@verdaccio/store 6.0.0-6-next.21 → 6.0.0-6-next.24

package/package.json

@@ -1,72 +1,72 @@
 {
-	"name": "@verdaccio/store",
-	"version": "6.0.0-6-next.21",
-	"description": "loaders logic",
-	"main": "./build/index.js",
-	"types": "build/index.d.ts",
-	"author": {
-		"name": "Juan Picado",
-		"email": "juanpicado19@gmail.com"
-	},
-	"repository": {
-		"type": "https",
-		"url": "https://github.com/verdaccio/verdaccio"
-	},
-	"license": "MIT",
-	"homepage": "https://verdaccio.org",
-	"keywords": [
-		"private",
-		"package",
-		"repository",
-		"registry",
-		"enterprise",
-		"modules",
-		"proxy",
-		"server",
-		"verdaccio"
-	],
-	"engines": {
-		"node": ">=14",
-		"npm": ">=6"
-	},
-	"dependencies": {
-		"@verdaccio/config": "6.0.0-6-next.13",
-		"@verdaccio/core": "6.0.0-6-next.5",
-		"@verdaccio/loaders": "6.0.0-6-next.12",
-		"@verdaccio/local-storage": "11.0.0-6-next.12",
-		"@verdaccio/logger": "6.0.0-6-next.11",
-		"@verdaccio/proxy": "6.0.0-6-next.19",
-		"@verdaccio/streams": "11.0.0-6-next.5",
-		"@verdaccio/utils": "6.0.0-6-next.11",
-		"@verdaccio/tarball": "11.0.0-6-next.12",
-		"JSONStream": "1.3.5",
-		"async": "3.2.3",
-		"debug": "4.3.3",
-		"lodash": "4.17.21",
-		"merge2": "1.4.1",
-		"semver": "7.3.5"
-	},
-	"devDependencies": {
-		"@types/node": "16.11.21",
-		"@verdaccio/mock": "6.0.0-6-next.14",
-		"@verdaccio/types": "11.0.0-6-next.11",
-		"@verdaccio/test-helper": "1.1.0-6-next.0",
-		"undici": "4.15.0",
-		"nock": "13.2.2",
-		"tmp-promise": "3.0.3",
-		"node-mocks-http": "1.11.0"
-	},
-	"funding": {
-		"type": "opencollective",
-		"url": "https://opencollective.com/verdaccio"
-	},
-	"scripts": {
-		"clean": "rimraf ./build",
-		"test": "cross-env NODE_ENV=test BABEL_ENV=test jest",
-		"type-check": "tsc --noEmit -p tsconfig.build.json",
-		"build:types": "tsc --emitDeclarationOnly -p tsconfig.build.json",
-		"build:js": "babel src/ --out-dir build/ --copy-files --extensions \".ts,.tsx\" --source-maps",
-		"watch": "pnpm build:js -- --watch",
-		"build": "pnpm run build:js && pnpm run build:types"
-	}
-}
+  "name": "@verdaccio/store",
+  "version": "6.0.0-6-next.24",
+  "description": "loaders logic",
+  "main": "./build/index.js",
+  "types": "build/index.d.ts",
+  "author": {
+    "name": "Juan Picado",
+    "email": "juanpicado19@gmail.com"
+  },
+  "repository": {
+    "type": "https",
+    "url": "https://github.com/verdaccio/verdaccio"
+  },
+  "license": "MIT",
+  "homepage": "https://verdaccio.org",
+  "keywords": [
+    "private",
+    "package",
+    "repository",
+    "registry",
+    "enterprise",
+    "modules",
+    "proxy",
+    "server",
+    "verdaccio"
+  ],
+  "engines": {
+    "node": ">=16",
+    "npm": ">=6"
+  },
+  "dependencies": {
+    "@verdaccio/config": "6.0.0-6-next.15",
+    "@verdaccio/core": "6.0.0-6-next.6",
+    "@verdaccio/hooks": "6.0.0-6-next.14",
+    "@verdaccio/loaders": "6.0.0-6-next.13",
+    "@verdaccio/local-storage": "11.0.0-6-next.14",
+    "@verdaccio/logger": "6.0.0-6-next.12",
+    "@verdaccio/proxy": "6.0.0-6-next.22",
+    "@verdaccio/url": "11.0.0-6-next.10",
+    "@verdaccio/utils": "6.0.0-6-next.12",
+    "@verdaccio/tarball": "11.0.0-6-next.13",
+    "JSONStream": "1.3.5",
+    "debug": "4.3.4",
+    "lodash": "4.17.21",
+    "merge2": "1.4.1",
+    "semver": "7.3.7"
+  },
+  "devDependencies": {
+    "@types/node": "16.11.51",
+    "@verdaccio/types": "11.0.0-6-next.14",
+    "@verdaccio/test-helper": "1.1.0-6-next.2",
+    "undici": "4.16.0",
+    "nock": "13.2.9",
+    "node-mocks-http": "1.11.0",
+    "mockdate": "3.0.5"
+  },
+  "funding": {
+    "type": "opencollective",
+    "url": "https://opencollective.com/verdaccio"
+  },
+  "scripts": {
+    "clean": "rimraf ./build",
+    "test": "jest",
+    "type-check": "tsc --noEmit -p tsconfig.build.json",
+    "build:types": "tsc --emitDeclarationOnly -p tsconfig.build.json",
+    "build:js": "babel src/ --out-dir build/ --copy-files --extensions \".ts,.tsx\" --source-maps",
+    "watch": "pnpm build:js -- --watch",
+    "build": "pnpm run build:js && pnpm run build:types"
+  },
+  "readme": "# @verdaccio/store\n\n[![backers](https://opencollective.com/verdaccio/tiers/backer/badge.svg?label=Backer&color=brightgreen)](https://opencollective.com/verdaccio)\n[![stackshare](https://img.shields.io/badge/Follow%20on-StackShare-blue.svg?logo=stackshare&style=flat)](https://stackshare.io/verdaccio)\n[![MIT](https://img.shields.io/github/license/mashape/apistatus.svg)](https://github.com/verdaccio/verdaccio/blob/master/LICENSE)\n[![Crowdin](https://d322cqt584bo4o.cloudfront.net/verdaccio/localized.svg)](https://crowdin.com/project/verdaccio)\n[![TODOs](https://badgen.net/https/api.tickgit.com/badgen/github.com/verdaccio/verdaccio)](https://www.tickgit.com/browse?repo=github.com/verdaccio/verdaccio)\n\n[![Twitter followers](https://img.shields.io/twitter/follow/verdaccio_npm.svg?style=social&label=Follow)](https://twitter.com/verdaccio_npm)\n[![Github](https://img.shields.io/github/stars/verdaccio/verdaccio.svg?style=social&label=Stars)](https://github.com/verdaccio/verdaccio/stargazers)\n\n## Donations\n\nVerdaccio is run by **volunteers**; nobody is working full-time on it. If you find this project to be useful and would like to support its development, consider making a donation - **your logo might end up in this readme.** 😉\n\n**[Donate](https://opencollective.com/verdaccio)** 💵👍🏻 starting from _\\$1/month_ or just one single contribution.\n\n## Report a vulnerability\n\nIf you want to report a security vulnerability, please follow the steps which we have defined for you in our [security policy](https://github.com/verdaccio/verdaccio/security/policy).\n\n## Open Collective Sponsors\n\nSupport this project by becoming a sponsor. Your logo will show up here with a link to your website. [[Become a sponsor](https://opencollective.com/verdaccio#sponsor)]\n\n[![sponsor](https://opencollective.com/verdaccio/sponsor/0/avatar.svg)](https://opencollective.com/verdaccio/sponsor/0/website)\n[![sponsor](https://opencollective.com/verdaccio/sponsor/1/avatar.svg)](https://opencollective.com/verdaccio/sponsor/1/website)\n[![sponsor](https://opencollective.com/verdaccio/sponsor/2/avatar.svg)](https://opencollective.com/verdaccio/sponsor/2/website)\n[![sponsor](https://opencollective.com/verdaccio/sponsor/3/avatar.svg)](https://opencollective.com/verdaccio/sponsor/3/website)\n[![sponsor](https://opencollective.com/verdaccio/sponsor/4/avatar.svg)](https://opencollective.com/verdaccio/sponsor/4/website)\n[![sponsor](https://opencollective.com/verdaccio/sponsor/5/avatar.svg)](https://opencollective.com/verdaccio/sponsor/5/website)\n[![sponsor](https://opencollective.com/verdaccio/sponsor/6/avatar.svg)](https://opencollective.com/verdaccio/sponsor/6/website)\n[![sponsor](https://opencollective.com/verdaccio/sponsor/7/avatar.svg)](https://opencollective.com/verdaccio/sponsor/7/website)\n[![sponsor](https://opencollective.com/verdaccio/sponsor/8/avatar.svg)](https://opencollective.com/verdaccio/sponsor/8/website)\n[![sponsor](https://opencollective.com/verdaccio/sponsor/9/avatar.svg)](https://opencollective.com/verdaccio/sponsor/9/website)\n\n## Open Collective Backers\n\nThank you to all our backers! 🙏 [[Become a backer](https://opencollective.com/verdaccio#backer)]\n\n[![backers](https://opencollective.com/verdaccio/backers.svg?width=890)](https://opencollective.com/verdaccio#backers)\n\n## Special Thanks\n\nThanks to the following companies to help us to achieve our goals providing free open source licenses.\n\n[![jetbrain](assets/thanks/jetbrains/logo.png)](https://www.jetbrains.com/)\n[![crowdin](assets/thanks/crowdin/logo.png)](https://crowdin.com/)\n[![balsamiq](assets/thanks/balsamiq/logo.jpg)](https://balsamiq.com/)\n\n## Contributors\n\nThis project exists thanks to all the people who contribute. [[Contribute](CONTRIBUTING.md)].\n\n[![contributors](https://opencollective.com/verdaccio/contributors.svg?width=890&button=true)](../../graphs/contributors)\n\n### FAQ / Contact / Troubleshoot\n\nIf you have any issue you can try the following options, do no desist to ask or check our issues database, perhaps someone has asked already what you are looking for.\n\n- [Blog](https://verdaccio.org/blog/)\n- [Donations](https://opencollective.com/verdaccio)\n- [Reporting an issue](https://github.com/verdaccio/verdaccio/blob/master/CONTRIBUTING.md#reporting-a-bug)\n- [Running discussions](https://github.com/verdaccio/verdaccio/issues?q=is%3Aissue+is%3Aopen+label%3Adiscuss)\n- [Chat](http://chat.verdaccio.org/)\n- [Logos](https://verdaccio.org/docs/en/logo)\n- [Docker Examples](https://github.com/verdaccio/docker-examples)\n- [FAQ](https://github.com/verdaccio/verdaccio/issues?utf8=%E2%9C%93&q=is%3Aissue%20label%3Aquestion%20)\n\n### License\n\nVerdaccio is [MIT licensed](https://github.com/verdaccio/verdaccio/blob/master/LICENSE)\n\nThe Verdaccio documentation and logos (excluding /thanks, e.g., .md, .png, .sketch) files within the /assets folder) is\n[Creative Commons licensed](https://github.com/verdaccio/verdaccio/blob/master/LICENSE-docs).\n"
+}

package/src/index.ts

@@ -1,5 +1,6 @@
-export * from './storage';
-export * from './storage-utils';
-export * from './star-utils';
-export * from './search';
+export { Storage } from './storage';
+export * from './lib/storage-utils';
+export * from './lib/search-utils';
+export * from './lib/versions-utils';
+export * from './lib/star-utils';
 export * from './type';

package/src/lib/TransFormResults.ts

@@ -0,0 +1,42 @@
+import buildDebug from 'debug';
+import _ from 'lodash';
+import { Transform } from 'stream';
+
+import { searchUtils } from '@verdaccio/core';
+
+const debug = buildDebug('verdaccio:storage:search:transform');
+
+export class TransFormResults extends Transform {
+  public constructor(options) {
+    super(options);
+  }
+
+  /**
+   * Transform either array of packages or a single package into a stream of packages.
+   * From uplinks the chunks are array but from local packages are objects.
+   * @param {string} chunk
+   * @param {string} encoding
+   * @param {function} done
+   * @returns {void}
+   * @override
+   */
+  public _transform(chunk, _encoding, callback) {
+    if (_.isArray(chunk)) {
+      // from remotes we should expect chunks as arrays
+      (chunk as searchUtils.SearchItem[])
+        .filter((pkgItem) => {
+          debug(`streaming remote pkg name ${pkgItem?.package?.name}`);
+          return true;
+        })
+        .forEach((pkgItem) => {
+          this.push({ ...pkgItem, verdaccioPkgCached: false, verdaccioPrivate: false });
+        });
+      return callback();
+    } else {
+      // local we expect objects
+      debug(`streaming local pkg name ${chunk?.package?.name}`);
+      this.push(chunk);
+      return callback();
+    }
+  }
+}

package/src/lib/search-utils.ts

@@ -0,0 +1,50 @@
+import { orderBy } from 'lodash';
+
+import { pkgUtils, searchUtils } from '@verdaccio/core';
+import { Manifest, Version } from '@verdaccio/types';
+
+export function removeDuplicates(results: searchUtils.SearchPackageItem[]) {
+  const pkgNames: any[] = [];
+  const orderByResults = orderBy(results, ['verdaccioPrivate', 'asc']);
+  return orderByResults.filter((pkg) => {
+    if (pkgNames.includes(pkg?.package?.name)) {
+      return false;
+    }
+    pkgNames.push(pkg?.package?.name);
+    return true;
+  });
+}
+
+export function mapManifestToSearchPackageBody(
+  pkg: Manifest,
+  searchItem: searchUtils.SearchItem
+): searchUtils.SearchPackageBody {
+  const latest = pkgUtils.getLatest(pkg);
+  const version: Version = pkg.versions[latest];
+  const result: searchUtils.SearchPackageBody = {
+    name: version.name,
+    scope: '',
+    description: version.description,
+    version: latest,
+    keywords: version.keywords,
+    date: pkg.time[latest],
+    // FIXME: type
+    author: version.author as any,
+    // FIXME: not possible fill this out from a private package
+    publisher: {},
+    // FIXME: type
+    maintainers: version.maintainers as any,
+    links: {
+      npm: '',
+      homepage: version.homepage,
+      repository: version.repository,
+      bugs: version.bugs,
+    },
+  };
+
+  if (typeof searchItem.package.scoped === 'string') {
+    result.scope = searchItem.package.scoped;
+  }
+
+  return result;
+}

package/src/{star-utils.ts → lib/star-utils.ts}

@@ -1,21 +1,28 @@
 import _ from 'lodash';
 
-import { Package } from '@verdaccio/types';
+import { validatioUtils } from '@verdaccio/core';
+import { Manifest } from '@verdaccio/types';
 
-import { Users } from '.';
+import { Users } from '../type';
 
 /**
  * Check whether the package metadta has enough data to be published
  * @param pkg metadata
  */
 
-export function isPublishablePackage(pkg: Package): boolean {
+/**
+ * Check whether the package metadta has enough data to be published
+ * @param pkg metadata
+ */
+export function isPublishablePackage(pkg: Manifest): boolean {
+  // TODO: we can do better, no need get keys
   const keys: string[] = Object.keys(pkg);
 
-  return _.includes(keys, 'versions');
+  return keys.includes('versions');
 }
 
-export function isRelatedToDeprecation(pkgInfo: Package): boolean {
+// @deprecated don't think this is used anymore (REMOVE)
+export function isRelatedToDeprecation(pkgInfo: Manifest): boolean {
   const { versions } = pkgInfo;
   for (const version in versions) {
     if (Object.prototype.hasOwnProperty.call(versions[version], 'deprecated')) {
@@ -36,3 +43,7 @@ export function validateInputs(localUsers: Users, username: string, isStar: bool
   }
   return false;
 }
+
+export function isStarManifest(manifest: Manifest): boolean {
+  return isPublishablePackage(manifest) === false && validatioUtils.isObject(manifest.users);
+}

package/src/lib/storage-utils.ts

@@ -0,0 +1,362 @@
+import _ from 'lodash';
+import semver from 'semver';
+
+import { errorUtils, pkgUtils, validatioUtils } from '@verdaccio/core';
+import { API_ERROR, DIST_TAGS, HTTP_STATUS, USERS } from '@verdaccio/core';
+import { AttachMents, Manifest, Version, Versions } from '@verdaccio/types';
+import { generateRandomHexString, isNil, isObject } from '@verdaccio/utils';
+
+import { sortVersionsAndFilterInvalid } from './versions-utils';
+
+export const STORAGE = {
+  PACKAGE_FILE_NAME: 'package.json',
+  FILE_EXIST_ERROR: 'EEXISTS',
+  NO_SUCH_FILE_ERROR: 'ENOENT',
+  DEFAULT_REVISION: '0-0000000000000000',
+};
+
+/**
+ * Create a new package in the storage, return a boilerplate package
+ * @param name package name
+ * @returns {Manifest}
+ */
+export function generatePackageTemplate(name: string): Manifest {
+  return {
+    // standard things
+    name,
+    versions: {},
+    time: {},
+    [USERS]: {},
+    [DIST_TAGS]: {},
+    _uplinks: {},
+    _distfiles: {},
+    _attachments: {},
+    _rev: '',
+  };
+}
+
+/**
+ * Normalize package properties, tags, revision id.
+ * @param {Object} pkg package reference.
+ */
+export function normalizePackage(pkg: Manifest): Manifest {
+  const pkgProperties = ['versions', 'dist-tags', '_distfiles', '_attachments', '_uplinks', 'time'];
+
+  pkgProperties.forEach((key): void => {
+    const pkgProp = pkg[key];
+
+    if (isNil(pkgProp) || validatioUtils.isObject(pkgProp) === false) {
+      pkg[key] = {};
+    }
+  });
+
+  if (typeof pkg?._rev !== 'string') {
+    pkg._rev = STORAGE.DEFAULT_REVISION;
+  }
+
+  if (typeof pkg?._id !== 'string') {
+    pkg._id = pkg.name;
+  }
+
+  // normalize dist-tags
+  return normalizeDistTags(pkg);
+}
+
+export function generateRevision(rev: string): string {
+  const _rev = rev.split('-');
+
+  return (+_rev[0] || 0) + 1 + '-' + generateRandomHexString();
+}
+
+export function getLatestReadme(pkg: Manifest): string {
+  const versions = pkg['versions'] || {};
+  const distTags = pkg[DIST_TAGS] || {};
+  // FIXME: here is a bit tricky add the types
+  const latestVersion: Version | any = distTags['latest'] ? versions[distTags['latest']] || {} : {};
+  let readme = _.trim(pkg.readme || latestVersion.readme || '');
+  if (readme) {
+    return readme;
+  }
+
+  // In case of empty readme - trying to get ANY readme in the following order:
+  // 'next','beta','alpha','test','dev','canary'
+  const readmeDistTagsPriority = ['next', 'beta', 'alpha', 'test', 'dev', 'canary'];
+  readmeDistTagsPriority.forEach(function (tag): string | void {
+    if (readme) {
+      return readme;
+    }
+    const version: Version | any = distTags[tag] ? versions[distTags[tag]] || {} : {};
+    readme = _.trim(version.readme || readme);
+  });
+  return readme;
+}
+
+// FIXME: type any due this
+export function cleanUpReadme(version: any): Version {
+  if (isNil(version) === false) {
+    delete version.readme;
+  }
+
+  return version;
+}
+
+export const WHITELIST = [
+  '_rev',
+  'name',
+  'versions',
+  'dist-tags',
+  'readme',
+  'time',
+  '_id',
+  'users',
+];
+
+export function cleanUpLinksRef(result: Manifest, keepUpLinkData?: boolean): Manifest {
+  const propertyToKeep = [...WHITELIST];
+  if (keepUpLinkData === true) {
+    propertyToKeep.push('_uplinks');
+  }
+
+  for (const i in result) {
+    if (propertyToKeep.indexOf(i) === -1) {
+      // Remove sections like '_uplinks' from response
+      delete result[i];
+    }
+  }
+
+  return result;
+}
+
+// TODO: move to abstract storage
+// @deprecated use abstract.storage.ts:checkPackageRemote
+export function checkPackageRemote(
+  name: string,
+  isAllowPublishOffline: boolean,
+  syncMetadata: Function
+): Promise<any> {
+  return new Promise<void>((resolve, reject): void => {
+    syncMetadata(name, null, {}, (err, packageJsonLocal, upLinksErrors): void => {
+      // something weird
+      if (err && err.status !== HTTP_STATUS.NOT_FOUND) {
+        return reject(err);
+      }
+
+      // checking package exist already
+      if (isNil(packageJsonLocal) === false) {
+        return reject(errorUtils.getConflict(API_ERROR.PACKAGE_EXIST));
+      }
+
+      for (let errorItem = 0; errorItem < upLinksErrors.length; errorItem++) {
+        // checking error
+        // if uplink fails with a status other than 404, we report failure
+        if (isNil(upLinksErrors[errorItem][0]) === false) {
+          if (upLinksErrors[errorItem][0].status !== HTTP_STATUS.NOT_FOUND) {
+            if (isAllowPublishOffline) {
+              return resolve();
+            }
+
+            return reject(errorUtils.getServiceUnavailable(API_ERROR.UPLINK_OFFLINE_PUBLISH));
+          }
+        }
+      }
+
+      return resolve();
+    });
+  });
+}
+
+// @deprecated use export function mergeUplinkTimeIntoLocalNext
+export function mergeUplinkTimeIntoLocal(localMetadata: Manifest, remoteMetadata: Manifest): any {
+  if ('time' in remoteMetadata) {
+    return Object.assign({}, localMetadata.time, remoteMetadata.time);
+  }
+
+  return localMetadata.time;
+}
+
+export function mergeUplinkTimeIntoLocalNext(
+  cacheManifest: Manifest,
+  remoteManifest: Manifest
+): Manifest {
+  if ('time' in remoteManifest) {
+    // remote override cache time conflicts
+    return { ...cacheManifest, time: { ...cacheManifest.time, ...remoteManifest.time } };
+  }
+
+  return cacheManifest;
+}
+
+export function updateUpLinkMetadata(uplinkId, manifest: Manifest, etag: string) {
+  const _uplinks = {
+    ...manifest._uplinks,
+    [uplinkId]: {
+      etag,
+      fetched: Date.now(),
+    },
+  };
+  return {
+    ...manifest,
+    _uplinks,
+  };
+}
+
+export function prepareSearchPackage(data: Manifest): any {
+  const latest = pkgUtils.getLatest(data);
+
+  if (latest && data.versions[latest]) {
+    const version: Version = data.versions[latest];
+    const versions: any = { [latest]: 'latest' };
+    const pkg: any = {
+      name: version.name,
+      description: version.description,
+      [DIST_TAGS]: { latest },
+      maintainers: version.maintainers || [version.author].filter(Boolean),
+      author: version.author,
+      repository: version.repository,
+      readmeFilename: version.readmeFilename || '',
+      homepage: version.homepage,
+      keywords: version.keywords,
+      bugs: version.bugs,
+      license: version.license,
+      // time: {
+      //   modified: time,
+      // },
+      versions,
+    };
+
+    return pkg;
+  }
+}
+
+export function isDifferentThanOne(versions: Versions | AttachMents): boolean {
+  return Object.keys(versions).length !== 1;
+}
+
+// @deprecated use validationUtils.validatePublishNewPackage
+export function hasInvalidPublishBody(manifest: Pick<Manifest, '_attachments' | 'versions'>) {
+  if (!manifest) {
+    return false;
+  }
+
+  const { _attachments, versions } = manifest;
+  const res =
+    isObject(_attachments) === false ||
+    isDifferentThanOne(_attachments) ||
+    isObject(versions) === false ||
+    isDifferentThanOne(versions);
+  return res;
+}
+
+/**
+ * Function gets a local info and an info from uplinks and tries to merge it
+ exported for unit tests only.
+  * @param {*} local
+  * @param {*} remoteManifest
+  * @param {*} config configuration file
+  */
+export function mergeVersions(cacheManifest: Manifest, remoteManifest: Manifest): Manifest {
+  let _cacheManifest = { ...cacheManifest };
+  const { versions, time } = remoteManifest;
+  // copy new versions to a cache
+  // NOTE: if a certain version was updated, we can't refresh it reliably
+  for (const i in versions) {
+    if (typeof cacheManifest.versions[i] === 'undefined') {
+      _cacheManifest.versions[i] = versions[i];
+    }
+  }
+
+  for (const i in time) {
+    if (typeof cacheManifest.time[i] === 'undefined') {
+      _cacheManifest.time[i] = time[i];
+    }
+  }
+
+  for (const distTag in remoteManifest[DIST_TAGS]) {
+    if (_cacheManifest[DIST_TAGS][distTag] !== remoteManifest[DIST_TAGS][distTag]) {
+      if (
+        !_cacheManifest[DIST_TAGS][distTag] ||
+        semver.lte(_cacheManifest[DIST_TAGS][distTag], remoteManifest[DIST_TAGS][distTag])
+      ) {
+        _cacheManifest[DIST_TAGS][distTag] = remoteManifest[DIST_TAGS][distTag];
+      }
+      if (
+        distTag === 'latest' &&
+        _cacheManifest[DIST_TAGS][distTag] === remoteManifest[DIST_TAGS][distTag]
+      ) {
+        // NOTE: this override the latest publish readme from local cache with
+        // the remote one
+        cacheManifest = { ..._cacheManifest, readme: remoteManifest.readme };
+      }
+    }
+  }
+
+  return cacheManifest;
+}
+
+/**
+ * Normalize dist-tags.
+ *
+ * There is a legacy behaviour where the dist-tags could be an array, in such
+ * case, the array is orderded and the highest version becames the
+ * latest.
+ *
+ * The dist-tag tags must be plain strigs, if the latest is empty (for whatever reason) is
+ * normalized to be the highest version available.
+ *
+ * This function cleans up every invalid version on dist-tags, but does not remove
+ * invalid versions from the manifest.
+ *
+ * @param {*} data
+ */
+export function normalizeDistTags(manifest: Manifest): Manifest {
+  let sorted;
+  // handle missing latest dist-tag
+  if (!manifest[DIST_TAGS].latest) {
+    // if there is no latest tag, set the highest known version based on semver sort
+    sorted = sortVersionsAndFilterInvalid(Object.keys(manifest.versions));
+    if (sorted?.length) {
+      // get the highest published version
+      manifest[DIST_TAGS].latest = sorted.pop();
+    }
+  }
+
+  for (const tag in manifest[DIST_TAGS]) {
+    // deprecated (will be removed un future majors)
+    // this should not happen, tags should be plain strings, legacy fallback
+    if (_.isArray(manifest[DIST_TAGS][tag])) {
+      if (manifest[DIST_TAGS][tag].length) {
+        // sort array
+        // FIXME: this is clearly wrong, we need to research why this is like this.
+        // @ts-ignore
+        sorted = sortVersionsAndFilterInvalid(manifest[DIST_TAGS][tag]);
+        if (sorted.length) {
+          // use highest version based on semver sort
+          manifest[DIST_TAGS][tag] = sorted.pop();
+        }
+      } else {
+        delete manifest[DIST_TAGS][tag];
+      }
+    } else if (_.isString(manifest[DIST_TAGS][tag])) {
+      if (!semver.parse(manifest[DIST_TAGS][tag], true)) {
+        // if the version is invalid, delete the dist-tag entry
+        delete manifest[DIST_TAGS][tag];
+      }
+    }
+  }
+
+  return manifest;
+}
+
+export function hasDeprecatedVersions(pkgInfo: Manifest): boolean {
+  const { versions } = pkgInfo;
+  for (const version in versions) {
+    if (Object.prototype.hasOwnProperty.call(versions[version], 'deprecated')) {
+      return true;
+    }
+  }
+  return false;
+}
+
+export function isDeprecatedManifest(manifest: Manifest): boolean {
+  return hasDeprecatedVersions(manifest) && Object.keys(manifest._attachments).length === 0;
+}