use new npm-registry-client API

Makes a *lot* clearer when the CLI is doing something with auth
implications, by explicitly pass auth to registry client.  Moves lookup
of credentials into mapRegistryToURI, which makes the code more
consistent.

21 files changed, 206 insertions, 175 deletions

diff --git a/lib/adduser.js b/lib/adduser.js
index 9693aebd3..6c8a652be 100644
--- a/lib/adduser.js
+++ b/lib/adduser.js
@@ -3,7 +3,6 @@ module.exports = adduser
 
 var log = require("npmlog")
   , npm = require("./npm.js")
-  , registry = npm.registry
   , read = require("read")
   , userValidate = require("npm-user-validate")
   , crypto
@@ -125,13 +124,6 @@ function readEmail (c, u, cb) {
 }
 
 function save (c, u, cb) {
-  if (c.changed) {
-    delete registry.auth
-    delete registry.username
-    delete registry.password
-    registry.username = u.u
-    registry.password = u.p
-  }
   npm.spinner.start()
 
   // save existing configs, but yank off for this PUT
@@ -146,14 +138,17 @@ function save (c, u, cb) {
     if (scopedRegistry) uri = scopedRegistry
   }
 
-  registry.adduser(uri, u.u, u.p, u.e, function (er, doc) {
+  var params = {
+    auth : {
+      username : u.u,
+      password : u.p,
+      email    : u.e
+    }
+  }
+  npm.registry.adduser(uri, params, function (er, doc) {
     npm.spinner.stop()
     if (er) return cb(er)
 
-    registry.username = u.u
-    registry.password = u.p
-    registry.email = u.e
-
     // don't want this polluting the configuration
     npm.config.del("_token", "user")
 
diff --git a/lib/bugs.js b/lib/bugs.js
index 16744cd5c..ea27bdd82 100644
--- a/lib/bugs.js
+++ b/lib/bugs.js
@@ -4,7 +4,6 @@ module.exports = bugs
 bugs.usage = "npm bugs <pkgname>"
 
 var npm = require("./npm.js")
-  , registry = npm.registry
   , log = require("npmlog")
   , opener = require("opener")
   , path = require("path")
@@ -15,10 +14,10 @@ var npm = require("./npm.js")
 
 bugs.completion = function (opts, cb) {
   if (opts.conf.argv.remain.length > 2) return cb()
-  mapToRegistry("-/short", npm.config, function (er, uri) {
+  mapToRegistry("-/short", npm.config, function (er, uri, auth) {
     if (er) return cb(er)
 
-    registry.get(uri, { timeout : 60000 }, function (er, list) {
+    npm.registry.get(uri, { timeout : 60000, auth : auth }, function (er, list) {
       return cb(null, list || [])
     })
   })
@@ -27,8 +26,10 @@ bugs.completion = function (opts, cb) {
 function bugs (args, cb) {
   var n = args.length && npa(args[0]).name || '.'
   fs.stat(n, function (er, s) {
-    if (er && er.code === "ENOENT") return callRegistry(n, cb)
-    else if (er) return cb (er)
+    if (er) {
+      if (er.code === "ENOENT") return callRegistry(n, cb)
+      return cb(er)
+    }
     if (!s.isDirectory()) return callRegistry(n, cb)
     readJson(path.resolve(n, "package.json"), function(er, d) {
       if (er) return cb(er)
@@ -38,35 +39,36 @@ function bugs (args, cb) {
 }
 
 function getUrlAndOpen (d, cb) {
-  var bugs = d.bugs
-    , repo = d.repository || d.repositories
+  var repo = d.repository || d.repositories
     , url
-  if (bugs) {
-    url = (typeof url === "string") ? bugs : bugs.url
-  } else if (repo) {
+  if (d.bugs) {
+    url = (typeof d.bugs === "string") ? d.bugs : d.bugs.url
+  }
+  else if (repo) {
     if (Array.isArray(repo)) repo = repo.shift()
     if (repo.hasOwnProperty("url")) repo = repo.url
-    log.verbose("repository", repo)
-    if (bugs && bugs.match(/^(https?:\/\/|git(:\/\/|@))github.com/)) {
-      url = bugs.replace(/^git(@|:\/\/)/, "https://")
+    log.verbose("bugs", "repository", repo)
+    if (repo && repo.match(/^(https?:\/\/|git(:\/\/|@))github.com/)) {
+      url = repo.replace(/^git(@|:\/\/)/, "https://")
                 .replace(/^https?:\/\/github.com:/, "https://github.com/")
-                .replace(/\.git$/, '')+"/issues"
+                .replace(/\.git$/, "")+"/issues"
     }
   }
   if (!url) {
-    url = "https://npmjs.org/package/" + d.name
+    url = "https://www.npmjs.org/package/" + d.name
   }
+  log.silly("bugs", "url", url)
   opener(url, { command: npm.config.get("browser") }, cb)
 }
 
-function callRegistry (n, cb) {
-  mapToRegistry(n, npm.config, function (er, uri) {
+function callRegistry (name, cb) {
+  mapToRegistry(name, npm.config, function (er, uri, auth) {
     if (er) return cb(er)
 
-    registry.get(uri + "/latest", { timeout : 3600 }, function (er, d) {
+    npm.registry.get(uri + "/latest", { auth : auth }, function (er, d) {
       if (er) return cb(er)
 
-      getUrlAndOpen (d, cb)
+      getUrlAndOpen(d, cb)
     })
   })
 }
diff --git a/lib/cache.js b/lib/cache.js
index e1afb0d15..d775541ec 100644
--- a/lib/cache.js
+++ b/lib/cache.js
@@ -285,7 +285,7 @@ function add (args, where, cb) {
         addLocal(p, null, cb)
         break
       case "remote":
-        addRemoteTarball(p.spec, {name : p.name}, null, cb)
+        addRemoteTarball(p.spec, {name : p.name}, null, null, cb)
         break
       case "git":
         addRemoteGit(p.spec, false, cb)
diff --git a/lib/cache/add-named.js b/lib/cache/add-named.js
index 1bd7af144..cb5a3fa8a 100644
--- a/lib/cache/add-named.js
+++ b/lib/cache/add-named.js
@@ -7,7 +7,6 @@ var path = require("path")
   , readJson = require("read-package-json")
   , url = require("url")
   , npm = require("../npm.js")
-  , registry = npm.registry
   , deprCheck = require("../utils/depr-check.js")
   , inflight = require("inflight")
   , addRemoteTarball = require("./add-remote-tarball.js")
@@ -18,7 +17,7 @@ var path = require("path")
 module.exports = addNamed
 
 function getOnceFromRegistry (name, from, next, done) {
-  mapToRegistry(name, npm.config, function (er, uri) {
+  mapToRegistry(name, npm.config, function (er, uri, auth) {
     if (er) return done(er)
 
     var key = "registry:" + uri
@@ -26,7 +25,7 @@ function getOnceFromRegistry (name, from, next, done) {
     if (!next) return log.verbose(from, key, "already in flight; waiting")
     else log.verbose(from, key, "not in flight; fetching")
 
-    registry.get(uri, null, next)
+    npm.registry.get(uri, { auth : auth }, next)
   })
 }
 
@@ -169,28 +168,28 @@ function addNameVersion (name, v, data, cb) {
     })
 
     function fetchit () {
-      if (!npm.config.get("registry")) {
-        return cb(new Error("Cannot fetch: "+dist.tarball))
-      }
-
-      // Use the same protocol as the registry.  https registry --> https
-      // tarballs, but only if they're the same hostname, or else detached
-      // tarballs may not work.
-      var tb = url.parse(dist.tarball)
-      var rp = url.parse(npm.config.get("registry"))
-      if (tb.hostname === rp.hostname
-          && tb.protocol !== rp.protocol) {
-        tb.protocol = url.parse(npm.config.get("registry")).protocol
-        delete tb.href
-      }
-      tb = url.format(tb)
-
-      // Only add non-shasum'ed packages if --forced. Only ancient things
-      // would lack this for good reasons nowadays.
-      if (!dist.shasum && !npm.config.get("force")) {
-        return cb(new Error("package lacks shasum: " + data._id))
-      }
-      return addRemoteTarball(tb, data, dist.shasum, cb)
+      mapToRegistry(name, npm.config, function (er, _, auth, ruri) {
+        if (er) return cb(er)
+
+        // Use the same protocol as the registry.  https registry --> https
+        // tarballs, but only if they're the same hostname, or else detached
+        // tarballs may not work.
+        var tb = url.parse(dist.tarball)
+        var rp = url.parse(ruri)
+        if (tb.hostname === rp.hostname && tb.protocol !== rp.protocol) {
+          tb.protocol = rp.protocol
+          delete tb.href
+        }
+        tb = url.format(tb)
+
+        // Only add non-shasum'ed packages if --forced. Only ancient things
+        // would lack this for good reasons nowadays.
+        if (!dist.shasum && !npm.config.get("force")) {
+          return cb(new Error("package lacks shasum: " + data._id))
+        }
+
+        addRemoteTarball(tb, data, dist.shasum, auth, cb)
+      })
     }
   }
 }
diff --git a/lib/cache/add-remote-tarball.js b/lib/cache/add-remote-tarball.js
index 9591ba89d..b55a10155 100644
--- a/lib/cache/add-remote-tarball.js
+++ b/lib/cache/add-remote-tarball.js
@@ -6,14 +6,13 @@ var mkdir = require("mkdirp")
   , retry = require("retry")
   , createWriteStream = require("fs-write-stream-atomic")
   , npm = require("../npm.js")
-  , registry = npm.registry
   , inflight = require("inflight")
   , addLocalTarball = require("./add-local-tarball.js")
   , cacheFile = require("npm-cache-filename")
 
 module.exports = addRemoteTarball
 
-function addRemoteTarball (u, pkgData, shasum, cb_) {
+function addRemoteTarball (u, pkgData, shasum, auth, cb_) {
   assert(typeof u === "string", "must have module URL")
   assert(typeof cb_ === "function", "must have callback")
 
@@ -42,11 +41,11 @@ function addRemoteTarball (u, pkgData, shasum, cb_) {
   log.verbose("addRemoteTarball", [u, shasum])
   mkdir(path.dirname(tmp), function (er) {
     if (er) return cb(er)
-    addRemoteTarball_(u, tmp, shasum, next)
+    addRemoteTarball_(u, tmp, shasum, auth, next)
   })
 }
 
-function addRemoteTarball_(u, tmp, shasum, cb) {
+function addRemoteTarball_ (u, tmp, shasum, auth, cb) {
   // Tuned to spread 3 attempts over about a minute.
   // See formula at <https://github.com/tim-kos/node-retry>.
   var operation = retry.operation({
@@ -59,7 +58,7 @@ function addRemoteTarball_(u, tmp, shasum, cb) {
   operation.attempt(function (currentAttempt) {
     log.info("retry", "fetch attempt " + currentAttempt
       + " at " + (new Date()).toLocaleTimeString())
-    fetchAndShaCheck(u, tmp, shasum, function (er, response, shasum) {
+    fetchAndShaCheck(u, tmp, shasum, auth, function (er, response, shasum) {
       // Only retry on 408, 5xx or no `response`.
       var sc = response && response.statusCode
       var statusRetry = !sc || (sc === 408 || sc >= 500)
@@ -72,8 +71,8 @@ function addRemoteTarball_(u, tmp, shasum, cb) {
   })
 }
 
-function fetchAndShaCheck (u, tmp, shasum, cb) {
-  registry.fetch(u, null, function (er, response) {
+function fetchAndShaCheck (u, tmp, shasum, auth, cb) {
+  npm.registry.fetch(u, { auth : auth }, function (er, response) {
     if (er) {
       log.error("fetch failed", u)
       return cb(er, response)
diff --git a/lib/dedupe.js b/lib/dedupe.js
index 74397d0cb..6a4abd730 100644
--- a/lib/dedupe.js
+++ b/lib/dedupe.js
@@ -240,10 +240,10 @@ function findVersions (npm, summary, cb) {
     var versions = data.versions
 
     var ranges = data.ranges
-    mapToRegistry(name, npm.config, function (er, uri) {
+    mapToRegistry(name, npm.config, function (er, uri, auth) {
       if (er) return cb(er)
 
-      npm.registry.get(uri, null, next)
+      npm.registry.get(uri, { auth : auth }, next)
     })
 
     function next (er, data) {
diff --git a/lib/deprecate.js b/lib/deprecate.js
index 17dd4eab0..c90ad9027 100644
--- a/lib/deprecate.js
+++ b/lib/deprecate.js
@@ -12,13 +12,16 @@ deprecate.completion = function (opts, cb) {
   if (opts.conf.argv.remain.length > 2) return cb()
   // get the list of packages by user
   var path = "/-/by-user/"
-  mapToRegistry(path, npm.config, function (er, uri) {
+  mapToRegistry(path, npm.config, function (er, uri, c) {
     if (er) return cb(er)
 
-    var c = npm.config.getCredentialsByURI(uri)
     if (!(c && c.username)) return cb()
 
-    npm.registry.get(uri + c.username, { timeout : 60000 }, function (er, list) {
+    var params = {
+      timeout : 60000,
+      auth    : c
+    }
+    npm.registry.get(uri + c.username, params, function (er, list) {
       if (er) return cb()
       console.error(list)
       return cb(null, list[c.username])
@@ -34,11 +37,14 @@ function deprecate (args, cb) {
   // fetch the data and make sure it exists.
   var p = npa(pkg)
 
-  mapToRegistry(p.name, npm.config, next)
-
-  function next (er, uri) {
+  mapToRegistry(p.name, npm.config, function (er, uri, auth) {
     if (er) return cb(er)
 
-    npm.registry.deprecate(uri, p.spec, msg, cb)
-  }
+    var params = {
+      version : p.spec,
+      message : msg,
+      auth    : auth
+    }
+    npm.registry.deprecate(uri, params, cb)
+  })
 }
diff --git a/lib/docs.js b/lib/docs.js
index dead3f755..3abeda7e2 100644
--- a/lib/docs.js
+++ b/lib/docs.js
@@ -5,10 +5,10 @@ docs.usage += "\n"
 docs.usage += "npm docs ."
 
 docs.completion = function (opts, cb) {
-  mapToRegistry("/-/short", npm.config, function (er, uri) {
+  mapToRegistry("/-/short", npm.config, function (er, uri, auth) {
     if (er) return cb(er)
 
-    registry.get(uri, { timeout : 60000 }, function (er, list) {
+    npm.registry.get(uri, { timeout : 60000, auth : auth }, function (er, list) {
       return cb(null, list || [])
     })
   })
@@ -57,10 +57,10 @@ function getDoc (project, cb) {
     return opener(url(json), { command: npm.config.get("browser") }, cb)
   }
 
-  mapToRegistry(project, npm.config, function (er, uri) {
+  mapToRegistry(project, npm.config, function (er, uri, auth) {
     if (er) return cb(er)
 
-    registry.get(uri + "/latest", { timeout : 3600 }, next)
+    npm.registry.get(uri + "/latest", { timeout : 3600, auth : auth }, next)
   })
 
   function next (er, json) {
diff --git a/lib/install.js b/lib/install.js
index e539307af..756d12ee3 100644
--- a/lib/install.js
+++ b/lib/install.js
@@ -33,11 +33,11 @@ install.completion = function (opts, cb) {
   // if it has a slash, then it's gotta be a folder
   // if it starts with https?://, then just give up, because it's a url
   // for now, not yet implemented.
-  var registry = npm.registry
-  mapToRegistry("-/short", npm.config, function (er, uri) {
+  mapToRegistry("-/short", npm.config, function (er, uri, auth) {
     if (er) return cb(er)
 
-    registry.get(uri, null, function (er, pkgs) {
+    var options = { auth : auth }
+    npm.registry.get(uri, options, function (er, pkgs) {
       if (er) return cb()
       if (!opts.partialWord) return cb(null, pkgs)
 
@@ -53,7 +53,7 @@ install.completion = function (opts, cb) {
       mapToRegistry(pkgs[0], npm.config, function (er, uri) {
         if (er) return cb(er)
 
-        registry.get(uri, null, function (er, d) {
+        npm.registry.get(uri, options, function (er, d) {
           if (er) return cb()
           return cb(null, Object.keys(d["dist-tags"] || {})
                     .concat(Object.keys(d.versions || {}))
diff --git a/lib/outdated.js b/lib/outdated.js
index fdfd7624d..db77601ef 100644
--- a/lib/outdated.js
+++ b/lib/outdated.js
@@ -269,10 +269,10 @@ function shouldUpdate (args, dir, dep, has, req, depth, cb) {
     return doIt("git", "git")
 
   // search for the latest package
-  mapToRegistry(dep, npm.config, function (er, uri) {
+  mapToRegistry(dep, npm.config, function (er, uri, auth) {
     if (er) return cb(er)
 
-    npm.registry.get(uri, null, updateDeps)
+    npm.registry.get(uri, { auth : auth }, updateDeps)
   })
 
   function updateDeps (er, d) {
diff --git a/lib/owner.js b/lib/owner.js
index 2fdee7adb..7d3d1f1c3 100644
--- a/lib/owner.js
+++ b/lib/owner.js
@@ -6,7 +6,6 @@ owner.usage = "npm owner add <username> <pkg>"
             + "\nnpm owner ls <pkg>"
 
 var npm = require("./npm.js")
-  , registry = npm.registry
   , log = require("npmlog")
   , readJson = require("read-package-json")
   , mapToRegistry = require("./utils/map-to-registry.js")
@@ -29,21 +28,21 @@ owner.completion = function (opts, cb) {
     switch (argv[2]) {
       case "ls":
         if (argv.length > 3) return cb()
-        return mapToRegistry("-/short", npm.config, function (er, uri) {
+        return mapToRegistry("-/short", npm.config, function (er, uri, auth) {
           if (er) return cb(er)
 
-          registry.get(uri, null, cb)
+          npm.registry.get(uri, { auth : auth }, cb)
         })
 
       case "rm":
         if (argv.length > 3) {
           theUser = encodeURIComponent(argv[3])
           byUser = "-/by-user/" + theUser + "|" + un
-          return mapToRegistry(byUser, npm.config, function (er, uri) {
+          return mapToRegistry(byUser, npm.config, function (er, uri, auth) {
             if (er) return cb(er)
 
             console.error(uri)
-            registry.get(uri, null, function (er, d) {
+            npm.registry.get(uri, { auth : auth }, function (er, d) {
               if (er) return cb(er)
               // return the intersection
               return cb(null, d[theUser].filter(function (p) {
@@ -58,11 +57,11 @@ owner.completion = function (opts, cb) {
         if (argv.length > 3) {
           theUser = encodeURIComponent(argv[3])
           byUser = "-/by-user/" + theUser + "|" + un
-          return mapToRegistry(byUser, npm.config, function (er, uri) {
+          return mapToRegistry(byUser, npm.config, function (er, uri, auth) {
             if (er) return cb(er)
 
             console.error(uri)
-            registry.get(uri, null, function (er, d) {
+            npm.registry.get(uri, { auth : auth }, function (er, d) {
               console.error(uri, er || d)
               // return mine that they're not already on.
               if (er) return cb(er)
@@ -75,10 +74,10 @@ owner.completion = function (opts, cb) {
           })
         }
         // just list all users who aren't me.
-        return mapToRegistry("-/users", npm.config, function (er, uri) {
+        return mapToRegistry("-/users", npm.config, function (er, uri, auth) {
           if (er) return cb(er)
 
-          registry.get(uri, null, function (er, list) {
+          npm.registry.get(uri, { auth : auth }, function (er, list) {
             if (er) return cb()
             return cb(null, Object.keys(list).filter(function (n) {
               return n !== un
@@ -109,10 +108,10 @@ function ls (pkg, cb) {
     ls(pkg, cb)
   })
 
-  mapToRegistry(pkg, npm.config, function (er, uri) {
+  mapToRegistry(pkg, npm.config, function (er, uri, auth) {
     if (er) return cb(er)
 
-    registry.get(uri, null, function (er, data) {
+    npm.registry.get(uri, { auth : auth }, function (er, data) {
       var msg = ""
       if (er) {
         log.error("owner ls", "Couldn't get owner data", pkg)
@@ -181,10 +180,10 @@ function rm (user, pkg, cb) {
 function mutate (pkg, user, mutation, cb) {
   if (user) {
     var byUser = "-/user/org.couchdb.user:" + user
-    mapToRegistry(byUser, npm.config, function (er, uri) {
+    mapToRegistry(byUser, npm.config, function (er, uri, auth) {
       if (er) return cb(er)
 
-      registry.get(uri, null, mutate_)
+      npm.registry.get(uri, { auth : auth }, mutate_)
     })
   } else {
     mutate_(null, null)
@@ -200,10 +199,10 @@ function mutate (pkg, user, mutation, cb) {
     }
 
     if (u) u = { "name" : u.name, "email" : u.email }
-    mapToRegistry(pkg, npm.config, function (er, uri) {
+    mapToRegistry(pkg, npm.config, function (er, uri, auth) {
       if (er) return cb(er)
 
-      registry.get(uri, null, function (er, data) {
+      npm.registry.get(uri, { auth : auth }, function (er, data) {
         if (er) {
           log.error("owner mutate", "Error getting package data for %s", pkg)
           return cb(er)
@@ -216,10 +215,15 @@ function mutate (pkg, user, mutation, cb) {
                , maintainers : m
                }
         var dataPath = pkg + "/-rev/" + data._rev
-        mapToRegistry(dataPath, npm.config, function (er, uri) {
+        mapToRegistry(dataPath, npm.config, function (er, uri, auth) {
           if (er) return cb(er)
 
-          registry.request("PUT", uri, { body : data }, function (er, data) {
+          var params = {
+            method : "PUT",
+            body : data,
+            auth : auth
+          }
+          npm.registry.request(uri, params, function (er, data) {
             if (!er && data.error) er = new Error(
               "Failed to update package metadata: " + JSON.stringify(data))
             if (er) {
diff --git a/lib/publish.js b/lib/publish.js
index 2a0fcff5a..f9abe5650 100644
--- a/lib/publish.js
+++ b/lib/publish.js
@@ -1,8 +1,7 @@
 
 module.exports = publish
 
-var url = require("url")
-  , npm = require("./npm.js")
+var npm = require("./npm.js")
   , log = require("npmlog")
   , path = require("path")
   , readJson = require("read-package-json")
@@ -12,6 +11,7 @@ var url = require("url")
   , RegClient = require("npm-registry-client")
   , mapToRegistry = require("./utils/map-to-registry.js")
   , cachedPackageRoot = require("./cache/cached-package-root.js")
+  , createReadStream = require("graceful-fs").createReadStream
 
 publish.usage = "npm publish <tarball>"
               + "\nnpm publish <folder>"
@@ -101,19 +101,27 @@ function publish_ (arg, data, isRetry, cachedir, cb) {
     )
   )
 
-  mapToRegistry(data.name, config, function (er, registryURI) {
+  mapToRegistry(data.name, config, function (er, registryURI, auth, registryBase) {
     if (er) return cb(er)
 
-    var tarball = cachedir + ".tgz"
+    var tarballPath = cachedir + ".tgz"
 
     // we just want the base registry URL in this case
-    var registryBase = url.resolve(registryURI, ".")
     log.verbose("publish", "registryBase", registryBase)
+    log.silly("publish", "uploading", tarballPath)
 
-    var c = config.getCredentialsByURI(registryBase)
-    data._npmUser = {name: c.username, email: c.email}
+    data._npmUser = {
+      name  : auth.username,
+      email : auth.email
+    }
+
+    var params = {
+      metadata : data,
+      body     : createReadStream(tarballPath),
+      auth     : auth
+    }
 
-    registry.publish(registryBase, data, tarball, function (er) {
+    registry.publish(registryBase, params, function (er) {
       if (er && er.code === "EPUBLISHCONFLICT"
           && npm.config.get("force") && !isRetry) {
         log.warn("publish", "Forced publish over " + data._id)
diff --git a/lib/repo.js b/lib/repo.js
index c6db8e37b..98195cb6e 100644
--- a/lib/repo.js
+++ b/lib/repo.js
@@ -15,7 +15,6 @@ repo.completion = function (opts, cb) {
 }
 
 var npm = require("./npm.js")
-  , registry = npm.registry
   , opener = require("opener")
   , github = require('github-url-from-git')
   , githubUserRepo = require("github-url-from-username-repo")
@@ -60,7 +59,7 @@ function callRegistry (n, cb) {
   mapToRegistry(n, npm.config, function (er, uri) {
     if (er) return cb(er)
 
-    registry.get(uri + "/latest", { timeout : 3600 }, function (er, d) {
+    npm.registry.get(uri + "/latest", { timeout : 3600 }, function (er, d) {
       if (er) return cb(er)
       getUrlAndOpen(d, cb)
     })
diff --git a/lib/search.js b/lib/search.js
index 5dd060f82..d2ce9a3c0 100644
--- a/lib/search.js
+++ b/lib/search.js
@@ -2,8 +2,7 @@
 module.exports = exports = search
 
 var npm = require("./npm.js")
-  , registry = npm.registry
-  , columnify = require('columnify')
+  , columnify = require("columnify")
   , mapToRegistry = require("./utils/map-to-registry.js")
 
 search.usage = "npm search [some search terms ...]"
@@ -58,15 +57,16 @@ function search (args, silent, staleness, cb) {
 }
 
 function getFilteredData (staleness, args, notArgs, cb) {
-  var opts = {
-    timeout : staleness,
-    follow  : true,
-    staleOk : true
-  }
-  mapToRegistry("-/all", npm.config, function (er, uri) {
+  mapToRegistry("-/all", npm.config, function (er, uri, auth) {
     if (er) return cb(er)
 
-    registry.get(uri, opts, function (er, data) {
+    var params = {
+      timeout : staleness,
+      follow  : true,
+      staleOk : true,
+      auth    : auth
+    }
+    npm.registry.getAll(uri, params, function (er, data) {
       if (er) return cb(er)
       return cb(null, filter(data, args, notArgs))
     })
diff --git a/lib/star.js b/lib/star.js
index 123c4ebbb..d2e69deb9 100644
--- a/lib/star.js
+++ b/lib/star.js
@@ -2,7 +2,6 @@
 module.exports = star
 
 var npm = require("./npm.js")
-  , registry = npm.registry
   , log = require("npmlog")
   , asyncMap = require("slide").asyncMap
   , mapToRegistry = require("./utils/map-to-registry.js")
@@ -11,10 +10,14 @@ star.usage = "npm star <package> [pkg, pkg, ...]\n"
            + "npm unstar <package> [pkg, pkg, ...]"
 
 star.completion = function (opts, cb) {
-  mapToRegistry("-/short", npm.config, function (er, uri) {
+  mapToRegistry("-/short", npm.config, function (er, uri, auth) {
     if (er) return cb(er)
 
-    registry.get(uri, { timeout : 60000 }, function (er, list) {
+    var params = {
+      timeout : 60000,
+      auth    : auth
+    }
+    npm.registry.get(uri, params, function (er, list) {
       return cb(null, list || [])
     })
   })
@@ -27,10 +30,14 @@ function star (args, cb) {
     , using = !(npm.command.match(/^un/))
   if (!using) s = u
   asyncMap(args, function (pkg, cb) {
-    mapToRegistry(pkg, npm.config, function (er, uri) {
+    mapToRegistry(pkg, npm.config, function (er, uri, auth) {
       if (er) return cb(er)
 
-      registry.star(uri, using, function (er, data, raw, req) {
+      var params = {
+        starred : using,
+        auth    : auth
+      }
+      npm.registry.star(uri, params, function (er, data, raw, req) {
         if (!er) {
           console.log(s + " "+pkg)
           log.verbose("star", data)
diff --git a/lib/stars.js b/lib/stars.js
index dee5c152a..087e8d9bf 100644
--- a/lib/stars.js
+++ b/lib/stars.js
@@ -3,17 +3,20 @@ module.exports = stars
 stars.usage = "npm stars [username]"
 
 var npm = require("./npm.js")
-  , registry = npm.registry
   , log = require("npmlog")
   , mapToRegistry = require("./utils/map-to-registry.js")
 
 function stars (args, cb) {
   npm.commands.whoami([], true, function (er, username) {
     var name = args.length === 1 ? args[0] : username
-    mapToRegistry("", npm.config, function (er, uri) {
+    mapToRegistry("", npm.config, function (er, uri, auth) {
       if (er) return cb(er)
 
-      registry.stars(uri, name, showstars)
+      var params = {
+        username : name,
+        auth     : auth
+      }
+      npm.registry.stars(uri, params, showstars)
     })
   })
 
diff --git a/lib/tag.js b/lib/tag.js
index 47e9a8c0a..bc7ec9187 100644
--- a/lib/tag.js
+++ b/lib/tag.js
@@ -6,7 +6,6 @@ tag.usage = "npm tag <project>@<version> [<tag>]"
 tag.completion = require("./unpublish.js").completion
 
 var npm = require("./npm.js")
-  , registry = npm.registry
   , mapToRegistry = require("./utils/map-to-registry.js")
   , npa = require("npm-package-arg")
   , semver = require("semver")
@@ -26,9 +25,14 @@ function tag (args, cb) {
     return cb(er)
   }
 
-  mapToRegistry(project, npm.config, function (er, uri) {
+  mapToRegistry(project, npm.config, function (er, uri, auth) {
     if (er) return cb(er)
 
-    registry.tag(uri, version, t, cb)
+    var params = {
+      version : version,
+      tag     : t,
+      auth    : auth
+    }
+    npm.registry.tag(uri, params, cb)
   })
 }
diff --git a/lib/unpublish.js b/lib/unpublish.js
index 2566cd5ae..da03b0dcc 100644
--- a/lib/unpublish.js
+++ b/lib/unpublish.js
@@ -3,7 +3,6 @@ module.exports = unpublish
 
 var log = require("npmlog")
   , npm = require("./npm.js")
-  , registry = npm.registry
   , readJson = require("read-package-json")
   , path = require("path")
   , mapToRegistry = require("./utils/map-to-registry.js")
@@ -19,10 +18,10 @@ unpublish.completion = function (opts, cb) {
     var un = encodeURIComponent(username)
     if (!un) return cb()
     var byUser = "-/by-user/" + un
-    mapToRegistry(byUser, npm.config, function (er, uri) {
+    mapToRegistry(byUser, npm.config, function (er, uri, auth) {
       if (er) return cb(er)
 
-      registry.get(uri, null, function (er, pkgs) {
+      npm.registry.get(uri, { auth : auth }, function (er, pkgs) {
         // do a bit of filtering at this point, so that we don't need
         // to fetch versions for more than one thing, but also don't
         // accidentally a whole project.
@@ -33,10 +32,10 @@ unpublish.completion = function (opts, cb) {
           return p.indexOf(pp) === 0
         })
         if (pkgs.length > 1) return cb(null, pkgs)
-        mapToRegistry(pkgs[0], npm.config, function (er, uri) {
+        mapToRegistry(pkgs[0], npm.config, function (er, uri, auth) {
           if (er) return cb(er)
 
-          registry.get(uri, null, function (er, d) {
+          npm.registry.get(uri, { auth : auth }, function (er, d) {
             if (er) return cb(er)
             var vers = Object.keys(d.versions)
             if (!vers.length) return cb(null, pkgs)
@@ -92,10 +91,14 @@ function gotProject (project, version, cb_) {
       return cb(er)
     }
 
-    mapToRegistry(project, npm.config, function (er, uri) {
+    mapToRegistry(project, npm.config, function (er, uri, auth) {
       if (er) return cb(er)
 
-      registry.unpublish(uri, version, cb)
+      var params = {
+        version : version,
+        auth    : auth
+      }
+      npm.registry.unpublish(uri, params, cb)
     })
   })
 }
diff --git a/lib/utils/map-to-registry.js b/lib/utils/map-to-registry.js
index cf665e4f6..458f1fca7 100644
--- a/lib/utils/map-to-registry.js
+++ b/lib/utils/map-to-registry.js
@@ -6,8 +6,8 @@ var log = require("npmlog")
 module.exports = mapToRegistry
 
 function mapToRegistry(name, config, cb) {
-  var uri
-  var scopedRegistry
+  log.silly("mapToRegistry", "name", name)
+  var registry
 
   // the name itself takes precedence
   var data = npa(name)
@@ -15,40 +15,42 @@ function mapToRegistry(name, config, cb) {
     // the name is definitely scoped, so escape now
     name = name.replace("/", "%2f")
 
-    log.silly("mapToRegistry", "scope", data.scope)
+    log.silly("mapToRegistry", "scope (from package name)", data.scope)
 
-    scopedRegistry = config.get(data.scope + ":registry")
-    if (scopedRegistry) {
-      log.silly("mapToRegistry", "scopedRegistry (scoped package)", scopedRegistry)
-      uri = url.resolve(scopedRegistry, name)
-    }
-    else {
-      log.verbose("mapToRegistry", "no registry URL found for scope", data.scope)
+    registry = config.get(data.scope + ":registry")
+    if (!registry) {
+      log.verbose("mapToRegistry", "no registry URL found in name for scope", data.scope)
     }
   }
 
   // ...then --scope=@scope or --scope=scope
   var scope = config.get("scope")
-  if (!uri && scope) {
+  if (!registry && scope) {
     // I'm an enabler, sorry
     if (scope.charAt(0) !== "@") scope = "@" + scope
 
-    scopedRegistry = config.get(scope + ":registry")
-    if (scopedRegistry) {
-      log.silly("mapToRegistry", "scopedRegistry (scope in config)", scopedRegistry)
-      uri = url.resolve(scopedRegistry, name)
-    }
-    else {
-      log.verbose("mapToRegistry", "no registry URL found for scope", scope)
+    log.silly("mapToRegistry", "scope (from config)", scope)
+
+    registry = config.get(scope + ":registry")
+    if (!registry) {
+      log.verbose("mapToRegistry", "no registry URL found in config for scope", scope)
     }
   }
 
   // ...and finally use the default registry
-  if (!uri) {
-    uri = url.resolve(config.get("registry"), name)
+  if (!registry) {
+    log.silly("mapToRegistry", "using default registry")
+    registry = config.get("registry")
   }
 
-  log.verbose("mapToRegistry", "name", name)
-  log.verbose("mapToRegistry", "uri", uri)
-  cb(null, uri)
+  log.silly("mapToRegistry", "registry", registry)
+
+  var auth = config.getCredentialsByURI(registry)
+
+  // normalize registry URL so resoluiton doesn't drop a piece of registry URL
+  var normalized = registry.slice(-1) !== "/" ? registry+"/" : registry
+  var uri = url.resolve(normalized, name)
+  log.silly("mapToRegistry", "uri", uri)
+
+  cb(null, uri, auth, registry)
 }
diff --git a/lib/view.js b/lib/view.js
index 6b45cca2e..c2605cf0a 100644
--- a/lib/view.js
+++ b/lib/view.js
@@ -5,18 +5,18 @@ view.usage = "npm view pkg[@version] [<field>[.subfield]...]"
 
 view.completion = function (opts, cb) {
   if (opts.conf.argv.remain.length <= 2) {
-    return mapToRegistry("-/short", npm.config, function (er, uri) {
+    return mapToRegistry("-/short", npm.config, function (er, uri, auth) {
       if (er) return cb(er)
 
-      registry.get(uri, null, cb)
+      npm.registry.get(uri, { auth : auth }, cb)
     })
   }
   // have the package, get the fields.
   var tag = npm.config.get("tag")
-  mapToRegistry(opts.conf.argv.remain[2], npm.config, function (er, uri) {
+  mapToRegistry(opts.conf.argv.remain[2], npm.config, function (er, uri, auth) {
     if (er) return cb(er)
 
-    registry.get(uri, null, function (er, d) {
+    npm.registry.get(uri, { auth : auth }, function (er, d) {
       if (er) return cb(er)
       var dv = d.versions[d["dist-tags"][tag]]
         , fields = []
@@ -97,10 +97,10 @@ function fetchAndRead (nv, args, silent, cb) {
   var name = nv.name
     , version = nv.rawSpec || npm.config.get("tag")
 
-  mapToRegistry(name, npm.config, function (er, uri) {
+  mapToRegistry(name, npm.config, function (er, uri, auth) {
     if (er) return cb(er)
 
-    registry.get(uri, null, function (er, data) {
+    npm.registry.get(uri, { auth : auth }, function (er, data) {
       if (er) return cb(er)
       if (data["dist-tags"] && data["dist-tags"].hasOwnProperty(version)) {
         version = data["dist-tags"][version]
diff --git a/lib/whoami.js b/lib/whoami.js
index b33f93743..121c4336a 100644
--- a/lib/whoami.js
+++ b/lib/whoami.js
@@ -14,14 +14,14 @@ function whoami (args, silent, cb) {
   var registry = npm.config.get("registry")
   if (!registry) return cb(new Error("no default registry set"))
 
-  var credentials = npm.config.getCredentialsByURI(registry)
-  if (credentials) {
-    if (credentials.username) {
-      if (!silent) console.log(credentials.username)
-      return process.nextTick(cb.bind(this, null, credentials.username))
+  var auth = npm.config.getCredentialsByURI(registry)
+  if (auth) {
+    if (auth.username) {
+      if (!silent) console.log(auth.username)
+      return process.nextTick(cb.bind(this, null, auth.username))
     }
-    else if (credentials.token) {
-      return npm.registry.whoami(registry, function (er, username) {
+    else if (auth.token) {
+      return npm.registry.whoami(registry, { auth : auth }, function (er, username) {
         if (er) return cb(er)
 
         if (!silent) console.log(username)