@verdaccio/e2e-cli 3.0.0 → 3.1.0

package/build/esm/runner.js

@@ -0,0 +1,138 @@
+import { reportSkipped, reportSubTestResult, reportSuiteStart, reportSummary, reportTestResult, reportTestStart } from "./reporter.js";
+import buildDebug from "debug";
+import { URL } from "url";
+//#region src/runner.ts
+var debug = buildDebug("verdaccio:e2e-cli:runner");
+function getPort(registryUrl) {
+	try {
+		const url = new URL(registryUrl);
+		return parseInt(url.port, 10) || (url.protocol === "https:" ? 443 : 80);
+	} catch {
+		return 4873;
+	}
+}
+async function runSingleTest(adapter, test, registryUrl, token, timeout) {
+	const port = getPort(registryUrl);
+	let hasSubTests = false;
+	const subResults = [];
+	const ctx = {
+		registryUrl,
+		token,
+		port,
+		exec: adapter.exec.bind(adapter),
+		adapter,
+		runId: `${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}`,
+		async subTest(label, fn) {
+			hasSubTests = true;
+			const subStart = Date.now();
+			try {
+				await fn();
+				const duration = Date.now() - subStart;
+				subResults.push({
+					label,
+					passed: true,
+					duration
+				});
+				reportSubTestResult(label, true, duration);
+			} catch (err) {
+				const duration = Date.now() - subStart;
+				const error = err instanceof Error ? err.message : String(err);
+				subResults.push({
+					label,
+					passed: false,
+					duration,
+					error
+				});
+				reportSubTestResult(label, false, duration);
+				throw err;
+			}
+		}
+	};
+	const start = Date.now();
+	return new Promise((resolve) => {
+		const timer = setTimeout(() => {
+			resolve({
+				name: test.name,
+				passed: false,
+				duration: Date.now() - start,
+				error: `Test timed out after ${timeout}ms`,
+				hasSubTests,
+				subTests: subResults.length > 0 ? subResults : void 0
+			});
+		}, timeout);
+		test.run(ctx).then(() => {
+			clearTimeout(timer);
+			resolve({
+				name: test.name,
+				passed: true,
+				duration: Date.now() - start,
+				hasSubTests,
+				subTests: subResults.length > 0 ? subResults : void 0
+			});
+		}).catch((err) => {
+			clearTimeout(timer);
+			resolve({
+				name: test.name,
+				passed: false,
+				duration: Date.now() - start,
+				error: err instanceof Error ? err.message : String(err),
+				hasSubTests,
+				subTests: subResults.length > 0 ? subResults : void 0
+			});
+		});
+	});
+}
+async function runSuite(adapter, tests, registryUrl, token, options) {
+	const suiteStart = Date.now();
+	const results = [];
+	let skipped = 0;
+	reportSuiteStart(adapter.name);
+	for (const test of tests) {
+		if (options.testFilter && options.testFilter.length > 0) {
+			if (!options.testFilter.includes(test.name)) continue;
+		}
+		if (test.requires) {
+			if (test.requires.filter((cmd) => !adapter.supports.has(cmd)).length > 0) {
+				reportSkipped(test.name);
+				skipped++;
+				continue;
+			}
+		}
+		if (test.appliesTo && !test.appliesTo(adapter)) {
+			reportSkipped(test.name);
+			skipped++;
+			continue;
+		}
+		reportTestStart(adapter.name, test.name);
+		const result = await runSingleTest(adapter, test, registryUrl, token, Math.max(options.timeout, test.timeout ?? 0));
+		results.push(result);
+		reportTestResult(result, result.hasSubTests);
+	}
+	const passed = results.filter((r) => r.passed).length;
+	const failed = results.filter((r) => !r.passed).length;
+	return {
+		adapter: adapter.name,
+		tests: results,
+		passed,
+		failed,
+		skipped,
+		duration: Date.now() - suiteStart
+	};
+}
+async function runAll(adapters, tests, registryUrl, token, options) {
+	debug("running %d adapters with %d tests", adapters.length, tests.length);
+	const results = [];
+	for (const adapter of adapters) {
+		const result = await runSuite(adapter, tests, registryUrl, token, options);
+		results.push(result);
+	}
+	reportSummary(results);
+	return {
+		results,
+		exitCode: results.reduce((sum, r) => sum + r.failed, 0) > 0 ? 1 : 0
+	};
+}
+//#endregion
+export { runAll, runSuite };
+
+//# sourceMappingURL=runner.js.map

package/build/esm/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","names":[],"sources":["../../src/runner.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { URL } from 'url';\n\nimport {\n  reportSkipped,\n  reportSubTestResult,\n  reportSuiteStart,\n  reportSummary,\n  reportTestResult,\n  reportTestStart,\n} from './reporter';\nimport {\n  PackageManagerAdapter,\n  SubTestResult,\n  SuiteResult,\n  TestContext,\n  TestDefinition,\n  TestResult,\n} from './types';\n\nconst debug = buildDebug('verdaccio:e2e-cli:runner');\n\nfunction getPort(registryUrl: string): number {\n  try {\n    const url = new URL(registryUrl);\n    return parseInt(url.port, 10) || (url.protocol === 'https:' ? 443 : 80);\n  } catch {\n    return 4873;\n  }\n}\n\nasync function runSingleTest(\n  adapter: PackageManagerAdapter,\n  test: TestDefinition,\n  registryUrl: string,\n  token: string,\n  timeout: number\n): Promise<TestResult & { hasSubTests: boolean }> {\n  const port = getPort(registryUrl);\n  let hasSubTests = false;\n  const subResults: SubTestResult[] = [];\n  const ctx: TestContext = {\n    registryUrl,\n    token,\n    port,\n    exec: adapter.exec.bind(adapter),\n    adapter,\n    runId: `${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}`,\n    async subTest(label: string, fn: () => Promise<void>): Promise<void> {\n      hasSubTests = true;\n      const subStart = Date.now();\n      try {\n        await fn();\n        const duration = Date.now() - subStart;\n        subResults.push({ label, passed: true, duration });\n        reportSubTestResult(label, true, duration);\n      } catch (err) {\n        const duration = Date.now() - subStart;\n        const error = err instanceof Error ? err.message : String(err);\n        subResults.push({ label, passed: false, duration, error });\n        reportSubTestResult(label, false, duration);\n        throw err;\n      }\n    },\n  };\n\n  const start = Date.now();\n\n  return new Promise<TestResult & { hasSubTests: boolean }>((resolve) => {\n    const timer = setTimeout(() => {\n      resolve({\n        name: test.name,\n        passed: false,\n        duration: Date.now() - start,\n        error: `Test timed out after ${timeout}ms`,\n        hasSubTests,\n        subTests: subResults.length > 0 ? subResults : undefined,\n      });\n    }, timeout);\n\n    test\n      .run(ctx)\n      .then(() => {\n        clearTimeout(timer);\n        resolve({\n          name: test.name,\n          passed: true,\n          duration: Date.now() - start,\n          hasSubTests,\n          subTests: subResults.length > 0 ? subResults : undefined,\n        });\n      })\n      .catch((err) => {\n        clearTimeout(timer);\n        resolve({\n          name: test.name,\n          passed: false,\n          duration: Date.now() - start,\n          error: err instanceof Error ? err.message : String(err),\n          hasSubTests,\n          subTests: subResults.length > 0 ? subResults : undefined,\n        });\n      });\n  });\n}\n\nexport async function runSuite(\n  adapter: PackageManagerAdapter,\n  tests: TestDefinition[],\n  registryUrl: string,\n  token: string,\n  options: { timeout: number; testFilter?: string[] }\n): Promise<SuiteResult> {\n  const suiteStart = Date.now();\n  const results: TestResult[] = [];\n  let skipped = 0;\n\n  reportSuiteStart(adapter.name);\n\n  for (const test of tests) {\n    // Filter by test name if specified\n    if (options.testFilter && options.testFilter.length > 0) {\n      if (!options.testFilter.includes(test.name)) {\n        continue;\n      }\n    }\n\n    // Check if adapter supports required commands\n    if (test.requires) {\n      const unsupported = test.requires.filter((cmd) => !adapter.supports.has(cmd));\n      if (unsupported.length > 0) {\n        reportSkipped(test.name);\n        skipped++;\n        continue;\n      }\n    }\n\n    // Check adapter/version gate (e.g. pnpm-only tests)\n    if (test.appliesTo && !test.appliesTo(adapter)) {\n      reportSkipped(test.name);\n      skipped++;\n      continue;\n    }\n\n    reportTestStart(adapter.name, test.name);\n    const timeout = Math.max(options.timeout, test.timeout ?? 0);\n    const result = await runSingleTest(adapter, test, registryUrl, token, timeout);\n    results.push(result);\n    reportTestResult(result, result.hasSubTests);\n  }\n\n  const passed = results.filter((r) => r.passed).length;\n  const failed = results.filter((r) => !r.passed).length;\n\n  return {\n    adapter: adapter.name,\n    tests: results,\n    passed,\n    failed,\n    skipped,\n    duration: Date.now() - suiteStart,\n  };\n}\n\nexport async function runAll(\n  adapters: PackageManagerAdapter[],\n  tests: TestDefinition[],\n  registryUrl: string,\n  token: string,\n  options: { timeout: number; concurrency: number; testFilter?: string[] }\n): Promise<{ results: SuiteResult[]; exitCode: number }> {\n  debug('running %d adapters with %d tests', adapters.length, tests.length);\n  const results: SuiteResult[] = [];\n\n  // Run adapters sequentially (each suite is already complex enough)\n  for (const adapter of adapters) {\n    const result = await runSuite(adapter, tests, registryUrl, token, options);\n    results.push(result);\n  }\n\n  reportSummary(results);\n\n  const totalFailed = results.reduce((sum, r) => sum + r.failed, 0);\n  return { results, exitCode: totalFailed > 0 ? 1 : 0 };\n}\n"],"mappings":";;;;AAoBA,IAAM,QAAQ,WAAW,0BAA0B;AAEnD,SAAS,QAAQ,aAA6B;CAC5C,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,WAAW;EAC/B,OAAO,SAAS,IAAI,MAAM,EAAE,MAAM,IAAI,aAAa,WAAW,MAAM;CACtE,QAAQ;EACN,OAAO;CACT;AACF;AAEA,eAAe,cACb,SACA,MACA,aACA,OACA,SACgD;CAChD,MAAM,OAAO,QAAQ,WAAW;CAChC,IAAI,cAAc;CAClB,MAAM,aAA8B,CAAC;CACrC,MAAM,MAAmB;EACvB;EACA;EACA;EACA,MAAM,QAAQ,KAAK,KAAK,OAAO;EAC/B;EACA,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,SAAS,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;EACzE,MAAM,QAAQ,OAAe,IAAwC;GACnE,cAAc;GACd,MAAM,WAAW,KAAK,IAAI;GAC1B,IAAI;IACF,MAAM,GAAG;IACT,MAAM,WAAW,KAAK,IAAI,IAAI;IAC9B,WAAW,KAAK;KAAE;KAAO,QAAQ;KAAM;IAAS,CAAC;IACjD,oBAAoB,OAAO,MAAM,QAAQ;GAC3C,SAAS,KAAK;IACZ,MAAM,WAAW,KAAK,IAAI,IAAI;IAC9B,MAAM,QAAQ,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;IAC7D,WAAW,KAAK;KAAE;KAAO,QAAQ;KAAO;KAAU;IAAM,CAAC;IACzD,oBAAoB,OAAO,OAAO,QAAQ;IAC1C,MAAM;GACR;EACF;CACF;CAEA,MAAM,QAAQ,KAAK,IAAI;CAEvB,OAAO,IAAI,SAAgD,YAAY;EACrE,MAAM,QAAQ,iBAAiB;GAC7B,QAAQ;IACN,MAAM,KAAK;IACX,QAAQ;IACR,UAAU,KAAK,IAAI,IAAI;IACvB,OAAO,wBAAwB,QAAQ;IACvC;IACA,UAAU,WAAW,SAAS,IAAI,aAAa,KAAA;GACjD,CAAC;EACH,GAAG,OAAO;EAEV,KACG,IAAI,GAAG,CAAC,CACR,WAAW;GACV,aAAa,KAAK;GAClB,QAAQ;IACN,MAAM,KAAK;IACX,QAAQ;IACR,UAAU,KAAK,IAAI,IAAI;IACvB;IACA,UAAU,WAAW,SAAS,IAAI,aAAa,KAAA;GACjD,CAAC;EACH,CAAC,CAAC,CACD,OAAO,QAAQ;GACd,aAAa,KAAK;GAClB,QAAQ;IACN,MAAM,KAAK;IACX,QAAQ;IACR,UAAU,KAAK,IAAI,IAAI;IACvB,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;IACtD;IACA,UAAU,WAAW,SAAS,IAAI,aAAa,KAAA;GACjD,CAAC;EACH,CAAC;CACL,CAAC;AACH;AAEA,eAAsB,SACpB,SACA,OACA,aACA,OACA,SACsB;CACtB,MAAM,aAAa,KAAK,IAAI;CAC5B,MAAM,UAAwB,CAAC;CAC/B,IAAI,UAAU;CAEd,iBAAiB,QAAQ,IAAI;CAE7B,KAAK,MAAM,QAAQ,OAAO;EAExB,IAAI,QAAQ,cAAc,QAAQ,WAAW,SAAS,GAChD;OAAA,CAAC,QAAQ,WAAW,SAAS,KAAK,IAAI,GACxC;EAAA;EAKJ,IAAI,KAAK,UACa;OAAA,KAAK,SAAS,QAAQ,QAAQ,CAAC,QAAQ,SAAS,IAAI,GAAG,CACvE,CAAA,CAAY,SAAS,GAAG;IAC1B,cAAc,KAAK,IAAI;IACvB;IACA;GACF;;EAIF,IAAI,KAAK,aAAa,CAAC,KAAK,UAAU,OAAO,GAAG;GAC9C,cAAc,KAAK,IAAI;GACvB;GACA;EACF;EAEA,gBAAgB,QAAQ,MAAM,KAAK,IAAI;EAEvC,MAAM,SAAS,MAAM,cAAc,SAAS,MAAM,aAAa,OAD/C,KAAK,IAAI,QAAQ,SAAS,KAAK,WAAW,CACY,CAAO;EAC7E,QAAQ,KAAK,MAAM;EACnB,iBAAiB,QAAQ,OAAO,WAAW;CAC7C;CAEA,MAAM,SAAS,QAAQ,QAAQ,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/C,MAAM,SAAS,QAAQ,QAAQ,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;CAEhD,OAAO;EACL,SAAS,QAAQ;EACjB,OAAO;EACP;EACA;EACA;EACA,UAAU,KAAK,IAAI,IAAI;CACzB;AACF;AAEA,eAAsB,OACpB,UACA,OACA,aACA,OACA,SACuD;CACvD,MAAM,qCAAqC,SAAS,QAAQ,MAAM,MAAM;CACxE,MAAM,UAAyB,CAAC;CAGhC,KAAK,MAAM,WAAW,UAAU;EAC9B,MAAM,SAAS,MAAM,SAAS,SAAS,OAAO,aAAa,OAAO,OAAO;EACzE,QAAQ,KAAK,MAAM;CACrB;CAEA,cAAc,OAAO;CAGrB,OAAO;EAAE;EAAS,UADE,QAAQ,QAAQ,KAAK,MAAM,MAAM,EAAE,QAAQ,CACnC,IAAc,IAAI,IAAI;CAAE;AACtD"}

package/build/esm/scenarios/index.js

@@ -0,0 +1,19 @@
+import { installMultipleDepsScenario } from "./install-multiple-deps.js";
+import { metadataScenario } from "./metadata.js";
+import { minimumReleaseAgeScenario } from "./minimum-release-age.js";
+import { searchScenario } from "./search.js";
+import { tarballsScenario } from "./tarballs.js";
+import { uplinkFailureScenario } from "./uplink-failure.js";
+//#region src/scenarios/index.ts
+var allScenarios = [
+	installMultipleDepsScenario,
+	minimumReleaseAgeScenario,
+	tarballsScenario,
+	metadataScenario,
+	searchScenario,
+	uplinkFailureScenario
+];
+//#endregion
+export { allScenarios, installMultipleDepsScenario, metadataScenario, minimumReleaseAgeScenario, searchScenario, tarballsScenario, uplinkFailureScenario };
+
+//# sourceMappingURL=index.js.map

package/build/esm/scenarios/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../../src/scenarios/index.ts"],"sourcesContent":["import { TestDefinition } from '../types';\nimport { installMultipleDepsScenario } from './install-multiple-deps';\nimport { metadataScenario } from './metadata';\nimport { minimumReleaseAgeScenario } from './minimum-release-age';\nimport { searchScenario } from './search';\nimport { tarballsScenario } from './tarballs';\nimport { uplinkFailureScenario } from './uplink-failure';\n\nexport const allScenarios: TestDefinition[] = [\n  installMultipleDepsScenario,\n  minimumReleaseAgeScenario,\n  tarballsScenario,\n  metadataScenario,\n  searchScenario,\n  uplinkFailureScenario,\n];\n\nexport {\n  installMultipleDepsScenario,\n  minimumReleaseAgeScenario,\n  searchScenario,\n  tarballsScenario,\n  metadataScenario,\n  uplinkFailureScenario,\n};\n"],"mappings":";;;;;;;AAQA,IAAa,eAAiC;CAC5C;CACA;CACA;CACA;CACA;CACA;AACF"}

package/build/esm/scenarios/install-multiple-deps.js

@@ -0,0 +1,117 @@
+import { trace } from "../utils/process.js";
+import { normalizeInfo } from "../utils/info.js";
+import { join } from "path";
+import { readFile } from "fs/promises";
+import assert from "assert";
+//#region src/scenarios/install-multiple-deps.ts
+/**
+* Scenario: install-multiple-deps
+*
+* Publishes several packages to the registry (some scoped, some unscoped,
+* some with inter-dependencies), then creates a consumer project that
+* depends on all of them and runs `install`.
+*
+* This exercises the registry under realistic load:
+*   - many parallel tarball downloads
+*   - metadata resolution for multiple packages
+*   - scoped-package authentication
+*   - transitive dependency resolution
+*/
+var SEED_PACKAGES_COUNT = 5;
+/**
+* Parse `info --json` output across all adapters.
+*/
+function parseInfoOutput(stdout) {
+	return normalizeInfo(JSON.parse(stdout));
+}
+async function publishSeedPackage(ctx, pkgName, version, dependencies = {}) {
+	trace("publishing seed package %s@%s", pkgName, version);
+	const { tempFolder } = await ctx.adapter.prepareProject(pkgName, version, ctx.registryUrl, ctx.port, ctx.token, dependencies);
+	if (ctx.adapter.type === "yarn-modern") await ctx.adapter.exec({ cwd: tempFolder }, "install");
+	await ctx.adapter.exec({ cwd: tempFolder }, "publish", ...ctx.adapter.registryArg(ctx.registryUrl));
+	trace("published %s@%s", pkgName, version);
+}
+async function testInstallMultipleDeps(ctx) {
+	const id = ctx.runId;
+	let projectCwd = "";
+	await ctx.subTest("publish seed packages", async () => {
+		for (let i = 1; i <= SEED_PACKAGES_COUNT; i++) await publishSeedPackage(ctx, `@verdaccio/seed-${id}-${i}`, "1.0.0");
+		const sharedPkg = `@verdaccio/seed-shared-${id}`;
+		await publishSeedPackage(ctx, sharedPkg, "1.0.0");
+		await publishSeedPackage(ctx, `@verdaccio/seed-mid-${id}`, "1.0.0", {
+			[`@verdaccio/seed-${id}-1`]: "1.0.0",
+			[`@verdaccio/seed-${id}-2`]: "1.0.0",
+			[sharedPkg]: "1.0.0"
+		});
+		trace("all seed packages published");
+	});
+	await ctx.subTest("install all dependencies in consumer project", async () => {
+		const consumerDeps = {};
+		for (let i = 1; i <= SEED_PACKAGES_COUNT; i++) consumerDeps[`@verdaccio/seed-${id}-${i}`] = "1.0.0";
+		consumerDeps[`@verdaccio/seed-mid-${id}`] = "1.0.0";
+		consumerDeps[`@verdaccio/seed-shared-${id}`] = "1.0.0";
+		const consumerName = `@verdaccio/consumer-${id}`;
+		const { tempFolder } = await ctx.adapter.prepareProject(consumerName, "1.0.0", ctx.registryUrl, ctx.port, ctx.token, consumerDeps);
+		projectCwd = tempFolder;
+		trace("installing %d dependencies in consumer project", Object.keys(consumerDeps).length);
+		const args = ["install", ...ctx.adapter.registryArg(ctx.registryUrl)];
+		await ctx.adapter.exec({ cwd: tempFolder }, ...args);
+		trace("install completed for consumer project");
+	});
+	await ctx.subTest("verify installed packages", async () => {
+		for (let i = 1; i <= SEED_PACKAGES_COUNT; i++) {
+			const name = `@verdaccio/seed-${id}-${i}`;
+			const info = parseInfoOutput((await ctx.adapter.exec({ cwd: projectCwd }, "info", name, "--json", ...ctx.adapter.registryArg(ctx.registryUrl))).stdout);
+			assert.strictEqual(info.name, name, `Expected package name "${name}"`);
+			assert.strictEqual(info.version, "1.0.0", `Expected version 1.0.0 for ${name}`);
+		}
+		const midName = `@verdaccio/seed-mid-${id}`;
+		const midInfo = parseInfoOutput((await ctx.adapter.exec({ cwd: projectCwd }, "info", midName, "--json", ...ctx.adapter.registryArg(ctx.registryUrl))).stdout);
+		assert.strictEqual(midInfo.name, midName);
+		const deps = midInfo.dependencies || {};
+		assert.strictEqual(deps[`@verdaccio/seed-${id}-1`], "1.0.0", "Intermediate should depend on seed-1");
+		assert.strictEqual(deps[`@verdaccio/seed-${id}-2`], "1.0.0", "Intermediate should depend on seed-2");
+		assert.strictEqual(deps[`@verdaccio/seed-shared-${id}`], "1.0.0", "Intermediate should depend on shared");
+		trace("all packages verified");
+	});
+	await ctx.subTest("update and re-install", async () => {
+		const leafName = `@verdaccio/seed-${id}-1`;
+		await publishSeedPackage(ctx, leafName, "2.0.0");
+		const sharedName = `@verdaccio/seed-shared-${id}`;
+		await publishSeedPackage(ctx, sharedName, "2.0.0");
+		const consumerDeps = {
+			[leafName]: "^1.0.0",
+			[sharedName]: "^1.0.0"
+		};
+		const consumerName = `@verdaccio/consumer-update-${id}`;
+		const { tempFolder } = await ctx.adapter.prepareProject(consumerName, "1.0.0", ctx.registryUrl, ctx.port, ctx.token, consumerDeps);
+		await ctx.adapter.exec({ cwd: tempFolder }, "install", ...ctx.adapter.registryArg(ctx.registryUrl));
+		if ([
+			"npm",
+			"pnpm",
+			"bun"
+		].includes(ctx.adapter.type)) for (const name of [leafName, sharedName]) {
+			const manifestPath = join(tempFolder, "node_modules", name, "package.json");
+			const installed = JSON.parse(await readFile(manifestPath, "utf8"));
+			trace("on disk: %s@%s (%s)", installed.name, installed.version, manifestPath);
+			assert.strictEqual(installed.version, "1.0.0", `Expected ${name}@1.0.0 installed for range ^1.0.0 (latest is 2.0.0), got ${installed.version}`);
+		}
+		const leafInfo = parseInfoOutput((await ctx.adapter.exec({ cwd: tempFolder }, "info", leafName, "--json", ...ctx.adapter.registryArg(ctx.registryUrl))).stdout);
+		trace("registry info for %s: version=%s dist-tags=%j", leafName, leafInfo.version, leafInfo["dist-tags"]);
+		assert.strictEqual(leafInfo["dist-tags"]?.latest ?? leafInfo.version, "2.0.0", `Expected latest version of ${leafName} to be 2.0.0`);
+		trace("update and re-install verified");
+	});
+}
+var installMultipleDepsScenario = {
+	name: "scenario:install-multiple-deps",
+	requires: [
+		"publish",
+		"install",
+		"info"
+	],
+	run: testInstallMultipleDeps
+};
+//#endregion
+export { installMultipleDepsScenario };
+
+//# sourceMappingURL=install-multiple-deps.js.map

package/build/esm/scenarios/install-multiple-deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-multiple-deps.js","names":[],"sources":["../../../src/scenarios/install-multiple-deps.ts"],"sourcesContent":["import assert from 'assert';\nimport { readFile } from 'fs/promises';\nimport { join } from 'path';\n\nimport { TestContext, TestDefinition } from '../types';\nimport { normalizeInfo } from '../utils/info';\nimport { trace } from '../utils/process';\n\n/**\n * Scenario: install-multiple-deps\n *\n * Publishes several packages to the registry (some scoped, some unscoped,\n * some with inter-dependencies), then creates a consumer project that\n * depends on all of them and runs `install`.\n *\n * This exercises the registry under realistic load:\n *   - many parallel tarball downloads\n *   - metadata resolution for multiple packages\n *   - scoped-package authentication\n *   - transitive dependency resolution\n */\n\nconst SEED_PACKAGES_COUNT = 5;\n\n/**\n * Parse `info --json` output across all adapters.\n */\nfunction parseInfoOutput(stdout: string): any {\n  return normalizeInfo(JSON.parse(stdout));\n}\n\nasync function publishSeedPackage(\n  ctx: TestContext,\n  pkgName: string,\n  version: string,\n  dependencies: Record<string, string> = {}\n): Promise<void> {\n  trace('publishing seed package %s@%s', pkgName, version);\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    pkgName,\n    version,\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token,\n    dependencies\n  );\n\n  if (ctx.adapter.type === 'yarn-modern') {\n    await ctx.adapter.exec({ cwd: tempFolder }, 'install');\n  }\n\n  await ctx.adapter.exec(\n    { cwd: tempFolder },\n    'publish',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n  trace('published %s@%s', pkgName, version);\n}\n\nasync function testInstallMultipleDeps(ctx: TestContext): Promise<void> {\n  const id = ctx.runId;\n\n  // Shared project folder used as cwd for info commands across subtests.\n  // Yarn modern requires a project context (package.json + .yarnrc.yml) for `yarn npm info`.\n  let projectCwd = '';\n\n  // --- Phase 1: Publish a tree of seed packages ---\n  await ctx.subTest('publish seed packages', async () => {\n    // Leaf packages (no dependencies of their own)\n    for (let i = 1; i <= SEED_PACKAGES_COUNT; i++) {\n      const name = `@verdaccio/seed-${id}-${i}`;\n      await publishSeedPackage(ctx, name, '1.0.0');\n    }\n\n    // A \"shared\" package that multiple consumers will pull in\n    const sharedPkg = `@verdaccio/seed-shared-${id}`;\n    await publishSeedPackage(ctx, sharedPkg, '1.0.0');\n\n    // An intermediate package that depends on some leaf packages + shared\n    const intermediatePkg = `@verdaccio/seed-mid-${id}`;\n    await publishSeedPackage(ctx, intermediatePkg, '1.0.0', {\n      [`@verdaccio/seed-${id}-1`]: '1.0.0',\n      [`@verdaccio/seed-${id}-2`]: '1.0.0',\n      [sharedPkg]: '1.0.0',\n    });\n\n    trace('all seed packages published');\n  });\n\n  // --- Phase 2: Create a consumer project that depends on everything ---\n  await ctx.subTest('install all dependencies in consumer project', async () => {\n    const consumerDeps: Record<string, string> = {};\n\n    // Direct deps on all leaf packages\n    for (let i = 1; i <= SEED_PACKAGES_COUNT; i++) {\n      consumerDeps[`@verdaccio/seed-${id}-${i}`] = '1.0.0';\n    }\n\n    // Also depend on the intermediate (pulls in transitive deps)\n    consumerDeps[`@verdaccio/seed-mid-${id}`] = '1.0.0';\n\n    // And the shared package directly (already a transitive dep of mid)\n    consumerDeps[`@verdaccio/seed-shared-${id}`] = '1.0.0';\n\n    const consumerName = `@verdaccio/consumer-${id}`;\n    const { tempFolder } = await ctx.adapter.prepareProject(\n      consumerName,\n      '1.0.0',\n      ctx.registryUrl,\n      ctx.port,\n      ctx.token,\n      consumerDeps\n    );\n\n    projectCwd = tempFolder;\n\n    trace('installing %d dependencies in consumer project', Object.keys(consumerDeps).length);\n\n    const args = ['install', ...ctx.adapter.registryArg(ctx.registryUrl)];\n    await ctx.adapter.exec({ cwd: tempFolder }, ...args);\n\n    trace('install completed for consumer project');\n  });\n\n  // --- Phase 3: Verify all packages resolved correctly ---\n  await ctx.subTest('verify installed packages', async () => {\n    // Check that each seed package is retrievable via `info`\n    for (let i = 1; i <= SEED_PACKAGES_COUNT; i++) {\n      const name = `@verdaccio/seed-${id}-${i}`;\n      const resp = await ctx.adapter.exec(\n        { cwd: projectCwd },\n        'info',\n        name,\n        '--json',\n        ...ctx.adapter.registryArg(ctx.registryUrl)\n      );\n      const info = parseInfoOutput(resp.stdout);\n      assert.strictEqual(info.name, name, `Expected package name \"${name}\"`);\n      assert.strictEqual(info.version, '1.0.0', `Expected version 1.0.0 for ${name}`);\n    }\n\n    // Verify intermediate package has correct dependencies in registry metadata\n    const midName = `@verdaccio/seed-mid-${id}`;\n    const resp = await ctx.adapter.exec(\n      { cwd: projectCwd },\n      'info',\n      midName,\n      '--json',\n      ...ctx.adapter.registryArg(ctx.registryUrl)\n    );\n    const midInfo = parseInfoOutput(resp.stdout);\n    assert.strictEqual(midInfo.name, midName);\n\n    const deps = midInfo.dependencies || {};\n    assert.strictEqual(\n      deps[`@verdaccio/seed-${id}-1`],\n      '1.0.0',\n      'Intermediate should depend on seed-1'\n    );\n    assert.strictEqual(\n      deps[`@verdaccio/seed-${id}-2`],\n      '1.0.0',\n      'Intermediate should depend on seed-2'\n    );\n    assert.strictEqual(\n      deps[`@verdaccio/seed-shared-${id}`],\n      '1.0.0',\n      'Intermediate should depend on shared'\n    );\n\n    trace('all packages verified');\n  });\n\n  // --- Phase 4: Publish updated versions and re-install ---\n  await ctx.subTest('update and re-install', async () => {\n    // Publish v2 of a leaf and the shared package\n    const leafName = `@verdaccio/seed-${id}-1`;\n    await publishSeedPackage(ctx, leafName, '2.0.0');\n\n    const sharedName = `@verdaccio/seed-shared-${id}`;\n    await publishSeedPackage(ctx, sharedName, '2.0.0');\n\n    // Create a new consumer that uses ^1.0.0 ranges. With 2.0.0 published,\n    // the range must still resolve to 1.0.0 (^1.0.0 excludes 2.x) even though\n    // dist-tags.latest now points at 2.0.0 — this catches registries that\n    // serve range resolution from `latest` instead of the full version list.\n    const consumerDeps: Record<string, string> = {\n      [leafName]: '^1.0.0',\n      [sharedName]: '^1.0.0',\n    };\n\n    const consumerName = `@verdaccio/consumer-update-${id}`;\n    const { tempFolder } = await ctx.adapter.prepareProject(\n      consumerName,\n      '1.0.0',\n      ctx.registryUrl,\n      ctx.port,\n      ctx.token,\n      consumerDeps\n    );\n\n    await ctx.adapter.exec(\n      { cwd: tempFolder },\n      'install',\n      ...ctx.adapter.registryArg(ctx.registryUrl)\n    );\n\n    // Verify what actually landed on disk, not just the registry metadata.\n    // yarn-modern uses PnP (no node_modules), so the on-disk check applies to\n    // the linkers that materialize it.\n    if (['npm', 'pnpm', 'bun'].includes(ctx.adapter.type)) {\n      for (const name of [leafName, sharedName]) {\n        const manifestPath = join(tempFolder, 'node_modules', name, 'package.json');\n        const installed = JSON.parse(await readFile(manifestPath, 'utf8'));\n        trace('on disk: %s@%s (%s)', installed.name, installed.version, manifestPath);\n        assert.strictEqual(\n          installed.version,\n          '1.0.0',\n          `Expected ${name}@1.0.0 installed for range ^1.0.0 (latest is 2.0.0), ` +\n            `got ${installed.version}`\n        );\n      }\n    }\n\n    // Verify that the registry now serves both versions\n    const leafResp = await ctx.adapter.exec(\n      { cwd: tempFolder },\n      'info',\n      leafName,\n      '--json',\n      ...ctx.adapter.registryArg(ctx.registryUrl)\n    );\n    const leafInfo = parseInfoOutput(leafResp.stdout);\n    trace(\n      'registry info for %s: version=%s dist-tags=%j',\n      leafName,\n      leafInfo.version,\n      leafInfo['dist-tags']\n    );\n\n    // dist-tags.latest should be 2.0.0\n    assert.strictEqual(\n      leafInfo['dist-tags']?.latest ?? leafInfo.version,\n      '2.0.0',\n      `Expected latest version of ${leafName} to be 2.0.0`\n    );\n\n    trace('update and re-install verified');\n  });\n}\n\nexport const installMultipleDepsScenario: TestDefinition = {\n  name: 'scenario:install-multiple-deps',\n  requires: ['publish', 'install', 'info'],\n  run: testInstallMultipleDeps,\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAsBA,IAAM,sBAAsB;;;;AAK5B,SAAS,gBAAgB,QAAqB;CAC5C,OAAO,cAAc,KAAK,MAAM,MAAM,CAAC;AACzC;AAEA,eAAe,mBACb,KACA,SACA,SACA,eAAuC,CAAC,GACzB;CACf,MAAM,iCAAiC,SAAS,OAAO;CACvD,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,SACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,OACJ,YACF;CAEA,IAAI,IAAI,QAAQ,SAAS,eACvB,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,WAAW,GAAG,SAAS;CAGvD,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CACA,MAAM,mBAAmB,SAAS,OAAO;AAC3C;AAEA,eAAe,wBAAwB,KAAiC;CACtE,MAAM,KAAK,IAAI;CAIf,IAAI,aAAa;CAGjB,MAAM,IAAI,QAAQ,yBAAyB,YAAY;EAErD,KAAK,IAAI,IAAI,GAAG,KAAK,qBAAqB,KAExC,MAAM,mBAAmB,KAAK,mBADE,GAAG,GAAG,KACF,OAAO;EAI7C,MAAM,YAAY,0BAA0B;EAC5C,MAAM,mBAAmB,KAAK,WAAW,OAAO;EAIhD,MAAM,mBAAmB,KAAK,uBADiB,MACA,SAAS;IACrD,mBAAmB,GAAG,MAAM;IAC5B,mBAAmB,GAAG,MAAM;IAC5B,YAAY;EACf,CAAC;EAED,MAAM,6BAA6B;CACrC,CAAC;CAGD,MAAM,IAAI,QAAQ,gDAAgD,YAAY;EAC5E,MAAM,eAAuC,CAAC;EAG9C,KAAK,IAAI,IAAI,GAAG,KAAK,qBAAqB,KACxC,aAAa,mBAAmB,GAAG,GAAG,OAAO;EAI/C,aAAa,uBAAuB,QAAQ;EAG5C,aAAa,0BAA0B,QAAQ;EAE/C,MAAM,eAAe,uBAAuB;EAC5C,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,cACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,OACJ,YACF;EAEA,aAAa;EAEb,MAAM,kDAAkD,OAAO,KAAK,YAAY,CAAC,CAAC,MAAM;EAExF,MAAM,OAAO,CAAC,WAAW,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAAC;EACpE,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,WAAW,GAAG,GAAG,IAAI;EAEnD,MAAM,wCAAwC;CAChD,CAAC;CAGD,MAAM,IAAI,QAAQ,6BAA6B,YAAY;EAEzD,KAAK,IAAI,IAAI,GAAG,KAAK,qBAAqB,KAAK;GAC7C,MAAM,OAAO,mBAAmB,GAAG,GAAG;GAQtC,MAAM,OAAO,iBAAgB,MAPV,IAAI,QAAQ,KAC7B,EAAE,KAAK,WAAW,GAClB,QACA,MACA,UACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C,EAAA,CACkC,MAAM;GACxC,OAAO,YAAY,KAAK,MAAM,MAAM,0BAA0B,KAAK,EAAE;GACrE,OAAO,YAAY,KAAK,SAAS,SAAS,8BAA8B,MAAM;EAChF;EAGA,MAAM,UAAU,uBAAuB;EAQvC,MAAM,UAAU,iBAAgB,MAPb,IAAI,QAAQ,KAC7B,EAAE,KAAK,WAAW,GAClB,QACA,SACA,UACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C,EAAA,CACqC,MAAM;EAC3C,OAAO,YAAY,QAAQ,MAAM,OAAO;EAExC,MAAM,OAAO,QAAQ,gBAAgB,CAAC;EACtC,OAAO,YACL,KAAK,mBAAmB,GAAG,MAC3B,SACA,sCACF;EACA,OAAO,YACL,KAAK,mBAAmB,GAAG,MAC3B,SACA,sCACF;EACA,OAAO,YACL,KAAK,0BAA0B,OAC/B,SACA,sCACF;EAEA,MAAM,uBAAuB;CAC/B,CAAC;CAGD,MAAM,IAAI,QAAQ,yBAAyB,YAAY;EAErD,MAAM,WAAW,mBAAmB,GAAG;EACvC,MAAM,mBAAmB,KAAK,UAAU,OAAO;EAE/C,MAAM,aAAa,0BAA0B;EAC7C,MAAM,mBAAmB,KAAK,YAAY,OAAO;EAMjD,MAAM,eAAuC;IAC1C,WAAW;IACX,aAAa;EAChB;EAEA,MAAM,eAAe,8BAA8B;EACnD,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,cACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,OACJ,YACF;EAEA,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EAKA,IAAI;GAAC;GAAO;GAAQ;EAAK,CAAC,CAAC,SAAS,IAAI,QAAQ,IAAI,GAClD,KAAK,MAAM,QAAQ,CAAC,UAAU,UAAU,GAAG;GACzC,MAAM,eAAe,KAAK,YAAY,gBAAgB,MAAM,cAAc;GAC1E,MAAM,YAAY,KAAK,MAAM,MAAM,SAAS,cAAc,MAAM,CAAC;GACjE,MAAM,uBAAuB,UAAU,MAAM,UAAU,SAAS,YAAY;GAC5E,OAAO,YACL,UAAU,SACV,SACA,YAAY,KAAK,2DACR,UAAU,SACrB;EACF;EAWF,MAAM,WAAW,iBAAgB,MAPV,IAAI,QAAQ,KACjC,EAAE,KAAK,WAAW,GAClB,QACA,UACA,UACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C,EAAA,CAC0C,MAAM;EAChD,MACE,iDACA,UACA,SAAS,SACT,SAAS,YACX;EAGA,OAAO,YACL,SAAS,YAAY,EAAE,UAAU,SAAS,SAC1C,SACA,8BAA8B,SAAS,aACzC;EAEA,MAAM,gCAAgC;CACxC,CAAC;AACH;AAEA,IAAa,8BAA8C;CACzD,MAAM;CACN,UAAU;EAAC;EAAW;EAAW;CAAM;CACvC,KAAK;AACP"}

package/build/esm/scenarios/metadata.js

@@ -0,0 +1,119 @@
+import { trace } from "../utils/process.js";
+import { downloadTarball, fetchPackument } from "../utils/http-client.js";
+import assert from "assert";
+//#region src/scenarios/metadata.ts
+/**
+* Scenario: metadata
+*
+* HTTP-level battery for the packument (package metadata) endpoints:
+*
+*   - full packument shape: versions, dist-tags, readme, time
+*   - abbreviated metadata (Accept: application/vnd.npm.install-v1+json)
+*   - ETag + If-None-Match revalidation → 304 (required by Yarn Berry)
+*   - dist.tarball URLs rewritten to the registry host and downloadable
+*   - scoped packages via the `%2f`-encoded URL form
+*   - 404 body shape for unknown packages
+*   - coherence after mutations (new version published, version unpublished)
+*
+* Protocol-level and package-manager-agnostic, so it is gated to the npm
+* adapter to run once per suite.
+*/
+async function publishVersion(ctx, pkgName, version) {
+	const { tempFolder } = await ctx.adapter.prepareProject(pkgName, version, ctx.registryUrl, ctx.port, ctx.token);
+	await ctx.adapter.exec({ cwd: tempFolder }, "publish", ...ctx.adapter.registryArg(ctx.registryUrl));
+	trace("published %s@%s", pkgName, version);
+	return tempFolder;
+}
+async function testMetadata(ctx) {
+	const id = ctx.runId;
+	const pkg = `e2e-metadata-${id}`;
+	let projectFolder = "";
+	await ctx.subTest("publish two versions", async () => {
+		await publishVersion(ctx, pkg, "1.0.0");
+		projectFolder = await publishVersion(ctx, pkg, "1.1.0");
+	});
+	await ctx.subTest("full packument has versions, dist-tags, readme and time", async () => {
+		const { status, body } = await fetchPackument(ctx.registryUrl, pkg);
+		trace("full packument → %d | keys=%j dist-tags=%j versions=%j", status, Object.keys(body ?? {}), body?.["dist-tags"], Object.keys(body?.versions ?? {}));
+		assert.strictEqual(status, 200, "Expected 200 for full packument");
+		assert.strictEqual(body.name, pkg, "Packument name mismatch");
+		assert.ok(body.versions["1.0.0"], "Expected version 1.0.0 in packument");
+		assert.ok(body.versions["1.1.0"], "Expected version 1.1.0 in packument");
+		assert.strictEqual(body["dist-tags"].latest, "1.1.0", "Expected latest dist-tag → 1.1.0");
+		assert.ok(body.readme, "Expected readme in full packument");
+		assert.ok(body.time?.["1.0.0"], "Expected time entry for 1.0.0");
+		assert.ok(body.time?.["1.1.0"], "Expected time entry for 1.1.0");
+	});
+	await ctx.subTest("abbreviated metadata (install-v1) is served", async () => {
+		const { status, body } = await fetchPackument(ctx.registryUrl, pkg, { abbreviated: true });
+		trace("abbreviated packument → %d | keys=%j", status, Object.keys(body ?? {}));
+		assert.strictEqual(status, 200, "Expected 200 for abbreviated packument");
+		assert.ok(body.versions["1.1.0"], "Expected versions in abbreviated metadata");
+		assert.ok(body["dist-tags"], "Expected dist-tags in abbreviated metadata");
+		assert.strictEqual(body.readme, void 0, "Abbreviated metadata must not include the readme");
+		assert.strictEqual(body._id, void 0, "Abbreviated metadata must not include _id");
+		assert.strictEqual(body._rev, void 0, "Abbreviated metadata must not include _rev");
+		assert.strictEqual(body.readmeFilename, void 0, "Abbreviated metadata must not include readmeFilename");
+		assert.ok(body.modified, "Expected \"modified\" field in abbreviated metadata");
+	});
+	await ctx.subTest("ETag + If-None-Match revalidation returns 304", async () => {
+		const etag = (await fetchPackument(ctx.registryUrl, pkg)).headers.get("etag");
+		trace("etag on first response: %s", etag);
+		assert.ok(etag, "Expected an ETag header on the packument response");
+		const revalidated = await fetchPackument(ctx.registryUrl, pkg, { etag });
+		trace("revalidation with If-None-Match → %d", revalidated.status);
+		assert.strictEqual(revalidated.status, 304, `Expected 304 with If-None-Match: ${etag}, got ${revalidated.status}`);
+	});
+	await ctx.subTest("ETag changes after a new version is published", async () => {
+		const staleEtag = (await fetchPackument(ctx.registryUrl, pkg)).headers.get("etag");
+		assert.ok(staleEtag, "Expected an ETag before publishing");
+		await publishVersion(ctx, pkg, "1.2.0");
+		const after = await fetchPackument(ctx.registryUrl, pkg, { etag: staleEtag });
+		trace("stale etag %s → %d | fresh etag %s", staleEtag, after.status, after.headers.get("etag"));
+		assert.strictEqual(after.status, 200, `Expected 200 with the stale ETag after publishing 1.2.0, got ${after.status}`);
+		assert.ok(after.body?.versions?.["1.2.0"], "Expected 1.2.0 in the revalidated packument");
+		const freshEtag = after.headers.get("etag");
+		assert.ok(freshEtag, "Expected an ETag on the fresh packument");
+		assert.notStrictEqual(freshEtag, staleEtag, "ETag did not change after a publish");
+	});
+	await ctx.subTest("dist.tarball points at this registry and is downloadable", async () => {
+		const { body } = await fetchPackument(ctx.registryUrl, pkg);
+		const tarball = body.versions["1.1.0"].dist.tarball;
+		assert.ok(tarball.startsWith(ctx.registryUrl), `Expected dist.tarball to be rewritten to ${ctx.registryUrl}, got ${tarball}`);
+		const download = await downloadTarball(tarball);
+		trace("tarball %s → %d | bytes=%d sha1=%s content-length=%s content-encoding=%s", tarball, download.status, download.bytes, download.sha1, download.headers.get("content-length"), download.headers.get("content-encoding"));
+		assert.strictEqual(download.status, 200, `Expected 200 downloading ${tarball}`);
+		assert.strictEqual(download.sha1, body.versions["1.1.0"].dist.shasum, "Downloaded tarball does not match advertised shasum");
+	});
+	await ctx.subTest("scoped packument via %2f-encoded URL", async () => {
+		const scopedPkg = `@verdaccio/e2e-metadata-${id}`;
+		await publishVersion(ctx, scopedPkg, "1.0.0");
+		const { status, body } = await fetchPackument(ctx.registryUrl, scopedPkg);
+		assert.strictEqual(status, 200, `Expected 200 for ${scopedPkg}`);
+		assert.strictEqual(body.name, scopedPkg, "Scoped packument name mismatch");
+	});
+	await ctx.subTest("unknown package returns a 404 error body", async () => {
+		const { status, body } = await fetchPackument(ctx.registryUrl, `does-not-exist-${id}`);
+		trace("unknown package → %d | body=%j", status, body);
+		assert.strictEqual(status, 404, `Expected 404, got ${status}`);
+		assert.ok(body?.error, "Expected an \"error\" field in the 404 body");
+	});
+	await ctx.subTest("unpublished version disappears from the packument", async () => {
+		await ctx.adapter.exec({ cwd: projectFolder }, "unpublish", `${pkg}@1.0.0`, "--force", ...ctx.adapter.registryArg(ctx.registryUrl));
+		const { status, body } = await fetchPackument(ctx.registryUrl, pkg);
+		trace("after unpublish → %d | versions=%j dist-tags=%j", status, Object.keys(body?.versions ?? {}), body?.["dist-tags"]);
+		assert.strictEqual(status, 200, "Expected 200 after unpublishing one version");
+		assert.strictEqual(body.versions["1.0.0"], void 0, "Expected 1.0.0 to be gone");
+		assert.ok(body.versions["1.1.0"], "Expected 1.1.0 to survive the unpublish");
+	});
+}
+var metadataScenario = {
+	name: "scenario:metadata",
+	requires: ["publish", "unpublish"],
+	appliesTo: (adapter) => adapter.type === "npm",
+	run: testMetadata
+};
+//#endregion
+export { metadataScenario };
+
+//# sourceMappingURL=metadata.js.map

package/build/esm/scenarios/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","names":[],"sources":["../../../src/scenarios/metadata.ts"],"sourcesContent":["import assert from 'assert';\n\nimport { TestContext, TestDefinition } from '../types';\nimport { downloadTarball, fetchPackument } from '../utils/http-client';\nimport { trace } from '../utils/process';\n\n/**\n * Scenario: metadata\n *\n * HTTP-level battery for the packument (package metadata) endpoints:\n *\n *   - full packument shape: versions, dist-tags, readme, time\n *   - abbreviated metadata (Accept: application/vnd.npm.install-v1+json)\n *   - ETag + If-None-Match revalidation → 304 (required by Yarn Berry)\n *   - dist.tarball URLs rewritten to the registry host and downloadable\n *   - scoped packages via the `%2f`-encoded URL form\n *   - 404 body shape for unknown packages\n *   - coherence after mutations (new version published, version unpublished)\n *\n * Protocol-level and package-manager-agnostic, so it is gated to the npm\n * adapter to run once per suite.\n */\n\nasync function publishVersion(ctx: TestContext, pkgName: string, version: string): Promise<string> {\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    pkgName,\n    version,\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token\n  );\n  await ctx.adapter.exec(\n    { cwd: tempFolder },\n    'publish',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n  trace('published %s@%s', pkgName, version);\n  return tempFolder;\n}\n\nasync function testMetadata(ctx: TestContext): Promise<void> {\n  const id = ctx.runId;\n  const pkg = `e2e-metadata-${id}`;\n  let projectFolder = '';\n\n  await ctx.subTest('publish two versions', async () => {\n    await publishVersion(ctx, pkg, '1.0.0');\n    projectFolder = await publishVersion(ctx, pkg, '1.1.0');\n  });\n\n  await ctx.subTest('full packument has versions, dist-tags, readme and time', async () => {\n    const { status, body } = await fetchPackument(ctx.registryUrl, pkg);\n    trace(\n      'full packument → %d | keys=%j dist-tags=%j versions=%j',\n      status,\n      Object.keys(body ?? {}),\n      body?.['dist-tags'],\n      Object.keys(body?.versions ?? {})\n    );\n    assert.strictEqual(status, 200, 'Expected 200 for full packument');\n    assert.strictEqual(body.name, pkg, 'Packument name mismatch');\n    assert.ok(body.versions['1.0.0'], 'Expected version 1.0.0 in packument');\n    assert.ok(body.versions['1.1.0'], 'Expected version 1.1.0 in packument');\n    assert.strictEqual(body['dist-tags'].latest, '1.1.0', 'Expected latest dist-tag → 1.1.0');\n    assert.ok(body.readme, 'Expected readme in full packument');\n    assert.ok(body.time?.['1.0.0'], 'Expected time entry for 1.0.0');\n    assert.ok(body.time?.['1.1.0'], 'Expected time entry for 1.1.0');\n  });\n\n  await ctx.subTest('abbreviated metadata (install-v1) is served', async () => {\n    const { status, body } = await fetchPackument(ctx.registryUrl, pkg, { abbreviated: true });\n    trace('abbreviated packument → %d | keys=%j', status, Object.keys(body ?? {}));\n    assert.strictEqual(status, 200, 'Expected 200 for abbreviated packument');\n    assert.ok(body.versions['1.1.0'], 'Expected versions in abbreviated metadata');\n    assert.ok(body['dist-tags'], 'Expected dist-tags in abbreviated metadata');\n    // The install-v1 format exists to keep install metadata small: the readme\n    // and the internal CouchDB fields must not leak (npm registry contract).\n    assert.strictEqual(body.readme, undefined, 'Abbreviated metadata must not include the readme');\n    assert.strictEqual(body._id, undefined, 'Abbreviated metadata must not include _id');\n    assert.strictEqual(body._rev, undefined, 'Abbreviated metadata must not include _rev');\n    assert.strictEqual(\n      body.readmeFilename,\n      undefined,\n      'Abbreviated metadata must not include readmeFilename'\n    );\n    // \"modified\" is part of the install-v1 contract\n    assert.ok(body.modified, 'Expected \"modified\" field in abbreviated metadata');\n  });\n\n  await ctx.subTest('ETag + If-None-Match revalidation returns 304', async () => {\n    const first = await fetchPackument(ctx.registryUrl, pkg);\n    const etag = first.headers.get('etag');\n    trace('etag on first response: %s', etag);\n    assert.ok(etag, 'Expected an ETag header on the packument response');\n    const revalidated = await fetchPackument(ctx.registryUrl, pkg, { etag });\n    trace('revalidation with If-None-Match → %d', revalidated.status);\n    assert.strictEqual(\n      revalidated.status,\n      304,\n      `Expected 304 with If-None-Match: ${etag}, got ${revalidated.status}`\n    );\n  });\n\n  await ctx.subTest('ETag changes after a new version is published', async () => {\n    const before = await fetchPackument(ctx.registryUrl, pkg);\n    const staleEtag = before.headers.get('etag');\n    assert.ok(staleEtag, 'Expected an ETag before publishing');\n\n    await publishVersion(ctx, pkg, '1.2.0');\n\n    // A \"stuck\" ETag would keep serving 304 forever — the stale value must\n    // now miss and return the fresh packument with a different ETag.\n    const after = await fetchPackument(ctx.registryUrl, pkg, { etag: staleEtag as string });\n    trace('stale etag %s → %d | fresh etag %s', staleEtag, after.status, after.headers.get('etag'));\n    assert.strictEqual(\n      after.status,\n      200,\n      `Expected 200 with the stale ETag after publishing 1.2.0, got ${after.status}`\n    );\n    assert.ok(after.body?.versions?.['1.2.0'], 'Expected 1.2.0 in the revalidated packument');\n    const freshEtag = after.headers.get('etag');\n    assert.ok(freshEtag, 'Expected an ETag on the fresh packument');\n    assert.notStrictEqual(freshEtag, staleEtag, 'ETag did not change after a publish');\n  });\n\n  await ctx.subTest('dist.tarball points at this registry and is downloadable', async () => {\n    const { body } = await fetchPackument(ctx.registryUrl, pkg);\n    const tarball: string = body.versions['1.1.0'].dist.tarball;\n    assert.ok(\n      tarball.startsWith(ctx.registryUrl),\n      `Expected dist.tarball to be rewritten to ${ctx.registryUrl}, got ${tarball}`\n    );\n    const download = await downloadTarball(tarball);\n    trace(\n      'tarball %s → %d | bytes=%d sha1=%s content-length=%s content-encoding=%s',\n      tarball,\n      download.status,\n      download.bytes,\n      download.sha1,\n      download.headers.get('content-length'),\n      download.headers.get('content-encoding')\n    );\n    assert.strictEqual(download.status, 200, `Expected 200 downloading ${tarball}`);\n    assert.strictEqual(\n      download.sha1,\n      body.versions['1.1.0'].dist.shasum,\n      'Downloaded tarball does not match advertised shasum'\n    );\n  });\n\n  await ctx.subTest('scoped packument via %2f-encoded URL', async () => {\n    const scopedPkg = `@verdaccio/e2e-metadata-${id}`;\n    await publishVersion(ctx, scopedPkg, '1.0.0');\n    const { status, body } = await fetchPackument(ctx.registryUrl, scopedPkg);\n    assert.strictEqual(status, 200, `Expected 200 for ${scopedPkg}`);\n    assert.strictEqual(body.name, scopedPkg, 'Scoped packument name mismatch');\n  });\n\n  await ctx.subTest('unknown package returns a 404 error body', async () => {\n    const { status, body } = await fetchPackument(ctx.registryUrl, `does-not-exist-${id}`);\n    trace('unknown package → %d | body=%j', status, body);\n    assert.strictEqual(status, 404, `Expected 404, got ${status}`);\n    assert.ok(body?.error, 'Expected an \"error\" field in the 404 body');\n  });\n\n  await ctx.subTest('unpublished version disappears from the packument', async () => {\n    // Run from the project folder so its .npmrc (auth token) applies.\n    await ctx.adapter.exec(\n      { cwd: projectFolder },\n      'unpublish',\n      `${pkg}@1.0.0`,\n      '--force',\n      ...ctx.adapter.registryArg(ctx.registryUrl)\n    );\n    const { status, body } = await fetchPackument(ctx.registryUrl, pkg);\n    trace(\n      'after unpublish → %d | versions=%j dist-tags=%j',\n      status,\n      Object.keys(body?.versions ?? {}),\n      body?.['dist-tags']\n    );\n    assert.strictEqual(status, 200, 'Expected 200 after unpublishing one version');\n    assert.strictEqual(body.versions['1.0.0'], undefined, 'Expected 1.0.0 to be gone');\n    assert.ok(body.versions['1.1.0'], 'Expected 1.1.0 to survive the unpublish');\n  });\n}\n\nexport const metadataScenario: TestDefinition = {\n  name: 'scenario:metadata',\n  requires: ['publish', 'unpublish'],\n  // Protocol-level battery — run once per suite via the npm adapter.\n  appliesTo: (adapter) => adapter.type === 'npm',\n  run: testMetadata,\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAuBA,eAAe,eAAe,KAAkB,SAAiB,SAAkC;CACjG,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,SACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;CACA,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CACA,MAAM,mBAAmB,SAAS,OAAO;CACzC,OAAO;AACT;AAEA,eAAe,aAAa,KAAiC;CAC3D,MAAM,KAAK,IAAI;CACf,MAAM,MAAM,gBAAgB;CAC5B,IAAI,gBAAgB;CAEpB,MAAM,IAAI,QAAQ,wBAAwB,YAAY;EACpD,MAAM,eAAe,KAAK,KAAK,OAAO;EACtC,gBAAgB,MAAM,eAAe,KAAK,KAAK,OAAO;CACxD,CAAC;CAED,MAAM,IAAI,QAAQ,2DAA2D,YAAY;EACvF,MAAM,EAAE,QAAQ,SAAS,MAAM,eAAe,IAAI,aAAa,GAAG;EAClE,MACE,0DACA,QACA,OAAO,KAAK,QAAQ,CAAC,CAAC,GACtB,OAAO,cACP,OAAO,KAAK,MAAM,YAAY,CAAC,CAAC,CAClC;EACA,OAAO,YAAY,QAAQ,KAAK,iCAAiC;EACjE,OAAO,YAAY,KAAK,MAAM,KAAK,yBAAyB;EAC5D,OAAO,GAAG,KAAK,SAAS,UAAU,qCAAqC;EACvE,OAAO,GAAG,KAAK,SAAS,UAAU,qCAAqC;EACvE,OAAO,YAAY,KAAK,YAAY,CAAC,QAAQ,SAAS,kCAAkC;EACxF,OAAO,GAAG,KAAK,QAAQ,mCAAmC;EAC1D,OAAO,GAAG,KAAK,OAAO,UAAU,+BAA+B;EAC/D,OAAO,GAAG,KAAK,OAAO,UAAU,+BAA+B;CACjE,CAAC;CAED,MAAM,IAAI,QAAQ,+CAA+C,YAAY;EAC3E,MAAM,EAAE,QAAQ,SAAS,MAAM,eAAe,IAAI,aAAa,KAAK,EAAE,aAAa,KAAK,CAAC;EACzF,MAAM,wCAAwC,QAAQ,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC;EAC7E,OAAO,YAAY,QAAQ,KAAK,wCAAwC;EACxE,OAAO,GAAG,KAAK,SAAS,UAAU,2CAA2C;EAC7E,OAAO,GAAG,KAAK,cAAc,4CAA4C;EAGzE,OAAO,YAAY,KAAK,QAAQ,KAAA,GAAW,kDAAkD;EAC7F,OAAO,YAAY,KAAK,KAAK,KAAA,GAAW,2CAA2C;EACnF,OAAO,YAAY,KAAK,MAAM,KAAA,GAAW,4CAA4C;EACrF,OAAO,YACL,KAAK,gBACL,KAAA,GACA,sDACF;EAEA,OAAO,GAAG,KAAK,UAAU,qDAAmD;CAC9E,CAAC;CAED,MAAM,IAAI,QAAQ,iDAAiD,YAAY;EAE7E,MAAM,QAAO,MADO,eAAe,IAAI,aAAa,GAAG,EAAA,CACpC,QAAQ,IAAI,MAAM;EACrC,MAAM,8BAA8B,IAAI;EACxC,OAAO,GAAG,MAAM,mDAAmD;EACnE,MAAM,cAAc,MAAM,eAAe,IAAI,aAAa,KAAK,EAAE,KAAK,CAAC;EACvE,MAAM,wCAAwC,YAAY,MAAM;EAChE,OAAO,YACL,YAAY,QACZ,KACA,oCAAoC,KAAK,QAAQ,YAAY,QAC/D;CACF,CAAC;CAED,MAAM,IAAI,QAAQ,iDAAiD,YAAY;EAE7E,MAAM,aAAY,MADG,eAAe,IAAI,aAAa,GAAG,EAAA,CAC/B,QAAQ,IAAI,MAAM;EAC3C,OAAO,GAAG,WAAW,oCAAoC;EAEzD,MAAM,eAAe,KAAK,KAAK,OAAO;EAItC,MAAM,QAAQ,MAAM,eAAe,IAAI,aAAa,KAAK,EAAE,MAAM,UAAoB,CAAC;EACtF,MAAM,sCAAsC,WAAW,MAAM,QAAQ,MAAM,QAAQ,IAAI,MAAM,CAAC;EAC9F,OAAO,YACL,MAAM,QACN,KACA,gEAAgE,MAAM,QACxE;EACA,OAAO,GAAG,MAAM,MAAM,WAAW,UAAU,6CAA6C;EACxF,MAAM,YAAY,MAAM,QAAQ,IAAI,MAAM;EAC1C,OAAO,GAAG,WAAW,yCAAyC;EAC9D,OAAO,eAAe,WAAW,WAAW,qCAAqC;CACnF,CAAC;CAED,MAAM,IAAI,QAAQ,4DAA4D,YAAY;EACxF,MAAM,EAAE,SAAS,MAAM,eAAe,IAAI,aAAa,GAAG;EAC1D,MAAM,UAAkB,KAAK,SAAS,QAAQ,CAAC,KAAK;EACpD,OAAO,GACL,QAAQ,WAAW,IAAI,WAAW,GAClC,4CAA4C,IAAI,YAAY,QAAQ,SACtE;EACA,MAAM,WAAW,MAAM,gBAAgB,OAAO;EAC9C,MACE,4EACA,SACA,SAAS,QACT,SAAS,OACT,SAAS,MACT,SAAS,QAAQ,IAAI,gBAAgB,GACrC,SAAS,QAAQ,IAAI,kBAAkB,CACzC;EACA,OAAO,YAAY,SAAS,QAAQ,KAAK,4BAA4B,SAAS;EAC9E,OAAO,YACL,SAAS,MACT,KAAK,SAAS,QAAQ,CAAC,KAAK,QAC5B,qDACF;CACF,CAAC;CAED,MAAM,IAAI,QAAQ,wCAAwC,YAAY;EACpE,MAAM,YAAY,2BAA2B;EAC7C,MAAM,eAAe,KAAK,WAAW,OAAO;EAC5C,MAAM,EAAE,QAAQ,SAAS,MAAM,eAAe,IAAI,aAAa,SAAS;EACxE,OAAO,YAAY,QAAQ,KAAK,oBAAoB,WAAW;EAC/D,OAAO,YAAY,KAAK,MAAM,WAAW,gCAAgC;CAC3E,CAAC;CAED,MAAM,IAAI,QAAQ,4CAA4C,YAAY;EACxE,MAAM,EAAE,QAAQ,SAAS,MAAM,eAAe,IAAI,aAAa,kBAAkB,IAAI;EACrF,MAAM,kCAAkC,QAAQ,IAAI;EACpD,OAAO,YAAY,QAAQ,KAAK,qBAAqB,QAAQ;EAC7D,OAAO,GAAG,MAAM,OAAO,6CAA2C;CACpE,CAAC;CAED,MAAM,IAAI,QAAQ,qDAAqD,YAAY;EAEjF,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,cAAc,GACrB,aACA,GAAG,IAAI,SACP,WACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EACA,MAAM,EAAE,QAAQ,SAAS,MAAM,eAAe,IAAI,aAAa,GAAG;EAClE,MACE,mDACA,QACA,OAAO,KAAK,MAAM,YAAY,CAAC,CAAC,GAChC,OAAO,YACT;EACA,OAAO,YAAY,QAAQ,KAAK,6CAA6C;EAC7E,OAAO,YAAY,KAAK,SAAS,UAAU,KAAA,GAAW,2BAA2B;EACjF,OAAO,GAAG,KAAK,SAAS,UAAU,yCAAyC;CAC7E,CAAC;AACH;AAEA,IAAa,mBAAmC;CAC9C,MAAM;CACN,UAAU,CAAC,WAAW,WAAW;CAEjC,YAAY,YAAY,QAAQ,SAAS;CACzC,KAAK;AACP"}

package/build/esm/scenarios/minimum-release-age.js

@@ -0,0 +1,108 @@
+import { trace } from "../utils/process.js";
+import { join } from "path";
+import { writeFile } from "fs/promises";
+import assert from "assert";
+//#region src/scenarios/minimum-release-age.ts
+/**
+* Scenario: minimum-release-age (pnpm 11.1+ only)
+*
+* Exercises pnpm's `minimumReleaseAge` cooldown together with
+* `minimumReleaseAgeExclude`. With a 7-day (10080 minute) cooldown, freshly
+* published versions are normally not installable until they age past the
+* threshold — but packages matching the exclude globs bypass the check.
+*
+*   minimumReleaseAge: 10080
+*   minimumReleaseAgeExclude:
+*     - '@verdaccio/*'
+*     - 'verdaccio-*'
+*
+* The scenario publishes brand-new (age ~0) packages and asserts:
+*   - an excluded scoped package   (@verdaccio/*) installs despite the cooldown
+*   - an excluded unscoped package (verdaccio-*)  installs despite the cooldown
+*   - a non-excluded package is blocked by the cooldown (proving it is active)
+*
+* pnpm reads these settings from `pnpm-workspace.yaml`, mirroring the
+* configuration used by the repo root. The cooldown is only enforced from
+* pnpm 11.1.0 onward (11.0.x silently ignores it), so the scenario is gated to
+* that version range — see {@link isPnpm11Plus}.
+*/
+var MINIMUM_RELEASE_AGE = 10080;
+var PNPM_WORKSPACE_YAML = [
+	`minimumReleaseAge: ${MINIMUM_RELEASE_AGE}`,
+	"minimumReleaseAgeExclude:",
+	...["@verdaccio/*", "verdaccio-*"].map((glob) => `  - '${glob}'`),
+	""
+].join("\n");
+/**
+* True only for pnpm versions that actually enforce minimumReleaseAge.
+*
+* The cooldown is honored in pnpm 11.1.0+, but it is silently ignored in
+* 11.0.0 / 11.0.1 (and the 11.0.0 release candidates) — those versions install
+* brand-new packages regardless of the configured cooldown. We scope this
+* scenario to pnpm 11.1.0 and newer so it doesn't false-fail on that regression.
+*/
+function isPnpm11Plus(adapter) {
+	if (adapter.type !== "pnpm") return false;
+	const match = adapter.name.match(/pnpm@(\d+)\.(\d+)/);
+	if (!match) return false;
+	const major = parseInt(match[1], 10);
+	const minor = parseInt(match[2], 10);
+	return major > 11 || major === 11 && minor >= 1;
+}
+async function publishPackage(ctx, pkgName, version) {
+	trace("publishing %s@%s", pkgName, version);
+	const { tempFolder } = await ctx.adapter.prepareProject(pkgName, version, ctx.registryUrl, ctx.port, ctx.token);
+	await ctx.adapter.exec({ cwd: tempFolder }, "publish", ...ctx.adapter.registryArg(ctx.registryUrl));
+	trace("published %s@%s", pkgName, version);
+}
+/**
+* Build a consumer project with the minimumReleaseAge cooldown configured in
+* pnpm-workspace.yaml, depending on the given packages.
+*/
+async function prepareCooldownConsumer(ctx, consumerName, dependencies) {
+	const { tempFolder } = await ctx.adapter.prepareProject(consumerName, "1.0.0", ctx.registryUrl, ctx.port, ctx.token, dependencies);
+	await writeFile(join(tempFolder, "pnpm-workspace.yaml"), PNPM_WORKSPACE_YAML);
+	trace("prepared cooldown consumer %s at %s", consumerName, tempFolder);
+	return tempFolder;
+}
+async function testMinimumReleaseAge(ctx) {
+	const id = ctx.runId;
+	const excludedScoped = `@verdaccio/release-age-${id}`;
+	const excludedUnscoped = `verdaccio-release-age-${id}`;
+	const blocked = `e2e-release-age-blocked-${id}`;
+	await ctx.subTest("publish fresh packages", async () => {
+		await publishPackage(ctx, excludedScoped, "1.0.0");
+		await publishPackage(ctx, excludedUnscoped, "1.0.0");
+		await publishPackage(ctx, blocked, "1.0.0");
+	});
+	await ctx.subTest("excluded packages bypass the cooldown", async () => {
+		const tempFolder = await prepareCooldownConsumer(ctx, `@verdaccio/consumer-excluded-${id}`, {
+			[excludedScoped]: "1.0.0",
+			[excludedUnscoped]: "1.0.0"
+		});
+		await ctx.adapter.exec({ cwd: tempFolder }, "install", ...ctx.adapter.registryArg(ctx.registryUrl));
+		trace("excluded packages installed successfully under cooldown");
+	});
+	await ctx.subTest("non-excluded fresh package is blocked", async () => {
+		const tempFolder = await prepareCooldownConsumer(ctx, `e2e-consumer-blocked-${id}`, { [blocked]: "1.0.0" });
+		let errorMessage = "";
+		try {
+			await ctx.adapter.exec({ cwd: tempFolder }, "install", "--frozen-lockfile=false", ...ctx.adapter.registryArg(ctx.registryUrl));
+		} catch (err) {
+			errorMessage = err instanceof Error ? err.message : String(err);
+			trace("install correctly rejected by cooldown: %s", errorMessage.split("\n")[0]);
+		}
+		assert.ok(errorMessage, `Expected install of fresh non-excluded package "${blocked}" to be blocked by minimumReleaseAge (${MINIMUM_RELEASE_AGE} min), but it succeeded`);
+		assert.ok(/minimumReleaseAge|NO_MATURE_MATCHING_VERSION/i.test(errorMessage), `Install of "${blocked}" failed for an unexpected reason (expected a minimumReleaseAge cooldown error):\n${errorMessage}`);
+	});
+}
+var minimumReleaseAgeScenario = {
+	name: "scenario:minimum-release-age",
+	requires: ["publish", "install"],
+	appliesTo: isPnpm11Plus,
+	run: testMinimumReleaseAge
+};
+//#endregion
+export { isPnpm11Plus, minimumReleaseAgeScenario };
+
+//# sourceMappingURL=minimum-release-age.js.map

package/build/esm/scenarios/minimum-release-age.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"minimum-release-age.js","names":[],"sources":["../../../src/scenarios/minimum-release-age.ts"],"sourcesContent":["import assert from 'assert';\nimport { writeFile } from 'fs/promises';\nimport { join } from 'path';\n\nimport { PackageManagerAdapter, TestContext, TestDefinition } from '../types';\nimport { trace } from '../utils/process';\n\n/**\n * Scenario: minimum-release-age (pnpm 11.1+ only)\n *\n * Exercises pnpm's `minimumReleaseAge` cooldown together with\n * `minimumReleaseAgeExclude`. With a 7-day (10080 minute) cooldown, freshly\n * published versions are normally not installable until they age past the\n * threshold — but packages matching the exclude globs bypass the check.\n *\n *   minimumReleaseAge: 10080\n *   minimumReleaseAgeExclude:\n *     - '@verdaccio/*'\n *     - 'verdaccio-*'\n *\n * The scenario publishes brand-new (age ~0) packages and asserts:\n *   - an excluded scoped package   (@verdaccio/*) installs despite the cooldown\n *   - an excluded unscoped package (verdaccio-*)  installs despite the cooldown\n *   - a non-excluded package is blocked by the cooldown (proving it is active)\n *\n * pnpm reads these settings from `pnpm-workspace.yaml`, mirroring the\n * configuration used by the repo root. The cooldown is only enforced from\n * pnpm 11.1.0 onward (11.0.x silently ignores it), so the scenario is gated to\n * that version range — see {@link isPnpm11Plus}.\n */\n\nconst MINIMUM_RELEASE_AGE = 10080; // 7 days, in minutes\nconst MINIMUM_RELEASE_AGE_EXCLUDE = ['@verdaccio/*', 'verdaccio-*'];\n\nconst PNPM_WORKSPACE_YAML = [\n  `minimumReleaseAge: ${MINIMUM_RELEASE_AGE}`,\n  'minimumReleaseAgeExclude:',\n  ...MINIMUM_RELEASE_AGE_EXCLUDE.map((glob) => `  - '${glob}'`),\n  '',\n].join('\\n');\n\n/**\n * True only for pnpm versions that actually enforce minimumReleaseAge.\n *\n * The cooldown is honored in pnpm 11.1.0+, but it is silently ignored in\n * 11.0.0 / 11.0.1 (and the 11.0.0 release candidates) — those versions install\n * brand-new packages regardless of the configured cooldown. We scope this\n * scenario to pnpm 11.1.0 and newer so it doesn't false-fail on that regression.\n */\nexport function isPnpm11Plus(adapter: PackageManagerAdapter): boolean {\n  if (adapter.type !== 'pnpm') {\n    return false;\n  }\n  const match = adapter.name.match(/pnpm@(\\d+)\\.(\\d+)/);\n  if (!match) {\n    return false;\n  }\n  const major = parseInt(match[1], 10);\n  const minor = parseInt(match[2], 10);\n  return major > 11 || (major === 11 && minor >= 1);\n}\n\nasync function publishPackage(ctx: TestContext, pkgName: string, version: string): Promise<void> {\n  trace('publishing %s@%s', pkgName, version);\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    pkgName,\n    version,\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token\n  );\n  await ctx.adapter.exec(\n    { cwd: tempFolder },\n    'publish',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n  trace('published %s@%s', pkgName, version);\n}\n\n/**\n * Build a consumer project with the minimumReleaseAge cooldown configured in\n * pnpm-workspace.yaml, depending on the given packages.\n */\nasync function prepareCooldownConsumer(\n  ctx: TestContext,\n  consumerName: string,\n  dependencies: Record<string, string>\n): Promise<string> {\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    consumerName,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token,\n    dependencies\n  );\n  await writeFile(join(tempFolder, 'pnpm-workspace.yaml'), PNPM_WORKSPACE_YAML);\n  trace('prepared cooldown consumer %s at %s', consumerName, tempFolder);\n  return tempFolder;\n}\n\nasync function testMinimumReleaseAge(ctx: TestContext): Promise<void> {\n  const id = ctx.runId;\n\n  const excludedScoped = `@verdaccio/release-age-${id}`;\n  const excludedUnscoped = `verdaccio-release-age-${id}`;\n  const blocked = `e2e-release-age-blocked-${id}`;\n\n  // --- Phase 1: Publish brand-new (age ~0) packages ---\n  await ctx.subTest('publish fresh packages', async () => {\n    await publishPackage(ctx, excludedScoped, '1.0.0');\n    await publishPackage(ctx, excludedUnscoped, '1.0.0');\n    await publishPackage(ctx, blocked, '1.0.0');\n  });\n\n  // --- Phase 2: Excluded packages install despite the cooldown ---\n  await ctx.subTest('excluded packages bypass the cooldown', async () => {\n    const tempFolder = await prepareCooldownConsumer(ctx, `@verdaccio/consumer-excluded-${id}`, {\n      [excludedScoped]: '1.0.0',\n      [excludedUnscoped]: '1.0.0',\n    });\n\n    // Should succeed: both deps match the exclude globs.\n    await ctx.adapter.exec(\n      { cwd: tempFolder },\n      'install',\n      ...ctx.adapter.registryArg(ctx.registryUrl)\n    );\n\n    trace('excluded packages installed successfully under cooldown');\n  });\n\n  // --- Phase 3: Non-excluded fresh package is blocked by the cooldown ---\n  await ctx.subTest('non-excluded fresh package is blocked', async () => {\n    const tempFolder = await prepareCooldownConsumer(ctx, `e2e-consumer-blocked-${id}`, {\n      [blocked]: '1.0.0',\n    });\n\n    let errorMessage = '';\n    try {\n      await ctx.adapter.exec(\n        { cwd: tempFolder },\n        'install',\n        '--frozen-lockfile=false',\n        ...ctx.adapter.registryArg(ctx.registryUrl)\n      );\n    } catch (err) {\n      errorMessage = err instanceof Error ? err.message : String(err);\n      trace('install correctly rejected by cooldown: %s', errorMessage.split('\\n')[0]);\n    }\n\n    assert.ok(\n      errorMessage,\n      `Expected install of fresh non-excluded package \"${blocked}\" to be blocked by ` +\n        `minimumReleaseAge (${MINIMUM_RELEASE_AGE} min), but it succeeded`\n    );\n    // pnpm reports ERR_PNPM_NO_MATURE_MATCHING_VERSION / \"minimumReleaseAge\" when a\n    // version is too new. Assert the failure is the cooldown, not an unrelated error.\n    assert.ok(\n      /minimumReleaseAge|NO_MATURE_MATCHING_VERSION/i.test(errorMessage),\n      `Install of \"${blocked}\" failed for an unexpected reason (expected a minimumReleaseAge ` +\n        `cooldown error):\\n${errorMessage}`\n    );\n  });\n}\n\nexport const minimumReleaseAgeScenario: TestDefinition = {\n  name: 'scenario:minimum-release-age',\n  requires: ['publish', 'install'],\n  appliesTo: isPnpm11Plus,\n  run: testMinimumReleaseAge,\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,IAAM,sBAAsB;AAG5B,IAAM,sBAAsB;CAC1B,sBAAsB;CACtB;CACA,GAAG,CALgC,gBAAgB,aAKhD,CAAA,CAA4B,KAAK,SAAS,QAAQ,KAAK,EAAE;CAC5D;AACF,CAAC,CAAC,KAAK,IAAI;;;;;;;;;AAUX,SAAgB,aAAa,SAAyC;CACpE,IAAI,QAAQ,SAAS,QACnB,OAAO;CAET,MAAM,QAAQ,QAAQ,KAAK,MAAM,mBAAmB;CACpD,IAAI,CAAC,OACH,OAAO;CAET,MAAM,QAAQ,SAAS,MAAM,IAAI,EAAE;CACnC,MAAM,QAAQ,SAAS,MAAM,IAAI,EAAE;CACnC,OAAO,QAAQ,MAAO,UAAU,MAAM,SAAS;AACjD;AAEA,eAAe,eAAe,KAAkB,SAAiB,SAAgC;CAC/F,MAAM,oBAAoB,SAAS,OAAO;CAC1C,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,SACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;CACA,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CACA,MAAM,mBAAmB,SAAS,OAAO;AAC3C;;;;;AAMA,eAAe,wBACb,KACA,cACA,cACiB;CACjB,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,cACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,OACJ,YACF;CACA,MAAM,UAAU,KAAK,YAAY,qBAAqB,GAAG,mBAAmB;CAC5E,MAAM,uCAAuC,cAAc,UAAU;CACrE,OAAO;AACT;AAEA,eAAe,sBAAsB,KAAiC;CACpE,MAAM,KAAK,IAAI;CAEf,MAAM,iBAAiB,0BAA0B;CACjD,MAAM,mBAAmB,yBAAyB;CAClD,MAAM,UAAU,2BAA2B;CAG3C,MAAM,IAAI,QAAQ,0BAA0B,YAAY;EACtD,MAAM,eAAe,KAAK,gBAAgB,OAAO;EACjD,MAAM,eAAe,KAAK,kBAAkB,OAAO;EACnD,MAAM,eAAe,KAAK,SAAS,OAAO;CAC5C,CAAC;CAGD,MAAM,IAAI,QAAQ,yCAAyC,YAAY;EACrE,MAAM,aAAa,MAAM,wBAAwB,KAAK,gCAAgC,MAAM;IACzF,iBAAiB;IACjB,mBAAmB;EACtB,CAAC;EAGD,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EAEA,MAAM,yDAAyD;CACjE,CAAC;CAGD,MAAM,IAAI,QAAQ,yCAAyC,YAAY;EACrE,MAAM,aAAa,MAAM,wBAAwB,KAAK,wBAAwB,MAAM,GACjF,UAAU,QACb,CAAC;EAED,IAAI,eAAe;EACnB,IAAI;GACF,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,2BACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EACF,SAAS,KAAK;GACZ,eAAe,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GAC9D,MAAM,8CAA8C,aAAa,MAAM,IAAI,CAAC,CAAC,EAAE;EACjF;EAEA,OAAO,GACL,cACA,mDAAmD,QAAQ,wCACnC,oBAAoB,wBAC9C;EAGA,OAAO,GACL,gDAAgD,KAAK,YAAY,GACjE,eAAe,QAAQ,oFACA,cACzB;CACF,CAAC;AACH;AAEA,IAAa,4BAA4C;CACvD,MAAM;CACN,UAAU,CAAC,WAAW,SAAS;CAC/B,WAAW;CACX,KAAK;AACP"}