@surgeapi/node 0.30.0 → 0.32.0

package/oidc/node_modules/npm/node_modules/pacote/README.md

@@ -1,283 +0,0 @@
-# pacote
-
-Fetches package manifests and tarballs from the npm registry.
-
-## USAGE
-
-```js
-const pacote = require('pacote')
-
-// get a package manifest
-pacote.manifest('foo@1.x').then(manifest => console.log('got it', manifest))
-
-// extract a package into a folder
-pacote.extract('github:npm/cli', 'some/path', options)
-  .then(({from, resolved, integrity}) => {
-    console.log('extracted!', from, resolved, integrity)
-  })
-
-pacote.tarball('https://server.com/package.tgz').then(data => {
-  console.log('got ' + data.length + ' bytes of tarball data')
-})
-```
-
-`pacote` works with any kind of package specifier that npm can install.  If
-you can pass it to the npm CLI, you can pass it to pacote.  (In fact, that's
-exactly what the npm CLI does.)
-
-Anything that you can do with one kind of package, you can do with another.
-
-Data that isn't relevant (like a packument for a tarball) will be
-simulated.
-
-`prepare` scripts will be run when generating tarballs from `git` and
-`directory` locations, to simulate what _would_ be published to the
-registry, so that you get a working package instead of just raw source
-code that might need to be transpiled.
-
-## CLI
-
-This module exports a command line interface that can do most of what is
-described below.  Run `pacote -h` to learn more.
-
-```
-Pacote - The JavaScript Package Handler, v10.1.1
-
-Usage:
-
-  pacote resolve <spec>
-    Resolve a specifier and output the fully resolved target
-    Returns integrity and from if '--long' flag is set.
-
-  pacote manifest <spec>
-    Fetch a manifest and print to stdout
-
-  pacote packument <spec>
-    Fetch a full packument and print to stdout
-
-  pacote tarball <spec> [<filename>]
-    Fetch a package tarball and save to <filename>
-    If <filename> is missing or '-', the tarball will be streamed to stdout.
-
-  pacote extract <spec> <folder>
-    Extract a package to the destination folder.
-
-Configuration values all match the names of configs passed to npm, or
-options passed to Pacote.  Additional flags for this executable:
-
-  --long     Print an object from 'resolve', including integrity and spec.
-  --json     Print result objects as JSON rather than node's default.
-             (This is the default if stdout is not a TTY.)
-  --help -h  Print this helpful text.
-
-For example '--cache=/path/to/folder' will use that folder as the cache.
-```
-
-## API
-
-The `spec` refers to any kind of package specifier that npm can install.
-If you can pass it to the npm CLI, you can pass it to pacote.  (In fact,
-that's exactly what the npm CLI does.)
-
-See below for valid `opts` values.
-
-* `pacote.resolve(spec, opts)` Resolve a specifier like `foo@latest` or
-  `github:user/project` all the way to a tarball url, tarball file, or git
-  repo with commit hash.
-
-* `pacote.extract(spec, dest, opts)` Extract a package's tarball into a
-  destination folder.  Returns a promise that resolves to the
-  `{from,resolved,integrity}` of the extracted package.
-
-* `pacote.manifest(spec, opts)` Fetch (or simulate) a package's manifest
-  (basically, the `package.json` file, plus a bit of metadata).
-  See below for more on manifests and packuments.  Returns a Promise that
-  resolves to the manifest object.
-
-* `pacote.packument(spec, opts)` Fetch (or simulate) a package's packument
-  (basically, the top-level package document listing all the manifests that
-  the registry returns).  See below for more on manifests and packuments.
-  Returns a Promise that resolves to the packument object.
-
-* `pacote.tarball(spec, opts)`  Get a package tarball data as a buffer in
-  memory.  Returns a Promise that resolves to the tarball data Buffer, with
-  `from`, `resolved`, and `integrity` fields attached.
-
-* `pacote.tarball.file(spec, dest, opts)`  Save a package tarball data to
-  a file on disk.  Returns a Promise that resolves to
-  `{from,integrity,resolved}` of the fetched tarball.
-
-* `pacote.tarball.stream(spec, streamHandler, opts)`  Fetch a tarball and
-  make the stream available to the `streamHandler` function.
-
-    This is mostly an internal function, but it is exposed because it does
-    provide some functionality that may be difficult to achieve otherwise.
-
-    The `streamHandler` function MUST return a Promise that resolves when
-    the stream (and all associated work) is ended, or rejects if the stream
-    has an error.
-
-    The `streamHandler` function MAY be called multiple times, as Pacote
-    retries requests in some scenarios, such as cache corruption or
-    retriable network failures.
-
-### Options
-
-Options are passed to
-[`npm-registry-fetch`](http://npm.im/npm-registry-fetch) and
-[`cacache`](http://npm.im/cacache), so in addition to these, anything for
-those modules can be given to pacote as well.
-
-Options object is cloned, and mutated along the way to add integrity,
-resolved, and other properties, as they are determined.
-
-* `cache` Where to store cache entries and temp files.  Passed to
-  [`cacache`](http://npm.im/cacache).  Defaults to the same cache directory
-  that npm will use by default, based on platform and environment.
-* `where` Base folder for resolving relative `file:` dependencies.
-* `resolved` Shortcut for looking up resolved values.  Should be specified
-  if known.
-* `integrity` Expected integrity of fetched package tarball.  If specified,
-  tarballs with mismatched integrity values will raise an `EINTEGRITY`
-  error.
-* `umask` Permission mode mask for extracted files and directories.
-  Defaults to `0o22`.  See "Extracted File Modes" below.
-* `fmode` Minimum permission mode for extracted files.  Defaults to
-  `0o666`.  See "Extracted File Modes" below.
-* `dmode` Minimum permission mode for extracted directories.  Defaults to
-  `0o777`.  See "Extracted File Modes" below.
-* `preferOnline` Prefer to revalidate cache entries, even when it would not
-  be strictly necessary.  Default `false`.
-* `before` When picking a manifest from a packument, only consider
-  packages published before the specified date.  Default `null`.
-* `defaultTag` The default `dist-tag` to use when choosing a manifest from a
-  packument.  Defaults to `latest`.
-* `registry` The npm registry to use by default.  Defaults to
-  `https://registry.npmjs.org/`.
-* `fullMetadata` Fetch the full metadata from the registry for packuments,
-  including information not strictly required for installation (author,
-  description, etc.)  Defaults to `true` when `before` is set, since the
-  version publish time is part of the extended packument metadata.
-* `fullReadJson` Use the slower `read-package-json` package insted of
-  `read-package-json-fast` in order to include extra fields like "readme" in
-  the manifest. Defaults to `false`.
-* `packumentCache` For registry packuments only, you may provide a `Map`
-  object which will be used to cache packument requests between pacote
-  calls.  This allows you to easily avoid hitting the registry multiple
-  times (even just to validate the cache) for a given packument, since it
-  is unlikely to change in the span of a single command.
-* `verifySignatures` A boolean that will make pacote verify the
-    integrity signature of a manifest, if present.  There must be a
-    configured `_keys` entry in the config that is scoped to the
-    registry the manifest is being fetched from.
-* `verifyAttestations` A boolean that will make pacote verify Sigstore
-    attestations, if present. There must be a configured `_keys` entry in the
-    config that is scoped to the registry the manifest is being fetched from.
-* `tufCache` Where to store metadata/target files when retrieving the package
-  attestation key material via TUF. Defaults to the same cache directory that
-  npm will use by default, based on platform and environment.
-
-### Advanced API
-
-Each different type of fetcher is exposed for more advanced usage such as
-using helper methods from this classes:
-
-* `DirFetcher`
-* `FileFetcher`
-* `GitFetcher`
-* `RegistryFetcher`
-* `RemoteFetcher`
-
-## Extracted File Modes
-
-Files are extracted with a mode matching the following formula:
-
-```
-( (tarball entry mode value) | (minimum mode option) ) ~ (umask)
-```
-
-This is in order to prevent unreadable files or unlistable directories from
-cluttering a project's `node_modules` folder, even if the package tarball
-specifies that the file should be inaccessible.
-
-It also prevents files from being group- or world-writable without explicit
-opt-in by the user, because all file and directory modes are masked against
-the `umask` value.
-
-So, a file which is `0o771` in the tarball, using the default `fmode` of
-`0o666` and `umask` of `0o22`, will result in a file mode of `0o755`:
-
-```
-(0o771 | 0o666) => 0o777
-(0o777 ~ 0o22) => 0o755
-```
-
-In almost every case, the defaults are appropriate.  To respect exactly
-what is in the package tarball (even if this makes an unusable system), set
-both `dmode` and `fmode` options to `0`.  Otherwise, the `umask` config
-should be used in most cases where file mode modifications are required,
-and this functions more or less the same as the `umask` value in most Unix
-systems.
-
-## Extracted File Ownership
-
-When running as `root` on Unix systems, all extracted files and folders
-will have their owning `uid` and `gid` values set to match the ownership
-of the containing folder.
-
-This prevents `root`-owned files showing up in a project's `node_modules`
-folder when a user runs `sudo npm install`.
-
-## Manifests
-
-A `manifest` is similar to a `package.json` file.  However, it has a few
-pieces of extra metadata, and sometimes lacks metadata that is inessential
-to package installation.
-
-In addition to the common `package.json` fields, manifests include:
-
-* `manifest._resolved` The tarball url or file path where the package
-  artifact can be found.
-* `manifest._from` A normalized form of the spec passed in as an argument.
-* `manifest._integrity` The integrity value for the package artifact.
-* `manifest._id` The canonical spec of this package version: name@version.
-* `manifest.dist` Registry manifests (those included in a packument) have a
-  `dist` object.  Only `tarball` is required, though at least one of
-  `shasum` or `integrity` is almost always present.
-
-    * `tarball` The url to the associated package artifact.  (Copied by
-      Pacote to `manifest._resolved`.)
-    * `integrity` The integrity SRI string for the artifact.  This may not
-      be present for older packages on the npm registry.  (Copied by Pacote
-      to `manifest._integrity`.)
-    * `shasum` Legacy integrity value.  Hexadecimal-encoded sha1 hash.
-      (Converted to an SRI string and copied by Pacote to
-      `manifest._integrity` when `dist.integrity` is not present.)
-    * `fileCount` Number of files in the tarball.
-    * `unpackedSize` Size on disk of the package when unpacked.
-    * `signatures` Signatures of the shasum.  Includes the keyid that
-        correlates to a [`key from the npm
-        registry`](https://registry.npmjs.org/-/npm/v1/keys)
-
-## Packuments
-
-A packument is the top-level package document that lists the set of
-manifests for available versions for a package.
-
-When a packument is fetched with `accept:
-application/vnd.npm.install-v1+json` in the HTTP headers, only the most
-minimum necessary metadata is returned.  Additional metadata is returned
-when fetched with only `accept: application/json`.
-
-For Pacote's purposes, the following fields are relevant:
-
-* `versions` An object where each key is a version, and each value is the
-  manifest for that version.
-* `dist-tags` An object mapping dist-tags to version numbers.  This is how
-  `foo@latest` gets turned into `foo@1.2.3`.
-* `time` In the full packument, an object mapping version numbers to
-  publication times, for the `opts.before` functionality.
-
-Pacote adds the following field, regardless of the accept header:
-
-* `_contentLength` The size of the packument.

package/oidc/node_modules/npm/node_modules/pacote/bin/index.js

@@ -1,158 +0,0 @@
-#!/usr/bin/env node
-
-const run = conf => {
-  const pacote = require('../')
-  switch (conf._[0]) {
-    case 'resolve':
-    case 'manifest':
-    case 'packument':
-      if (conf._[0] === 'resolve' && conf.long) {
-        return pacote.manifest(conf._[1], conf).then(mani => ({
-          resolved: mani._resolved,
-          integrity: mani._integrity,
-          from: mani._from,
-        }))
-      }
-      return pacote[conf._[0]](conf._[1], conf)
-
-    case 'tarball':
-      if (!conf._[2] || conf._[2] === '-') {
-        return pacote.tarball.stream(conf._[1], stream => {
-          stream.pipe(
-            conf.testStdout ||
-            /* istanbul ignore next */
-            process.stdout
-          )
-          // make sure it resolves something falsey
-          return stream.promise().then(() => {
-            return false
-          })
-        }, conf)
-      } else {
-        return pacote.tarball.file(conf._[1], conf._[2], conf)
-      }
-
-    case 'extract':
-      return pacote.extract(conf._[1], conf._[2], conf)
-
-    default: /* istanbul ignore next */ {
-      throw new Error(`bad command: ${conf._[0]}`)
-    }
-  }
-}
-
-const version = require('../package.json').version
-const usage = () =>
-`Pacote - The JavaScript Package Handler, v${version}
-
-Usage:
-
-  pacote resolve <spec>
-    Resolve a specifier and output the fully resolved target
-    Returns integrity and from if '--long' flag is set.
-
-  pacote manifest <spec>
-    Fetch a manifest and print to stdout
-
-  pacote packument <spec>
-    Fetch a full packument and print to stdout
-
-  pacote tarball <spec> [<filename>]
-    Fetch a package tarball and save to <filename>
-    If <filename> is missing or '-', the tarball will be streamed to stdout.
-
-  pacote extract <spec> <folder>
-    Extract a package to the destination folder.
-
-Configuration values all match the names of configs passed to npm, or
-options passed to Pacote.  Additional flags for this executable:
-
-  --long     Print an object from 'resolve', including integrity and spec.
-  --json     Print result objects as JSON rather than node's default.
-             (This is the default if stdout is not a TTY.)
-  --help -h  Print this helpful text.
-
-For example '--cache=/path/to/folder' will use that folder as the cache.
-`
-
-const shouldJSON = (conf, result) =>
-  conf.json ||
-  !process.stdout.isTTY &&
-  conf.json === undefined &&
-  result &&
-  typeof result === 'object'
-
-const pretty = (conf, result) =>
-  shouldJSON(conf, result) ? JSON.stringify(result, 0, 2) : result
-
-let addedLogListener = false
-const main = args => {
-  const conf = parse(args)
-  if (conf.help || conf.h) {
-    return console.log(usage())
-  }
-
-  if (!addedLogListener) {
-    process.on('log', console.error)
-    addedLogListener = true
-  }
-
-  try {
-    return run(conf)
-      .then(result => result && console.log(pretty(conf, result)))
-      .catch(er => {
-        console.error(er)
-        process.exit(1)
-      })
-  } catch (er) {
-    console.error(er.message)
-    console.error(usage())
-  }
-}
-
-const parseArg = arg => {
-  const split = arg.slice(2).split('=')
-  const k = split.shift()
-  const v = split.join('=')
-  const no = /^no-/.test(k) && !v
-  const key = (no ? k.slice(3) : k)
-    .replace(/^tag$/, 'defaultTag')
-    .replace(/-([a-z])/g, (_, c) => c.toUpperCase())
-  const value = v ? v.replace(/^~/, process.env.HOME) : !no
-  return { key, value }
-}
-
-const parse = args => {
-  const conf = {
-    _: [],
-    cache: process.env.HOME + '/.npm/_cacache',
-  }
-  let dashdash = false
-  args.forEach(arg => {
-    if (dashdash) {
-      conf._.push(arg)
-    } else if (arg === '--') {
-      dashdash = true
-    } else if (arg === '-h') {
-      conf.help = true
-    } else if (/^--/.test(arg)) {
-      const { key, value } = parseArg(arg)
-      conf[key] = value
-    } else {
-      conf._.push(arg)
-    }
-  })
-  return conf
-}
-
-if (module === require.main) {
-  main(process.argv.slice(2))
-} else {
-  module.exports = {
-    main,
-    run,
-    usage,
-    parseArg,
-    parse,
-  }
-}

package/oidc/node_modules/npm/node_modules/pacote/lib/dir.js

@@ -1,105 +0,0 @@
-const { resolve } = require('node:path')
-const packlist = require('npm-packlist')
-const runScript = require('@npmcli/run-script')
-const tar = require('tar')
-const { Minipass } = require('minipass')
-const Fetcher = require('./fetcher.js')
-const FileFetcher = require('./file.js')
-const _ = require('./util/protected.js')
-const tarCreateOptions = require('./util/tar-create-options.js')
-
-class DirFetcher extends Fetcher {
-  constructor (spec, opts) {
-    super(spec, opts)
-    // just the fully resolved filename
-    this.resolved = this.spec.fetchSpec
-
-    this.tree = opts.tree || null
-    this.Arborist = opts.Arborist || null
-  }
-
-  // exposes tarCreateOptions as public API
-  static tarCreateOptions (manifest) {
-    return tarCreateOptions(manifest)
-  }
-
-  get types () {
-    return ['directory']
-  }
-
-  #prepareDir () {
-    return this.manifest().then(mani => {
-      if (!mani.scripts || !mani.scripts.prepare) {
-        return
-      }
-      if (this.opts.ignoreScripts) {
-        return
-      }
-
-      // we *only* run prepare.
-      // pre/post-pack is run by the npm CLI for publish and pack,
-      // but this function is *also* run when installing git deps
-      const stdio = this.opts.foregroundScripts ? 'inherit' : 'pipe'
-
-      return runScript({
-        // this || undefined is because runScript will be unhappy with the default null value
-        scriptShell: this.opts.scriptShell || undefined,
-        pkg: mani,
-        event: 'prepare',
-        path: this.resolved,
-        stdio,
-        env: {
-          npm_package_resolved: this.resolved,
-          npm_package_integrity: this.integrity,
-          npm_package_json: resolve(this.resolved, 'package.json'),
-        },
-      })
-    })
-  }
-
-  [_.tarballFromResolved] () {
-    if (!this.tree && !this.Arborist) {
-      throw new Error('DirFetcher requires either a tree or an Arborist constructor to pack')
-    }
-
-    const stream = new Minipass()
-    stream.resolved = this.resolved
-    stream.integrity = this.integrity
-
-    const { prefix, workspaces } = this.opts
-
-    // run the prepare script, get the list of files, and tar it up
-    // pipe to the stream, and proxy errors the chain.
-    this.#prepareDir()
-      .then(async () => {
-        if (!this.tree) {
-          const arb = new this.Arborist({ path: this.resolved })
-          this.tree = await arb.loadActual()
-        }
-        return packlist(this.tree, { path: this.resolved, prefix, workspaces })
-      })
-      .then(files => tar.c(tarCreateOptions(this.package), files)
-        .on('error', er => stream.emit('error', er)).pipe(stream))
-      .catch(er => stream.emit('error', er))
-    return stream
-  }
-
-  manifest () {
-    if (this.package) {
-      return Promise.resolve(this.package)
-    }
-
-    return this[_.readPackageJson](this.resolved)
-      .then(mani => this.package = {
-        ...mani,
-        _integrity: this.integrity && String(this.integrity),
-        _resolved: this.resolved,
-        _from: this.from,
-      })
-  }
-
-  packument () {
-    return FileFetcher.prototype.packument.apply(this)
-  }
-}
-module.exports = DirFetcher