@seanhogg/builderforce-webcontainers-core 2026.10.6 → 2026.10.7

package/src/installer/npmrc.ts

@@ -0,0 +1,69 @@
+/**
+ * `.npmrc`: the default registry, per-scope registries (`@acme:registry=…`) and
+ * auth tokens keyed by registry path (`//npm.acme.dev/:_authToken=${NPM_TOKEN}`).
+ * Project and user files are read like npm does — the project's wins — and
+ * `${VAR}` is filled from the process environment.
+ *
+ * A private registry is reached with the browser's `fetch`, so it must answer
+ * CORS requests that carry an `Authorization` header.
+ */
+import type { VirtualFileSystem } from '../vfs.js';
+
+export interface NpmConfig {
+  registry?: string;
+  /** `@scope` → registry URL. */
+  scopes: Record<string, string>;
+  /** `//host/path/` → bearer token. */
+  tokens: Record<string, string>;
+}
+
+export function emptyNpmConfig(): NpmConfig {
+  return { scopes: {}, tokens: {} };
+}
+
+const trimSlash = (url: string) => url.replace(/\/+$/, '');
+
+export function parseNpmrc(text: string, env: Record<string, string | undefined> = {}, into: NpmConfig = emptyNpmConfig()): NpmConfig {
+  for (const raw of text.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || line.startsWith('#') || line.startsWith(';')) continue;
+    const eq = line.indexOf('=');
+    if (eq < 0) continue;
+    const key = line.slice(0, eq).trim();
+    const value = line.slice(eq + 1).trim().replace(/^(["'])(.*)\1$/, '$2').replace(/\$\{([^}]+)\}/g, (_m, name: string) => env[name] ?? '');
+    if (key === 'registry') into.registry = trimSlash(value);
+    else if (/^@[^:]+:registry$/.test(key)) into.scopes[key.slice(0, key.indexOf(':'))] = trimSlash(value);
+    else if (key.startsWith('//') && key.endsWith(':_authToken')) into.tokens[key.slice(0, -':_authToken'.length).replace(/\/?$/, '/')] = value;
+  }
+  return into;
+}
+
+/** Read `.npmrc` files, lowest precedence first (user, then project). Missing files are skipped. */
+export function readNpmConfig(fs: VirtualFileSystem, paths: string[], env: Record<string, string | undefined> = {}): NpmConfig {
+  const config = emptyNpmConfig();
+  for (const path of paths) {
+    const text = fs.readText(path);
+    if (text !== undefined) parseNpmrc(text, env, config);
+  }
+  return config;
+}
+
+/** The registry a package is fetched from: its scope's, else the default. */
+export function registryFor(config: NpmConfig | undefined, name: string, fallback: string): string {
+  if (name.startsWith('@')) {
+    const scoped = config?.scopes[name.slice(0, name.indexOf('/'))];
+    if (scoped) return scoped;
+  }
+  return fallback;
+}
+
+/** `Authorization` for a URL: the token whose registry path is the longest prefix of it. */
+export function authHeaders(config: NpmConfig | undefined, url: string): Record<string, string> {
+  if (!config) return {};
+  const target = url.replace(/^https?:/, '');
+  let best = '';
+  for (const prefix of Object.keys(config.tokens)) {
+    if ((target.startsWith(prefix) || target + '/' === prefix) && prefix.length > best.length) best = prefix;
+  }
+  return best ? { authorization: `Bearer ${config.tokens[best]}` } : {};
+}

package/src/installer/registry.ts

@@ -5,6 +5,8 @@
  * caller injects one, which is what keeps this testable against a fake registry.
  */
 
+import { authHeaders, registryFor, type NpmConfig } from './npmrc.js';
+
 export type FetchLike = (url: string, init?: { headers?: Record<string, string>; signal?: AbortSignal }) => Promise<{
   ok: boolean;
   status: number;
@@ -60,6 +62,8 @@ export interface RegistryOptions {
   fetch: FetchLike;
   registry?: string;
   cache?: PackageCache;
+  /** `.npmrc` settings: scoped registries and auth tokens. */
+  npmrc?: NpmConfig;
   /** How long a cached packument is trusted. Default 10 minutes. */
   packumentMaxAgeMs?: number;
   signal?: AbortSignal;
@@ -136,7 +140,8 @@ export class RegistryClient {
   }
 
   private async loadPackument(name: string): Promise<Packument> {
-    const key = `packument:${this.registry}/${name}`;
+    const registry = registryFor(this.options.npmrc, name, this.registry);
+    const key = `packument:${registry}/${name}`;
     const maxAge = this.options.packumentMaxAgeMs ?? 10 * 60_000;
     const cached = await this.options.cache?.get(key);
     if (cached) {
@@ -147,15 +152,16 @@ export class RegistryClient {
         // a corrupt entry is just a miss
       }
     }
-    const url = `${this.registry}/${name.startsWith('@') ? '@' + encodeURIComponent(name.slice(1)) : encodeURIComponent(name)}`;
-    const bytes = await this.get(url, { accept: ABBREVIATED }, name);
+    const url = `${registry}/${name.startsWith('@') ? '@' + encodeURIComponent(name.slice(1)) : encodeURIComponent(name)}`;
+    const bytes = await this.get(url, { accept: ABBREVIATED }, name, registry);
     const packument = JSON.parse(decoder.decode(bytes)) as Packument;
     if (!packument.versions) throw new Error(`The registry returned no versions for "${name}".`);
     await this.options.cache?.put(key, encoder.encode(JSON.stringify({ t: Date.now(), p: packument })));
     return packument;
   }
 
-  private async get(url: string, headers: Record<string, string>, packageName?: string): Promise<Uint8Array> {
+  private async get(url: string, headers: Record<string, string>, packageName?: string, registry = this.registry): Promise<Uint8Array> {
+    headers = { ...headers, ...authHeaders(this.options.npmrc, url) };
     let lastError: unknown;
     for (let attempt = 0; attempt < 2; attempt++) {
       let response: Awaited<ReturnType<FetchLike>>;
@@ -166,7 +172,8 @@ export class RegistryClient {
         lastError = error; // network blip: retry once
         continue;
       }
-      if (response.status === 404 && packageName) throw new Error(`Package "${packageName}" was not found in ${this.registry}.`);
+      if (response.status === 404 && packageName) throw new Error(`Package "${packageName}" was not found in ${registry}.`);
+      if ((response.status === 401 || response.status === 403) && packageName) throw new Error(`${registry} refused "${packageName}" (HTTP ${response.status}). Add an auth token to .npmrc.`);
       if (!response.ok) throw new Error(`GET ${url} failed with HTTP ${response.status}.`);
       return new Uint8Array(await response.arrayBuffer());
     }

package/src/shell/npm.ts

@@ -7,6 +7,7 @@
  */
 import { join } from '../paths.js';
 import { installPackages, type InstallOptions } from '../installer/install.js';
+import { readNpmConfig } from '../installer/npmrc.js';
 import type { PackageJson } from '../installer/spec.js';
 import { binDirectories, findExecutable } from '../system/commands.js';
 import { findPackageScope } from '../node/resolve.js';
@@ -34,10 +35,13 @@ async function install(ctx: CommandContext, options: Partial<InstallOptions>, di
   const started = performance.now();
   const progress = ctx.io.isTerminal;
   try {
+    // User file first, then the project's: later files win, as with npm.
+    const npmrc = readNpmConfig(ctx.fs, [join(ctx.env.HOME ?? '/home/user', '.npmrc'), join(dir, '.npmrc')], ctx.env);
     const result = await installPackages({
       fs: ctx.fs,
       fetch: (url, init) => ctx.system.fetch(url, init as RequestInit),
-      registry: ctx.env.npm_config_registry ?? ctx.system.registry,
+      registry: ctx.env.npm_config_registry ?? npmrc.registry ?? ctx.system.registry,
+      npmrc,
       cache: ctx.system.packageCache,
       cwd: dir,
       signal: ctx.signal,

package/src/vfs.ts

@@ -14,6 +14,11 @@ export interface FileTree {
   [name: string]: FileContent | FileTree;
 }
 
+export interface DirectoryEntry {
+  name: string;
+  kind: 'file' | 'directory';
+}
+
 export interface FsChange {
   /** `mkdir` is an explicitly created (possibly empty) directory. */
   type: 'write' | 'remove' | 'mkdir';
@@ -98,6 +103,39 @@ export class VirtualFileSystem {
     return [...(this.children.get(normalizePath(path)) ?? [])].sort();
   }
 
+  /** Direct children with their kind, sorted by name — `readdir` for callers that render a tree. */
+  entries(path: string): DirectoryEntry[] {
+    const dir = normalizePath(path);
+    return this.readdir(dir).map((name) => ({ name, kind: this.children.has(join(dir, name)) ? 'directory' : 'file' }));
+  }
+
+  /**
+   * Move a file or a directory (with everything under it). Throws when `from` is
+   * missing or `to` already exists. Watchers see the old paths removed and the
+   * new ones written, which is what every consumer (dev server, process sync) needs.
+   */
+  rename(from: string, to: string): void {
+    const source = normalizePath(from);
+    const target = normalizePath(to);
+    if (source === target) return;
+    if (!this.exists(source)) throw new Error(`ENOENT: no such file or directory, rename '${source}' -> '${target}'`);
+    if (this.exists(target)) throw new Error(`EEXIST: file already exists, rename '${source}' -> '${target}'`);
+    if (target.startsWith(source + '/')) throw new Error(`EINVAL: cannot move '${source}' into itself`);
+    if (this.files.has(source)) {
+      const contents = this.files.get(source)!;
+      this.removeFile(source);
+      this.writeFile(target, contents);
+      return;
+    }
+    const prefix = source + '/';
+    const moved = [...this.files].filter(([path]) => path.startsWith(prefix));
+    const dirs = [...this.explicit].filter((dir) => dir === source || dir.startsWith(prefix));
+    this.rm(source);
+    this.mkdir(target);
+    for (const dir of dirs) this.mkdir(target + dir.slice(source.length));
+    for (const [path, contents] of moved) this.writeFile(target + path.slice(source.length), contents);
+  }
+
   /** Every file path, sorted. */
   list(): string[] {
     return [...this.files.keys()].sort();
@@ -152,9 +190,14 @@ export class VirtualFileSystem {
     return out;
   }
 
-  watch(listener: (change: FsChange) => void): () => void {
-    this.listeners.add(listener);
-    return () => this.listeners.delete(listener);
+  /** Every change, or with `under` only changes at or below that path. */
+  watch(listener: (change: FsChange) => void, options: { under?: string } = {}): () => void {
+    const root = options.under === undefined ? undefined : normalizePath(options.under);
+    const filtered = root === undefined || root === '/'
+      ? listener
+      : (change: FsChange) => (change.path === root || change.path.startsWith(root + '/')) && listener(change);
+    this.listeners.add(filtered);
+    return () => this.listeners.delete(filtered);
   }
 
   private removeFile(key: string): void {