I can create a dist-tag with characters that encodeURIComponent encodes (🚀), but can not install one

[jpwilliams]

I'm opening this issue because:

• npm is crashing.
• npm is producing an incorrect install.
• npm is doing something I don't understand.
• Other (see below for feature requests):

What's going wrong?

My example here is with an emoji, but I assume anything that encodeURIComponent encodes will have the same effect.

I can create a dist-tag on a package by running (in my package's dir):

npm publish --tag 🚀

This then successfully creates the dist-tag. As an example, here's the output of running npm dist-tag ls gitree following a the above command:

latest: 0.0.3
🚀: 0.0.4

If I then attempt to download a package using this new dist-tag (in this case via npm install gitree@🚀), I get the following error:

Unhandled rejection Error: Invalid tag name "🚀": Tags may not have any characters that encodeURIComponent encodes.
    at invalidTagName (/Users/jpwilliams/.nvm/versions/node/v8.3.0/lib/node_modules/npm/node_modules/npm-package-arg/npa.js:76:15)
    at fromRegistry (/Users/jpwilliams/.nvm/versions/node/v8.3.0/lib/node_modules/npm/node_modules/npm-package-arg/npa.js:265:13)
    at resolve (/Users/jpwilliams/.nvm/versions/node/v8.3.0/lib/node_modules/npm/node_modules/npm-package-arg/npa.js:66:12)
    at npa (/Users/jpwilliams/.nvm/versions/node/v8.3.0/lib/node_modules/npm/node_modules/npm-package-arg/npa.js:39:10)
    at /Users/jpwilliams/.nvm/versions/node/v8.3.0/lib/node_modules/npm/lib/install/deps.js:200:16
    at /Users/jpwilliams/.nvm/versions/node/v8.3.0/lib/node_modules/npm/node_modules/slide/lib/async-map.js:52:35
    at Array.forEach (<anonymous>)
    at /Users/jpwilliams/.nvm/versions/node/v8.3.0/lib/node_modules/npm/node_modules/slide/lib/async-map.js:52:11
    at Array.forEach (<anonymous>)
    at asyncMap (/Users/jpwilliams/.nvm/versions/node/v8.3.0/lib/node_modules/npm/node_modules/slide/lib/async-map.js:51:8)
    at exports.getAllMetadata (/Users/jpwilliams/.nvm/versions/node/v8.3.0/lib/node_modules/npm/lib/install/deps.js:199:3)
    at Installer.loadArgMetadata (/Users/jpwilliams/.nvm/versions/node/v8.3.0/lib/node_modules/npm/lib/install.js:325:3)
    at /Users/jpwilliams/.nvm/versions/node/v8.3.0/lib/node_modules/npm/lib/install.js:656:16
    at BB.join.then (/Users/jpwilliams/.nvm/versions/node/v8.3.0/lib/node_modules/npm/lib/install/read-shrinkwrap.js:41:16)
    at tryCatcher (/Users/jpwilliams/.nvm/versions/node/v8.3.0/lib/node_modules/npm/node_modules/bluebird/js/release/util.js:16:23)
    at Promise._settlePromiseFromHandler (/Users/jpwilliams/.nvm/versions/node/v8.3.0/lib/node_modules/npm/node_modules/bluebird/js/release/promise.js:512:31)

I'd guess that creating a dist-tag somewhere needs the same check as installing one gets.

How can the CLI team reproduce the problem?

No npm-debug.log file to be found.

You can reproduce by following something along these lines, replacing foo with some available package name:

cd ~

mkdir foo
cd foo
npm init -y
npm publish --tag 🚀

cd ~

mkdir bar
cd bar
npm init -y
npm install foo@🚀

supporting information:

• npm -v prints: 5.3.0
• node -v prints: v8.3.0
• npm config get registry prints: https://registry.npmjs.org/
• Windows, OS X/macOS, or Linux?: OS X
• Network issues:
  • Geographic location where npm was run:
  • I use a proxy to connect to the npm registry.
  • I use a proxy to connect to the web.
  • I use a proxy when downloading Git repos.
  • I access the npm registry via a VPN
  • I don't use a proxy, but have limited or unreliable internet access.
• Container:
  • I develop using Vagrant on Windows.
  • I develop using Vagrant on OS X or Linux.
  • I develop / deploy using Docker.
  • I deploy to a PaaS (Triton, Heroku).