NOTE: this package is still under heavy development. Please don't use it yet
pacote is a Node.js library for downloading
npm-compatible packages. It supports all package specifier
syntax that npm install and its ilk support. It transparently caches anything
needed to reduce excess operations, using cacache.
$ npm install --save pacote
const pacote = require('pacote')
pacote.manifest('pacote@^1').then(pkg => {
console.log('package manifest for registry pkg:', pkg)
// { "name": "pacote", "version": "1.0.0", ... }
})
pacote.extract('http://hi.com/pkg.tgz', './here').then(() => {
console.log('remote tarball contents extracted to ./here')
})- Handles all package types npm does
- high-performance, reliable, verified local cache
- offline mode
- authentication support (private git, private npm registries, etc)
- github, gitlab, and bitbucket-aware
- semver range support for git dependencies
The pacote team enthusiastically welcomes contributions and project participation! There's a bunch of things you can do if you want to contribute! The Contributor Guide has all the information you need for everything from reporting bugs to contributing entire new features. Please don't hesitate to jump in if you'd like to, or even ask us questions if something isn't clear.
Fetches the manifest for a package. Manifest objects are similar and based
on the package.json for that package, but with pre-processed and limited
fields. The object has the following shape:
{
"name": PkgName,
"version": SemverString,
"dependencies": { PkgName: SemverString },
"optionalDependencies": { PkgName: SemverString },
"devDependencies": { PkgName: SemverString },
"peerDependencies": { PkgName: SemverString },
"bundleDependencies": false || [PkgName],
"bin": { BinName: Path },
"_resolved": TarballSource, // different for each package type
"_integrity": SubresourceIntegrityHash,
"_shrinkwrap": null || ShrinkwrapJsonObj
}Note that depending on the spec type, some additional fields might be present.
For example, packages from registry.npmjs.org have additional metadata
appended by the registry.
pacote.manifest('[email protected]').then(pkgJson => {
// fetched `package.json` data from the registry
})Extracts package data identified by <spec> into a directory named
<destination>, which will be created if it does not already exist.
If opts.digest is provided and the data it identifies is present in the cache,
extract will bypass most of its operations and go straight to extracting the
tarball.
pacote.extract('[email protected]', './woot', {
digest: 'deadbeef'
}).then(() => {
// Succeeds as long as `[email protected]` still exists somewhere. Network and
// other operations are bypassed entirely if `digest` is present in the cache.
})Fetches package data identified by <spec>, usually for the purpose of warming
up the local package cache (with opts.cache). It does not return anything.
pacote.prefetch('[email protected]', { cache: './my-cache' }).then(() => {
// ./my-cache now has both the manifest and tarball for `[email protected]`.
})This utility function can be used to force pacote to release its references to any memoized data in its various internal caches. It might help free some memory.
pacote.manifest(...).then(() => pacote.clearMemoized)If provided, pacote will confirm that the relevant integrity hash for each
operation's results matches the given digest. The call will return EINTEGRITY
if the check fails.
Additionally, pacote.extract will use this integrity string check the cache
directly for matching contents before performing any other operations.
Default: silentNpmLog
An npmlog-compatible logger. Will be used to log
various events at the levels specified by npmlog.