feat: using just credentials-by-uri instead of the whole npm

package.json

@@ -24,6 +24,7 @@
     "@types/ramda": "^0.24.1",
     "@types/retry": "^0.10.1",
     "@types/semver": "^5.3.32",
+    "credentials-by-uri": "^1.0.0",
     "dint": "^1.0.0",
     "drive-by-path": "^0.1.0",
     "encode-registry": "^1.0.0",
@@ -35,7 +36,6 @@
     "normalize-path": "^2.1.1",
     "normalize-registry-url": "^1.0.0",
     "normalize-ssh": "^1.0.0",
-    "npm": "^5.1.0",
     "os-homedir": "^1.0.2",
     "p-limit": "^1.1.0",
     "p-queue": "^1.1.0",

shrinkwrap.yaml

@@ -4,6 +4,7 @@ dependencies:
   '@types/ramda': 0.24.14
   '@types/retry': 0.10.1
   '@types/semver': 5.4.0
+  credentials-by-uri: 1.0.0
   dint: 1.0.0
   drive-by-path: 0.1.0
   encode-registry: 1.0.0
@@ -15,7 +16,6 @@ dependencies:
   normalize-path: 2.1.1
   normalize-registry-url: 1.0.0
   normalize-ssh: 1.0.0
-  npm: 5.4.2
   os-homedir: 1.0.2
   p-limit: 1.1.0
   p-queue: 1.2.0
@@ -299,6 +299,11 @@ packages:
   /core-util-is/1.0.2:
     resolution:
       integrity: sha1-tf1UIgqivFq1eqtxQMlAdUUDwac=
+  /credentials-by-uri/1.0.0:
+    dependencies:
+      nerf-dart: 1.0.0
+    resolution:
+      integrity: sha512-WtoZkGQV2KgEfEqWKPetJ2btv+GxldzOe2vHVqAcyuiYdpIwCX7viL2+P9EaZLLfR+SFAZgPdP1+HZJ7MqRc2A==
   /cross-spawn/5.1.0:
     dependencies:
       lru-cache: 4.1.1
@@ -1110,6 +1115,9 @@ packages:
     dev: true
     resolution:
       integrity: sha1-rmA7NrE0vOw0e0UkIrC/mNWDLsg=
+  /nerf-dart/1.0.0:
+    resolution:
+      integrity: sha1-5tq3/r9a2Bbqgc9cYpxaDr3nLBo=
   /node-abi/2.1.1:
     resolution:
       integrity: sha512-6oxV13poCOv7TfGvhsSz6XZWpXeKkdGVh72++cs33OfMh3KAX8lN84dCvmqSETyDXAFcUHtV7eJrgFBoOqZbNQ==
@@ -1155,9 +1163,6 @@ packages:
     dev: true
     resolution:
       integrity: sha1-FOfHjBKIvW2CB4dpx6qVg/xBPAM=
-  /npm/5.4.2:
-    resolution:
-      integrity: sha512-F6LLCAHriKyKQ9Ff03UKCjkXZoRBp281I42K42+VeHfjAXZ3TJdg3RccinzoCFV1kDxCedVm7AstIpb1Uf5UkQ==
   /npmlog/4.1.2:
     dependencies:
       are-we-there-yet: 1.1.4
@@ -1839,6 +1844,7 @@ specifiers:
   '@types/semver': ^5.3.32
   '@types/tape': ^4.2.30
   commitizen: ^2.8.6
+  credentials-by-uri: ^1.0.0
   cz-conventional-changelog: ^2.0.0
   dint: ^1.0.0
   drive-by-path: ^0.1.0
@@ -1853,7 +1859,6 @@ specifiers:
   normalize-path: ^2.1.1
   normalize-registry-url: ^1.0.0
   normalize-ssh: ^1.0.0
-  npm: ^5.1.0
   npm-scripts-info: ^0.3.6
   os-homedir: ^1.0.2
   p-limit: ^1.1.0

src/network/got.ts

@@ -7,7 +7,7 @@ import path = require('path')
 import createWriteStreamAtomic = require('fs-write-stream-atomic')
 import ssri = require('ssri')
 import unpackStream = require('unpack-stream')
-import npmGetCredentialsByURI = require('npm/lib/config/get-credentials-by-uri')
+import getCredentialsByURI = require('credentials-by-uri')
 import urlLib = require('url')
 import normalizeRegistryUrl = require('normalize-registry-url')
 import PQueue = require('p-queue')
@@ -67,14 +67,9 @@ export default (
     randomize: opts.randomize,
   }
 
-  const getCredentialsByURI = npmGetCredentialsByURI.bind({
-    get (key: string) {
-      return opts.rawNpmConfig[key]
-    }
-  })
-
   let counter = 0
   const networkConcurrency = opts.networkConcurrency || 16
+  const rawNpmConfig = opts.rawNpmConfig || {}
   const requestsQueue = new PQueue({
     concurrency: networkConcurrency,
   })
@@ -82,7 +77,7 @@ export default (
   async function getJSON (url: string, registry: string, priority?: number) {
     return requestsQueue.add(() => new Promise((resolve, reject) => {
     const getOpts = {
-        auth: getCredentialsByURI(registry),
+        auth: getCredentialsByURI(registry, rawNpmConfig),
         fullMetadata: false,
       }
       client.get(url, getOpts, (err: Error, data: Object, raw: Object, res: HttpResponse) => {
@@ -109,7 +104,7 @@ export default (
     return requestsQueue.add(async () => {
       await mkdirp(path.dirname(saveto))
 
-      const auth = opts.registry && getCredentialsByURI(opts.registry)
+      const auth = opts.registry && getCredentialsByURI(opts.registry, rawNpmConfig)
       // If a tarball is hosted on a different place than the manifest, only send
       // credentials on `alwaysAuth`
       const shouldAuth = auth && (

typings/index.d.ts

@@ -214,16 +214,6 @@ declare module 'is-inner-link' {
   export = anything;
 }
 
-declare module 'npm/lib/config/defaults' {
-  const anything: any;
-  export = anything;
-}
-
-declare module 'npm/lib/config/get-credentials-by-uri' {
-  const anything: any;
-  export = anything;
-}
-
 declare module 'pnpm-registry-mock' {
   const anything: any;
   export = anything;