@verdaccio/e2e-cli 3.0.0 → 3.2.0

package/build/esm/tests/login.js

@@ -0,0 +1,122 @@
+import { createTempFolder, getPackageJSON, getREADME } from "../utils/project.js";
+import buildDebug from "debug";
+import { join } from "path";
+import { writeFile } from "fs/promises";
+import * as YAML from "js-yaml";
+import assert from "assert";
+//#region src/tests/login.ts
+var debug = buildDebug("verdaccio:e2e-cli:test:login");
+/**
+* Creates a project with registry config but WITHOUT auth token,
+* so whoami will use the token saved by login to ~/.yarnrc.yml.
+*/
+async function prepareLoginProject(ctx, name) {
+	debug("preparing project for %s (no auth token)", name);
+	const tempFolder = await createTempFolder(name);
+	const yamlContent = YAML.dump({
+		npmRegistryServer: ctx.registryUrl,
+		enableImmutableInstalls: false,
+		unsafeHttpWhitelist: ["localhost"]
+	});
+	await writeFile(join(tempFolder, ".yarnrc.yml"), yamlContent);
+	await writeFile(join(tempFolder, "package.json"), JSON.stringify({
+		name,
+		version: "1.0.0"
+	}));
+	if (ctx.adapter.importPlugin) {
+		debug("importing npm-login plugin into %s", tempFolder);
+		await ctx.adapter.importPlugin(tempFolder, "npm-login");
+	}
+	return tempFolder;
+}
+async function yarnLogin(ctx, cwd, user, password, email) {
+	debug("yarn npm login as %s", user);
+	return ctx.adapter.exec({ cwd }, "login", "--auth-type=legacy", `--user=${user}`, `--password=${password}`, `--email=${email}`);
+}
+async function yarnWhoami(ctx, cwd) {
+	const resp = await ctx.adapter.exec({ cwd }, "whoami");
+	debug("yarn npm whoami: %s", resp.stdout);
+	return resp.stdout;
+}
+async function testLogin(ctx) {
+	const type = ctx.adapter.type;
+	const id = ctx.runId;
+	if (type !== "yarn-modern") {
+		debug("login test only supported for yarn-modern, skipping %s", type);
+		return;
+	}
+	const user1 = `login-a-${id}`;
+	const password1 = "test-password-123";
+	const email1 = `${user1}@test.example.com`;
+	await ctx.subTest("create new user + whoami", async () => {
+		const tf = await prepareLoginProject(ctx, `verdaccio-login1-${id}`);
+		const loginResp = await yarnLogin(ctx, tf, user1, password1, email1);
+		assert.ok(loginResp.stdout.includes("Logged in") || loginResp.stdout.includes("token saved"), `Expected login success message but got "${loginResp.stdout}"`);
+		const who = await yarnWhoami(ctx, tf);
+		assert.ok(who.includes(user1), `Expected whoami "${user1}" but got "${who}"`);
+	});
+	await ctx.subTest("legacy re-login is rejected without basic auth", async () => {
+		const tf = await prepareLoginProject(ctx, `verdaccio-login2-${id}`);
+		let loginFailed = false;
+		try {
+			await yarnLogin(ctx, tf, user1, password1, email1);
+		} catch {
+			loginFailed = true;
+		}
+		assert.ok(loginFailed, "Legacy re-login for an existing user should fail without Basic auth");
+	});
+	await ctx.subTest("wrong password fails", async () => {
+		const tf = await prepareLoginProject(ctx, `verdaccio-login3-${id}`);
+		let loginFailed = false;
+		try {
+			await yarnLogin(ctx, tf, user1, "wrong-password", email1);
+		} catch {
+			loginFailed = true;
+		}
+		assert.ok(loginFailed, "Login with wrong password should have failed");
+	});
+	await ctx.subTest("login then publish", async () => {
+		const pkgName = `@verdaccio/login-pub-${id}`;
+		const publishUser = `login-pub-${id}`;
+		const publishPassword = "publish-password-123";
+		const publishEmail = `${publishUser}@test.example.com`;
+		const tf = await createTempFolder(`login-pub-${id}`);
+		const yamlContent = YAML.dump({
+			npmRegistryServer: ctx.registryUrl,
+			enableImmutableInstalls: false,
+			unsafeHttpWhitelist: ["localhost"]
+		});
+		await writeFile(join(tf, ".yarnrc.yml"), yamlContent);
+		await writeFile(join(tf, "package.json"), getPackageJSON(pkgName, "1.0.0"));
+		await writeFile(join(tf, "README.md"), getREADME(pkgName));
+		if (ctx.adapter.importPlugin) await ctx.adapter.importPlugin(tf, "npm-login");
+		await yarnLogin(ctx, tf, publishUser, publishPassword, publishEmail);
+		await ctx.adapter.exec({ cwd: tf }, "install");
+		const pubResp = await ctx.adapter.exec({ cwd: tf }, "publish");
+		assert.ok(pubResp.stdout.includes("Package archive published"), `Expected publish success but got "${pubResp.stdout}"`);
+	});
+	await ctx.subTest("switch users", async () => {
+		const switchUser1 = `login-switch-a-${id}`;
+		const switchPassword1 = "switch-password-123";
+		const switchEmail1 = `${switchUser1}@test.example.com`;
+		const user2 = `login-b-${id}`;
+		const password2 = "other-password-456";
+		const email2 = `${user2}@test.example.com`;
+		const tf = await prepareLoginProject(ctx, `verdaccio-login5-${id}`);
+		await yarnLogin(ctx, tf, switchUser1, switchPassword1, switchEmail1);
+		const who1 = await yarnWhoami(ctx, tf);
+		assert.ok(who1.includes(switchUser1), `Expected "${switchUser1}" but got "${who1}"`);
+		await yarnLogin(ctx, tf, user2, password2, email2);
+		const who2 = await yarnWhoami(ctx, tf);
+		assert.ok(who2.includes(user2), `Expected "${user2}" after switch but got "${who2}"`);
+	});
+}
+var loginTest = {
+	name: "login",
+	requires: ["login"],
+	run: testLogin
+};
+//#endregion
+export { loginTest };
+
+//# sourceMappingURL=login.js.map

package/build/esm/tests/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","names":[],"sources":["../../../src/tests/login.ts"],"sourcesContent":["import assert from 'assert';\nimport buildDebug from 'debug';\nimport { writeFile } from 'fs/promises';\nimport * as YAML from 'js-yaml';\nimport { join } from 'path';\n\nimport { TestContext, TestDefinition } from '../types';\nimport { createTempFolder, getPackageJSON, getREADME } from '../utils/project';\n\nconst debug = buildDebug('verdaccio:e2e-cli:test:login');\n\n/**\n * Creates a project with registry config but WITHOUT auth token,\n * so whoami will use the token saved by login to ~/.yarnrc.yml.\n */\nasync function prepareLoginProject(ctx: TestContext, name: string): Promise<string> {\n  debug('preparing project for %s (no auth token)', name);\n  const tempFolder = await createTempFolder(name);\n  const yamlContent = YAML.dump({\n    npmRegistryServer: ctx.registryUrl,\n    enableImmutableInstalls: false,\n    unsafeHttpWhitelist: ['localhost'],\n  });\n  await writeFile(join(tempFolder, '.yarnrc.yml'), yamlContent);\n  await writeFile(join(tempFolder, 'package.json'), JSON.stringify({ name, version: '1.0.0' }));\n  if (ctx.adapter.importPlugin) {\n    debug('importing npm-login plugin into %s', tempFolder);\n    await ctx.adapter.importPlugin(tempFolder, 'npm-login');\n  }\n  return tempFolder;\n}\n\nasync function yarnLogin(\n  ctx: TestContext,\n  cwd: string,\n  user: string,\n  password: string,\n  email: string\n) {\n  debug('yarn npm login as %s', user);\n  return ctx.adapter.exec(\n    { cwd },\n    'login',\n    '--auth-type=legacy',\n    `--user=${user}`,\n    `--password=${password}`,\n    `--email=${email}`\n  );\n}\n\nasync function yarnWhoami(ctx: TestContext, cwd: string): Promise<string> {\n  const resp = await ctx.adapter.exec({ cwd }, 'whoami');\n  debug('yarn npm whoami: %s', resp.stdout);\n  return resp.stdout;\n}\n\nasync function testLogin(ctx: TestContext): Promise<void> {\n  const type = ctx.adapter.type;\n  const id = ctx.runId;\n\n  if (type !== 'yarn-modern') {\n    debug('login test only supported for yarn-modern, skipping %s', type);\n    return;\n  }\n\n  const user1 = `login-a-${id}`;\n  const password1 = 'test-password-123';\n  const email1 = `${user1}@test.example.com`;\n\n  await ctx.subTest('create new user + whoami', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login1-${id}`);\n    const loginResp = await yarnLogin(ctx, tf, user1, password1, email1);\n    assert.ok(\n      loginResp.stdout.includes('Logged in') || loginResp.stdout.includes('token saved'),\n      `Expected login success message but got \"${loginResp.stdout}\"`\n    );\n    const who = await yarnWhoami(ctx, tf);\n    assert.ok(who.includes(user1), `Expected whoami \"${user1}\" but got \"${who}\"`);\n  });\n\n  await ctx.subTest('legacy re-login is rejected without basic auth', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login2-${id}`);\n    let loginFailed = false;\n    try {\n      await yarnLogin(ctx, tf, user1, password1, email1);\n    } catch {\n      loginFailed = true;\n    }\n    assert.ok(loginFailed, 'Legacy re-login for an existing user should fail without Basic auth');\n  });\n\n  await ctx.subTest('wrong password fails', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login3-${id}`);\n    let loginFailed = false;\n    try {\n      await yarnLogin(ctx, tf, user1, 'wrong-password', email1);\n    } catch {\n      loginFailed = true;\n    }\n    assert.ok(loginFailed, 'Login with wrong password should have failed');\n  });\n\n  await ctx.subTest('login then publish', async () => {\n    const pkgName = `@verdaccio/login-pub-${id}`;\n    const publishUser = `login-pub-${id}`;\n    const publishPassword = 'publish-password-123';\n    const publishEmail = `${publishUser}@test.example.com`;\n    const tf = await createTempFolder(`login-pub-${id}`);\n    const yamlContent = YAML.dump({\n      npmRegistryServer: ctx.registryUrl,\n      enableImmutableInstalls: false,\n      unsafeHttpWhitelist: ['localhost'],\n    });\n    await writeFile(join(tf, '.yarnrc.yml'), yamlContent);\n    await writeFile(join(tf, 'package.json'), getPackageJSON(pkgName, '1.0.0'));\n    await writeFile(join(tf, 'README.md'), getREADME(pkgName));\n    if (ctx.adapter.importPlugin) {\n      await ctx.adapter.importPlugin(tf, 'npm-login');\n    }\n    await yarnLogin(ctx, tf, publishUser, publishPassword, publishEmail);\n    await ctx.adapter.exec({ cwd: tf }, 'install');\n    const pubResp = await ctx.adapter.exec({ cwd: tf }, 'publish');\n    assert.ok(\n      pubResp.stdout.includes('Package archive published'),\n      `Expected publish success but got \"${pubResp.stdout}\"`\n    );\n  });\n\n  await ctx.subTest('switch users', async () => {\n    const switchUser1 = `login-switch-a-${id}`;\n    const switchPassword1 = 'switch-password-123';\n    const switchEmail1 = `${switchUser1}@test.example.com`;\n    const user2 = `login-b-${id}`;\n    const password2 = 'other-password-456';\n    const email2 = `${user2}@test.example.com`;\n    const tf = await prepareLoginProject(ctx, `verdaccio-login5-${id}`);\n\n    await yarnLogin(ctx, tf, switchUser1, switchPassword1, switchEmail1);\n    const who1 = await yarnWhoami(ctx, tf);\n    assert.ok(who1.includes(switchUser1), `Expected \"${switchUser1}\" but got \"${who1}\"`);\n\n    await yarnLogin(ctx, tf, user2, password2, email2);\n    const who2 = await yarnWhoami(ctx, tf);\n    assert.ok(who2.includes(user2), `Expected \"${user2}\" after switch but got \"${who2}\"`);\n  });\n}\n\nexport const loginTest: TestDefinition = {\n  name: 'login',\n  requires: ['login'],\n  run: testLogin,\n};\n"],"mappings":";;;;;;;AASA,IAAM,QAAQ,WAAW,8BAA8B;;;;;AAMvD,eAAe,oBAAoB,KAAkB,MAA+B;CAClF,MAAM,4CAA4C,IAAI;CACtD,MAAM,aAAa,MAAM,iBAAiB,IAAI;CAC9C,MAAM,cAAc,KAAK,KAAK;EAC5B,mBAAmB,IAAI;EACvB,yBAAyB;EACzB,qBAAqB,CAAC,WAAW;CACnC,CAAC;CACD,MAAM,UAAU,KAAK,YAAY,aAAa,GAAG,WAAW;CAC5D,MAAM,UAAU,KAAK,YAAY,cAAc,GAAG,KAAK,UAAU;EAAE;EAAM,SAAS;CAAQ,CAAC,CAAC;CAC5F,IAAI,IAAI,QAAQ,cAAc;EAC5B,MAAM,sCAAsC,UAAU;EACtD,MAAM,IAAI,QAAQ,aAAa,YAAY,WAAW;CACxD;CACA,OAAO;AACT;AAEA,eAAe,UACb,KACA,KACA,MACA,UACA,OACA;CACA,MAAM,wBAAwB,IAAI;CAClC,OAAO,IAAI,QAAQ,KACjB,EAAE,IAAI,GACN,SACA,sBACA,UAAU,QACV,cAAc,YACd,WAAW,OACb;AACF;AAEA,eAAe,WAAW,KAAkB,KAA8B;CACxE,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,EAAE,IAAI,GAAG,QAAQ;CACrD,MAAM,uBAAuB,KAAK,MAAM;CACxC,OAAO,KAAK;AACd;AAEA,eAAe,UAAU,KAAiC;CACxD,MAAM,OAAO,IAAI,QAAQ;CACzB,MAAM,KAAK,IAAI;CAEf,IAAI,SAAS,eAAe;EAC1B,MAAM,0DAA0D,IAAI;EACpE;CACF;CAEA,MAAM,QAAQ,WAAW;CACzB,MAAM,YAAY;CAClB,MAAM,SAAS,GAAG,MAAM;CAExB,MAAM,IAAI,QAAQ,4BAA4B,YAAY;EACxD,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,MAAM,YAAY,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACnE,OAAO,GACL,UAAU,OAAO,SAAS,WAAW,KAAK,UAAU,OAAO,SAAS,aAAa,GACjF,2CAA2C,UAAU,OAAO,EAC9D;EACA,MAAM,MAAM,MAAM,WAAW,KAAK,EAAE;EACpC,OAAO,GAAG,IAAI,SAAS,KAAK,GAAG,oBAAoB,MAAM,aAAa,IAAI,EAAE;CAC9E,CAAC;CAED,MAAM,IAAI,QAAQ,kDAAkD,YAAY;EAC9E,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,IAAI,cAAc;EAClB,IAAI;GACF,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACnD,QAAQ;GACN,cAAc;EAChB;EACA,OAAO,GAAG,aAAa,qEAAqE;CAC9F,CAAC;CAED,MAAM,IAAI,QAAQ,wBAAwB,YAAY;EACpD,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,IAAI,cAAc;EAClB,IAAI;GACF,MAAM,UAAU,KAAK,IAAI,OAAO,kBAAkB,MAAM;EAC1D,QAAQ;GACN,cAAc;EAChB;EACA,OAAO,GAAG,aAAa,8CAA8C;CACvE,CAAC;CAED,MAAM,IAAI,QAAQ,sBAAsB,YAAY;EAClD,MAAM,UAAU,wBAAwB;EACxC,MAAM,cAAc,aAAa;EACjC,MAAM,kBAAkB;EACxB,MAAM,eAAe,GAAG,YAAY;EACpC,MAAM,KAAK,MAAM,iBAAiB,aAAa,IAAI;EACnD,MAAM,cAAc,KAAK,KAAK;GAC5B,mBAAmB,IAAI;GACvB,yBAAyB;GACzB,qBAAqB,CAAC,WAAW;EACnC,CAAC;EACD,MAAM,UAAU,KAAK,IAAI,aAAa,GAAG,WAAW;EACpD,MAAM,UAAU,KAAK,IAAI,cAAc,GAAG,eAAe,SAAS,OAAO,CAAC;EAC1E,MAAM,UAAU,KAAK,IAAI,WAAW,GAAG,UAAU,OAAO,CAAC;EACzD,IAAI,IAAI,QAAQ,cACd,MAAM,IAAI,QAAQ,aAAa,IAAI,WAAW;EAEhD,MAAM,UAAU,KAAK,IAAI,aAAa,iBAAiB,YAAY;EACnE,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,GAAG,GAAG,SAAS;EAC7C,MAAM,UAAU,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,GAAG,GAAG,SAAS;EAC7D,OAAO,GACL,QAAQ,OAAO,SAAS,2BAA2B,GACnD,qCAAqC,QAAQ,OAAO,EACtD;CACF,CAAC;CAED,MAAM,IAAI,QAAQ,gBAAgB,YAAY;EAC5C,MAAM,cAAc,kBAAkB;EACtC,MAAM,kBAAkB;EACxB,MAAM,eAAe,GAAG,YAAY;EACpC,MAAM,QAAQ,WAAW;EACzB,MAAM,YAAY;EAClB,MAAM,SAAS,GAAG,MAAM;EACxB,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAElE,MAAM,UAAU,KAAK,IAAI,aAAa,iBAAiB,YAAY;EACnE,MAAM,OAAO,MAAM,WAAW,KAAK,EAAE;EACrC,OAAO,GAAG,KAAK,SAAS,WAAW,GAAG,aAAa,YAAY,aAAa,KAAK,EAAE;EAEnF,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK,EAAE;EACrC,OAAO,GAAG,KAAK,SAAS,KAAK,GAAG,aAAa,MAAM,0BAA0B,KAAK,EAAE;CACtF,CAAC;AACH;AAEA,IAAa,YAA4B;CACvC,MAAM;CACN,UAAU,CAAC,OAAO;CAClB,KAAK;AACP"}

package/build/esm/tests/ping.js

@@ -0,0 +1,24 @@
+import assert from "assert";
+//#region src/tests/ping.ts
+async function testPing(ctx) {
+	const type = ctx.adapter.type;
+	const { tempFolder } = await ctx.adapter.prepareProject(`verdaccio-ping-${ctx.runId}`, "1.0.0", ctx.registryUrl, ctx.port, ctx.token);
+	const cwd = tempFolder;
+	if (type === "yarn-modern" && ctx.adapter.importPlugin) await ctx.adapter.importPlugin(tempFolder, "npm-ping");
+	const jsonFlag = type === "yarn-modern" ? [] : ["--json"];
+	const resp = await ctx.adapter.exec({ cwd }, "ping", ...jsonFlag, ...ctx.adapter.registryArg(ctx.registryUrl));
+	if (type === "yarn-modern") assert.ok(true, "ping succeeded");
+	else {
+		const parsedBody = JSON.parse(resp.stdout);
+		assert.strictEqual(parsedBody.registry, ctx.registryUrl + "/", `Expected registry "${ctx.registryUrl}/" but got "${parsedBody.registry}"`);
+	}
+}
+var pingTest = {
+	name: "ping",
+	requires: ["ping"],
+	run: testPing
+};
+//#endregion
+export { pingTest };
+
+//# sourceMappingURL=ping.js.map

package/build/esm/tests/ping.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ping.js","names":[],"sources":["../../../src/tests/ping.ts"],"sourcesContent":["import assert from 'assert';\n\nimport { TestContext, TestDefinition } from '../types';\n\nasync function testPing(ctx: TestContext): Promise<void> {\n  const type = ctx.adapter.type;\n\n  // Always run from a prepared project: its .npmrc carries the fresh token and\n  // shields the test from whatever the developer's global ~/.npmrc has for\n  // this registry (a stale token there would turn into a spurious E401).\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    `verdaccio-ping-${ctx.runId}`,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token\n  );\n  const cwd = tempFolder;\n  if (type === 'yarn-modern' && ctx.adapter.importPlugin) {\n    await ctx.adapter.importPlugin(tempFolder, 'npm-ping');\n  }\n\n  const jsonFlag = type === 'yarn-modern' ? [] : ['--json'];\n  const resp = await ctx.adapter.exec(\n    { cwd },\n    'ping',\n    ...jsonFlag,\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n\n  if (type === 'yarn-modern') {\n    // yarn npm ping succeeding (exit code 0) is sufficient proof the registry is reachable\n    assert.ok(true, 'ping succeeded');\n  } else {\n    const parsedBody = JSON.parse(resp.stdout);\n    assert.strictEqual(\n      parsedBody.registry,\n      ctx.registryUrl + '/',\n      `Expected registry \"${ctx.registryUrl}/\" but got \"${parsedBody.registry}\"`\n    );\n  }\n}\n\nexport const pingTest: TestDefinition = {\n  name: 'ping',\n  requires: ['ping'],\n  run: testPing,\n};\n"],"mappings":";;AAIA,eAAe,SAAS,KAAiC;CACvD,MAAM,OAAO,IAAI,QAAQ;CAKzB,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,kBAAkB,IAAI,SACtB,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;CACA,MAAM,MAAM;CACZ,IAAI,SAAS,iBAAiB,IAAI,QAAQ,cACxC,MAAM,IAAI,QAAQ,aAAa,YAAY,UAAU;CAGvD,MAAM,WAAW,SAAS,gBAAgB,CAAC,IAAI,CAAC,QAAQ;CACxD,MAAM,OAAO,MAAM,IAAI,QAAQ,KAC7B,EAAE,IAAI,GACN,QACA,GAAG,UACH,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CAEA,IAAI,SAAS,eAEX,OAAO,GAAG,MAAM,gBAAgB;MAC3B;EACL,MAAM,aAAa,KAAK,MAAM,KAAK,MAAM;EACzC,OAAO,YACL,WAAW,UACX,IAAI,cAAc,KAClB,sBAAsB,IAAI,YAAY,cAAc,WAAW,SAAS,EAC1E;CACF;AACF;AAEA,IAAa,WAA2B;CACtC,MAAM;CACN,UAAU,CAAC,MAAM;CACjB,KAAK;AACP"}

package/build/esm/tests/publish.js

@@ -0,0 +1,34 @@
+import assert from "assert";
+//#region src/tests/publish.ts
+async function testPublish(ctx) {
+	const packages = [
+		`verdaccio-memory-${ctx.runId}`,
+		`verdaccio-${ctx.runId}`,
+		`@verdaccio/foo-${ctx.runId}`,
+		`@verdaccio/some-foo-${ctx.runId}`
+	];
+	const type = ctx.adapter.type;
+	for (const pkgName of packages) {
+		const { tempFolder } = await ctx.adapter.prepareProject(pkgName, "1.0.0", ctx.registryUrl, ctx.port, ctx.token);
+		if (type === "yarn-modern") await ctx.adapter.exec({ cwd: tempFolder }, "install");
+		const resp = await ctx.adapter.exec({ cwd: tempFolder }, "publish", "--json", ...ctx.adapter.registryArg(ctx.registryUrl));
+		if (type === "yarn-modern") assert.ok(resp.stdout.match(/Package archive published/), `Expected "Package archive published" for ${pkgName} but got "${resp.stdout}"`);
+		else if (type === "bun") assert.ok(true, `Publish succeeded for ${pkgName}`);
+		else try {
+			const parsedBody = JSON.parse(resp.stdout);
+			assert.strictEqual(parsedBody.name, pkgName, `Expected package name "${pkgName}" but got "${parsedBody.name}"`);
+			assert.ok(parsedBody.files, `Expected files to be defined for ${pkgName}`);
+		} catch {
+			assert.ok(true, `Publish succeeded for ${pkgName}`);
+		}
+	}
+}
+var publishTest = {
+	name: "publish",
+	requires: ["publish"],
+	run: testPublish
+};
+//#endregion
+export { publishTest };
+
+//# sourceMappingURL=publish.js.map

package/build/esm/tests/publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.js","names":[],"sources":["../../../src/tests/publish.ts"],"sourcesContent":["import assert from 'assert';\n\nimport { TestContext, TestDefinition } from '../types';\n\nasync function testPublish(ctx: TestContext): Promise<void> {\n  const packages = [\n    `verdaccio-memory-${ctx.runId}`,\n    `verdaccio-${ctx.runId}`,\n    `@verdaccio/foo-${ctx.runId}`,\n    `@verdaccio/some-foo-${ctx.runId}`,\n  ];\n\n  const type = ctx.adapter.type;\n\n  for (const pkgName of packages) {\n    const { tempFolder } = await ctx.adapter.prepareProject(\n      pkgName,\n      '1.0.0',\n      ctx.registryUrl,\n      ctx.port,\n      ctx.token\n    );\n\n    // yarn modern requires install before publish to generate lockfile\n    if (type === 'yarn-modern') {\n      await ctx.adapter.exec({ cwd: tempFolder }, 'install');\n    }\n\n    const resp = await ctx.adapter.exec(\n      { cwd: tempFolder },\n      'publish',\n      '--json',\n      ...ctx.adapter.registryArg(ctx.registryUrl)\n    );\n\n    if (type === 'yarn-modern') {\n      assert.ok(\n        resp.stdout.match(/Package archive published/),\n        `Expected \"Package archive published\" for ${pkgName} but got \"${resp.stdout}\"`\n      );\n    } else if (type === 'bun') {\n      // bun publish outputs text confirmation — exit code 0 is sufficient\n      assert.ok(true, `Publish succeeded for ${pkgName}`);\n    } else {\n      // npm / pnpm\n      try {\n        const parsedBody = JSON.parse(resp.stdout);\n        assert.strictEqual(\n          parsedBody.name,\n          pkgName,\n          `Expected package name \"${pkgName}\" but got \"${parsedBody.name}\"`\n        );\n        assert.ok(parsedBody.files, `Expected files to be defined for ${pkgName}`);\n      } catch {\n        // pnpm v11+ native publish doesn't output JSON — exit code 0 is sufficient\n        assert.ok(true, `Publish succeeded for ${pkgName}`);\n      }\n    }\n  }\n}\n\nexport const publishTest: TestDefinition = {\n  name: 'publish',\n  requires: ['publish'],\n  run: testPublish,\n};\n"],"mappings":";;AAIA,eAAe,YAAY,KAAiC;CAC1D,MAAM,WAAW;EACf,oBAAoB,IAAI;EACxB,aAAa,IAAI;EACjB,kBAAkB,IAAI;EACtB,uBAAuB,IAAI;CAC7B;CAEA,MAAM,OAAO,IAAI,QAAQ;CAEzB,KAAK,MAAM,WAAW,UAAU;EAC9B,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,SACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;EAGA,IAAI,SAAS,eACX,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,WAAW,GAAG,SAAS;EAGvD,MAAM,OAAO,MAAM,IAAI,QAAQ,KAC7B,EAAE,KAAK,WAAW,GAClB,WACA,UACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EAEA,IAAI,SAAS,eACX,OAAO,GACL,KAAK,OAAO,MAAM,2BAA2B,GAC7C,4CAA4C,QAAQ,YAAY,KAAK,OAAO,EAC9E;OACK,IAAI,SAAS,OAElB,OAAO,GAAG,MAAM,yBAAyB,SAAS;OAGlD,IAAI;GACF,MAAM,aAAa,KAAK,MAAM,KAAK,MAAM;GACzC,OAAO,YACL,WAAW,MACX,SACA,0BAA0B,QAAQ,aAAa,WAAW,KAAK,EACjE;GACA,OAAO,GAAG,WAAW,OAAO,oCAAoC,SAAS;EAC3E,QAAQ;GAEN,OAAO,GAAG,MAAM,yBAAyB,SAAS;EACpD;CAEJ;AACF;AAEA,IAAa,cAA8B;CACzC,MAAM;CACN,UAAU,CAAC,SAAS;CACpB,KAAK;AACP"}

package/build/esm/tests/search.js

@@ -0,0 +1,21 @@
+import { publishLocalPackage } from "../utils/publish.js";
+import assert from "assert";
+//#region src/tests/search.ts
+async function testSearch(ctx) {
+	const pkgName = `verdaccio-search-${ctx.runId}`;
+	await publishLocalPackage(ctx, pkgName, "1.0.0");
+	const { tempFolder } = await ctx.adapter.prepareProject(`search-client-${ctx.runId}`, "1.0.0", ctx.registryUrl, ctx.port, ctx.token);
+	const resp = await ctx.adapter.exec({ cwd: tempFolder }, "search", pkgName, "--json", ...ctx.adapter.registryArg(ctx.registryUrl));
+	const pkgFind = JSON.parse(resp.stdout).find((item) => item.name === pkgName);
+	assert.ok(pkgFind, `Expected to find ${pkgName} in search results`);
+	assert.strictEqual(pkgFind.name, pkgName);
+}
+var searchTest = {
+	name: "search",
+	requires: ["search", "publish"],
+	run: testSearch
+};
+//#endregion
+export { searchTest };
+
+//# sourceMappingURL=search.js.map

package/build/esm/tests/search.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"search.js","names":[],"sources":["../../../src/tests/search.ts"],"sourcesContent":["import assert from 'assert';\n\nimport { TestContext, TestDefinition } from '../types';\nimport { publishLocalPackage } from '../utils/publish';\n\nasync function testSearch(ctx: TestContext): Promise<void> {\n  // Publish the package we search for — searching an npmjs package would need\n  // an uplink and the suite must run offline.\n  const pkgName = `verdaccio-search-${ctx.runId}`;\n  await publishLocalPackage(ctx, pkgName, '1.0.0');\n\n  // Run from a prepared project so its .npmrc (fresh token) shields the test\n  // from stale credentials in the developer's global ~/.npmrc.\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    `search-client-${ctx.runId}`,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token\n  );\n\n  const resp = await ctx.adapter.exec(\n    { cwd: tempFolder },\n    'search',\n    pkgName,\n    '--json',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n  const parsedBody = JSON.parse(resp.stdout);\n  const pkgFind = parsedBody.find((item: any) => item.name === pkgName);\n  assert.ok(pkgFind, `Expected to find ${pkgName} in search results`);\n  assert.strictEqual(pkgFind.name, pkgName);\n}\n\nexport const searchTest: TestDefinition = {\n  name: 'search',\n  requires: ['search', 'publish'],\n  run: testSearch,\n};\n"],"mappings":";;;AAKA,eAAe,WAAW,KAAiC;CAGzD,MAAM,UAAU,oBAAoB,IAAI;CACxC,MAAM,oBAAoB,KAAK,SAAS,OAAO;CAI/C,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,iBAAiB,IAAI,SACrB,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;CAEA,MAAM,OAAO,MAAM,IAAI,QAAQ,KAC7B,EAAE,KAAK,WAAW,GAClB,UACA,SACA,UACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CAEA,MAAM,UADa,KAAK,MAAM,KAAK,MACnB,CAAA,CAAW,MAAM,SAAc,KAAK,SAAS,OAAO;CACpE,OAAO,GAAG,SAAS,oBAAoB,QAAQ,mBAAmB;CAClE,OAAO,YAAY,QAAQ,MAAM,OAAO;AAC1C;AAEA,IAAa,aAA6B;CACxC,MAAM;CACN,UAAU,CAAC,UAAU,SAAS;CAC9B,KAAK;AACP"}

package/build/esm/tests/unpublish.js

@@ -0,0 +1,38 @@
+import assert from "assert";
+//#region src/tests/unpublish.ts
+async function publishPkg(ctx, tempFolder) {
+	await ctx.adapter.exec({ cwd: tempFolder }, "publish", "--json", ...ctx.adapter.registryArg(ctx.registryUrl));
+}
+async function bumpVersion(ctx, tempFolder, bump) {
+	await ctx.adapter.exec({ cwd: tempFolder }, "version", bump, "--no--git-tag-version", "--loglevel=info", ...ctx.adapter.registryArg(ctx.registryUrl));
+}
+async function testUnpublish(ctx) {
+	const id = ctx.runId;
+	const pkgName = `@verdaccio/unpub1-${id}`;
+	const { tempFolder } = await ctx.adapter.prepareProject(pkgName, "1.0.0", ctx.registryUrl, ctx.port, ctx.token);
+	await publishPkg(ctx, tempFolder);
+	await bumpVersion(ctx, tempFolder, "minor");
+	await publishPkg(ctx, tempFolder);
+	await bumpVersion(ctx, tempFolder, "minor");
+	await publishPkg(ctx, tempFolder);
+	await bumpVersion(ctx, tempFolder, "major");
+	await publishPkg(ctx, tempFolder);
+	const resp = await ctx.adapter.exec({ cwd: tempFolder }, "unpublish", pkgName, "--force", "--loglevel=info", "--json", ...ctx.adapter.registryArg(ctx.registryUrl));
+	assert.ok(resp.stdout.includes(pkgName), `Expected unpublish output to contain "${pkgName}" but got "${resp.stdout}"`);
+	const pkgName2 = `@verdaccio/unpub2-${id}`;
+	const { tempFolder: tf2 } = await ctx.adapter.prepareProject(pkgName2, "1.0.0", ctx.registryUrl, ctx.port, ctx.token);
+	await publishPkg(ctx, tf2);
+	await bumpVersion(ctx, tf2, "minor");
+	await publishPkg(ctx, tf2);
+	const resp2 = await ctx.adapter.exec({ cwd: tf2 }, "unpublish", `${pkgName2}@1.0.0`, "--force", "--loglevel=info", "--json", ...ctx.adapter.registryArg(ctx.registryUrl));
+	assert.ok(resp2.stdout.includes(pkgName2), `Expected unpublish output to contain "${pkgName2}" but got "${resp2.stdout}"`);
+}
+var unpublishTest = {
+	name: "unpublish",
+	requires: ["unpublish"],
+	run: testUnpublish
+};
+//#endregion
+export { unpublishTest };
+
+//# sourceMappingURL=unpublish.js.map

package/build/esm/tests/unpublish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unpublish.js","names":[],"sources":["../../../src/tests/unpublish.ts"],"sourcesContent":["import assert from 'assert';\n\nimport { TestContext, TestDefinition } from '../types';\n\nasync function publishPkg(ctx: TestContext, tempFolder: string) {\n  await ctx.adapter.exec(\n    { cwd: tempFolder },\n    'publish',\n    '--json',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n}\n\nasync function bumpVersion(ctx: TestContext, tempFolder: string, bump: string) {\n  await ctx.adapter.exec(\n    { cwd: tempFolder },\n    'version',\n    bump,\n    '--no--git-tag-version',\n    '--loglevel=info',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n}\n\nasync function testUnpublish(ctx: TestContext): Promise<void> {\n  const id = ctx.runId;\n\n  // Test 1: unpublish a full package\n  const pkgName = `@verdaccio/unpub1-${id}`;\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    pkgName,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token\n  );\n  await publishPkg(ctx, tempFolder);\n  await bumpVersion(ctx, tempFolder, 'minor');\n  await publishPkg(ctx, tempFolder);\n  await bumpVersion(ctx, tempFolder, 'minor');\n  await publishPkg(ctx, tempFolder);\n  await bumpVersion(ctx, tempFolder, 'major');\n  await publishPkg(ctx, tempFolder);\n\n  const resp = await ctx.adapter.exec(\n    { cwd: tempFolder },\n    'unpublish',\n    pkgName,\n    '--force',\n    '--loglevel=info',\n    '--json',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n  assert.ok(\n    resp.stdout.includes(pkgName),\n    `Expected unpublish output to contain \"${pkgName}\" but got \"${resp.stdout}\"`\n  );\n\n  // Test 2: unpublish a specific version\n  const pkgName2 = `@verdaccio/unpub2-${id}`;\n  const { tempFolder: tf2 } = await ctx.adapter.prepareProject(\n    pkgName2,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token\n  );\n  await publishPkg(ctx, tf2);\n  await bumpVersion(ctx, tf2, 'minor');\n  await publishPkg(ctx, tf2);\n\n  const resp2 = await ctx.adapter.exec(\n    { cwd: tf2 },\n    'unpublish',\n    `${pkgName2}@1.0.0`,\n    '--force',\n    '--loglevel=info',\n    '--json',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n  assert.ok(\n    resp2.stdout.includes(pkgName2),\n    `Expected unpublish output to contain \"${pkgName2}\" but got \"${resp2.stdout}\"`\n  );\n}\n\nexport const unpublishTest: TestDefinition = {\n  name: 'unpublish',\n  requires: ['unpublish'],\n  run: testUnpublish,\n};\n"],"mappings":";;AAIA,eAAe,WAAW,KAAkB,YAAoB;CAC9D,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,UACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;AACF;AAEA,eAAe,YAAY,KAAkB,YAAoB,MAAc;CAC7E,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,MACA,yBACA,mBACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;AACF;AAEA,eAAe,cAAc,KAAiC;CAC5D,MAAM,KAAK,IAAI;CAGf,MAAM,UAAU,qBAAqB;CACrC,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,SACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;CACA,MAAM,WAAW,KAAK,UAAU;CAChC,MAAM,YAAY,KAAK,YAAY,OAAO;CAC1C,MAAM,WAAW,KAAK,UAAU;CAChC,MAAM,YAAY,KAAK,YAAY,OAAO;CAC1C,MAAM,WAAW,KAAK,UAAU;CAChC,MAAM,YAAY,KAAK,YAAY,OAAO;CAC1C,MAAM,WAAW,KAAK,UAAU;CAEhC,MAAM,OAAO,MAAM,IAAI,QAAQ,KAC7B,EAAE,KAAK,WAAW,GAClB,aACA,SACA,WACA,mBACA,UACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CACA,OAAO,GACL,KAAK,OAAO,SAAS,OAAO,GAC5B,yCAAyC,QAAQ,aAAa,KAAK,OAAO,EAC5E;CAGA,MAAM,WAAW,qBAAqB;CACtC,MAAM,EAAE,YAAY,QAAQ,MAAM,IAAI,QAAQ,eAC5C,UACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;CACA,MAAM,WAAW,KAAK,GAAG;CACzB,MAAM,YAAY,KAAK,KAAK,OAAO;CACnC,MAAM,WAAW,KAAK,GAAG;CAEzB,MAAM,QAAQ,MAAM,IAAI,QAAQ,KAC9B,EAAE,KAAK,IAAI,GACX,aACA,GAAG,SAAS,SACZ,WACA,mBACA,UACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CACA,OAAO,GACL,MAAM,OAAO,SAAS,QAAQ,GAC9B,yCAAyC,SAAS,aAAa,MAAM,OAAO,EAC9E;AACF;AAEA,IAAa,gBAAgC;CAC3C,MAAM;CACN,UAAU,CAAC,WAAW;CACtB,KAAK;AACP"}

package/build/esm/utils/e2e-config.js

@@ -0,0 +1,58 @@
+//#region src/utils/e2e-config.ts
+/**
+* Recommended Verdaccio config for running the full e2e-cli battery,
+* printed by `verdaccio-e2e --print-config`. It is what the consuming repos'
+* CI jobs and scripts/run-e2e.sh feed to `verdaccio --config`:
+*
+*   - max_body_size raised so scenario:tarballs can publish ~30 MB packages
+*     (Verdaccio's default is 10mb)
+*   - an `e2emock` uplink + `e2e-uplink-*` package pattern wired to the mock
+*     uplink server that scenario:uplink-failure starts on E2E_UPLINK_PORT
+*     (short timeout so the "slow uplink" case completes quickly; high
+*     max_fails so simulated failures don't trip the circuit breaker for
+*     later sub-tests)
+*   - NO npmjs uplink: the whole suite publishes every package it consumes,
+*     so the registry under test never talks to the outside world and the
+*     battery runs fully offline (and deterministically in CI)
+*
+* Relative paths (storage/htpasswd) resolve next to the config file, so write
+* it into a disposable directory.
+*/
+var DEFAULT_UPLINK_PORT = 4874;
+function buildE2EConfig(uplinkPort = DEFAULT_UPLINK_PORT) {
+	return `# Generated by @verdaccio/e2e-cli --print-config
+storage: ./storage
+auth:
+  htpasswd:
+    file: ./htpasswd
+    max_users: 1000
+web:
+  enable: true
+  title: Verdaccio E2E
+max_body_size: 100mb
+uplinks:
+  e2emock:
+    url: http://localhost:${uplinkPort}/
+    timeout: 3s
+    retry: 0
+    max_fails: 100
+    fail_timeout: 1s
+packages:
+  'e2e-uplink-*':
+    access: $all
+    proxy: e2emock
+  '@*/*':
+    access: $all
+    publish: $authenticated
+    unpublish: $authenticated
+  '**':
+    access: $all
+    publish: $authenticated
+    unpublish: $authenticated
+log: { type: stdout, format: pretty, level: warn }
+`;
+}
+//#endregion
+export { DEFAULT_UPLINK_PORT, buildE2EConfig };
+
+//# sourceMappingURL=e2e-config.js.map

package/build/esm/utils/e2e-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2e-config.js","names":[],"sources":["../../../src/utils/e2e-config.ts"],"sourcesContent":["/**\n * Recommended Verdaccio config for running the full e2e-cli battery,\n * printed by `verdaccio-e2e --print-config`. It is what the consuming repos'\n * CI jobs and scripts/run-e2e.sh feed to `verdaccio --config`:\n *\n *   - max_body_size raised so scenario:tarballs can publish ~30 MB packages\n *     (Verdaccio's default is 10mb)\n *   - an `e2emock` uplink + `e2e-uplink-*` package pattern wired to the mock\n *     uplink server that scenario:uplink-failure starts on E2E_UPLINK_PORT\n *     (short timeout so the \"slow uplink\" case completes quickly; high\n *     max_fails so simulated failures don't trip the circuit breaker for\n *     later sub-tests)\n *   - NO npmjs uplink: the whole suite publishes every package it consumes,\n *     so the registry under test never talks to the outside world and the\n *     battery runs fully offline (and deterministically in CI)\n *\n * Relative paths (storage/htpasswd) resolve next to the config file, so write\n * it into a disposable directory.\n */\nexport const DEFAULT_UPLINK_PORT = 4874;\n\nexport function buildE2EConfig(uplinkPort: number = DEFAULT_UPLINK_PORT): string {\n  return `# Generated by @verdaccio/e2e-cli --print-config\nstorage: ./storage\nauth:\n  htpasswd:\n    file: ./htpasswd\n    max_users: 1000\nweb:\n  enable: true\n  title: Verdaccio E2E\nmax_body_size: 100mb\nuplinks:\n  e2emock:\n    url: http://localhost:${uplinkPort}/\n    timeout: 3s\n    retry: 0\n    max_fails: 100\n    fail_timeout: 1s\npackages:\n  'e2e-uplink-*':\n    access: $all\n    proxy: e2emock\n  '@*/*':\n    access: $all\n    publish: $authenticated\n    unpublish: $authenticated\n  '**':\n    access: $all\n    publish: $authenticated\n    unpublish: $authenticated\nlog: { type: stdout, format: pretty, level: warn }\n`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAmBA,IAAa,sBAAsB;AAEnC,SAAgB,eAAe,aAAqB,qBAA6B;CAC/E,OAAO;;;;;;;;;;;;4BAYmB,WAAW;;;;;;;;;;;;;;;;;;;AAmBvC"}

package/build/esm/utils/http-client.js

@@ -0,0 +1,105 @@
+import buildDebug from "debug";
+import { createHash } from "crypto";
+import { get } from "http";
+//#region src/utils/http-client.ts
+var debug = buildDebug("verdaccio:e2e-cli:http-client");
+var ABBREVIATED_ACCEPT = "application/vnd.npm.install-v1+json";
+/**
+* Registry URL for a package name. Scoped names are encoded with the same
+* `%2f` form npm clients use: `@scope%2fname`.
+*/
+function packumentUrl(registryUrl, pkgName) {
+	const encoded = pkgName.startsWith("@") ? pkgName.replaceAll("/", "%2f") : pkgName;
+	return `${registryUrl.replace(/\/$/, "")}/${encoded}`;
+}
+async function fetchPackument(registryUrl, pkgName, options = {}) {
+	const url = packumentUrl(registryUrl, pkgName);
+	const headers = {};
+	if (options.abbreviated) headers["Accept"] = ABBREVIATED_ACCEPT;
+	if (options.etag) headers["If-None-Match"] = options.etag;
+	if (options.token) headers["Authorization"] = `Bearer ${options.token}`;
+	debug("GET %s %o", url, headers);
+	if (options.etag) return new Promise((resolve, reject) => {
+		get(url, { headers }, (response) => {
+			let text = "";
+			response.setEncoding("utf8");
+			response.on("data", (chunk) => text += chunk);
+			response.on("end", () => {
+				let body;
+				try {
+					body = JSON.parse(text);
+				} catch {
+					body = void 0;
+				}
+				const responseHeaders = new Headers();
+				for (const [name, value] of Object.entries(response.headers)) if (value !== void 0) responseHeaders.set(name, Array.isArray(value) ? value.join(", ") : value);
+				resolve({
+					status: response.statusCode || 0,
+					headers: responseHeaders,
+					body
+				});
+			});
+		}).on("error", reject);
+	});
+	const response = await fetch(url, { headers });
+	let body;
+	if (response.status !== 304) {
+		const text = await response.text();
+		try {
+			body = JSON.parse(text);
+		} catch {
+			body = void 0;
+		}
+	}
+	return {
+		status: response.status,
+		headers: response.headers,
+		body
+	};
+}
+/**
+* Download a tarball fully, computing sha1/sha512 integrity on the fly.
+* Rejects with the underlying error when aborted or the connection drops.
+*/
+async function downloadTarball(url, options = {}) {
+	const headers = {};
+	if (options.token) headers["Authorization"] = `Bearer ${options.token}`;
+	debug("GET (tarball) %s", url);
+	const response = await fetch(url, {
+		headers,
+		signal: options.signal
+	});
+	const sha1 = createHash("sha1");
+	const sha512 = createHash("sha512");
+	let bytes = 0;
+	let first = true;
+	if (response.body) for await (const chunk of response.body) {
+		const buf = Buffer.from(chunk);
+		bytes += buf.length;
+		sha1.update(buf);
+		sha512.update(buf);
+		if (first) {
+			first = false;
+			options.onFirstChunk?.();
+		}
+		options.onChunk?.(bytes);
+	}
+	return {
+		status: response.status,
+		headers: response.headers,
+		bytes,
+		sha1: sha1.digest("hex"),
+		integrity: `sha512-${sha512.digest("base64")}`
+	};
+}
+/** Compute npm-style dist values (shasum/integrity) for a buffer. */
+function computeDist(buffer) {
+	return {
+		shasum: createHash("sha1").update(buffer).digest("hex"),
+		integrity: `sha512-${createHash("sha512").update(buffer).digest("base64")}`
+	};
+}
+//#endregion
+export { ABBREVIATED_ACCEPT, computeDist, downloadTarball, fetchPackument, packumentUrl };
+
+//# sourceMappingURL=http-client.js.map

package/build/esm/utils/http-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-client.js","names":[],"sources":["../../../src/utils/http-client.ts"],"sourcesContent":["import { createHash } from 'crypto';\nimport buildDebug from 'debug';\nimport { get } from 'http';\n\nconst debug = buildDebug('verdaccio:e2e-cli:http-client');\n\nexport type PackumentResponse = {\n  status: number;\n  headers: Headers;\n  /** Parsed JSON body, or undefined when the response is not JSON (e.g. 304) */\n  body?: any;\n};\n\nexport type TarballDownload = {\n  status: number;\n  headers: Headers;\n  /** Total bytes received */\n  bytes: number;\n  /** hex-encoded sha1 of the received bytes (matches dist.shasum) */\n  sha1: string;\n  /** `sha512-<base64>` of the received bytes (matches dist.integrity) */\n  integrity: string;\n};\n\nexport type FetchPackumentOptions = {\n  /** Request the abbreviated (install) metadata format */\n  abbreviated?: boolean;\n  /** Send If-None-Match with this value */\n  etag?: string;\n  /** Bearer token */\n  token?: string;\n};\n\nexport const ABBREVIATED_ACCEPT = 'application/vnd.npm.install-v1+json';\n\n/**\n * Registry URL for a package name. Scoped names are encoded with the same\n * `%2f` form npm clients use: `@scope%2fname`.\n */\nexport function packumentUrl(registryUrl: string, pkgName: string): string {\n  const encoded = pkgName.startsWith('@') ? pkgName.replaceAll('/', '%2f') : pkgName;\n  return `${registryUrl.replace(/\\/$/, '')}/${encoded}`;\n}\n\nexport async function fetchPackument(\n  registryUrl: string,\n  pkgName: string,\n  options: FetchPackumentOptions = {}\n): Promise<PackumentResponse> {\n  const url = packumentUrl(registryUrl, pkgName);\n  const headers: Record<string, string> = {};\n  if (options.abbreviated) {\n    headers['Accept'] = ABBREVIATED_ACCEPT;\n  }\n  if (options.etag) {\n    headers['If-None-Match'] = options.etag;\n  }\n  if (options.token) {\n    headers['Authorization'] = `Bearer ${options.token}`;\n  }\n  debug('GET %s %o', url, headers);\n\n  // Conditional requests must bypass fetch(): undici appends\n  // `cache-control: no-cache` whenever If-None-Match is present, which\n  // (correctly, per HTTP semantics) disables the server's 304 revalidation.\n  if (options.etag) {\n    return new Promise((resolve, reject) => {\n      get(url, { headers }, (response) => {\n        let text = '';\n        response.setEncoding('utf8');\n        response.on('data', (chunk) => (text += chunk));\n        response.on('end', () => {\n          let body: any;\n          try {\n            body = JSON.parse(text);\n          } catch {\n            body = undefined;\n          }\n          const responseHeaders = new Headers();\n          for (const [name, value] of Object.entries(response.headers)) {\n            if (value !== undefined) {\n              responseHeaders.set(name, Array.isArray(value) ? value.join(', ') : value);\n            }\n          }\n          resolve({ status: response.statusCode || 0, headers: responseHeaders, body });\n        });\n      }).on('error', reject);\n    });\n  }\n\n  const response = await fetch(url, { headers });\n  let body: any;\n  if (response.status !== 304) {\n    const text = await response.text();\n    try {\n      body = JSON.parse(text);\n    } catch {\n      body = undefined;\n    }\n  }\n  return { status: response.status, headers: response.headers, body };\n}\n\nexport type DownloadTarballOptions = {\n  signal?: AbortSignal;\n  token?: string;\n  /** Called after the first chunk of the body arrives (useful to abort mid-stream) */\n  onFirstChunk?: () => void;\n  /** Called after every chunk with the total bytes received so far (useful to abort at a threshold) */\n  onChunk?: (bytesReceived: number) => void;\n};\n\n/**\n * Download a tarball fully, computing sha1/sha512 integrity on the fly.\n * Rejects with the underlying error when aborted or the connection drops.\n */\nexport async function downloadTarball(\n  url: string,\n  options: DownloadTarballOptions = {}\n): Promise<TarballDownload> {\n  const headers: Record<string, string> = {};\n  if (options.token) {\n    headers['Authorization'] = `Bearer ${options.token}`;\n  }\n  debug('GET (tarball) %s', url);\n  const response = await fetch(url, { headers, signal: options.signal });\n\n  const sha1 = createHash('sha1');\n  const sha512 = createHash('sha512');\n  let bytes = 0;\n  let first = true;\n\n  if (response.body) {\n    for await (const chunk of response.body as any) {\n      const buf = Buffer.from(chunk);\n      bytes += buf.length;\n      sha1.update(buf);\n      sha512.update(buf);\n      if (first) {\n        first = false;\n        options.onFirstChunk?.();\n      }\n      options.onChunk?.(bytes);\n    }\n  }\n\n  return {\n    status: response.status,\n    headers: response.headers,\n    bytes,\n    sha1: sha1.digest('hex'),\n    integrity: `sha512-${sha512.digest('base64')}`,\n  };\n}\n\n/** Compute npm-style dist values (shasum/integrity) for a buffer. */\nexport function computeDist(buffer: Buffer): { shasum: string; integrity: string } {\n  return {\n    shasum: createHash('sha1').update(buffer).digest('hex'),\n    integrity: `sha512-${createHash('sha512').update(buffer).digest('base64')}`,\n  };\n}\n"],"mappings":";;;;AAIA,IAAM,QAAQ,WAAW,+BAA+B;AA6BxD,IAAa,qBAAqB;;;;;AAMlC,SAAgB,aAAa,aAAqB,SAAyB;CACzE,MAAM,UAAU,QAAQ,WAAW,GAAG,IAAI,QAAQ,WAAW,KAAK,KAAK,IAAI;CAC3E,OAAO,GAAG,YAAY,QAAQ,OAAO,EAAE,EAAE,GAAG;AAC9C;AAEA,eAAsB,eACpB,aACA,SACA,UAAiC,CAAC,GACN;CAC5B,MAAM,MAAM,aAAa,aAAa,OAAO;CAC7C,MAAM,UAAkC,CAAC;CACzC,IAAI,QAAQ,aACV,QAAQ,YAAY;CAEtB,IAAI,QAAQ,MACV,QAAQ,mBAAmB,QAAQ;CAErC,IAAI,QAAQ,OACV,QAAQ,mBAAmB,UAAU,QAAQ;CAE/C,MAAM,aAAa,KAAK,OAAO;CAK/B,IAAI,QAAQ,MACV,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,IAAI,KAAK,EAAE,QAAQ,IAAI,aAAa;GAClC,IAAI,OAAO;GACX,SAAS,YAAY,MAAM;GAC3B,SAAS,GAAG,SAAS,UAAW,QAAQ,KAAM;GAC9C,SAAS,GAAG,aAAa;IACvB,IAAI;IACJ,IAAI;KACF,OAAO,KAAK,MAAM,IAAI;IACxB,QAAQ;KACN,OAAO,KAAA;IACT;IACA,MAAM,kBAAkB,IAAI,QAAQ;IACpC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,SAAS,OAAO,GACzD,IAAI,UAAU,KAAA,GACZ,gBAAgB,IAAI,MAAM,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK;IAG7E,QAAQ;KAAE,QAAQ,SAAS,cAAc;KAAG,SAAS;KAAiB;IAAK,CAAC;GAC9E,CAAC;EACH,CAAC,CAAC,CAAC,GAAG,SAAS,MAAM;CACvB,CAAC;CAGH,MAAM,WAAW,MAAM,MAAM,KAAK,EAAE,QAAQ,CAAC;CAC7C,IAAI;CACJ,IAAI,SAAS,WAAW,KAAK;EAC3B,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,IAAI;GACF,OAAO,KAAK,MAAM,IAAI;EACxB,QAAQ;GACN,OAAO,KAAA;EACT;CACF;CACA,OAAO;EAAE,QAAQ,SAAS;EAAQ,SAAS,SAAS;EAAS;CAAK;AACpE;;;;;AAeA,eAAsB,gBACpB,KACA,UAAkC,CAAC,GACT;CAC1B,MAAM,UAAkC,CAAC;CACzC,IAAI,QAAQ,OACV,QAAQ,mBAAmB,UAAU,QAAQ;CAE/C,MAAM,oBAAoB,GAAG;CAC7B,MAAM,WAAW,MAAM,MAAM,KAAK;EAAE;EAAS,QAAQ,QAAQ;CAAO,CAAC;CAErE,MAAM,OAAO,WAAW,MAAM;CAC9B,MAAM,SAAS,WAAW,QAAQ;CAClC,IAAI,QAAQ;CACZ,IAAI,QAAQ;CAEZ,IAAI,SAAS,MACX,WAAW,MAAM,SAAS,SAAS,MAAa;EAC9C,MAAM,MAAM,OAAO,KAAK,KAAK;EAC7B,SAAS,IAAI;EACb,KAAK,OAAO,GAAG;EACf,OAAO,OAAO,GAAG;EACjB,IAAI,OAAO;GACT,QAAQ;GACR,QAAQ,eAAe;EACzB;EACA,QAAQ,UAAU,KAAK;CACzB;CAGF,OAAO;EACL,QAAQ,SAAS;EACjB,SAAS,SAAS;EAClB;EACA,MAAM,KAAK,OAAO,KAAK;EACvB,WAAW,UAAU,OAAO,OAAO,QAAQ;CAC7C;AACF;;AAGA,SAAgB,YAAY,QAAuD;CACjF,OAAO;EACL,QAAQ,WAAW,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,OAAO,KAAK;EACtD,WAAW,UAAU,WAAW,QAAQ,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,OAAO,QAAQ;CAC1E;AACF"}

package/build/esm/utils/info.js

@@ -0,0 +1,24 @@
+//#region src/utils/info.ts
+/**
+* Normalize the parsed output of `npm/pnpm info <pkg> --json`.
+*
+* npm 12+ wraps the result in a single-element JSON array
+* (e.g. `[{ "name": "verdaccio", ... }]`) for both full-packument and
+* version-specific queries, whereas older npm versions return a bare object.
+* When multiple results match a range, the array holds one entry per match;
+* the last entry is the highest (latest) version, which is what the tests want.
+*
+* Returns the bare object as-is for backward compatibility.
+*/
+function normalizeInfo(parsed) {
+	if (Array.isArray(parsed)) return parsed[parsed.length - 1];
+	return parsed;
+}
+/** Parse `info --json` stdout and normalize to a single info object. */
+function parseInfoJson(stdout) {
+	return normalizeInfo(JSON.parse(stdout));
+}
+//#endregion
+export { normalizeInfo, parseInfoJson };
+
+//# sourceMappingURL=info.js.map

package/build/esm/utils/info.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"info.js","names":[],"sources":["../../../src/utils/info.ts"],"sourcesContent":["/**\n * Normalize the parsed output of `npm/pnpm info <pkg> --json`.\n *\n * npm 12+ wraps the result in a single-element JSON array\n * (e.g. `[{ \"name\": \"verdaccio\", ... }]`) for both full-packument and\n * version-specific queries, whereas older npm versions return a bare object.\n * When multiple results match a range, the array holds one entry per match;\n * the last entry is the highest (latest) version, which is what the tests want.\n *\n * Returns the bare object as-is for backward compatibility.\n */\nexport function normalizeInfo(parsed: any): any {\n  if (Array.isArray(parsed)) {\n    return parsed[parsed.length - 1];\n  }\n  return parsed;\n}\n\n/** Parse `info --json` stdout and normalize to a single info object. */\nexport function parseInfoJson(stdout: string): any {\n  return normalizeInfo(JSON.parse(stdout));\n}\n"],"mappings":";;;;;;;;;;;;AAWA,SAAgB,cAAc,QAAkB;CAC9C,IAAI,MAAM,QAAQ,MAAM,GACtB,OAAO,OAAO,OAAO,SAAS;CAEhC,OAAO;AACT;;AAGA,SAAgB,cAAc,QAAqB;CACjD,OAAO,cAAc,KAAK,MAAM,MAAM,CAAC;AACzC"}