@verdaccio/e2e-cli 3.0.0 → 3.2.0

package/build/cjs/tests/ping.cjs

@@ -0,0 +1,26 @@
+const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
+let assert = require("assert");
+assert = require_runtime.__toESM(assert, 1);
+//#region src/tests/ping.ts
+async function testPing(ctx) {
+	const type = ctx.adapter.type;
+	const { tempFolder } = await ctx.adapter.prepareProject(`verdaccio-ping-${ctx.runId}`, "1.0.0", ctx.registryUrl, ctx.port, ctx.token);
+	const cwd = tempFolder;
+	if (type === "yarn-modern" && ctx.adapter.importPlugin) await ctx.adapter.importPlugin(tempFolder, "npm-ping");
+	const jsonFlag = type === "yarn-modern" ? [] : ["--json"];
+	const resp = await ctx.adapter.exec({ cwd }, "ping", ...jsonFlag, ...ctx.adapter.registryArg(ctx.registryUrl));
+	if (type === "yarn-modern") assert.default.ok(true, "ping succeeded");
+	else {
+		const parsedBody = JSON.parse(resp.stdout);
+		assert.default.strictEqual(parsedBody.registry, ctx.registryUrl + "/", `Expected registry "${ctx.registryUrl}/" but got "${parsedBody.registry}"`);
+	}
+}
+var pingTest = {
+	name: "ping",
+	requires: ["ping"],
+	run: testPing
+};
+//#endregion
+exports.pingTest = pingTest;
+
+//# sourceMappingURL=ping.cjs.map

package/build/cjs/tests/ping.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ping.cjs","names":[],"sources":["../../../src/tests/ping.ts"],"sourcesContent":["import assert from 'assert';\n\nimport { TestContext, TestDefinition } from '../types';\n\nasync function testPing(ctx: TestContext): Promise<void> {\n  const type = ctx.adapter.type;\n\n  // Always run from a prepared project: its .npmrc carries the fresh token and\n  // shields the test from whatever the developer's global ~/.npmrc has for\n  // this registry (a stale token there would turn into a spurious E401).\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    `verdaccio-ping-${ctx.runId}`,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token\n  );\n  const cwd = tempFolder;\n  if (type === 'yarn-modern' && ctx.adapter.importPlugin) {\n    await ctx.adapter.importPlugin(tempFolder, 'npm-ping');\n  }\n\n  const jsonFlag = type === 'yarn-modern' ? [] : ['--json'];\n  const resp = await ctx.adapter.exec(\n    { cwd },\n    'ping',\n    ...jsonFlag,\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n\n  if (type === 'yarn-modern') {\n    // yarn npm ping succeeding (exit code 0) is sufficient proof the registry is reachable\n    assert.ok(true, 'ping succeeded');\n  } else {\n    const parsedBody = JSON.parse(resp.stdout);\n    assert.strictEqual(\n      parsedBody.registry,\n      ctx.registryUrl + '/',\n      `Expected registry \"${ctx.registryUrl}/\" but got \"${parsedBody.registry}\"`\n    );\n  }\n}\n\nexport const pingTest: TestDefinition = {\n  name: 'ping',\n  requires: ['ping'],\n  run: testPing,\n};\n"],"mappings":";;;;AAIA,eAAe,SAAS,KAAiC;CACvD,MAAM,OAAO,IAAI,QAAQ;CAKzB,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,kBAAkB,IAAI,SACtB,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;CACA,MAAM,MAAM;CACZ,IAAI,SAAS,iBAAiB,IAAI,QAAQ,cACxC,MAAM,IAAI,QAAQ,aAAa,YAAY,UAAU;CAGvD,MAAM,WAAW,SAAS,gBAAgB,CAAC,IAAI,CAAC,QAAQ;CACxD,MAAM,OAAO,MAAM,IAAI,QAAQ,KAC7B,EAAE,IAAI,GACN,QACA,GAAG,UACH,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CAEA,IAAI,SAAS,eAEX,OAAA,QAAO,GAAG,MAAM,gBAAgB;MAC3B;EACL,MAAM,aAAa,KAAK,MAAM,KAAK,MAAM;EACzC,OAAA,QAAO,YACL,WAAW,UACX,IAAI,cAAc,KAClB,sBAAsB,IAAI,YAAY,cAAc,WAAW,SAAS,EAC1E;CACF;AACF;AAEA,IAAa,WAA2B;CACtC,MAAM;CACN,UAAU,CAAC,MAAM;CACjB,KAAK;AACP"}

package/build/cjs/tests/publish.cjs

@@ -0,0 +1,36 @@
+const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
+let assert = require("assert");
+assert = require_runtime.__toESM(assert, 1);
+//#region src/tests/publish.ts
+async function testPublish(ctx) {
+	const packages = [
+		`verdaccio-memory-${ctx.runId}`,
+		`verdaccio-${ctx.runId}`,
+		`@verdaccio/foo-${ctx.runId}`,
+		`@verdaccio/some-foo-${ctx.runId}`
+	];
+	const type = ctx.adapter.type;
+	for (const pkgName of packages) {
+		const { tempFolder } = await ctx.adapter.prepareProject(pkgName, "1.0.0", ctx.registryUrl, ctx.port, ctx.token);
+		if (type === "yarn-modern") await ctx.adapter.exec({ cwd: tempFolder }, "install");
+		const resp = await ctx.adapter.exec({ cwd: tempFolder }, "publish", "--json", ...ctx.adapter.registryArg(ctx.registryUrl));
+		if (type === "yarn-modern") assert.default.ok(resp.stdout.match(/Package archive published/), `Expected "Package archive published" for ${pkgName} but got "${resp.stdout}"`);
+		else if (type === "bun") assert.default.ok(true, `Publish succeeded for ${pkgName}`);
+		else try {
+			const parsedBody = JSON.parse(resp.stdout);
+			assert.default.strictEqual(parsedBody.name, pkgName, `Expected package name "${pkgName}" but got "${parsedBody.name}"`);
+			assert.default.ok(parsedBody.files, `Expected files to be defined for ${pkgName}`);
+		} catch {
+			assert.default.ok(true, `Publish succeeded for ${pkgName}`);
+		}
+	}
+}
+var publishTest = {
+	name: "publish",
+	requires: ["publish"],
+	run: testPublish
+};
+//#endregion
+exports.publishTest = publishTest;
+
+//# sourceMappingURL=publish.cjs.map

package/build/cjs/tests/publish.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.cjs","names":[],"sources":["../../../src/tests/publish.ts"],"sourcesContent":["import assert from 'assert';\n\nimport { TestContext, TestDefinition } from '../types';\n\nasync function testPublish(ctx: TestContext): Promise<void> {\n  const packages = [\n    `verdaccio-memory-${ctx.runId}`,\n    `verdaccio-${ctx.runId}`,\n    `@verdaccio/foo-${ctx.runId}`,\n    `@verdaccio/some-foo-${ctx.runId}`,\n  ];\n\n  const type = ctx.adapter.type;\n\n  for (const pkgName of packages) {\n    const { tempFolder } = await ctx.adapter.prepareProject(\n      pkgName,\n      '1.0.0',\n      ctx.registryUrl,\n      ctx.port,\n      ctx.token\n    );\n\n    // yarn modern requires install before publish to generate lockfile\n    if (type === 'yarn-modern') {\n      await ctx.adapter.exec({ cwd: tempFolder }, 'install');\n    }\n\n    const resp = await ctx.adapter.exec(\n      { cwd: tempFolder },\n      'publish',\n      '--json',\n      ...ctx.adapter.registryArg(ctx.registryUrl)\n    );\n\n    if (type === 'yarn-modern') {\n      assert.ok(\n        resp.stdout.match(/Package archive published/),\n        `Expected \"Package archive published\" for ${pkgName} but got \"${resp.stdout}\"`\n      );\n    } else if (type === 'bun') {\n      // bun publish outputs text confirmation — exit code 0 is sufficient\n      assert.ok(true, `Publish succeeded for ${pkgName}`);\n    } else {\n      // npm / pnpm\n      try {\n        const parsedBody = JSON.parse(resp.stdout);\n        assert.strictEqual(\n          parsedBody.name,\n          pkgName,\n          `Expected package name \"${pkgName}\" but got \"${parsedBody.name}\"`\n        );\n        assert.ok(parsedBody.files, `Expected files to be defined for ${pkgName}`);\n      } catch {\n        // pnpm v11+ native publish doesn't output JSON — exit code 0 is sufficient\n        assert.ok(true, `Publish succeeded for ${pkgName}`);\n      }\n    }\n  }\n}\n\nexport const publishTest: TestDefinition = {\n  name: 'publish',\n  requires: ['publish'],\n  run: testPublish,\n};\n"],"mappings":";;;;AAIA,eAAe,YAAY,KAAiC;CAC1D,MAAM,WAAW;EACf,oBAAoB,IAAI;EACxB,aAAa,IAAI;EACjB,kBAAkB,IAAI;EACtB,uBAAuB,IAAI;CAC7B;CAEA,MAAM,OAAO,IAAI,QAAQ;CAEzB,KAAK,MAAM,WAAW,UAAU;EAC9B,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,SACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;EAGA,IAAI,SAAS,eACX,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,WAAW,GAAG,SAAS;EAGvD,MAAM,OAAO,MAAM,IAAI,QAAQ,KAC7B,EAAE,KAAK,WAAW,GAClB,WACA,UACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EAEA,IAAI,SAAS,eACX,OAAA,QAAO,GACL,KAAK,OAAO,MAAM,2BAA2B,GAC7C,4CAA4C,QAAQ,YAAY,KAAK,OAAO,EAC9E;OACK,IAAI,SAAS,OAElB,OAAA,QAAO,GAAG,MAAM,yBAAyB,SAAS;OAGlD,IAAI;GACF,MAAM,aAAa,KAAK,MAAM,KAAK,MAAM;GACzC,OAAA,QAAO,YACL,WAAW,MACX,SACA,0BAA0B,QAAQ,aAAa,WAAW,KAAK,EACjE;GACA,OAAA,QAAO,GAAG,WAAW,OAAO,oCAAoC,SAAS;EAC3E,QAAQ;GAEN,OAAA,QAAO,GAAG,MAAM,yBAAyB,SAAS;EACpD;CAEJ;AACF;AAEA,IAAa,cAA8B;CACzC,MAAM;CACN,UAAU,CAAC,SAAS;CACpB,KAAK;AACP"}

package/build/cjs/tests/search.cjs

@@ -0,0 +1,23 @@
+const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
+const require_publish = require("../utils/publish.cjs");
+let assert = require("assert");
+assert = require_runtime.__toESM(assert, 1);
+//#region src/tests/search.ts
+async function testSearch(ctx) {
+	const pkgName = `verdaccio-search-${ctx.runId}`;
+	await require_publish.publishLocalPackage(ctx, pkgName, "1.0.0");
+	const { tempFolder } = await ctx.adapter.prepareProject(`search-client-${ctx.runId}`, "1.0.0", ctx.registryUrl, ctx.port, ctx.token);
+	const resp = await ctx.adapter.exec({ cwd: tempFolder }, "search", pkgName, "--json", ...ctx.adapter.registryArg(ctx.registryUrl));
+	const pkgFind = JSON.parse(resp.stdout).find((item) => item.name === pkgName);
+	assert.default.ok(pkgFind, `Expected to find ${pkgName} in search results`);
+	assert.default.strictEqual(pkgFind.name, pkgName);
+}
+var searchTest = {
+	name: "search",
+	requires: ["search", "publish"],
+	run: testSearch
+};
+//#endregion
+exports.searchTest = searchTest;
+
+//# sourceMappingURL=search.cjs.map

package/build/cjs/tests/search.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"search.cjs","names":[],"sources":["../../../src/tests/search.ts"],"sourcesContent":["import assert from 'assert';\n\nimport { TestContext, TestDefinition } from '../types';\nimport { publishLocalPackage } from '../utils/publish';\n\nasync function testSearch(ctx: TestContext): Promise<void> {\n  // Publish the package we search for — searching an npmjs package would need\n  // an uplink and the suite must run offline.\n  const pkgName = `verdaccio-search-${ctx.runId}`;\n  await publishLocalPackage(ctx, pkgName, '1.0.0');\n\n  // Run from a prepared project so its .npmrc (fresh token) shields the test\n  // from stale credentials in the developer's global ~/.npmrc.\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    `search-client-${ctx.runId}`,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token\n  );\n\n  const resp = await ctx.adapter.exec(\n    { cwd: tempFolder },\n    'search',\n    pkgName,\n    '--json',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n  const parsedBody = JSON.parse(resp.stdout);\n  const pkgFind = parsedBody.find((item: any) => item.name === pkgName);\n  assert.ok(pkgFind, `Expected to find ${pkgName} in search results`);\n  assert.strictEqual(pkgFind.name, pkgName);\n}\n\nexport const searchTest: TestDefinition = {\n  name: 'search',\n  requires: ['search', 'publish'],\n  run: testSearch,\n};\n"],"mappings":";;;;;AAKA,eAAe,WAAW,KAAiC;CAGzD,MAAM,UAAU,oBAAoB,IAAI;CACxC,MAAM,gBAAA,oBAAoB,KAAK,SAAS,OAAO;CAI/C,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,iBAAiB,IAAI,SACrB,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;CAEA,MAAM,OAAO,MAAM,IAAI,QAAQ,KAC7B,EAAE,KAAK,WAAW,GAClB,UACA,SACA,UACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CAEA,MAAM,UADa,KAAK,MAAM,KAAK,MACnB,CAAA,CAAW,MAAM,SAAc,KAAK,SAAS,OAAO;CACpE,OAAA,QAAO,GAAG,SAAS,oBAAoB,QAAQ,mBAAmB;CAClE,OAAA,QAAO,YAAY,QAAQ,MAAM,OAAO;AAC1C;AAEA,IAAa,aAA6B;CACxC,MAAM;CACN,UAAU,CAAC,UAAU,SAAS;CAC9B,KAAK;AACP"}

package/build/cjs/tests/unpublish.cjs

@@ -0,0 +1,40 @@
+const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
+let assert = require("assert");
+assert = require_runtime.__toESM(assert, 1);
+//#region src/tests/unpublish.ts
+async function publishPkg(ctx, tempFolder) {
+	await ctx.adapter.exec({ cwd: tempFolder }, "publish", "--json", ...ctx.adapter.registryArg(ctx.registryUrl));
+}
+async function bumpVersion(ctx, tempFolder, bump) {
+	await ctx.adapter.exec({ cwd: tempFolder }, "version", bump, "--no--git-tag-version", "--loglevel=info", ...ctx.adapter.registryArg(ctx.registryUrl));
+}
+async function testUnpublish(ctx) {
+	const id = ctx.runId;
+	const pkgName = `@verdaccio/unpub1-${id}`;
+	const { tempFolder } = await ctx.adapter.prepareProject(pkgName, "1.0.0", ctx.registryUrl, ctx.port, ctx.token);
+	await publishPkg(ctx, tempFolder);
+	await bumpVersion(ctx, tempFolder, "minor");
+	await publishPkg(ctx, tempFolder);
+	await bumpVersion(ctx, tempFolder, "minor");
+	await publishPkg(ctx, tempFolder);
+	await bumpVersion(ctx, tempFolder, "major");
+	await publishPkg(ctx, tempFolder);
+	const resp = await ctx.adapter.exec({ cwd: tempFolder }, "unpublish", pkgName, "--force", "--loglevel=info", "--json", ...ctx.adapter.registryArg(ctx.registryUrl));
+	assert.default.ok(resp.stdout.includes(pkgName), `Expected unpublish output to contain "${pkgName}" but got "${resp.stdout}"`);
+	const pkgName2 = `@verdaccio/unpub2-${id}`;
+	const { tempFolder: tf2 } = await ctx.adapter.prepareProject(pkgName2, "1.0.0", ctx.registryUrl, ctx.port, ctx.token);
+	await publishPkg(ctx, tf2);
+	await bumpVersion(ctx, tf2, "minor");
+	await publishPkg(ctx, tf2);
+	const resp2 = await ctx.adapter.exec({ cwd: tf2 }, "unpublish", `${pkgName2}@1.0.0`, "--force", "--loglevel=info", "--json", ...ctx.adapter.registryArg(ctx.registryUrl));
+	assert.default.ok(resp2.stdout.includes(pkgName2), `Expected unpublish output to contain "${pkgName2}" but got "${resp2.stdout}"`);
+}
+var unpublishTest = {
+	name: "unpublish",
+	requires: ["unpublish"],
+	run: testUnpublish
+};
+//#endregion
+exports.unpublishTest = unpublishTest;
+
+//# sourceMappingURL=unpublish.cjs.map

package/build/cjs/tests/unpublish.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"unpublish.cjs","names":[],"sources":["../../../src/tests/unpublish.ts"],"sourcesContent":["import assert from 'assert';\n\nimport { TestContext, TestDefinition } from '../types';\n\nasync function publishPkg(ctx: TestContext, tempFolder: string) {\n  await ctx.adapter.exec(\n    { cwd: tempFolder },\n    'publish',\n    '--json',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n}\n\nasync function bumpVersion(ctx: TestContext, tempFolder: string, bump: string) {\n  await ctx.adapter.exec(\n    { cwd: tempFolder },\n    'version',\n    bump,\n    '--no--git-tag-version',\n    '--loglevel=info',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n}\n\nasync function testUnpublish(ctx: TestContext): Promise<void> {\n  const id = ctx.runId;\n\n  // Test 1: unpublish a full package\n  const pkgName = `@verdaccio/unpub1-${id}`;\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    pkgName,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token\n  );\n  await publishPkg(ctx, tempFolder);\n  await bumpVersion(ctx, tempFolder, 'minor');\n  await publishPkg(ctx, tempFolder);\n  await bumpVersion(ctx, tempFolder, 'minor');\n  await publishPkg(ctx, tempFolder);\n  await bumpVersion(ctx, tempFolder, 'major');\n  await publishPkg(ctx, tempFolder);\n\n  const resp = await ctx.adapter.exec(\n    { cwd: tempFolder },\n    'unpublish',\n    pkgName,\n    '--force',\n    '--loglevel=info',\n    '--json',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n  assert.ok(\n    resp.stdout.includes(pkgName),\n    `Expected unpublish output to contain \"${pkgName}\" but got \"${resp.stdout}\"`\n  );\n\n  // Test 2: unpublish a specific version\n  const pkgName2 = `@verdaccio/unpub2-${id}`;\n  const { tempFolder: tf2 } = await ctx.adapter.prepareProject(\n    pkgName2,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token\n  );\n  await publishPkg(ctx, tf2);\n  await bumpVersion(ctx, tf2, 'minor');\n  await publishPkg(ctx, tf2);\n\n  const resp2 = await ctx.adapter.exec(\n    { cwd: tf2 },\n    'unpublish',\n    `${pkgName2}@1.0.0`,\n    '--force',\n    '--loglevel=info',\n    '--json',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n  assert.ok(\n    resp2.stdout.includes(pkgName2),\n    `Expected unpublish output to contain \"${pkgName2}\" but got \"${resp2.stdout}\"`\n  );\n}\n\nexport const unpublishTest: TestDefinition = {\n  name: 'unpublish',\n  requires: ['unpublish'],\n  run: testUnpublish,\n};\n"],"mappings":";;;;AAIA,eAAe,WAAW,KAAkB,YAAoB;CAC9D,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,UACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;AACF;AAEA,eAAe,YAAY,KAAkB,YAAoB,MAAc;CAC7E,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,MACA,yBACA,mBACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;AACF;AAEA,eAAe,cAAc,KAAiC;CAC5D,MAAM,KAAK,IAAI;CAGf,MAAM,UAAU,qBAAqB;CACrC,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,SACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;CACA,MAAM,WAAW,KAAK,UAAU;CAChC,MAAM,YAAY,KAAK,YAAY,OAAO;CAC1C,MAAM,WAAW,KAAK,UAAU;CAChC,MAAM,YAAY,KAAK,YAAY,OAAO;CAC1C,MAAM,WAAW,KAAK,UAAU;CAChC,MAAM,YAAY,KAAK,YAAY,OAAO;CAC1C,MAAM,WAAW,KAAK,UAAU;CAEhC,MAAM,OAAO,MAAM,IAAI,QAAQ,KAC7B,EAAE,KAAK,WAAW,GAClB,aACA,SACA,WACA,mBACA,UACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CACA,OAAA,QAAO,GACL,KAAK,OAAO,SAAS,OAAO,GAC5B,yCAAyC,QAAQ,aAAa,KAAK,OAAO,EAC5E;CAGA,MAAM,WAAW,qBAAqB;CACtC,MAAM,EAAE,YAAY,QAAQ,MAAM,IAAI,QAAQ,eAC5C,UACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;CACA,MAAM,WAAW,KAAK,GAAG;CACzB,MAAM,YAAY,KAAK,KAAK,OAAO;CACnC,MAAM,WAAW,KAAK,GAAG;CAEzB,MAAM,QAAQ,MAAM,IAAI,QAAQ,KAC9B,EAAE,KAAK,IAAI,GACX,aACA,GAAG,SAAS,SACZ,WACA,mBACA,UACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CACA,OAAA,QAAO,GACL,MAAM,OAAO,SAAS,QAAQ,GAC9B,yCAAyC,SAAS,aAAa,MAAM,OAAO,EAC9E;AACF;AAEA,IAAa,gBAAgC;CAC3C,MAAM;CACN,UAAU,CAAC,WAAW;CACtB,KAAK;AACP"}

package/build/cjs/utils/e2e-config.cjs

@@ -0,0 +1,59 @@
+//#region src/utils/e2e-config.ts
+/**
+* Recommended Verdaccio config for running the full e2e-cli battery,
+* printed by `verdaccio-e2e --print-config`. It is what the consuming repos'
+* CI jobs and scripts/run-e2e.sh feed to `verdaccio --config`:
+*
+*   - max_body_size raised so scenario:tarballs can publish ~30 MB packages
+*     (Verdaccio's default is 10mb)
+*   - an `e2emock` uplink + `e2e-uplink-*` package pattern wired to the mock
+*     uplink server that scenario:uplink-failure starts on E2E_UPLINK_PORT
+*     (short timeout so the "slow uplink" case completes quickly; high
+*     max_fails so simulated failures don't trip the circuit breaker for
+*     later sub-tests)
+*   - NO npmjs uplink: the whole suite publishes every package it consumes,
+*     so the registry under test never talks to the outside world and the
+*     battery runs fully offline (and deterministically in CI)
+*
+* Relative paths (storage/htpasswd) resolve next to the config file, so write
+* it into a disposable directory.
+*/
+var DEFAULT_UPLINK_PORT = 4874;
+function buildE2EConfig(uplinkPort = DEFAULT_UPLINK_PORT) {
+	return `# Generated by @verdaccio/e2e-cli --print-config
+storage: ./storage
+auth:
+  htpasswd:
+    file: ./htpasswd
+    max_users: 1000
+web:
+  enable: true
+  title: Verdaccio E2E
+max_body_size: 100mb
+uplinks:
+  e2emock:
+    url: http://localhost:${uplinkPort}/
+    timeout: 3s
+    retry: 0
+    max_fails: 100
+    fail_timeout: 1s
+packages:
+  'e2e-uplink-*':
+    access: $all
+    proxy: e2emock
+  '@*/*':
+    access: $all
+    publish: $authenticated
+    unpublish: $authenticated
+  '**':
+    access: $all
+    publish: $authenticated
+    unpublish: $authenticated
+log: { type: stdout, format: pretty, level: warn }
+`;
+}
+//#endregion
+exports.DEFAULT_UPLINK_PORT = DEFAULT_UPLINK_PORT;
+exports.buildE2EConfig = buildE2EConfig;
+
+//# sourceMappingURL=e2e-config.cjs.map

package/build/cjs/utils/e2e-config.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2e-config.cjs","names":[],"sources":["../../../src/utils/e2e-config.ts"],"sourcesContent":["/**\n * Recommended Verdaccio config for running the full e2e-cli battery,\n * printed by `verdaccio-e2e --print-config`. It is what the consuming repos'\n * CI jobs and scripts/run-e2e.sh feed to `verdaccio --config`:\n *\n *   - max_body_size raised so scenario:tarballs can publish ~30 MB packages\n *     (Verdaccio's default is 10mb)\n *   - an `e2emock` uplink + `e2e-uplink-*` package pattern wired to the mock\n *     uplink server that scenario:uplink-failure starts on E2E_UPLINK_PORT\n *     (short timeout so the \"slow uplink\" case completes quickly; high\n *     max_fails so simulated failures don't trip the circuit breaker for\n *     later sub-tests)\n *   - NO npmjs uplink: the whole suite publishes every package it consumes,\n *     so the registry under test never talks to the outside world and the\n *     battery runs fully offline (and deterministically in CI)\n *\n * Relative paths (storage/htpasswd) resolve next to the config file, so write\n * it into a disposable directory.\n */\nexport const DEFAULT_UPLINK_PORT = 4874;\n\nexport function buildE2EConfig(uplinkPort: number = DEFAULT_UPLINK_PORT): string {\n  return `# Generated by @verdaccio/e2e-cli --print-config\nstorage: ./storage\nauth:\n  htpasswd:\n    file: ./htpasswd\n    max_users: 1000\nweb:\n  enable: true\n  title: Verdaccio E2E\nmax_body_size: 100mb\nuplinks:\n  e2emock:\n    url: http://localhost:${uplinkPort}/\n    timeout: 3s\n    retry: 0\n    max_fails: 100\n    fail_timeout: 1s\npackages:\n  'e2e-uplink-*':\n    access: $all\n    proxy: e2emock\n  '@*/*':\n    access: $all\n    publish: $authenticated\n    unpublish: $authenticated\n  '**':\n    access: $all\n    publish: $authenticated\n    unpublish: $authenticated\nlog: { type: stdout, format: pretty, level: warn }\n`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAmBA,IAAa,sBAAsB;AAEnC,SAAgB,eAAe,aAAqB,qBAA6B;CAC/E,OAAO;;;;;;;;;;;;4BAYmB,WAAW;;;;;;;;;;;;;;;;;;;AAmBvC"}

package/build/cjs/utils/http-client.cjs

@@ -0,0 +1,111 @@
+const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
+let debug = require("debug");
+debug = require_runtime.__toESM(debug, 1);
+let crypto = require("crypto");
+let http = require("http");
+//#region src/utils/http-client.ts
+var debug$1 = (0, debug.default)("verdaccio:e2e-cli:http-client");
+var ABBREVIATED_ACCEPT = "application/vnd.npm.install-v1+json";
+/**
+* Registry URL for a package name. Scoped names are encoded with the same
+* `%2f` form npm clients use: `@scope%2fname`.
+*/
+function packumentUrl(registryUrl, pkgName) {
+	const encoded = pkgName.startsWith("@") ? pkgName.replaceAll("/", "%2f") : pkgName;
+	return `${registryUrl.replace(/\/$/, "")}/${encoded}`;
+}
+async function fetchPackument(registryUrl, pkgName, options = {}) {
+	const url = packumentUrl(registryUrl, pkgName);
+	const headers = {};
+	if (options.abbreviated) headers["Accept"] = ABBREVIATED_ACCEPT;
+	if (options.etag) headers["If-None-Match"] = options.etag;
+	if (options.token) headers["Authorization"] = `Bearer ${options.token}`;
+	debug$1("GET %s %o", url, headers);
+	if (options.etag) return new Promise((resolve, reject) => {
+		(0, http.get)(url, { headers }, (response) => {
+			let text = "";
+			response.setEncoding("utf8");
+			response.on("data", (chunk) => text += chunk);
+			response.on("end", () => {
+				let body;
+				try {
+					body = JSON.parse(text);
+				} catch {
+					body = void 0;
+				}
+				const responseHeaders = new Headers();
+				for (const [name, value] of Object.entries(response.headers)) if (value !== void 0) responseHeaders.set(name, Array.isArray(value) ? value.join(", ") : value);
+				resolve({
+					status: response.statusCode || 0,
+					headers: responseHeaders,
+					body
+				});
+			});
+		}).on("error", reject);
+	});
+	const response = await fetch(url, { headers });
+	let body;
+	if (response.status !== 304) {
+		const text = await response.text();
+		try {
+			body = JSON.parse(text);
+		} catch {
+			body = void 0;
+		}
+	}
+	return {
+		status: response.status,
+		headers: response.headers,
+		body
+	};
+}
+/**
+* Download a tarball fully, computing sha1/sha512 integrity on the fly.
+* Rejects with the underlying error when aborted or the connection drops.
+*/
+async function downloadTarball(url, options = {}) {
+	const headers = {};
+	if (options.token) headers["Authorization"] = `Bearer ${options.token}`;
+	debug$1("GET (tarball) %s", url);
+	const response = await fetch(url, {
+		headers,
+		signal: options.signal
+	});
+	const sha1 = (0, crypto.createHash)("sha1");
+	const sha512 = (0, crypto.createHash)("sha512");
+	let bytes = 0;
+	let first = true;
+	if (response.body) for await (const chunk of response.body) {
+		const buf = Buffer.from(chunk);
+		bytes += buf.length;
+		sha1.update(buf);
+		sha512.update(buf);
+		if (first) {
+			first = false;
+			options.onFirstChunk?.();
+		}
+		options.onChunk?.(bytes);
+	}
+	return {
+		status: response.status,
+		headers: response.headers,
+		bytes,
+		sha1: sha1.digest("hex"),
+		integrity: `sha512-${sha512.digest("base64")}`
+	};
+}
+/** Compute npm-style dist values (shasum/integrity) for a buffer. */
+function computeDist(buffer) {
+	return {
+		shasum: (0, crypto.createHash)("sha1").update(buffer).digest("hex"),
+		integrity: `sha512-${(0, crypto.createHash)("sha512").update(buffer).digest("base64")}`
+	};
+}
+//#endregion
+exports.ABBREVIATED_ACCEPT = ABBREVIATED_ACCEPT;
+exports.computeDist = computeDist;
+exports.downloadTarball = downloadTarball;
+exports.fetchPackument = fetchPackument;
+exports.packumentUrl = packumentUrl;
+
+//# sourceMappingURL=http-client.cjs.map

package/build/cjs/utils/http-client.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-client.cjs","names":[],"sources":["../../../src/utils/http-client.ts"],"sourcesContent":["import { createHash } from 'crypto';\nimport buildDebug from 'debug';\nimport { get } from 'http';\n\nconst debug = buildDebug('verdaccio:e2e-cli:http-client');\n\nexport type PackumentResponse = {\n  status: number;\n  headers: Headers;\n  /** Parsed JSON body, or undefined when the response is not JSON (e.g. 304) */\n  body?: any;\n};\n\nexport type TarballDownload = {\n  status: number;\n  headers: Headers;\n  /** Total bytes received */\n  bytes: number;\n  /** hex-encoded sha1 of the received bytes (matches dist.shasum) */\n  sha1: string;\n  /** `sha512-<base64>` of the received bytes (matches dist.integrity) */\n  integrity: string;\n};\n\nexport type FetchPackumentOptions = {\n  /** Request the abbreviated (install) metadata format */\n  abbreviated?: boolean;\n  /** Send If-None-Match with this value */\n  etag?: string;\n  /** Bearer token */\n  token?: string;\n};\n\nexport const ABBREVIATED_ACCEPT = 'application/vnd.npm.install-v1+json';\n\n/**\n * Registry URL for a package name. Scoped names are encoded with the same\n * `%2f` form npm clients use: `@scope%2fname`.\n */\nexport function packumentUrl(registryUrl: string, pkgName: string): string {\n  const encoded = pkgName.startsWith('@') ? pkgName.replaceAll('/', '%2f') : pkgName;\n  return `${registryUrl.replace(/\\/$/, '')}/${encoded}`;\n}\n\nexport async function fetchPackument(\n  registryUrl: string,\n  pkgName: string,\n  options: FetchPackumentOptions = {}\n): Promise<PackumentResponse> {\n  const url = packumentUrl(registryUrl, pkgName);\n  const headers: Record<string, string> = {};\n  if (options.abbreviated) {\n    headers['Accept'] = ABBREVIATED_ACCEPT;\n  }\n  if (options.etag) {\n    headers['If-None-Match'] = options.etag;\n  }\n  if (options.token) {\n    headers['Authorization'] = `Bearer ${options.token}`;\n  }\n  debug('GET %s %o', url, headers);\n\n  // Conditional requests must bypass fetch(): undici appends\n  // `cache-control: no-cache` whenever If-None-Match is present, which\n  // (correctly, per HTTP semantics) disables the server's 304 revalidation.\n  if (options.etag) {\n    return new Promise((resolve, reject) => {\n      get(url, { headers }, (response) => {\n        let text = '';\n        response.setEncoding('utf8');\n        response.on('data', (chunk) => (text += chunk));\n        response.on('end', () => {\n          let body: any;\n          try {\n            body = JSON.parse(text);\n          } catch {\n            body = undefined;\n          }\n          const responseHeaders = new Headers();\n          for (const [name, value] of Object.entries(response.headers)) {\n            if (value !== undefined) {\n              responseHeaders.set(name, Array.isArray(value) ? value.join(', ') : value);\n            }\n          }\n          resolve({ status: response.statusCode || 0, headers: responseHeaders, body });\n        });\n      }).on('error', reject);\n    });\n  }\n\n  const response = await fetch(url, { headers });\n  let body: any;\n  if (response.status !== 304) {\n    const text = await response.text();\n    try {\n      body = JSON.parse(text);\n    } catch {\n      body = undefined;\n    }\n  }\n  return { status: response.status, headers: response.headers, body };\n}\n\nexport type DownloadTarballOptions = {\n  signal?: AbortSignal;\n  token?: string;\n  /** Called after the first chunk of the body arrives (useful to abort mid-stream) */\n  onFirstChunk?: () => void;\n  /** Called after every chunk with the total bytes received so far (useful to abort at a threshold) */\n  onChunk?: (bytesReceived: number) => void;\n};\n\n/**\n * Download a tarball fully, computing sha1/sha512 integrity on the fly.\n * Rejects with the underlying error when aborted or the connection drops.\n */\nexport async function downloadTarball(\n  url: string,\n  options: DownloadTarballOptions = {}\n): Promise<TarballDownload> {\n  const headers: Record<string, string> = {};\n  if (options.token) {\n    headers['Authorization'] = `Bearer ${options.token}`;\n  }\n  debug('GET (tarball) %s', url);\n  const response = await fetch(url, { headers, signal: options.signal });\n\n  const sha1 = createHash('sha1');\n  const sha512 = createHash('sha512');\n  let bytes = 0;\n  let first = true;\n\n  if (response.body) {\n    for await (const chunk of response.body as any) {\n      const buf = Buffer.from(chunk);\n      bytes += buf.length;\n      sha1.update(buf);\n      sha512.update(buf);\n      if (first) {\n        first = false;\n        options.onFirstChunk?.();\n      }\n      options.onChunk?.(bytes);\n    }\n  }\n\n  return {\n    status: response.status,\n    headers: response.headers,\n    bytes,\n    sha1: sha1.digest('hex'),\n    integrity: `sha512-${sha512.digest('base64')}`,\n  };\n}\n\n/** Compute npm-style dist values (shasum/integrity) for a buffer. */\nexport function computeDist(buffer: Buffer): { shasum: string; integrity: string } {\n  return {\n    shasum: createHash('sha1').update(buffer).digest('hex'),\n    integrity: `sha512-${createHash('sha512').update(buffer).digest('base64')}`,\n  };\n}\n"],"mappings":";;;;;;AAIA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,+BAA+B;AA6BxD,IAAa,qBAAqB;;;;;AAMlC,SAAgB,aAAa,aAAqB,SAAyB;CACzE,MAAM,UAAU,QAAQ,WAAW,GAAG,IAAI,QAAQ,WAAW,KAAK,KAAK,IAAI;CAC3E,OAAO,GAAG,YAAY,QAAQ,OAAO,EAAE,EAAE,GAAG;AAC9C;AAEA,eAAsB,eACpB,aACA,SACA,UAAiC,CAAC,GACN;CAC5B,MAAM,MAAM,aAAa,aAAa,OAAO;CAC7C,MAAM,UAAkC,CAAC;CACzC,IAAI,QAAQ,aACV,QAAQ,YAAY;CAEtB,IAAI,QAAQ,MACV,QAAQ,mBAAmB,QAAQ;CAErC,IAAI,QAAQ,OACV,QAAQ,mBAAmB,UAAU,QAAQ;CAE/C,QAAM,aAAa,KAAK,OAAO;CAK/B,IAAI,QAAQ,MACV,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,CAAA,GAAA,KAAA,IAAA,CAAI,KAAK,EAAE,QAAQ,IAAI,aAAa;GAClC,IAAI,OAAO;GACX,SAAS,YAAY,MAAM;GAC3B,SAAS,GAAG,SAAS,UAAW,QAAQ,KAAM;GAC9C,SAAS,GAAG,aAAa;IACvB,IAAI;IACJ,IAAI;KACF,OAAO,KAAK,MAAM,IAAI;IACxB,QAAQ;KACN,OAAO,KAAA;IACT;IACA,MAAM,kBAAkB,IAAI,QAAQ;IACpC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,SAAS,OAAO,GACzD,IAAI,UAAU,KAAA,GACZ,gBAAgB,IAAI,MAAM,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK;IAG7E,QAAQ;KAAE,QAAQ,SAAS,cAAc;KAAG,SAAS;KAAiB;IAAK,CAAC;GAC9E,CAAC;EACH,CAAC,CAAC,CAAC,GAAG,SAAS,MAAM;CACvB,CAAC;CAGH,MAAM,WAAW,MAAM,MAAM,KAAK,EAAE,QAAQ,CAAC;CAC7C,IAAI;CACJ,IAAI,SAAS,WAAW,KAAK;EAC3B,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,IAAI;GACF,OAAO,KAAK,MAAM,IAAI;EACxB,QAAQ;GACN,OAAO,KAAA;EACT;CACF;CACA,OAAO;EAAE,QAAQ,SAAS;EAAQ,SAAS,SAAS;EAAS;CAAK;AACpE;;;;;AAeA,eAAsB,gBACpB,KACA,UAAkC,CAAC,GACT;CAC1B,MAAM,UAAkC,CAAC;CACzC,IAAI,QAAQ,OACV,QAAQ,mBAAmB,UAAU,QAAQ;CAE/C,QAAM,oBAAoB,GAAG;CAC7B,MAAM,WAAW,MAAM,MAAM,KAAK;EAAE;EAAS,QAAQ,QAAQ;CAAO,CAAC;CAErE,MAAM,QAAA,GAAO,OAAA,WAAA,CAAW,MAAM;CAC9B,MAAM,UAAA,GAAS,OAAA,WAAA,CAAW,QAAQ;CAClC,IAAI,QAAQ;CACZ,IAAI,QAAQ;CAEZ,IAAI,SAAS,MACX,WAAW,MAAM,SAAS,SAAS,MAAa;EAC9C,MAAM,MAAM,OAAO,KAAK,KAAK;EAC7B,SAAS,IAAI;EACb,KAAK,OAAO,GAAG;EACf,OAAO,OAAO,GAAG;EACjB,IAAI,OAAO;GACT,QAAQ;GACR,QAAQ,eAAe;EACzB;EACA,QAAQ,UAAU,KAAK;CACzB;CAGF,OAAO;EACL,QAAQ,SAAS;EACjB,SAAS,SAAS;EAClB;EACA,MAAM,KAAK,OAAO,KAAK;EACvB,WAAW,UAAU,OAAO,OAAO,QAAQ;CAC7C;AACF;;AAGA,SAAgB,YAAY,QAAuD;CACjF,OAAO;EACL,SAAA,GAAQ,OAAA,WAAA,CAAW,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,OAAO,KAAK;EACtD,WAAW,WAAA,GAAU,OAAA,WAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,OAAO,QAAQ;CAC1E;AACF"}

package/build/cjs/utils/info.cjs

@@ -0,0 +1,25 @@
+//#region src/utils/info.ts
+/**
+* Normalize the parsed output of `npm/pnpm info <pkg> --json`.
+*
+* npm 12+ wraps the result in a single-element JSON array
+* (e.g. `[{ "name": "verdaccio", ... }]`) for both full-packument and
+* version-specific queries, whereas older npm versions return a bare object.
+* When multiple results match a range, the array holds one entry per match;
+* the last entry is the highest (latest) version, which is what the tests want.
+*
+* Returns the bare object as-is for backward compatibility.
+*/
+function normalizeInfo(parsed) {
+	if (Array.isArray(parsed)) return parsed[parsed.length - 1];
+	return parsed;
+}
+/** Parse `info --json` stdout and normalize to a single info object. */
+function parseInfoJson(stdout) {
+	return normalizeInfo(JSON.parse(stdout));
+}
+//#endregion
+exports.normalizeInfo = normalizeInfo;
+exports.parseInfoJson = parseInfoJson;
+
+//# sourceMappingURL=info.cjs.map

package/build/cjs/utils/info.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"info.cjs","names":[],"sources":["../../../src/utils/info.ts"],"sourcesContent":["/**\n * Normalize the parsed output of `npm/pnpm info <pkg> --json`.\n *\n * npm 12+ wraps the result in a single-element JSON array\n * (e.g. `[{ \"name\": \"verdaccio\", ... }]`) for both full-packument and\n * version-specific queries, whereas older npm versions return a bare object.\n * When multiple results match a range, the array holds one entry per match;\n * the last entry is the highest (latest) version, which is what the tests want.\n *\n * Returns the bare object as-is for backward compatibility.\n */\nexport function normalizeInfo(parsed: any): any {\n  if (Array.isArray(parsed)) {\n    return parsed[parsed.length - 1];\n  }\n  return parsed;\n}\n\n/** Parse `info --json` stdout and normalize to a single info object. */\nexport function parseInfoJson(stdout: string): any {\n  return normalizeInfo(JSON.parse(stdout));\n}\n"],"mappings":";;;;;;;;;;;;AAWA,SAAgB,cAAc,QAAkB;CAC9C,IAAI,MAAM,QAAQ,MAAM,GACtB,OAAO,OAAO,OAAO,SAAS;CAEhC,OAAO;AACT;;AAGA,SAAgB,cAAc,QAAqB;CACjD,OAAO,cAAc,KAAK,MAAM,MAAM,CAAC;AACzC"}

package/build/cjs/utils/mock-uplink.cjs

@@ -0,0 +1,196 @@
+const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
+const require_http_client = require("./http-client.cjs");
+let debug = require("debug");
+debug = require_runtime.__toESM(debug, 1);
+let crypto = require("crypto");
+let http = require("http");
+//#region src/utils/mock-uplink.ts
+var debug$1 = (0, debug.default)("verdaccio:e2e-cli:mock-uplink");
+/**
+* Minimal controllable npm uplink used by scenario:uplink-failure.
+*
+* The registry under test is configured (see --print-config) to proxy the
+* `e2e-uplink-*` package pattern to this server, so the scenario can flip the
+* uplink between healthy, dropping connections mid-tarball, slow, and down.
+*/
+var MockUplink = class {
+	port;
+	mode = "ok";
+	requests = [];
+	server;
+	packages = /* @__PURE__ */ new Map();
+	searchResults = [];
+	constructor(port) {
+		this.port = port;
+	}
+	/** Register a package served by this uplink; tarball is random (incompressible) bytes. */
+	addPackage(name, tarballBytes = 65536) {
+		const tarball = (0, crypto.randomBytes)(tarballBytes);
+		const { shasum, integrity } = require_http_client.computeDist(tarball);
+		const pkg = {
+			name,
+			version: "1.0.0",
+			tarball,
+			shasum,
+			integrity
+		};
+		this.packages.set(name, pkg);
+		return pkg;
+	}
+	/** Register a result served by the /-/v1/search endpoint. */
+	addSearchResult(name, version = "1.0.0") {
+		this.searchResults.push({
+			name,
+			version
+		});
+	}
+	/**
+	* npmjs-faithful /-/v1/search: filters by `text` substring, applies
+	* `from`/`size` itself (like registry.npmjs.org does) and reports the real
+	* `total` of matches. Mimicking the upstream offsetting is what exposes
+	* double pagination in the registry under test.
+	*/
+	searchResponse(url) {
+		const text = url.searchParams.get("text") ?? "";
+		const from = Math.max(0, parseInt(url.searchParams.get("from") ?? "0", 10) || 0);
+		const size = Math.max(0, parseInt(url.searchParams.get("size") ?? "20", 10) || 20);
+		const matches = this.searchResults.filter((r) => r.name.includes(text));
+		const page = matches.slice(from, from + size);
+		return JSON.stringify({
+			objects: page.map((r) => ({
+				package: {
+					name: r.name,
+					version: r.version,
+					description: "mock uplink search result",
+					date: "2020-01-01T00:00:00.000Z",
+					maintainers: [{
+						username: "mock-uplink",
+						email: "mock@example.org"
+					}],
+					links: { npm: `http://localhost:${this.port}/${r.name}` }
+				},
+				score: {
+					final: 1,
+					detail: {
+						quality: 1,
+						popularity: 1,
+						maintenance: 1
+					}
+				},
+				searchScore: 1,
+				flags: {}
+			})),
+			total: matches.length,
+			time: (/* @__PURE__ */ new Date("2020-01-01T00:00:00.000Z")).toISOString()
+		});
+	}
+	packument(pkg) {
+		const tarballUrl = `http://localhost:${this.port}/${pkg.name}/-/${pkg.name}-${pkg.version}.tgz`;
+		return JSON.stringify({
+			name: pkg.name,
+			"dist-tags": { latest: pkg.version },
+			versions: { [pkg.version]: {
+				name: pkg.name,
+				version: pkg.version,
+				description: "mock uplink package",
+				dist: {
+					tarball: tarballUrl,
+					shasum: pkg.shasum,
+					integrity: pkg.integrity
+				}
+			} },
+			time: {
+				created: "2020-01-01T00:00:00.000Z",
+				modified: "2020-01-01T00:00:00.000Z",
+				[pkg.version]: "2020-01-01T00:00:00.000Z"
+			}
+		});
+	}
+	start() {
+		this.server = (0, http.createServer)((req, res) => {
+			const url = req.url || "";
+			this.requests.push(url);
+			debug$1("mock uplink %s %s (mode: %s)", req.method, url, this.mode);
+			const respond = () => {
+				if (this.mode === "error-500") {
+					res.writeHead(500, { "Content-Type": "application/json" });
+					res.end(JSON.stringify({ error: "mock uplink internal error" }));
+					return;
+				}
+				if (url.startsWith("/-/v1/search")) {
+					res.writeHead(200, { "Content-Type": "application/json" });
+					res.end(this.searchResponse(new URL(url, `http://localhost:${this.port}`)));
+					return;
+				}
+				const tarballSep = url.indexOf("/-/");
+				if (tarballSep > 0 && url.endsWith(".tgz")) {
+					const pkg = this.packages.get(decodeURIComponent(url.slice(1, tarballSep)));
+					if (!pkg) {
+						res.writeHead(404, { "Content-Type": "application/json" });
+						res.end(JSON.stringify({ error: "not found" }));
+						return;
+					}
+					if (this.mode === "drop-mid-stream") {
+						res.writeHead(200, {
+							"Content-Type": "application/octet-stream",
+							"Content-Length": String(pkg.tarball.length)
+						});
+						res.write(pkg.tarball.subarray(0, Math.floor(pkg.tarball.length / 2)));
+						setTimeout(() => res.socket?.destroy(), 50);
+						return;
+					}
+					res.writeHead(200, {
+						"Content-Type": "application/octet-stream",
+						"Content-Length": String(pkg.tarball.length)
+					});
+					res.end(pkg.tarball);
+					return;
+				}
+				const pkg = this.packages.get(decodeURIComponent(url.slice(1)));
+				if (!pkg) {
+					res.writeHead(404, { "Content-Type": "application/json" });
+					res.end(JSON.stringify({ error: "not found" }));
+					return;
+				}
+				res.writeHead(200, { "Content-Type": "application/json" });
+				res.end(this.packument(pkg));
+			};
+			const safeRespond = () => {
+				try {
+					respond();
+				} catch (err) {
+					debug$1("mock uplink response failed (socket gone?): %s", err);
+				}
+			};
+			if (this.mode === "slow") {
+				const timer = setTimeout(safeRespond, 1e4);
+				res.socket?.once("close", () => clearTimeout(timer));
+			} else safeRespond();
+		});
+		return new Promise((resolve, reject) => {
+			this.server.once("error", reject);
+			this.server.listen(this.port, () => {
+				debug$1("mock uplink listening on %d", this.port);
+				resolve();
+			});
+		});
+	}
+	stop() {
+		return new Promise((resolve) => {
+			if (!this.server) {
+				resolve();
+				return;
+			}
+			this.server.closeAllConnections?.();
+			this.server.close(() => {
+				debug$1("mock uplink stopped");
+				this.server = void 0;
+				resolve();
+			});
+		});
+	}
+};
+//#endregion
+exports.MockUplink = MockUplink;
+
+//# sourceMappingURL=mock-uplink.cjs.map

package/build/cjs/utils/mock-uplink.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock-uplink.cjs","names":[],"sources":["../../../src/utils/mock-uplink.ts"],"sourcesContent":["import { randomBytes } from 'crypto';\nimport buildDebug from 'debug';\nimport { Server, createServer } from 'http';\n\nimport { computeDist } from './http-client';\n\nconst debug = buildDebug('verdaccio:e2e-cli:mock-uplink');\n\nexport type UplinkMode =\n  /** Serve packuments and tarballs normally */\n  | 'ok'\n  /** Send tarball headers + half the body, then destroy the socket */\n  | 'drop-mid-stream'\n  /** Delay every response long enough to trip the registry's uplink timeout */\n  | 'slow'\n  /** Respond 500 to everything */\n  | 'error-500';\n\ntype MockPackage = {\n  name: string;\n  version: string;\n  tarball: Buffer;\n  shasum: string;\n  integrity: string;\n};\n\n/**\n * Minimal controllable npm uplink used by scenario:uplink-failure.\n *\n * The registry under test is configured (see --print-config) to proxy the\n * `e2e-uplink-*` package pattern to this server, so the scenario can flip the\n * uplink between healthy, dropping connections mid-tarball, slow, and down.\n */\nexport class MockUplink {\n  public mode: UplinkMode = 'ok';\n  public requests: string[] = [];\n  private server?: Server;\n  private packages = new Map<string, MockPackage>();\n  private searchResults: { name: string; version: string }[] = [];\n\n  constructor(public readonly port: number) {}\n\n  /** Register a package served by this uplink; tarball is random (incompressible) bytes. */\n  addPackage(name: string, tarballBytes = 64 * 1024): MockPackage {\n    const tarball = randomBytes(tarballBytes);\n    const { shasum, integrity } = computeDist(tarball);\n    const pkg: MockPackage = { name, version: '1.0.0', tarball, shasum, integrity };\n    this.packages.set(name, pkg);\n    return pkg;\n  }\n\n  /** Register a result served by the /-/v1/search endpoint. */\n  addSearchResult(name: string, version = '1.0.0'): void {\n    this.searchResults.push({ name, version });\n  }\n\n  /**\n   * npmjs-faithful /-/v1/search: filters by `text` substring, applies\n   * `from`/`size` itself (like registry.npmjs.org does) and reports the real\n   * `total` of matches. Mimicking the upstream offsetting is what exposes\n   * double pagination in the registry under test.\n   */\n  private searchResponse(url: URL): string {\n    const text = url.searchParams.get('text') ?? '';\n    const from = Math.max(0, parseInt(url.searchParams.get('from') ?? '0', 10) || 0);\n    const size = Math.max(0, parseInt(url.searchParams.get('size') ?? '20', 10) || 20);\n    const matches = this.searchResults.filter((r) => r.name.includes(text));\n    const page = matches.slice(from, from + size);\n    return JSON.stringify({\n      objects: page.map((r) => ({\n        package: {\n          name: r.name,\n          version: r.version,\n          description: 'mock uplink search result',\n          date: '2020-01-01T00:00:00.000Z',\n          maintainers: [{ username: 'mock-uplink', email: 'mock@example.org' }],\n          links: { npm: `http://localhost:${this.port}/${r.name}` },\n        },\n        score: { final: 1, detail: { quality: 1, popularity: 1, maintenance: 1 } },\n        searchScore: 1,\n        flags: {},\n      })),\n      total: matches.length,\n      time: new Date('2020-01-01T00:00:00.000Z').toISOString(),\n    });\n  }\n\n  private packument(pkg: MockPackage): string {\n    const tarballUrl = `http://localhost:${this.port}/${pkg.name}/-/${pkg.name}-${pkg.version}.tgz`;\n    return JSON.stringify({\n      name: pkg.name,\n      'dist-tags': { latest: pkg.version },\n      versions: {\n        [pkg.version]: {\n          name: pkg.name,\n          version: pkg.version,\n          description: 'mock uplink package',\n          dist: { tarball: tarballUrl, shasum: pkg.shasum, integrity: pkg.integrity },\n        },\n      },\n      time: {\n        created: '2020-01-01T00:00:00.000Z',\n        modified: '2020-01-01T00:00:00.000Z',\n        [pkg.version]: '2020-01-01T00:00:00.000Z',\n      },\n    });\n  }\n\n  start(): Promise<void> {\n    this.server = createServer((req, res) => {\n      const url = req.url || '';\n      this.requests.push(url);\n      debug('mock uplink %s %s (mode: %s)', req.method, url, this.mode);\n\n      const respond = () => {\n        if (this.mode === 'error-500') {\n          res.writeHead(500, { 'Content-Type': 'application/json' });\n          res.end(JSON.stringify({ error: 'mock uplink internal error' }));\n          return;\n        }\n\n        // Search route: /-/v1/search?text=...&from=...&size=...\n        if (url.startsWith('/-/v1/search')) {\n          res.writeHead(200, { 'Content-Type': 'application/json' });\n          res.end(this.searchResponse(new URL(url, `http://localhost:${this.port}`)));\n          return;\n        }\n\n        // Tarball route: /<name>/-/<file>.tgz — parsed without a regex to\n        // avoid backtracking on untrusted input (CodeQL js/polynomial-redos).\n        const tarballSep = url.indexOf('/-/');\n        if (tarballSep > 0 && url.endsWith('.tgz')) {\n          const pkg = this.packages.get(decodeURIComponent(url.slice(1, tarballSep)));\n          if (!pkg) {\n            res.writeHead(404, { 'Content-Type': 'application/json' });\n            res.end(JSON.stringify({ error: 'not found' }));\n            return;\n          }\n          if (this.mode === 'drop-mid-stream') {\n            res.writeHead(200, {\n              'Content-Type': 'application/octet-stream',\n              'Content-Length': String(pkg.tarball.length),\n            });\n            res.write(pkg.tarball.subarray(0, Math.floor(pkg.tarball.length / 2)));\n            // Kill the connection before the body completes.\n            setTimeout(() => res.socket?.destroy(), 50);\n            return;\n          }\n          res.writeHead(200, {\n            'Content-Type': 'application/octet-stream',\n            'Content-Length': String(pkg.tarball.length),\n          });\n          res.end(pkg.tarball);\n          return;\n        }\n\n        // Packument route: /<name>\n        const pkg = this.packages.get(decodeURIComponent(url.slice(1)));\n        if (!pkg) {\n          res.writeHead(404, { 'Content-Type': 'application/json' });\n          res.end(JSON.stringify({ error: 'not found' }));\n          return;\n        }\n        res.writeHead(200, { 'Content-Type': 'application/json' });\n        res.end(this.packument(pkg));\n      };\n\n      // The registry (or a stopped server) may have torn the socket down by the\n      // time a delayed response fires — never let that crash the mock.\n      const safeRespond = () => {\n        try {\n          respond();\n        } catch (err) {\n          debug('mock uplink response failed (socket gone?): %s', err);\n        }\n      };\n\n      if (this.mode === 'slow') {\n        // Longer than the uplink timeout configured for the e2e registry (3s).\n        const timer = setTimeout(safeRespond, 10_000);\n        res.socket?.once('close', () => clearTimeout(timer));\n      } else {\n        safeRespond();\n      }\n    });\n\n    return new Promise((resolve, reject) => {\n      this.server!.once('error', reject);\n      this.server!.listen(this.port, () => {\n        debug('mock uplink listening on %d', this.port);\n        resolve();\n      });\n    });\n  }\n\n  stop(): Promise<void> {\n    return new Promise((resolve) => {\n      if (!this.server) {\n        resolve();\n        return;\n      }\n      // closeAllConnections drops keep-alive sockets so close() completes.\n      this.server.closeAllConnections?.();\n      this.server.close(() => {\n        debug('mock uplink stopped');\n        this.server = undefined;\n        resolve();\n      });\n    });\n  }\n}\n"],"mappings":";;;;;;;AAMA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,+BAA+B;;;;;;;;AA2BxD,IAAa,aAAb,MAAwB;CAOM;CAN5B,OAA0B;CAC1B,WAA4B,CAAC;CAC7B;CACA,2BAAmB,IAAI,IAAyB;CAChD,gBAA6D,CAAC;CAE9D,YAAY,MAA8B;EAAd,KAAA,OAAA;CAAe;;CAG3C,WAAW,MAAc,eAAe,OAAwB;EAC9D,MAAM,WAAA,GAAU,OAAA,YAAA,CAAY,YAAY;EACxC,MAAM,EAAE,QAAQ,cAAc,oBAAA,YAAY,OAAO;EACjD,MAAM,MAAmB;GAAE;GAAM,SAAS;GAAS;GAAS;GAAQ;EAAU;EAC9E,KAAK,SAAS,IAAI,MAAM,GAAG;EAC3B,OAAO;CACT;;CAGA,gBAAgB,MAAc,UAAU,SAAe;EACrD,KAAK,cAAc,KAAK;GAAE;GAAM;EAAQ,CAAC;CAC3C;;;;;;;CAQA,eAAuB,KAAkB;EACvC,MAAM,OAAO,IAAI,aAAa,IAAI,MAAM,KAAK;EAC7C,MAAM,OAAO,KAAK,IAAI,GAAG,SAAS,IAAI,aAAa,IAAI,MAAM,KAAK,KAAK,EAAE,KAAK,CAAC;EAC/E,MAAM,OAAO,KAAK,IAAI,GAAG,SAAS,IAAI,aAAa,IAAI,MAAM,KAAK,MAAM,EAAE,KAAK,EAAE;EACjF,MAAM,UAAU,KAAK,cAAc,QAAQ,MAAM,EAAE,KAAK,SAAS,IAAI,CAAC;EACtE,MAAM,OAAO,QAAQ,MAAM,MAAM,OAAO,IAAI;EAC5C,OAAO,KAAK,UAAU;GACpB,SAAS,KAAK,KAAK,OAAO;IACxB,SAAS;KACP,MAAM,EAAE;KACR,SAAS,EAAE;KACX,aAAa;KACb,MAAM;KACN,aAAa,CAAC;MAAE,UAAU;MAAe,OAAO;KAAmB,CAAC;KACpE,OAAO,EAAE,KAAK,oBAAoB,KAAK,KAAK,GAAG,EAAE,OAAO;IAC1D;IACA,OAAO;KAAE,OAAO;KAAG,QAAQ;MAAE,SAAS;MAAG,YAAY;MAAG,aAAa;KAAE;IAAE;IACzE,aAAa;IACb,OAAO,CAAC;GACV,EAAE;GACF,OAAO,QAAQ;GACf,uBAAM,IAAI,KAAK,0BAA0B,EAAA,CAAE,YAAY;EACzD,CAAC;CACH;CAEA,UAAkB,KAA0B;EAC1C,MAAM,aAAa,oBAAoB,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,KAAK,GAAG,IAAI,QAAQ;EAC1F,OAAO,KAAK,UAAU;GACpB,MAAM,IAAI;GACV,aAAa,EAAE,QAAQ,IAAI,QAAQ;GACnC,UAAU,GACP,IAAI,UAAU;IACb,MAAM,IAAI;IACV,SAAS,IAAI;IACb,aAAa;IACb,MAAM;KAAE,SAAS;KAAY,QAAQ,IAAI;KAAQ,WAAW,IAAI;IAAU;GAC5E,EACF;GACA,MAAM;IACJ,SAAS;IACT,UAAU;KACT,IAAI,UAAU;GACjB;EACF,CAAC;CACH;CAEA,QAAuB;EACrB,KAAK,UAAA,GAAS,KAAA,aAAA,EAAc,KAAK,QAAQ;GACvC,MAAM,MAAM,IAAI,OAAO;GACvB,KAAK,SAAS,KAAK,GAAG;GACtB,QAAM,gCAAgC,IAAI,QAAQ,KAAK,KAAK,IAAI;GAEhE,MAAM,gBAAgB;IACpB,IAAI,KAAK,SAAS,aAAa;KAC7B,IAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;KACzD,IAAI,IAAI,KAAK,UAAU,EAAE,OAAO,6BAA6B,CAAC,CAAC;KAC/D;IACF;IAGA,IAAI,IAAI,WAAW,cAAc,GAAG;KAClC,IAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;KACzD,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,oBAAoB,KAAK,MAAM,CAAC,CAAC;KAC1E;IACF;IAIA,MAAM,aAAa,IAAI,QAAQ,KAAK;IACpC,IAAI,aAAa,KAAK,IAAI,SAAS,MAAM,GAAG;KAC1C,MAAM,MAAM,KAAK,SAAS,IAAI,mBAAmB,IAAI,MAAM,GAAG,UAAU,CAAC,CAAC;KAC1E,IAAI,CAAC,KAAK;MACR,IAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;MACzD,IAAI,IAAI,KAAK,UAAU,EAAE,OAAO,YAAY,CAAC,CAAC;MAC9C;KACF;KACA,IAAI,KAAK,SAAS,mBAAmB;MACnC,IAAI,UAAU,KAAK;OACjB,gBAAgB;OAChB,kBAAkB,OAAO,IAAI,QAAQ,MAAM;MAC7C,CAAC;MACD,IAAI,MAAM,IAAI,QAAQ,SAAS,GAAG,KAAK,MAAM,IAAI,QAAQ,SAAS,CAAC,CAAC,CAAC;MAErE,iBAAiB,IAAI,QAAQ,QAAQ,GAAG,EAAE;MAC1C;KACF;KACA,IAAI,UAAU,KAAK;MACjB,gBAAgB;MAChB,kBAAkB,OAAO,IAAI,QAAQ,MAAM;KAC7C,CAAC;KACD,IAAI,IAAI,IAAI,OAAO;KACnB;IACF;IAGA,MAAM,MAAM,KAAK,SAAS,IAAI,mBAAmB,IAAI,MAAM,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK;KACR,IAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;KACzD,IAAI,IAAI,KAAK,UAAU,EAAE,OAAO,YAAY,CAAC,CAAC;KAC9C;IACF;IACA,IAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;IACzD,IAAI,IAAI,KAAK,UAAU,GAAG,CAAC;GAC7B;GAIA,MAAM,oBAAoB;IACxB,IAAI;KACF,QAAQ;IACV,SAAS,KAAK;KACZ,QAAM,kDAAkD,GAAG;IAC7D;GACF;GAEA,IAAI,KAAK,SAAS,QAAQ;IAExB,MAAM,QAAQ,WAAW,aAAa,GAAM;IAC5C,IAAI,QAAQ,KAAK,eAAe,aAAa,KAAK,CAAC;GACrD,OACE,YAAY;EAEhB,CAAC;EAED,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,KAAK,OAAQ,KAAK,SAAS,MAAM;GACjC,KAAK,OAAQ,OAAO,KAAK,YAAY;IACnC,QAAM,+BAA+B,KAAK,IAAI;IAC9C,QAAQ;GACV,CAAC;EACH,CAAC;CACH;CAEA,OAAsB;EACpB,OAAO,IAAI,SAAS,YAAY;GAC9B,IAAI,CAAC,KAAK,QAAQ;IAChB,QAAQ;IACR;GACF;GAEA,KAAK,OAAO,sBAAsB;GAClC,KAAK,OAAO,YAAY;IACtB,QAAM,qBAAqB;IAC3B,KAAK,SAAS,KAAA;IACd,QAAQ;GACV,CAAC;EACH,CAAC;CACH;AACF"}

package/build/cjs/utils/pending-checks.cjs

@@ -0,0 +1,21 @@
+//#region src/utils/pending-checks.ts
+/**
+* Pending contract checks pin registry behavior that is correct per the
+* npmjs contract but still red against some published Verdaccio versions.
+* They are off by default; E2E_PENDING_CONTRACT_CHECKS enables them:
+*
+*   E2E_PENDING_CONTRACT_CHECKS=true              → all scenarios
+*   E2E_PENDING_CONTRACT_CHECKS=tarballs          → one scenario
+*   E2E_PENDING_CONTRACT_CHECKS=tarballs,search   → a list
+*
+* Flip the default once the registry-side fixes are published everywhere.
+*/
+function pendingContractChecksEnabled(scenario) {
+	const value = (process.env.E2E_PENDING_CONTRACT_CHECKS || "").toLowerCase();
+	if (value === "true" || value === "1" || value === "all") return true;
+	return value.split(",").map((entry) => entry.trim()).includes(scenario);
+}
+//#endregion
+exports.pendingContractChecksEnabled = pendingContractChecksEnabled;
+
+//# sourceMappingURL=pending-checks.cjs.map

package/build/cjs/utils/pending-checks.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-checks.cjs","names":[],"sources":["../../../src/utils/pending-checks.ts"],"sourcesContent":["/**\n * Pending contract checks pin registry behavior that is correct per the\n * npmjs contract but still red against some published Verdaccio versions.\n * They are off by default; E2E_PENDING_CONTRACT_CHECKS enables them:\n *\n *   E2E_PENDING_CONTRACT_CHECKS=true              → all scenarios\n *   E2E_PENDING_CONTRACT_CHECKS=tarballs          → one scenario\n *   E2E_PENDING_CONTRACT_CHECKS=tarballs,search   → a list\n *\n * Flip the default once the registry-side fixes are published everywhere.\n */\nexport function pendingContractChecksEnabled(scenario: string): boolean {\n  const value = (process.env.E2E_PENDING_CONTRACT_CHECKS || '').toLowerCase();\n  if (value === 'true' || value === '1' || value === 'all') {\n    return true;\n  }\n  return value\n    .split(',')\n    .map((entry) => entry.trim())\n    .includes(scenario);\n}\n"],"mappings":";;;;;;;;;;;;AAWA,SAAgB,6BAA6B,UAA2B;CACtE,MAAM,SAAS,QAAQ,IAAI,+BAA+B,GAAA,CAAI,YAAY;CAC1E,IAAI,UAAU,UAAU,UAAU,OAAO,UAAU,OACjD,OAAO;CAET,OAAO,MACJ,MAAM,GAAG,CAAC,CACV,KAAK,UAAU,MAAM,KAAK,CAAC,CAAC,CAC5B,SAAS,QAAQ;AACtB"}