@verdaccio/e2e-cli 2.10.4 → 3.1.0

package/build/esm/scenarios/uplink-failure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uplink-failure.js","names":[],"sources":["../../../src/scenarios/uplink-failure.ts"],"sourcesContent":["import assert from 'assert';\n\nimport { TestContext, TestDefinition } from '../types';\nimport { downloadTarball, fetchPackument } from '../utils/http-client';\nimport { MockUplink } from '../utils/mock-uplink';\nimport { trace } from '../utils/process';\n\n/**\n * Scenario: uplink-failure\n *\n * Verifies how the registry behaves when its uplink misbehaves. Requires the\n * registry to be configured with an uplink pointing at the mock uplink port\n * and a package pattern proxied to it (see `--print-config`):\n *\n *   uplinks:\n *     e2emock:\n *       url: http://localhost:<E2E_UPLINK_PORT>/\n *       timeout: 3s\n *       max_fails: 100\n *   packages:\n *     'e2e-uplink-*':\n *       access: $all\n *       proxy: e2emock\n *\n * The scenario starts its own HTTP server on that port and flips it between\n * modes:\n *   - healthy: packument + tarball proxied through, tarball URL rewritten\n *   - drop-mid-stream: uplink kills the socket halfway through a tarball —\n *     the client must not receive a \"successful\" corrupt download, and the\n *     tarball must be intact on retry (no poisoned cache)\n *   - down: previously fetched packages still served from cache; unknown\n *     packages fail cleanly; the registry stays alive\n *   - slow: uplink slower than the configured timeout — the registry gives up\n *     instead of hanging\n *\n * Gated on E2E_UPLINK_PORT being set (the harness exports it) so runs against\n * arbitrary registries skip it cleanly, and to the npm adapter so it runs once\n * per suite.\n */\n\nfunction uplinkPort(): number {\n  return parseInt(process.env.E2E_UPLINK_PORT || '', 10);\n}\n\nasync function testUplinkFailure(ctx: TestContext): Promise<void> {\n  const id = ctx.runId;\n  const mock = new MockUplink(uplinkPort());\n  const cachedPkg = `e2e-uplink-cached-${id}`;\n  const cached = mock.addPackage(cachedPkg, 512 * 1024);\n\n  await mock.start();\n  try {\n    await ctx.subTest('healthy uplink: packument and tarball proxied through', async () => {\n      const { status, body } = await fetchPackument(ctx.registryUrl, cachedPkg);\n      trace('healthy proxy %s → %d | keys=%j', cachedPkg, status, Object.keys(body ?? {}));\n      assert.strictEqual(status, 200, `Expected 200 proxying ${cachedPkg}, got ${status}`);\n      assert.strictEqual(body.name, cachedPkg, 'Proxied packument name mismatch');\n      const tarball: string = body.versions['1.0.0'].dist.tarball;\n      assert.ok(\n        tarball.startsWith(ctx.registryUrl),\n        `Expected proxied dist.tarball rewritten to ${ctx.registryUrl}, got ${tarball}`\n      );\n      const download = await downloadTarball(tarball);\n      assert.strictEqual(download.status, 200, 'Proxied tarball download failed');\n      assert.strictEqual(download.sha1, cached.shasum, 'Proxied tarball bytes mismatch');\n      trace('mock uplink requests so far: %j', mock.requests);\n      assert.ok(mock.requests.length > 0, 'Expected the registry to hit the mock uplink');\n    });\n\n    await ctx.subTest('uplink drops connection mid-tarball', async () => {\n      const droppedPkg = `e2e-uplink-dropped-${id}`;\n      const dropped = mock.addPackage(droppedPkg, 512 * 1024);\n\n      // Packument fetch is unaffected by drop-mid-stream (tarball route only).\n      const { status, body } = await fetchPackument(ctx.registryUrl, droppedPkg);\n      assert.strictEqual(status, 200, `Expected 200 for ${droppedPkg} packument`);\n      const tarball: string = body.versions['1.0.0'].dist.tarball;\n\n      mock.mode = 'drop-mid-stream';\n      let sawCleanFailure = false;\n      try {\n        // The registry must terminate the client response promptly when its\n        // uplink dies — a client left hanging is a bug, so cap the wait.\n        const download = await downloadTarball(tarball, { signal: AbortSignal.timeout(15_000) });\n        // A non-200, or a truncated/corrupt body, are both acceptable failures —\n        // what must NOT happen is a \"successful\" download with wrong bytes\n        // going undetected, so we check integrity ourselves.\n        sawCleanFailure = download.status !== 200 || download.sha1 !== dropped.shasum;\n        trace(\n          'drop-mid-stream download: status=%d bytes=%d sha1=%s (expected %s)',\n          download.status,\n          download.bytes,\n          download.sha1,\n          dropped.shasum\n        );\n      } catch (err) {\n        assert.ok(\n          (err as Error).name !== 'TimeoutError',\n          'Registry left the client hanging after the uplink dropped mid-tarball ' +\n            '(response never terminated within 15s)'\n        );\n        sawCleanFailure = true;\n        trace(\n          'drop-mid-stream download rejected as expected: %s',\n          err instanceof Error ? err.message : err\n        );\n      }\n      assert.ok(\n        sawCleanFailure,\n        'Expected the client download to fail while the uplink drops mid-stream'\n      );\n\n      // Back to healthy: the tarball must be intact (no partial tarball cached).\n      mock.mode = 'ok';\n      const retry = await downloadTarball(tarball);\n      trace('retry after recovery → %d bytes=%d sha1=%s', retry.status, retry.bytes, retry.sha1);\n      assert.strictEqual(retry.status, 200, 'Tarball download after uplink recovery failed');\n      assert.strictEqual(\n        retry.sha1,\n        dropped.shasum,\n        'Registry served a corrupt tarball after a mid-stream uplink failure (poisoned cache?)'\n      );\n    });\n\n    await ctx.subTest('slow uplink hits the timeout instead of hanging', async () => {\n      const slowPkg = `e2e-uplink-slow-${id}`;\n      mock.addPackage(slowPkg);\n      mock.mode = 'slow';\n      const start = Date.now();\n      const { status } = await fetchPackument(ctx.registryUrl, slowPkg);\n      const elapsed = Date.now() - start;\n      trace('slow uplink: %s → %d in %dms', slowPkg, status, elapsed);\n      mock.mode = 'ok';\n      assert.ok(status >= 400, `Expected an error status for a timed-out uplink, got ${status}`);\n      // Configured uplink timeout is 3s with retry: 0 — anything close to the\n      // mock's 10s answer means retries or timeouts are multiplying again\n      // (the max_fails-as-retry-limit bug family).\n      assert.ok(\n        elapsed < 6_000,\n        `Expected the registry to time out (~3s), but the request took ${elapsed}ms`\n      );\n    });\n\n    await ctx.subTest('uplink responding 500: cache served, unknown fails cleanly', async () => {\n      mock.mode = 'error-500';\n      // The already-proxied package must keep working from cache.\n      const cachedResp = await fetchPackument(ctx.registryUrl, cachedPkg);\n      trace('uplink 500: cached %s → %d', cachedPkg, cachedResp.status);\n      assert.strictEqual(\n        cachedResp.status,\n        200,\n        `Expected cached packument for ${cachedPkg} while the uplink returns 500, got ${cachedResp.status}`\n      );\n      // An unknown package must fail cleanly, not crash or hang.\n      const unknown = await fetchPackument(ctx.registryUrl, `e2e-uplink-500-missing-${id}`);\n      trace('uplink 500: unknown package → %d | body=%j', unknown.status, unknown.body);\n      assert.ok(\n        unknown.status >= 400,\n        `Expected a clean 4xx/5xx for an unknown package while the uplink returns 500, got ${unknown.status}`\n      );\n      const ping = await fetch(`${ctx.registryUrl}/-/ping`);\n      assert.strictEqual(ping.status, 200, 'Registry stopped responding after uplink 500s');\n      mock.mode = 'ok';\n    });\n  } finally {\n    await mock.stop();\n  }\n\n  await ctx.subTest('uplink down: cached package still served', async () => {\n    const { status, body } = await fetchPackument(ctx.registryUrl, cachedPkg);\n    trace('uplink down: cached %s → %d', cachedPkg, status);\n    assert.strictEqual(\n      status,\n      200,\n      `Expected cached packument for ${cachedPkg} while the uplink is down, got ${status}`\n    );\n    const tarball: string = body.versions['1.0.0'].dist.tarball;\n    const download = await downloadTarball(tarball);\n    assert.strictEqual(download.status, 200, 'Cached tarball not served while uplink is down');\n    assert.strictEqual(download.sha1, cached.shasum, 'Cached tarball bytes mismatch');\n  });\n\n  await ctx.subTest('uplink down: unknown package fails cleanly', async () => {\n    const started = Date.now();\n    const { status } = await fetchPackument(ctx.registryUrl, `e2e-uplink-missing-${id}`);\n    trace('uplink down: unknown package → %d in %dms', status, Date.now() - started);\n    assert.ok(\n      status >= 400,\n      `Expected a clean 4xx/5xx for an unknown package with the uplink down, got ${status}`\n    );\n    const ping = await fetch(`${ctx.registryUrl}/-/ping`);\n    assert.strictEqual(ping.status, 200, 'Registry stopped responding after uplink failures');\n  });\n}\n\nexport const uplinkFailureScenario: TestDefinition = {\n  name: 'scenario:uplink-failure',\n  // Needs the harness-provided uplink config; skipped cleanly otherwise.\n  appliesTo: (adapter) => adapter.type === 'npm' && Number.isFinite(uplinkPort()),\n  timeout: 120_000,\n  run: testUplinkFailure,\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,SAAS,aAAqB;CAC5B,OAAO,SAAS,QAAQ,IAAI,mBAAmB,IAAI,EAAE;AACvD;AAEA,eAAe,kBAAkB,KAAiC;CAChE,MAAM,KAAK,IAAI;CACf,MAAM,OAAO,IAAI,WAAW,WAAW,CAAC;CACxC,MAAM,YAAY,qBAAqB;CACvC,MAAM,SAAS,KAAK,WAAW,WAAW,MAAU;CAEpD,MAAM,KAAK,MAAM;CACjB,IAAI;EACF,MAAM,IAAI,QAAQ,yDAAyD,YAAY;GACrF,MAAM,EAAE,QAAQ,SAAS,MAAM,eAAe,IAAI,aAAa,SAAS;GACxE,MAAM,mCAAmC,WAAW,QAAQ,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC;GACnF,OAAO,YAAY,QAAQ,KAAK,yBAAyB,UAAU,QAAQ,QAAQ;GACnF,OAAO,YAAY,KAAK,MAAM,WAAW,iCAAiC;GAC1E,MAAM,UAAkB,KAAK,SAAS,QAAQ,CAAC,KAAK;GACpD,OAAO,GACL,QAAQ,WAAW,IAAI,WAAW,GAClC,8CAA8C,IAAI,YAAY,QAAQ,SACxE;GACA,MAAM,WAAW,MAAM,gBAAgB,OAAO;GAC9C,OAAO,YAAY,SAAS,QAAQ,KAAK,iCAAiC;GAC1E,OAAO,YAAY,SAAS,MAAM,OAAO,QAAQ,gCAAgC;GACjF,MAAM,mCAAmC,KAAK,QAAQ;GACtD,OAAO,GAAG,KAAK,SAAS,SAAS,GAAG,8CAA8C;EACpF,CAAC;EAED,MAAM,IAAI,QAAQ,uCAAuC,YAAY;GACnE,MAAM,aAAa,sBAAsB;GACzC,MAAM,UAAU,KAAK,WAAW,YAAY,MAAU;GAGtD,MAAM,EAAE,QAAQ,SAAS,MAAM,eAAe,IAAI,aAAa,UAAU;GACzE,OAAO,YAAY,QAAQ,KAAK,oBAAoB,WAAW,WAAW;GAC1E,MAAM,UAAkB,KAAK,SAAS,QAAQ,CAAC,KAAK;GAEpD,KAAK,OAAO;GACZ,IAAI,kBAAkB;GACtB,IAAI;IAGF,MAAM,WAAW,MAAM,gBAAgB,SAAS,EAAE,QAAQ,YAAY,QAAQ,IAAM,EAAE,CAAC;IAIvF,kBAAkB,SAAS,WAAW,OAAO,SAAS,SAAS,QAAQ;IACvE,MACE,sEACA,SAAS,QACT,SAAS,OACT,SAAS,MACT,QAAQ,MACV;GACF,SAAS,KAAK;IACZ,OAAO,GACJ,IAAc,SAAS,gBACxB,8GAEF;IACA,kBAAkB;IAClB,MACE,qDACA,eAAe,QAAQ,IAAI,UAAU,GACvC;GACF;GACA,OAAO,GACL,iBACA,wEACF;GAGA,KAAK,OAAO;GACZ,MAAM,QAAQ,MAAM,gBAAgB,OAAO;GAC3C,MAAM,8CAA8C,MAAM,QAAQ,MAAM,OAAO,MAAM,IAAI;GACzF,OAAO,YAAY,MAAM,QAAQ,KAAK,+CAA+C;GACrF,OAAO,YACL,MAAM,MACN,QAAQ,QACR,uFACF;EACF,CAAC;EAED,MAAM,IAAI,QAAQ,mDAAmD,YAAY;GAC/E,MAAM,UAAU,mBAAmB;GACnC,KAAK,WAAW,OAAO;GACvB,KAAK,OAAO;GACZ,MAAM,QAAQ,KAAK,IAAI;GACvB,MAAM,EAAE,WAAW,MAAM,eAAe,IAAI,aAAa,OAAO;GAChE,MAAM,UAAU,KAAK,IAAI,IAAI;GAC7B,MAAM,gCAAgC,SAAS,QAAQ,OAAO;GAC9D,KAAK,OAAO;GACZ,OAAO,GAAG,UAAU,KAAK,wDAAwD,QAAQ;GAIzF,OAAO,GACL,UAAU,KACV,iEAAiE,QAAQ,GAC3E;EACF,CAAC;EAED,MAAM,IAAI,QAAQ,8DAA8D,YAAY;GAC1F,KAAK,OAAO;GAEZ,MAAM,aAAa,MAAM,eAAe,IAAI,aAAa,SAAS;GAClE,MAAM,8BAA8B,WAAW,WAAW,MAAM;GAChE,OAAO,YACL,WAAW,QACX,KACA,iCAAiC,UAAU,qCAAqC,WAAW,QAC7F;GAEA,MAAM,UAAU,MAAM,eAAe,IAAI,aAAa,0BAA0B,IAAI;GACpF,MAAM,8CAA8C,QAAQ,QAAQ,QAAQ,IAAI;GAChF,OAAO,GACL,QAAQ,UAAU,KAClB,qFAAqF,QAAQ,QAC/F;GACA,MAAM,OAAO,MAAM,MAAM,GAAG,IAAI,YAAY,QAAQ;GACpD,OAAO,YAAY,KAAK,QAAQ,KAAK,+CAA+C;GACpF,KAAK,OAAO;EACd,CAAC;CACH,UAAU;EACR,MAAM,KAAK,KAAK;CAClB;CAEA,MAAM,IAAI,QAAQ,4CAA4C,YAAY;EACxE,MAAM,EAAE,QAAQ,SAAS,MAAM,eAAe,IAAI,aAAa,SAAS;EACxE,MAAM,+BAA+B,WAAW,MAAM;EACtD,OAAO,YACL,QACA,KACA,iCAAiC,UAAU,iCAAiC,QAC9E;EACA,MAAM,UAAkB,KAAK,SAAS,QAAQ,CAAC,KAAK;EACpD,MAAM,WAAW,MAAM,gBAAgB,OAAO;EAC9C,OAAO,YAAY,SAAS,QAAQ,KAAK,gDAAgD;EACzF,OAAO,YAAY,SAAS,MAAM,OAAO,QAAQ,+BAA+B;CAClF,CAAC;CAED,MAAM,IAAI,QAAQ,8CAA8C,YAAY;EAC1E,MAAM,UAAU,KAAK,IAAI;EACzB,MAAM,EAAE,WAAW,MAAM,eAAe,IAAI,aAAa,sBAAsB,IAAI;EACnF,MAAM,6CAA6C,QAAQ,KAAK,IAAI,IAAI,OAAO;EAC/E,OAAO,GACL,UAAU,KACV,6EAA6E,QAC/E;EACA,MAAM,OAAO,MAAM,MAAM,GAAG,IAAI,YAAY,QAAQ;EACpD,OAAO,YAAY,KAAK,QAAQ,KAAK,mDAAmD;CAC1F,CAAC;AACH;AAEA,IAAa,wBAAwC;CACnD,MAAM;CAEN,YAAY,YAAY,QAAQ,SAAS,SAAS,OAAO,SAAS,WAAW,CAAC;CAC9E,SAAS;CACT,KAAK;AACP"}

package/build/esm/tests/audit.js

@@ -1,3 +1,4 @@
+import { publishLocalPackage } from "../utils/publish.js";
 import buildDebug from "debug";
 import assert from "assert";
 //#region src/tests/audit.ts
@@ -8,8 +9,10 @@ async function testAudit(ctx) {
 		return;
 	}
 	const packages = [`verdaccio-audit-${ctx.runId}`, `@verdaccio/audit-${ctx.runId}`];
+	const depName = `e2e-audit-dep-${ctx.runId}`;
+	await publishLocalPackage(ctx, depName, "1.0.0");
 	for (const pkgName of packages) {
-		const { tempFolder } = await ctx.adapter.prepareProject(pkgName, "1.0.0", ctx.registryUrl, ctx.port, ctx.token, { jquery: "3.6.1" });
+		const { tempFolder } = await ctx.adapter.prepareProject(pkgName, "1.0.0", ctx.registryUrl, ctx.port, ctx.token, { [depName]: "1.0.0" });
 		await ctx.adapter.exec({ cwd: tempFolder }, "install", ...ctx.adapter.registryArg(ctx.registryUrl));
 		try {
 			if ((await fetch(`${ctx.registryUrl}/-/npm/v1/security/audits/quick`, {
@@ -24,7 +27,17 @@ async function testAudit(ctx) {
 			debug("audit endpoint probe failed, skipping");
 			return;
 		}
-		const resp = await ctx.adapter.exec({ cwd: tempFolder }, "audit", "--json", ...ctx.adapter.registryArg(ctx.registryUrl));
+		let resp;
+		try {
+			resp = await ctx.adapter.exec({ cwd: tempFolder }, "audit", "--json", ...ctx.adapter.registryArg(ctx.registryUrl));
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			if (/503|ENOTFOUND|EAI_AGAIN|getaddrinfo|ECONNREFUSED|audit/i.test(message)) {
+				debug("audit upstream unreachable (offline?), skipping: %s", message);
+				return;
+			}
+			throw err;
+		}
 		if (ctx.adapter.type === "bun") assert.ok(resp.stdout.length > 0 || resp.stderr.length > 0, "Expected audit output");
 		else {
 			const parsedBody = JSON.parse(resp.stdout);

package/build/esm/tests/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","names":[],"sources":["../../../src/tests/audit.ts"],"sourcesContent":["import assert from 'assert';\nimport buildDebug from 'debug';\n\nimport { TestContext, TestDefinition } from '../types';\n\nconst debug = buildDebug('verdaccio:e2e-cli:test:audit');\n\nasync function testAudit(ctx: TestContext): Promise<void> {\n  // Audit is only reliable with npm and bun — pnpm/yarn audit output varies too much\n  if (ctx.adapter.type !== 'npm' && ctx.adapter.type !== 'bun') {\n    debug('skipping audit test for %s (npm/bun only)', ctx.adapter.type);\n    return;\n  }\n\n  const packages = [`verdaccio-audit-${ctx.runId}`, `@verdaccio/audit-${ctx.runId}`];\n\n  for (const pkgName of packages) {\n    const { tempFolder } = await ctx.adapter.prepareProject(\n      pkgName,\n      '1.0.0',\n      ctx.registryUrl,\n      ctx.port,\n      ctx.token,\n      { jquery: '3.6.1' }\n    );\n\n    // install is required to create package lock file\n    await ctx.adapter.exec(\n      { cwd: tempFolder },\n      'install',\n      ...ctx.adapter.registryArg(ctx.registryUrl)\n    );\n\n    // npm audit exits with code 1 both when vulnerabilities are found AND when\n    // the endpoint is unavailable. We need to distinguish between the two.\n    // Probe the audit endpoint first to avoid false failures on registries\n    // that don't support it (e.g. verdaccio next-7+).\n    try {\n      const probe = await fetch(`${ctx.registryUrl}/-/npm/v1/security/audits/quick`, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: '{}',\n      });\n      if (probe.status === 404) {\n        debug('audit endpoint not supported by this registry (404), skipping');\n        return;\n      }\n    } catch {\n      debug('audit endpoint probe failed, skipping');\n      return;\n    }\n\n    const resp = await ctx.adapter.exec(\n      { cwd: tempFolder },\n      'audit',\n      '--json',\n      ...ctx.adapter.registryArg(ctx.registryUrl)\n    );\n\n    if (ctx.adapter.type === 'bun') {\n      // bun audit output may differ — exit code 0 is sufficient for basic validation\n      assert.ok(resp.stdout.length > 0 || resp.stderr.length > 0, 'Expected audit output');\n    } else {\n      const parsedBody = JSON.parse(resp.stdout);\n      assert.ok(\n        parsedBody.auditReportVersion !== undefined,\n        'Expected \"auditReportVersion\" in audit response'\n      );\n      assert.ok(\n        parsedBody.vulnerabilities !== undefined,\n        'Expected \"vulnerabilities\" in audit response'\n      );\n    }\n  }\n}\n\nexport const auditTest: TestDefinition = {\n  name: 'audit',\n  requires: ['audit'],\n  run: testAudit,\n};\n"],"mappings":";;;AAKA,IAAM,QAAQ,WAAW,8BAA8B;AAEvD,eAAe,UAAU,KAAiC;CAExD,IAAI,IAAI,QAAQ,SAAS,SAAS,IAAI,QAAQ,SAAS,OAAO;EAC5D,MAAM,6CAA6C,IAAI,QAAQ,IAAI;EACnE;CACF;CAEA,MAAM,WAAW,CAAC,mBAAmB,IAAI,SAAS,oBAAoB,IAAI,OAAO;CAEjF,KAAK,MAAM,WAAW,UAAU;EAC9B,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,SACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,OACJ,EAAE,QAAQ,QAAQ,CACpB;EAGA,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EAMA,IAAI;GAMF,KAAI,MALgB,MAAM,GAAG,IAAI,YAAY,kCAAkC;IAC7E,QAAQ;IACR,SAAS,EAAE,gBAAgB,mBAAmB;IAC9C,MAAM;GACR,CAAC,EAAA,CACS,WAAW,KAAK;IACxB,MAAM,+DAA+D;IACrE;GACF;EACF,QAAQ;GACN,MAAM,uCAAuC;GAC7C;EACF;EAEA,MAAM,OAAO,MAAM,IAAI,QAAQ,KAC7B,EAAE,KAAK,WAAW,GAClB,SACA,UACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EAEA,IAAI,IAAI,QAAQ,SAAS,OAEvB,OAAO,GAAG,KAAK,OAAO,SAAS,KAAK,KAAK,OAAO,SAAS,GAAG,uBAAuB;OAC9E;GACL,MAAM,aAAa,KAAK,MAAM,KAAK,MAAM;GACzC,OAAO,GACL,WAAW,uBAAuB,KAAA,GAClC,mDACF;GACA,OAAO,GACL,WAAW,oBAAoB,KAAA,GAC/B,gDACF;EACF;CACF;AACF;AAEA,IAAa,YAA4B;CACvC,MAAM;CACN,UAAU,CAAC,OAAO;CAClB,KAAK;AACP"}
+{"version":3,"file":"audit.js","names":[],"sources":["../../../src/tests/audit.ts"],"sourcesContent":["import assert from 'assert';\nimport buildDebug from 'debug';\n\nimport { TestContext, TestDefinition } from '../types';\nimport { publishLocalPackage } from '../utils/publish';\n\nconst debug = buildDebug('verdaccio:e2e-cli:test:audit');\n\nasync function testAudit(ctx: TestContext): Promise<void> {\n  // Audit is only reliable with npm and bun — pnpm/yarn audit output varies too much\n  if (ctx.adapter.type !== 'npm' && ctx.adapter.type !== 'bun') {\n    debug('skipping audit test for %s (npm/bun only)', ctx.adapter.type);\n    return;\n  }\n\n  const packages = [`verdaccio-audit-${ctx.runId}`, `@verdaccio/audit-${ctx.runId}`];\n\n  // Publish the dependency locally so metadata/tarball resolution never leaves\n  // the registry under test (the suite must run offline). Only the audit\n  // report request itself may travel upstream, and that is skipped below when\n  // the endpoint is unavailable.\n  const depName = `e2e-audit-dep-${ctx.runId}`;\n  await publishLocalPackage(ctx, depName, '1.0.0');\n\n  for (const pkgName of packages) {\n    const { tempFolder } = await ctx.adapter.prepareProject(\n      pkgName,\n      '1.0.0',\n      ctx.registryUrl,\n      ctx.port,\n      ctx.token,\n      { [depName]: '1.0.0' }\n    );\n\n    // install is required to create package lock file\n    await ctx.adapter.exec(\n      { cwd: tempFolder },\n      'install',\n      ...ctx.adapter.registryArg(ctx.registryUrl)\n    );\n\n    // npm audit exits with code 1 both when vulnerabilities are found AND when\n    // the endpoint is unavailable. We need to distinguish between the two.\n    // Probe the audit endpoint first to avoid false failures on registries\n    // that don't support it (e.g. verdaccio next-7+).\n    try {\n      const probe = await fetch(`${ctx.registryUrl}/-/npm/v1/security/audits/quick`, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: '{}',\n      });\n      if (probe.status === 404) {\n        debug('audit endpoint not supported by this registry (404), skipping');\n        return;\n      }\n    } catch {\n      debug('audit endpoint probe failed, skipping');\n      return;\n    }\n\n    let resp;\n    try {\n      resp = await ctx.adapter.exec(\n        { cwd: tempFolder },\n        'audit',\n        '--json',\n        ...ctx.adapter.registryArg(ctx.registryUrl)\n      );\n    } catch (err) {\n      // The registry proxies audit reports upstream; when running offline that\n      // upstream is unreachable and the audit command fails — that is not a\n      // registry bug, so skip instead of failing the suite.\n      const message = err instanceof Error ? err.message : String(err);\n      if (/503|ENOTFOUND|EAI_AGAIN|getaddrinfo|ECONNREFUSED|audit/i.test(message)) {\n        debug('audit upstream unreachable (offline?), skipping: %s', message);\n        return;\n      }\n      throw err;\n    }\n\n    if (ctx.adapter.type === 'bun') {\n      // bun audit output may differ — exit code 0 is sufficient for basic validation\n      assert.ok(resp.stdout.length > 0 || resp.stderr.length > 0, 'Expected audit output');\n    } else {\n      const parsedBody = JSON.parse(resp.stdout);\n      assert.ok(\n        parsedBody.auditReportVersion !== undefined,\n        'Expected \"auditReportVersion\" in audit response'\n      );\n      assert.ok(\n        parsedBody.vulnerabilities !== undefined,\n        'Expected \"vulnerabilities\" in audit response'\n      );\n    }\n  }\n}\n\nexport const auditTest: TestDefinition = {\n  name: 'audit',\n  requires: ['audit'],\n  run: testAudit,\n};\n"],"mappings":";;;;AAMA,IAAM,QAAQ,WAAW,8BAA8B;AAEvD,eAAe,UAAU,KAAiC;CAExD,IAAI,IAAI,QAAQ,SAAS,SAAS,IAAI,QAAQ,SAAS,OAAO;EAC5D,MAAM,6CAA6C,IAAI,QAAQ,IAAI;EACnE;CACF;CAEA,MAAM,WAAW,CAAC,mBAAmB,IAAI,SAAS,oBAAoB,IAAI,OAAO;CAMjF,MAAM,UAAU,iBAAiB,IAAI;CACrC,MAAM,oBAAoB,KAAK,SAAS,OAAO;CAE/C,KAAK,MAAM,WAAW,UAAU;EAC9B,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,SACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,OACJ,GAAG,UAAU,QAAQ,CACvB;EAGA,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EAMA,IAAI;GAMF,KAAI,MALgB,MAAM,GAAG,IAAI,YAAY,kCAAkC;IAC7E,QAAQ;IACR,SAAS,EAAE,gBAAgB,mBAAmB;IAC9C,MAAM;GACR,CAAC,EAAA,CACS,WAAW,KAAK;IACxB,MAAM,+DAA+D;IACrE;GACF;EACF,QAAQ;GACN,MAAM,uCAAuC;GAC7C;EACF;EAEA,IAAI;EACJ,IAAI;GACF,OAAO,MAAM,IAAI,QAAQ,KACvB,EAAE,KAAK,WAAW,GAClB,SACA,UACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EACF,SAAS,KAAK;GAIZ,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GAC/D,IAAI,0DAA0D,KAAK,OAAO,GAAG;IAC3E,MAAM,uDAAuD,OAAO;IACpE;GACF;GACA,MAAM;EACR;EAEA,IAAI,IAAI,QAAQ,SAAS,OAEvB,OAAO,GAAG,KAAK,OAAO,SAAS,KAAK,KAAK,OAAO,SAAS,GAAG,uBAAuB;OAC9E;GACL,MAAM,aAAa,KAAK,MAAM,KAAK,MAAM;GACzC,OAAO,GACL,WAAW,uBAAuB,KAAA,GAClC,mDACF;GACA,OAAO,GACL,WAAW,oBAAoB,KAAA,GAC/B,gDACF;EACF;CACF;AACF;AAEA,IAAa,YAA4B;CACvC,MAAM;CACN,UAAU,CAAC,OAAO;CAClB,KAAK;AACP"}

package/build/esm/tests/ci.js

@@ -1,3 +1,4 @@
+import { publishLocalPackage } from "../utils/publish.js";
 import buildDebug from "debug";
 import { join } from "path";
 import { rm } from "fs/promises";
@@ -26,11 +27,6 @@ function getCiArgs(ctx) {
 			"--frozen-lockfile",
 			...ctx.adapter.registryArg(ctx.registryUrl)
 		];
-		case "yarn-classic": return [
-			"install",
-			"--frozen-lockfile",
-			...ctx.adapter.registryArg(ctx.registryUrl)
-		];
 		case "yarn-modern": return ["install", "--immutable"];
 		case "bun": return [
 			"install",
@@ -45,7 +41,9 @@ async function testCi(ctx) {
 		debug("skipping ci test for deno (no ci command)");
 		return;
 	}
-	const { tempFolder } = await ctx.adapter.prepareProject(`ci-test-${ctx.runId}`, "1.0.0", ctx.registryUrl, ctx.port, ctx.token, { "is-odd": "1.0.0" });
+	const depName = `e2e-ci-dep-${ctx.runId}`;
+	await publishLocalPackage(ctx, depName, "1.0.0");
+	const { tempFolder } = await ctx.adapter.prepareProject(`ci-test-${ctx.runId}`, "1.0.0", ctx.registryUrl, ctx.port, ctx.token, { [depName]: "1.0.0" });
 	debug("running initial install to generate lockfile in %s", tempFolder);
 	await ctx.adapter.exec({ cwd: tempFolder }, "install", ...ctx.adapter.registryArg(ctx.registryUrl));
 	debug("lockfile generated, removing node_modules");

package/build/esm/tests/ci.js.map

@@ -1 +1 @@
-{"version":3,"file":"ci.js","names":[],"sources":["../../../src/tests/ci.ts"],"sourcesContent":["import assert from 'assert';\nimport buildDebug from 'debug';\nimport { rm } from 'fs/promises';\nimport { join } from 'path';\n\nimport { TestContext, TestDefinition } from '../types';\n\nconst debug = buildDebug('verdaccio:e2e-cli:test:ci');\n\n/**\n * Test: ci\n *\n * Verifies that lockfile-based install works correctly.\n * Unlike `install`, CI commands skip metadata fetches and resolve\n * tarballs directly from the URLs stored in the lockfile.\n *\n * Flow:\n *   1. Prepare a project with dependencies\n *   2. Run `install` to generate the lockfile\n *   3. Remove node_modules\n *   4. Run the CI-equivalent command (npm ci / pnpm install --frozen-lockfile / yarn --frozen-lockfile / yarn --immutable)\n *   5. Verify it completes successfully\n */\n\nfunction getCiArgs(ctx: TestContext): string[] {\n  switch (ctx.adapter.type) {\n    case 'npm':\n      // `npm ci` — separate command, reads package-lock.json\n      return ['ci', ...ctx.adapter.registryArg(ctx.registryUrl)];\n    case 'pnpm':\n      // `pnpm install --frozen-lockfile` — same command, strict mode\n      return ['install', '--frozen-lockfile', ...ctx.adapter.registryArg(ctx.registryUrl)];\n    case 'yarn-classic':\n      // `yarn install --frozen-lockfile`\n      return ['install', '--frozen-lockfile', ...ctx.adapter.registryArg(ctx.registryUrl)];\n    case 'yarn-modern':\n      // `yarn install --immutable`\n      return ['install', '--immutable'];\n    case 'bun':\n      // `bun install --frozen-lockfile`\n      return ['install', '--frozen-lockfile', ...ctx.adapter.registryArg(ctx.registryUrl)];\n    default:\n      return ['ci', ...ctx.adapter.registryArg(ctx.registryUrl)];\n  }\n}\n\nasync function testCi(ctx: TestContext): Promise<void> {\n  // deno doesn't have a CI/frozen-lockfile equivalent\n  if (ctx.adapter.type === 'deno') {\n    debug('skipping ci test for deno (no ci command)');\n    return;\n  }\n\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    `ci-test-${ctx.runId}`,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token,\n    { 'is-odd': '1.0.0' }\n  );\n\n  debug('running initial install to generate lockfile in %s', tempFolder);\n\n  // Step 1: Run install to generate the lockfile\n  await ctx.adapter.exec(\n    { cwd: tempFolder },\n    'install',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n\n  debug('lockfile generated, removing node_modules');\n\n  // Step 2: Remove node_modules to force a clean install from lockfile\n  const nodeModulesPath = join(tempFolder, 'node_modules');\n  await rm(nodeModulesPath, { recursive: true, force: true });\n\n  // For pnpm, also clean the virtual store\n  const pnpmStorePath = join(tempFolder, '.pnpm-store');\n  await rm(pnpmStorePath, { recursive: true, force: true });\n\n  debug('node_modules removed, running ci command');\n\n  // Step 3: Run CI-equivalent command (tarball-only, no metadata fetches)\n  const ciArgs = getCiArgs(ctx);\n  debug('ci args: %o', ciArgs);\n  const resp = await ctx.adapter.exec({ cwd: tempFolder }, ...ciArgs);\n\n  // Step 4: Verify success\n  if (ctx.adapter.type === 'npm') {\n    // npm ci with --json is not reliable, just check exit code 0\n    // and verify output mentions added packages\n    const output = resp.stdout + resp.stderr;\n    debug('npm ci output: %s', output);\n    assert.ok(true, 'npm ci completed successfully');\n  } else {\n    debug('ci completed successfully for %s', ctx.adapter.type);\n    assert.ok(true, `CI install completed successfully for ${ctx.adapter.type}`);\n  }\n}\n\nexport const ciTest: TestDefinition = {\n  name: 'ci',\n  requires: ['install'],\n  run: testCi,\n};\n"],"mappings":";;;;;AAOA,IAAM,QAAQ,WAAW,2BAA2B;;;;;;;;;;;;;;;AAiBpD,SAAS,UAAU,KAA4B;CAC7C,QAAQ,IAAI,QAAQ,MAApB;EACE,KAAK,OAEH,OAAO,CAAC,MAAM,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAAC;EAC3D,KAAK,QAEH,OAAO;GAAC;GAAW;GAAqB,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW;EAAC;EACrF,KAAK,gBAEH,OAAO;GAAC;GAAW;GAAqB,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW;EAAC;EACrF,KAAK,eAEH,OAAO,CAAC,WAAW,aAAa;EAClC,KAAK,OAEH,OAAO;GAAC;GAAW;GAAqB,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW;EAAC;EACrF,SACE,OAAO,CAAC,MAAM,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAAC;CAC7D;AACF;AAEA,eAAe,OAAO,KAAiC;CAErD,IAAI,IAAI,QAAQ,SAAS,QAAQ;EAC/B,MAAM,2CAA2C;EACjD;CACF;CAEA,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,WAAW,IAAI,SACf,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,OACJ,EAAE,UAAU,QAAQ,CACtB;CAEA,MAAM,sDAAsD,UAAU;CAGtE,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CAEA,MAAM,2CAA2C;CAGjD,MAAM,kBAAkB,KAAK,YAAY,cAAc;CACvD,MAAM,GAAG,iBAAiB;EAAE,WAAW;EAAM,OAAO;CAAK,CAAC;CAG1D,MAAM,gBAAgB,KAAK,YAAY,aAAa;CACpD,MAAM,GAAG,eAAe;EAAE,WAAW;EAAM,OAAO;CAAK,CAAC;CAExD,MAAM,0CAA0C;CAGhD,MAAM,SAAS,UAAU,GAAG;CAC5B,MAAM,eAAe,MAAM;CAC3B,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,WAAW,GAAG,GAAG,MAAM;CAGlE,IAAI,IAAI,QAAQ,SAAS,OAAO;EAI9B,MAAM,qBADS,KAAK,SAAS,KAAK,MACD;EACjC,OAAO,GAAG,MAAM,+BAA+B;CACjD,OAAO;EACL,MAAM,oCAAoC,IAAI,QAAQ,IAAI;EAC1D,OAAO,GAAG,MAAM,yCAAyC,IAAI,QAAQ,MAAM;CAC7E;AACF;AAEA,IAAa,SAAyB;CACpC,MAAM;CACN,UAAU,CAAC,SAAS;CACpB,KAAK;AACP"}
+{"version":3,"file":"ci.js","names":[],"sources":["../../../src/tests/ci.ts"],"sourcesContent":["import assert from 'assert';\nimport buildDebug from 'debug';\nimport { rm } from 'fs/promises';\nimport { join } from 'path';\n\nimport { TestContext, TestDefinition } from '../types';\nimport { publishLocalPackage } from '../utils/publish';\n\nconst debug = buildDebug('verdaccio:e2e-cli:test:ci');\n\n/**\n * Test: ci\n *\n * Verifies that lockfile-based install works correctly.\n * Unlike `install`, CI commands skip metadata fetches and resolve\n * tarballs directly from the URLs stored in the lockfile.\n *\n * Flow:\n *   1. Prepare a project with dependencies\n *   2. Run `install` to generate the lockfile\n *   3. Remove node_modules\n *   4. Run the CI-equivalent command (npm ci / pnpm install --frozen-lockfile / yarn --frozen-lockfile / yarn --immutable)\n *   5. Verify it completes successfully\n */\n\nfunction getCiArgs(ctx: TestContext): string[] {\n  switch (ctx.adapter.type) {\n    case 'npm':\n      // `npm ci` — separate command, reads package-lock.json\n      return ['ci', ...ctx.adapter.registryArg(ctx.registryUrl)];\n    case 'pnpm':\n      // `pnpm install --frozen-lockfile` — same command, strict mode\n      return ['install', '--frozen-lockfile', ...ctx.adapter.registryArg(ctx.registryUrl)];\n    case 'yarn-modern':\n      // `yarn install --immutable`\n      return ['install', '--immutable'];\n    case 'bun':\n      // `bun install --frozen-lockfile`\n      return ['install', '--frozen-lockfile', ...ctx.adapter.registryArg(ctx.registryUrl)];\n    default:\n      return ['ci', ...ctx.adapter.registryArg(ctx.registryUrl)];\n  }\n}\n\nasync function testCi(ctx: TestContext): Promise<void> {\n  // deno doesn't have a CI/frozen-lockfile equivalent\n  if (ctx.adapter.type === 'deno') {\n    debug('skipping ci test for deno (no ci command)');\n    return;\n  }\n\n  // Publish the dependency locally first — the suite must run offline\n  const depName = `e2e-ci-dep-${ctx.runId}`;\n  await publishLocalPackage(ctx, depName, '1.0.0');\n\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    `ci-test-${ctx.runId}`,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token,\n    { [depName]: '1.0.0' }\n  );\n\n  debug('running initial install to generate lockfile in %s', tempFolder);\n\n  // Step 1: Run install to generate the lockfile\n  await ctx.adapter.exec(\n    { cwd: tempFolder },\n    'install',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n\n  debug('lockfile generated, removing node_modules');\n\n  // Step 2: Remove node_modules to force a clean install from lockfile\n  const nodeModulesPath = join(tempFolder, 'node_modules');\n  await rm(nodeModulesPath, { recursive: true, force: true });\n\n  // For pnpm, also clean the virtual store\n  const pnpmStorePath = join(tempFolder, '.pnpm-store');\n  await rm(pnpmStorePath, { recursive: true, force: true });\n\n  debug('node_modules removed, running ci command');\n\n  // Step 3: Run CI-equivalent command (tarball-only, no metadata fetches)\n  const ciArgs = getCiArgs(ctx);\n  debug('ci args: %o', ciArgs);\n  const resp = await ctx.adapter.exec({ cwd: tempFolder }, ...ciArgs);\n\n  // Step 4: Verify success\n  if (ctx.adapter.type === 'npm') {\n    // npm ci with --json is not reliable, just check exit code 0\n    // and verify output mentions added packages\n    const output = resp.stdout + resp.stderr;\n    debug('npm ci output: %s', output);\n    assert.ok(true, 'npm ci completed successfully');\n  } else {\n    debug('ci completed successfully for %s', ctx.adapter.type);\n    assert.ok(true, `CI install completed successfully for ${ctx.adapter.type}`);\n  }\n}\n\nexport const ciTest: TestDefinition = {\n  name: 'ci',\n  requires: ['install'],\n  run: testCi,\n};\n"],"mappings":";;;;;;AAQA,IAAM,QAAQ,WAAW,2BAA2B;;;;;;;;;;;;;;;AAiBpD,SAAS,UAAU,KAA4B;CAC7C,QAAQ,IAAI,QAAQ,MAApB;EACE,KAAK,OAEH,OAAO,CAAC,MAAM,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAAC;EAC3D,KAAK,QAEH,OAAO;GAAC;GAAW;GAAqB,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW;EAAC;EACrF,KAAK,eAEH,OAAO,CAAC,WAAW,aAAa;EAClC,KAAK,OAEH,OAAO;GAAC;GAAW;GAAqB,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW;EAAC;EACrF,SACE,OAAO,CAAC,MAAM,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAAC;CAC7D;AACF;AAEA,eAAe,OAAO,KAAiC;CAErD,IAAI,IAAI,QAAQ,SAAS,QAAQ;EAC/B,MAAM,2CAA2C;EACjD;CACF;CAGA,MAAM,UAAU,cAAc,IAAI;CAClC,MAAM,oBAAoB,KAAK,SAAS,OAAO;CAE/C,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,WAAW,IAAI,SACf,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,OACJ,GAAG,UAAU,QAAQ,CACvB;CAEA,MAAM,sDAAsD,UAAU;CAGtE,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CAEA,MAAM,2CAA2C;CAGjD,MAAM,kBAAkB,KAAK,YAAY,cAAc;CACvD,MAAM,GAAG,iBAAiB;EAAE,WAAW;EAAM,OAAO;CAAK,CAAC;CAG1D,MAAM,gBAAgB,KAAK,YAAY,aAAa;CACpD,MAAM,GAAG,eAAe;EAAE,WAAW;EAAM,OAAO;CAAK,CAAC;CAExD,MAAM,0CAA0C;CAGhD,MAAM,SAAS,UAAU,GAAG;CAC5B,MAAM,eAAe,MAAM;CAC3B,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,WAAW,GAAG,GAAG,MAAM;CAGlE,IAAI,IAAI,QAAQ,SAAS,OAAO;EAI9B,MAAM,qBADS,KAAK,SAAS,KAAK,MACD;EACjC,OAAO,GAAG,MAAM,+BAA+B;CACjD,OAAO;EACL,MAAM,oCAAoC,IAAI,QAAQ,IAAI;EAC1D,OAAO,GAAG,MAAM,yCAAyC,IAAI,QAAQ,MAAM;CAC7E;AACF;AAEA,IAAa,SAAyB;CACpC,MAAM;CACN,UAAU,CAAC,SAAS;CACpB,KAAK;AACP"}

package/build/esm/tests/index.js

@@ -1,5 +1,9 @@
 import "../scenarios/install-multiple-deps.js";
+import "../scenarios/metadata.js";
 import "../scenarios/minimum-release-age.js";
+import "../scenarios/search.js";
+import "../scenarios/tarballs.js";
+import "../scenarios/uplink-failure.js";
 import { allScenarios } from "../scenarios/index.js";
 import { auditTest } from "./audit.js";
 import { ciTest } from "./ci.js";

package/build/esm/tests/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../src/tests/index.ts"],"sourcesContent":["import { allScenarios, installMultipleDepsScenario, minimumReleaseAgeScenario } from '../scenarios';\nimport { TestDefinition } from '../types';\nimport { auditTest } from './audit';\nimport { ciTest } from './ci';\nimport { deprecateTest } from './deprecate';\nimport { distTagsTest } from './dist-tags';\nimport { infoTest } from './info';\nimport { installTest } from './install';\nimport { loginTest } from './login';\nimport { pingTest } from './ping';\nimport { publishTest } from './publish';\nimport { searchTest } from './search';\nimport { unpublishTest } from './unpublish';\n\nexport const allTests: TestDefinition[] = [\n  publishTest,\n  installTest,\n  ciTest,\n  auditTest,\n  infoTest,\n  deprecateTest,\n  distTagsTest,\n  loginTest,\n  pingTest,\n  searchTest,\n  unpublishTest,\n  // Scenarios (complex, multi-step tests)\n  ...allScenarios,\n];\n\nexport {\n  publishTest,\n  installTest,\n  ciTest,\n  auditTest,\n  infoTest,\n  deprecateTest,\n  distTagsTest,\n  loginTest,\n  pingTest,\n  searchTest,\n  unpublishTest,\n  // Scenarios\n  installMultipleDepsScenario,\n  minimumReleaseAgeScenario,\n  allScenarios,\n};\n"],"mappings":";;;;;;;;;;;;;;;AAcA,IAAa,WAA6B;CACxC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,GAAG;AACL"}
+{"version":3,"file":"index.js","names":[],"sources":["../../../src/tests/index.ts"],"sourcesContent":["import {\n  allScenarios,\n  installMultipleDepsScenario,\n  metadataScenario,\n  minimumReleaseAgeScenario,\n  searchScenario,\n  tarballsScenario,\n  uplinkFailureScenario,\n} from '../scenarios';\nimport { TestDefinition } from '../types';\nimport { auditTest } from './audit';\nimport { ciTest } from './ci';\nimport { deprecateTest } from './deprecate';\nimport { distTagsTest } from './dist-tags';\nimport { infoTest } from './info';\nimport { installTest } from './install';\nimport { loginTest } from './login';\nimport { pingTest } from './ping';\nimport { publishTest } from './publish';\nimport { searchTest } from './search';\nimport { unpublishTest } from './unpublish';\n\nexport const allTests: TestDefinition[] = [\n  publishTest,\n  installTest,\n  ciTest,\n  auditTest,\n  infoTest,\n  deprecateTest,\n  distTagsTest,\n  loginTest,\n  pingTest,\n  searchTest,\n  unpublishTest,\n  // Scenarios (complex, multi-step tests)\n  ...allScenarios,\n];\n\nexport {\n  publishTest,\n  installTest,\n  ciTest,\n  auditTest,\n  infoTest,\n  deprecateTest,\n  distTagsTest,\n  loginTest,\n  pingTest,\n  searchTest,\n  unpublishTest,\n  // Scenarios\n  installMultipleDepsScenario,\n  minimumReleaseAgeScenario,\n  tarballsScenario,\n  metadataScenario,\n  searchScenario,\n  uplinkFailureScenario,\n  allScenarios,\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAsBA,IAAa,WAA6B;CACxC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,GAAG;AACL"}

package/build/esm/tests/info.js

@@ -1,31 +1,20 @@
-import { createTempFolder } from "../utils/project.js";
 import { parseInfoJson } from "../utils/info.js";
-import { join } from "path";
-import { writeFile } from "fs/promises";
+import { publishLocalPackage } from "../utils/publish.js";
 import assert from "assert";
 //#region src/tests/info.ts
 async function testInfo(ctx) {
-	const tempFolder = await createTempFolder("info-test");
-	await writeFile(join(tempFolder, "package.json"), JSON.stringify({
-		name: "info-test",
-		version: "1.0.0"
-	}));
-	const resp = await ctx.adapter.exec({ cwd: tempFolder }, "info", "verdaccio", "--json", ...ctx.adapter.registryArg(ctx.registryUrl));
-	if (ctx.adapter.type === "yarn-classic") {
-		const dataLine = resp.stdout.split("\n").filter(Boolean).find((l) => {
-			try {
-				return JSON.parse(l).type === "inspect";
-			} catch {
-				return false;
-			}
-		});
-		assert.ok(dataLine, "Expected yarn info NDJSON to contain an \"inspect\" entry");
-	} else if (ctx.adapter.type === "deno") {
+	const depName = `e2e-info-dep-${ctx.runId}`;
+	const pkgName = `e2e-info-${ctx.runId}`;
+	await publishLocalPackage(ctx, depName, "1.0.0");
+	await publishLocalPackage(ctx, pkgName, "1.0.0", { [depName]: "1.0.0" });
+	const { tempFolder } = await ctx.adapter.prepareProject(`info-client-${ctx.runId}`, "1.0.0", ctx.registryUrl, ctx.port, ctx.token);
+	const resp = await ctx.adapter.exec({ cwd: tempFolder }, "info", pkgName, "--json", ...ctx.adapter.registryArg(ctx.registryUrl));
+	if (ctx.adapter.type === "deno") {
 		const output = resp.stdout + resp.stderr;
-		assert.ok(output.includes("verdaccio"), "Expected deno info output to reference verdaccio");
+		assert.ok(output.includes(pkgName), `Expected deno info output to reference ${pkgName}`);
 	} else {
 		const parsedBody = parseInfoJson(resp.stdout);
-		assert.strictEqual(parsedBody.name, "verdaccio", "Expected package name \"verdaccio\"");
+		assert.strictEqual(parsedBody.name, pkgName, `Expected package name "${pkgName}"`);
 		assert.ok(parsedBody.dependencies !== void 0, "Expected \"dependencies\" to be defined");
 	}
 }

package/build/esm/tests/info.js.map

@@ -1 +1 @@
-{"version":3,"file":"info.js","names":[],"sources":["../../../src/tests/info.ts"],"sourcesContent":["import assert from 'assert';\nimport { writeFile } from 'fs/promises';\nimport { join } from 'path';\n\nimport { TestContext, TestDefinition } from '../types';\nimport { parseInfoJson } from '../utils/info';\nimport { createTempFolder } from '../utils/project';\n\nasync function testInfo(ctx: TestContext): Promise<void> {\n  // Create a minimal temp project so yarn modern has a project context\n  // and yarn classic doesn't pick up the repo's packageManager field\n  const tempFolder = await createTempFolder('info-test');\n  await writeFile(\n    join(tempFolder, 'package.json'),\n    JSON.stringify({ name: 'info-test', version: '1.0.0' })\n  );\n\n  const resp = await ctx.adapter.exec(\n    { cwd: tempFolder },\n    'info',\n    'verdaccio',\n    '--json',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n\n  if (ctx.adapter.type === 'yarn-classic') {\n    const lines = resp.stdout.split('\\n').filter(Boolean);\n    const dataLine = lines.find((l) => {\n      try {\n        const obj = JSON.parse(l);\n        return obj.type === 'inspect';\n      } catch {\n        return false;\n      }\n    });\n    assert.ok(dataLine, 'Expected yarn info NDJSON to contain an \"inspect\" entry');\n  } else if (ctx.adapter.type === 'deno') {\n    // deno info npm:<pkg> outputs a text dependency tree\n    const output = resp.stdout + resp.stderr;\n    assert.ok(output.includes('verdaccio'), 'Expected deno info output to reference verdaccio');\n  } else {\n    const parsedBody = parseInfoJson(resp.stdout);\n    assert.strictEqual(parsedBody.name, 'verdaccio', 'Expected package name \"verdaccio\"');\n    assert.ok(parsedBody.dependencies !== undefined, 'Expected \"dependencies\" to be defined');\n  }\n}\n\nexport const infoTest: TestDefinition = {\n  name: 'info',\n  requires: ['info'],\n  run: testInfo,\n};\n"],"mappings":";;;;;;AAQA,eAAe,SAAS,KAAiC;CAGvD,MAAM,aAAa,MAAM,iBAAiB,WAAW;CACrD,MAAM,UACJ,KAAK,YAAY,cAAc,GAC/B,KAAK,UAAU;EAAE,MAAM;EAAa,SAAS;CAAQ,CAAC,CACxD;CAEA,MAAM,OAAO,MAAM,IAAI,QAAQ,KAC7B,EAAE,KAAK,WAAW,GAClB,QACA,aACA,UACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CAEA,IAAI,IAAI,QAAQ,SAAS,gBAAgB;EAEvC,MAAM,WADQ,KAAK,OAAO,MAAM,IAAI,CAAC,CAAC,OAAO,OAC5B,CAAA,CAAM,MAAM,MAAM;GACjC,IAAI;IAEF,OADY,KAAK,MAAM,CAChB,CAAA,CAAI,SAAS;GACtB,QAAQ;IACN,OAAO;GACT;EACF,CAAC;EACD,OAAO,GAAG,UAAU,2DAAyD;CAC/E,OAAO,IAAI,IAAI,QAAQ,SAAS,QAAQ;EAEtC,MAAM,SAAS,KAAK,SAAS,KAAK;EAClC,OAAO,GAAG,OAAO,SAAS,WAAW,GAAG,kDAAkD;CAC5F,OAAO;EACL,MAAM,aAAa,cAAc,KAAK,MAAM;EAC5C,OAAO,YAAY,WAAW,MAAM,aAAa,qCAAmC;EACpF,OAAO,GAAG,WAAW,iBAAiB,KAAA,GAAW,yCAAuC;CAC1F;AACF;AAEA,IAAa,WAA2B;CACtC,MAAM;CACN,UAAU,CAAC,MAAM;CACjB,KAAK;AACP"}
+{"version":3,"file":"info.js","names":[],"sources":["../../../src/tests/info.ts"],"sourcesContent":["import assert from 'assert';\n\nimport { TestContext, TestDefinition } from '../types';\nimport { parseInfoJson } from '../utils/info';\nimport { publishLocalPackage } from '../utils/publish';\n\nasync function testInfo(ctx: TestContext): Promise<void> {\n  // Publish the package we inspect (with one dependency, also local) — asking\n  // for a real npmjs package would need an uplink and the suite must run\n  // offline. deno resolves the dependency tree, so the dep must exist too.\n  const depName = `e2e-info-dep-${ctx.runId}`;\n  const pkgName = `e2e-info-${ctx.runId}`;\n  await publishLocalPackage(ctx, depName, '1.0.0');\n  await publishLocalPackage(ctx, pkgName, '1.0.0', { [depName]: '1.0.0' });\n\n  // Run from a prepared project: it gives yarn modern a project context, and\n  // its .npmrc (fresh token) shields the test from stale credentials in\n  // ~/.npmrc.\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    `info-client-${ctx.runId}`,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token\n  );\n\n  const resp = await ctx.adapter.exec(\n    { cwd: tempFolder },\n    'info',\n    pkgName,\n    '--json',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n\n  if (ctx.adapter.type === 'deno') {\n    // deno info npm:<pkg> outputs a text dependency tree\n    const output = resp.stdout + resp.stderr;\n    assert.ok(output.includes(pkgName), `Expected deno info output to reference ${pkgName}`);\n  } else {\n    const parsedBody = parseInfoJson(resp.stdout);\n    assert.strictEqual(parsedBody.name, pkgName, `Expected package name \"${pkgName}\"`);\n    assert.ok(parsedBody.dependencies !== undefined, 'Expected \"dependencies\" to be defined');\n  }\n}\n\nexport const infoTest: TestDefinition = {\n  name: 'info',\n  requires: ['info'],\n  run: testInfo,\n};\n"],"mappings":";;;;AAMA,eAAe,SAAS,KAAiC;CAIvD,MAAM,UAAU,gBAAgB,IAAI;CACpC,MAAM,UAAU,YAAY,IAAI;CAChC,MAAM,oBAAoB,KAAK,SAAS,OAAO;CAC/C,MAAM,oBAAoB,KAAK,SAAS,SAAS,GAAG,UAAU,QAAQ,CAAC;CAKvE,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,eAAe,IAAI,SACnB,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;CAEA,MAAM,OAAO,MAAM,IAAI,QAAQ,KAC7B,EAAE,KAAK,WAAW,GAClB,QACA,SACA,UACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CAEA,IAAI,IAAI,QAAQ,SAAS,QAAQ;EAE/B,MAAM,SAAS,KAAK,SAAS,KAAK;EAClC,OAAO,GAAG,OAAO,SAAS,OAAO,GAAG,0CAA0C,SAAS;CACzF,OAAO;EACL,MAAM,aAAa,cAAc,KAAK,MAAM;EAC5C,OAAO,YAAY,WAAW,MAAM,SAAS,0BAA0B,QAAQ,EAAE;EACjF,OAAO,GAAG,WAAW,iBAAiB,KAAA,GAAW,yCAAuC;CAC1F;AACF;AAEA,IAAa,WAA2B;CACtC,MAAM;CACN,UAAU,CAAC,MAAM;CACjB,KAAK;AACP"}

package/build/esm/tests/install.js

@@ -1,7 +1,10 @@
+import { publishLocalPackage } from "../utils/publish.js";
 import assert from "assert";
 //#region src/tests/install.ts
 async function testInstall(ctx) {
-	const { tempFolder } = await ctx.adapter.prepareProject(`install-test-${ctx.runId}`, "1.0.0", ctx.registryUrl, ctx.port, ctx.token, { react: "18.2.0" });
+	const depName = `e2e-install-dep-${ctx.runId}`;
+	await publishLocalPackage(ctx, depName, "1.0.0");
+	const { tempFolder } = await ctx.adapter.prepareProject(`install-test-${ctx.runId}`, "1.0.0", ctx.registryUrl, ctx.port, ctx.token, { [depName]: "1.0.0" });
 	const isNpm = ctx.adapter.type === "npm";
 	const args = isNpm ? [
 		"install",

package/build/esm/tests/install.js.map

@@ -1 +1 @@
-{"version":3,"file":"install.js","names":[],"sources":["../../../src/tests/install.ts"],"sourcesContent":["import assert from 'assert';\n\nimport { TestContext, TestDefinition } from '../types';\n\nasync function testInstall(ctx: TestContext): Promise<void> {\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    `install-test-${ctx.runId}`,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token,\n    { react: '18.2.0' }\n  );\n\n  const isNpm = ctx.adapter.type === 'npm';\n\n  // pnpm doesn't support --json on install\n  const args = isNpm\n    ? ['install', '--json', ...ctx.adapter.registryArg(ctx.registryUrl)]\n    : ['install', ...ctx.adapter.registryArg(ctx.registryUrl)];\n\n  const resp = await ctx.adapter.exec({ cwd: tempFolder }, ...args);\n\n  if (isNpm) {\n    const parsedBody = JSON.parse(resp.stdout);\n    assert.ok(parsedBody.added !== undefined, 'Expected \"added\" field in install response');\n  } else {\n    // for pnpm/yarn just verify it completed without error (exit code 0)\n    assert.ok(true, 'Install completed successfully');\n  }\n}\n\nexport const installTest: TestDefinition = {\n  name: 'install',\n  requires: ['install'],\n  run: testInstall,\n};\n"],"mappings":";;AAIA,eAAe,YAAY,KAAiC;CAC1D,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,gBAAgB,IAAI,SACpB,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,OACJ,EAAE,OAAO,SAAS,CACpB;CAEA,MAAM,QAAQ,IAAI,QAAQ,SAAS;CAGnC,MAAM,OAAO,QACT;EAAC;EAAW;EAAU,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW;CAAC,IACjE,CAAC,WAAW,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAAC;CAE3D,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,WAAW,GAAG,GAAG,IAAI;CAEhE,IAAI,OAAO;EACT,MAAM,aAAa,KAAK,MAAM,KAAK,MAAM;EACzC,OAAO,GAAG,WAAW,UAAU,KAAA,GAAW,8CAA4C;CACxF,OAEE,OAAO,GAAG,MAAM,gCAAgC;AAEpD;AAEA,IAAa,cAA8B;CACzC,MAAM;CACN,UAAU,CAAC,SAAS;CACpB,KAAK;AACP"}
+{"version":3,"file":"install.js","names":[],"sources":["../../../src/tests/install.ts"],"sourcesContent":["import assert from 'assert';\n\nimport { TestContext, TestDefinition } from '../types';\nimport { publishLocalPackage } from '../utils/publish';\n\nasync function testInstall(ctx: TestContext): Promise<void> {\n  // Publish the dependency locally first — the suite must work offline, so\n  // nothing is ever resolved from an external registry.\n  const depName = `e2e-install-dep-${ctx.runId}`;\n  await publishLocalPackage(ctx, depName, '1.0.0');\n\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    `install-test-${ctx.runId}`,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token,\n    { [depName]: '1.0.0' }\n  );\n\n  const isNpm = ctx.adapter.type === 'npm';\n\n  // pnpm doesn't support --json on install\n  const args = isNpm\n    ? ['install', '--json', ...ctx.adapter.registryArg(ctx.registryUrl)]\n    : ['install', ...ctx.adapter.registryArg(ctx.registryUrl)];\n\n  const resp = await ctx.adapter.exec({ cwd: tempFolder }, ...args);\n\n  if (isNpm) {\n    const parsedBody = JSON.parse(resp.stdout);\n    assert.ok(parsedBody.added !== undefined, 'Expected \"added\" field in install response');\n  } else {\n    // for pnpm/yarn just verify it completed without error (exit code 0)\n    assert.ok(true, 'Install completed successfully');\n  }\n}\n\nexport const installTest: TestDefinition = {\n  name: 'install',\n  requires: ['install'],\n  run: testInstall,\n};\n"],"mappings":";;;AAKA,eAAe,YAAY,KAAiC;CAG1D,MAAM,UAAU,mBAAmB,IAAI;CACvC,MAAM,oBAAoB,KAAK,SAAS,OAAO;CAE/C,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,gBAAgB,IAAI,SACpB,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,OACJ,GAAG,UAAU,QAAQ,CACvB;CAEA,MAAM,QAAQ,IAAI,QAAQ,SAAS;CAGnC,MAAM,OAAO,QACT;EAAC;EAAW;EAAU,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW;CAAC,IACjE,CAAC,WAAW,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAAC;CAE3D,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,WAAW,GAAG,GAAG,IAAI;CAEhE,IAAI,OAAO;EACT,MAAM,aAAa,KAAK,MAAM,KAAK,MAAM;EACzC,OAAO,GAAG,WAAW,UAAU,KAAA,GAAW,8CAA4C;CACxF,OAEE,OAAO,GAAG,MAAM,gCAAgC;AAEpD;AAEA,IAAa,cAA8B;CACzC,MAAM;CACN,UAAU,CAAC,SAAS;CACpB,KAAK;AACP"}

package/build/esm/tests/ping.js

@@ -2,13 +2,9 @@ import assert from "assert";
 //#region src/tests/ping.ts
 async function testPing(ctx) {
 	const type = ctx.adapter.type;
-	const needsProject = type === "yarn-modern";
-	let cwd;
-	if (needsProject) {
-		const { tempFolder } = await ctx.adapter.prepareProject(`verdaccio-ping-${ctx.runId}`, "1.0.0", ctx.registryUrl, ctx.port, ctx.token);
-		cwd = tempFolder;
-		if (ctx.adapter.importPlugin) await ctx.adapter.importPlugin(tempFolder, "npm-ping");
-	}
+	const { tempFolder } = await ctx.adapter.prepareProject(`verdaccio-ping-${ctx.runId}`, "1.0.0", ctx.registryUrl, ctx.port, ctx.token);
+	const cwd = tempFolder;
+	if (type === "yarn-modern" && ctx.adapter.importPlugin) await ctx.adapter.importPlugin(tempFolder, "npm-ping");
 	const jsonFlag = type === "yarn-modern" ? [] : ["--json"];
 	const resp = await ctx.adapter.exec({ cwd }, "ping", ...jsonFlag, ...ctx.adapter.registryArg(ctx.registryUrl));
 	if (type === "yarn-modern") assert.ok(true, "ping succeeded");

package/build/esm/tests/ping.js.map

@@ -1 +1 @@
-{"version":3,"file":"ping.js","names":[],"sources":["../../../src/tests/ping.ts"],"sourcesContent":["import assert from 'assert';\n\nimport { TestContext, TestDefinition } from '../types';\n\nasync function testPing(ctx: TestContext): Promise<void> {\n  const type = ctx.adapter.type;\n  const needsProject = type === 'yarn-modern';\n  let cwd: string | undefined;\n\n  if (needsProject) {\n    const { tempFolder } = await ctx.adapter.prepareProject(\n      `verdaccio-ping-${ctx.runId}`,\n      '1.0.0',\n      ctx.registryUrl,\n      ctx.port,\n      ctx.token\n    );\n    cwd = tempFolder;\n    if (ctx.adapter.importPlugin) {\n      await ctx.adapter.importPlugin(tempFolder, 'npm-ping');\n    }\n  }\n\n  const jsonFlag = type === 'yarn-modern' ? [] : ['--json'];\n  const resp = await ctx.adapter.exec(\n    { cwd },\n    'ping',\n    ...jsonFlag,\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n\n  if (type === 'yarn-modern') {\n    // yarn npm ping succeeding (exit code 0) is sufficient proof the registry is reachable\n    assert.ok(true, 'ping succeeded');\n  } else {\n    const parsedBody = JSON.parse(resp.stdout);\n    assert.strictEqual(\n      parsedBody.registry,\n      ctx.registryUrl + '/',\n      `Expected registry \"${ctx.registryUrl}/\" but got \"${parsedBody.registry}\"`\n    );\n  }\n}\n\nexport const pingTest: TestDefinition = {\n  name: 'ping',\n  requires: ['ping'],\n  run: testPing,\n};\n"],"mappings":";;AAIA,eAAe,SAAS,KAAiC;CACvD,MAAM,OAAO,IAAI,QAAQ;CACzB,MAAM,eAAe,SAAS;CAC9B,IAAI;CAEJ,IAAI,cAAc;EAChB,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,kBAAkB,IAAI,SACtB,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;EACA,MAAM;EACN,IAAI,IAAI,QAAQ,cACd,MAAM,IAAI,QAAQ,aAAa,YAAY,UAAU;CAEzD;CAEA,MAAM,WAAW,SAAS,gBAAgB,CAAC,IAAI,CAAC,QAAQ;CACxD,MAAM,OAAO,MAAM,IAAI,QAAQ,KAC7B,EAAE,IAAI,GACN,QACA,GAAG,UACH,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CAEA,IAAI,SAAS,eAEX,OAAO,GAAG,MAAM,gBAAgB;MAC3B;EACL,MAAM,aAAa,KAAK,MAAM,KAAK,MAAM;EACzC,OAAO,YACL,WAAW,UACX,IAAI,cAAc,KAClB,sBAAsB,IAAI,YAAY,cAAc,WAAW,SAAS,EAC1E;CACF;AACF;AAEA,IAAa,WAA2B;CACtC,MAAM;CACN,UAAU,CAAC,MAAM;CACjB,KAAK;AACP"}
+{"version":3,"file":"ping.js","names":[],"sources":["../../../src/tests/ping.ts"],"sourcesContent":["import assert from 'assert';\n\nimport { TestContext, TestDefinition } from '../types';\n\nasync function testPing(ctx: TestContext): Promise<void> {\n  const type = ctx.adapter.type;\n\n  // Always run from a prepared project: its .npmrc carries the fresh token and\n  // shields the test from whatever the developer's global ~/.npmrc has for\n  // this registry (a stale token there would turn into a spurious E401).\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    `verdaccio-ping-${ctx.runId}`,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token\n  );\n  const cwd = tempFolder;\n  if (type === 'yarn-modern' && ctx.adapter.importPlugin) {\n    await ctx.adapter.importPlugin(tempFolder, 'npm-ping');\n  }\n\n  const jsonFlag = type === 'yarn-modern' ? [] : ['--json'];\n  const resp = await ctx.adapter.exec(\n    { cwd },\n    'ping',\n    ...jsonFlag,\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n\n  if (type === 'yarn-modern') {\n    // yarn npm ping succeeding (exit code 0) is sufficient proof the registry is reachable\n    assert.ok(true, 'ping succeeded');\n  } else {\n    const parsedBody = JSON.parse(resp.stdout);\n    assert.strictEqual(\n      parsedBody.registry,\n      ctx.registryUrl + '/',\n      `Expected registry \"${ctx.registryUrl}/\" but got \"${parsedBody.registry}\"`\n    );\n  }\n}\n\nexport const pingTest: TestDefinition = {\n  name: 'ping',\n  requires: ['ping'],\n  run: testPing,\n};\n"],"mappings":";;AAIA,eAAe,SAAS,KAAiC;CACvD,MAAM,OAAO,IAAI,QAAQ;CAKzB,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,kBAAkB,IAAI,SACtB,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;CACA,MAAM,MAAM;CACZ,IAAI,SAAS,iBAAiB,IAAI,QAAQ,cACxC,MAAM,IAAI,QAAQ,aAAa,YAAY,UAAU;CAGvD,MAAM,WAAW,SAAS,gBAAgB,CAAC,IAAI,CAAC,QAAQ;CACxD,MAAM,OAAO,MAAM,IAAI,QAAQ,KAC7B,EAAE,IAAI,GACN,QACA,GAAG,UACH,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CAEA,IAAI,SAAS,eAEX,OAAO,GAAG,MAAM,gBAAgB;MAC3B;EACL,MAAM,aAAa,KAAK,MAAM,KAAK,MAAM;EACzC,OAAO,YACL,WAAW,UACX,IAAI,cAAc,KAClB,sBAAsB,IAAI,YAAY,cAAc,WAAW,SAAS,EAC1E;CACF;AACF;AAEA,IAAa,WAA2B;CACtC,MAAM;CACN,UAAU,CAAC,MAAM;CACjB,KAAK;AACP"}

package/build/esm/tests/publish.js

@@ -13,7 +13,6 @@ async function testPublish(ctx) {
 		if (type === "yarn-modern") await ctx.adapter.exec({ cwd: tempFolder }, "install");
 		const resp = await ctx.adapter.exec({ cwd: tempFolder }, "publish", "--json", ...ctx.adapter.registryArg(ctx.registryUrl));
 		if (type === "yarn-modern") assert.ok(resp.stdout.match(/Package archive published/), `Expected "Package archive published" for ${pkgName} but got "${resp.stdout}"`);
-		else if (type === "yarn-classic") assert.ok(resp.stdout.length > 0, `Expected publish output for ${pkgName}`);
 		else if (type === "bun") assert.ok(true, `Publish succeeded for ${pkgName}`);
 		else try {
 			const parsedBody = JSON.parse(resp.stdout);

package/build/esm/tests/publish.js.map

@@ -1 +1 @@
-{"version":3,"file":"publish.js","names":[],"sources":["../../../src/tests/publish.ts"],"sourcesContent":["import assert from 'assert';\n\nimport { TestContext, TestDefinition } from '../types';\n\nasync function testPublish(ctx: TestContext): Promise<void> {\n  const packages = [\n    `verdaccio-memory-${ctx.runId}`,\n    `verdaccio-${ctx.runId}`,\n    `@verdaccio/foo-${ctx.runId}`,\n    `@verdaccio/some-foo-${ctx.runId}`,\n  ];\n\n  const type = ctx.adapter.type;\n\n  for (const pkgName of packages) {\n    const { tempFolder } = await ctx.adapter.prepareProject(\n      pkgName,\n      '1.0.0',\n      ctx.registryUrl,\n      ctx.port,\n      ctx.token\n    );\n\n    // yarn modern requires install before publish to generate lockfile\n    if (type === 'yarn-modern') {\n      await ctx.adapter.exec({ cwd: tempFolder }, 'install');\n    }\n\n    const resp = await ctx.adapter.exec(\n      { cwd: tempFolder },\n      'publish',\n      '--json',\n      ...ctx.adapter.registryArg(ctx.registryUrl)\n    );\n\n    if (type === 'yarn-modern') {\n      assert.ok(\n        resp.stdout.match(/Package archive published/),\n        `Expected \"Package archive published\" for ${pkgName} but got \"${resp.stdout}\"`\n      );\n    } else if (type === 'yarn-classic') {\n      // yarn classic --json outputs NDJSON — just verify no error exit (exit code 0 is enough)\n      assert.ok(resp.stdout.length > 0, `Expected publish output for ${pkgName}`);\n    } else if (type === 'bun') {\n      // bun publish outputs text confirmation — exit code 0 is sufficient\n      assert.ok(true, `Publish succeeded for ${pkgName}`);\n    } else {\n      // npm / pnpm\n      try {\n        const parsedBody = JSON.parse(resp.stdout);\n        assert.strictEqual(\n          parsedBody.name,\n          pkgName,\n          `Expected package name \"${pkgName}\" but got \"${parsedBody.name}\"`\n        );\n        assert.ok(parsedBody.files, `Expected files to be defined for ${pkgName}`);\n      } catch {\n        // pnpm v11+ native publish doesn't output JSON — exit code 0 is sufficient\n        assert.ok(true, `Publish succeeded for ${pkgName}`);\n      }\n    }\n  }\n}\n\nexport const publishTest: TestDefinition = {\n  name: 'publish',\n  requires: ['publish'],\n  run: testPublish,\n};\n"],"mappings":";;AAIA,eAAe,YAAY,KAAiC;CAC1D,MAAM,WAAW;EACf,oBAAoB,IAAI;EACxB,aAAa,IAAI;EACjB,kBAAkB,IAAI;EACtB,uBAAuB,IAAI;CAC7B;CAEA,MAAM,OAAO,IAAI,QAAQ;CAEzB,KAAK,MAAM,WAAW,UAAU;EAC9B,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,SACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;EAGA,IAAI,SAAS,eACX,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,WAAW,GAAG,SAAS;EAGvD,MAAM,OAAO,MAAM,IAAI,QAAQ,KAC7B,EAAE,KAAK,WAAW,GAClB,WACA,UACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EAEA,IAAI,SAAS,eACX,OAAO,GACL,KAAK,OAAO,MAAM,2BAA2B,GAC7C,4CAA4C,QAAQ,YAAY,KAAK,OAAO,EAC9E;OACK,IAAI,SAAS,gBAElB,OAAO,GAAG,KAAK,OAAO,SAAS,GAAG,+BAA+B,SAAS;OACrE,IAAI,SAAS,OAElB,OAAO,GAAG,MAAM,yBAAyB,SAAS;OAGlD,IAAI;GACF,MAAM,aAAa,KAAK,MAAM,KAAK,MAAM;GACzC,OAAO,YACL,WAAW,MACX,SACA,0BAA0B,QAAQ,aAAa,WAAW,KAAK,EACjE;GACA,OAAO,GAAG,WAAW,OAAO,oCAAoC,SAAS;EAC3E,QAAQ;GAEN,OAAO,GAAG,MAAM,yBAAyB,SAAS;EACpD;CAEJ;AACF;AAEA,IAAa,cAA8B;CACzC,MAAM;CACN,UAAU,CAAC,SAAS;CACpB,KAAK;AACP"}
+{"version":3,"file":"publish.js","names":[],"sources":["../../../src/tests/publish.ts"],"sourcesContent":["import assert from 'assert';\n\nimport { TestContext, TestDefinition } from '../types';\n\nasync function testPublish(ctx: TestContext): Promise<void> {\n  const packages = [\n    `verdaccio-memory-${ctx.runId}`,\n    `verdaccio-${ctx.runId}`,\n    `@verdaccio/foo-${ctx.runId}`,\n    `@verdaccio/some-foo-${ctx.runId}`,\n  ];\n\n  const type = ctx.adapter.type;\n\n  for (const pkgName of packages) {\n    const { tempFolder } = await ctx.adapter.prepareProject(\n      pkgName,\n      '1.0.0',\n      ctx.registryUrl,\n      ctx.port,\n      ctx.token\n    );\n\n    // yarn modern requires install before publish to generate lockfile\n    if (type === 'yarn-modern') {\n      await ctx.adapter.exec({ cwd: tempFolder }, 'install');\n    }\n\n    const resp = await ctx.adapter.exec(\n      { cwd: tempFolder },\n      'publish',\n      '--json',\n      ...ctx.adapter.registryArg(ctx.registryUrl)\n    );\n\n    if (type === 'yarn-modern') {\n      assert.ok(\n        resp.stdout.match(/Package archive published/),\n        `Expected \"Package archive published\" for ${pkgName} but got \"${resp.stdout}\"`\n      );\n    } else if (type === 'bun') {\n      // bun publish outputs text confirmation — exit code 0 is sufficient\n      assert.ok(true, `Publish succeeded for ${pkgName}`);\n    } else {\n      // npm / pnpm\n      try {\n        const parsedBody = JSON.parse(resp.stdout);\n        assert.strictEqual(\n          parsedBody.name,\n          pkgName,\n          `Expected package name \"${pkgName}\" but got \"${parsedBody.name}\"`\n        );\n        assert.ok(parsedBody.files, `Expected files to be defined for ${pkgName}`);\n      } catch {\n        // pnpm v11+ native publish doesn't output JSON — exit code 0 is sufficient\n        assert.ok(true, `Publish succeeded for ${pkgName}`);\n      }\n    }\n  }\n}\n\nexport const publishTest: TestDefinition = {\n  name: 'publish',\n  requires: ['publish'],\n  run: testPublish,\n};\n"],"mappings":";;AAIA,eAAe,YAAY,KAAiC;CAC1D,MAAM,WAAW;EACf,oBAAoB,IAAI;EACxB,aAAa,IAAI;EACjB,kBAAkB,IAAI;EACtB,uBAAuB,IAAI;CAC7B;CAEA,MAAM,OAAO,IAAI,QAAQ;CAEzB,KAAK,MAAM,WAAW,UAAU;EAC9B,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,SACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;EAGA,IAAI,SAAS,eACX,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,WAAW,GAAG,SAAS;EAGvD,MAAM,OAAO,MAAM,IAAI,QAAQ,KAC7B,EAAE,KAAK,WAAW,GAClB,WACA,UACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EAEA,IAAI,SAAS,eACX,OAAO,GACL,KAAK,OAAO,MAAM,2BAA2B,GAC7C,4CAA4C,QAAQ,YAAY,KAAK,OAAO,EAC9E;OACK,IAAI,SAAS,OAElB,OAAO,GAAG,MAAM,yBAAyB,SAAS;OAGlD,IAAI;GACF,MAAM,aAAa,KAAK,MAAM,KAAK,MAAM;GACzC,OAAO,YACL,WAAW,MACX,SACA,0BAA0B,QAAQ,aAAa,WAAW,KAAK,EACjE;GACA,OAAO,GAAG,WAAW,OAAO,oCAAoC,SAAS;EAC3E,QAAQ;GAEN,OAAO,GAAG,MAAM,yBAAyB,SAAS;EACpD;CAEJ;AACF;AAEA,IAAa,cAA8B;CACzC,MAAM;CACN,UAAU,CAAC,SAAS;CACpB,KAAK;AACP"}

package/build/esm/tests/search.js

@@ -1,14 +1,18 @@
+import { publishLocalPackage } from "../utils/publish.js";
 import assert from "assert";
 //#region src/tests/search.ts
 async function testSearch(ctx) {
-	const resp = await ctx.adapter.exec({}, "search", "@verdaccio/cli", "--json", ...ctx.adapter.registryArg(ctx.registryUrl));
-	const pkgFind = JSON.parse(resp.stdout).find((item) => item.name === "@verdaccio/cli");
-	assert.ok(pkgFind, "Expected to find @verdaccio/cli in search results");
-	assert.strictEqual(pkgFind.name, "@verdaccio/cli");
+	const pkgName = `verdaccio-search-${ctx.runId}`;
+	await publishLocalPackage(ctx, pkgName, "1.0.0");
+	const { tempFolder } = await ctx.adapter.prepareProject(`search-client-${ctx.runId}`, "1.0.0", ctx.registryUrl, ctx.port, ctx.token);
+	const resp = await ctx.adapter.exec({ cwd: tempFolder }, "search", pkgName, "--json", ...ctx.adapter.registryArg(ctx.registryUrl));
+	const pkgFind = JSON.parse(resp.stdout).find((item) => item.name === pkgName);
+	assert.ok(pkgFind, `Expected to find ${pkgName} in search results`);
+	assert.strictEqual(pkgFind.name, pkgName);
 }
 var searchTest = {
 	name: "search",
-	requires: ["search"],
+	requires: ["search", "publish"],
 	run: testSearch
 };
 //#endregion

package/build/esm/tests/search.js.map

@@ -1 +1 @@
-{"version":3,"file":"search.js","names":[],"sources":["../../../src/tests/search.ts"],"sourcesContent":["import assert from 'assert';\n\nimport { TestContext, TestDefinition } from '../types';\n\nasync function testSearch(ctx: TestContext): Promise<void> {\n  const resp = await ctx.adapter.exec(\n    {},\n    'search',\n    '@verdaccio/cli',\n    '--json',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n  const parsedBody = JSON.parse(resp.stdout);\n  const pkgFind = parsedBody.find((item: any) => item.name === '@verdaccio/cli');\n  assert.ok(pkgFind, 'Expected to find @verdaccio/cli in search results');\n  assert.strictEqual(pkgFind.name, '@verdaccio/cli');\n}\n\nexport const searchTest: TestDefinition = {\n  name: 'search',\n  requires: ['search'],\n  run: testSearch,\n};\n"],"mappings":";;AAIA,eAAe,WAAW,KAAiC;CACzD,MAAM,OAAO,MAAM,IAAI,QAAQ,KAC7B,CAAC,GACD,UACA,kBACA,UACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CAEA,MAAM,UADa,KAAK,MAAM,KAAK,MACnB,CAAA,CAAW,MAAM,SAAc,KAAK,SAAS,gBAAgB;CAC7E,OAAO,GAAG,SAAS,mDAAmD;CACtE,OAAO,YAAY,QAAQ,MAAM,gBAAgB;AACnD;AAEA,IAAa,aAA6B;CACxC,MAAM;CACN,UAAU,CAAC,QAAQ;CACnB,KAAK;AACP"}
+{"version":3,"file":"search.js","names":[],"sources":["../../../src/tests/search.ts"],"sourcesContent":["import assert from 'assert';\n\nimport { TestContext, TestDefinition } from '../types';\nimport { publishLocalPackage } from '../utils/publish';\n\nasync function testSearch(ctx: TestContext): Promise<void> {\n  // Publish the package we search for — searching an npmjs package would need\n  // an uplink and the suite must run offline.\n  const pkgName = `verdaccio-search-${ctx.runId}`;\n  await publishLocalPackage(ctx, pkgName, '1.0.0');\n\n  // Run from a prepared project so its .npmrc (fresh token) shields the test\n  // from stale credentials in the developer's global ~/.npmrc.\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    `search-client-${ctx.runId}`,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token\n  );\n\n  const resp = await ctx.adapter.exec(\n    { cwd: tempFolder },\n    'search',\n    pkgName,\n    '--json',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n  const parsedBody = JSON.parse(resp.stdout);\n  const pkgFind = parsedBody.find((item: any) => item.name === pkgName);\n  assert.ok(pkgFind, `Expected to find ${pkgName} in search results`);\n  assert.strictEqual(pkgFind.name, pkgName);\n}\n\nexport const searchTest: TestDefinition = {\n  name: 'search',\n  requires: ['search', 'publish'],\n  run: testSearch,\n};\n"],"mappings":";;;AAKA,eAAe,WAAW,KAAiC;CAGzD,MAAM,UAAU,oBAAoB,IAAI;CACxC,MAAM,oBAAoB,KAAK,SAAS,OAAO;CAI/C,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,iBAAiB,IAAI,SACrB,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;CAEA,MAAM,OAAO,MAAM,IAAI,QAAQ,KAC7B,EAAE,KAAK,WAAW,GAClB,UACA,SACA,UACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CAEA,MAAM,UADa,KAAK,MAAM,KAAK,MACnB,CAAA,CAAW,MAAM,SAAc,KAAK,SAAS,OAAO;CACpE,OAAO,GAAG,SAAS,oBAAoB,QAAQ,mBAAmB;CAClE,OAAO,YAAY,QAAQ,MAAM,OAAO;AAC1C;AAEA,IAAa,aAA6B;CACxC,MAAM;CACN,UAAU,CAAC,UAAU,SAAS;CAC9B,KAAK;AACP"}

package/build/esm/utils/e2e-config.js

@@ -0,0 +1,58 @@
+//#region src/utils/e2e-config.ts
+/**
+* Recommended Verdaccio config for running the full e2e-cli battery,
+* printed by `verdaccio-e2e --print-config`. It is what the consuming repos'
+* CI jobs and scripts/run-e2e.sh feed to `verdaccio --config`:
+*
+*   - max_body_size raised so scenario:tarballs can publish ~30 MB packages
+*     (Verdaccio's default is 10mb)
+*   - an `e2emock` uplink + `e2e-uplink-*` package pattern wired to the mock
+*     uplink server that scenario:uplink-failure starts on E2E_UPLINK_PORT
+*     (short timeout so the "slow uplink" case completes quickly; high
+*     max_fails so simulated failures don't trip the circuit breaker for
+*     later sub-tests)
+*   - NO npmjs uplink: the whole suite publishes every package it consumes,
+*     so the registry under test never talks to the outside world and the
+*     battery runs fully offline (and deterministically in CI)
+*
+* Relative paths (storage/htpasswd) resolve next to the config file, so write
+* it into a disposable directory.
+*/
+var DEFAULT_UPLINK_PORT = 4874;
+function buildE2EConfig(uplinkPort = DEFAULT_UPLINK_PORT) {
+	return `# Generated by @verdaccio/e2e-cli --print-config
+storage: ./storage
+auth:
+  htpasswd:
+    file: ./htpasswd
+    max_users: 1000
+web:
+  enable: true
+  title: Verdaccio E2E
+max_body_size: 100mb
+uplinks:
+  e2emock:
+    url: http://localhost:${uplinkPort}/
+    timeout: 3s
+    retry: 0
+    max_fails: 100
+    fail_timeout: 1s
+packages:
+  'e2e-uplink-*':
+    access: $all
+    proxy: e2emock
+  '@*/*':
+    access: $all
+    publish: $authenticated
+    unpublish: $authenticated
+  '**':
+    access: $all
+    publish: $authenticated
+    unpublish: $authenticated
+log: { type: stdout, format: pretty, level: warn }
+`;
+}
+//#endregion
+export { DEFAULT_UPLINK_PORT, buildE2EConfig };
+
+//# sourceMappingURL=e2e-config.js.map

package/build/esm/utils/e2e-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2e-config.js","names":[],"sources":["../../../src/utils/e2e-config.ts"],"sourcesContent":["/**\n * Recommended Verdaccio config for running the full e2e-cli battery,\n * printed by `verdaccio-e2e --print-config`. It is what the consuming repos'\n * CI jobs and scripts/run-e2e.sh feed to `verdaccio --config`:\n *\n *   - max_body_size raised so scenario:tarballs can publish ~30 MB packages\n *     (Verdaccio's default is 10mb)\n *   - an `e2emock` uplink + `e2e-uplink-*` package pattern wired to the mock\n *     uplink server that scenario:uplink-failure starts on E2E_UPLINK_PORT\n *     (short timeout so the \"slow uplink\" case completes quickly; high\n *     max_fails so simulated failures don't trip the circuit breaker for\n *     later sub-tests)\n *   - NO npmjs uplink: the whole suite publishes every package it consumes,\n *     so the registry under test never talks to the outside world and the\n *     battery runs fully offline (and deterministically in CI)\n *\n * Relative paths (storage/htpasswd) resolve next to the config file, so write\n * it into a disposable directory.\n */\nexport const DEFAULT_UPLINK_PORT = 4874;\n\nexport function buildE2EConfig(uplinkPort: number = DEFAULT_UPLINK_PORT): string {\n  return `# Generated by @verdaccio/e2e-cli --print-config\nstorage: ./storage\nauth:\n  htpasswd:\n    file: ./htpasswd\n    max_users: 1000\nweb:\n  enable: true\n  title: Verdaccio E2E\nmax_body_size: 100mb\nuplinks:\n  e2emock:\n    url: http://localhost:${uplinkPort}/\n    timeout: 3s\n    retry: 0\n    max_fails: 100\n    fail_timeout: 1s\npackages:\n  'e2e-uplink-*':\n    access: $all\n    proxy: e2emock\n  '@*/*':\n    access: $all\n    publish: $authenticated\n    unpublish: $authenticated\n  '**':\n    access: $all\n    publish: $authenticated\n    unpublish: $authenticated\nlog: { type: stdout, format: pretty, level: warn }\n`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAmBA,IAAa,sBAAsB;AAEnC,SAAgB,eAAe,aAAqB,qBAA6B;CAC/E,OAAO;;;;;;;;;;;;4BAYmB,WAAW;;;;;;;;;;;;;;;;;;;AAmBvC"}

package/build/esm/utils/http-client.js

@@ -0,0 +1,105 @@
+import buildDebug from "debug";
+import { createHash } from "crypto";
+import { get } from "http";
+//#region src/utils/http-client.ts
+var debug = buildDebug("verdaccio:e2e-cli:http-client");
+var ABBREVIATED_ACCEPT = "application/vnd.npm.install-v1+json";
+/**
+* Registry URL for a package name. Scoped names are encoded with the same
+* `%2f` form npm clients use: `@scope%2fname`.
+*/
+function packumentUrl(registryUrl, pkgName) {
+	const encoded = pkgName.startsWith("@") ? pkgName.replaceAll("/", "%2f") : pkgName;
+	return `${registryUrl.replace(/\/$/, "")}/${encoded}`;
+}
+async function fetchPackument(registryUrl, pkgName, options = {}) {
+	const url = packumentUrl(registryUrl, pkgName);
+	const headers = {};
+	if (options.abbreviated) headers["Accept"] = ABBREVIATED_ACCEPT;
+	if (options.etag) headers["If-None-Match"] = options.etag;
+	if (options.token) headers["Authorization"] = `Bearer ${options.token}`;
+	debug("GET %s %o", url, headers);
+	if (options.etag) return new Promise((resolve, reject) => {
+		get(url, { headers }, (response) => {
+			let text = "";
+			response.setEncoding("utf8");
+			response.on("data", (chunk) => text += chunk);
+			response.on("end", () => {
+				let body;
+				try {
+					body = JSON.parse(text);
+				} catch {
+					body = void 0;
+				}
+				const responseHeaders = new Headers();
+				for (const [name, value] of Object.entries(response.headers)) if (value !== void 0) responseHeaders.set(name, Array.isArray(value) ? value.join(", ") : value);
+				resolve({
+					status: response.statusCode || 0,
+					headers: responseHeaders,
+					body
+				});
+			});
+		}).on("error", reject);
+	});
+	const response = await fetch(url, { headers });
+	let body;
+	if (response.status !== 304) {
+		const text = await response.text();
+		try {
+			body = JSON.parse(text);
+		} catch {
+			body = void 0;
+		}
+	}
+	return {
+		status: response.status,
+		headers: response.headers,
+		body
+	};
+}
+/**
+* Download a tarball fully, computing sha1/sha512 integrity on the fly.
+* Rejects with the underlying error when aborted or the connection drops.
+*/
+async function downloadTarball(url, options = {}) {
+	const headers = {};
+	if (options.token) headers["Authorization"] = `Bearer ${options.token}`;
+	debug("GET (tarball) %s", url);
+	const response = await fetch(url, {
+		headers,
+		signal: options.signal
+	});
+	const sha1 = createHash("sha1");
+	const sha512 = createHash("sha512");
+	let bytes = 0;
+	let first = true;
+	if (response.body) for await (const chunk of response.body) {
+		const buf = Buffer.from(chunk);
+		bytes += buf.length;
+		sha1.update(buf);
+		sha512.update(buf);
+		if (first) {
+			first = false;
+			options.onFirstChunk?.();
+		}
+		options.onChunk?.(bytes);
+	}
+	return {
+		status: response.status,
+		headers: response.headers,
+		bytes,
+		sha1: sha1.digest("hex"),
+		integrity: `sha512-${sha512.digest("base64")}`
+	};
+}
+/** Compute npm-style dist values (shasum/integrity) for a buffer. */
+function computeDist(buffer) {
+	return {
+		shasum: createHash("sha1").update(buffer).digest("hex"),
+		integrity: `sha512-${createHash("sha512").update(buffer).digest("base64")}`
+	};
+}
+//#endregion
+export { ABBREVIATED_ACCEPT, computeDist, downloadTarball, fetchPackument, packumentUrl };
+
+//# sourceMappingURL=http-client.js.map

package/build/esm/utils/http-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-client.js","names":[],"sources":["../../../src/utils/http-client.ts"],"sourcesContent":["import { createHash } from 'crypto';\nimport buildDebug from 'debug';\nimport { get } from 'http';\n\nconst debug = buildDebug('verdaccio:e2e-cli:http-client');\n\nexport type PackumentResponse = {\n  status: number;\n  headers: Headers;\n  /** Parsed JSON body, or undefined when the response is not JSON (e.g. 304) */\n  body?: any;\n};\n\nexport type TarballDownload = {\n  status: number;\n  headers: Headers;\n  /** Total bytes received */\n  bytes: number;\n  /** hex-encoded sha1 of the received bytes (matches dist.shasum) */\n  sha1: string;\n  /** `sha512-<base64>` of the received bytes (matches dist.integrity) */\n  integrity: string;\n};\n\nexport type FetchPackumentOptions = {\n  /** Request the abbreviated (install) metadata format */\n  abbreviated?: boolean;\n  /** Send If-None-Match with this value */\n  etag?: string;\n  /** Bearer token */\n  token?: string;\n};\n\nexport const ABBREVIATED_ACCEPT = 'application/vnd.npm.install-v1+json';\n\n/**\n * Registry URL for a package name. Scoped names are encoded with the same\n * `%2f` form npm clients use: `@scope%2fname`.\n */\nexport function packumentUrl(registryUrl: string, pkgName: string): string {\n  const encoded = pkgName.startsWith('@') ? pkgName.replaceAll('/', '%2f') : pkgName;\n  return `${registryUrl.replace(/\\/$/, '')}/${encoded}`;\n}\n\nexport async function fetchPackument(\n  registryUrl: string,\n  pkgName: string,\n  options: FetchPackumentOptions = {}\n): Promise<PackumentResponse> {\n  const url = packumentUrl(registryUrl, pkgName);\n  const headers: Record<string, string> = {};\n  if (options.abbreviated) {\n    headers['Accept'] = ABBREVIATED_ACCEPT;\n  }\n  if (options.etag) {\n    headers['If-None-Match'] = options.etag;\n  }\n  if (options.token) {\n    headers['Authorization'] = `Bearer ${options.token}`;\n  }\n  debug('GET %s %o', url, headers);\n\n  // Conditional requests must bypass fetch(): undici appends\n  // `cache-control: no-cache` whenever If-None-Match is present, which\n  // (correctly, per HTTP semantics) disables the server's 304 revalidation.\n  if (options.etag) {\n    return new Promise((resolve, reject) => {\n      get(url, { headers }, (response) => {\n        let text = '';\n        response.setEncoding('utf8');\n        response.on('data', (chunk) => (text += chunk));\n        response.on('end', () => {\n          let body: any;\n          try {\n            body = JSON.parse(text);\n          } catch {\n            body = undefined;\n          }\n          const responseHeaders = new Headers();\n          for (const [name, value] of Object.entries(response.headers)) {\n            if (value !== undefined) {\n              responseHeaders.set(name, Array.isArray(value) ? value.join(', ') : value);\n            }\n          }\n          resolve({ status: response.statusCode || 0, headers: responseHeaders, body });\n        });\n      }).on('error', reject);\n    });\n  }\n\n  const response = await fetch(url, { headers });\n  let body: any;\n  if (response.status !== 304) {\n    const text = await response.text();\n    try {\n      body = JSON.parse(text);\n    } catch {\n      body = undefined;\n    }\n  }\n  return { status: response.status, headers: response.headers, body };\n}\n\nexport type DownloadTarballOptions = {\n  signal?: AbortSignal;\n  token?: string;\n  /** Called after the first chunk of the body arrives (useful to abort mid-stream) */\n  onFirstChunk?: () => void;\n  /** Called after every chunk with the total bytes received so far (useful to abort at a threshold) */\n  onChunk?: (bytesReceived: number) => void;\n};\n\n/**\n * Download a tarball fully, computing sha1/sha512 integrity on the fly.\n * Rejects with the underlying error when aborted or the connection drops.\n */\nexport async function downloadTarball(\n  url: string,\n  options: DownloadTarballOptions = {}\n): Promise<TarballDownload> {\n  const headers: Record<string, string> = {};\n  if (options.token) {\n    headers['Authorization'] = `Bearer ${options.token}`;\n  }\n  debug('GET (tarball) %s', url);\n  const response = await fetch(url, { headers, signal: options.signal });\n\n  const sha1 = createHash('sha1');\n  const sha512 = createHash('sha512');\n  let bytes = 0;\n  let first = true;\n\n  if (response.body) {\n    for await (const chunk of response.body as any) {\n      const buf = Buffer.from(chunk);\n      bytes += buf.length;\n      sha1.update(buf);\n      sha512.update(buf);\n      if (first) {\n        first = false;\n        options.onFirstChunk?.();\n      }\n      options.onChunk?.(bytes);\n    }\n  }\n\n  return {\n    status: response.status,\n    headers: response.headers,\n    bytes,\n    sha1: sha1.digest('hex'),\n    integrity: `sha512-${sha512.digest('base64')}`,\n  };\n}\n\n/** Compute npm-style dist values (shasum/integrity) for a buffer. */\nexport function computeDist(buffer: Buffer): { shasum: string; integrity: string } {\n  return {\n    shasum: createHash('sha1').update(buffer).digest('hex'),\n    integrity: `sha512-${createHash('sha512').update(buffer).digest('base64')}`,\n  };\n}\n"],"mappings":";;;;AAIA,IAAM,QAAQ,WAAW,+BAA+B;AA6BxD,IAAa,qBAAqB;;;;;AAMlC,SAAgB,aAAa,aAAqB,SAAyB;CACzE,MAAM,UAAU,QAAQ,WAAW,GAAG,IAAI,QAAQ,WAAW,KAAK,KAAK,IAAI;CAC3E,OAAO,GAAG,YAAY,QAAQ,OAAO,EAAE,EAAE,GAAG;AAC9C;AAEA,eAAsB,eACpB,aACA,SACA,UAAiC,CAAC,GACN;CAC5B,MAAM,MAAM,aAAa,aAAa,OAAO;CAC7C,MAAM,UAAkC,CAAC;CACzC,IAAI,QAAQ,aACV,QAAQ,YAAY;CAEtB,IAAI,QAAQ,MACV,QAAQ,mBAAmB,QAAQ;CAErC,IAAI,QAAQ,OACV,QAAQ,mBAAmB,UAAU,QAAQ;CAE/C,MAAM,aAAa,KAAK,OAAO;CAK/B,IAAI,QAAQ,MACV,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,IAAI,KAAK,EAAE,QAAQ,IAAI,aAAa;GAClC,IAAI,OAAO;GACX,SAAS,YAAY,MAAM;GAC3B,SAAS,GAAG,SAAS,UAAW,QAAQ,KAAM;GAC9C,SAAS,GAAG,aAAa;IACvB,IAAI;IACJ,IAAI;KACF,OAAO,KAAK,MAAM,IAAI;IACxB,QAAQ;KACN,OAAO,KAAA;IACT;IACA,MAAM,kBAAkB,IAAI,QAAQ;IACpC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,SAAS,OAAO,GACzD,IAAI,UAAU,KAAA,GACZ,gBAAgB,IAAI,MAAM,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK;IAG7E,QAAQ;KAAE,QAAQ,SAAS,cAAc;KAAG,SAAS;KAAiB;IAAK,CAAC;GAC9E,CAAC;EACH,CAAC,CAAC,CAAC,GAAG,SAAS,MAAM;CACvB,CAAC;CAGH,MAAM,WAAW,MAAM,MAAM,KAAK,EAAE,QAAQ,CAAC;CAC7C,IAAI;CACJ,IAAI,SAAS,WAAW,KAAK;EAC3B,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,IAAI;GACF,OAAO,KAAK,MAAM,IAAI;EACxB,QAAQ;GACN,OAAO,KAAA;EACT;CACF;CACA,OAAO;EAAE,QAAQ,SAAS;EAAQ,SAAS,SAAS;EAAS;CAAK;AACpE;;;;;AAeA,eAAsB,gBACpB,KACA,UAAkC,CAAC,GACT;CAC1B,MAAM,UAAkC,CAAC;CACzC,IAAI,QAAQ,OACV,QAAQ,mBAAmB,UAAU,QAAQ;CAE/C,MAAM,oBAAoB,GAAG;CAC7B,MAAM,WAAW,MAAM,MAAM,KAAK;EAAE;EAAS,QAAQ,QAAQ;CAAO,CAAC;CAErE,MAAM,OAAO,WAAW,MAAM;CAC9B,MAAM,SAAS,WAAW,QAAQ;CAClC,IAAI,QAAQ;CACZ,IAAI,QAAQ;CAEZ,IAAI,SAAS,MACX,WAAW,MAAM,SAAS,SAAS,MAAa;EAC9C,MAAM,MAAM,OAAO,KAAK,KAAK;EAC7B,SAAS,IAAI;EACb,KAAK,OAAO,GAAG;EACf,OAAO,OAAO,GAAG;EACjB,IAAI,OAAO;GACT,QAAQ;GACR,QAAQ,eAAe;EACzB;EACA,QAAQ,UAAU,KAAK;CACzB;CAGF,OAAO;EACL,QAAQ,SAAS;EACjB,SAAS,SAAS;EAClB;EACA,MAAM,KAAK,OAAO,KAAK;EACvB,WAAW,UAAU,OAAO,OAAO,QAAQ;CAC7C;AACF;;AAGA,SAAgB,YAAY,QAAuD;CACjF,OAAO;EACL,QAAQ,WAAW,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,OAAO,KAAK;EACtD,WAAW,UAAU,WAAW,QAAQ,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,OAAO,QAAQ;CAC1E;AACF"}