@verdaccio/store 6.0.0-6-next.21 → 6.0.0-6-next.24

package/build/storage.js

@@ -3,15 +3,19 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.Storage = void 0;
+exports.resourceNotAvailable = exports.noSuchFile = exports.Storage = exports.PROTO_NAME = void 0;
 
 var _assert = _interopRequireDefault(require("assert"));
 
-var _async = _interopRequireDefault(require("async"));
-
 var _debug = _interopRequireDefault(require("debug"));
 
-var _lodash = _interopRequireDefault(require("lodash"));
+var _lodash = _interopRequireWildcard(require("lodash"));
+
+var _stream = require("stream");
+
+var _promises = require("stream/promises");
+
+var _url = _interopRequireDefault(require("url"));
 
 var _config = require("@verdaccio/config");
 
@@ -21,385 +25,443 @@ var _logger = require("@verdaccio/logger");
 
 var _proxy = require("@verdaccio/proxy");
 
-var _streams = require("@verdaccio/streams");
-
 var _tarball = require("@verdaccio/tarball");
 
 var _utils = require("@verdaccio/utils");
 
-var _localStorage = require("./local-storage");
+var _2 = require(".");
+
+var _TransFormResults = require("./lib/TransFormResults");
+
+var _searchUtils = require("./lib/search-utils");
 
-var _search = require("./search");
+var _starUtils = require("./lib/star-utils");
 
-var _storageUtils = require("./storage-utils");
+var _storageUtils = require("./lib/storage-utils");
 
-var _uplinkUtil = require("./uplink-util");
+var _uplinkUtil = require("./lib/uplink-util");
+
+var _versionsUtils = require("./lib/versions-utils");
+
+var _localStorage = require("./local-storage");
+
+function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function (nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }
+
+function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
-// import { isPublishablePackage, validateInputs } from './star-utils';
-// import { StarBody, Users } from './type';
 const debug = (0, _debug.default)('verdaccio:storage');
+const noSuchFile = 'ENOENT';
+exports.noSuchFile = noSuchFile;
+const resourceNotAvailable = 'EAGAIN';
+exports.resourceNotAvailable = resourceNotAvailable;
+const PROTO_NAME = '__proto__';
+exports.PROTO_NAME = PROTO_NAME;
 
 class Storage {
   constructor(config) {
     this.config = config;
     this.uplinks = (0, _uplinkUtil.setupUpLinks)(config);
-    debug('uplinks available %o', Object.keys(this.uplinks));
     this.logger = _logger.logger.child({
       module: 'storage'
     });
     this.filters = []; // @ts-ignore
 
     this.localStorage = null;
-    this.searchManager = null;
+    debug('uplinks available %o', Object.keys(this.uplinks));
   }
 
-  async init(config, filters = []) {
-    if (this.localStorage === null) {
-      this.filters = filters || [];
-      debug('filters available %o', filters);
-      this.localStorage = new _localStorage.LocalStorage(this.config, _logger.logger);
-      await this.localStorage.init();
-      debug('local init storage initialized');
-      await this.localStorage.getSecret(config);
-      debug('local storage secret initialized');
-      this.searchManager = new _search.SearchManager(this.uplinks, this.localStorage);
-    } else {
-      debug('storage has been already initialized');
-    }
-
-    return;
-  }
+  static ABBREVIATED_HEADER = 'application/vnd.npm.install-v1+json; q=1.0, application/json; q=0.8, */*';
   /**
-   *  Add a {name} package to a system
-   Function checks if package with the same name is available from uplinks.
-   If it isn't, we create package locally
-   Used storages: local (write) && uplinks
+   * Change an existing package (i.e. unpublish one version)
+   Function changes a package info from local storage and all uplinks with write access./
+   Used storages: local (write)
    */
 
+  async changePackageNext(name, metadata, revision) {
+    debug('change existing package for package %o revision %o', name, revision);
+    debug(`change manifest tags for %o revision %s`, name, revision);
 
-  async addPackage(name, metadata, callback) {
-    try {
-      debug('add package for %o', name);
-      await (0, _storageUtils.checkPackageLocal)(name, this.localStorage);
-      debug('look up remote for %o', name);
-      await (0, _storageUtils.checkPackageRemote)(name, this._isAllowPublishOffline(), this._syncUplinksMetadata.bind(this));
-      debug('publishing a package for %o', name);
-      await (0, _storageUtils.publishPackage)(name, metadata, this.localStorage); // TODO: return published data and replace callback by a promise
-
-      callback(null, true);
-    } catch (err) {
-      debug('error on add a package for %o with error %o', name, err);
-      callback(err);
+    if (!_core.validatioUtils.isObject(metadata.versions) || !_core.validatioUtils.isObject(metadata[_core.DIST_TAGS])) {
+      debug(`change manifest bad data for %o`, name);
+      throw _core.errorUtils.getBadData();
     }
-  }
-  /**
-   * Add a {name} package to a system
-   Function checks if package with the same name is available from uplinks.
-   If it isn't, we create package locally
-   Used storages: local (write) && uplinks
-   */
 
+    debug(`change manifest udapting manifest for %o`, name);
+    await this.updatePackageNext(name, async localData => {
+      // eslint-disable-next-line guard-for-in
+      for (const version in localData.versions) {
+        const incomingVersion = metadata.versions[version];
 
-  async addPackageNext(name, metadata) {
-    try {
-      debug('add package for %o', name);
-      await (0, _storageUtils.checkPackageLocal)(name, this.localStorage);
-      debug('look up remote for %o', name);
-      await (0, _storageUtils.checkPackageRemote)(name, this._isAllowPublishOffline(), this._syncUplinksMetadata.bind(this));
-      debug('publishing a package for %o', name); // FIXME: publishPackage should return fresh metadata from backend
-      // instead return metadata
-
-      await (0, _storageUtils.publishPackage)(name, metadata, this.localStorage);
-      return metadata;
-    } catch (err) {
-      debug('error on add a package for %o with error %o', name, err);
-      throw err;
-    }
-  }
+        if (_lodash.default.isNil(incomingVersion)) {
+          this.logger.info({
+            name: name,
+            version: version
+          }, 'unpublishing @{name}@@{version}'); // FIXME: I prefer return a new object rather mutate the metadata
 
-  _isAllowPublishOffline() {
-    return typeof this.config.publish !== 'undefined' && _lodash.default.isBoolean(this.config.publish.allow_offline) && this.config.publish.allow_offline;
-  }
+          delete localData.versions[version];
+          delete localData.time[version];
 
-  readTokens(filter) {
-    return this.localStorage.readTokens(filter);
-  }
+          for (const file in localData._attachments) {
+            if (localData._attachments[file].version === version) {
+              delete localData._attachments[file].version;
+            }
+          }
+        } else if (Object.prototype.hasOwnProperty.call(incomingVersion, 'deprecated')) {
+          const incomingDeprecated = incomingVersion.deprecated;
+
+          if (incomingDeprecated != localData.versions[version].deprecated) {
+            if (!incomingDeprecated) {
+              this.logger.info({
+                name: name,
+                version: version
+              }, 'undeprecating @{name}@@{version}');
+              delete localData.versions[version].deprecated;
+            } else {
+              this.logger.info({
+                name: name,
+                version: version
+              }, 'deprecating @{name}@@{version}');
+              localData.versions[version].deprecated = incomingDeprecated;
+            }
 
-  saveToken(token) {
-    return this.localStorage.saveToken(token);
+            localData.time.modified = new Date().toISOString();
+          }
+        }
+      }
+
+      localData[_core.USERS] = metadata[_core.USERS];
+      localData[_core.DIST_TAGS] = metadata[_core.DIST_TAGS];
+      return localData;
+    });
   }
 
-  deleteToken(user, tokenKey) {
-    return this.localStorage.deleteToken(user, tokenKey);
+  async removePackage(name, revision) {
+    debug('remove package %o', name);
+    await this.removePackageByRevision(name, revision);
   }
   /**
-   * Add a new version of package {name} to a system
-   Used storages: local (write)
+   Remove a tarball from a system
+   Function removes a tarball from local storage.
+   Tarball in question should not be linked to in any existing
+   versions, i.e. package version should be unpublished first.
+   Used storage: local (write)
    */
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
 
 
-  addVersion(name, version, metadata, tag, callback) {
-    debug('add the version %o for package %o', version, name);
-    this.localStorage.addVersion(name, version, metadata, tag, callback);
-  }
+  async removeTarball(name, filename, _revision) {
+    debug('remove tarball %s for %s', filename, name);
+    (0, _assert.default)(_core.validatioUtils.validateName(filename));
+    const storage = this.getPrivatePackageStorage(name);
 
-  async addVersionNext(name, version, metadata, tag) {
-    debug('add the version %o for package %o', version, name);
-    return this.localStorage.addVersionNext(name, version, metadata, tag);
-  }
-  /**
-   * Tags a package version with a provided tag
-   Used storages: local (write)
-   */
+    if (!storage) {
+      debug(`method not implemented for storage`);
+      this.logger.error('method for remove tarball not implemented');
+      throw _core.errorUtils.getInternalError(_core.API_ERROR.INTERNAL_SERVER_ERROR);
+    }
 
+    try {
+      const cacheManifest = await storage.readPackage(name);
 
-  mergeTags(name, tagHash, callback) {
-    debug('merge tags for package %o tags %o', name, tagHash);
-    this.localStorage.mergeTags(name, tagHash, callback);
-  }
-  /**
-   * Change an existing package (i.e. unpublish one version)
-   Function changes a package info from local storage and all uplinks with write access./
-   Used storages: local (write)
-   */
+      if (!cacheManifest._attachments[filename]) {
+        throw _core.errorUtils.getNotFound('no such file available');
+      }
+    } catch (err) {
+      if (err.code === noSuchFile) {
+        throw _core.errorUtils.getNotFound();
+      }
 
+      throw err;
+    }
 
-  changePackage(name, metadata, revision, callback) {
-    debug('change existing package for package %o revision %o', name, revision);
-    this.localStorage.changePackage(name, metadata, revision, callback);
-  }
-  /**
-   * Change an existing package (i.e. unpublish one version)
-   Function changes a package info from local storage and all uplinks with write access./
-   Used storages: local (write)
-   */
+    const manifest = await this.updatePackageNext(name, async data => {
+      let newData = { ...data
+      };
+      delete data._attachments[filename];
+      return newData;
+    });
 
+    try {
+      const storage = this.getPrivatePackageStorage(name);
 
-  async changePackageNext(name, metadata, revision) {
-    debug('change existing package for package %o revision %o', name, revision);
-    this.localStorage.changePackageNext(name, metadata, revision);
-  }
-  /**
-   * Remove a package from a system
-   Function removes a package from local storage
-   Used storages: local (write)
-   */
+      if (!storage) {
+        debug(`method not implemented for storage`);
+        this.logger.error('method for remove tarball not implemented');
+        throw _core.errorUtils.getInternalError(_core.API_ERROR.INTERNAL_SERVER_ERROR);
+      }
 
+      await storage.deletePackage(filename);
+      debug('package %s removed', filename);
+    } catch (err) {
+      this.logger.error({
+        err
+      }, 'error removing %s from storage');
+      throw err;
+    }
 
-  async removePackage(name) {
-    debug('remove packagefor package %o', name);
-    await this.localStorage.removePackage(name);
+    return manifest;
   }
   /**
-   Remove a tarball from a system
-   Function removes a tarball from local storage.
-   Tarball in question should not be linked to in any existing
-   versions, i.e. package version should be unpublished first.
-   Used storage: local (write)
+   * Handle search on packages and proxies.
+   * Iterate all proxies configured and search in all endpoints in v2 and pipe all responses
+   * to a stream, once the proxies request has finished search in local storage for all packages
+   * (privated and cached).
    */
 
 
-  removeTarball(name, filename, revision, callback) {
-    this.localStorage.removeTarball(name, filename, revision, callback);
-  }
-  /**
-   * Upload a tarball for {name} package
-   Function is synchronous and returns a WritableStream
-   Used storages: local (write)
-   */
+  async search(options) {
+    const transformResults = new _TransFormResults.TransFormResults({
+      objectMode: true
+    });
+    const streamPassThrough = new _stream.PassThrough({
+      objectMode: true
+    });
+    const upLinkList = this.getProxyList();
+    const searchUplinksStreams = upLinkList.map(uplinkId => {
+      const uplink = this.uplinks[uplinkId];
+
+      if (!uplink) {
+        // this should never tecnically happens
+        this.logger.error({
+          uplinkId
+        }, 'uplink @upLinkId not found');
+      }
+
+      return this.consumeSearchStream(uplinkId, uplink, options, streamPassThrough);
+    });
 
+    try {
+      debug('search uplinks'); // we only process those streams end successfully, if all fails
+      // we just include local storage
+
+      await Promise.allSettled([...searchUplinksStreams]);
+      debug('search uplinks done');
+    } catch (err) {
+      this.logger.error({
+        err: err === null || err === void 0 ? void 0 : err.message
+      }, ' error on uplinks search @{err}');
+      streamPassThrough.emit('error', err);
+    }
+
+    debug('search local');
+
+    try {
+      await this.searchCachedPackages(streamPassThrough, options.query);
+    } catch (err) {
+      this.logger.error({
+        err: err === null || err === void 0 ? void 0 : err.message
+      }, ' error on local search @{err}');
+      streamPassThrough.emit('error', err);
+    }
 
-  addTarball(name, filename) {
-    debug('add tarball for package %o', name);
-    return this.localStorage.addTarball(name, filename);
+    const data = [];
+    const outPutStream = new _stream.PassThrough({
+      objectMode: true
+    });
+    (0, _stream.pipeline)(streamPassThrough, transformResults, outPutStream, err => {
+      if (err) {
+        this.logger.error({
+          err: err === null || err === void 0 ? void 0 : err.message
+        }, ' error on search @{err}');
+        throw _core.errorUtils.getInternalError(err ? err.message : 'unknown search error');
+      } else {
+        debug('pipeline succeeded');
+      }
+    });
+    outPutStream.on('data', chunk => {
+      data.push(chunk);
+    });
+    return new Promise(resolve => {
+      outPutStream.on('finish', async () => {
+        const searchFinalResults = (0, _searchUtils.removeDuplicates)(data);
+        debug('search stream total results: %o', searchFinalResults.length);
+        return resolve(searchFinalResults);
+      });
+      debug('search done');
+    });
   }
-  /**
-   Get a tarball from a storage for {name} package
-   Function is synchronous and returns a ReadableStream
-   Function tries to read tarball locally, if it fails then it reads package
-   information in order to figure out where we can get this tarball from
-   Used storages: local || uplink (just one)
-   */
 
+  async getTarballFromUpstream(name, filename, {
+    signal
+  }) {
+    var _cachedManifest, _cachedManifest2, _cachedManifest2$_dis;
 
-  getTarball(name, filename) {
-    debug('get tarball for package %o filename %o', name, filename);
-    const readStream = new _streams.ReadTarball({});
+    let cachedManifest = null;
 
-    readStream.abort = function () {};
+    try {
+      cachedManifest = await this.getPackageLocalMetadata(name);
+    } catch (err) {
+      debug('error on get package local metadata %o', err);
+    } // dist url should be on local cache metadata
 
-    const self = this; // if someone requesting tarball, it means that we should already have some
-    // information about it, so fetching package info is unnecessary
-    // trying local first
-    // flow: should be IReadTarball
 
-    let localStream = self.localStorage.getTarball(name, filename);
-    let isOpen = false;
-    localStream.on('error', err => {
-      if (isOpen || err.status !== _core.HTTP_STATUS.NOT_FOUND) {
-        return readStream.emit('error', err);
-      } // local reported 404
-
-
-      const err404 = err;
-      localStream.abort();
-      localStream = null; // we force for garbage collector
-
-      self.localStorage.getPackageMetadata(name, (err, info) => {
-        if (_lodash.default.isNil(err) && info._distfiles && _lodash.default.isNil(info._distfiles[filename]) === false) {
-          // information about this file exists locally
-          serveFile(info._distfiles[filename]);
-        } else {
-          // we know nothing about this file, trying to get information elsewhere
-          self._syncUplinksMetadata(name, info, {}, (err, info) => {
-            if (_lodash.default.isNil(err) === false) {
-              return readStream.emit('error', err);
-            }
+    if ((_cachedManifest = cachedManifest) !== null && _cachedManifest !== void 0 && _cachedManifest._distfiles && typeof ((_cachedManifest2 = cachedManifest) === null || _cachedManifest2 === void 0 ? void 0 : (_cachedManifest2$_dis = _cachedManifest2._distfiles[filename]) === null || _cachedManifest2$_dis === void 0 ? void 0 : _cachedManifest2$_dis.url) === 'string') {
+      var _cachedManifest3;
 
-            if (_lodash.default.isNil(info._distfiles) || _lodash.default.isNil(info._distfiles[filename])) {
-              return readStream.emit('error', err404);
-            }
+      debug('dist file found, using it %o', (_cachedManifest3 = cachedManifest) === null || _cachedManifest3 === void 0 ? void 0 : _cachedManifest3._distfiles[filename].url); // dist file found, proceed to download
 
-            serveFile(info._distfiles[filename]);
-          });
+      const distFile = cachedManifest._distfiles[filename];
+      let current_length = 0;
+      let expected_length;
+      const passThroughRemoteStream = new _stream.PassThrough();
+      const proxy = this.getUpLinkForDistFile(name, distFile);
+      const remoteStream = proxy.fetchTarballNext(distFile.url, {});
+      remoteStream.on('request', async () => {
+        try {
+          debug('remote stream request');
+          const storage = this.getPrivatePackageStorage(name);
+
+          if (proxy.config.cache === true && storage) {
+            const localStorageWriteStream = await storage.writeTarball(filename, {
+              signal
+            });
+            await (0, _promises.pipeline)(remoteStream, passThroughRemoteStream, localStorageWriteStream, {
+              signal
+            });
+          } else {
+            await (0, _promises.pipeline)(remoteStream, passThroughRemoteStream, {
+              signal
+            });
+          }
+        } catch (err) {
+          debug('error on pipeline downloading tarball for package %o', name);
+          passThroughRemoteStream.emit('error', err);
         }
       });
-    });
-    localStream.on('content-length', function (v) {
-      readStream.emit('content-length', v);
-    });
-    localStream.on('open', function () {
-      isOpen = true;
-      localStream.pipe(readStream);
-    });
-    return readStream;
-    /**
-     * Fetch and cache local/remote packages.
-     * @param {Object} file define the package shape
-     */
-
-    function serveFile(file) {
-      let uplink = null;
-
-      for (const uplinkId in self.uplinks) {
-        // https://github.com/verdaccio/verdaccio/issues/1642
-        if ((0, _config.hasProxyTo)(name, uplinkId, self.config.packages)) {
-          uplink = self.uplinks[uplinkId];
+      remoteStream.on('response', async res => {
+        if (res.statusCode === _core.HTTP_STATUS.NOT_FOUND) {
+          debug('remote stream response 404');
+          passThroughRemoteStream.emit('error', _core.errorUtils.getNotFound(_core.errorUtils.API_ERROR.NOT_FILE_UPLINK));
+          return;
         }
-      }
 
-      if (uplink == null) {
-        uplink = new _proxy.ProxyStorage({
-          url: file.url,
-          cache: true,
-          _autogenerated: true
-        }, self.config);
-      }
+        if (!(res.statusCode >= _core.HTTP_STATUS.OK && res.statusCode < _core.HTTP_STATUS.MULTIPLE_CHOICES)) {
+          debug('remote stream response ok');
+          passThroughRemoteStream.emit('error', _core.errorUtils.getInternalError(`bad uplink status code: ${res.statusCode}`));
+          return;
+        }
 
-      let savestream = null;
+        if (res.headers[_core.HEADER_TYPE.CONTENT_LENGTH]) {
+          expected_length = res.headers[_core.HEADER_TYPE.CONTENT_LENGTH];
+          debug('remote stream response content length %o', expected_length);
+          passThroughRemoteStream.emit(_core.HEADER_TYPE.CONTENT_LENGTH, res.headers[_core.HEADER_TYPE.CONTENT_LENGTH]);
+        }
+      }).on('downloadProgress', progress => {
+        current_length = progress.transferred;
 
-      if (uplink.config.cache) {
-        savestream = self.localStorage.addTarball(name, filename);
-      }
+        if (typeof expected_length === 'undefined' && progress.total) {
+          expected_length = progress.total;
+        }
+      }).on('end', () => {
+        if (expected_length && current_length != expected_length) {
+          debug('stream end, but length mismatch %o %o', current_length, expected_length);
+          passThroughRemoteStream.emit('error', _core.errorUtils.getInternalError(_core.API_ERROR.CONTENT_MISMATCH));
+        }
 
-      let on_open = function () {
-        // prevent it from being called twice
-        on_open = function () {};
+        debug('remote stream end');
+      }).on('error', err => {
+        debug('remote stream error %o', err);
+        passThroughRemoteStream.emit('error', err);
+      });
+      return passThroughRemoteStream;
+    } else {
+      debug('dist file not found, proceed update upstream'); // no dist url found, proceed to fetch from upstream
+      // should not be the case
 
-        const rstream2 = uplink.fetchTarball(file.url);
-        rstream2.on('error', function (err) {
-          if (savestream) {
-            savestream.abort();
-          }
+      const passThroughRemoteStream = new _stream.PassThrough(); // ensure get the latest data
 
-          savestream = null;
-          readStream.emit('error', err);
-        });
-        rstream2.on('end', function () {
-          if (savestream) {
-            savestream.done();
-          }
-        });
-        rstream2.on('content-length', function (v) {
-          readStream.emit('content-length', v);
+      const [updatedManifest] = await this.syncUplinksMetadataNext(name, cachedManifest, {
+        uplinksLook: true
+      });
+      const distFile = updatedManifest._distfiles[filename];
 
-          if (savestream) {
-            savestream.emit('content-length', v);
-          }
-        });
-        rstream2.pipe(readStream);
+      if (updatedManifest === null || !distFile) {
+        debug('remote tarball not found');
+        throw _core.errorUtils.getNotFound(_core.API_ERROR.NO_SUCH_FILE);
+      }
 
-        if (savestream) {
-          rstream2.pipe(savestream);
+      const proxy = this.getUpLinkForDistFile(name, distFile);
+      const remoteStream = proxy.fetchTarballNext(distFile.url, {});
+      remoteStream.on('response', async () => {
+        try {
+          const storage = this.getPrivatePackageStorage(name);
+
+          if (proxy.config.cache === true && storage) {
+            debug('cache remote tarball enabled');
+            const localStorageWriteStream = await storage.writeTarball(filename, {
+              signal
+            });
+            await (0, _promises.pipeline)(remoteStream, passThroughRemoteStream, localStorageWriteStream, {
+              signal
+            });
+          } else {
+            debug('cache remote tarball disabled');
+            await (0, _promises.pipeline)(remoteStream, passThroughRemoteStream, {
+              signal
+            });
+          }
+        } catch (err) {
+          debug('error on pipeline downloading tarball for package %o', name);
+          passThroughRemoteStream.emit('error', err);
         }
-      };
+      });
+      return passThroughRemoteStream;
+    }
+  }
+  /**
+   *
+   * @param name
+   * @param filename
+   * @param param2
+   * @returns
+   */
 
-      if (savestream) {
-        savestream.on('open', function () {
-          on_open();
-        });
-        savestream.on('error', function (err) {
-          self.logger.warn({
-            err: err,
-            fileName: file
-          }, 'error saving file @{fileName}: @{err?.message}\n@{err.stack}');
-
-          if (savestream) {
-            savestream.abort();
-          }
 
-          savestream = null;
-          on_open();
+  async getTarballNext(name, filename, {
+    signal
+  }) {
+    debug('get tarball for package %o filename %o', name, filename); // TODO: check if isOpen is need it after all.
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+
+    let isOpen = false;
+    const localTarballStream = new _stream.PassThrough();
+    const localStream = await this.getLocalTarball(name, filename, {
+      signal
+    });
+    localStream.on('open', async () => {
+      // eslint-disable-next-line @typescript-eslint/no-unused-vars
+      isOpen = true;
+      await (0, _promises.pipeline)(localStream, localTarballStream, {
+        signal
+      });
+    });
+    localStream.on('error', err => {
+      // eslint-disable-next-line no-console
+      if (err.code === _storageUtils.STORAGE.NO_SUCH_FILE_ERROR || err.code === _core.HTTP_STATUS.NOT_FOUND) {
+        this.getTarballFromUpstream(name, filename, {
+          signal
+        }).then(uplinkStream => {
+          (0, _promises.pipeline)(uplinkStream, localTarballStream, {
+            signal
+          }).then(() => {
+            debug('successfully downloaded tarball for package %o filename %o', name, filename);
+          }).catch(err => {
+            localTarballStream.emit('error', err);
+          });
+        }).catch(err => {
+          localTarballStream.emit('error', err);
         });
       } else {
-        on_open();
-      }
-    }
-  } // public async starPackage(body: StarBody, options: IGetPackageOptionsNext): Promise<void> {
-  //   debug('star package');
-  //   const manifest = await this.getPackageNext(options);
-  //   const newStarUser = body[constants.USERS];
-  //   const remoteUsername: string = options.remoteUser.name as string;
-  //   const localStarUsers = manifest[constants.USERS];
-  //   // Check is star or unstar
-  //   const isStar = Object.keys(newStarUser).includes(remoteUsername);
-  //   debug('is start? %o', isStar);
-  //   if (
-  //     _.isNil(localStarUsers) === false &&
-  //     validateInputs(localStarUsers, remoteUsername, isStar)
-  //   ) {
-  //     // return afterChangePackage();
-  //   }
-  //   const users: Users = isStar
-  //     ? {
-  //         ...localStarUsers,
-  //         [remoteUsername]: true,
-  //       }
-  //     : _.reduce(
-  //         localStarUsers,
-  //         (users, value, key) => {
-  //           if (key !== remoteUsername) {
-  //             users[key] = value;
-  //           }
-  //           return users;
-  //         },
-  //         {}
-  //       );
-  //   debug('update package for  %o', name);
-  // }
-  // public async publish(body: any, options: IGetPackageOptionsNext): Promise<any> {
-  //   const { name } = options;
-  //   debug('publishing or updating a new version for %o', name);
-  //   // we check if the request is npm star
-  //   if (!isPublishablePackage(body) && isObject(body.users)) {
-  //     debug('starting star a package');
-  //     await this.starPackage(body as StarBody, options);
-  //   }
-  //   return { ok: API_MESSAGE.PKG_CHANGED, success: true };
-  // }
-
+        this.logger.error({
+          err: err.message
+        }, 'some error on fatal @{err}');
+        localTarballStream.emit('error', err);
+      }
+    });
+    return localTarballStream;
+  }
 
   async getPackageByVersion(options) {
     const queryVersion = options.version;
@@ -410,7 +472,7 @@ class Storage {
 
 
     const [convertedManifest] = await this.getPackageNext(options);
-    const version = (0, _utils.getVersion)(convertedManifest.versions, queryVersion);
+    const version = (0, _versionsUtils.getVersion)(convertedManifest.versions, queryVersion);
     debug('query by latest version %o and result %o', queryVersion, version);
 
     if (typeof version !== 'undefined') {
@@ -425,7 +487,7 @@ class Storage {
         // the version found as a distag
         const matchedDisTagVersion = convertedManifest[_core.DIST_TAGS][queryVersion];
         debug('dist-tag version found %o', matchedDisTagVersion);
-        const disTagVersion = (0, _utils.getVersion)(convertedManifest.versions, matchedDisTagVersion);
+        const disTagVersion = (0, _versionsUtils.getVersion)(convertedManifest.versions, matchedDisTagVersion);
 
         if (typeof disTagVersion !== 'undefined') {
           debug('dist-tag found %o', disTagVersion);
@@ -447,6 +509,44 @@ class Storage {
     const convertedManifest = (0, _tarball.convertDistRemoteToLocalTarballUrls)(manifest, options.requestOptions, this.config.url_prefix);
     return convertedManifest;
   }
+
+  convertAbbreviatedManifest(manifest) {
+    const abbreviatedVersions = Object.keys(manifest.versions).reduce((acc, version) => {
+      const _version = manifest.versions[version]; // This should be align with this document
+      // https://github.com/npm/registry/blob/master/docs/responses/package-metadata.md#abbreviated-version-object
+
+      const _version_abbreviated = {
+        name: _version.name,
+        version: _version.version,
+        description: _version.description,
+        deprecated: _version.deprecated,
+        bin: _version.bin,
+        dist: _version.dist,
+        engines: _version.engines,
+        funding: _version.funding,
+        directories: _version.directories,
+        dependencies: _version.dependencies,
+        devDependencies: _version.devDependencies,
+        peerDependencies: _version.peerDependencies,
+        optionalDependencies: _version.optionalDependencies,
+        bundleDependencies: _version.bundleDependencies,
+        // npm cli specifics
+        _hasShrinkwrap: _version._hasShrinkwrap,
+        hasInstallScript: _version.hasInstallScript
+      };
+      acc[version] = _version_abbreviated;
+      return acc;
+    }, {});
+    const convertedManifest = {
+      name: manifest['name'],
+      [_core.DIST_TAGS]: manifest[_core.DIST_TAGS],
+      versions: abbreviatedVersions,
+      modified: manifest.time.modified,
+      // NOTE: special case for pnpm https://github.com/pnpm/rfcs/pull/2
+      time: manifest.time
+    };
+    return convertedManifest;
+  }
   /**
    * Return a manifest or version based on the options.
    * @param options {Object}
@@ -459,329 +559,1362 @@ class Storage {
     if (_lodash.default.isNil(options.version) === false) {
       return this.getPackageByVersion(options);
     } else {
-      return this.getPackageManifest(options);
+      const manifest = await this.getPackageManifest(options);
+
+      if (options.abbreviated === true) {
+        debug('abbreviated manifest');
+        return this.convertAbbreviatedManifest(manifest);
+      }
+
+      return manifest;
     }
   }
 
-  async getPackageNext(options) {
-    const {
-      name
-    } = options;
-    debug('get package for %o', name);
-
-    try {
-      let data;
+  async getLocalDatabaseNext() {
+    debug('get local database');
+    const storage = this.localStorage.getStoragePlugin();
+    const database = await storage.get();
+    const packages = [];
 
-      try {
-        data = await this.localStorage.getPackageMetadataNext(name);
-      } catch (err) {
-        // we don't have package locally, so we need to fetch it from uplinks
-        if (err && (!err.status || err.status >= _core.HTTP_STATUS.INTERNAL_ERROR)) {
-          throw err;
-        }
-      } // time to sync with uplinks if we have any
+    for (const pkg of database) {
+      debug('get local database %o', pkg);
+      const manifest = await this.getPackageLocalMetadata(pkg);
+      const latest = manifest[_core.DIST_TAGS].latest;
 
+      if (latest && manifest.versions[latest]) {
+        const version = manifest.versions[latest];
+        const timeList = manifest.time;
+        const time = timeList[latest]; // @ts-ignore
 
-      debug('sync uplinks for %o', name); // @ts-expect-error
+        version.time = time; // Add for stars api
+        // @ts-ignore
 
-      return this._syncUplinksMetadataNext(name, data, {
-        req: options.req,
-        uplinksLook: options.uplinksLook,
-        keepUpLinkData: options.keepUpLinkData
-      });
-    } catch (err) {
-      this.logger.error({
-        name,
-        err: err.message
-      }, 'error on get package for @{name} with error @{err}');
-      throw err;
+        version.users = manifest.users;
+        packages.push(version);
+      } else {
+        this.logger.warn({
+          package: pkg
+        }, 'package @{package} does not have a "latest" tag?');
+      }
     }
-  }
-
-  _syncUplinksMetadataNext(name, data, {
-    uplinksLook,
-    keepUpLinkData,
-    req
-  }) {
-    return new Promise((resolve, reject) => {
-      this._syncUplinksMetadata(name, data, {
-        req: req,
-        uplinksLook
-      }, function getPackageSynUpLinksCallback(err, result, uplinkErrors) {
-        if (err) {
-          debug('error on sync package for %o with error %o', name, err === null || err === void 0 ? void 0 : err.message);
-          return reject(err);
-        }
 
-        const normalizedPkg = Object.assign({}, result, { ...(0, _utils.normalizeDistTags)((0, _storageUtils.cleanUpLinksRef)(result, keepUpLinkData)),
-          _attachments: {}
-        });
-        debug('no. sync uplinks errors %o for %s', uplinkErrors === null || uplinkErrors === void 0 ? void 0 : uplinkErrors.length, name);
-        resolve([normalizedPkg, uplinkErrors]);
-      });
-    });
+    return packages;
   }
-  /**
-   Retrieve a package metadata for {name} package
-   Function invokes localStorage.getPackage and uplink.get_package for every
-   uplink with proxy_access rights against {name} and combines results
-   into one json object
-   Used storages: local && uplink (proxy_access)
-    * @param {object} options
-   * @property {string} options.name Package Name
-   * @property {object}  options.req Express `req` object
-   * @property {boolean} options.keepUpLinkData keep up link info in package meta, last update, etc.
-   * @property {function} options.callback Callback for receive data
-   */
 
+  saveToken(token) {
+    if (_lodash.default.isFunction(this.localStorage.getStoragePlugin().saveToken) === false) {
+      return Promise.reject(_core.errorUtils.getCode(_core.HTTP_STATUS.SERVICE_UNAVAILABLE, _core.SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));
+    }
 
-  getPackage(options) {
-    const {
-      name
-    } = options;
-    debug('get package for %o', name);
-    this.localStorage.getPackageMetadata(name, (err, data) => {
-      if (err && (!err.status || err.status >= _core.HTTP_STATUS.INTERNAL_ERROR)) {
-        // report internal errors right away
-        debug('error on get package for %o with error %o', name, err === null || err === void 0 ? void 0 : err.message);
-        return options.callback(err);
-      }
+    return this.localStorage.getStoragePlugin().saveToken(token);
+  }
 
-      debug('sync uplinks for %o', name);
+  deleteToken(user, tokenKey) {
+    if (_lodash.default.isFunction(this.localStorage.getStoragePlugin().deleteToken) === false) {
+      return Promise.reject(_core.errorUtils.getCode(_core.HTTP_STATUS.SERVICE_UNAVAILABLE, _core.SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));
+    }
 
-      this._syncUplinksMetadata(name, data, {
-        req: options.req,
-        uplinksLook: options.uplinksLook
-      }, function getPackageSynUpLinksCallback(err, result, uplinkErrors) {
-        if (err) {
-          debug('error on sync package for %o with error %o', name, err === null || err === void 0 ? void 0 : err.message);
-          return options.callback(err);
-        }
+    return this.localStorage.getStoragePlugin().deleteToken(user, tokenKey);
+  }
 
-        result = (0, _utils.normalizeDistTags)((0, _storageUtils.cleanUpLinksRef)(result, options === null || options === void 0 ? void 0 : options.keepUpLinkData)); // npm can throw if this field doesn't exist
+  readTokens(filter) {
+    if (_lodash.default.isFunction(this.localStorage.getStoragePlugin().readTokens) === false) {
+      return Promise.reject(_core.errorUtils.getCode(_core.HTTP_STATUS.SERVICE_UNAVAILABLE, _core.SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));
+    }
 
-        result._attachments = {};
-        debug('no. sync uplinks errors %o', uplinkErrors === null || uplinkErrors === void 0 ? void 0 : uplinkErrors.length);
-        options.callback(null, result, uplinkErrors);
-      });
-    });
+    return this.localStorage.getStoragePlugin().readTokens(filter);
   }
   /**
-   * Retrieve only private local packages
-   * @param {*} callback
+   * Initialize the storage asynchronously.
+   * @param config Config
+   * @param filters IPluginFilters
+   * @returns Storage instance
    */
 
 
-  getLocalDatabase(callback) {
-    const self = this;
-    debug('get local database');
-
-    if (this.localStorage.storagePlugin !== null) {
-      this.localStorage.storagePlugin.get().then(locals => {
-        const packages = [];
-
-        const getPackage = function (itemPkg) {
-          self.localStorage.getPackageMetadata(locals[itemPkg], function (err, pkgMetadata) {
-            if (_lodash.default.isNil(err)) {
-              const latest = pkgMetadata[_core.DIST_TAGS].latest;
-
-              if (latest && pkgMetadata.versions[latest]) {
-                const version = pkgMetadata.versions[latest];
-                const timeList = pkgMetadata.time;
-                const time = timeList[latest]; // @ts-ignore
-
-                version.time = time; // Add for stars api
-                // @ts-ignore
-
-                version.users = pkgMetadata.users;
-                packages.push(version);
-              } else {
-                self.logger.warn({
-                  package: locals[itemPkg]
-                }, 'package @{package} does not have a "latest" tag?');
-              }
-            }
-
-            if (itemPkg >= locals.length - 1) {
-              callback(null, packages);
-            } else {
-              getPackage(itemPkg + 1);
-            }
-          });
-        };
+  async init(config, filters = []) {
+    if (this.localStorage === null) {
+      this.filters = filters || [];
+      debug('filters available %o', filters);
+      this.localStorage = new _localStorage.LocalStorage(this.config, _logger.logger);
+      await this.localStorage.init();
+      debug('local init storage initialized');
+      await this.localStorage.getSecret(config);
+      debug('local storage secret initialized');
+    } else {
+      debug('storage has been already initialized');
+    }
 
-        if (locals.length) {
-          getPackage(0);
-        } else {
-          callback(null, []);
-        }
-      }).catch(err => {
-        callback(err);
+    return;
+  }
+  /**
+   * Consume the upstream and pipe it to a transformable stream.
+   */
+
+
+  consumeSearchStream(uplinkId, uplink, options, searchPassThrough) {
+    return uplink.search({ ...options
+    }).then(bodyStream => {
+      bodyStream.pipe(searchPassThrough, {
+        end: false
       });
+      bodyStream.on('error', err => {
+        _logger.logger.error({
+          uplinkId,
+          err: err
+        }, 'search error for uplink @{uplinkId}: @{err?.message}');
+
+        searchPassThrough.end();
+      });
+      return new Promise(resolve => bodyStream.on('end', resolve));
+    });
+  }
+  /**
+   * Retrieve a wrapper that provide access to the package location.
+   * @param {Object} pkgName package name.
+   * @return {Object}
+   */
+
+
+  getPrivatePackageStorage(pkgName) {
+    debug('get local storage for %o', pkgName);
+    return this.localStorage.getStoragePlugin().getPackageStorage(pkgName);
+  }
+  /**
+   * Create a tarball stream from a package.
+   * @param name
+   * @param filename
+   * @param options
+   * @returns
+   */
+
+
+  async getLocalTarball(pkgName, filename, {
+    signal
+  }) {
+    (0, _assert.default)(_core.validatioUtils.validateName(filename));
+    const storage = this.getPrivatePackageStorage(pkgName);
+
+    if (typeof storage === 'undefined') {
+      return this.createFailureStreamResponseNext();
+    }
+
+    return await storage.readTarball(filename, {
+      signal
+    });
+  }
+
+  async searchCachedPackages(searchStream, query) {
+    debug('search on each package');
+    this.logger.info({
+      t: query.text,
+      q: query.quality,
+      p: query.popularity,
+      m: query.maintenance,
+      s: query.size
+    }, 'search by text @{t}| maintenance @{m}| quality @{q}| popularity @{p}');
+
+    if (typeof this.localStorage.getStoragePlugin().search === 'undefined') {
+      this.logger.info('plugin search not implemented yet');
+      searchStream.end();
     } else {
-      debug('local stora instance is null');
+      debug('search on each package by plugin');
+      const items = await this.localStorage.getStoragePlugin().search(query);
+
+      try {
+        for (const searchItem of items) {
+          const manifest = await this.getPackageLocalMetadata(searchItem.package.name);
+
+          if (_lodash.default.isEmpty(manifest === null || manifest === void 0 ? void 0 : manifest.versions) === false) {
+            const searchPackage = (0, _2.mapManifestToSearchPackageBody)(manifest, searchItem);
+            const searchPackageItem = {
+              package: searchPackage,
+              score: searchItem.score,
+              verdaccioPkgCached: searchItem.verdaccioPkgCached,
+              verdaccioPrivate: searchItem.verdaccioPrivate,
+              flags: searchItem === null || searchItem === void 0 ? void 0 : searchItem.flags,
+              // FUTURE: find a better way to calculate the score
+              searchScore: 1
+            };
+            searchStream.write(searchPackageItem);
+          }
+        }
+
+        debug('search local stream end');
+        searchStream.end();
+      } catch (err) {
+        this.logger.error({
+          err,
+          query
+        }, 'error on search by plugin @{err.message}');
+        searchStream.emit('error', err);
+      }
+    }
+  }
+
+  async removePackageByRevision(pkgName, revision) {
+    const storage = this.getPrivatePackageStorage(pkgName);
+    debug('get package metadata for %o', pkgName);
+
+    if (typeof storage === 'undefined') {
+      throw _core.errorUtils.getServiceUnavailable('storage not initialized');
     }
-  } // notas, debo migrar _syncUplinksMetadata algo mas lindo
 
+    let manifest;
+
+    try {
+      manifest = await storage.readPackage(pkgName);
+      manifest = (0, _storageUtils.normalizePackage)(manifest);
+    } catch (err) {
+      if (err.code === _storageUtils.STORAGE.NO_SUCH_FILE_ERROR || err.code === _core.HTTP_STATUS.NOT_FOUND) {
+        _logger.logger.info({
+          pkgName,
+          revision
+        }, 'package not found');
+
+        throw _core.errorUtils.getNotFound();
+      }
+
+      _logger.logger.error({
+        pkgName,
+        revision,
+        err: err.message
+      }, 'error @{err} while reading package @{pkgName}-{revision}');
+
+      throw err;
+    } // TODO:  move this to another method
+
+
+    try {
+      await this.localStorage.getStoragePlugin().remove(pkgName); // remove each attachment
+
+      const attachments = Object.keys(manifest._attachments);
+      debug('attachments to remove %s', attachments === null || attachments === void 0 ? void 0 : attachments.length);
+
+      for (let attachment of attachments) {
+        debug('remove attachment %s', attachment);
+        await storage.deletePackage(attachment);
+
+        _logger.logger.info({
+          attachment
+        }, 'attachment @{attachment} removed');
+      } // remove package.json
+
+
+      debug('remove package.json');
+      await storage.deletePackage(_storageUtils.STORAGE.PACKAGE_FILE_NAME); // remove folder
+
+      debug('remove package folder');
+      await storage.removePackage();
+
+      _logger.logger.info({
+        pkgName
+      }, 'package @{pkgName} removed');
+    } catch (err) {
+      this.logger.error({
+        err
+      }, 'removed package has failed @{err.message}');
+      throw _core.errorUtils.getBadData(err.message);
+    }
+  }
   /**
-   * Function fetches package metadata from uplinks and synchronizes it with local data
-   if package is available locally, it MUST be provided in pkginfo
-   returns callback(err, result, uplink_errors)
+   * Get a package local manifest.
+   *
+   * Fails if package is not found.
+   * @param name package name
+   * @param revision of package
+   * @returns local manifest
    */
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
 
 
-  _syncUplinksMetadata(name, packageInfo, options, callback) {
-    let found = true;
-    const self = this;
-    const upLinks = [];
-    const hasToLookIntoUplinks = _lodash.default.isNil(options.uplinksLook) || options.uplinksLook;
-    debug('is sync uplink enabled %o', hasToLookIntoUplinks);
+  async getPackageLocalMetadata(name, _revision) {
+    const storage = this.getPrivatePackageStorage(name);
+    debug('get package metadata for %o', name);
 
-    if (!packageInfo) {
-      found = false;
-      packageInfo = (0, _storageUtils.generatePackageTemplate)(name);
+    if (typeof storage === 'undefined') {
+      throw _core.errorUtils.getServiceUnavailable('storage not initialized');
     }
 
-    for (const uplink in this.uplinks) {
-      if ((0, _config.hasProxyTo)(name, uplink, this.config.packages) && hasToLookIntoUplinks) {
-        upLinks.push(this.uplinks[uplink]);
+    try {
+      const result = await storage.readPackage(name);
+      return (0, _storageUtils.normalizePackage)(result);
+    } catch (err) {
+      if (err.code === _storageUtils.STORAGE.NO_SUCH_FILE_ERROR || err.code === _core.HTTP_STATUS.NOT_FOUND) {
+        debug('package %s not found', name);
+        throw _core.errorUtils.getNotFound();
       }
+
+      this.logger.error({
+        err: err,
+        file: _storageUtils.STORAGE.PACKAGE_FILE_NAME
+      }, `error reading  @{file}: @{!err.message}`);
+      throw _core.errorUtils.getInternalError();
     }
+  }
+  /**
+   * Fail the stream response with an not found error.
+   * @returns
+   */
 
-    debug('uplink list %o', upLinks.length);
 
-    _async.default.map(upLinks, (upLink, cb) => {
-      const _options = Object.assign({}, options);
+  createFailureStreamResponseNext() {
+    const stream = new _stream.PassThrough(); // we ensure fails on the next tick into the event loop
 
-      const upLinkMeta = packageInfo._uplinks[upLink.upname];
+    process.nextTick(() => {
+      stream.emit('error', _core.errorUtils.getNotFound(_core.API_ERROR.NO_SUCH_FILE));
+    });
+    return stream;
+  }
+  /**
+   * Update a package and merge tags
+   * @param name package name
+   * @param tags list of dist-tags
+   */
 
-      if (_core.validatioUtils.isObject(upLinkMeta)) {
-        const fetched = upLinkMeta.fetched;
 
-        if (fetched && Date.now() - fetched < upLink.maxage) {
-          return cb();
+  async mergeTagsNext(name, tags) {
+    return await this.updatePackageNext(name, async data => {
+      let newData = { ...data
+      };
+
+      for (const tag of Object.keys(tags)) {
+        // this handle dist-tag rm command
+        if (_lodash.default.isNull(tags[tag])) {
+          delete newData[_core.DIST_TAGS][tag];
+          continue;
+        }
+
+        if (_lodash.default.isNil(newData.versions[tags[tag]])) {
+          throw _core.errorUtils.getNotFound(_core.API_ERROR.VERSION_NOT_EXIST);
         }
 
-        _options.etag = upLinkMeta.etag;
+        const version = tags[tag];
+        newData = (0, _2.tagVersionNext)(newData, version, tag);
       }
 
-      upLink.getRemoteMetadata(name, _options, (err, upLinkResponse, eTag) => {
-        if (err && err.remoteStatus === 304) {
-          upLinkMeta.fetched = Date.now();
-        }
+      return newData;
+    });
+  }
 
-        if (err || !upLinkResponse) {
-          return cb(null, [err || _core.errorUtils.getInternalError('no data')]);
-        }
+  getUpLinkForDistFile(pkgName, distFile) {
+    let uplink = null;
+
+    for (const uplinkId in this.uplinks) {
+      // refer to https://github.com/verdaccio/verdaccio/issues/1642
+      if ((0, _config.hasProxyTo)(pkgName, uplinkId, this.config.packages)) {
+        uplink = this.uplinks[uplinkId];
+      }
+    }
+
+    if (uplink == null) {
+      debug('upstream not found creating one for %o', pkgName);
+      uplink = new _proxy.ProxyStorage({
+        url: distFile.url,
+        cache: true
+      }, this.config);
+    }
+
+    return uplink;
+  }
+
+  async updateLocalMetadata(pkgName) {
+    const storage = this.getPrivatePackageStorage(pkgName);
+
+    if (!storage) {
+      throw _core.errorUtils.getNotFound();
+    }
+  }
+
+  async updateManifest(manifest, options) {
+    if ((0, _2.isDeprecatedManifest)(manifest)) {
+      // if the manifest is deprecated, we need to update the package.json
+      await this.deprecate(manifest, { ...options
+      });
+    } else if ((0, _starUtils.isPublishablePackage)(manifest) === false && _core.validatioUtils.isObject(manifest.users)) {
+      // if user request to apply a star to the manifest
+      await this.star(manifest, { ...options
+      });
+    } else if (_core.validatioUtils.validatePublishSingleVersion(manifest)) {
+      // if continue, the version to be published does not exist
+      // we create a new package
+      const [mergedManifest, version] = await this.publishANewVersion(manifest, { ...options
+      }); // send notification of publication (notification step, non transactional)
+
+      try {
+        const {
+          name
+        } = mergedManifest;
+        await this.notify(mergedManifest, `${name}@${version}`);
+
+        _logger.logger.info({
+          name,
+          version
+        }, 'notify for @{name}@@{version} has been sent');
+      } catch (error) {
+        _logger.logger.error({
+          error: error.message
+        }, 'notify batch service has failed: @{error}');
+      }
+    } else {
+      debug('invalid body format');
+
+      _logger.logger.info({
+        packageName: options.name
+      }, `wrong package format on publish a package @{packageName}`);
+
+      throw _core.errorUtils.getBadRequest(_core.API_ERROR.UNSUPORTED_REGISTRY_CALL);
+    }
+  } // eslint-disable-next-line @typescript-eslint/no-unused-vars
+
+
+  async deprecate(_body, _options) {
+    // // const storage: IPackageStorage = this.getPrivatePackageStorage(opname);
+    // if (typeof storage === 'undefined') {
+    //   throw errorUtils.getNotFound();
+    // }
+    throw _core.errorUtils.getInternalError('no implemenation ready for npm deprecate');
+  } // eslint-disable-next-line @typescript-eslint/no-unused-vars
+
+
+  async star(_body, _options) {
+    // // const storage: IPackageStorage = this.getPrivatePackageStorage(opname);
+    // if (typeof storage === 'undefined') {
+    //   throw errorUtils.getNotFound();
+    // }
+    throw _core.errorUtils.getInternalError('no implemenation ready for npm star');
+  }
+  /**
+   * Get local package, on fails return null.
+   * Errors are considered package not found.
+   * @param name
+   * @returns
+   */
+
+
+  async getPackagelocalByNameNext(name) {
+    try {
+      return await this.getPackageLocalMetadata(name);
+    } catch (err) {
+      debug('local package %s not found', name);
+      return null;
+    }
+  }
+  /**
+   * Convert tarball as string into a Buffer and validate the length.
+   * @param data the tarball data as string
+   * @returns
+   */
+
+
+  getBufferManifest(data) {
+    const buffer = Buffer.from(data, 'base64');
+
+    if (buffer.length === 0) {
+      throw _core.errorUtils.getBadData('refusing to accept zero-length file');
+    }
+
+    return buffer;
+  }
+  /**
+   * Verify if the package exists in the local storage
+   * (the package refers to the package.json), directory would return false.
+   * @param pkgName package name
+   * @returns boolean
+   */
+
+
+  async hasPackage(pkgName) {
+    const storage = this.getPrivatePackageStorage(pkgName);
+
+    if (typeof storage === 'undefined') {
+      throw _core.errorUtils.getNotFound();
+    }
+
+    const hasPackage = await storage.hasPackage();
+    debug('has package %o for %o', pkgName, hasPackage);
+    return hasPackage;
+  }
+  /**
+   * Create a new package.
+   * This situation happens only of the package does not exist on the cache.
+   *
+   * @param body package metadata
+   * @param options
+   * @returns
+   */
+
+
+  async publishANewVersion(body, options) {
+    const {
+      name
+    } = options;
+    debug('publishing a new package for %o', name);
+    const manifest = { ..._core.validatioUtils.normalizeMetadata(body, name)
+    };
+    const {
+      _attachments,
+      versions
+    } = manifest; // validation step, if _attachments is not an object throw error
+    // _attachments is need it for holding the tarball buffer in the local storage as file
+    // versions is need it for holding the version in the local storage as file
+    // _attachments and validation are required otherwise cannot continue.
+
+    if ((0, _lodash.isEmpty)(_attachments)) {
+      throw _core.errorUtils.getBadRequest(_core.API_ERROR.UNSUPORTED_REGISTRY_CALL);
+    } // get the unique version available
+
+
+    const [versionToPublish] = Object.keys(versions); // at this point document is either created or existed before
+
+    const [firstAttachmentKey] = Object.keys(_attachments);
+    const buffer = this.getBufferManifest(body._attachments[firstAttachmentKey].data);
+
+    try {
+      // we check if package exist already locally
+      const manifest = await this.getPackagelocalByNameNext(name); // if continue, the version to be published does not exist
+
+      if ((manifest === null || manifest === void 0 ? void 0 : manifest.versions[versionToPublish]) != null) {
+        debug('%s version %s already exists', name, versionToPublish);
+        throw _core.errorUtils.getConflict();
+      } // if execution get here, package does not exist locally, we search upstream
+
+
+      const remoteManifest = await this.checkPackageRemote(name, this.isAllowPublishOffline());
+
+      if ((remoteManifest === null || remoteManifest === void 0 ? void 0 : remoteManifest.versions[versionToPublish]) != null) {
+        debug('%s version %s already exists', name, versionToPublish);
+        throw _core.errorUtils.getConflict();
+      }
+
+      const hasPackageInStorage = await this.hasPackage(name);
+
+      if (!hasPackageInStorage) {
+        await this.createNewLocalCachePackage(name, versionToPublish);
+      }
+    } catch (err) {
+      debug('error on change or update a package with %o', err.message);
+
+      _logger.logger.error({
+        err: err.message
+      }, 'error on create package: @{err}');
+
+      throw err;
+    } // 1. after tarball has been successfully uploaded, we update the version
+
+
+    try {
+      // TODO: review why do this
+      versions[versionToPublish].readme = _lodash.default.isNil(manifest.readme) === false ? String(manifest.readme) : '';
+      await this.addVersionNext(name, versionToPublish, versions[versionToPublish], null);
+    } catch (err) {
+      _logger.logger.error({
+        err: err.message
+      }, 'updated version has failed: @{err}');
+
+      debug('error on create a version for %o with error %o', name, err.message); // TODO: remove tarball if add version fails
+
+      throw err;
+    } // 2. update and merge tags
+
+
+    let mergedManifest;
+
+    try {
+      // note: I could merge this with addVersionNext
+      // 1. add version
+      // 2. merge versions
+      // 3. upload tarball
+      // 3.update once to the storage (easy peasy)
+      mergedManifest = await this.mergeTagsNext(name, manifest[_core.DIST_TAGS]);
+    } catch (err) {
+      _logger.logger.error({
+        err: err.message
+      }, 'merge version has failed: @{err}');
+
+      debug('error on create a version for %o with error %o', name, err.message); // TODO: undo if this fails
+      // 1. remove tarball
+      // 2. remove updated version
+
+      throw err;
+    } // 3. upload the tarball to the storage
+
+
+    try {
+      const readable = _stream.Readable.from(buffer);
+
+      await this.uploadTarball(name, firstAttachmentKey, readable, {
+        signal: options.signal
+      });
+    } catch (err) {
+      _logger.logger.error({
+        err: err.message
+      }, 'upload tarball has failed: @{err}');
+
+      throw err;
+    }
+
+    _logger.logger.info({
+      name,
+      version: versionToPublish
+    }, 'package @{name}@@{version} has been published');
+
+    return [mergedManifest, versionToPublish];
+  } // TODO: pending implementation
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+
+
+  async notify(_manifest, _message) {
+    return;
+  }
+
+  getProxyList() {
+    const uplinksList = Object.keys(this.uplinks);
+    return uplinksList;
+  }
+  /**
+   * Wrap uploadTarballAsStream into a promise.
+   * @param name package name
+   * @param fileName tarball name
+   * @param contentReadable content as readable stream
+   * @param options
+   * @returns
+   */
+
+
+  async uploadTarball(name, fileName, contentReadable, {
+    signal
+  }) {
+    return new Promise((resolve, reject) => {
+      (async () => {
+        const stream = await this.uploadTarballAsStream(name, fileName, {
+          signal
+        });
+        stream.on('error', err => {
+          debug('error on stream a tarball %o for %o with error %o', 'foo.tar.gz', name, err.message);
+          reject(err);
+        });
+        stream.on('success', () => {
+          this.logger.debug({
+            fileName,
+            name
+          }, 'file @{fileName} for package @{name} has been succesfully uploaded');
+          resolve();
+        });
+        await (0, _promises.pipeline)(contentReadable, stream, {
+          signal
+        });
+      })().catch(err => {
+        reject(err);
+      });
+    });
+  }
+
+  async uploadTarballAsStream(pkgName, filename, {
+    signal
+  }) {
+    debug(`add a tarball for %o`, pkgName);
+    (0, _assert.default)(_core.validatioUtils.validateName(filename));
+    const shaOneHash = (0, _utils.createTarballHash)();
+    const transformHash = new _stream.Transform({
+      transform(chunk, _encoding, callback) {
+        // measure the length for validation reasons
+        shaOneHash.update(chunk);
+        callback(null, chunk);
+      }
+
+    });
+    const uploadStream = new _stream.PassThrough();
+    const storage = this.getPrivatePackageStorage(pkgName); // FUTURE: this validation could happen even before
+
+    if (pkgName === PROTO_NAME) {
+      process.nextTick(() => {
+        uploadStream.emit('error', _core.errorUtils.getForbidden());
+      });
+      return uploadStream;
+    } // FIXME: this condition will never met, storage is always defined
+
+
+    if (!storage) {
+      process.nextTick(() => {
+        uploadStream.emit('error', "can't upload this package storage is missing");
+      });
+      return uploadStream;
+    }
+
+    const fileDoesExist = await storage.hasTarball(filename);
+
+    if (fileDoesExist) {
+      process.nextTick(() => {
+        uploadStream.emit('error', _core.errorUtils.getConflict());
+      });
+    } else {
+      const localStorageWriteStream = await storage.writeTarball(filename, {
+        signal
+      });
+      localStorageWriteStream.on('open', async () => {
+        await (0, _promises.pipeline)(uploadStream, transformHash, localStorageWriteStream, {
+          signal
+        });
+      }); // once the file descriptor has been closed
 
+      localStorageWriteStream.on('close', async () => {
         try {
-          _core.validatioUtils.validateMetadata(upLinkResponse, name);
+          debug('uploaded tarball %o for %o', filename, pkgName); // update the package metadata
+
+          await this.updatePackageNext(pkgName, async data => {
+            const newData = { ...data
+            };
+            debug('added _attachment for %o', pkgName);
+            newData._attachments[filename] = {
+              // TODO:  add integrity hash here
+              shasum: shaOneHash.digest('hex')
+            };
+            return newData;
+          });
+          debug('emit success for %o', pkgName);
+          uploadStream.emit('success');
         } catch (err) {
-          self.logger.error({
-            sub: 'out',
-            err: err
-          }, 'package.json validating error @{!err?.message}\n@{err.stack}');
-          return cb(null, [err]);
+          // FUTURE: if the update package fails, remove tarball to avoid left
+          // orphan tarballs
+          debug('something has failed on upload tarball %o for %o : %s', filename, pkgName, err.message);
+          uploadStream.emit('error', err);
         }
+      }); // something went wrong writing into the local storage
 
-        packageInfo._uplinks[upLink.upname] = {
-          etag: eTag,
-          fetched: Date.now()
-        };
-        packageInfo.time = (0, _storageUtils.mergeUplinkTimeIntoLocal)(packageInfo, upLinkResponse);
-        (0, _uplinkUtil.updateVersionsHiddenUpLink)(upLinkResponse.versions, upLink);
+      localStorageWriteStream.on('error', async err => {
+        uploadStream.emit('error', err);
+      });
+    }
 
-        try {
-          _core.pkgUtils.mergeVersions(packageInfo, upLinkResponse);
-        } catch (err) {
-          self.logger.error({
-            sub: 'out',
-            err: err
-          }, 'package.json parsing error @{!err?.message}\n@{err.stack}');
-          return cb(null, [err]);
-        } // if we got to this point, assume that the correct package exists
-        // on the uplink
+    return uploadStream;
+  }
+  /**
+   * Add a new version to a package.
+   * @param name package name
+   * @param version version
+   * @param metadata version metadata
+   * @param tag tag of the version
+   */
 
 
-        found = true;
-        cb();
-      });
-    }, // @ts-ignore
-    (err, upLinksErrors) => {
-      (0, _assert.default)(!err && Array.isArray(upLinksErrors)); // Check for connection timeout or reset errors with uplink(s)
-      // (these should be handled differently from the package not being found)
-
-      if (!found) {
-        let uplinkTimeoutError;
-
-        for (let i = 0; i < upLinksErrors.length; i++) {
-          if (upLinksErrors[i]) {
-            for (let j = 0; j < upLinksErrors[i].length; j++) {
-              if (upLinksErrors[i][j]) {
-                const code = upLinksErrors[i][j].code;
-
-                if (code === 'ETIMEDOUT' || code === 'ESOCKETTIMEDOUT' || code === 'ECONNRESET') {
-                  uplinkTimeoutError = true;
-                  break;
-                }
-              }
+  async addVersionNext(name, version, metadata, tag) {
+    debug(`add version %s package for %s`, version, name);
+    await this.updatePackageNext(name, async data => {
+      // keep only one readme per package
+      data.readme = metadata.readme;
+      debug('%s` readme mutated', name); // TODO: lodash remove
+
+      metadata = (0, _2.cleanUpReadme)(metadata);
+      metadata.contributors = (0, _utils.normalizeContributors)(metadata.contributors);
+      debug('%s` contributors normalized', name); // if uploaded tarball has a different shasum, it's very likely that we
+      // have some kind of error
+
+      if (_core.validatioUtils.isObject(metadata.dist) && _lodash.default.isString(metadata.dist.tarball)) {
+        var _data$time;
+
+        const tarball = metadata.dist.tarball.replace(/.*\//, '');
+
+        if (_core.validatioUtils.isObject(data._attachments[tarball])) {
+          if (_lodash.default.isNil(data._attachments[tarball].shasum) === false && _lodash.default.isNil(metadata.dist.shasum) === false) {
+            if (data._attachments[tarball].shasum != metadata.dist.shasum) {
+              const errorMessage = `shasum error, ` + `${data._attachments[tarball].shasum} != ${metadata.dist.shasum}`;
+              throw _core.errorUtils.getBadRequest(errorMessage);
             }
           }
+
+          data._attachments[tarball].version = version;
+        } // if the time field doesn't exist, we create it, some old storage
+        // might not have it
+        // https://github.com/verdaccio/verdaccio/issues/740
+
+
+        if (_lodash.default.isNil(data.time)) {
+          this.logger.warn({
+            name
+          }, 'time field could not be found, it has been recreated for @{name}');
+          data.time = {};
+        } // populate the time field  with the date of the version
+
+
+        const currentDate = new Date().toISOString();
+        data.time.modified = currentDate;
+
+        if (!((_data$time = data.time) !== null && _data$time !== void 0 && _data$time.created)) {
+          data.time.created = currentDate;
         }
 
-        if (uplinkTimeoutError) {
-          return callback(_core.errorUtils.getServiceUnavailable(), null, upLinksErrors);
+        if (typeof data.time[version] === 'string') {
+          // this should not h appen, but we keep this check to avoid or easy bug report
+          this.logger.warn({
+            name,
+            version
+          }, 'the time for the version @{version} already exists, it has been overwritten for package @{name}');
         }
 
-        return callback(_core.errorUtils.getNotFound(_core.API_ERROR.NO_PACKAGE), null, upLinksErrors);
+        data.time[version] = currentDate;
+        debug('time added for %s version %s', name, version);
       }
 
-      if (upLinks.length === 0) {
-        return callback(null, packageInfo);
+      data.versions[version] = metadata; // TODO: review this method, it's a bit ugly
+
+      (0, _2.tagVersion)(data, version, tag);
+
+      try {
+        debug('%s` add on database', name);
+        await this.localStorage.getStoragePlugin().add(name);
+        this.logger.debug({
+          name,
+          version
+        }, 'version @{version} added to database for @{name}');
+      } catch (err) {
+        throw _core.errorUtils.getBadData(err.message);
       }
 
-      self.localStorage.updateVersions(name, packageInfo, async (err, packageJsonLocal) => {
-        if (err) {
-          return callback(err);
-        } // Any error here will cause a 404, like an uplink error. This is likely
-        // the right thing to do
-        // as a broken filter is a security risk.
+      return data;
+    });
+  }
+  /**
+   * Create an empty new local cache package without versions.
+   * @param name name of the package
+   * @returns
+   */
+
 
+  async createNewLocalCachePackage(name, latestVersion) {
+    const storage = this.getPrivatePackageStorage(name);
 
-        const filterErrors = []; // This MUST be done serially and not in parallel as they modify packageJsonLocal
+    if (!storage) {
+      debug(`storage is missing for %o package cannot be added`, name);
+      throw _core.errorUtils.getNotFound('this package cannot be added');
+    }
+
+    const currentTime = new Date().toISOString();
+    const packageData = { ...(0, _storageUtils.generatePackageTemplate)(name),
+      time: {
+        created: currentTime,
+        modified: currentTime,
+        [latestVersion]: currentTime
+      }
+    };
 
-        for (const filter of self.filters) {
-          try {
-            // These filters can assume it's save to modify packageJsonLocal
-            // and return it directly for
-            // performance (i.e. need not be pure)
-            packageJsonLocal = await filter.filter_metadata(packageJsonLocal);
-          } catch (err) {
-            filterErrors.push(err);
+    try {
+      await storage.createPackage(name, packageData);
+      this.logger.info({
+        name
+      }, 'created new package @{name}');
+      return;
+    } catch (err) {
+      if (_lodash.default.isNull(err) === false && (err.code === _storageUtils.STORAGE.FILE_EXIST_ERROR || err.code === _core.HTTP_STATUS.CONFLICT)) {
+        debug(`error on creating a package for %o with error %o`, name, err.message);
+        throw _core.errorUtils.getConflict();
+      }
+
+      return;
+    }
+  }
+
+  isAllowPublishOffline() {
+    return typeof this.config.publish !== 'undefined' && _lodash.default.isBoolean(this.config.publish.allow_offline) && this.config.publish.allow_offline;
+  }
+  /**
+   *
+   * @param name package name
+   * @param uplinksLook
+   * @returns
+   */
+
+
+  async checkPackageRemote(name, uplinksLook) {
+    try {
+      // we provide a null manifest, thus the manifest returned will be the remote one
+      const [remoteManifest, upLinksErrors] = await this.syncUplinksMetadataNext(name, null, {
+        uplinksLook
+      }); // checking package exist already
+
+      if ((0, _lodash.isNil)(remoteManifest) === false) {
+        throw _core.errorUtils.getConflict(_core.API_ERROR.PACKAGE_EXIST);
+      }
+
+      for (let errorItem = 0; errorItem < upLinksErrors.length; errorItem++) {
+        // checking error
+        // if uplink fails with a status other than 404, we report failure
+        if ((0, _lodash.isNil)(upLinksErrors[errorItem][0]) === false) {
+          if (upLinksErrors[errorItem][0].status !== _core.HTTP_STATUS.NOT_FOUND) {
+            if (upLinksErrors) {
+              return null;
+            }
+
+            throw _core.errorUtils.getServiceUnavailable(_core.API_ERROR.UPLINK_OFFLINE_PUBLISH);
           }
         }
+      }
 
-        callback(null, packageJsonLocal, _lodash.default.concat(upLinksErrors, filterErrors));
-      });
+      return remoteManifest;
+    } catch (err) {
+      if (err && err.status !== _core.HTTP_STATUS.NOT_FOUND) {
+        throw err;
+      }
+
+      return null;
+    }
+  }
+
+  setDefaultRevision(json) {
+    // calculate revision from couch db
+    if (_lodash.default.isString(json._rev) === false) {
+      json._rev = _storageUtils.STORAGE.DEFAULT_REVISION;
+    } // this is intended in debug mode we do not want modify the store revision
+
+
+    if (_lodash.default.isNil(this.config._debug)) {
+      json._rev = (0, _storageUtils.generateRevision)(json._rev);
+    }
+
+    return json;
+  }
+
+  async writePackageNext(name, json) {
+    const storage = this.getPrivatePackageStorage(name);
+
+    if (_lodash.default.isNil(storage)) {
+      // TODO: replace here 500 error
+      throw _core.errorUtils.getBadData();
+    }
+
+    await storage.savePackage(name, this.setDefaultRevision(json));
+  }
+  /**
+   * @param {*} name package name
+   * @param {*} updateHandler function(package, cb) - update function
+   * @param {*} callback callback that gets invoked after it's all updated
+   * @return {Function}
+   */
+
+
+  async updatePackageNext(name, updateHandler) {
+    const storage = this.getPrivatePackageStorage(name);
+
+    if (!storage) {
+      throw _core.errorUtils.getNotFound();
+    } // we update the package on the local storage
+
+
+    const updatedManifest = await storage.updatePackage(name, updateHandler); // after correctly updated write to the storage
+
+    try {
+      await this.writePackageNext(name, (0, _storageUtils.normalizePackage)(updatedManifest));
+      return updatedManifest;
+    } catch (err) {
+      if (err.code === resourceNotAvailable) {
+        throw _core.errorUtils.getInternalError('resource temporarily unavailable');
+      } else if (err.code === noSuchFile) {
+        throw _core.errorUtils.getNotFound();
+      } else {
+        throw err;
+      }
+    }
+  }
+  /**
+   *
+   * @protected
+   * @param {IGetPackageOptionsNext} options
+   * @return {*}  {Promise<[Manifest, any[]]>}
+   * @memberof AbstractStorage
+   */
+
+
+  async getPackageNext(options) {
+    const {
+      name
+    } = options;
+    debug('get package for %o', name);
+    let data = null;
+
+    try {
+      data = await this.getPackageLocalMetadata(name);
+    } catch (err) {
+      // if error code is higher than 500 stop here
+      if (err && (!err.status || err.status >= _core.HTTP_STATUS.INTERNAL_ERROR)) {
+        throw err;
+      }
+    } // if we can't get the local metadata, we try to get the remote metadata
+    // if we do to have local metadata, we try to update it with the upstream registry
+
+
+    debug('sync uplinks for %o', name);
+    const [remoteManifest, upLinksErrors] = await this.syncUplinksMetadataNext(name, data, {
+      uplinksLook: options.uplinksLook,
+      retry: options.retry,
+      remoteAddress: options.requestOptions.remoteAddress // etag??
+
+    }); // if either local data and upstream data are empty, we throw an error
+
+    if (!remoteManifest && _lodash.default.isNull(data)) {
+      throw _core.errorUtils.getNotFound(`${_core.API_ERROR.NOT_PACKAGE_UPLINK}: ${name}`); // if the remote manifest is empty, we return local data
+    } else if (!remoteManifest && !_lodash.default.isNull(data)) {
+      // no data on uplinks
+      return [data, upLinksErrors];
+    } // if we have local data, we try to update it with the upstream registry
+
+
+    const normalizedPkg = Object.assign({}, remoteManifest, { // FIXME: clean up  mutation within cleanUpLinksRef method
+      ...(0, _storageUtils.normalizeDistTags)((0, _storageUtils.cleanUpLinksRef)(remoteManifest, options.keepUpLinkData)),
+      _attachments: {}
     });
+    debug('no. sync uplinks errors %o for %s', upLinksErrors === null || upLinksErrors === void 0 ? void 0 : upLinksErrors.length, name);
+    return [normalizedPkg, upLinksErrors];
   }
   /**
-   * Set a hidden value for each version.
-   * @param {Array} versions list of version
-   * @param {String} upLink uplink name
+   * Function fetches package metadata from uplinks and synchronizes it with local data
+     if package is available locally, it MUST be provided in pkginfo.
+     Using this example:
+     "jquery":
+      access: $all
+      publish: $authenticated
+      unpublish: $authenticated
+      # two uplinks setup
+      proxy: ver npmjs
+      # one uplink setup
+      proxy: npmjs
+     A package requires uplinks syncronization if enables the proxy section, uplinks
+    can be more than one, the more are the most slow request will take, the request
+    are made in serie and if 1st call fails, the second will be triggered, otherwise
+    the 1st will reply and others will be discareded. The order is important.
+     Errors on upkinks are considered are, time outs, connection fails and http status 304,
+    in that case the request returns empty body and we want ask next on the list if has fresh
+    updates.
+   */
+
+
+  async syncUplinksMetadataNext(name, localManifest, options = {}) {
+    let found = localManifest !== null;
+    let syncManifest = null;
+    const upLinks = [];
+    const hasToLookIntoUplinks = _lodash.default.isNil(options.uplinksLook) || options.uplinksLook;
+    debug('is sync uplink enabled %o', hasToLookIntoUplinks);
+
+    for (const uplink in this.uplinks) {
+      if ((0, _config.hasProxyTo)(name, uplink, this.config.packages) && hasToLookIntoUplinks) {
+        debug('sync uplink %o', uplink);
+        upLinks.push(uplink);
+      }
+    } //  if none uplink match we return the local manifest
+
+
+    if (upLinks.length === 0) {
+      debug('no uplinks found for %o upstream update aborted', name);
+      return [localManifest, []];
+    }
+
+    const uplinksErrors = []; // we resolve uplinks async in serie, first come first serve
+
+    for (const uplink of upLinks) {
+      try {
+        const tempManifest = _lodash.default.isNil(localManifest) ? (0, _storageUtils.generatePackageTemplate)(name) : { ...localManifest
+        };
+        syncManifest = await this.mergeCacheRemoteMetadata(this.uplinks[uplink], tempManifest, options);
+        debug('syncing on uplink %o', syncManifest.name);
+
+        if (_lodash.default.isNil(syncManifest) === false) {
+          found = true;
+          break;
+        }
+      } catch (err) {
+        debug('error captured on uplink %o', err.message);
+        uplinksErrors.push(err); // enforce use next uplink on the list
+
+        continue;
+      }
+    }
+
+    if (found && syncManifest !== null) {
+      // updates the local cache manifest with fresh data
+      let updatedCacheManifest = await this.updateVersionsNext(name, syncManifest); // plugin filter applied to the manifest
+
+      const [filteredManifest, filtersErrors] = await this.applyFilters(updatedCacheManifest);
+      return [{ ...updatedCacheManifest,
+        ...filteredManifest
+      }, [...uplinksErrors, ...filtersErrors]];
+    } else if (found && _lodash.default.isNil(localManifest) === false) {
+      return [localManifest, uplinksErrors];
+    } else {
+      // if is not found, calculate the right error to return
+      debug('uplinks sync failed with %o errors', uplinksErrors.length);
+
+      for (const err of uplinksErrors) {
+        const {
+          code
+        } = err;
+
+        if (code === 'ETIMEDOUT' || code === 'ESOCKETTIMEDOUT' || code === 'ECONNRESET') {
+          debug('uplinks sync failed with timeout error');
+          throw _core.errorUtils.getServiceUnavailable(err.code);
+        } // we bubble up the 304 special error case
+
+
+        if (code === _core.HTTP_STATUS.NOT_MODIFIED) {
+          debug('uplinks sync failed with 304 error');
+          throw err;
+        }
+      }
+
+      debug('uplinks sync failed with no package found');
+      throw _core.errorUtils.getNotFound(_core.API_ERROR.NO_PACKAGE);
+    }
+  }
+  /**
+   * Merge a manifest with a remote manifest.
+   *
+   * If the uplinks are not available, the local manifest is returned.
+   * If the uplinks are available, the local manifest is merged with the remote one.
+   *
+   *
+   * @param uplink uplink instance
+   * @param cachedManifest the local cached manifest
+   * @param options options
+   * @returns Returns a promise that resolves with the merged manifest.
+   */
+
+
+  async mergeCacheRemoteMetadata(uplink, cachedManifest, options) {
+    // we store which uplink is updating the manifest
+    const upLinkMeta = cachedManifest._uplinks[uplink.upname];
+    let _cacheManifest = { ...cachedManifest
+    };
+
+    if (_core.validatioUtils.isObject(upLinkMeta)) {
+      const fetched = upLinkMeta.fetched; // we check the uplink cache is fresh
+
+      if (fetched && Date.now() - fetched < uplink.maxage) {
+        return cachedManifest;
+      }
+    }
+
+    const remoteOptions = Object.assign({}, options, {
+      etag: upLinkMeta === null || upLinkMeta === void 0 ? void 0 : upLinkMeta.etag
+    }); // get the latest metadata from the uplink
+
+    const [remoteManifest, etag] = await uplink.getRemoteMetadataNext(_cacheManifest.name, remoteOptions);
+
+    try {
+      _cacheManifest = _core.validatioUtils.normalizeMetadata(_cacheManifest, _cacheManifest.name);
+    } catch (err) {
+      this.logger.error({
+        err: err
+      }, 'package.json validating error @{!err?.message}\n@{err.stack}');
+      throw err;
+    } // updates the _uplink metadata fields, cache, etc
+
+
+    _cacheManifest = (0, _storageUtils.updateUpLinkMetadata)(uplink.upname, _cacheManifest, etag); // merge time field cache and remote
+
+    _cacheManifest = (0, _storageUtils.mergeUplinkTimeIntoLocalNext)(_cacheManifest, remoteManifest); // update the _uplinks field in the cache
+
+    _cacheManifest = (0, _uplinkUtil.updateVersionsHiddenUpLinkNext)(_cacheManifest, uplink);
+
+    try {
+      // merge versions from remote into the cache
+      _cacheManifest = (0, _storageUtils.mergeVersions)(_cacheManifest, remoteManifest);
+      return _cacheManifest;
+    } catch (err) {
+      this.logger.error({
+        err: err
+      }, 'package.json merge has failed @{!err?.message}\n@{err.stack}');
+      throw err;
+    }
+  }
+  /**
+   * Apply filters to manifest.
+   * @param manifest
+   * @returns
+   */
+
+
+  async applyFilters(manifest) {
+    if (this.filters.length === 0) {
+      return [manifest, []];
+    }
+
+    let filterPluginErrors = [];
+    let filteredManifest = { ...manifest
+    };
+
+    for (const filter of this.filters) {
+      // These filters can assume it's save to modify packageJsonLocal
+      // and return it directly for
+      // performance (i.e. need not be pure)
+      try {
+        filteredManifest = await filter.filter_metadata(manifest);
+      } catch (err) {
+        this.logger.error({
+          err: err.message
+        }, 'filter has failed @{err}');
+        filterPluginErrors.push(err);
+      }
+    }
+
+    return [filteredManifest, filterPluginErrors];
+  }
+
+  _createNewPackageNext(name) {
+    return (0, _storageUtils.normalizePackage)((0, _storageUtils.generatePackageTemplate)(name));
+  }
+  /**
+   * Ensure the dist file remains as the same protocol
+   * @param {Object} hash metadata
+   * @param {String} upLinkKey registry key
    * @private
+   * @deprecated use _updateUplinkToRemoteProtocolNext (???)
    */
 
 
-  _updateVersionsHiddenUpLink(versions, upLink) {
-    for (const i in versions) {
-      if (Object.prototype.hasOwnProperty.call(versions, i)) {
-        const version = versions[i]; // holds a "hidden" value to be used by the package storage.
-        // $FlowFixMe
+  updateUplinkToRemoteProtocol(hash, upLinkKey) {
+    // if we got this information from a known registry,
+    // use the same protocol for the tarball
+    const tarballUrl = _url.default.parse(hash.url);
+
+    const uplinkUrl = _url.default.parse(this.config.uplinks[upLinkKey].url);
+
+    if (uplinkUrl.host === tarballUrl.host) {
+      tarballUrl.protocol = uplinkUrl.protocol;
+      hash.registry = upLinkKey;
+      hash.url = _url.default.format(tarballUrl);
+    }
+  }
+  /**
+   * Create or read a package.
+   *
+   * If the package already exists, it will be read.
+   * If the package is not found, it will be created.
+   * If the error is anything else will throw an error
+   *
+   * @param {*} pkgName
+   * @param {*} callback
+   * @return {Function}
+   */
+
+
+  async readCreatePackage(pkgName) {
+    const storage = this.getPrivatePackageStorage(pkgName);
+
+    if (_lodash.default.isNil(storage)) {
+      throw _core.errorUtils.getInternalError('storage could not be found');
+    }
+
+    try {
+      const result = await storage.readPackage(pkgName);
+      return (0, _storageUtils.normalizePackage)(result);
+    } catch (err) {
+      if (err.code === _storageUtils.STORAGE.NO_SUCH_FILE_ERROR || err.code === _core.HTTP_STATUS.NOT_FOUND) {
+        return this._createNewPackageNext(pkgName);
+      } else {
+        this.logger.error({
+          err: err,
+          file: _storageUtils.STORAGE.PACKAGE_FILE_NAME
+        }, `'error reading'  @{file}: @{!err.message}`);
+        throw _core.errorUtils.getInternalError();
+      }
+    }
+  }
+  /**
+    Updates the local cache with the merge from the remote/client manifest.
+     The steps are the following.
+    1. Get the latest version of the package from the cache.
+    2. If does not exist will return a 
+     @param name
+    @param remoteManifest
+    @returns return a merged manifest.
+  */
+
+
+  async updateVersionsNext(name, remoteManifest) {
+    debug(`updating versions for package %o`, name);
+    let cacheManifest = await this.readCreatePackage(name);
+    let change = false; // updating readme
+
+    cacheManifest.readme = (0, _storageUtils.getLatestReadme)(remoteManifest);
+
+    if (remoteManifest.readme !== cacheManifest.readme) {
+      debug('manifest readme updated for %o', name);
+      change = true;
+    }
+
+    debug('updating new remote versions');
+
+    for (const versionId in remoteManifest.versions) {
+      // if detect a new remote version does not exist cache
+      if (_lodash.default.isNil(cacheManifest.versions[versionId])) {
+        var _version2, _version2$dist;
+
+        debug('new version from upstream %o', versionId);
+        let version = remoteManifest.versions[versionId]; // we don't keep readme for package versions,
+        // only one readme per package
+        // TODO: readme clean up could be  saved in configured eventually
+
+        version = (0, _2.cleanUpReadme)(version);
+        debug('clean up readme for %o', versionId);
+        version.contributors = (0, _utils.normalizeContributors)(version.contributors);
+        change = true;
+        cacheManifest.versions[versionId] = version;
+
+        if ((_version2 = version) !== null && _version2 !== void 0 && (_version2$dist = _version2.dist) !== null && _version2$dist !== void 0 && _version2$dist.tarball) {
+          const filename = _core.pkgUtils.extractTarballName(version.dist.tarball); // store a fast access to the dist file by tarball name
+          // it does NOT overwrite any existing records
+
 
-        version[Symbol.for('__verdaccio_uplink')] = upLink.upname;
+          if (_lodash.default.isNil(cacheManifest === null || cacheManifest === void 0 ? void 0 : cacheManifest._distfiles[filename])) {
+            const hash = cacheManifest._distfiles[filename] = {
+              url: version.dist.tarball,
+              sha: version.dist.shasum
+            }; // store cache metadata this the manifest
+
+            const upLink = version[Symbol.for('__verdaccio_uplink')];
+
+            if (_lodash.default.isNil(upLink) === false) {
+              this.updateUplinkToRemoteProtocol(hash, upLink);
+            }
+          }
+        }
+      } else {
+        debug('no new versions from upstream %s', name);
       }
     }
+
+    debug('update dist-tags');
+
+    for (const tag in remoteManifest[_core.DIST_TAGS]) {
+      if (!cacheManifest[_core.DIST_TAGS][tag] || cacheManifest[_core.DIST_TAGS][tag] !== remoteManifest[_core.DIST_TAGS][tag]) {
+        change = true;
+        cacheManifest[_core.DIST_TAGS][tag] = remoteManifest[_core.DIST_TAGS][tag];
+      }
+    }
+
+    for (const up in remoteManifest._uplinks) {
+      if (Object.prototype.hasOwnProperty.call(remoteManifest._uplinks, up)) {
+        const need_change = !(0, _utils.isObject)(cacheManifest._uplinks[up]) || remoteManifest._uplinks[up].etag !== cacheManifest._uplinks[up].etag || remoteManifest._uplinks[up].fetched !== cacheManifest._uplinks[up].fetched;
+
+        if (need_change) {
+          change = true;
+          cacheManifest._uplinks[up] = remoteManifest._uplinks[up];
+        }
+      }
+    }
+
+    debug('update time');
+
+    if ('time' in remoteManifest && !_lodash.default.isEqual(cacheManifest.time, remoteManifest.time)) {
+      cacheManifest.time = remoteManifest.time;
+      change = true;
+    }
+
+    if (change) {
+      debug('updating package info %o', name);
+      await this.writePackageNext(name, cacheManifest);
+      return cacheManifest;
+    } else {
+      return cacheManifest;
+    }
   }
 
 }