@verdaccio/e2e-cli 3.4.0 → 4.0.0

package/build/cjs/adapters/pnpm.cjs

@@ -8,18 +8,7 @@ let path = require("path");
 let fs_promises = require("fs/promises");
 //#region src/adapters/pnpm.ts
 var debug$1 = (0, debug.default)("verdaccio:e2e-cli:pnpm");
-var PNPM_V10_COMMANDS = /* @__PURE__ */ new Set([
-	"publish",
-	"unpublish",
-	"install",
-	"info",
-	"audit",
-	"deprecate",
-	"dist-tag",
-	"ping",
-	"search"
-]);
-var PNPM_V11_COMMANDS = /* @__PURE__ */ new Set([
+var PNPM_COMMANDS = /* @__PURE__ */ new Set([
 	"publish",
 	"unpublish",
 	"install",
@@ -27,15 +16,7 @@ var PNPM_V11_COMMANDS = /* @__PURE__ */ new Set([
 	"audit",
 	"deprecate"
 ]);
-function getSupportedCommands(version) {
-	const major = parseInt(version.split(".")[0], 10);
-	if (major >= 11) {
-		debug$1("pnpm v%d detected, using v11 command set", major);
-		return PNPM_V11_COMMANDS;
-	}
-	return PNPM_V10_COMMANDS;
-}
-var PNPM_MIN_SUPPORTED_MAJOR = 10;
+var PNPM_MIN_SUPPORTED_MAJOR = 11;
 function detectVersion(bin) {
 	try {
 		return (0, child_process.execSync)(`${bin} --version`, {
@@ -78,7 +59,7 @@ function createPnpmAdapter(binPath, version) {
 		name: `pnpm@${resolved}`,
 		type: "pnpm",
 		bin,
-		supports: getSupportedCommands(resolved),
+		supports: PNPM_COMMANDS,
 		registryArg(url) {
 			return ["--registry", url];
 		},

package/build/cjs/adapters/pnpm.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"pnpm.cjs","names":[],"sources":["../../../src/adapters/pnpm.ts"],"sourcesContent":["import { SpawnOptions, execSync } from 'child_process';\nimport buildDebug from 'debug';\nimport { writeFile } from 'fs/promises';\nimport { join } from 'path';\n\nimport { ExecOutput, PackageManagerAdapter } from '../types';\nimport { exec } from '../utils/process';\nimport { prepareGenericEmptyProject } from '../utils/project';\n\nconst debug = buildDebug('verdaccio:e2e-cli:pnpm');\n\nconst PNPM_V10_COMMANDS = new Set([\n  'publish',\n  'unpublish',\n  'install',\n  'info',\n  'audit',\n  'deprecate',\n  'dist-tag',\n  'ping',\n  'search',\n]);\n\n// pnpm v11 removed ping and search\n// dist-tag output format changed (no --json), needs adapted assertions\nconst PNPM_V11_COMMANDS = new Set([\n  'publish',\n  'unpublish',\n  'install',\n  'info',\n  'audit',\n  'deprecate',\n]);\n\nfunction getSupportedCommands(version: string): Set<string> {\n  const major = parseInt(version.split('.')[0], 10);\n  if (major >= 11) {\n    debug('pnpm v%d detected, using v11 command set', major);\n    return PNPM_V11_COMMANDS;\n  }\n  return PNPM_V10_COMMANDS;\n}\n\n// pnpm 8 and 9 are end-of-life and no longer supported by the suite.\nconst PNPM_MIN_SUPPORTED_MAJOR = 10;\n\nfunction detectVersion(bin: string): string {\n  try {\n    return execSync(`${bin} --version`, { encoding: 'utf8', timeout: 5000 }).trim();\n  } catch {\n    return 'unknown';\n  }\n}\n\nfunction assertSupportedVersion(resolved: string): void {\n  const major = parseInt(resolved.split('.')[0], 10);\n  if (!Number.isNaN(major) && major < PNPM_MIN_SUPPORTED_MAJOR) {\n    throw new Error(\n      `pnpm@${resolved} is not supported. Minimum supported major: ${PNPM_MIN_SUPPORTED_MAJOR}`\n    );\n  }\n}\n\nfunction installPnpm(version: string): string {\n  const pkg = `pnpm@${version}`;\n  debug('installing %s into temp dir', pkg);\n  const tmpDir = execSync('mktemp -d', { encoding: 'utf8' }).trim();\n  execSync(`npm install --prefix \"${tmpDir}\" ${pkg} --loglevel=error`, {\n    encoding: 'utf8',\n    timeout: 30000,\n  });\n  const bin = `${tmpDir}/node_modules/.bin/pnpm`;\n  const installed = detectVersion(bin);\n  debug('installed pnpm %s at %s', installed, bin);\n  console.log(`  Auto-installed pnpm ${installed}`);\n  return bin;\n}\n\nfunction resolvePnpmBin(binPath?: string, version?: string): string {\n  if (binPath) return binPath;\n  if (version) return installPnpm(version);\n  return 'pnpm';\n}\n\nexport function createPnpmAdapter(binPath?: string, version?: string): PackageManagerAdapter {\n  const bin = resolvePnpmBin(binPath, version);\n  const resolved = detectVersion(bin);\n  assertSupportedVersion(resolved);\n  debug('creating pnpm adapter with bin: %s (%s)', bin, resolved);\n\n  const adapter: PackageManagerAdapter = {\n    name: `pnpm@${resolved}`,\n    type: 'pnpm',\n    bin,\n    supports: getSupportedCommands(resolved),\n\n    registryArg(url: string): string[] {\n      return ['--registry', url];\n    },\n\n    prefixArg(folder: string): string[] {\n      return ['--prefix', folder];\n    },\n\n    exec(options: SpawnOptions, ...args: string[]): Promise<ExecOutput> {\n      const major = parseInt(resolved.split('.')[0], 10);\n      if (major >= 11) {\n        // pnpm v11: native deprecate/unpublish don't support --json\n        const cmd = args[0];\n        if (cmd === 'deprecate' || cmd === 'unpublish' || cmd === 'publish' || cmd === 'dist-tag') {\n          args = args.filter((a) => a !== '--json' && !a.startsWith('--loglevel'));\n        }\n        // pnpm v11: un-deprecate uses `undeprecate` command instead of `deprecate pkg \"\"`\n        if (cmd === 'deprecate') {\n          // Check if message arg is empty string (un-deprecate)\n          // args: ['deprecate', 'pkg@version', '', ...flags]\n          const msgIdx = 2; // message is the third arg\n          if (args.length > msgIdx && args[msgIdx] === '') {\n            args = ['undeprecate', args[1], ...args.slice(3)];\n          }\n        }\n        // pnpm v11: native version command doesn't accept --registry, --loglevel, or --no--git-tag-version\n        if (cmd === 'version') {\n          args = args.filter(\n            (a) =>\n              !a.startsWith('--registry') &&\n              !a.startsWith('--loglevel') &&\n              !a.startsWith('--no--git-tag-version')\n          );\n        }\n      }\n      return exec(options, bin, args);\n    },\n\n    async prepareProject(\n      packageName: string,\n      version: string,\n      registryUrl: string,\n      port: number,\n      token: string,\n      dependencies: Record<string, string> = {},\n      devDependencies: Record<string, string> = {}\n    ): Promise<{ tempFolder: string }> {\n      const project = await prepareGenericEmptyProject(\n        packageName,\n        version,\n        port,\n        token,\n        registryUrl,\n        dependencies,\n        devDependencies\n      );\n      // pnpm 11.24+ enforces a minimumReleaseAge cooldown by default, which\n      // rejects the just-published packages these tests install\n      // (ERR_PNPM_NO_MATURE_MATCHING_VERSION). Disable it per project via\n      // pnpm-workspace.yaml — the file also marks the temp folder as its own\n      // workspace root, isolating it from any parent workspace. Tests that\n      // exercise the cooldown itself overwrite this file with their own config.\n      await writeFile(join(project.tempFolder, 'pnpm-workspace.yaml'), 'minimumReleaseAge: 0\\n');\n      return project;\n    },\n  };\n\n  return adapter;\n}\n"],"mappings":";;;;;;;;;AASA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,wBAAwB;AAEjD,IAAM,oCAAoB,IAAI,IAAI;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAID,IAAM,oCAAoB,IAAI,IAAI;CAChC;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,qBAAqB,SAA8B;CAC1D,MAAM,QAAQ,SAAS,QAAQ,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE;CAChD,IAAI,SAAS,IAAI;EACf,QAAM,4CAA4C,KAAK;EACvD,OAAO;CACT;CACA,OAAO;AACT;AAGA,IAAM,2BAA2B;AAEjC,SAAS,cAAc,KAAqB;CAC1C,IAAI;EACF,QAAA,GAAO,cAAA,SAAA,CAAS,GAAG,IAAI,aAAa;GAAE,UAAU;GAAQ,SAAS;EAAK,CAAC,CAAC,CAAC,KAAK;CAChF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,uBAAuB,UAAwB;CACtD,MAAM,QAAQ,SAAS,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE;CACjD,IAAI,CAAC,OAAO,MAAM,KAAK,KAAK,QAAQ,0BAClC,MAAM,IAAI,MACR,QAAQ,SAAS,8CAA8C,0BACjE;AAEJ;AAEA,SAAS,YAAY,SAAyB;CAC5C,MAAM,MAAM,QAAQ;CACpB,QAAM,+BAA+B,GAAG;CACxC,MAAM,UAAA,GAAS,cAAA,SAAA,CAAS,aAAa,EAAE,UAAU,OAAO,CAAC,CAAC,CAAC,KAAK;CAChE,CAAA,GAAA,cAAA,SAAA,CAAS,yBAAyB,OAAO,IAAI,IAAI,oBAAoB;EACnE,UAAU;EACV,SAAS;CACX,CAAC;CACD,MAAM,MAAM,GAAG,OAAO;CACtB,MAAM,YAAY,cAAc,GAAG;CACnC,QAAM,2BAA2B,WAAW,GAAG;CAC/C,QAAQ,IAAI,yBAAyB,WAAW;CAChD,OAAO;AACT;AAEA,SAAS,eAAe,SAAkB,SAA0B;CAClE,IAAI,SAAS,OAAO;CACpB,IAAI,SAAS,OAAO,YAAY,OAAO;CACvC,OAAO;AACT;AAEA,SAAgB,kBAAkB,SAAkB,SAAyC;CAC3F,MAAM,MAAM,eAAe,SAAS,OAAO;CAC3C,MAAM,WAAW,cAAc,GAAG;CAClC,uBAAuB,QAAQ;CAC/B,QAAM,2CAA2C,KAAK,QAAQ;CA2E9D,OAAO;EAxEL,MAAM,QAAQ;EACd,MAAM;EACN;EACA,UAAU,qBAAqB,QAAQ;EAEvC,YAAY,KAAuB;GACjC,OAAO,CAAC,cAAc,GAAG;EAC3B;EAEA,UAAU,QAA0B;GAClC,OAAO,CAAC,YAAY,MAAM;EAC5B;EAEA,KAAK,SAAuB,GAAG,MAAqC;GAElE,IADc,SAAS,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,EAC3C,KAAS,IAAI;IAEf,MAAM,MAAM,KAAK;IACjB,IAAI,QAAQ,eAAe,QAAQ,eAAe,QAAQ,aAAa,QAAQ,YAC7E,OAAO,KAAK,QAAQ,MAAM,MAAM,YAAY,CAAC,EAAE,WAAW,YAAY,CAAC;IAGzE,IAAI,QAAQ,aAAa;KAGvB,MAAM,SAAS;KACf,IAAI,KAAK,SAAS,UAAU,KAAK,YAAY,IAC3C,OAAO;MAAC;MAAe,KAAK;MAAI,GAAG,KAAK,MAAM,CAAC;KAAC;IAEpD;IAEA,IAAI,QAAQ,WACV,OAAO,KAAK,QACT,MACC,CAAC,EAAE,WAAW,YAAY,KAC1B,CAAC,EAAE,WAAW,YAAY,KAC1B,CAAC,EAAE,WAAW,uBAAuB,CACzC;GAEJ;GACA,OAAO,gBAAA,KAAK,SAAS,KAAK,IAAI;EAChC;EAEA,MAAM,eACJ,aACA,SACA,aACA,MACA,OACA,eAAuC,CAAC,GACxC,kBAA0C,CAAC,GACV;GACjC,MAAM,UAAU,MAAM,gBAAA,2BACpB,aACA,SACA,MACA,OACA,aACA,cACA,eACF;GAOA,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,QAAQ,YAAY,qBAAqB,GAAG,wBAAwB;GACzF,OAAO;EACT;CAGK;AACT"}
+{"version":3,"file":"pnpm.cjs","names":[],"sources":["../../../src/adapters/pnpm.ts"],"sourcesContent":["import { SpawnOptions, execSync } from 'child_process';\nimport buildDebug from 'debug';\nimport { writeFile } from 'fs/promises';\nimport { join } from 'path';\n\nimport { ExecOutput, PackageManagerAdapter } from '../types';\nimport { exec } from '../utils/process';\nimport { prepareGenericEmptyProject } from '../utils/project';\n\nconst debug = buildDebug('verdaccio:e2e-cli:pnpm');\n\n// pnpm removed ping and search; the dist-tag output changed (no --json) and needs adapted assertions\nconst PNPM_COMMANDS = new Set(['publish', 'unpublish', 'install', 'info', 'audit', 'deprecate']);\n\n// pnpm 8, 9 and 10 are no longer supported by the suite.\nconst PNPM_MIN_SUPPORTED_MAJOR = 11;\n\nfunction detectVersion(bin: string): string {\n  try {\n    return execSync(`${bin} --version`, { encoding: 'utf8', timeout: 5000 }).trim();\n  } catch {\n    return 'unknown';\n  }\n}\n\nfunction assertSupportedVersion(resolved: string): void {\n  const major = parseInt(resolved.split('.')[0], 10);\n  if (!Number.isNaN(major) && major < PNPM_MIN_SUPPORTED_MAJOR) {\n    throw new Error(\n      `pnpm@${resolved} is not supported. Minimum supported major: ${PNPM_MIN_SUPPORTED_MAJOR}`\n    );\n  }\n}\n\nfunction installPnpm(version: string): string {\n  const pkg = `pnpm@${version}`;\n  debug('installing %s into temp dir', pkg);\n  const tmpDir = execSync('mktemp -d', { encoding: 'utf8' }).trim();\n  execSync(`npm install --prefix \"${tmpDir}\" ${pkg} --loglevel=error`, {\n    encoding: 'utf8',\n    timeout: 30000,\n  });\n  const bin = `${tmpDir}/node_modules/.bin/pnpm`;\n  const installed = detectVersion(bin);\n  debug('installed pnpm %s at %s', installed, bin);\n  console.log(`  Auto-installed pnpm ${installed}`);\n  return bin;\n}\n\nfunction resolvePnpmBin(binPath?: string, version?: string): string {\n  if (binPath) return binPath;\n  if (version) return installPnpm(version);\n  return 'pnpm';\n}\n\nexport function createPnpmAdapter(binPath?: string, version?: string): PackageManagerAdapter {\n  const bin = resolvePnpmBin(binPath, version);\n  const resolved = detectVersion(bin);\n  assertSupportedVersion(resolved);\n  debug('creating pnpm adapter with bin: %s (%s)', bin, resolved);\n\n  const adapter: PackageManagerAdapter = {\n    name: `pnpm@${resolved}`,\n    type: 'pnpm',\n    bin,\n    supports: PNPM_COMMANDS,\n\n    registryArg(url: string): string[] {\n      return ['--registry', url];\n    },\n\n    prefixArg(folder: string): string[] {\n      return ['--prefix', folder];\n    },\n\n    exec(options: SpawnOptions, ...args: string[]): Promise<ExecOutput> {\n      const major = parseInt(resolved.split('.')[0], 10);\n      if (major >= 11) {\n        // pnpm v11: native deprecate/unpublish don't support --json\n        const cmd = args[0];\n        if (cmd === 'deprecate' || cmd === 'unpublish' || cmd === 'publish' || cmd === 'dist-tag') {\n          args = args.filter((a) => a !== '--json' && !a.startsWith('--loglevel'));\n        }\n        // pnpm v11: un-deprecate uses `undeprecate` command instead of `deprecate pkg \"\"`\n        if (cmd === 'deprecate') {\n          // Check if message arg is empty string (un-deprecate)\n          // args: ['deprecate', 'pkg@version', '', ...flags]\n          const msgIdx = 2; // message is the third arg\n          if (args.length > msgIdx && args[msgIdx] === '') {\n            args = ['undeprecate', args[1], ...args.slice(3)];\n          }\n        }\n        // pnpm v11: native version command doesn't accept --registry, --loglevel, or --no--git-tag-version\n        if (cmd === 'version') {\n          args = args.filter(\n            (a) =>\n              !a.startsWith('--registry') &&\n              !a.startsWith('--loglevel') &&\n              !a.startsWith('--no--git-tag-version')\n          );\n        }\n      }\n      return exec(options, bin, args);\n    },\n\n    async prepareProject(\n      packageName: string,\n      version: string,\n      registryUrl: string,\n      port: number,\n      token: string,\n      dependencies: Record<string, string> = {},\n      devDependencies: Record<string, string> = {}\n    ): Promise<{ tempFolder: string }> {\n      const project = await prepareGenericEmptyProject(\n        packageName,\n        version,\n        port,\n        token,\n        registryUrl,\n        dependencies,\n        devDependencies\n      );\n      // pnpm 11.24+ enforces a minimumReleaseAge cooldown by default, which\n      // rejects the just-published packages these tests install\n      // (ERR_PNPM_NO_MATURE_MATCHING_VERSION). Disable it per project via\n      // pnpm-workspace.yaml — the file also marks the temp folder as its own\n      // workspace root, isolating it from any parent workspace. Tests that\n      // exercise the cooldown itself overwrite this file with their own config.\n      await writeFile(join(project.tempFolder, 'pnpm-workspace.yaml'), 'minimumReleaseAge: 0\\n');\n      return project;\n    },\n  };\n\n  return adapter;\n}\n"],"mappings":";;;;;;;;;AASA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,wBAAwB;AAGjD,IAAM,gCAAgB,IAAI,IAAI;CAAC;CAAW;CAAa;CAAW;CAAQ;CAAS;AAAW,CAAC;AAG/F,IAAM,2BAA2B;AAEjC,SAAS,cAAc,KAAqB;CAC1C,IAAI;EACF,QAAA,GAAO,cAAA,SAAA,CAAS,GAAG,IAAI,aAAa;GAAE,UAAU;GAAQ,SAAS;EAAK,CAAC,CAAC,CAAC,KAAK;CAChF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,uBAAuB,UAAwB;CACtD,MAAM,QAAQ,SAAS,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE;CACjD,IAAI,CAAC,OAAO,MAAM,KAAK,KAAK,QAAQ,0BAClC,MAAM,IAAI,MACR,QAAQ,SAAS,8CAA8C,0BACjE;AAEJ;AAEA,SAAS,YAAY,SAAyB;CAC5C,MAAM,MAAM,QAAQ;CACpB,QAAM,+BAA+B,GAAG;CACxC,MAAM,UAAA,GAAS,cAAA,SAAA,CAAS,aAAa,EAAE,UAAU,OAAO,CAAC,CAAC,CAAC,KAAK;CAChE,CAAA,GAAA,cAAA,SAAA,CAAS,yBAAyB,OAAO,IAAI,IAAI,oBAAoB;EACnE,UAAU;EACV,SAAS;CACX,CAAC;CACD,MAAM,MAAM,GAAG,OAAO;CACtB,MAAM,YAAY,cAAc,GAAG;CACnC,QAAM,2BAA2B,WAAW,GAAG;CAC/C,QAAQ,IAAI,yBAAyB,WAAW;CAChD,OAAO;AACT;AAEA,SAAS,eAAe,SAAkB,SAA0B;CAClE,IAAI,SAAS,OAAO;CACpB,IAAI,SAAS,OAAO,YAAY,OAAO;CACvC,OAAO;AACT;AAEA,SAAgB,kBAAkB,SAAkB,SAAyC;CAC3F,MAAM,MAAM,eAAe,SAAS,OAAO;CAC3C,MAAM,WAAW,cAAc,GAAG;CAClC,uBAAuB,QAAQ;CAC/B,QAAM,2CAA2C,KAAK,QAAQ;CA2E9D,OAAO;EAxEL,MAAM,QAAQ;EACd,MAAM;EACN;EACA,UAAU;EAEV,YAAY,KAAuB;GACjC,OAAO,CAAC,cAAc,GAAG;EAC3B;EAEA,UAAU,QAA0B;GAClC,OAAO,CAAC,YAAY,MAAM;EAC5B;EAEA,KAAK,SAAuB,GAAG,MAAqC;GAElE,IADc,SAAS,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,EAC3C,KAAS,IAAI;IAEf,MAAM,MAAM,KAAK;IACjB,IAAI,QAAQ,eAAe,QAAQ,eAAe,QAAQ,aAAa,QAAQ,YAC7E,OAAO,KAAK,QAAQ,MAAM,MAAM,YAAY,CAAC,EAAE,WAAW,YAAY,CAAC;IAGzE,IAAI,QAAQ,aAAa;KAGvB,MAAM,SAAS;KACf,IAAI,KAAK,SAAS,UAAU,KAAK,YAAY,IAC3C,OAAO;MAAC;MAAe,KAAK;MAAI,GAAG,KAAK,MAAM,CAAC;KAAC;IAEpD;IAEA,IAAI,QAAQ,WACV,OAAO,KAAK,QACT,MACC,CAAC,EAAE,WAAW,YAAY,KAC1B,CAAC,EAAE,WAAW,YAAY,KAC1B,CAAC,EAAE,WAAW,uBAAuB,CACzC;GAEJ;GACA,OAAO,gBAAA,KAAK,SAAS,KAAK,IAAI;EAChC;EAEA,MAAM,eACJ,aACA,SACA,aACA,MACA,OACA,eAAuC,CAAC,GACxC,kBAA0C,CAAC,GACV;GACjC,MAAM,UAAU,MAAM,gBAAA,2BACpB,aACA,SACA,MACA,OACA,aACA,cACA,eACF;GAOA,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,QAAQ,YAAY,qBAAqB,GAAG,wBAAwB;GACzF,OAAO;EACT;CAGK;AACT"}

package/build/cjs/index.cjs

@@ -10,8 +10,8 @@ const require_yarn_modern = require("./adapters/yarn-modern.cjs");
 require("./adapters/index.cjs");
 const require_runner = require("./runner.cjs");
 const require_index$1 = require("./scenarios/index.cjs");
-const require_index$2 = require("./tests/index.cjs");
 const require_registry_client = require("./utils/registry-client.cjs");
+const require_index$2 = require("./tests/index.cjs");
 let debug = require("debug");
 debug = require_runtime.__toESM(debug, 1);
 //#region src/index.ts

package/build/cjs/scenarios/minimum-release-age.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"minimum-release-age.cjs","names":[],"sources":["../../../src/scenarios/minimum-release-age.ts"],"sourcesContent":["import assert from 'assert';\nimport { writeFile } from 'fs/promises';\nimport { join } from 'path';\n\nimport { PackageManagerAdapter, TestContext, TestDefinition } from '../types';\nimport { trace } from '../utils/process';\n\n/**\n * Scenario: minimum-release-age (pnpm 11.1+ only)\n *\n * Exercises pnpm's `minimumReleaseAge` cooldown together with\n * `minimumReleaseAgeExclude`. With a 7-day (10080 minute) cooldown, freshly\n * published versions are normally not installable until they age past the\n * threshold — but packages matching the exclude globs bypass the check.\n *\n *   minimumReleaseAge: 10080\n *   minimumReleaseAgeStrict: true\n *   minimumReleaseAgeExclude:\n *     - '@verdaccio/*'\n *     - 'verdaccio-*'\n *\n * minimumReleaseAgeStrict is required on pnpm 12: without it, pnpm 12\n * auto-adds new direct dependencies to minimumReleaseAgeExclude instead of\n * failing. pnpm 11 enforces the cooldown unconditionally and ignores the key.\n *\n * The scenario publishes brand-new (age ~0) packages and asserts:\n *   - an excluded scoped package   (@verdaccio/*) installs despite the cooldown\n *   - an excluded unscoped package (verdaccio-*)  installs despite the cooldown\n *   - a non-excluded package is blocked by the cooldown (proving it is active)\n *\n * pnpm reads these settings from `pnpm-workspace.yaml`, mirroring the\n * configuration used by the repo root. The cooldown is only enforced from\n * pnpm 11.1.0 onward (11.0.x silently ignores it), so the scenario is gated to\n * that version range — see {@link isPnpm11Plus}.\n */\n\nconst MINIMUM_RELEASE_AGE = 10080; // 7 days, in minutes\nconst MINIMUM_RELEASE_AGE_EXCLUDE = ['@verdaccio/*', 'verdaccio-*'];\n\nconst PNPM_WORKSPACE_YAML = [\n  `minimumReleaseAge: ${MINIMUM_RELEASE_AGE}`,\n  // pnpm 12 no longer blocks new direct dependencies by default: it auto-adds\n  // them to minimumReleaseAgeExclude in pnpm-workspace.yaml and proceeds.\n  // minimumReleaseAgeStrict restores the blocking behavior this scenario\n  // asserts (ERR_PNPM_NO_MATURE_MATCHING_VERSION); pnpm 11 ignores the key.\n  'minimumReleaseAgeStrict: true',\n  'minimumReleaseAgeExclude:',\n  ...MINIMUM_RELEASE_AGE_EXCLUDE.map((glob) => `  - '${glob}'`),\n  '',\n].join('\\n');\n\n/**\n * True only for pnpm versions that actually enforce minimumReleaseAge.\n *\n * The cooldown is honored in pnpm 11.1.0+, but it is silently ignored in\n * 11.0.0 / 11.0.1 (and the 11.0.0 release candidates) — those versions install\n * brand-new packages regardless of the configured cooldown. We scope this\n * scenario to pnpm 11.1.0 and newer so it doesn't false-fail on that regression.\n */\nexport function isPnpm11Plus(adapter: PackageManagerAdapter): boolean {\n  if (adapter.type !== 'pnpm') {\n    return false;\n  }\n  const match = adapter.name.match(/pnpm@(\\d+)\\.(\\d+)/);\n  if (!match) {\n    return false;\n  }\n  const major = parseInt(match[1], 10);\n  const minor = parseInt(match[2], 10);\n  return major > 11 || (major === 11 && minor >= 1);\n}\n\nasync function publishPackage(ctx: TestContext, pkgName: string, version: string): Promise<void> {\n  trace('publishing %s@%s', pkgName, version);\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    pkgName,\n    version,\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token\n  );\n  await ctx.adapter.exec(\n    { cwd: tempFolder },\n    'publish',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n  trace('published %s@%s', pkgName, version);\n}\n\n/**\n * Build a consumer project with the minimumReleaseAge cooldown configured in\n * pnpm-workspace.yaml, depending on the given packages.\n */\nasync function prepareCooldownConsumer(\n  ctx: TestContext,\n  consumerName: string,\n  dependencies: Record<string, string>\n): Promise<string> {\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    consumerName,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token,\n    dependencies\n  );\n  await writeFile(join(tempFolder, 'pnpm-workspace.yaml'), PNPM_WORKSPACE_YAML);\n  trace('prepared cooldown consumer %s at %s', consumerName, tempFolder);\n  return tempFolder;\n}\n\nasync function testMinimumReleaseAge(ctx: TestContext): Promise<void> {\n  const id = ctx.runId;\n\n  const excludedScoped = `@verdaccio/release-age-${id}`;\n  const excludedUnscoped = `verdaccio-release-age-${id}`;\n  const blocked = `e2e-release-age-blocked-${id}`;\n\n  // --- Phase 1: Publish brand-new (age ~0) packages ---\n  await ctx.subTest('publish fresh packages', async () => {\n    await publishPackage(ctx, excludedScoped, '1.0.0');\n    await publishPackage(ctx, excludedUnscoped, '1.0.0');\n    await publishPackage(ctx, blocked, '1.0.0');\n  });\n\n  // --- Phase 2: Excluded packages install despite the cooldown ---\n  await ctx.subTest('excluded packages bypass the cooldown', async () => {\n    const tempFolder = await prepareCooldownConsumer(ctx, `@verdaccio/consumer-excluded-${id}`, {\n      [excludedScoped]: '1.0.0',\n      [excludedUnscoped]: '1.0.0',\n    });\n\n    // Should succeed: both deps match the exclude globs.\n    await ctx.adapter.exec(\n      { cwd: tempFolder },\n      'install',\n      ...ctx.adapter.registryArg(ctx.registryUrl)\n    );\n\n    trace('excluded packages installed successfully under cooldown');\n  });\n\n  // --- Phase 3: Non-excluded fresh package is blocked by the cooldown ---\n  await ctx.subTest('non-excluded fresh package is blocked', async () => {\n    const tempFolder = await prepareCooldownConsumer(ctx, `e2e-consumer-blocked-${id}`, {\n      [blocked]: '1.0.0',\n    });\n\n    let errorMessage = '';\n    try {\n      await ctx.adapter.exec(\n        { cwd: tempFolder },\n        'install',\n        // pnpm 12's parser rejects the `--flag=false` form; --no-frozen-lockfile\n        // is accepted by pnpm 10, 11 and 12 alike\n        '--no-frozen-lockfile',\n        ...ctx.adapter.registryArg(ctx.registryUrl)\n      );\n    } catch (err) {\n      errorMessage = err instanceof Error ? err.message : String(err);\n      trace('install correctly rejected by cooldown: %s', errorMessage.split('\\n')[0]);\n    }\n\n    assert.ok(\n      errorMessage,\n      `Expected install of fresh non-excluded package \"${blocked}\" to be blocked by ` +\n        `minimumReleaseAge (${MINIMUM_RELEASE_AGE} min), but it succeeded`\n    );\n    // pnpm reports ERR_PNPM_NO_MATURE_MATCHING_VERSION / \"minimumReleaseAge\" when a\n    // version is too new. Assert the failure is the cooldown, not an unrelated error.\n    assert.ok(\n      /minimumReleaseAge|NO_MATURE_MATCHING_VERSION/i.test(errorMessage),\n      `Install of \"${blocked}\" failed for an unexpected reason (expected a minimumReleaseAge ` +\n        `cooldown error):\\n${errorMessage}`\n    );\n  });\n}\n\nexport const minimumReleaseAgeScenario: TestDefinition = {\n  name: 'scenario:minimum-release-age',\n  requires: ['publish', 'install'],\n  appliesTo: isPnpm11Plus,\n  run: testMinimumReleaseAge,\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,IAAM,sBAAsB;AAG5B,IAAM,sBAAsB;CAC1B,sBAAsB;CAKtB;CACA;CACA,GAAG,CAVgC,gBAAgB,aAUhD,CAAA,CAA4B,KAAK,SAAS,QAAQ,KAAK,EAAE;CAC5D;AACF,CAAC,CAAC,KAAK,IAAI;;;;;;;;;AAUX,SAAgB,aAAa,SAAyC;CACpE,IAAI,QAAQ,SAAS,QACnB,OAAO;CAET,MAAM,QAAQ,QAAQ,KAAK,MAAM,mBAAmB;CACpD,IAAI,CAAC,OACH,OAAO;CAET,MAAM,QAAQ,SAAS,MAAM,IAAI,EAAE;CACnC,MAAM,QAAQ,SAAS,MAAM,IAAI,EAAE;CACnC,OAAO,QAAQ,MAAO,UAAU,MAAM,SAAS;AACjD;AAEA,eAAe,eAAe,KAAkB,SAAiB,SAAgC;CAC/F,gBAAA,MAAM,oBAAoB,SAAS,OAAO;CAC1C,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,SACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;CACA,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CACA,gBAAA,MAAM,mBAAmB,SAAS,OAAO;AAC3C;;;;;AAMA,eAAe,wBACb,KACA,cACA,cACiB;CACjB,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,cACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,OACJ,YACF;CACA,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,YAAY,qBAAqB,GAAG,mBAAmB;CAC5E,gBAAA,MAAM,uCAAuC,cAAc,UAAU;CACrE,OAAO;AACT;AAEA,eAAe,sBAAsB,KAAiC;CACpE,MAAM,KAAK,IAAI;CAEf,MAAM,iBAAiB,0BAA0B;CACjD,MAAM,mBAAmB,yBAAyB;CAClD,MAAM,UAAU,2BAA2B;CAG3C,MAAM,IAAI,QAAQ,0BAA0B,YAAY;EACtD,MAAM,eAAe,KAAK,gBAAgB,OAAO;EACjD,MAAM,eAAe,KAAK,kBAAkB,OAAO;EACnD,MAAM,eAAe,KAAK,SAAS,OAAO;CAC5C,CAAC;CAGD,MAAM,IAAI,QAAQ,yCAAyC,YAAY;EACrE,MAAM,aAAa,MAAM,wBAAwB,KAAK,gCAAgC,MAAM;IACzF,iBAAiB;IACjB,mBAAmB;EACtB,CAAC;EAGD,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EAEA,gBAAA,MAAM,yDAAyD;CACjE,CAAC;CAGD,MAAM,IAAI,QAAQ,yCAAyC,YAAY;EACrE,MAAM,aAAa,MAAM,wBAAwB,KAAK,wBAAwB,MAAM,GACjF,UAAU,QACb,CAAC;EAED,IAAI,eAAe;EACnB,IAAI;GACF,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WAGA,wBACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EACF,SAAS,KAAK;GACZ,eAAe,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GAC9D,gBAAA,MAAM,8CAA8C,aAAa,MAAM,IAAI,CAAC,CAAC,EAAE;EACjF;EAEA,OAAA,QAAO,GACL,cACA,mDAAmD,QAAQ,wCACnC,oBAAoB,wBAC9C;EAGA,OAAA,QAAO,GACL,gDAAgD,KAAK,YAAY,GACjE,eAAe,QAAQ,oFACA,cACzB;CACF,CAAC;AACH;AAEA,IAAa,4BAA4C;CACvD,MAAM;CACN,UAAU,CAAC,WAAW,SAAS;CAC/B,WAAW;CACX,KAAK;AACP"}
+{"version":3,"file":"minimum-release-age.cjs","names":[],"sources":["../../../src/scenarios/minimum-release-age.ts"],"sourcesContent":["import assert from 'assert';\nimport { writeFile } from 'fs/promises';\nimport { join } from 'path';\n\nimport { PackageManagerAdapter, TestContext, TestDefinition } from '../types';\nimport { trace } from '../utils/process';\n\n/**\n * Scenario: minimum-release-age (pnpm 11.1+ only)\n *\n * Exercises pnpm's `minimumReleaseAge` cooldown together with\n * `minimumReleaseAgeExclude`. With a 7-day (10080 minute) cooldown, freshly\n * published versions are normally not installable until they age past the\n * threshold — but packages matching the exclude globs bypass the check.\n *\n *   minimumReleaseAge: 10080\n *   minimumReleaseAgeStrict: true\n *   minimumReleaseAgeExclude:\n *     - '@verdaccio/*'\n *     - 'verdaccio-*'\n *\n * minimumReleaseAgeStrict is required on pnpm 12: without it, pnpm 12\n * auto-adds new direct dependencies to minimumReleaseAgeExclude instead of\n * failing. pnpm 11 enforces the cooldown unconditionally and ignores the key.\n *\n * The scenario publishes brand-new (age ~0) packages and asserts:\n *   - an excluded scoped package   (@verdaccio/*) installs despite the cooldown\n *   - an excluded unscoped package (verdaccio-*)  installs despite the cooldown\n *   - a non-excluded package is blocked by the cooldown (proving it is active)\n *\n * pnpm reads these settings from `pnpm-workspace.yaml`, mirroring the\n * configuration used by the repo root. The cooldown is only enforced from\n * pnpm 11.1.0 onward (11.0.x silently ignores it), so the scenario is gated to\n * that version range — see {@link isPnpm11Plus}.\n */\n\nconst MINIMUM_RELEASE_AGE = 10080; // 7 days, in minutes\nconst MINIMUM_RELEASE_AGE_EXCLUDE = ['@verdaccio/*', 'verdaccio-*'];\n\nconst PNPM_WORKSPACE_YAML = [\n  `minimumReleaseAge: ${MINIMUM_RELEASE_AGE}`,\n  // pnpm 12 no longer blocks new direct dependencies by default: it auto-adds\n  // them to minimumReleaseAgeExclude in pnpm-workspace.yaml and proceeds.\n  // minimumReleaseAgeStrict restores the blocking behavior this scenario\n  // asserts (ERR_PNPM_NO_MATURE_MATCHING_VERSION); pnpm 11 ignores the key.\n  'minimumReleaseAgeStrict: true',\n  'minimumReleaseAgeExclude:',\n  ...MINIMUM_RELEASE_AGE_EXCLUDE.map((glob) => `  - '${glob}'`),\n  '',\n].join('\\n');\n\n/**\n * True only for pnpm versions that actually enforce minimumReleaseAge.\n *\n * The cooldown is honored in pnpm 11.1.0+, but it is silently ignored in\n * 11.0.0 / 11.0.1 (and the 11.0.0 release candidates) — those versions install\n * brand-new packages regardless of the configured cooldown. We scope this\n * scenario to pnpm 11.1.0 and newer so it doesn't false-fail on that regression.\n */\nexport function isPnpm11Plus(adapter: PackageManagerAdapter): boolean {\n  if (adapter.type !== 'pnpm') {\n    return false;\n  }\n  const match = adapter.name.match(/pnpm@(\\d+)\\.(\\d+)/);\n  if (!match) {\n    return false;\n  }\n  const major = parseInt(match[1], 10);\n  const minor = parseInt(match[2], 10);\n  return major > 11 || (major === 11 && minor >= 1);\n}\n\nasync function publishPackage(ctx: TestContext, pkgName: string, version: string): Promise<void> {\n  trace('publishing %s@%s', pkgName, version);\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    pkgName,\n    version,\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token\n  );\n  await ctx.adapter.exec(\n    { cwd: tempFolder },\n    'publish',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n  trace('published %s@%s', pkgName, version);\n}\n\n/**\n * Build a consumer project with the minimumReleaseAge cooldown configured in\n * pnpm-workspace.yaml, depending on the given packages.\n */\nasync function prepareCooldownConsumer(\n  ctx: TestContext,\n  consumerName: string,\n  dependencies: Record<string, string>\n): Promise<string> {\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    consumerName,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token,\n    dependencies\n  );\n  await writeFile(join(tempFolder, 'pnpm-workspace.yaml'), PNPM_WORKSPACE_YAML);\n  trace('prepared cooldown consumer %s at %s', consumerName, tempFolder);\n  return tempFolder;\n}\n\nasync function testMinimumReleaseAge(ctx: TestContext): Promise<void> {\n  const id = ctx.runId;\n\n  const excludedScoped = `@verdaccio/release-age-${id}`;\n  const excludedUnscoped = `verdaccio-release-age-${id}`;\n  const blocked = `e2e-release-age-blocked-${id}`;\n\n  // --- Phase 1: Publish brand-new (age ~0) packages ---\n  await ctx.subTest('publish fresh packages', async () => {\n    await publishPackage(ctx, excludedScoped, '1.0.0');\n    await publishPackage(ctx, excludedUnscoped, '1.0.0');\n    await publishPackage(ctx, blocked, '1.0.0');\n  });\n\n  // --- Phase 2: Excluded packages install despite the cooldown ---\n  await ctx.subTest('excluded packages bypass the cooldown', async () => {\n    const tempFolder = await prepareCooldownConsumer(ctx, `@verdaccio/consumer-excluded-${id}`, {\n      [excludedScoped]: '1.0.0',\n      [excludedUnscoped]: '1.0.0',\n    });\n\n    // Should succeed: both deps match the exclude globs.\n    await ctx.adapter.exec(\n      { cwd: tempFolder },\n      'install',\n      ...ctx.adapter.registryArg(ctx.registryUrl)\n    );\n\n    trace('excluded packages installed successfully under cooldown');\n  });\n\n  // --- Phase 3: Non-excluded fresh package is blocked by the cooldown ---\n  await ctx.subTest('non-excluded fresh package is blocked', async () => {\n    const tempFolder = await prepareCooldownConsumer(ctx, `e2e-consumer-blocked-${id}`, {\n      [blocked]: '1.0.0',\n    });\n\n    let errorMessage = '';\n    try {\n      await ctx.adapter.exec(\n        { cwd: tempFolder },\n        'install',\n        // pnpm 12's parser rejects the `--flag=false` form; --no-frozen-lockfile\n        // is accepted by pnpm 11 and 12 alike\n        '--no-frozen-lockfile',\n        ...ctx.adapter.registryArg(ctx.registryUrl)\n      );\n    } catch (err) {\n      errorMessage = err instanceof Error ? err.message : String(err);\n      trace('install correctly rejected by cooldown: %s', errorMessage.split('\\n')[0]);\n    }\n\n    assert.ok(\n      errorMessage,\n      `Expected install of fresh non-excluded package \"${blocked}\" to be blocked by ` +\n        `minimumReleaseAge (${MINIMUM_RELEASE_AGE} min), but it succeeded`\n    );\n    // pnpm reports ERR_PNPM_NO_MATURE_MATCHING_VERSION / \"minimumReleaseAge\" when a\n    // version is too new. Assert the failure is the cooldown, not an unrelated error.\n    assert.ok(\n      /minimumReleaseAge|NO_MATURE_MATCHING_VERSION/i.test(errorMessage),\n      `Install of \"${blocked}\" failed for an unexpected reason (expected a minimumReleaseAge ` +\n        `cooldown error):\\n${errorMessage}`\n    );\n  });\n}\n\nexport const minimumReleaseAgeScenario: TestDefinition = {\n  name: 'scenario:minimum-release-age',\n  requires: ['publish', 'install'],\n  appliesTo: isPnpm11Plus,\n  run: testMinimumReleaseAge,\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,IAAM,sBAAsB;AAG5B,IAAM,sBAAsB;CAC1B,sBAAsB;CAKtB;CACA;CACA,GAAG,CAVgC,gBAAgB,aAUhD,CAAA,CAA4B,KAAK,SAAS,QAAQ,KAAK,EAAE;CAC5D;AACF,CAAC,CAAC,KAAK,IAAI;;;;;;;;;AAUX,SAAgB,aAAa,SAAyC;CACpE,IAAI,QAAQ,SAAS,QACnB,OAAO;CAET,MAAM,QAAQ,QAAQ,KAAK,MAAM,mBAAmB;CACpD,IAAI,CAAC,OACH,OAAO;CAET,MAAM,QAAQ,SAAS,MAAM,IAAI,EAAE;CACnC,MAAM,QAAQ,SAAS,MAAM,IAAI,EAAE;CACnC,OAAO,QAAQ,MAAO,UAAU,MAAM,SAAS;AACjD;AAEA,eAAe,eAAe,KAAkB,SAAiB,SAAgC;CAC/F,gBAAA,MAAM,oBAAoB,SAAS,OAAO;CAC1C,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,SACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;CACA,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CACA,gBAAA,MAAM,mBAAmB,SAAS,OAAO;AAC3C;;;;;AAMA,eAAe,wBACb,KACA,cACA,cACiB;CACjB,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,cACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,OACJ,YACF;CACA,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,YAAY,qBAAqB,GAAG,mBAAmB;CAC5E,gBAAA,MAAM,uCAAuC,cAAc,UAAU;CACrE,OAAO;AACT;AAEA,eAAe,sBAAsB,KAAiC;CACpE,MAAM,KAAK,IAAI;CAEf,MAAM,iBAAiB,0BAA0B;CACjD,MAAM,mBAAmB,yBAAyB;CAClD,MAAM,UAAU,2BAA2B;CAG3C,MAAM,IAAI,QAAQ,0BAA0B,YAAY;EACtD,MAAM,eAAe,KAAK,gBAAgB,OAAO;EACjD,MAAM,eAAe,KAAK,kBAAkB,OAAO;EACnD,MAAM,eAAe,KAAK,SAAS,OAAO;CAC5C,CAAC;CAGD,MAAM,IAAI,QAAQ,yCAAyC,YAAY;EACrE,MAAM,aAAa,MAAM,wBAAwB,KAAK,gCAAgC,MAAM;IACzF,iBAAiB;IACjB,mBAAmB;EACtB,CAAC;EAGD,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EAEA,gBAAA,MAAM,yDAAyD;CACjE,CAAC;CAGD,MAAM,IAAI,QAAQ,yCAAyC,YAAY;EACrE,MAAM,aAAa,MAAM,wBAAwB,KAAK,wBAAwB,MAAM,GACjF,UAAU,QACb,CAAC;EAED,IAAI,eAAe;EACnB,IAAI;GACF,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WAGA,wBACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EACF,SAAS,KAAK;GACZ,eAAe,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GAC9D,gBAAA,MAAM,8CAA8C,aAAa,MAAM,IAAI,CAAC,CAAC,EAAE;EACjF;EAEA,OAAA,QAAO,GACL,cACA,mDAAmD,QAAQ,wCACnC,oBAAoB,wBAC9C;EAGA,OAAA,QAAO,GACL,gDAAgD,KAAK,YAAY,GACjE,eAAe,QAAQ,oFACA,cACzB;CACF,CAAC;AACH;AAEA,IAAa,4BAA4C;CACvD,MAAM;CACN,UAAU,CAAC,WAAW,SAAS;CAC/B,WAAW;CACX,KAAK;AACP"}

package/build/cjs/tests/login.cjs

@@ -1,5 +1,6 @@
 const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
 const require_project = require("../utils/project.cjs");
+const require_registry_client = require("../utils/registry-client.cjs");
 let debug = require("debug");
 debug = require_runtime.__toESM(debug, 1);
 let path = require("path");
@@ -114,6 +115,29 @@ async function testLogin(ctx) {
 		const who2 = await yarnWhoami(ctx, tf);
 		assert.default.ok(who2.includes(user2), `Expected "${user2}" after switch but got "${who2}"`);
 	});
+	for (const client of [
+		"npm",
+		"yarn",
+		"pnpm"
+	]) {
+		await ctx.subTest(`${client} logs an existing user in with the Basic retry`, async () => {
+			const user = `login-retry-${client}-${id}`;
+			const password = "retry-password-123";
+			await require_registry_client.createUser(ctx.registryUrl, user, password);
+			const token = await require_registry_client.legacyLogin(ctx.registryUrl, user, password, client);
+			assert.default.strictEqual(await require_registry_client.whoami(ctx.registryUrl, token), user);
+		});
+		await ctx.subTest(`${client} registers a new user`, async () => {
+			const user = `login-new-${client}-${id}`;
+			const token = await require_registry_client.legacyLogin(ctx.registryUrl, user, "retry-password-123", client);
+			assert.default.strictEqual(await require_registry_client.whoami(ctx.registryUrl, token), user);
+		});
+		await ctx.subTest(`${client} cannot log an existing user in with a wrong password`, async () => {
+			const user = `login-wrong-${client}-${id}`;
+			await require_registry_client.createUser(ctx.registryUrl, user, "retry-password-123");
+			await assert.default.rejects(require_registry_client.legacyLogin(ctx.registryUrl, user, "wrong-password", client), (error) => error instanceof require_registry_client.LegacyLoginError && error.status === 401);
+		});
+	}
 }
 var loginTest = {
 	name: "login",

package/build/cjs/tests/login.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"login.cjs","names":[],"sources":["../../../src/tests/login.ts"],"sourcesContent":["import assert from 'assert';\nimport buildDebug from 'debug';\nimport { writeFile } from 'fs/promises';\nimport * as YAML from 'js-yaml';\nimport { join } from 'path';\n\nimport { TestContext, TestDefinition } from '../types';\nimport { createTempFolder, getPackageJSON, getREADME } from '../utils/project';\n\nconst debug = buildDebug('verdaccio:e2e-cli:test:login');\n\n/**\n * Creates a project with registry config but WITHOUT auth token,\n * so whoami will use the token saved by login to ~/.yarnrc.yml.\n */\nasync function prepareLoginProject(ctx: TestContext, name: string): Promise<string> {\n  debug('preparing project for %s (no auth token)', name);\n  const tempFolder = await createTempFolder(name);\n  const yamlContent = YAML.dump({\n    npmRegistryServer: ctx.registryUrl,\n    enableImmutableInstalls: false,\n    unsafeHttpWhitelist: ['localhost'],\n  });\n  await writeFile(join(tempFolder, '.yarnrc.yml'), yamlContent);\n  await writeFile(join(tempFolder, 'package.json'), JSON.stringify({ name, version: '1.0.0' }));\n  if (ctx.adapter.importPlugin) {\n    debug('importing npm-login plugin into %s', tempFolder);\n    await ctx.adapter.importPlugin(tempFolder, 'npm-login');\n  }\n  return tempFolder;\n}\n\nasync function yarnLogin(\n  ctx: TestContext,\n  cwd: string,\n  user: string,\n  password: string,\n  email: string\n) {\n  debug('yarn npm login as %s', user);\n  return ctx.adapter.exec(\n    { cwd },\n    'login',\n    '--auth-type=legacy',\n    `--user=${user}`,\n    `--password=${password}`,\n    `--email=${email}`\n  );\n}\n\nasync function yarnWhoami(ctx: TestContext, cwd: string): Promise<string> {\n  const resp = await ctx.adapter.exec({ cwd }, 'whoami');\n  debug('yarn npm whoami: %s', resp.stdout);\n  return resp.stdout;\n}\n\nasync function testLogin(ctx: TestContext): Promise<void> {\n  const type = ctx.adapter.type;\n  const id = ctx.runId;\n\n  if (type !== 'yarn-modern') {\n    debug('login test only supported for yarn-modern, skipping %s', type);\n    return;\n  }\n\n  const user1 = `login-a-${id}`;\n  const password1 = 'test-password-123';\n  const email1 = `${user1}@test.example.com`;\n\n  await ctx.subTest('create new user + whoami', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login1-${id}`);\n    const loginResp = await yarnLogin(ctx, tf, user1, password1, email1);\n    assert.ok(\n      loginResp.stdout.includes('Logged in') || loginResp.stdout.includes('token saved'),\n      `Expected login success message but got \"${loginResp.stdout}\"`\n    );\n    const who = await yarnWhoami(ctx, tf);\n    assert.ok(who.includes(user1), `Expected whoami \"${user1}\" but got \"${who}\"`);\n  });\n\n  await ctx.subTest('legacy re-login is rejected without basic auth', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login2-${id}`);\n    let loginFailed = false;\n    try {\n      await yarnLogin(ctx, tf, user1, password1, email1);\n    } catch {\n      loginFailed = true;\n    }\n    assert.ok(loginFailed, 'Legacy re-login for an existing user should fail without Basic auth');\n  });\n\n  await ctx.subTest('wrong password fails', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login3-${id}`);\n    let loginFailed = false;\n    try {\n      await yarnLogin(ctx, tf, user1, 'wrong-password', email1);\n    } catch {\n      loginFailed = true;\n    }\n    assert.ok(loginFailed, 'Login with wrong password should have failed');\n  });\n\n  await ctx.subTest('login then publish', async () => {\n    const pkgName = `@verdaccio/login-pub-${id}`;\n    const publishUser = `login-pub-${id}`;\n    const publishPassword = 'publish-password-123';\n    const publishEmail = `${publishUser}@test.example.com`;\n    const tf = await createTempFolder(`login-pub-${id}`);\n    const yamlContent = YAML.dump({\n      npmRegistryServer: ctx.registryUrl,\n      enableImmutableInstalls: false,\n      unsafeHttpWhitelist: ['localhost'],\n    });\n    await writeFile(join(tf, '.yarnrc.yml'), yamlContent);\n    await writeFile(join(tf, 'package.json'), getPackageJSON(pkgName, '1.0.0'));\n    await writeFile(join(tf, 'README.md'), getREADME(pkgName));\n    if (ctx.adapter.importPlugin) {\n      await ctx.adapter.importPlugin(tf, 'npm-login');\n    }\n    await yarnLogin(ctx, tf, publishUser, publishPassword, publishEmail);\n    await ctx.adapter.exec({ cwd: tf }, 'install');\n    const pubResp = await ctx.adapter.exec({ cwd: tf }, 'publish');\n    assert.ok(\n      pubResp.stdout.includes('Package archive published'),\n      `Expected publish success but got \"${pubResp.stdout}\"`\n    );\n  });\n\n  await ctx.subTest('switch users', async () => {\n    const switchUser1 = `login-switch-a-${id}`;\n    const switchPassword1 = 'switch-password-123';\n    const switchEmail1 = `${switchUser1}@test.example.com`;\n    const user2 = `login-b-${id}`;\n    const password2 = 'other-password-456';\n    const email2 = `${user2}@test.example.com`;\n    const tf = await prepareLoginProject(ctx, `verdaccio-login5-${id}`);\n\n    await yarnLogin(ctx, tf, switchUser1, switchPassword1, switchEmail1);\n    const who1 = await yarnWhoami(ctx, tf);\n    assert.ok(who1.includes(switchUser1), `Expected \"${switchUser1}\" but got \"${who1}\"`);\n\n    await yarnLogin(ctx, tf, user2, password2, email2);\n    const who2 = await yarnWhoami(ctx, tf);\n    assert.ok(who2.includes(user2), `Expected \"${user2}\" after switch but got \"${who2}\"`);\n  });\n}\n\nexport const loginTest: TestDefinition = {\n  name: 'login',\n  requires: ['login'],\n  run: testLogin,\n};\n"],"mappings":";;;;;;;;;;;AASA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,8BAA8B;;;;;AAMvD,eAAe,oBAAoB,KAAkB,MAA+B;CAClF,QAAM,4CAA4C,IAAI;CACtD,MAAM,aAAa,MAAM,gBAAA,iBAAiB,IAAI;CAC9C,MAAM,cAAc,QAAK,KAAK;EAC5B,mBAAmB,IAAI;EACvB,yBAAyB;EACzB,qBAAqB,CAAC,WAAW;CACnC,CAAC;CACD,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,YAAY,aAAa,GAAG,WAAW;CAC5D,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,YAAY,cAAc,GAAG,KAAK,UAAU;EAAE;EAAM,SAAS;CAAQ,CAAC,CAAC;CAC5F,IAAI,IAAI,QAAQ,cAAc;EAC5B,QAAM,sCAAsC,UAAU;EACtD,MAAM,IAAI,QAAQ,aAAa,YAAY,WAAW;CACxD;CACA,OAAO;AACT;AAEA,eAAe,UACb,KACA,KACA,MACA,UACA,OACA;CACA,QAAM,wBAAwB,IAAI;CAClC,OAAO,IAAI,QAAQ,KACjB,EAAE,IAAI,GACN,SACA,sBACA,UAAU,QACV,cAAc,YACd,WAAW,OACb;AACF;AAEA,eAAe,WAAW,KAAkB,KAA8B;CACxE,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,EAAE,IAAI,GAAG,QAAQ;CACrD,QAAM,uBAAuB,KAAK,MAAM;CACxC,OAAO,KAAK;AACd;AAEA,eAAe,UAAU,KAAiC;CACxD,MAAM,OAAO,IAAI,QAAQ;CACzB,MAAM,KAAK,IAAI;CAEf,IAAI,SAAS,eAAe;EAC1B,QAAM,0DAA0D,IAAI;EACpE;CACF;CAEA,MAAM,QAAQ,WAAW;CACzB,MAAM,YAAY;CAClB,MAAM,SAAS,GAAG,MAAM;CAExB,MAAM,IAAI,QAAQ,4BAA4B,YAAY;EACxD,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,MAAM,YAAY,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACnE,OAAA,QAAO,GACL,UAAU,OAAO,SAAS,WAAW,KAAK,UAAU,OAAO,SAAS,aAAa,GACjF,2CAA2C,UAAU,OAAO,EAC9D;EACA,MAAM,MAAM,MAAM,WAAW,KAAK,EAAE;EACpC,OAAA,QAAO,GAAG,IAAI,SAAS,KAAK,GAAG,oBAAoB,MAAM,aAAa,IAAI,EAAE;CAC9E,CAAC;CAED,MAAM,IAAI,QAAQ,kDAAkD,YAAY;EAC9E,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,IAAI,cAAc;EAClB,IAAI;GACF,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACnD,QAAQ;GACN,cAAc;EAChB;EACA,OAAA,QAAO,GAAG,aAAa,qEAAqE;CAC9F,CAAC;CAED,MAAM,IAAI,QAAQ,wBAAwB,YAAY;EACpD,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,IAAI,cAAc;EAClB,IAAI;GACF,MAAM,UAAU,KAAK,IAAI,OAAO,kBAAkB,MAAM;EAC1D,QAAQ;GACN,cAAc;EAChB;EACA,OAAA,QAAO,GAAG,aAAa,8CAA8C;CACvE,CAAC;CAED,MAAM,IAAI,QAAQ,sBAAsB,YAAY;EAClD,MAAM,UAAU,wBAAwB;EACxC,MAAM,cAAc,aAAa;EACjC,MAAM,kBAAkB;EACxB,MAAM,eAAe,GAAG,YAAY;EACpC,MAAM,KAAK,MAAM,gBAAA,iBAAiB,aAAa,IAAI;EACnD,MAAM,cAAc,QAAK,KAAK;GAC5B,mBAAmB,IAAI;GACvB,yBAAyB;GACzB,qBAAqB,CAAC,WAAW;EACnC,CAAC;EACD,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,IAAI,aAAa,GAAG,WAAW;EACpD,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,IAAI,cAAc,GAAG,gBAAA,eAAe,SAAS,OAAO,CAAC;EAC1E,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,IAAI,WAAW,GAAG,gBAAA,UAAU,OAAO,CAAC;EACzD,IAAI,IAAI,QAAQ,cACd,MAAM,IAAI,QAAQ,aAAa,IAAI,WAAW;EAEhD,MAAM,UAAU,KAAK,IAAI,aAAa,iBAAiB,YAAY;EACnE,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,GAAG,GAAG,SAAS;EAC7C,MAAM,UAAU,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,GAAG,GAAG,SAAS;EAC7D,OAAA,QAAO,GACL,QAAQ,OAAO,SAAS,2BAA2B,GACnD,qCAAqC,QAAQ,OAAO,EACtD;CACF,CAAC;CAED,MAAM,IAAI,QAAQ,gBAAgB,YAAY;EAC5C,MAAM,cAAc,kBAAkB;EACtC,MAAM,kBAAkB;EACxB,MAAM,eAAe,GAAG,YAAY;EACpC,MAAM,QAAQ,WAAW;EACzB,MAAM,YAAY;EAClB,MAAM,SAAS,GAAG,MAAM;EACxB,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAElE,MAAM,UAAU,KAAK,IAAI,aAAa,iBAAiB,YAAY;EACnE,MAAM,OAAO,MAAM,WAAW,KAAK,EAAE;EACrC,OAAA,QAAO,GAAG,KAAK,SAAS,WAAW,GAAG,aAAa,YAAY,aAAa,KAAK,EAAE;EAEnF,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK,EAAE;EACrC,OAAA,QAAO,GAAG,KAAK,SAAS,KAAK,GAAG,aAAa,MAAM,0BAA0B,KAAK,EAAE;CACtF,CAAC;AACH;AAEA,IAAa,YAA4B;CACvC,MAAM;CACN,UAAU,CAAC,OAAO;CAClB,KAAK;AACP"}
+{"version":3,"file":"login.cjs","names":[],"sources":["../../../src/tests/login.ts"],"sourcesContent":["import assert from 'assert';\nimport buildDebug from 'debug';\nimport { writeFile } from 'fs/promises';\nimport * as YAML from 'js-yaml';\nimport { join } from 'path';\n\nimport { TestContext, TestDefinition } from '../types';\nimport { createTempFolder, getPackageJSON, getREADME } from '../utils/project';\nimport { LegacyLoginError, createUser, legacyLogin, whoami } from '../utils/registry-client';\n\nconst debug = buildDebug('verdaccio:e2e-cli:test:login');\n\n/**\n * Creates a project with registry config but WITHOUT auth token,\n * so whoami will use the token saved by login to ~/.yarnrc.yml.\n */\nasync function prepareLoginProject(ctx: TestContext, name: string): Promise<string> {\n  debug('preparing project for %s (no auth token)', name);\n  const tempFolder = await createTempFolder(name);\n  const yamlContent = YAML.dump({\n    npmRegistryServer: ctx.registryUrl,\n    enableImmutableInstalls: false,\n    unsafeHttpWhitelist: ['localhost'],\n  });\n  await writeFile(join(tempFolder, '.yarnrc.yml'), yamlContent);\n  await writeFile(join(tempFolder, 'package.json'), JSON.stringify({ name, version: '1.0.0' }));\n  if (ctx.adapter.importPlugin) {\n    debug('importing npm-login plugin into %s', tempFolder);\n    await ctx.adapter.importPlugin(tempFolder, 'npm-login');\n  }\n  return tempFolder;\n}\n\nasync function yarnLogin(\n  ctx: TestContext,\n  cwd: string,\n  user: string,\n  password: string,\n  email: string\n) {\n  debug('yarn npm login as %s', user);\n  return ctx.adapter.exec(\n    { cwd },\n    'login',\n    '--auth-type=legacy',\n    `--user=${user}`,\n    `--password=${password}`,\n    `--email=${email}`\n  );\n}\n\nasync function yarnWhoami(ctx: TestContext, cwd: string): Promise<string> {\n  const resp = await ctx.adapter.exec({ cwd }, 'whoami');\n  debug('yarn npm whoami: %s', resp.stdout);\n  return resp.stdout;\n}\n\nasync function testLogin(ctx: TestContext): Promise<void> {\n  const type = ctx.adapter.type;\n  const id = ctx.runId;\n\n  if (type !== 'yarn-modern') {\n    debug('login test only supported for yarn-modern, skipping %s', type);\n    return;\n  }\n\n  const user1 = `login-a-${id}`;\n  const password1 = 'test-password-123';\n  const email1 = `${user1}@test.example.com`;\n\n  await ctx.subTest('create new user + whoami', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login1-${id}`);\n    const loginResp = await yarnLogin(ctx, tf, user1, password1, email1);\n    assert.ok(\n      loginResp.stdout.includes('Logged in') || loginResp.stdout.includes('token saved'),\n      `Expected login success message but got \"${loginResp.stdout}\"`\n    );\n    const who = await yarnWhoami(ctx, tf);\n    assert.ok(who.includes(user1), `Expected whoami \"${user1}\" but got \"${who}\"`);\n  });\n\n  await ctx.subTest('legacy re-login is rejected without basic auth', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login2-${id}`);\n    let loginFailed = false;\n    try {\n      await yarnLogin(ctx, tf, user1, password1, email1);\n    } catch {\n      loginFailed = true;\n    }\n    assert.ok(loginFailed, 'Legacy re-login for an existing user should fail without Basic auth');\n  });\n\n  await ctx.subTest('wrong password fails', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login3-${id}`);\n    let loginFailed = false;\n    try {\n      await yarnLogin(ctx, tf, user1, 'wrong-password', email1);\n    } catch {\n      loginFailed = true;\n    }\n    assert.ok(loginFailed, 'Login with wrong password should have failed');\n  });\n\n  await ctx.subTest('login then publish', async () => {\n    const pkgName = `@verdaccio/login-pub-${id}`;\n    const publishUser = `login-pub-${id}`;\n    const publishPassword = 'publish-password-123';\n    const publishEmail = `${publishUser}@test.example.com`;\n    const tf = await createTempFolder(`login-pub-${id}`);\n    const yamlContent = YAML.dump({\n      npmRegistryServer: ctx.registryUrl,\n      enableImmutableInstalls: false,\n      unsafeHttpWhitelist: ['localhost'],\n    });\n    await writeFile(join(tf, '.yarnrc.yml'), yamlContent);\n    await writeFile(join(tf, 'package.json'), getPackageJSON(pkgName, '1.0.0'));\n    await writeFile(join(tf, 'README.md'), getREADME(pkgName));\n    if (ctx.adapter.importPlugin) {\n      await ctx.adapter.importPlugin(tf, 'npm-login');\n    }\n    await yarnLogin(ctx, tf, publishUser, publishPassword, publishEmail);\n    await ctx.adapter.exec({ cwd: tf }, 'install');\n    const pubResp = await ctx.adapter.exec({ cwd: tf }, 'publish');\n    assert.ok(\n      pubResp.stdout.includes('Package archive published'),\n      `Expected publish success but got \"${pubResp.stdout}\"`\n    );\n  });\n\n  await ctx.subTest('switch users', async () => {\n    const switchUser1 = `login-switch-a-${id}`;\n    const switchPassword1 = 'switch-password-123';\n    const switchEmail1 = `${switchUser1}@test.example.com`;\n    const user2 = `login-b-${id}`;\n    const password2 = 'other-password-456';\n    const email2 = `${user2}@test.example.com`;\n    const tf = await prepareLoginProject(ctx, `verdaccio-login5-${id}`);\n\n    await yarnLogin(ctx, tf, switchUser1, switchPassword1, switchEmail1);\n    const who1 = await yarnWhoami(ctx, tf);\n    assert.ok(who1.includes(switchUser1), `Expected \"${switchUser1}\" but got \"${who1}\"`);\n\n    await yarnLogin(ctx, tf, user2, password2, email2);\n    const who2 = await yarnWhoami(ctx, tf);\n    assert.ok(who2.includes(user2), `Expected \"${user2}\" after switch but got \"${who2}\"`);\n  });\n\n  // replayed over HTTP: what `npm login`, native `yarn npm login` and `pnpm login` send\n  for (const client of ['npm', 'yarn', 'pnpm'] as const) {\n    await ctx.subTest(`${client} logs an existing user in with the Basic retry`, async () => {\n      const user = `login-retry-${client}-${id}`;\n      const password = 'retry-password-123';\n      await createUser(ctx.registryUrl, user, password);\n\n      const token = await legacyLogin(ctx.registryUrl, user, password, client);\n      assert.strictEqual(await whoami(ctx.registryUrl, token), user);\n    });\n\n    await ctx.subTest(`${client} registers a new user`, async () => {\n      const user = `login-new-${client}-${id}`;\n\n      const token = await legacyLogin(ctx.registryUrl, user, 'retry-password-123', client);\n      assert.strictEqual(await whoami(ctx.registryUrl, token), user);\n    });\n\n    await ctx.subTest(\n      `${client} cannot log an existing user in with a wrong password`,\n      async () => {\n        const user = `login-wrong-${client}-${id}`;\n        await createUser(ctx.registryUrl, user, 'retry-password-123');\n\n        await assert.rejects(\n          legacyLogin(ctx.registryUrl, user, 'wrong-password', client),\n          (error: unknown) => error instanceof LegacyLoginError && error.status === 401\n        );\n      }\n    );\n  }\n}\n\nexport const loginTest: TestDefinition = {\n  name: 'login',\n  requires: ['login'],\n  run: testLogin,\n};\n"],"mappings":";;;;;;;;;;;;AAUA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,8BAA8B;;;;;AAMvD,eAAe,oBAAoB,KAAkB,MAA+B;CAClF,QAAM,4CAA4C,IAAI;CACtD,MAAM,aAAa,MAAM,gBAAA,iBAAiB,IAAI;CAC9C,MAAM,cAAc,QAAK,KAAK;EAC5B,mBAAmB,IAAI;EACvB,yBAAyB;EACzB,qBAAqB,CAAC,WAAW;CACnC,CAAC;CACD,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,YAAY,aAAa,GAAG,WAAW;CAC5D,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,YAAY,cAAc,GAAG,KAAK,UAAU;EAAE;EAAM,SAAS;CAAQ,CAAC,CAAC;CAC5F,IAAI,IAAI,QAAQ,cAAc;EAC5B,QAAM,sCAAsC,UAAU;EACtD,MAAM,IAAI,QAAQ,aAAa,YAAY,WAAW;CACxD;CACA,OAAO;AACT;AAEA,eAAe,UACb,KACA,KACA,MACA,UACA,OACA;CACA,QAAM,wBAAwB,IAAI;CAClC,OAAO,IAAI,QAAQ,KACjB,EAAE,IAAI,GACN,SACA,sBACA,UAAU,QACV,cAAc,YACd,WAAW,OACb;AACF;AAEA,eAAe,WAAW,KAAkB,KAA8B;CACxE,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,EAAE,IAAI,GAAG,QAAQ;CACrD,QAAM,uBAAuB,KAAK,MAAM;CACxC,OAAO,KAAK;AACd;AAEA,eAAe,UAAU,KAAiC;CACxD,MAAM,OAAO,IAAI,QAAQ;CACzB,MAAM,KAAK,IAAI;CAEf,IAAI,SAAS,eAAe;EAC1B,QAAM,0DAA0D,IAAI;EACpE;CACF;CAEA,MAAM,QAAQ,WAAW;CACzB,MAAM,YAAY;CAClB,MAAM,SAAS,GAAG,MAAM;CAExB,MAAM,IAAI,QAAQ,4BAA4B,YAAY;EACxD,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,MAAM,YAAY,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACnE,OAAA,QAAO,GACL,UAAU,OAAO,SAAS,WAAW,KAAK,UAAU,OAAO,SAAS,aAAa,GACjF,2CAA2C,UAAU,OAAO,EAC9D;EACA,MAAM,MAAM,MAAM,WAAW,KAAK,EAAE;EACpC,OAAA,QAAO,GAAG,IAAI,SAAS,KAAK,GAAG,oBAAoB,MAAM,aAAa,IAAI,EAAE;CAC9E,CAAC;CAED,MAAM,IAAI,QAAQ,kDAAkD,YAAY;EAC9E,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,IAAI,cAAc;EAClB,IAAI;GACF,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACnD,QAAQ;GACN,cAAc;EAChB;EACA,OAAA,QAAO,GAAG,aAAa,qEAAqE;CAC9F,CAAC;CAED,MAAM,IAAI,QAAQ,wBAAwB,YAAY;EACpD,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,IAAI,cAAc;EAClB,IAAI;GACF,MAAM,UAAU,KAAK,IAAI,OAAO,kBAAkB,MAAM;EAC1D,QAAQ;GACN,cAAc;EAChB;EACA,OAAA,QAAO,GAAG,aAAa,8CAA8C;CACvE,CAAC;CAED,MAAM,IAAI,QAAQ,sBAAsB,YAAY;EAClD,MAAM,UAAU,wBAAwB;EACxC,MAAM,cAAc,aAAa;EACjC,MAAM,kBAAkB;EACxB,MAAM,eAAe,GAAG,YAAY;EACpC,MAAM,KAAK,MAAM,gBAAA,iBAAiB,aAAa,IAAI;EACnD,MAAM,cAAc,QAAK,KAAK;GAC5B,mBAAmB,IAAI;GACvB,yBAAyB;GACzB,qBAAqB,CAAC,WAAW;EACnC,CAAC;EACD,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,IAAI,aAAa,GAAG,WAAW;EACpD,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,IAAI,cAAc,GAAG,gBAAA,eAAe,SAAS,OAAO,CAAC;EAC1E,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,IAAI,WAAW,GAAG,gBAAA,UAAU,OAAO,CAAC;EACzD,IAAI,IAAI,QAAQ,cACd,MAAM,IAAI,QAAQ,aAAa,IAAI,WAAW;EAEhD,MAAM,UAAU,KAAK,IAAI,aAAa,iBAAiB,YAAY;EACnE,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,GAAG,GAAG,SAAS;EAC7C,MAAM,UAAU,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,GAAG,GAAG,SAAS;EAC7D,OAAA,QAAO,GACL,QAAQ,OAAO,SAAS,2BAA2B,GACnD,qCAAqC,QAAQ,OAAO,EACtD;CACF,CAAC;CAED,MAAM,IAAI,QAAQ,gBAAgB,YAAY;EAC5C,MAAM,cAAc,kBAAkB;EACtC,MAAM,kBAAkB;EACxB,MAAM,eAAe,GAAG,YAAY;EACpC,MAAM,QAAQ,WAAW;EACzB,MAAM,YAAY;EAClB,MAAM,SAAS,GAAG,MAAM;EACxB,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAElE,MAAM,UAAU,KAAK,IAAI,aAAa,iBAAiB,YAAY;EACnE,MAAM,OAAO,MAAM,WAAW,KAAK,EAAE;EACrC,OAAA,QAAO,GAAG,KAAK,SAAS,WAAW,GAAG,aAAa,YAAY,aAAa,KAAK,EAAE;EAEnF,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK,EAAE;EACrC,OAAA,QAAO,GAAG,KAAK,SAAS,KAAK,GAAG,aAAa,MAAM,0BAA0B,KAAK,EAAE;CACtF,CAAC;CAGD,KAAK,MAAM,UAAU;EAAC;EAAO;EAAQ;CAAM,GAAY;EACrD,MAAM,IAAI,QAAQ,GAAG,OAAO,iDAAiD,YAAY;GACvF,MAAM,OAAO,eAAe,OAAO,GAAG;GACtC,MAAM,WAAW;GACjB,MAAM,wBAAA,WAAW,IAAI,aAAa,MAAM,QAAQ;GAEhD,MAAM,QAAQ,MAAM,wBAAA,YAAY,IAAI,aAAa,MAAM,UAAU,MAAM;GACvE,OAAA,QAAO,YAAY,MAAM,wBAAA,OAAO,IAAI,aAAa,KAAK,GAAG,IAAI;EAC/D,CAAC;EAED,MAAM,IAAI,QAAQ,GAAG,OAAO,wBAAwB,YAAY;GAC9D,MAAM,OAAO,aAAa,OAAO,GAAG;GAEpC,MAAM,QAAQ,MAAM,wBAAA,YAAY,IAAI,aAAa,MAAM,sBAAsB,MAAM;GACnF,OAAA,QAAO,YAAY,MAAM,wBAAA,OAAO,IAAI,aAAa,KAAK,GAAG,IAAI;EAC/D,CAAC;EAED,MAAM,IAAI,QACR,GAAG,OAAO,wDACV,YAAY;GACV,MAAM,OAAO,eAAe,OAAO,GAAG;GACtC,MAAM,wBAAA,WAAW,IAAI,aAAa,MAAM,oBAAoB;GAE5D,MAAM,OAAA,QAAO,QACX,wBAAA,YAAY,IAAI,aAAa,MAAM,kBAAkB,MAAM,IAC1D,UAAmB,iBAAiB,wBAAA,oBAAoB,MAAM,WAAW,GAC5E;EACF,CACF;CACF;AACF;AAEA,IAAa,YAA4B;CACvC,MAAM;CACN,UAAU,CAAC,OAAO;CAClB,KAAK;AACP"}

package/build/cjs/utils/registry-client.cjs

@@ -49,8 +49,67 @@ async function pingRegistry(registryUrl) {
 		return false;
 	}
 }
+var LegacyLoginError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+	}
+};
+/**
+* Replays the legacy login the way each client sends it. npm and Yarn retry a
+* 409 with Basic (Yarn on the GET too); pnpm sends Basic on a single PUT. A
+* registry that authenticates the first PUT is accepted too.
+*/
+async function legacyLogin(registryUrl, user, password, client) {
+	const userUrl = `${registryUrl}/-/user/org.couchdb.user:${encodeURIComponent(user)}`;
+	const basic = `Basic ${Buffer.from(`${user}:${password}`).toString("base64")}`;
+	const jsonHeaders = { "Content-Type": "application/json" };
+	const body = {
+		_id: `org.couchdb.user:${user}`,
+		name: user,
+		password,
+		type: "user",
+		roles: [],
+		date: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	const put = (url, headers) => fetch(url, {
+		method: "PUT",
+		headers,
+		body: JSON.stringify(body)
+	});
+	const first = await put(userUrl, client === "pnpm" ? {
+		...jsonHeaders,
+		Authorization: basic,
+		"npm-auth-type": "web"
+	} : jsonHeaders);
+	const firstBody = await first.json();
+	if (first.ok && firstBody.token) {
+		debug$1("%s: first PUT authenticated %s", client, user);
+		return firstBody.token;
+	}
+	if (first.status !== 409) throw new LegacyLoginError(`first PUT answered ${first.status}`, first.status);
+	const current = await fetch(`${userUrl}?write=true`, { headers: client === "yarn" ? { Authorization: basic } : {} });
+	if (!current.ok) throw new LegacyLoginError(`GET answered ${current.status}`, current.status);
+	const currentBody = await current.json();
+	for (const [key, value] of Object.entries(currentBody)) if (!body[key] || key === "roles") body[key] = value;
+	const second = await put(`${userUrl}/-rev/${body._rev}`, {
+		...jsonHeaders,
+		Authorization: basic
+	});
+	const secondBody = await second.json();
+	if (!second.ok || !secondBody.token) throw new LegacyLoginError(`PUT with revision answered ${second.status}`, second.status);
+	return secondBody.token;
+}
+async function whoami(registryUrl, token) {
+	const response = await fetch(`${registryUrl}/-/whoami`, { headers: { Authorization: `Bearer ${token}` } });
+	return response.ok ? (await response.json()).username : void 0;
+}
 //#endregion
+exports.LegacyLoginError = LegacyLoginError;
 exports.createUser = createUser;
+exports.legacyLogin = legacyLogin;
 exports.pingRegistry = pingRegistry;
+exports.whoami = whoami;
 
 //# sourceMappingURL=registry-client.cjs.map

package/build/cjs/utils/registry-client.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"registry-client.cjs","names":[],"sources":["../../../src/utils/registry-client.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { ping } from '@verdaccio/registry-cli';\n\nconst debug = buildDebug('verdaccio:e2e-cli:registry-client');\n\nexport type RegistryAuth = {\n  token: string;\n  user: string;\n};\n\n/**\n * Creates a user on the registry and returns the auth token.\n * Uses a unique username per run to avoid 409 conflicts.\n * Works against any running Verdaccio instance with htpasswd auth.\n */\nexport async function createUser(\n  registryUrl: string,\n  user = `e2e-user-${Date.now()}`,\n  password = 'e2e-test-password'\n): Promise<RegistryAuth> {\n  debug('creating user %s on %s', user, registryUrl);\n  const url = `${registryUrl}/-/user/org.couchdb.user:${encodeURIComponent(user)}`;\n  const response = await fetch(url, {\n    method: 'PUT',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      name: user,\n      password,\n      _id: `org.couchdb.user:${user}`,\n      type: 'user',\n      roles: [],\n      date: new Date().toISOString(),\n    }),\n  });\n\n  const body = (await response.json()) as any;\n\n  if (response.status === 201 || response.status === 200 || response.status === 409) {\n    const token = body.token;\n    if (token) {\n      debug('user %s authenticated, token obtained', user);\n      return { token, user };\n    }\n  }\n\n  throw new Error(\n    `Failed to create/login user \"${user}\" on ${registryUrl}: ${response.status} ${JSON.stringify(body)}`\n  );\n}\n\n/**\n * Ping the registry to check it's alive.\n * Uses @verdaccio/registry-cli ping.\n */\nexport async function pingRegistry(registryUrl: string): Promise<boolean> {\n  debug('pinging %s', registryUrl);\n  try {\n    const result = await ping(registryUrl);\n    return result.ok;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;AAIA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,mCAAmC;;;;;;AAY5D,eAAsB,WACpB,aACA,OAAO,YAAY,KAAK,IAAI,KAC5B,WAAW,qBACY;CACvB,QAAM,0BAA0B,MAAM,WAAW;CACjD,MAAM,MAAM,GAAG,YAAY,2BAA2B,mBAAmB,IAAI;CAC7E,MAAM,WAAW,MAAM,MAAM,KAAK;EAChC,QAAQ;EACR,SAAS,EAAE,gBAAgB,mBAAmB;EAC9C,MAAM,KAAK,UAAU;GACnB,MAAM;GACN;GACA,KAAK,oBAAoB;GACzB,MAAM;GACN,OAAO,CAAC;GACR,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;EAC/B,CAAC;CACH,CAAC;CAED,MAAM,OAAQ,MAAM,SAAS,KAAK;CAElC,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,OAAO,SAAS,WAAW,KAAK;EACjF,MAAM,QAAQ,KAAK;EACnB,IAAI,OAAO;GACT,QAAM,yCAAyC,IAAI;GACnD,OAAO;IAAE;IAAO;GAAK;EACvB;CACF;CAEA,MAAM,IAAI,MACR,gCAAgC,KAAK,OAAO,YAAY,IAAI,SAAS,OAAO,GAAG,KAAK,UAAU,IAAI,GACpG;AACF;;;;;AAMA,eAAsB,aAAa,aAAuC;CACxE,QAAM,cAAc,WAAW;CAC/B,IAAI;EAEF,QAAO,OAAA,GADc,wBAAA,KAAA,CAAK,WAAW,EAAA,CACvB;CAChB,QAAQ;EACN,OAAO;CACT;AACF"}
+{"version":3,"file":"registry-client.cjs","names":[],"sources":["../../../src/utils/registry-client.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { ping } from '@verdaccio/registry-cli';\n\nconst debug = buildDebug('verdaccio:e2e-cli:registry-client');\n\nexport type RegistryAuth = {\n  token: string;\n  user: string;\n};\n\n/**\n * Creates a user on the registry and returns the auth token.\n * Uses a unique username per run to avoid 409 conflicts.\n * Works against any running Verdaccio instance with htpasswd auth.\n */\nexport async function createUser(\n  registryUrl: string,\n  user = `e2e-user-${Date.now()}`,\n  password = 'e2e-test-password'\n): Promise<RegistryAuth> {\n  debug('creating user %s on %s', user, registryUrl);\n  const url = `${registryUrl}/-/user/org.couchdb.user:${encodeURIComponent(user)}`;\n  const response = await fetch(url, {\n    method: 'PUT',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      name: user,\n      password,\n      _id: `org.couchdb.user:${user}`,\n      type: 'user',\n      roles: [],\n      date: new Date().toISOString(),\n    }),\n  });\n\n  const body = (await response.json()) as any;\n\n  if (response.status === 201 || response.status === 200 || response.status === 409) {\n    const token = body.token;\n    if (token) {\n      debug('user %s authenticated, token obtained', user);\n      return { token, user };\n    }\n  }\n\n  throw new Error(\n    `Failed to create/login user \"${user}\" on ${registryUrl}: ${response.status} ${JSON.stringify(body)}`\n  );\n}\n\n/**\n * Ping the registry to check it's alive.\n * Uses @verdaccio/registry-cli ping.\n */\nexport async function pingRegistry(registryUrl: string): Promise<boolean> {\n  debug('pinging %s', registryUrl);\n  try {\n    const result = await ping(registryUrl);\n    return result.ok;\n  } catch {\n    return false;\n  }\n}\n\nexport class LegacyLoginError extends Error {\n  constructor(\n    message: string,\n    readonly status: number\n  ) {\n    super(message);\n  }\n}\n\n/**\n * Replays the legacy login the way each client sends it. npm and Yarn retry a\n * 409 with Basic (Yarn on the GET too); pnpm sends Basic on a single PUT. A\n * registry that authenticates the first PUT is accepted too.\n */\nexport async function legacyLogin(\n  registryUrl: string,\n  user: string,\n  password: string,\n  client: 'npm' | 'yarn' | 'pnpm'\n): Promise<string> {\n  const userUrl = `${registryUrl}/-/user/org.couchdb.user:${encodeURIComponent(user)}`;\n  const basic = `Basic ${Buffer.from(`${user}:${password}`).toString('base64')}`;\n  const jsonHeaders = { 'Content-Type': 'application/json' };\n  const body: Record<string, unknown> = {\n    _id: `org.couchdb.user:${user}`,\n    name: user,\n    password,\n    type: 'user',\n    roles: [],\n    date: new Date().toISOString(),\n  };\n\n  const put = (url: string, headers: Record<string, string>) =>\n    fetch(url, { method: 'PUT', headers, body: JSON.stringify(body) });\n\n  const first = await put(\n    userUrl,\n    client === 'pnpm'\n      ? { ...jsonHeaders, Authorization: basic, 'npm-auth-type': 'web' }\n      : jsonHeaders\n  );\n  const firstBody = (await first.json()) as any;\n  if (first.ok && firstBody.token) {\n    debug('%s: first PUT authenticated %s', client, user);\n    return firstBody.token;\n  }\n  if (first.status !== 409) {\n    throw new LegacyLoginError(`first PUT answered ${first.status}`, first.status);\n  }\n\n  const current = await fetch(`${userUrl}?write=true`, {\n    headers: client === 'yarn' ? { Authorization: basic } : {},\n  });\n  if (!current.ok) {\n    throw new LegacyLoginError(`GET answered ${current.status}`, current.status);\n  }\n  const currentBody = (await current.json()) as Record<string, unknown>;\n  for (const [key, value] of Object.entries(currentBody)) {\n    if (!body[key] || key === 'roles') {\n      body[key] = value;\n    }\n  }\n\n  const second = await put(`${userUrl}/-rev/${body._rev}`, {\n    ...jsonHeaders,\n    Authorization: basic,\n  });\n  const secondBody = (await second.json()) as any;\n  if (!second.ok || !secondBody.token) {\n    throw new LegacyLoginError(`PUT with revision answered ${second.status}`, second.status);\n  }\n  return secondBody.token;\n}\n\nexport async function whoami(registryUrl: string, token: string): Promise<string | undefined> {\n  const response = await fetch(`${registryUrl}/-/whoami`, {\n    headers: { Authorization: `Bearer ${token}` },\n  });\n  return response.ok ? ((await response.json()) as any).username : undefined;\n}\n"],"mappings":";;;;;AAIA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,mCAAmC;;;;;;AAY5D,eAAsB,WACpB,aACA,OAAO,YAAY,KAAK,IAAI,KAC5B,WAAW,qBACY;CACvB,QAAM,0BAA0B,MAAM,WAAW;CACjD,MAAM,MAAM,GAAG,YAAY,2BAA2B,mBAAmB,IAAI;CAC7E,MAAM,WAAW,MAAM,MAAM,KAAK;EAChC,QAAQ;EACR,SAAS,EAAE,gBAAgB,mBAAmB;EAC9C,MAAM,KAAK,UAAU;GACnB,MAAM;GACN;GACA,KAAK,oBAAoB;GACzB,MAAM;GACN,OAAO,CAAC;GACR,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;EAC/B,CAAC;CACH,CAAC;CAED,MAAM,OAAQ,MAAM,SAAS,KAAK;CAElC,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,OAAO,SAAS,WAAW,KAAK;EACjF,MAAM,QAAQ,KAAK;EACnB,IAAI,OAAO;GACT,QAAM,yCAAyC,IAAI;GACnD,OAAO;IAAE;IAAO;GAAK;EACvB;CACF;CAEA,MAAM,IAAI,MACR,gCAAgC,KAAK,OAAO,YAAY,IAAI,SAAS,OAAO,GAAG,KAAK,UAAU,IAAI,GACpG;AACF;;;;;AAMA,eAAsB,aAAa,aAAuC;CACxE,QAAM,cAAc,WAAW;CAC/B,IAAI;EAEF,QAAO,OAAA,GADc,wBAAA,KAAA,CAAK,WAAW,EAAA,CACvB;CAChB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,IAAa,mBAAb,cAAsC,MAAM;CAG/B;CAFX,YACE,SACA,QACA;EACA,MAAM,OAAO;EAFJ,KAAA,SAAA;CAGX;AACF;;;;;;AAOA,eAAsB,YACpB,aACA,MACA,UACA,QACiB;CACjB,MAAM,UAAU,GAAG,YAAY,2BAA2B,mBAAmB,IAAI;CACjF,MAAM,QAAQ,SAAS,OAAO,KAAK,GAAG,KAAK,GAAG,UAAU,CAAC,CAAC,SAAS,QAAQ;CAC3E,MAAM,cAAc,EAAE,gBAAgB,mBAAmB;CACzD,MAAM,OAAgC;EACpC,KAAK,oBAAoB;EACzB,MAAM;EACN;EACA,MAAM;EACN,OAAO,CAAC;EACR,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;CAC/B;CAEA,MAAM,OAAO,KAAa,YACxB,MAAM,KAAK;EAAE,QAAQ;EAAO;EAAS,MAAM,KAAK,UAAU,IAAI;CAAE,CAAC;CAEnE,MAAM,QAAQ,MAAM,IAClB,SACA,WAAW,SACP;EAAE,GAAG;EAAa,eAAe;EAAO,iBAAiB;CAAM,IAC/D,WACN;CACA,MAAM,YAAa,MAAM,MAAM,KAAK;CACpC,IAAI,MAAM,MAAM,UAAU,OAAO;EAC/B,QAAM,kCAAkC,QAAQ,IAAI;EACpD,OAAO,UAAU;CACnB;CACA,IAAI,MAAM,WAAW,KACnB,MAAM,IAAI,iBAAiB,sBAAsB,MAAM,UAAU,MAAM,MAAM;CAG/E,MAAM,UAAU,MAAM,MAAM,GAAG,QAAQ,cAAc,EACnD,SAAS,WAAW,SAAS,EAAE,eAAe,MAAM,IAAI,CAAC,EAC3D,CAAC;CACD,IAAI,CAAC,QAAQ,IACX,MAAM,IAAI,iBAAiB,gBAAgB,QAAQ,UAAU,QAAQ,MAAM;CAE7E,MAAM,cAAe,MAAM,QAAQ,KAAK;CACxC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,WAAW,GACnD,IAAI,CAAC,KAAK,QAAQ,QAAQ,SACxB,KAAK,OAAO;CAIhB,MAAM,SAAS,MAAM,IAAI,GAAG,QAAQ,QAAQ,KAAK,QAAQ;EACvD,GAAG;EACH,eAAe;CACjB,CAAC;CACD,MAAM,aAAc,MAAM,OAAO,KAAK;CACtC,IAAI,CAAC,OAAO,MAAM,CAAC,WAAW,OAC5B,MAAM,IAAI,iBAAiB,8BAA8B,OAAO,UAAU,OAAO,MAAM;CAEzF,OAAO,WAAW;AACpB;AAEA,eAAsB,OAAO,aAAqB,OAA4C;CAC5F,MAAM,WAAW,MAAM,MAAM,GAAG,YAAY,YAAY,EACtD,SAAS,EAAE,eAAe,UAAU,QAAQ,EAC9C,CAAC;CACD,OAAO,SAAS,MAAO,MAAM,SAAS,KAAK,EAAA,CAAW,WAAW,KAAA;AACnE"}

package/build/esm/adapters/pnpm.js

@@ -6,18 +6,7 @@ import { join } from "path";
 import { writeFile } from "fs/promises";
 //#region src/adapters/pnpm.ts
 var debug = buildDebug("verdaccio:e2e-cli:pnpm");
-var PNPM_V10_COMMANDS = /* @__PURE__ */ new Set([
-	"publish",
-	"unpublish",
-	"install",
-	"info",
-	"audit",
-	"deprecate",
-	"dist-tag",
-	"ping",
-	"search"
-]);
-var PNPM_V11_COMMANDS = /* @__PURE__ */ new Set([
+var PNPM_COMMANDS = /* @__PURE__ */ new Set([
 	"publish",
 	"unpublish",
 	"install",
@@ -25,15 +14,7 @@ var PNPM_V11_COMMANDS = /* @__PURE__ */ new Set([
 	"audit",
 	"deprecate"
 ]);
-function getSupportedCommands(version) {
-	const major = parseInt(version.split(".")[0], 10);
-	if (major >= 11) {
-		debug("pnpm v%d detected, using v11 command set", major);
-		return PNPM_V11_COMMANDS;
-	}
-	return PNPM_V10_COMMANDS;
-}
-var PNPM_MIN_SUPPORTED_MAJOR = 10;
+var PNPM_MIN_SUPPORTED_MAJOR = 11;
 function detectVersion(bin) {
 	try {
 		return execSync(`${bin} --version`, {
@@ -76,7 +57,7 @@ function createPnpmAdapter(binPath, version) {
 		name: `pnpm@${resolved}`,
 		type: "pnpm",
 		bin,
-		supports: getSupportedCommands(resolved),
+		supports: PNPM_COMMANDS,
 		registryArg(url) {
 			return ["--registry", url];
 		},

package/build/esm/adapters/pnpm.js.map

@@ -1 +1 @@
-{"version":3,"file":"pnpm.js","names":[],"sources":["../../../src/adapters/pnpm.ts"],"sourcesContent":["import { SpawnOptions, execSync } from 'child_process';\nimport buildDebug from 'debug';\nimport { writeFile } from 'fs/promises';\nimport { join } from 'path';\n\nimport { ExecOutput, PackageManagerAdapter } from '../types';\nimport { exec } from '../utils/process';\nimport { prepareGenericEmptyProject } from '../utils/project';\n\nconst debug = buildDebug('verdaccio:e2e-cli:pnpm');\n\nconst PNPM_V10_COMMANDS = new Set([\n  'publish',\n  'unpublish',\n  'install',\n  'info',\n  'audit',\n  'deprecate',\n  'dist-tag',\n  'ping',\n  'search',\n]);\n\n// pnpm v11 removed ping and search\n// dist-tag output format changed (no --json), needs adapted assertions\nconst PNPM_V11_COMMANDS = new Set([\n  'publish',\n  'unpublish',\n  'install',\n  'info',\n  'audit',\n  'deprecate',\n]);\n\nfunction getSupportedCommands(version: string): Set<string> {\n  const major = parseInt(version.split('.')[0], 10);\n  if (major >= 11) {\n    debug('pnpm v%d detected, using v11 command set', major);\n    return PNPM_V11_COMMANDS;\n  }\n  return PNPM_V10_COMMANDS;\n}\n\n// pnpm 8 and 9 are end-of-life and no longer supported by the suite.\nconst PNPM_MIN_SUPPORTED_MAJOR = 10;\n\nfunction detectVersion(bin: string): string {\n  try {\n    return execSync(`${bin} --version`, { encoding: 'utf8', timeout: 5000 }).trim();\n  } catch {\n    return 'unknown';\n  }\n}\n\nfunction assertSupportedVersion(resolved: string): void {\n  const major = parseInt(resolved.split('.')[0], 10);\n  if (!Number.isNaN(major) && major < PNPM_MIN_SUPPORTED_MAJOR) {\n    throw new Error(\n      `pnpm@${resolved} is not supported. Minimum supported major: ${PNPM_MIN_SUPPORTED_MAJOR}`\n    );\n  }\n}\n\nfunction installPnpm(version: string): string {\n  const pkg = `pnpm@${version}`;\n  debug('installing %s into temp dir', pkg);\n  const tmpDir = execSync('mktemp -d', { encoding: 'utf8' }).trim();\n  execSync(`npm install --prefix \"${tmpDir}\" ${pkg} --loglevel=error`, {\n    encoding: 'utf8',\n    timeout: 30000,\n  });\n  const bin = `${tmpDir}/node_modules/.bin/pnpm`;\n  const installed = detectVersion(bin);\n  debug('installed pnpm %s at %s', installed, bin);\n  console.log(`  Auto-installed pnpm ${installed}`);\n  return bin;\n}\n\nfunction resolvePnpmBin(binPath?: string, version?: string): string {\n  if (binPath) return binPath;\n  if (version) return installPnpm(version);\n  return 'pnpm';\n}\n\nexport function createPnpmAdapter(binPath?: string, version?: string): PackageManagerAdapter {\n  const bin = resolvePnpmBin(binPath, version);\n  const resolved = detectVersion(bin);\n  assertSupportedVersion(resolved);\n  debug('creating pnpm adapter with bin: %s (%s)', bin, resolved);\n\n  const adapter: PackageManagerAdapter = {\n    name: `pnpm@${resolved}`,\n    type: 'pnpm',\n    bin,\n    supports: getSupportedCommands(resolved),\n\n    registryArg(url: string): string[] {\n      return ['--registry', url];\n    },\n\n    prefixArg(folder: string): string[] {\n      return ['--prefix', folder];\n    },\n\n    exec(options: SpawnOptions, ...args: string[]): Promise<ExecOutput> {\n      const major = parseInt(resolved.split('.')[0], 10);\n      if (major >= 11) {\n        // pnpm v11: native deprecate/unpublish don't support --json\n        const cmd = args[0];\n        if (cmd === 'deprecate' || cmd === 'unpublish' || cmd === 'publish' || cmd === 'dist-tag') {\n          args = args.filter((a) => a !== '--json' && !a.startsWith('--loglevel'));\n        }\n        // pnpm v11: un-deprecate uses `undeprecate` command instead of `deprecate pkg \"\"`\n        if (cmd === 'deprecate') {\n          // Check if message arg is empty string (un-deprecate)\n          // args: ['deprecate', 'pkg@version', '', ...flags]\n          const msgIdx = 2; // message is the third arg\n          if (args.length > msgIdx && args[msgIdx] === '') {\n            args = ['undeprecate', args[1], ...args.slice(3)];\n          }\n        }\n        // pnpm v11: native version command doesn't accept --registry, --loglevel, or --no--git-tag-version\n        if (cmd === 'version') {\n          args = args.filter(\n            (a) =>\n              !a.startsWith('--registry') &&\n              !a.startsWith('--loglevel') &&\n              !a.startsWith('--no--git-tag-version')\n          );\n        }\n      }\n      return exec(options, bin, args);\n    },\n\n    async prepareProject(\n      packageName: string,\n      version: string,\n      registryUrl: string,\n      port: number,\n      token: string,\n      dependencies: Record<string, string> = {},\n      devDependencies: Record<string, string> = {}\n    ): Promise<{ tempFolder: string }> {\n      const project = await prepareGenericEmptyProject(\n        packageName,\n        version,\n        port,\n        token,\n        registryUrl,\n        dependencies,\n        devDependencies\n      );\n      // pnpm 11.24+ enforces a minimumReleaseAge cooldown by default, which\n      // rejects the just-published packages these tests install\n      // (ERR_PNPM_NO_MATURE_MATCHING_VERSION). Disable it per project via\n      // pnpm-workspace.yaml — the file also marks the temp folder as its own\n      // workspace root, isolating it from any parent workspace. Tests that\n      // exercise the cooldown itself overwrite this file with their own config.\n      await writeFile(join(project.tempFolder, 'pnpm-workspace.yaml'), 'minimumReleaseAge: 0\\n');\n      return project;\n    },\n  };\n\n  return adapter;\n}\n"],"mappings":";;;;;;;AASA,IAAM,QAAQ,WAAW,wBAAwB;AAEjD,IAAM,oCAAoB,IAAI,IAAI;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAID,IAAM,oCAAoB,IAAI,IAAI;CAChC;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,qBAAqB,SAA8B;CAC1D,MAAM,QAAQ,SAAS,QAAQ,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE;CAChD,IAAI,SAAS,IAAI;EACf,MAAM,4CAA4C,KAAK;EACvD,OAAO;CACT;CACA,OAAO;AACT;AAGA,IAAM,2BAA2B;AAEjC,SAAS,cAAc,KAAqB;CAC1C,IAAI;EACF,OAAO,SAAS,GAAG,IAAI,aAAa;GAAE,UAAU;GAAQ,SAAS;EAAK,CAAC,CAAC,CAAC,KAAK;CAChF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,uBAAuB,UAAwB;CACtD,MAAM,QAAQ,SAAS,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE;CACjD,IAAI,CAAC,OAAO,MAAM,KAAK,KAAK,QAAQ,0BAClC,MAAM,IAAI,MACR,QAAQ,SAAS,8CAA8C,0BACjE;AAEJ;AAEA,SAAS,YAAY,SAAyB;CAC5C,MAAM,MAAM,QAAQ;CACpB,MAAM,+BAA+B,GAAG;CACxC,MAAM,SAAS,SAAS,aAAa,EAAE,UAAU,OAAO,CAAC,CAAC,CAAC,KAAK;CAChE,SAAS,yBAAyB,OAAO,IAAI,IAAI,oBAAoB;EACnE,UAAU;EACV,SAAS;CACX,CAAC;CACD,MAAM,MAAM,GAAG,OAAO;CACtB,MAAM,YAAY,cAAc,GAAG;CACnC,MAAM,2BAA2B,WAAW,GAAG;CAC/C,QAAQ,IAAI,yBAAyB,WAAW;CAChD,OAAO;AACT;AAEA,SAAS,eAAe,SAAkB,SAA0B;CAClE,IAAI,SAAS,OAAO;CACpB,IAAI,SAAS,OAAO,YAAY,OAAO;CACvC,OAAO;AACT;AAEA,SAAgB,kBAAkB,SAAkB,SAAyC;CAC3F,MAAM,MAAM,eAAe,SAAS,OAAO;CAC3C,MAAM,WAAW,cAAc,GAAG;CAClC,uBAAuB,QAAQ;CAC/B,MAAM,2CAA2C,KAAK,QAAQ;CA2E9D,OAAO;EAxEL,MAAM,QAAQ;EACd,MAAM;EACN;EACA,UAAU,qBAAqB,QAAQ;EAEvC,YAAY,KAAuB;GACjC,OAAO,CAAC,cAAc,GAAG;EAC3B;EAEA,UAAU,QAA0B;GAClC,OAAO,CAAC,YAAY,MAAM;EAC5B;EAEA,KAAK,SAAuB,GAAG,MAAqC;GAElE,IADc,SAAS,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,EAC3C,KAAS,IAAI;IAEf,MAAM,MAAM,KAAK;IACjB,IAAI,QAAQ,eAAe,QAAQ,eAAe,QAAQ,aAAa,QAAQ,YAC7E,OAAO,KAAK,QAAQ,MAAM,MAAM,YAAY,CAAC,EAAE,WAAW,YAAY,CAAC;IAGzE,IAAI,QAAQ,aAAa;KAGvB,MAAM,SAAS;KACf,IAAI,KAAK,SAAS,UAAU,KAAK,YAAY,IAC3C,OAAO;MAAC;MAAe,KAAK;MAAI,GAAG,KAAK,MAAM,CAAC;KAAC;IAEpD;IAEA,IAAI,QAAQ,WACV,OAAO,KAAK,QACT,MACC,CAAC,EAAE,WAAW,YAAY,KAC1B,CAAC,EAAE,WAAW,YAAY,KAC1B,CAAC,EAAE,WAAW,uBAAuB,CACzC;GAEJ;GACA,OAAO,KAAK,SAAS,KAAK,IAAI;EAChC;EAEA,MAAM,eACJ,aACA,SACA,aACA,MACA,OACA,eAAuC,CAAC,GACxC,kBAA0C,CAAC,GACV;GACjC,MAAM,UAAU,MAAM,2BACpB,aACA,SACA,MACA,OACA,aACA,cACA,eACF;GAOA,MAAM,UAAU,KAAK,QAAQ,YAAY,qBAAqB,GAAG,wBAAwB;GACzF,OAAO;EACT;CAGK;AACT"}
+{"version":3,"file":"pnpm.js","names":[],"sources":["../../../src/adapters/pnpm.ts"],"sourcesContent":["import { SpawnOptions, execSync } from 'child_process';\nimport buildDebug from 'debug';\nimport { writeFile } from 'fs/promises';\nimport { join } from 'path';\n\nimport { ExecOutput, PackageManagerAdapter } from '../types';\nimport { exec } from '../utils/process';\nimport { prepareGenericEmptyProject } from '../utils/project';\n\nconst debug = buildDebug('verdaccio:e2e-cli:pnpm');\n\n// pnpm removed ping and search; the dist-tag output changed (no --json) and needs adapted assertions\nconst PNPM_COMMANDS = new Set(['publish', 'unpublish', 'install', 'info', 'audit', 'deprecate']);\n\n// pnpm 8, 9 and 10 are no longer supported by the suite.\nconst PNPM_MIN_SUPPORTED_MAJOR = 11;\n\nfunction detectVersion(bin: string): string {\n  try {\n    return execSync(`${bin} --version`, { encoding: 'utf8', timeout: 5000 }).trim();\n  } catch {\n    return 'unknown';\n  }\n}\n\nfunction assertSupportedVersion(resolved: string): void {\n  const major = parseInt(resolved.split('.')[0], 10);\n  if (!Number.isNaN(major) && major < PNPM_MIN_SUPPORTED_MAJOR) {\n    throw new Error(\n      `pnpm@${resolved} is not supported. Minimum supported major: ${PNPM_MIN_SUPPORTED_MAJOR}`\n    );\n  }\n}\n\nfunction installPnpm(version: string): string {\n  const pkg = `pnpm@${version}`;\n  debug('installing %s into temp dir', pkg);\n  const tmpDir = execSync('mktemp -d', { encoding: 'utf8' }).trim();\n  execSync(`npm install --prefix \"${tmpDir}\" ${pkg} --loglevel=error`, {\n    encoding: 'utf8',\n    timeout: 30000,\n  });\n  const bin = `${tmpDir}/node_modules/.bin/pnpm`;\n  const installed = detectVersion(bin);\n  debug('installed pnpm %s at %s', installed, bin);\n  console.log(`  Auto-installed pnpm ${installed}`);\n  return bin;\n}\n\nfunction resolvePnpmBin(binPath?: string, version?: string): string {\n  if (binPath) return binPath;\n  if (version) return installPnpm(version);\n  return 'pnpm';\n}\n\nexport function createPnpmAdapter(binPath?: string, version?: string): PackageManagerAdapter {\n  const bin = resolvePnpmBin(binPath, version);\n  const resolved = detectVersion(bin);\n  assertSupportedVersion(resolved);\n  debug('creating pnpm adapter with bin: %s (%s)', bin, resolved);\n\n  const adapter: PackageManagerAdapter = {\n    name: `pnpm@${resolved}`,\n    type: 'pnpm',\n    bin,\n    supports: PNPM_COMMANDS,\n\n    registryArg(url: string): string[] {\n      return ['--registry', url];\n    },\n\n    prefixArg(folder: string): string[] {\n      return ['--prefix', folder];\n    },\n\n    exec(options: SpawnOptions, ...args: string[]): Promise<ExecOutput> {\n      const major = parseInt(resolved.split('.')[0], 10);\n      if (major >= 11) {\n        // pnpm v11: native deprecate/unpublish don't support --json\n        const cmd = args[0];\n        if (cmd === 'deprecate' || cmd === 'unpublish' || cmd === 'publish' || cmd === 'dist-tag') {\n          args = args.filter((a) => a !== '--json' && !a.startsWith('--loglevel'));\n        }\n        // pnpm v11: un-deprecate uses `undeprecate` command instead of `deprecate pkg \"\"`\n        if (cmd === 'deprecate') {\n          // Check if message arg is empty string (un-deprecate)\n          // args: ['deprecate', 'pkg@version', '', ...flags]\n          const msgIdx = 2; // message is the third arg\n          if (args.length > msgIdx && args[msgIdx] === '') {\n            args = ['undeprecate', args[1], ...args.slice(3)];\n          }\n        }\n        // pnpm v11: native version command doesn't accept --registry, --loglevel, or --no--git-tag-version\n        if (cmd === 'version') {\n          args = args.filter(\n            (a) =>\n              !a.startsWith('--registry') &&\n              !a.startsWith('--loglevel') &&\n              !a.startsWith('--no--git-tag-version')\n          );\n        }\n      }\n      return exec(options, bin, args);\n    },\n\n    async prepareProject(\n      packageName: string,\n      version: string,\n      registryUrl: string,\n      port: number,\n      token: string,\n      dependencies: Record<string, string> = {},\n      devDependencies: Record<string, string> = {}\n    ): Promise<{ tempFolder: string }> {\n      const project = await prepareGenericEmptyProject(\n        packageName,\n        version,\n        port,\n        token,\n        registryUrl,\n        dependencies,\n        devDependencies\n      );\n      // pnpm 11.24+ enforces a minimumReleaseAge cooldown by default, which\n      // rejects the just-published packages these tests install\n      // (ERR_PNPM_NO_MATURE_MATCHING_VERSION). Disable it per project via\n      // pnpm-workspace.yaml — the file also marks the temp folder as its own\n      // workspace root, isolating it from any parent workspace. Tests that\n      // exercise the cooldown itself overwrite this file with their own config.\n      await writeFile(join(project.tempFolder, 'pnpm-workspace.yaml'), 'minimumReleaseAge: 0\\n');\n      return project;\n    },\n  };\n\n  return adapter;\n}\n"],"mappings":";;;;;;;AASA,IAAM,QAAQ,WAAW,wBAAwB;AAGjD,IAAM,gCAAgB,IAAI,IAAI;CAAC;CAAW;CAAa;CAAW;CAAQ;CAAS;AAAW,CAAC;AAG/F,IAAM,2BAA2B;AAEjC,SAAS,cAAc,KAAqB;CAC1C,IAAI;EACF,OAAO,SAAS,GAAG,IAAI,aAAa;GAAE,UAAU;GAAQ,SAAS;EAAK,CAAC,CAAC,CAAC,KAAK;CAChF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,uBAAuB,UAAwB;CACtD,MAAM,QAAQ,SAAS,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE;CACjD,IAAI,CAAC,OAAO,MAAM,KAAK,KAAK,QAAQ,0BAClC,MAAM,IAAI,MACR,QAAQ,SAAS,8CAA8C,0BACjE;AAEJ;AAEA,SAAS,YAAY,SAAyB;CAC5C,MAAM,MAAM,QAAQ;CACpB,MAAM,+BAA+B,GAAG;CACxC,MAAM,SAAS,SAAS,aAAa,EAAE,UAAU,OAAO,CAAC,CAAC,CAAC,KAAK;CAChE,SAAS,yBAAyB,OAAO,IAAI,IAAI,oBAAoB;EACnE,UAAU;EACV,SAAS;CACX,CAAC;CACD,MAAM,MAAM,GAAG,OAAO;CACtB,MAAM,YAAY,cAAc,GAAG;CACnC,MAAM,2BAA2B,WAAW,GAAG;CAC/C,QAAQ,IAAI,yBAAyB,WAAW;CAChD,OAAO;AACT;AAEA,SAAS,eAAe,SAAkB,SAA0B;CAClE,IAAI,SAAS,OAAO;CACpB,IAAI,SAAS,OAAO,YAAY,OAAO;CACvC,OAAO;AACT;AAEA,SAAgB,kBAAkB,SAAkB,SAAyC;CAC3F,MAAM,MAAM,eAAe,SAAS,OAAO;CAC3C,MAAM,WAAW,cAAc,GAAG;CAClC,uBAAuB,QAAQ;CAC/B,MAAM,2CAA2C,KAAK,QAAQ;CA2E9D,OAAO;EAxEL,MAAM,QAAQ;EACd,MAAM;EACN;EACA,UAAU;EAEV,YAAY,KAAuB;GACjC,OAAO,CAAC,cAAc,GAAG;EAC3B;EAEA,UAAU,QAA0B;GAClC,OAAO,CAAC,YAAY,MAAM;EAC5B;EAEA,KAAK,SAAuB,GAAG,MAAqC;GAElE,IADc,SAAS,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,EAC3C,KAAS,IAAI;IAEf,MAAM,MAAM,KAAK;IACjB,IAAI,QAAQ,eAAe,QAAQ,eAAe,QAAQ,aAAa,QAAQ,YAC7E,OAAO,KAAK,QAAQ,MAAM,MAAM,YAAY,CAAC,EAAE,WAAW,YAAY,CAAC;IAGzE,IAAI,QAAQ,aAAa;KAGvB,MAAM,SAAS;KACf,IAAI,KAAK,SAAS,UAAU,KAAK,YAAY,IAC3C,OAAO;MAAC;MAAe,KAAK;MAAI,GAAG,KAAK,MAAM,CAAC;KAAC;IAEpD;IAEA,IAAI,QAAQ,WACV,OAAO,KAAK,QACT,MACC,CAAC,EAAE,WAAW,YAAY,KAC1B,CAAC,EAAE,WAAW,YAAY,KAC1B,CAAC,EAAE,WAAW,uBAAuB,CACzC;GAEJ;GACA,OAAO,KAAK,SAAS,KAAK,IAAI;EAChC;EAEA,MAAM,eACJ,aACA,SACA,aACA,MACA,OACA,eAAuC,CAAC,GACxC,kBAA0C,CAAC,GACV;GACjC,MAAM,UAAU,MAAM,2BACpB,aACA,SACA,MACA,OACA,aACA,cACA,eACF;GAOA,MAAM,UAAU,KAAK,QAAQ,YAAY,qBAAqB,GAAG,wBAAwB;GACzF,OAAO;EACT;CAGK;AACT"}

package/build/esm/index.js

@@ -8,8 +8,8 @@ import { createYarnModernAdapter } from "./adapters/yarn-modern.js";
 import "./adapters/index.js";
 import { runAll, runSuite } from "./runner.js";
 import { allScenarios } from "./scenarios/index.js";
-import { allTests } from "./tests/index.js";
 import { createUser, pingRegistry } from "./utils/registry-client.js";
+import { allTests } from "./tests/index.js";
 import buildDebug from "debug";
 //#region src/index.ts
 buildDebug("verdaccio:e2e-cli");

package/build/esm/scenarios/minimum-release-age.js.map

@@ -1 +1 @@
-{"version":3,"file":"minimum-release-age.js","names":[],"sources":["../../../src/scenarios/minimum-release-age.ts"],"sourcesContent":["import assert from 'assert';\nimport { writeFile } from 'fs/promises';\nimport { join } from 'path';\n\nimport { PackageManagerAdapter, TestContext, TestDefinition } from '../types';\nimport { trace } from '../utils/process';\n\n/**\n * Scenario: minimum-release-age (pnpm 11.1+ only)\n *\n * Exercises pnpm's `minimumReleaseAge` cooldown together with\n * `minimumReleaseAgeExclude`. With a 7-day (10080 minute) cooldown, freshly\n * published versions are normally not installable until they age past the\n * threshold — but packages matching the exclude globs bypass the check.\n *\n *   minimumReleaseAge: 10080\n *   minimumReleaseAgeStrict: true\n *   minimumReleaseAgeExclude:\n *     - '@verdaccio/*'\n *     - 'verdaccio-*'\n *\n * minimumReleaseAgeStrict is required on pnpm 12: without it, pnpm 12\n * auto-adds new direct dependencies to minimumReleaseAgeExclude instead of\n * failing. pnpm 11 enforces the cooldown unconditionally and ignores the key.\n *\n * The scenario publishes brand-new (age ~0) packages and asserts:\n *   - an excluded scoped package   (@verdaccio/*) installs despite the cooldown\n *   - an excluded unscoped package (verdaccio-*)  installs despite the cooldown\n *   - a non-excluded package is blocked by the cooldown (proving it is active)\n *\n * pnpm reads these settings from `pnpm-workspace.yaml`, mirroring the\n * configuration used by the repo root. The cooldown is only enforced from\n * pnpm 11.1.0 onward (11.0.x silently ignores it), so the scenario is gated to\n * that version range — see {@link isPnpm11Plus}.\n */\n\nconst MINIMUM_RELEASE_AGE = 10080; // 7 days, in minutes\nconst MINIMUM_RELEASE_AGE_EXCLUDE = ['@verdaccio/*', 'verdaccio-*'];\n\nconst PNPM_WORKSPACE_YAML = [\n  `minimumReleaseAge: ${MINIMUM_RELEASE_AGE}`,\n  // pnpm 12 no longer blocks new direct dependencies by default: it auto-adds\n  // them to minimumReleaseAgeExclude in pnpm-workspace.yaml and proceeds.\n  // minimumReleaseAgeStrict restores the blocking behavior this scenario\n  // asserts (ERR_PNPM_NO_MATURE_MATCHING_VERSION); pnpm 11 ignores the key.\n  'minimumReleaseAgeStrict: true',\n  'minimumReleaseAgeExclude:',\n  ...MINIMUM_RELEASE_AGE_EXCLUDE.map((glob) => `  - '${glob}'`),\n  '',\n].join('\\n');\n\n/**\n * True only for pnpm versions that actually enforce minimumReleaseAge.\n *\n * The cooldown is honored in pnpm 11.1.0+, but it is silently ignored in\n * 11.0.0 / 11.0.1 (and the 11.0.0 release candidates) — those versions install\n * brand-new packages regardless of the configured cooldown. We scope this\n * scenario to pnpm 11.1.0 and newer so it doesn't false-fail on that regression.\n */\nexport function isPnpm11Plus(adapter: PackageManagerAdapter): boolean {\n  if (adapter.type !== 'pnpm') {\n    return false;\n  }\n  const match = adapter.name.match(/pnpm@(\\d+)\\.(\\d+)/);\n  if (!match) {\n    return false;\n  }\n  const major = parseInt(match[1], 10);\n  const minor = parseInt(match[2], 10);\n  return major > 11 || (major === 11 && minor >= 1);\n}\n\nasync function publishPackage(ctx: TestContext, pkgName: string, version: string): Promise<void> {\n  trace('publishing %s@%s', pkgName, version);\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    pkgName,\n    version,\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token\n  );\n  await ctx.adapter.exec(\n    { cwd: tempFolder },\n    'publish',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n  trace('published %s@%s', pkgName, version);\n}\n\n/**\n * Build a consumer project with the minimumReleaseAge cooldown configured in\n * pnpm-workspace.yaml, depending on the given packages.\n */\nasync function prepareCooldownConsumer(\n  ctx: TestContext,\n  consumerName: string,\n  dependencies: Record<string, string>\n): Promise<string> {\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    consumerName,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token,\n    dependencies\n  );\n  await writeFile(join(tempFolder, 'pnpm-workspace.yaml'), PNPM_WORKSPACE_YAML);\n  trace('prepared cooldown consumer %s at %s', consumerName, tempFolder);\n  return tempFolder;\n}\n\nasync function testMinimumReleaseAge(ctx: TestContext): Promise<void> {\n  const id = ctx.runId;\n\n  const excludedScoped = `@verdaccio/release-age-${id}`;\n  const excludedUnscoped = `verdaccio-release-age-${id}`;\n  const blocked = `e2e-release-age-blocked-${id}`;\n\n  // --- Phase 1: Publish brand-new (age ~0) packages ---\n  await ctx.subTest('publish fresh packages', async () => {\n    await publishPackage(ctx, excludedScoped, '1.0.0');\n    await publishPackage(ctx, excludedUnscoped, '1.0.0');\n    await publishPackage(ctx, blocked, '1.0.0');\n  });\n\n  // --- Phase 2: Excluded packages install despite the cooldown ---\n  await ctx.subTest('excluded packages bypass the cooldown', async () => {\n    const tempFolder = await prepareCooldownConsumer(ctx, `@verdaccio/consumer-excluded-${id}`, {\n      [excludedScoped]: '1.0.0',\n      [excludedUnscoped]: '1.0.0',\n    });\n\n    // Should succeed: both deps match the exclude globs.\n    await ctx.adapter.exec(\n      { cwd: tempFolder },\n      'install',\n      ...ctx.adapter.registryArg(ctx.registryUrl)\n    );\n\n    trace('excluded packages installed successfully under cooldown');\n  });\n\n  // --- Phase 3: Non-excluded fresh package is blocked by the cooldown ---\n  await ctx.subTest('non-excluded fresh package is blocked', async () => {\n    const tempFolder = await prepareCooldownConsumer(ctx, `e2e-consumer-blocked-${id}`, {\n      [blocked]: '1.0.0',\n    });\n\n    let errorMessage = '';\n    try {\n      await ctx.adapter.exec(\n        { cwd: tempFolder },\n        'install',\n        // pnpm 12's parser rejects the `--flag=false` form; --no-frozen-lockfile\n        // is accepted by pnpm 10, 11 and 12 alike\n        '--no-frozen-lockfile',\n        ...ctx.adapter.registryArg(ctx.registryUrl)\n      );\n    } catch (err) {\n      errorMessage = err instanceof Error ? err.message : String(err);\n      trace('install correctly rejected by cooldown: %s', errorMessage.split('\\n')[0]);\n    }\n\n    assert.ok(\n      errorMessage,\n      `Expected install of fresh non-excluded package \"${blocked}\" to be blocked by ` +\n        `minimumReleaseAge (${MINIMUM_RELEASE_AGE} min), but it succeeded`\n    );\n    // pnpm reports ERR_PNPM_NO_MATURE_MATCHING_VERSION / \"minimumReleaseAge\" when a\n    // version is too new. Assert the failure is the cooldown, not an unrelated error.\n    assert.ok(\n      /minimumReleaseAge|NO_MATURE_MATCHING_VERSION/i.test(errorMessage),\n      `Install of \"${blocked}\" failed for an unexpected reason (expected a minimumReleaseAge ` +\n        `cooldown error):\\n${errorMessage}`\n    );\n  });\n}\n\nexport const minimumReleaseAgeScenario: TestDefinition = {\n  name: 'scenario:minimum-release-age',\n  requires: ['publish', 'install'],\n  appliesTo: isPnpm11Plus,\n  run: testMinimumReleaseAge,\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,IAAM,sBAAsB;AAG5B,IAAM,sBAAsB;CAC1B,sBAAsB;CAKtB;CACA;CACA,GAAG,CAVgC,gBAAgB,aAUhD,CAAA,CAA4B,KAAK,SAAS,QAAQ,KAAK,EAAE;CAC5D;AACF,CAAC,CAAC,KAAK,IAAI;;;;;;;;;AAUX,SAAgB,aAAa,SAAyC;CACpE,IAAI,QAAQ,SAAS,QACnB,OAAO;CAET,MAAM,QAAQ,QAAQ,KAAK,MAAM,mBAAmB;CACpD,IAAI,CAAC,OACH,OAAO;CAET,MAAM,QAAQ,SAAS,MAAM,IAAI,EAAE;CACnC,MAAM,QAAQ,SAAS,MAAM,IAAI,EAAE;CACnC,OAAO,QAAQ,MAAO,UAAU,MAAM,SAAS;AACjD;AAEA,eAAe,eAAe,KAAkB,SAAiB,SAAgC;CAC/F,MAAM,oBAAoB,SAAS,OAAO;CAC1C,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,SACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;CACA,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CACA,MAAM,mBAAmB,SAAS,OAAO;AAC3C;;;;;AAMA,eAAe,wBACb,KACA,cACA,cACiB;CACjB,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,cACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,OACJ,YACF;CACA,MAAM,UAAU,KAAK,YAAY,qBAAqB,GAAG,mBAAmB;CAC5E,MAAM,uCAAuC,cAAc,UAAU;CACrE,OAAO;AACT;AAEA,eAAe,sBAAsB,KAAiC;CACpE,MAAM,KAAK,IAAI;CAEf,MAAM,iBAAiB,0BAA0B;CACjD,MAAM,mBAAmB,yBAAyB;CAClD,MAAM,UAAU,2BAA2B;CAG3C,MAAM,IAAI,QAAQ,0BAA0B,YAAY;EACtD,MAAM,eAAe,KAAK,gBAAgB,OAAO;EACjD,MAAM,eAAe,KAAK,kBAAkB,OAAO;EACnD,MAAM,eAAe,KAAK,SAAS,OAAO;CAC5C,CAAC;CAGD,MAAM,IAAI,QAAQ,yCAAyC,YAAY;EACrE,MAAM,aAAa,MAAM,wBAAwB,KAAK,gCAAgC,MAAM;IACzF,iBAAiB;IACjB,mBAAmB;EACtB,CAAC;EAGD,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EAEA,MAAM,yDAAyD;CACjE,CAAC;CAGD,MAAM,IAAI,QAAQ,yCAAyC,YAAY;EACrE,MAAM,aAAa,MAAM,wBAAwB,KAAK,wBAAwB,MAAM,GACjF,UAAU,QACb,CAAC;EAED,IAAI,eAAe;EACnB,IAAI;GACF,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WAGA,wBACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EACF,SAAS,KAAK;GACZ,eAAe,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GAC9D,MAAM,8CAA8C,aAAa,MAAM,IAAI,CAAC,CAAC,EAAE;EACjF;EAEA,OAAO,GACL,cACA,mDAAmD,QAAQ,wCACnC,oBAAoB,wBAC9C;EAGA,OAAO,GACL,gDAAgD,KAAK,YAAY,GACjE,eAAe,QAAQ,oFACA,cACzB;CACF,CAAC;AACH;AAEA,IAAa,4BAA4C;CACvD,MAAM;CACN,UAAU,CAAC,WAAW,SAAS;CAC/B,WAAW;CACX,KAAK;AACP"}
+{"version":3,"file":"minimum-release-age.js","names":[],"sources":["../../../src/scenarios/minimum-release-age.ts"],"sourcesContent":["import assert from 'assert';\nimport { writeFile } from 'fs/promises';\nimport { join } from 'path';\n\nimport { PackageManagerAdapter, TestContext, TestDefinition } from '../types';\nimport { trace } from '../utils/process';\n\n/**\n * Scenario: minimum-release-age (pnpm 11.1+ only)\n *\n * Exercises pnpm's `minimumReleaseAge` cooldown together with\n * `minimumReleaseAgeExclude`. With a 7-day (10080 minute) cooldown, freshly\n * published versions are normally not installable until they age past the\n * threshold — but packages matching the exclude globs bypass the check.\n *\n *   minimumReleaseAge: 10080\n *   minimumReleaseAgeStrict: true\n *   minimumReleaseAgeExclude:\n *     - '@verdaccio/*'\n *     - 'verdaccio-*'\n *\n * minimumReleaseAgeStrict is required on pnpm 12: without it, pnpm 12\n * auto-adds new direct dependencies to minimumReleaseAgeExclude instead of\n * failing. pnpm 11 enforces the cooldown unconditionally and ignores the key.\n *\n * The scenario publishes brand-new (age ~0) packages and asserts:\n *   - an excluded scoped package   (@verdaccio/*) installs despite the cooldown\n *   - an excluded unscoped package (verdaccio-*)  installs despite the cooldown\n *   - a non-excluded package is blocked by the cooldown (proving it is active)\n *\n * pnpm reads these settings from `pnpm-workspace.yaml`, mirroring the\n * configuration used by the repo root. The cooldown is only enforced from\n * pnpm 11.1.0 onward (11.0.x silently ignores it), so the scenario is gated to\n * that version range — see {@link isPnpm11Plus}.\n */\n\nconst MINIMUM_RELEASE_AGE = 10080; // 7 days, in minutes\nconst MINIMUM_RELEASE_AGE_EXCLUDE = ['@verdaccio/*', 'verdaccio-*'];\n\nconst PNPM_WORKSPACE_YAML = [\n  `minimumReleaseAge: ${MINIMUM_RELEASE_AGE}`,\n  // pnpm 12 no longer blocks new direct dependencies by default: it auto-adds\n  // them to minimumReleaseAgeExclude in pnpm-workspace.yaml and proceeds.\n  // minimumReleaseAgeStrict restores the blocking behavior this scenario\n  // asserts (ERR_PNPM_NO_MATURE_MATCHING_VERSION); pnpm 11 ignores the key.\n  'minimumReleaseAgeStrict: true',\n  'minimumReleaseAgeExclude:',\n  ...MINIMUM_RELEASE_AGE_EXCLUDE.map((glob) => `  - '${glob}'`),\n  '',\n].join('\\n');\n\n/**\n * True only for pnpm versions that actually enforce minimumReleaseAge.\n *\n * The cooldown is honored in pnpm 11.1.0+, but it is silently ignored in\n * 11.0.0 / 11.0.1 (and the 11.0.0 release candidates) — those versions install\n * brand-new packages regardless of the configured cooldown. We scope this\n * scenario to pnpm 11.1.0 and newer so it doesn't false-fail on that regression.\n */\nexport function isPnpm11Plus(adapter: PackageManagerAdapter): boolean {\n  if (adapter.type !== 'pnpm') {\n    return false;\n  }\n  const match = adapter.name.match(/pnpm@(\\d+)\\.(\\d+)/);\n  if (!match) {\n    return false;\n  }\n  const major = parseInt(match[1], 10);\n  const minor = parseInt(match[2], 10);\n  return major > 11 || (major === 11 && minor >= 1);\n}\n\nasync function publishPackage(ctx: TestContext, pkgName: string, version: string): Promise<void> {\n  trace('publishing %s@%s', pkgName, version);\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    pkgName,\n    version,\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token\n  );\n  await ctx.adapter.exec(\n    { cwd: tempFolder },\n    'publish',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n  trace('published %s@%s', pkgName, version);\n}\n\n/**\n * Build a consumer project with the minimumReleaseAge cooldown configured in\n * pnpm-workspace.yaml, depending on the given packages.\n */\nasync function prepareCooldownConsumer(\n  ctx: TestContext,\n  consumerName: string,\n  dependencies: Record<string, string>\n): Promise<string> {\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    consumerName,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token,\n    dependencies\n  );\n  await writeFile(join(tempFolder, 'pnpm-workspace.yaml'), PNPM_WORKSPACE_YAML);\n  trace('prepared cooldown consumer %s at %s', consumerName, tempFolder);\n  return tempFolder;\n}\n\nasync function testMinimumReleaseAge(ctx: TestContext): Promise<void> {\n  const id = ctx.runId;\n\n  const excludedScoped = `@verdaccio/release-age-${id}`;\n  const excludedUnscoped = `verdaccio-release-age-${id}`;\n  const blocked = `e2e-release-age-blocked-${id}`;\n\n  // --- Phase 1: Publish brand-new (age ~0) packages ---\n  await ctx.subTest('publish fresh packages', async () => {\n    await publishPackage(ctx, excludedScoped, '1.0.0');\n    await publishPackage(ctx, excludedUnscoped, '1.0.0');\n    await publishPackage(ctx, blocked, '1.0.0');\n  });\n\n  // --- Phase 2: Excluded packages install despite the cooldown ---\n  await ctx.subTest('excluded packages bypass the cooldown', async () => {\n    const tempFolder = await prepareCooldownConsumer(ctx, `@verdaccio/consumer-excluded-${id}`, {\n      [excludedScoped]: '1.0.0',\n      [excludedUnscoped]: '1.0.0',\n    });\n\n    // Should succeed: both deps match the exclude globs.\n    await ctx.adapter.exec(\n      { cwd: tempFolder },\n      'install',\n      ...ctx.adapter.registryArg(ctx.registryUrl)\n    );\n\n    trace('excluded packages installed successfully under cooldown');\n  });\n\n  // --- Phase 3: Non-excluded fresh package is blocked by the cooldown ---\n  await ctx.subTest('non-excluded fresh package is blocked', async () => {\n    const tempFolder = await prepareCooldownConsumer(ctx, `e2e-consumer-blocked-${id}`, {\n      [blocked]: '1.0.0',\n    });\n\n    let errorMessage = '';\n    try {\n      await ctx.adapter.exec(\n        { cwd: tempFolder },\n        'install',\n        // pnpm 12's parser rejects the `--flag=false` form; --no-frozen-lockfile\n        // is accepted by pnpm 11 and 12 alike\n        '--no-frozen-lockfile',\n        ...ctx.adapter.registryArg(ctx.registryUrl)\n      );\n    } catch (err) {\n      errorMessage = err instanceof Error ? err.message : String(err);\n      trace('install correctly rejected by cooldown: %s', errorMessage.split('\\n')[0]);\n    }\n\n    assert.ok(\n      errorMessage,\n      `Expected install of fresh non-excluded package \"${blocked}\" to be blocked by ` +\n        `minimumReleaseAge (${MINIMUM_RELEASE_AGE} min), but it succeeded`\n    );\n    // pnpm reports ERR_PNPM_NO_MATURE_MATCHING_VERSION / \"minimumReleaseAge\" when a\n    // version is too new. Assert the failure is the cooldown, not an unrelated error.\n    assert.ok(\n      /minimumReleaseAge|NO_MATURE_MATCHING_VERSION/i.test(errorMessage),\n      `Install of \"${blocked}\" failed for an unexpected reason (expected a minimumReleaseAge ` +\n        `cooldown error):\\n${errorMessage}`\n    );\n  });\n}\n\nexport const minimumReleaseAgeScenario: TestDefinition = {\n  name: 'scenario:minimum-release-age',\n  requires: ['publish', 'install'],\n  appliesTo: isPnpm11Plus,\n  run: testMinimumReleaseAge,\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,IAAM,sBAAsB;AAG5B,IAAM,sBAAsB;CAC1B,sBAAsB;CAKtB;CACA;CACA,GAAG,CAVgC,gBAAgB,aAUhD,CAAA,CAA4B,KAAK,SAAS,QAAQ,KAAK,EAAE;CAC5D;AACF,CAAC,CAAC,KAAK,IAAI;;;;;;;;;AAUX,SAAgB,aAAa,SAAyC;CACpE,IAAI,QAAQ,SAAS,QACnB,OAAO;CAET,MAAM,QAAQ,QAAQ,KAAK,MAAM,mBAAmB;CACpD,IAAI,CAAC,OACH,OAAO;CAET,MAAM,QAAQ,SAAS,MAAM,IAAI,EAAE;CACnC,MAAM,QAAQ,SAAS,MAAM,IAAI,EAAE;CACnC,OAAO,QAAQ,MAAO,UAAU,MAAM,SAAS;AACjD;AAEA,eAAe,eAAe,KAAkB,SAAiB,SAAgC;CAC/F,MAAM,oBAAoB,SAAS,OAAO;CAC1C,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,SACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;CACA,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CACA,MAAM,mBAAmB,SAAS,OAAO;AAC3C;;;;;AAMA,eAAe,wBACb,KACA,cACA,cACiB;CACjB,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,cACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,OACJ,YACF;CACA,MAAM,UAAU,KAAK,YAAY,qBAAqB,GAAG,mBAAmB;CAC5E,MAAM,uCAAuC,cAAc,UAAU;CACrE,OAAO;AACT;AAEA,eAAe,sBAAsB,KAAiC;CACpE,MAAM,KAAK,IAAI;CAEf,MAAM,iBAAiB,0BAA0B;CACjD,MAAM,mBAAmB,yBAAyB;CAClD,MAAM,UAAU,2BAA2B;CAG3C,MAAM,IAAI,QAAQ,0BAA0B,YAAY;EACtD,MAAM,eAAe,KAAK,gBAAgB,OAAO;EACjD,MAAM,eAAe,KAAK,kBAAkB,OAAO;EACnD,MAAM,eAAe,KAAK,SAAS,OAAO;CAC5C,CAAC;CAGD,MAAM,IAAI,QAAQ,yCAAyC,YAAY;EACrE,MAAM,aAAa,MAAM,wBAAwB,KAAK,gCAAgC,MAAM;IACzF,iBAAiB;IACjB,mBAAmB;EACtB,CAAC;EAGD,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EAEA,MAAM,yDAAyD;CACjE,CAAC;CAGD,MAAM,IAAI,QAAQ,yCAAyC,YAAY;EACrE,MAAM,aAAa,MAAM,wBAAwB,KAAK,wBAAwB,MAAM,GACjF,UAAU,QACb,CAAC;EAED,IAAI,eAAe;EACnB,IAAI;GACF,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WAGA,wBACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EACF,SAAS,KAAK;GACZ,eAAe,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GAC9D,MAAM,8CAA8C,aAAa,MAAM,IAAI,CAAC,CAAC,EAAE;EACjF;EAEA,OAAO,GACL,cACA,mDAAmD,QAAQ,wCACnC,oBAAoB,wBAC9C;EAGA,OAAO,GACL,gDAAgD,KAAK,YAAY,GACjE,eAAe,QAAQ,oFACA,cACzB;CACF,CAAC;AACH;AAEA,IAAa,4BAA4C;CACvD,MAAM;CACN,UAAU,CAAC,WAAW,SAAS;CAC/B,WAAW;CACX,KAAK;AACP"}

package/build/esm/tests/login.js

@@ -1,4 +1,5 @@
 import { createTempFolder, getPackageJSON, getREADME } from "../utils/project.js";
+import { LegacyLoginError, createUser, legacyLogin, whoami } from "../utils/registry-client.js";
 import buildDebug from "debug";
 import { join } from "path";
 import { writeFile } from "fs/promises";
@@ -110,6 +111,29 @@ async function testLogin(ctx) {
 		const who2 = await yarnWhoami(ctx, tf);
 		assert.ok(who2.includes(user2), `Expected "${user2}" after switch but got "${who2}"`);
 	});
+	for (const client of [
+		"npm",
+		"yarn",
+		"pnpm"
+	]) {
+		await ctx.subTest(`${client} logs an existing user in with the Basic retry`, async () => {
+			const user = `login-retry-${client}-${id}`;
+			const password = "retry-password-123";
+			await createUser(ctx.registryUrl, user, password);
+			const token = await legacyLogin(ctx.registryUrl, user, password, client);
+			assert.strictEqual(await whoami(ctx.registryUrl, token), user);
+		});
+		await ctx.subTest(`${client} registers a new user`, async () => {
+			const user = `login-new-${client}-${id}`;
+			const token = await legacyLogin(ctx.registryUrl, user, "retry-password-123", client);
+			assert.strictEqual(await whoami(ctx.registryUrl, token), user);
+		});
+		await ctx.subTest(`${client} cannot log an existing user in with a wrong password`, async () => {
+			const user = `login-wrong-${client}-${id}`;
+			await createUser(ctx.registryUrl, user, "retry-password-123");
+			await assert.rejects(legacyLogin(ctx.registryUrl, user, "wrong-password", client), (error) => error instanceof LegacyLoginError && error.status === 401);
+		});
+	}
 }
 var loginTest = {
 	name: "login",

package/build/esm/tests/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","names":[],"sources":["../../../src/tests/login.ts"],"sourcesContent":["import assert from 'assert';\nimport buildDebug from 'debug';\nimport { writeFile } from 'fs/promises';\nimport * as YAML from 'js-yaml';\nimport { join } from 'path';\n\nimport { TestContext, TestDefinition } from '../types';\nimport { createTempFolder, getPackageJSON, getREADME } from '../utils/project';\n\nconst debug = buildDebug('verdaccio:e2e-cli:test:login');\n\n/**\n * Creates a project with registry config but WITHOUT auth token,\n * so whoami will use the token saved by login to ~/.yarnrc.yml.\n */\nasync function prepareLoginProject(ctx: TestContext, name: string): Promise<string> {\n  debug('preparing project for %s (no auth token)', name);\n  const tempFolder = await createTempFolder(name);\n  const yamlContent = YAML.dump({\n    npmRegistryServer: ctx.registryUrl,\n    enableImmutableInstalls: false,\n    unsafeHttpWhitelist: ['localhost'],\n  });\n  await writeFile(join(tempFolder, '.yarnrc.yml'), yamlContent);\n  await writeFile(join(tempFolder, 'package.json'), JSON.stringify({ name, version: '1.0.0' }));\n  if (ctx.adapter.importPlugin) {\n    debug('importing npm-login plugin into %s', tempFolder);\n    await ctx.adapter.importPlugin(tempFolder, 'npm-login');\n  }\n  return tempFolder;\n}\n\nasync function yarnLogin(\n  ctx: TestContext,\n  cwd: string,\n  user: string,\n  password: string,\n  email: string\n) {\n  debug('yarn npm login as %s', user);\n  return ctx.adapter.exec(\n    { cwd },\n    'login',\n    '--auth-type=legacy',\n    `--user=${user}`,\n    `--password=${password}`,\n    `--email=${email}`\n  );\n}\n\nasync function yarnWhoami(ctx: TestContext, cwd: string): Promise<string> {\n  const resp = await ctx.adapter.exec({ cwd }, 'whoami');\n  debug('yarn npm whoami: %s', resp.stdout);\n  return resp.stdout;\n}\n\nasync function testLogin(ctx: TestContext): Promise<void> {\n  const type = ctx.adapter.type;\n  const id = ctx.runId;\n\n  if (type !== 'yarn-modern') {\n    debug('login test only supported for yarn-modern, skipping %s', type);\n    return;\n  }\n\n  const user1 = `login-a-${id}`;\n  const password1 = 'test-password-123';\n  const email1 = `${user1}@test.example.com`;\n\n  await ctx.subTest('create new user + whoami', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login1-${id}`);\n    const loginResp = await yarnLogin(ctx, tf, user1, password1, email1);\n    assert.ok(\n      loginResp.stdout.includes('Logged in') || loginResp.stdout.includes('token saved'),\n      `Expected login success message but got \"${loginResp.stdout}\"`\n    );\n    const who = await yarnWhoami(ctx, tf);\n    assert.ok(who.includes(user1), `Expected whoami \"${user1}\" but got \"${who}\"`);\n  });\n\n  await ctx.subTest('legacy re-login is rejected without basic auth', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login2-${id}`);\n    let loginFailed = false;\n    try {\n      await yarnLogin(ctx, tf, user1, password1, email1);\n    } catch {\n      loginFailed = true;\n    }\n    assert.ok(loginFailed, 'Legacy re-login for an existing user should fail without Basic auth');\n  });\n\n  await ctx.subTest('wrong password fails', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login3-${id}`);\n    let loginFailed = false;\n    try {\n      await yarnLogin(ctx, tf, user1, 'wrong-password', email1);\n    } catch {\n      loginFailed = true;\n    }\n    assert.ok(loginFailed, 'Login with wrong password should have failed');\n  });\n\n  await ctx.subTest('login then publish', async () => {\n    const pkgName = `@verdaccio/login-pub-${id}`;\n    const publishUser = `login-pub-${id}`;\n    const publishPassword = 'publish-password-123';\n    const publishEmail = `${publishUser}@test.example.com`;\n    const tf = await createTempFolder(`login-pub-${id}`);\n    const yamlContent = YAML.dump({\n      npmRegistryServer: ctx.registryUrl,\n      enableImmutableInstalls: false,\n      unsafeHttpWhitelist: ['localhost'],\n    });\n    await writeFile(join(tf, '.yarnrc.yml'), yamlContent);\n    await writeFile(join(tf, 'package.json'), getPackageJSON(pkgName, '1.0.0'));\n    await writeFile(join(tf, 'README.md'), getREADME(pkgName));\n    if (ctx.adapter.importPlugin) {\n      await ctx.adapter.importPlugin(tf, 'npm-login');\n    }\n    await yarnLogin(ctx, tf, publishUser, publishPassword, publishEmail);\n    await ctx.adapter.exec({ cwd: tf }, 'install');\n    const pubResp = await ctx.adapter.exec({ cwd: tf }, 'publish');\n    assert.ok(\n      pubResp.stdout.includes('Package archive published'),\n      `Expected publish success but got \"${pubResp.stdout}\"`\n    );\n  });\n\n  await ctx.subTest('switch users', async () => {\n    const switchUser1 = `login-switch-a-${id}`;\n    const switchPassword1 = 'switch-password-123';\n    const switchEmail1 = `${switchUser1}@test.example.com`;\n    const user2 = `login-b-${id}`;\n    const password2 = 'other-password-456';\n    const email2 = `${user2}@test.example.com`;\n    const tf = await prepareLoginProject(ctx, `verdaccio-login5-${id}`);\n\n    await yarnLogin(ctx, tf, switchUser1, switchPassword1, switchEmail1);\n    const who1 = await yarnWhoami(ctx, tf);\n    assert.ok(who1.includes(switchUser1), `Expected \"${switchUser1}\" but got \"${who1}\"`);\n\n    await yarnLogin(ctx, tf, user2, password2, email2);\n    const who2 = await yarnWhoami(ctx, tf);\n    assert.ok(who2.includes(user2), `Expected \"${user2}\" after switch but got \"${who2}\"`);\n  });\n}\n\nexport const loginTest: TestDefinition = {\n  name: 'login',\n  requires: ['login'],\n  run: testLogin,\n};\n"],"mappings":";;;;;;;AASA,IAAM,QAAQ,WAAW,8BAA8B;;;;;AAMvD,eAAe,oBAAoB,KAAkB,MAA+B;CAClF,MAAM,4CAA4C,IAAI;CACtD,MAAM,aAAa,MAAM,iBAAiB,IAAI;CAC9C,MAAM,cAAc,KAAK,KAAK;EAC5B,mBAAmB,IAAI;EACvB,yBAAyB;EACzB,qBAAqB,CAAC,WAAW;CACnC,CAAC;CACD,MAAM,UAAU,KAAK,YAAY,aAAa,GAAG,WAAW;CAC5D,MAAM,UAAU,KAAK,YAAY,cAAc,GAAG,KAAK,UAAU;EAAE;EAAM,SAAS;CAAQ,CAAC,CAAC;CAC5F,IAAI,IAAI,QAAQ,cAAc;EAC5B,MAAM,sCAAsC,UAAU;EACtD,MAAM,IAAI,QAAQ,aAAa,YAAY,WAAW;CACxD;CACA,OAAO;AACT;AAEA,eAAe,UACb,KACA,KACA,MACA,UACA,OACA;CACA,MAAM,wBAAwB,IAAI;CAClC,OAAO,IAAI,QAAQ,KACjB,EAAE,IAAI,GACN,SACA,sBACA,UAAU,QACV,cAAc,YACd,WAAW,OACb;AACF;AAEA,eAAe,WAAW,KAAkB,KAA8B;CACxE,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,EAAE,IAAI,GAAG,QAAQ;CACrD,MAAM,uBAAuB,KAAK,MAAM;CACxC,OAAO,KAAK;AACd;AAEA,eAAe,UAAU,KAAiC;CACxD,MAAM,OAAO,IAAI,QAAQ;CACzB,MAAM,KAAK,IAAI;CAEf,IAAI,SAAS,eAAe;EAC1B,MAAM,0DAA0D,IAAI;EACpE;CACF;CAEA,MAAM,QAAQ,WAAW;CACzB,MAAM,YAAY;CAClB,MAAM,SAAS,GAAG,MAAM;CAExB,MAAM,IAAI,QAAQ,4BAA4B,YAAY;EACxD,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,MAAM,YAAY,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACnE,OAAO,GACL,UAAU,OAAO,SAAS,WAAW,KAAK,UAAU,OAAO,SAAS,aAAa,GACjF,2CAA2C,UAAU,OAAO,EAC9D;EACA,MAAM,MAAM,MAAM,WAAW,KAAK,EAAE;EACpC,OAAO,GAAG,IAAI,SAAS,KAAK,GAAG,oBAAoB,MAAM,aAAa,IAAI,EAAE;CAC9E,CAAC;CAED,MAAM,IAAI,QAAQ,kDAAkD,YAAY;EAC9E,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,IAAI,cAAc;EAClB,IAAI;GACF,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACnD,QAAQ;GACN,cAAc;EAChB;EACA,OAAO,GAAG,aAAa,qEAAqE;CAC9F,CAAC;CAED,MAAM,IAAI,QAAQ,wBAAwB,YAAY;EACpD,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,IAAI,cAAc;EAClB,IAAI;GACF,MAAM,UAAU,KAAK,IAAI,OAAO,kBAAkB,MAAM;EAC1D,QAAQ;GACN,cAAc;EAChB;EACA,OAAO,GAAG,aAAa,8CAA8C;CACvE,CAAC;CAED,MAAM,IAAI,QAAQ,sBAAsB,YAAY;EAClD,MAAM,UAAU,wBAAwB;EACxC,MAAM,cAAc,aAAa;EACjC,MAAM,kBAAkB;EACxB,MAAM,eAAe,GAAG,YAAY;EACpC,MAAM,KAAK,MAAM,iBAAiB,aAAa,IAAI;EACnD,MAAM,cAAc,KAAK,KAAK;GAC5B,mBAAmB,IAAI;GACvB,yBAAyB;GACzB,qBAAqB,CAAC,WAAW;EACnC,CAAC;EACD,MAAM,UAAU,KAAK,IAAI,aAAa,GAAG,WAAW;EACpD,MAAM,UAAU,KAAK,IAAI,cAAc,GAAG,eAAe,SAAS,OAAO,CAAC;EAC1E,MAAM,UAAU,KAAK,IAAI,WAAW,GAAG,UAAU,OAAO,CAAC;EACzD,IAAI,IAAI,QAAQ,cACd,MAAM,IAAI,QAAQ,aAAa,IAAI,WAAW;EAEhD,MAAM,UAAU,KAAK,IAAI,aAAa,iBAAiB,YAAY;EACnE,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,GAAG,GAAG,SAAS;EAC7C,MAAM,UAAU,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,GAAG,GAAG,SAAS;EAC7D,OAAO,GACL,QAAQ,OAAO,SAAS,2BAA2B,GACnD,qCAAqC,QAAQ,OAAO,EACtD;CACF,CAAC;CAED,MAAM,IAAI,QAAQ,gBAAgB,YAAY;EAC5C,MAAM,cAAc,kBAAkB;EACtC,MAAM,kBAAkB;EACxB,MAAM,eAAe,GAAG,YAAY;EACpC,MAAM,QAAQ,WAAW;EACzB,MAAM,YAAY;EAClB,MAAM,SAAS,GAAG,MAAM;EACxB,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAElE,MAAM,UAAU,KAAK,IAAI,aAAa,iBAAiB,YAAY;EACnE,MAAM,OAAO,MAAM,WAAW,KAAK,EAAE;EACrC,OAAO,GAAG,KAAK,SAAS,WAAW,GAAG,aAAa,YAAY,aAAa,KAAK,EAAE;EAEnF,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK,EAAE;EACrC,OAAO,GAAG,KAAK,SAAS,KAAK,GAAG,aAAa,MAAM,0BAA0B,KAAK,EAAE;CACtF,CAAC;AACH;AAEA,IAAa,YAA4B;CACvC,MAAM;CACN,UAAU,CAAC,OAAO;CAClB,KAAK;AACP"}
+{"version":3,"file":"login.js","names":[],"sources":["../../../src/tests/login.ts"],"sourcesContent":["import assert from 'assert';\nimport buildDebug from 'debug';\nimport { writeFile } from 'fs/promises';\nimport * as YAML from 'js-yaml';\nimport { join } from 'path';\n\nimport { TestContext, TestDefinition } from '../types';\nimport { createTempFolder, getPackageJSON, getREADME } from '../utils/project';\nimport { LegacyLoginError, createUser, legacyLogin, whoami } from '../utils/registry-client';\n\nconst debug = buildDebug('verdaccio:e2e-cli:test:login');\n\n/**\n * Creates a project with registry config but WITHOUT auth token,\n * so whoami will use the token saved by login to ~/.yarnrc.yml.\n */\nasync function prepareLoginProject(ctx: TestContext, name: string): Promise<string> {\n  debug('preparing project for %s (no auth token)', name);\n  const tempFolder = await createTempFolder(name);\n  const yamlContent = YAML.dump({\n    npmRegistryServer: ctx.registryUrl,\n    enableImmutableInstalls: false,\n    unsafeHttpWhitelist: ['localhost'],\n  });\n  await writeFile(join(tempFolder, '.yarnrc.yml'), yamlContent);\n  await writeFile(join(tempFolder, 'package.json'), JSON.stringify({ name, version: '1.0.0' }));\n  if (ctx.adapter.importPlugin) {\n    debug('importing npm-login plugin into %s', tempFolder);\n    await ctx.adapter.importPlugin(tempFolder, 'npm-login');\n  }\n  return tempFolder;\n}\n\nasync function yarnLogin(\n  ctx: TestContext,\n  cwd: string,\n  user: string,\n  password: string,\n  email: string\n) {\n  debug('yarn npm login as %s', user);\n  return ctx.adapter.exec(\n    { cwd },\n    'login',\n    '--auth-type=legacy',\n    `--user=${user}`,\n    `--password=${password}`,\n    `--email=${email}`\n  );\n}\n\nasync function yarnWhoami(ctx: TestContext, cwd: string): Promise<string> {\n  const resp = await ctx.adapter.exec({ cwd }, 'whoami');\n  debug('yarn npm whoami: %s', resp.stdout);\n  return resp.stdout;\n}\n\nasync function testLogin(ctx: TestContext): Promise<void> {\n  const type = ctx.adapter.type;\n  const id = ctx.runId;\n\n  if (type !== 'yarn-modern') {\n    debug('login test only supported for yarn-modern, skipping %s', type);\n    return;\n  }\n\n  const user1 = `login-a-${id}`;\n  const password1 = 'test-password-123';\n  const email1 = `${user1}@test.example.com`;\n\n  await ctx.subTest('create new user + whoami', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login1-${id}`);\n    const loginResp = await yarnLogin(ctx, tf, user1, password1, email1);\n    assert.ok(\n      loginResp.stdout.includes('Logged in') || loginResp.stdout.includes('token saved'),\n      `Expected login success message but got \"${loginResp.stdout}\"`\n    );\n    const who = await yarnWhoami(ctx, tf);\n    assert.ok(who.includes(user1), `Expected whoami \"${user1}\" but got \"${who}\"`);\n  });\n\n  await ctx.subTest('legacy re-login is rejected without basic auth', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login2-${id}`);\n    let loginFailed = false;\n    try {\n      await yarnLogin(ctx, tf, user1, password1, email1);\n    } catch {\n      loginFailed = true;\n    }\n    assert.ok(loginFailed, 'Legacy re-login for an existing user should fail without Basic auth');\n  });\n\n  await ctx.subTest('wrong password fails', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login3-${id}`);\n    let loginFailed = false;\n    try {\n      await yarnLogin(ctx, tf, user1, 'wrong-password', email1);\n    } catch {\n      loginFailed = true;\n    }\n    assert.ok(loginFailed, 'Login with wrong password should have failed');\n  });\n\n  await ctx.subTest('login then publish', async () => {\n    const pkgName = `@verdaccio/login-pub-${id}`;\n    const publishUser = `login-pub-${id}`;\n    const publishPassword = 'publish-password-123';\n    const publishEmail = `${publishUser}@test.example.com`;\n    const tf = await createTempFolder(`login-pub-${id}`);\n    const yamlContent = YAML.dump({\n      npmRegistryServer: ctx.registryUrl,\n      enableImmutableInstalls: false,\n      unsafeHttpWhitelist: ['localhost'],\n    });\n    await writeFile(join(tf, '.yarnrc.yml'), yamlContent);\n    await writeFile(join(tf, 'package.json'), getPackageJSON(pkgName, '1.0.0'));\n    await writeFile(join(tf, 'README.md'), getREADME(pkgName));\n    if (ctx.adapter.importPlugin) {\n      await ctx.adapter.importPlugin(tf, 'npm-login');\n    }\n    await yarnLogin(ctx, tf, publishUser, publishPassword, publishEmail);\n    await ctx.adapter.exec({ cwd: tf }, 'install');\n    const pubResp = await ctx.adapter.exec({ cwd: tf }, 'publish');\n    assert.ok(\n      pubResp.stdout.includes('Package archive published'),\n      `Expected publish success but got \"${pubResp.stdout}\"`\n    );\n  });\n\n  await ctx.subTest('switch users', async () => {\n    const switchUser1 = `login-switch-a-${id}`;\n    const switchPassword1 = 'switch-password-123';\n    const switchEmail1 = `${switchUser1}@test.example.com`;\n    const user2 = `login-b-${id}`;\n    const password2 = 'other-password-456';\n    const email2 = `${user2}@test.example.com`;\n    const tf = await prepareLoginProject(ctx, `verdaccio-login5-${id}`);\n\n    await yarnLogin(ctx, tf, switchUser1, switchPassword1, switchEmail1);\n    const who1 = await yarnWhoami(ctx, tf);\n    assert.ok(who1.includes(switchUser1), `Expected \"${switchUser1}\" but got \"${who1}\"`);\n\n    await yarnLogin(ctx, tf, user2, password2, email2);\n    const who2 = await yarnWhoami(ctx, tf);\n    assert.ok(who2.includes(user2), `Expected \"${user2}\" after switch but got \"${who2}\"`);\n  });\n\n  // replayed over HTTP: what `npm login`, native `yarn npm login` and `pnpm login` send\n  for (const client of ['npm', 'yarn', 'pnpm'] as const) {\n    await ctx.subTest(`${client} logs an existing user in with the Basic retry`, async () => {\n      const user = `login-retry-${client}-${id}`;\n      const password = 'retry-password-123';\n      await createUser(ctx.registryUrl, user, password);\n\n      const token = await legacyLogin(ctx.registryUrl, user, password, client);\n      assert.strictEqual(await whoami(ctx.registryUrl, token), user);\n    });\n\n    await ctx.subTest(`${client} registers a new user`, async () => {\n      const user = `login-new-${client}-${id}`;\n\n      const token = await legacyLogin(ctx.registryUrl, user, 'retry-password-123', client);\n      assert.strictEqual(await whoami(ctx.registryUrl, token), user);\n    });\n\n    await ctx.subTest(\n      `${client} cannot log an existing user in with a wrong password`,\n      async () => {\n        const user = `login-wrong-${client}-${id}`;\n        await createUser(ctx.registryUrl, user, 'retry-password-123');\n\n        await assert.rejects(\n          legacyLogin(ctx.registryUrl, user, 'wrong-password', client),\n          (error: unknown) => error instanceof LegacyLoginError && error.status === 401\n        );\n      }\n    );\n  }\n}\n\nexport const loginTest: TestDefinition = {\n  name: 'login',\n  requires: ['login'],\n  run: testLogin,\n};\n"],"mappings":";;;;;;;;AAUA,IAAM,QAAQ,WAAW,8BAA8B;;;;;AAMvD,eAAe,oBAAoB,KAAkB,MAA+B;CAClF,MAAM,4CAA4C,IAAI;CACtD,MAAM,aAAa,MAAM,iBAAiB,IAAI;CAC9C,MAAM,cAAc,KAAK,KAAK;EAC5B,mBAAmB,IAAI;EACvB,yBAAyB;EACzB,qBAAqB,CAAC,WAAW;CACnC,CAAC;CACD,MAAM,UAAU,KAAK,YAAY,aAAa,GAAG,WAAW;CAC5D,MAAM,UAAU,KAAK,YAAY,cAAc,GAAG,KAAK,UAAU;EAAE;EAAM,SAAS;CAAQ,CAAC,CAAC;CAC5F,IAAI,IAAI,QAAQ,cAAc;EAC5B,MAAM,sCAAsC,UAAU;EACtD,MAAM,IAAI,QAAQ,aAAa,YAAY,WAAW;CACxD;CACA,OAAO;AACT;AAEA,eAAe,UACb,KACA,KACA,MACA,UACA,OACA;CACA,MAAM,wBAAwB,IAAI;CAClC,OAAO,IAAI,QAAQ,KACjB,EAAE,IAAI,GACN,SACA,sBACA,UAAU,QACV,cAAc,YACd,WAAW,OACb;AACF;AAEA,eAAe,WAAW,KAAkB,KAA8B;CACxE,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,EAAE,IAAI,GAAG,QAAQ;CACrD,MAAM,uBAAuB,KAAK,MAAM;CACxC,OAAO,KAAK;AACd;AAEA,eAAe,UAAU,KAAiC;CACxD,MAAM,OAAO,IAAI,QAAQ;CACzB,MAAM,KAAK,IAAI;CAEf,IAAI,SAAS,eAAe;EAC1B,MAAM,0DAA0D,IAAI;EACpE;CACF;CAEA,MAAM,QAAQ,WAAW;CACzB,MAAM,YAAY;CAClB,MAAM,SAAS,GAAG,MAAM;CAExB,MAAM,IAAI,QAAQ,4BAA4B,YAAY;EACxD,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,MAAM,YAAY,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACnE,OAAO,GACL,UAAU,OAAO,SAAS,WAAW,KAAK,UAAU,OAAO,SAAS,aAAa,GACjF,2CAA2C,UAAU,OAAO,EAC9D;EACA,MAAM,MAAM,MAAM,WAAW,KAAK,EAAE;EACpC,OAAO,GAAG,IAAI,SAAS,KAAK,GAAG,oBAAoB,MAAM,aAAa,IAAI,EAAE;CAC9E,CAAC;CAED,MAAM,IAAI,QAAQ,kDAAkD,YAAY;EAC9E,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,IAAI,cAAc;EAClB,IAAI;GACF,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACnD,QAAQ;GACN,cAAc;EAChB;EACA,OAAO,GAAG,aAAa,qEAAqE;CAC9F,CAAC;CAED,MAAM,IAAI,QAAQ,wBAAwB,YAAY;EACpD,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,IAAI,cAAc;EAClB,IAAI;GACF,MAAM,UAAU,KAAK,IAAI,OAAO,kBAAkB,MAAM;EAC1D,QAAQ;GACN,cAAc;EAChB;EACA,OAAO,GAAG,aAAa,8CAA8C;CACvE,CAAC;CAED,MAAM,IAAI,QAAQ,sBAAsB,YAAY;EAClD,MAAM,UAAU,wBAAwB;EACxC,MAAM,cAAc,aAAa;EACjC,MAAM,kBAAkB;EACxB,MAAM,eAAe,GAAG,YAAY;EACpC,MAAM,KAAK,MAAM,iBAAiB,aAAa,IAAI;EACnD,MAAM,cAAc,KAAK,KAAK;GAC5B,mBAAmB,IAAI;GACvB,yBAAyB;GACzB,qBAAqB,CAAC,WAAW;EACnC,CAAC;EACD,MAAM,UAAU,KAAK,IAAI,aAAa,GAAG,WAAW;EACpD,MAAM,UAAU,KAAK,IAAI,cAAc,GAAG,eAAe,SAAS,OAAO,CAAC;EAC1E,MAAM,UAAU,KAAK,IAAI,WAAW,GAAG,UAAU,OAAO,CAAC;EACzD,IAAI,IAAI,QAAQ,cACd,MAAM,IAAI,QAAQ,aAAa,IAAI,WAAW;EAEhD,MAAM,UAAU,KAAK,IAAI,aAAa,iBAAiB,YAAY;EACnE,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,GAAG,GAAG,SAAS;EAC7C,MAAM,UAAU,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,GAAG,GAAG,SAAS;EAC7D,OAAO,GACL,QAAQ,OAAO,SAAS,2BAA2B,GACnD,qCAAqC,QAAQ,OAAO,EACtD;CACF,CAAC;CAED,MAAM,IAAI,QAAQ,gBAAgB,YAAY;EAC5C,MAAM,cAAc,kBAAkB;EACtC,MAAM,kBAAkB;EACxB,MAAM,eAAe,GAAG,YAAY;EACpC,MAAM,QAAQ,WAAW;EACzB,MAAM,YAAY;EAClB,MAAM,SAAS,GAAG,MAAM;EACxB,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAElE,MAAM,UAAU,KAAK,IAAI,aAAa,iBAAiB,YAAY;EACnE,MAAM,OAAO,MAAM,WAAW,KAAK,EAAE;EACrC,OAAO,GAAG,KAAK,SAAS,WAAW,GAAG,aAAa,YAAY,aAAa,KAAK,EAAE;EAEnF,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK,EAAE;EACrC,OAAO,GAAG,KAAK,SAAS,KAAK,GAAG,aAAa,MAAM,0BAA0B,KAAK,EAAE;CACtF,CAAC;CAGD,KAAK,MAAM,UAAU;EAAC;EAAO;EAAQ;CAAM,GAAY;EACrD,MAAM,IAAI,QAAQ,GAAG,OAAO,iDAAiD,YAAY;GACvF,MAAM,OAAO,eAAe,OAAO,GAAG;GACtC,MAAM,WAAW;GACjB,MAAM,WAAW,IAAI,aAAa,MAAM,QAAQ;GAEhD,MAAM,QAAQ,MAAM,YAAY,IAAI,aAAa,MAAM,UAAU,MAAM;GACvE,OAAO,YAAY,MAAM,OAAO,IAAI,aAAa,KAAK,GAAG,IAAI;EAC/D,CAAC;EAED,MAAM,IAAI,QAAQ,GAAG,OAAO,wBAAwB,YAAY;GAC9D,MAAM,OAAO,aAAa,OAAO,GAAG;GAEpC,MAAM,QAAQ,MAAM,YAAY,IAAI,aAAa,MAAM,sBAAsB,MAAM;GACnF,OAAO,YAAY,MAAM,OAAO,IAAI,aAAa,KAAK,GAAG,IAAI;EAC/D,CAAC;EAED,MAAM,IAAI,QACR,GAAG,OAAO,wDACV,YAAY;GACV,MAAM,OAAO,eAAe,OAAO,GAAG;GACtC,MAAM,WAAW,IAAI,aAAa,MAAM,oBAAoB;GAE5D,MAAM,OAAO,QACX,YAAY,IAAI,aAAa,MAAM,kBAAkB,MAAM,IAC1D,UAAmB,iBAAiB,oBAAoB,MAAM,WAAW,GAC5E;EACF,CACF;CACF;AACF;AAEA,IAAa,YAA4B;CACvC,MAAM;CACN,UAAU,CAAC,OAAO;CAClB,KAAK;AACP"}

package/build/esm/utils/registry-client.js

@@ -47,7 +47,63 @@ async function pingRegistry(registryUrl) {
 		return false;
 	}
 }
+var LegacyLoginError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+	}
+};
+/**
+* Replays the legacy login the way each client sends it. npm and Yarn retry a
+* 409 with Basic (Yarn on the GET too); pnpm sends Basic on a single PUT. A
+* registry that authenticates the first PUT is accepted too.
+*/
+async function legacyLogin(registryUrl, user, password, client) {
+	const userUrl = `${registryUrl}/-/user/org.couchdb.user:${encodeURIComponent(user)}`;
+	const basic = `Basic ${Buffer.from(`${user}:${password}`).toString("base64")}`;
+	const jsonHeaders = { "Content-Type": "application/json" };
+	const body = {
+		_id: `org.couchdb.user:${user}`,
+		name: user,
+		password,
+		type: "user",
+		roles: [],
+		date: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	const put = (url, headers) => fetch(url, {
+		method: "PUT",
+		headers,
+		body: JSON.stringify(body)
+	});
+	const first = await put(userUrl, client === "pnpm" ? {
+		...jsonHeaders,
+		Authorization: basic,
+		"npm-auth-type": "web"
+	} : jsonHeaders);
+	const firstBody = await first.json();
+	if (first.ok && firstBody.token) {
+		debug("%s: first PUT authenticated %s", client, user);
+		return firstBody.token;
+	}
+	if (first.status !== 409) throw new LegacyLoginError(`first PUT answered ${first.status}`, first.status);
+	const current = await fetch(`${userUrl}?write=true`, { headers: client === "yarn" ? { Authorization: basic } : {} });
+	if (!current.ok) throw new LegacyLoginError(`GET answered ${current.status}`, current.status);
+	const currentBody = await current.json();
+	for (const [key, value] of Object.entries(currentBody)) if (!body[key] || key === "roles") body[key] = value;
+	const second = await put(`${userUrl}/-rev/${body._rev}`, {
+		...jsonHeaders,
+		Authorization: basic
+	});
+	const secondBody = await second.json();
+	if (!second.ok || !secondBody.token) throw new LegacyLoginError(`PUT with revision answered ${second.status}`, second.status);
+	return secondBody.token;
+}
+async function whoami(registryUrl, token) {
+	const response = await fetch(`${registryUrl}/-/whoami`, { headers: { Authorization: `Bearer ${token}` } });
+	return response.ok ? (await response.json()).username : void 0;
+}
 //#endregion
-export { createUser, pingRegistry };
+export { LegacyLoginError, createUser, legacyLogin, pingRegistry, whoami };
 
 //# sourceMappingURL=registry-client.js.map

package/build/esm/utils/registry-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry-client.js","names":[],"sources":["../../../src/utils/registry-client.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { ping } from '@verdaccio/registry-cli';\n\nconst debug = buildDebug('verdaccio:e2e-cli:registry-client');\n\nexport type RegistryAuth = {\n  token: string;\n  user: string;\n};\n\n/**\n * Creates a user on the registry and returns the auth token.\n * Uses a unique username per run to avoid 409 conflicts.\n * Works against any running Verdaccio instance with htpasswd auth.\n */\nexport async function createUser(\n  registryUrl: string,\n  user = `e2e-user-${Date.now()}`,\n  password = 'e2e-test-password'\n): Promise<RegistryAuth> {\n  debug('creating user %s on %s', user, registryUrl);\n  const url = `${registryUrl}/-/user/org.couchdb.user:${encodeURIComponent(user)}`;\n  const response = await fetch(url, {\n    method: 'PUT',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      name: user,\n      password,\n      _id: `org.couchdb.user:${user}`,\n      type: 'user',\n      roles: [],\n      date: new Date().toISOString(),\n    }),\n  });\n\n  const body = (await response.json()) as any;\n\n  if (response.status === 201 || response.status === 200 || response.status === 409) {\n    const token = body.token;\n    if (token) {\n      debug('user %s authenticated, token obtained', user);\n      return { token, user };\n    }\n  }\n\n  throw new Error(\n    `Failed to create/login user \"${user}\" on ${registryUrl}: ${response.status} ${JSON.stringify(body)}`\n  );\n}\n\n/**\n * Ping the registry to check it's alive.\n * Uses @verdaccio/registry-cli ping.\n */\nexport async function pingRegistry(registryUrl: string): Promise<boolean> {\n  debug('pinging %s', registryUrl);\n  try {\n    const result = await ping(registryUrl);\n    return result.ok;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;AAIA,IAAM,QAAQ,WAAW,mCAAmC;;;;;;AAY5D,eAAsB,WACpB,aACA,OAAO,YAAY,KAAK,IAAI,KAC5B,WAAW,qBACY;CACvB,MAAM,0BAA0B,MAAM,WAAW;CACjD,MAAM,MAAM,GAAG,YAAY,2BAA2B,mBAAmB,IAAI;CAC7E,MAAM,WAAW,MAAM,MAAM,KAAK;EAChC,QAAQ;EACR,SAAS,EAAE,gBAAgB,mBAAmB;EAC9C,MAAM,KAAK,UAAU;GACnB,MAAM;GACN;GACA,KAAK,oBAAoB;GACzB,MAAM;GACN,OAAO,CAAC;GACR,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;EAC/B,CAAC;CACH,CAAC;CAED,MAAM,OAAQ,MAAM,SAAS,KAAK;CAElC,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,OAAO,SAAS,WAAW,KAAK;EACjF,MAAM,QAAQ,KAAK;EACnB,IAAI,OAAO;GACT,MAAM,yCAAyC,IAAI;GACnD,OAAO;IAAE;IAAO;GAAK;EACvB;CACF;CAEA,MAAM,IAAI,MACR,gCAAgC,KAAK,OAAO,YAAY,IAAI,SAAS,OAAO,GAAG,KAAK,UAAU,IAAI,GACpG;AACF;;;;;AAMA,eAAsB,aAAa,aAAuC;CACxE,MAAM,cAAc,WAAW;CAC/B,IAAI;EAEF,QAAO,MADc,KAAK,WAAW,EAAA,CACvB;CAChB,QAAQ;EACN,OAAO;CACT;AACF"}
+{"version":3,"file":"registry-client.js","names":[],"sources":["../../../src/utils/registry-client.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { ping } from '@verdaccio/registry-cli';\n\nconst debug = buildDebug('verdaccio:e2e-cli:registry-client');\n\nexport type RegistryAuth = {\n  token: string;\n  user: string;\n};\n\n/**\n * Creates a user on the registry and returns the auth token.\n * Uses a unique username per run to avoid 409 conflicts.\n * Works against any running Verdaccio instance with htpasswd auth.\n */\nexport async function createUser(\n  registryUrl: string,\n  user = `e2e-user-${Date.now()}`,\n  password = 'e2e-test-password'\n): Promise<RegistryAuth> {\n  debug('creating user %s on %s', user, registryUrl);\n  const url = `${registryUrl}/-/user/org.couchdb.user:${encodeURIComponent(user)}`;\n  const response = await fetch(url, {\n    method: 'PUT',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      name: user,\n      password,\n      _id: `org.couchdb.user:${user}`,\n      type: 'user',\n      roles: [],\n      date: new Date().toISOString(),\n    }),\n  });\n\n  const body = (await response.json()) as any;\n\n  if (response.status === 201 || response.status === 200 || response.status === 409) {\n    const token = body.token;\n    if (token) {\n      debug('user %s authenticated, token obtained', user);\n      return { token, user };\n    }\n  }\n\n  throw new Error(\n    `Failed to create/login user \"${user}\" on ${registryUrl}: ${response.status} ${JSON.stringify(body)}`\n  );\n}\n\n/**\n * Ping the registry to check it's alive.\n * Uses @verdaccio/registry-cli ping.\n */\nexport async function pingRegistry(registryUrl: string): Promise<boolean> {\n  debug('pinging %s', registryUrl);\n  try {\n    const result = await ping(registryUrl);\n    return result.ok;\n  } catch {\n    return false;\n  }\n}\n\nexport class LegacyLoginError extends Error {\n  constructor(\n    message: string,\n    readonly status: number\n  ) {\n    super(message);\n  }\n}\n\n/**\n * Replays the legacy login the way each client sends it. npm and Yarn retry a\n * 409 with Basic (Yarn on the GET too); pnpm sends Basic on a single PUT. A\n * registry that authenticates the first PUT is accepted too.\n */\nexport async function legacyLogin(\n  registryUrl: string,\n  user: string,\n  password: string,\n  client: 'npm' | 'yarn' | 'pnpm'\n): Promise<string> {\n  const userUrl = `${registryUrl}/-/user/org.couchdb.user:${encodeURIComponent(user)}`;\n  const basic = `Basic ${Buffer.from(`${user}:${password}`).toString('base64')}`;\n  const jsonHeaders = { 'Content-Type': 'application/json' };\n  const body: Record<string, unknown> = {\n    _id: `org.couchdb.user:${user}`,\n    name: user,\n    password,\n    type: 'user',\n    roles: [],\n    date: new Date().toISOString(),\n  };\n\n  const put = (url: string, headers: Record<string, string>) =>\n    fetch(url, { method: 'PUT', headers, body: JSON.stringify(body) });\n\n  const first = await put(\n    userUrl,\n    client === 'pnpm'\n      ? { ...jsonHeaders, Authorization: basic, 'npm-auth-type': 'web' }\n      : jsonHeaders\n  );\n  const firstBody = (await first.json()) as any;\n  if (first.ok && firstBody.token) {\n    debug('%s: first PUT authenticated %s', client, user);\n    return firstBody.token;\n  }\n  if (first.status !== 409) {\n    throw new LegacyLoginError(`first PUT answered ${first.status}`, first.status);\n  }\n\n  const current = await fetch(`${userUrl}?write=true`, {\n    headers: client === 'yarn' ? { Authorization: basic } : {},\n  });\n  if (!current.ok) {\n    throw new LegacyLoginError(`GET answered ${current.status}`, current.status);\n  }\n  const currentBody = (await current.json()) as Record<string, unknown>;\n  for (const [key, value] of Object.entries(currentBody)) {\n    if (!body[key] || key === 'roles') {\n      body[key] = value;\n    }\n  }\n\n  const second = await put(`${userUrl}/-rev/${body._rev}`, {\n    ...jsonHeaders,\n    Authorization: basic,\n  });\n  const secondBody = (await second.json()) as any;\n  if (!second.ok || !secondBody.token) {\n    throw new LegacyLoginError(`PUT with revision answered ${second.status}`, second.status);\n  }\n  return secondBody.token;\n}\n\nexport async function whoami(registryUrl: string, token: string): Promise<string | undefined> {\n  const response = await fetch(`${registryUrl}/-/whoami`, {\n    headers: { Authorization: `Bearer ${token}` },\n  });\n  return response.ok ? ((await response.json()) as any).username : undefined;\n}\n"],"mappings":";;;AAIA,IAAM,QAAQ,WAAW,mCAAmC;;;;;;AAY5D,eAAsB,WACpB,aACA,OAAO,YAAY,KAAK,IAAI,KAC5B,WAAW,qBACY;CACvB,MAAM,0BAA0B,MAAM,WAAW;CACjD,MAAM,MAAM,GAAG,YAAY,2BAA2B,mBAAmB,IAAI;CAC7E,MAAM,WAAW,MAAM,MAAM,KAAK;EAChC,QAAQ;EACR,SAAS,EAAE,gBAAgB,mBAAmB;EAC9C,MAAM,KAAK,UAAU;GACnB,MAAM;GACN;GACA,KAAK,oBAAoB;GACzB,MAAM;GACN,OAAO,CAAC;GACR,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;EAC/B,CAAC;CACH,CAAC;CAED,MAAM,OAAQ,MAAM,SAAS,KAAK;CAElC,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,OAAO,SAAS,WAAW,KAAK;EACjF,MAAM,QAAQ,KAAK;EACnB,IAAI,OAAO;GACT,MAAM,yCAAyC,IAAI;GACnD,OAAO;IAAE;IAAO;GAAK;EACvB;CACF;CAEA,MAAM,IAAI,MACR,gCAAgC,KAAK,OAAO,YAAY,IAAI,SAAS,OAAO,GAAG,KAAK,UAAU,IAAI,GACpG;AACF;;;;;AAMA,eAAsB,aAAa,aAAuC;CACxE,MAAM,cAAc,WAAW;CAC/B,IAAI;EAEF,QAAO,MADc,KAAK,WAAW,EAAA,CACvB;CAChB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,IAAa,mBAAb,cAAsC,MAAM;CAG/B;CAFX,YACE,SACA,QACA;EACA,MAAM,OAAO;EAFJ,KAAA,SAAA;CAGX;AACF;;;;;;AAOA,eAAsB,YACpB,aACA,MACA,UACA,QACiB;CACjB,MAAM,UAAU,GAAG,YAAY,2BAA2B,mBAAmB,IAAI;CACjF,MAAM,QAAQ,SAAS,OAAO,KAAK,GAAG,KAAK,GAAG,UAAU,CAAC,CAAC,SAAS,QAAQ;CAC3E,MAAM,cAAc,EAAE,gBAAgB,mBAAmB;CACzD,MAAM,OAAgC;EACpC,KAAK,oBAAoB;EACzB,MAAM;EACN;EACA,MAAM;EACN,OAAO,CAAC;EACR,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;CAC/B;CAEA,MAAM,OAAO,KAAa,YACxB,MAAM,KAAK;EAAE,QAAQ;EAAO;EAAS,MAAM,KAAK,UAAU,IAAI;CAAE,CAAC;CAEnE,MAAM,QAAQ,MAAM,IAClB,SACA,WAAW,SACP;EAAE,GAAG;EAAa,eAAe;EAAO,iBAAiB;CAAM,IAC/D,WACN;CACA,MAAM,YAAa,MAAM,MAAM,KAAK;CACpC,IAAI,MAAM,MAAM,UAAU,OAAO;EAC/B,MAAM,kCAAkC,QAAQ,IAAI;EACpD,OAAO,UAAU;CACnB;CACA,IAAI,MAAM,WAAW,KACnB,MAAM,IAAI,iBAAiB,sBAAsB,MAAM,UAAU,MAAM,MAAM;CAG/E,MAAM,UAAU,MAAM,MAAM,GAAG,QAAQ,cAAc,EACnD,SAAS,WAAW,SAAS,EAAE,eAAe,MAAM,IAAI,CAAC,EAC3D,CAAC;CACD,IAAI,CAAC,QAAQ,IACX,MAAM,IAAI,iBAAiB,gBAAgB,QAAQ,UAAU,QAAQ,MAAM;CAE7E,MAAM,cAAe,MAAM,QAAQ,KAAK;CACxC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,WAAW,GACnD,IAAI,CAAC,KAAK,QAAQ,QAAQ,SACxB,KAAK,OAAO;CAIhB,MAAM,SAAS,MAAM,IAAI,GAAG,QAAQ,QAAQ,KAAK,QAAQ;EACvD,GAAG;EACH,eAAe;CACjB,CAAC;CACD,MAAM,aAAc,MAAM,OAAO,KAAK;CACtC,IAAI,CAAC,OAAO,MAAM,CAAC,WAAW,OAC5B,MAAM,IAAI,iBAAiB,8BAA8B,OAAO,UAAU,OAAO,MAAM;CAEzF,OAAO,WAAW;AACpB;AAEA,eAAsB,OAAO,aAAqB,OAA4C;CAC5F,MAAM,WAAW,MAAM,MAAM,GAAG,YAAY,YAAY,EACtD,SAAS,EAAE,eAAe,UAAU,QAAQ,EAC9C,CAAC;CACD,OAAO,SAAS,MAAO,MAAM,SAAS,KAAK,EAAA,CAAW,WAAW,KAAA;AACnE"}

package/build/utils/registry-client.d.ts

@@ -13,3 +13,14 @@ export declare function createUser(registryUrl: string, user?: string, password?
  * Uses @verdaccio/registry-cli ping.
  */
 export declare function pingRegistry(registryUrl: string): Promise<boolean>;
+export declare class LegacyLoginError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
+/**
+ * Replays the legacy login the way each client sends it. npm and Yarn retry a
+ * 409 with Basic (Yarn on the GET too); pnpm sends Basic on a single PUT. A
+ * registry that authenticates the first PUT is accepted too.
+ */
+export declare function legacyLogin(registryUrl: string, user: string, password: string, client: 'npm' | 'yarn' | 'pnpm'): Promise<string>;
+export declare function whoami(registryUrl: string, token: string): Promise<string | undefined>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/e2e-cli",
-  "version": "3.4.0",
+  "version": "4.0.0",
   "type": "module",
   "license": "MIT",
   "description": "CLI tool to run Verdaccio e2e tests against any running registry",
@@ -30,7 +30,7 @@
     "@verdaccio/registry-cli": "^1.1.0",
     "debug": "4.4.3",
     "get-port": "7.2.0",
-    "js-yaml": "5.2.3"
+    "js-yaml": "5.4.1"
   },
   "devDependencies": {
     "@types/debug": "4.1.13",