npm

type Candidate struct {
	// Version is the index's cleaned version.
	Version string
	// Published is when its tarball was last deployed (Metadata.Published).
	Published time.Time
}

type Dist struct {
	// Shasum is the stored SHA-1, in hex.
	Shasum string `json:"shasum"`
	// Integrity is the stored SHA-512 in Subresource Integrity form.
	Integrity string `json:"integrity"`
}

type Handler struct {
	// The generic format's hooks for what npm leaves alone. Admit adds the
	// release and snapshot handling to its deploy policy (policy.go). A
	// republish's 403 belongs to the npm publish protocol: a REST deploy
	// over a tarball is an overwrite, which needs Delete, as for any item
	// (decision 0034).
	generic.Handler
	// Settings are the server's npm options.
	Settings Settings
}

type Metadata struct {
	// Manifest is the tarball's package.json, compacted. Its version is as
	// the author wrote it; the index's version is the cleaned one.
	Manifest json.RawMessage `json:"manifest"`
	Dist     Dist            `json:"dist"`
	// HasInstallScript is Tarball.HasInstallScript.
	HasInstallScript bool `json:"has_install_script,omitempty"`
	// Tags are the dist-tags the tarball carries (npm.disttag), sorted.
	Tags []string `json:"tags,omitempty"`
	// Deprecated is the tarball's npm.deprecated message.
	Deprecated string `json:"deprecated,omitempty"`
	// Published is when the tarball was last deployed, in UTC to the
	// microsecond the stores keep.
	Published time.Time `json:"published"`
}

type Settings struct {
	// TagLatestByPublish is npm.tag_latest_by_publish, 7.x's
	// artifactory.npm.tag.tagLatestByPublish: in rules 2 and 4 the version
	// deployed last outranks the others, pre-releases included, rather
	// than the highest. 7.x has it off by default (6.20's ConstantValues;
	// RTFACT-9754, RTFACT-20127).
	TagLatestByPublish bool
	// EnforcePath is npm.enforce_path, 7.x's artifactory.npm.enforce.path:
	// a package tarball deployed to a local repository under a file name
	// other than the one its package.json gives is refused (Admit). 7.x
	// has it off by default (npm-repositories).
	EnforcePath bool
}

type Tarball struct {
	// SHA256 is the content read, so a hook can tell the inspection of its
	// own write from one of other content.
	SHA256 string
	// Name is package.json's; Version is package.json's as CleanVersion
	// leaves it.
	Name, Version string
	// Manifest is package.json, compacted.
	Manifest json.RawMessage
	// Description and Keywords are package.json's, as npm normalises them:
	// a description that is no string is none, and keywords given as one
	// string are split at commas.
	Description string
	Keywords    []string
	// License is package.json's license when it is a string, an SPDX
	// expression such as "MIT" or "(MIT OR Apache-2.0)".
	License string
	// HasInstallScript is whether installing runs a script: a preinstall,
	// install or postinstall script, or a binding.gyp, for which npm runs
	// node-gyp rebuild unless gypfile is false.
	HasInstallScript bool
}

type WorkRequest struct {
	// By is recorded as the mover of what a conversion moves.
	By string `json:"by,omitempty"`
}