First cut of publishing for metadata works, needs proper locking, deleting request after processing and parsing attachments. Code seems overly complicated, way to much is done in NpmUtility.  Parsing json into memory is ugly, should use json input stream instead (maybe stream each version's json onto disk directly, some trickery with input streams will be needed).