Skip to content
A storage and developer workflow engine for enforcing arbitrary checks on ontologies of npm packages.
Branch: master
Clone or download
Latest commit 5823169 May 9, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
.github [fix] give some credits to RN Apr 19, 2019
assets [fix] promote May 8, 2019
bin [fix] allround fixes May 8, 2019
lib [dist][fix] bump bffs / cdnup and fix swagger spec for publish to inc… ( Apr 2, 2019
scripts [dist] code and tests Nov 30, 2016
test [dist] fix release-line swagger (#41) Mar 15, 2019
.gitattributes [fix] support auth on the whole API surface (#15) Dec 5, 2017
.gitignore dereference the swagger spec (#43) Mar 20, 2019
.npmignore dereference the swagger spec (#43) Mar 20, 2019
.travis.yml [Major] Add OpenApi docs, remove `Checks`, remove `/assets/:hash` (#39) Mar 4, 2019 [doc] changelog May 8, 2019 [fix] newlines Apr 17, 2019
LICENSE [minor] initial setup of more docs Apr 15, 2019 [doc] provide alts for img May 9, 2019
config.example.json [dist][fix] bump bffs / cdnup and fix swagger spec for publish to inc… ( Apr 2, 2019
package-lock.json [fix] diagram generation script May 7, 2019
package.json [fix] diagram generation script May 7, 2019


A storage and developer workflow engine for npm packages.


The goal of the Warehouse is to support modular UI development by:

In other words the Warehouse is designed to give as many programmatic guarantees that it is safe to "always be on latest" and make rolling back as painless as possible when issues arise.

Developer Experience

The Warehouse was created with specific conventions around how developers release code:

  1. Front-end code is built to be modular by design.
  2. A module must be up-to-date with the latest version of its dependencies.
  3. Each module is released using npm publish
  4. Each module is released to production using npm dist-tag

Releasing code

Stability: 2 – Stable

The release process for any module using the Warehouse is:

  1. Add the following publishConfig to your package.json
"publishConfig": {
  "registry": ""
  1. Publish the module@version which releases it to your DEV environment.
cd /path/to/my/front-end/module
npm publish

Diagram of npm publish workflow to

  1. Perform any manual QA in your DEV environment.
  2. Promote the module@version to production using npm dist-tag add
npm dist-tag add module@version prod

Diagram of npm dist-tag promotion of modules builds are an interaction between multiple smaller microservices to garantuee high concurrency and stability.

Diagram of build workflow of a single package in

NOTE In order to publish to warehouse you must add the following to your .npmrc. Authorization information is stubbed to let the npm client itself actually make the publish request and not just throw an error before it even tries.


NOTE: You may also need to set strict-ssl to false if you do not configure SSL termination for

npm c set strict-ssl false

Automatically build dependents

Stability: 2 – Stable

After a package build completes will query the database for any dependant modules. Builds for dependents will automatically be queued. The system will walk all the way up the dependency tree until it reaches a "top-level" package.

NOTE Dependent builds are only performed if the dependent has opted for building with

Diagram of build scheduling of dependent packages

Rolling back to previous versions

Stability: 2 – Stable

The act of rolling back to a previous version takes two forms in the Warehouse:

  1. Rolling back a top-level module: if a module has no dependents (i.e. nothing depends on a given module) then that module is considered "top-level". In this case a rollback in a specific environment will use the previous build of the version being rolled back to with no other side-effects.
  2. Rolling back a module depended on by other modules: if a module has dependents (i.e. other modules depend on a given module) then rolling back to a previous version in a specific environment will roll back the top level module and all dependent modules to the version they were on for the given release-line.

Rollback is performed using npm dist-tag. For example if my-module has a production version of 1.0.5:

npm view my-module dist-tags
  latest: '1.0.5',
  devtest: '1.0.5',
  production: '1.0.5'

And we wish to rollback production to 1.0.4 then:

npm dist-tag add my-module@1.0.4 prod

This will trigger a build of my-module@1.0.4 (since it's dependencies may have changed since 1.0.4 was latest in production) and a build of all modules that depend on my-module.

Auto-update of builds

Stability: 1 – Unstable

The first (and most important) point developers need to be aware of is that builds from the Warehouse are always on latest version of private dependencies tagged with that particular environment.

In other words the version specified in the package.json may not match the version used in builds, by design. For example if a module that has the following dependencies:

  "dependencies": {
    "private-dep-1": "1.0.x",
    "private-dep-2": "1.2.x",
    "private-dep-3": "~1.7.5",
    "public-dep-1": "1.0.x",
    "public-dep-2": "1.2.x"

And the latest versions tagged with "production" and "devtest" are, respectively:



Then the build the Warehouse returns for your module will include those dependencies.

Depedency resolution

API documentation

The Warehouse implements four distinct APIs over HTTP:

  • npm wire protocol: This is the HTTP API that the npm CLI client speaks. This allows the Warehouse to be a publish and install target for the npm CLI client itself. The wire protocol is implemented in two ways:

    • Overridden routes: These are routes that the warehouse itself has reimplemented to ensure that builds are fresh and that modules are installed from the correct environment.
    • npm proxying: before any 404 is served the request is first proxied over HTTP(S) to the location specified via
  • Assets & Builds: Creating ad-hoc builds, fetching builds and assets (based on fingerprint), and when necessary finding builds for a particular version or environment or both.

  • All routes are able to get some debugging information by using the ?debug=* query parameter. This will override the output of your request and show all logged output for that request as JSON, response headers that were intended to be sent back, and content that was sent back.

npm wire protocol

The following routes from the npm wire protocol are implemented:

PUT    /:pkg                          # Publish a package
GET    /:pkg                          # Install a package
DELETE /:pkg/-rev/:rev                # Unpublish a package
GET    /-/package/:pkg/dist-tags/     # Get all dist-tags
PUT    /-/package/:pkg/dist-tags/     # Update a dist-tag
POST   /-/package/:pkg/dist-tags/     # Set all dist-tags
GET    /-/package/:pkg/dist-tags/:tag # Get a dist-tag
PUT    /-/package/:pkg/dist-tags/:tag # Update a dist-tag
POST   /-/package/:pkg/dist-tags/:tag # Set a dist-tag

The rest of the requests related to the npm wire protocol will be sent to the npm read or write URL specified in the configuration

Assets & Builds API

GET  /builds/:pkg                     # Get build information
GET  /builds/:pkg/:env/:version       # Get build information
GET  /builds/:pkg/:env/:version/meta  # Get build information
POST /builds/:pkg                     # Ad-hoc build
POST /builds/compose                  # Trigger multiple builds

To use the fingerprinted assets from the CDN the build information can be fetched through the above API endpoints or by using the

Diagram of web services retrieving CDN metadata of builds

Packages API

GET  /packages/                       # Get information about all packages
GET  /packages/:pkg                   # Get information about a specific package
POST /packages/search                 # Search for packages (if redis is configured)

Release Line API

GET /release-line/:pkg/:version?      # Get release line for specified package and version (or latest if not defined)

Environment-specific installation

Warehouse allows for installation against a specific dist-tag via the REGISTRY-ENVIRONMENT header. Although npm does not allow for headers to be set directly, [carpenter] sets these headers internally during it's install process.

This is how multiple versions live and are built side-by-side in the same registry namespace. Without this nuance, the latest npm dist-tag would be installed by default everywhere, including carpenterd.

Future extensions to this header-only API are planned:

GET /env/:pkg  # Install a package against a specified "environment" (i.e. `dist-tag`) Internals

The purpose of this section is to document important internals, conventions and patterns used by the Warehouse.

Internals and conventions

Data Models

Currently the data models defined by the Warehouse are:

  • Build
  • BuildFile
  • BuildHead
  • Dependent
  • Version
  • Package

They are documented individually in warehouse-models.

Config options

  npm: {
    urls: {
      "auth-argument-factory": "/path/to/custom-auth.js",
      read: '',
      write: ''
    cluster: {
      // Gjallarhorn related options
      gid: 0
      uid: 0
    // NpmVerifyStream related options
    concurrency: 5,
    cleanup: true,
    read: { log: /* a debug logger */ }


Warehouse has the ability to use passport-npm to check authorization when connecting via npm. An example of this can be found in the tests for npm auth.

Local development environment

Running locally requires carpenterd to run locally or at the configured location as builds will run in carpenterd. Then the can be started using:

npm start

Running tests

Running the tests will require a running cassandra instance on your local machine. All tests are written with mocha and istanbul. They can be run with npm:

npm test
LICENSE: MIT (C) 2015 Operating Company, LLC
You can’t perform that action at this time.