@verdaccio/e2e-cli 3.4.0 → 4.0.1

package/build/cjs/adapters/bun.cjs

@@ -42,7 +42,8 @@ function createBunAdapter(binPath, _version) {
 			return ["--cwd", folder];
 		},
 		exec(options, ...args) {
-			if (args[0] === "info") {
+			const cmd = args[0];
+			if (cmd === "info") {
 				const pkgName = args[1];
 				const cleaned = args.slice(2).filter((a) => a !== "--registry").filter((a) => !a.startsWith("http"));
 				return require_process.exec(options, bin, [
@@ -51,6 +52,7 @@ function createBunAdapter(binPath, _version) {
 					...cleaned
 				]);
 			}
+			if (cmd === "publish") return require_process.exec(options, bin, args.filter((a) => a !== "--json"));
 			return require_process.exec(options, bin, args);
 		},
 		async prepareProject(packageName, version, registryUrl, port, token, dependencies = {}, devDependencies = {}) {

package/build/cjs/adapters/bun.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"bun.cjs","names":[],"sources":["../../../src/adapters/bun.ts"],"sourcesContent":["import { SpawnOptions, execSync } from 'child_process';\nimport buildDebug from 'debug';\n\nimport { ExecOutput, PackageManagerAdapter } from '../types';\nimport { exec } from '../utils/process';\nimport { prepareGenericEmptyProject } from '../utils/project';\n\nconst debug = buildDebug('verdaccio:e2e-cli:bun');\n\nconst BUN_SUPPORTED_COMMANDS = new Set(['publish', 'install', 'info', 'audit']);\n\nfunction detectVersion(bin: string): string {\n  try {\n    return execSync(`${bin} --version`, { encoding: 'utf8', timeout: 5000 }).trim();\n  } catch {\n    return 'unknown';\n  }\n}\n\nfunction resolveBunBin(binPath?: string): string {\n  if (binPath) return binPath;\n  return 'bun';\n}\n\nexport function createBunAdapter(binPath?: string, _version?: string): PackageManagerAdapter {\n  const bin = resolveBunBin(binPath);\n  const resolved = detectVersion(bin);\n  debug('creating bun adapter with bin: %s (%s)', bin, resolved);\n\n  const adapter: PackageManagerAdapter = {\n    name: `bun@${resolved}`,\n    type: 'bun',\n    bin,\n    supports: BUN_SUPPORTED_COMMANDS,\n\n    registryArg(url: string): string[] {\n      return ['--registry', url];\n    },\n\n    prefixArg(folder: string): string[] {\n      return ['--cwd', folder];\n    },\n\n    exec(options: SpawnOptions, ...args: string[]): Promise<ExecOutput> {\n      const cmd = args[0];\n\n      if (cmd === 'info') {\n        // bun info <pkg> reads registry from .npmrc, strip --registry <url>\n        const pkgName = args[1];\n        const filteredArgs = args.slice(2).filter((a) => a !== '--registry');\n        // also remove the URL that follows --registry\n        const cleaned = filteredArgs.filter((a) => !a.startsWith('http'));\n        return exec(options, bin, ['info', pkgName, ...cleaned]);\n      }\n\n      return exec(options, bin, args);\n    },\n\n    async prepareProject(\n      packageName: string,\n      version: string,\n      registryUrl: string,\n      port: number,\n      token: string,\n      dependencies: Record<string, string> = {},\n      devDependencies: Record<string, string> = {}\n    ): Promise<{ tempFolder: string }> {\n      return prepareGenericEmptyProject(\n        packageName,\n        version,\n        port,\n        token,\n        registryUrl,\n        dependencies,\n        devDependencies\n      );\n    },\n  };\n\n  return adapter;\n}\n"],"mappings":";;;;;;;AAOA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,uBAAuB;AAEhD,IAAM,yCAAyB,IAAI,IAAI;CAAC;CAAW;CAAW;CAAQ;AAAO,CAAC;AAE9E,SAAS,cAAc,KAAqB;CAC1C,IAAI;EACF,QAAA,GAAO,cAAA,SAAA,CAAS,GAAG,IAAI,aAAa;GAAE,UAAU;GAAQ,SAAS;EAAK,CAAC,CAAC,CAAC,KAAK;CAChF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,cAAc,SAA0B;CAC/C,IAAI,SAAS,OAAO;CACpB,OAAO;AACT;AAEA,SAAgB,iBAAiB,SAAkB,UAA0C;CAC3F,MAAM,MAAM,cAAc,OAAO;CACjC,MAAM,WAAW,cAAc,GAAG;CAClC,QAAM,0CAA0C,KAAK,QAAQ;CAoD7D,OAAO;EAjDL,MAAM,OAAO;EACb,MAAM;EACN;EACA,UAAU;EAEV,YAAY,KAAuB;GACjC,OAAO,CAAC,cAAc,GAAG;EAC3B;EAEA,UAAU,QAA0B;GAClC,OAAO,CAAC,SAAS,MAAM;EACzB;EAEA,KAAK,SAAuB,GAAG,MAAqC;GAGlE,IAFY,KAAK,OAEL,QAAQ;IAElB,MAAM,UAAU,KAAK;IAGrB,MAAM,UAFe,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,MAAM,MAAM,YAEvC,CAAA,CAAa,QAAQ,MAAM,CAAC,EAAE,WAAW,MAAM,CAAC;IAChE,OAAO,gBAAA,KAAK,SAAS,KAAK;KAAC;KAAQ;KAAS,GAAG;IAAO,CAAC;GACzD;GAEA,OAAO,gBAAA,KAAK,SAAS,KAAK,IAAI;EAChC;EAEA,MAAM,eACJ,aACA,SACA,aACA,MACA,OACA,eAAuC,CAAC,GACxC,kBAA0C,CAAC,GACV;GACjC,OAAO,gBAAA,2BACL,aACA,SACA,MACA,OACA,aACA,cACA,eACF;EACF;CAGK;AACT"}
+{"version":3,"file":"bun.cjs","names":[],"sources":["../../../src/adapters/bun.ts"],"sourcesContent":["import { SpawnOptions, execSync } from 'child_process';\nimport buildDebug from 'debug';\n\nimport { ExecOutput, PackageManagerAdapter } from '../types';\nimport { exec } from '../utils/process';\nimport { prepareGenericEmptyProject } from '../utils/project';\n\nconst debug = buildDebug('verdaccio:e2e-cli:bun');\n\nconst BUN_SUPPORTED_COMMANDS = new Set(['publish', 'install', 'info', 'audit']);\n\nfunction detectVersion(bin: string): string {\n  try {\n    return execSync(`${bin} --version`, { encoding: 'utf8', timeout: 5000 }).trim();\n  } catch {\n    return 'unknown';\n  }\n}\n\nfunction resolveBunBin(binPath?: string): string {\n  if (binPath) return binPath;\n  return 'bun';\n}\n\nexport function createBunAdapter(binPath?: string, _version?: string): PackageManagerAdapter {\n  const bin = resolveBunBin(binPath);\n  const resolved = detectVersion(bin);\n  debug('creating bun adapter with bin: %s (%s)', bin, resolved);\n\n  const adapter: PackageManagerAdapter = {\n    name: `bun@${resolved}`,\n    type: 'bun',\n    bin,\n    supports: BUN_SUPPORTED_COMMANDS,\n\n    registryArg(url: string): string[] {\n      return ['--registry', url];\n    },\n\n    prefixArg(folder: string): string[] {\n      return ['--cwd', folder];\n    },\n\n    exec(options: SpawnOptions, ...args: string[]): Promise<ExecOutput> {\n      const cmd = args[0];\n\n      if (cmd === 'info') {\n        // bun info <pkg> reads registry from .npmrc, strip --registry <url>\n        const pkgName = args[1];\n        const filteredArgs = args.slice(2).filter((a) => a !== '--registry');\n        // also remove the URL that follows --registry\n        const cleaned = filteredArgs.filter((a) => !a.startsWith('http'));\n        return exec(options, bin, ['info', pkgName, ...cleaned]);\n      }\n\n      if (cmd === 'publish') {\n        // bun 1.4.4 rejects `publish --json`; the publish test only checks the exit code for bun\n        return exec(\n          options,\n          bin,\n          args.filter((a) => a !== '--json')\n        );\n      }\n\n      return exec(options, bin, args);\n    },\n\n    async prepareProject(\n      packageName: string,\n      version: string,\n      registryUrl: string,\n      port: number,\n      token: string,\n      dependencies: Record<string, string> = {},\n      devDependencies: Record<string, string> = {}\n    ): Promise<{ tempFolder: string }> {\n      return prepareGenericEmptyProject(\n        packageName,\n        version,\n        port,\n        token,\n        registryUrl,\n        dependencies,\n        devDependencies\n      );\n    },\n  };\n\n  return adapter;\n}\n"],"mappings":";;;;;;;AAOA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,uBAAuB;AAEhD,IAAM,yCAAyB,IAAI,IAAI;CAAC;CAAW;CAAW;CAAQ;AAAO,CAAC;AAE9E,SAAS,cAAc,KAAqB;CAC1C,IAAI;EACF,QAAA,GAAO,cAAA,SAAA,CAAS,GAAG,IAAI,aAAa;GAAE,UAAU;GAAQ,SAAS;EAAK,CAAC,CAAC,CAAC,KAAK;CAChF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,cAAc,SAA0B;CAC/C,IAAI,SAAS,OAAO;CACpB,OAAO;AACT;AAEA,SAAgB,iBAAiB,SAAkB,UAA0C;CAC3F,MAAM,MAAM,cAAc,OAAO;CACjC,MAAM,WAAW,cAAc,GAAG;CAClC,QAAM,0CAA0C,KAAK,QAAQ;CA6D7D,OAAO;EA1DL,MAAM,OAAO;EACb,MAAM;EACN;EACA,UAAU;EAEV,YAAY,KAAuB;GACjC,OAAO,CAAC,cAAc,GAAG;EAC3B;EAEA,UAAU,QAA0B;GAClC,OAAO,CAAC,SAAS,MAAM;EACzB;EAEA,KAAK,SAAuB,GAAG,MAAqC;GAClE,MAAM,MAAM,KAAK;GAEjB,IAAI,QAAQ,QAAQ;IAElB,MAAM,UAAU,KAAK;IAGrB,MAAM,UAFe,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,MAAM,MAAM,YAEvC,CAAA,CAAa,QAAQ,MAAM,CAAC,EAAE,WAAW,MAAM,CAAC;IAChE,OAAO,gBAAA,KAAK,SAAS,KAAK;KAAC;KAAQ;KAAS,GAAG;IAAO,CAAC;GACzD;GAEA,IAAI,QAAQ,WAEV,OAAO,gBAAA,KACL,SACA,KACA,KAAK,QAAQ,MAAM,MAAM,QAAQ,CACnC;GAGF,OAAO,gBAAA,KAAK,SAAS,KAAK,IAAI;EAChC;EAEA,MAAM,eACJ,aACA,SACA,aACA,MACA,OACA,eAAuC,CAAC,GACxC,kBAA0C,CAAC,GACV;GACjC,OAAO,gBAAA,2BACL,aACA,SACA,MACA,OACA,aACA,cACA,eACF;EACF;CAGK;AACT"}

package/build/cjs/adapters/pnpm.cjs

@@ -8,18 +8,7 @@ let path = require("path");
 let fs_promises = require("fs/promises");
 //#region src/adapters/pnpm.ts
 var debug$1 = (0, debug.default)("verdaccio:e2e-cli:pnpm");
-var PNPM_V10_COMMANDS = /* @__PURE__ */ new Set([
-	"publish",
-	"unpublish",
-	"install",
-	"info",
-	"audit",
-	"deprecate",
-	"dist-tag",
-	"ping",
-	"search"
-]);
-var PNPM_V11_COMMANDS = /* @__PURE__ */ new Set([
+var PNPM_COMMANDS = /* @__PURE__ */ new Set([
 	"publish",
 	"unpublish",
 	"install",
@@ -27,15 +16,7 @@ var PNPM_V11_COMMANDS = /* @__PURE__ */ new Set([
 	"audit",
 	"deprecate"
 ]);
-function getSupportedCommands(version) {
-	const major = parseInt(version.split(".")[0], 10);
-	if (major >= 11) {
-		debug$1("pnpm v%d detected, using v11 command set", major);
-		return PNPM_V11_COMMANDS;
-	}
-	return PNPM_V10_COMMANDS;
-}
-var PNPM_MIN_SUPPORTED_MAJOR = 10;
+var PNPM_MIN_SUPPORTED_MAJOR = 11;
 function detectVersion(bin) {
 	try {
 		return (0, child_process.execSync)(`${bin} --version`, {
@@ -78,7 +59,7 @@ function createPnpmAdapter(binPath, version) {
 		name: `pnpm@${resolved}`,
 		type: "pnpm",
 		bin,
-		supports: getSupportedCommands(resolved),
+		supports: PNPM_COMMANDS,
 		registryArg(url) {
 			return ["--registry", url];
 		},

package/build/cjs/adapters/pnpm.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"pnpm.cjs","names":[],"sources":["../../../src/adapters/pnpm.ts"],"sourcesContent":["import { SpawnOptions, execSync } from 'child_process';\nimport buildDebug from 'debug';\nimport { writeFile } from 'fs/promises';\nimport { join } from 'path';\n\nimport { ExecOutput, PackageManagerAdapter } from '../types';\nimport { exec } from '../utils/process';\nimport { prepareGenericEmptyProject } from '../utils/project';\n\nconst debug = buildDebug('verdaccio:e2e-cli:pnpm');\n\nconst PNPM_V10_COMMANDS = new Set([\n  'publish',\n  'unpublish',\n  'install',\n  'info',\n  'audit',\n  'deprecate',\n  'dist-tag',\n  'ping',\n  'search',\n]);\n\n// pnpm v11 removed ping and search\n// dist-tag output format changed (no --json), needs adapted assertions\nconst PNPM_V11_COMMANDS = new Set([\n  'publish',\n  'unpublish',\n  'install',\n  'info',\n  'audit',\n  'deprecate',\n]);\n\nfunction getSupportedCommands(version: string): Set<string> {\n  const major = parseInt(version.split('.')[0], 10);\n  if (major >= 11) {\n    debug('pnpm v%d detected, using v11 command set', major);\n    return PNPM_V11_COMMANDS;\n  }\n  return PNPM_V10_COMMANDS;\n}\n\n// pnpm 8 and 9 are end-of-life and no longer supported by the suite.\nconst PNPM_MIN_SUPPORTED_MAJOR = 10;\n\nfunction detectVersion(bin: string): string {\n  try {\n    return execSync(`${bin} --version`, { encoding: 'utf8', timeout: 5000 }).trim();\n  } catch {\n    return 'unknown';\n  }\n}\n\nfunction assertSupportedVersion(resolved: string): void {\n  const major = parseInt(resolved.split('.')[0], 10);\n  if (!Number.isNaN(major) && major < PNPM_MIN_SUPPORTED_MAJOR) {\n    throw new Error(\n      `pnpm@${resolved} is not supported. Minimum supported major: ${PNPM_MIN_SUPPORTED_MAJOR}`\n    );\n  }\n}\n\nfunction installPnpm(version: string): string {\n  const pkg = `pnpm@${version}`;\n  debug('installing %s into temp dir', pkg);\n  const tmpDir = execSync('mktemp -d', { encoding: 'utf8' }).trim();\n  execSync(`npm install --prefix \"${tmpDir}\" ${pkg} --loglevel=error`, {\n    encoding: 'utf8',\n    timeout: 30000,\n  });\n  const bin = `${tmpDir}/node_modules/.bin/pnpm`;\n  const installed = detectVersion(bin);\n  debug('installed pnpm %s at %s', installed, bin);\n  console.log(`  Auto-installed pnpm ${installed}`);\n  return bin;\n}\n\nfunction resolvePnpmBin(binPath?: string, version?: string): string {\n  if (binPath) return binPath;\n  if (version) return installPnpm(version);\n  return 'pnpm';\n}\n\nexport function createPnpmAdapter(binPath?: string, version?: string): PackageManagerAdapter {\n  const bin = resolvePnpmBin(binPath, version);\n  const resolved = detectVersion(bin);\n  assertSupportedVersion(resolved);\n  debug('creating pnpm adapter with bin: %s (%s)', bin, resolved);\n\n  const adapter: PackageManagerAdapter = {\n    name: `pnpm@${resolved}`,\n    type: 'pnpm',\n    bin,\n    supports: getSupportedCommands(resolved),\n\n    registryArg(url: string): string[] {\n      return ['--registry', url];\n    },\n\n    prefixArg(folder: string): string[] {\n      return ['--prefix', folder];\n    },\n\n    exec(options: SpawnOptions, ...args: string[]): Promise<ExecOutput> {\n      const major = parseInt(resolved.split('.')[0], 10);\n      if (major >= 11) {\n        // pnpm v11: native deprecate/unpublish don't support --json\n        const cmd = args[0];\n        if (cmd === 'deprecate' || cmd === 'unpublish' || cmd === 'publish' || cmd === 'dist-tag') {\n          args = args.filter((a) => a !== '--json' && !a.startsWith('--loglevel'));\n        }\n        // pnpm v11: un-deprecate uses `undeprecate` command instead of `deprecate pkg \"\"`\n        if (cmd === 'deprecate') {\n          // Check if message arg is empty string (un-deprecate)\n          // args: ['deprecate', 'pkg@version', '', ...flags]\n          const msgIdx = 2; // message is the third arg\n          if (args.length > msgIdx && args[msgIdx] === '') {\n            args = ['undeprecate', args[1], ...args.slice(3)];\n          }\n        }\n        // pnpm v11: native version command doesn't accept --registry, --loglevel, or --no--git-tag-version\n        if (cmd === 'version') {\n          args = args.filter(\n            (a) =>\n              !a.startsWith('--registry') &&\n              !a.startsWith('--loglevel') &&\n              !a.startsWith('--no--git-tag-version')\n          );\n        }\n      }\n      return exec(options, bin, args);\n    },\n\n    async prepareProject(\n      packageName: string,\n      version: string,\n      registryUrl: string,\n      port: number,\n      token: string,\n      dependencies: Record<string, string> = {},\n      devDependencies: Record<string, string> = {}\n    ): Promise<{ tempFolder: string }> {\n      const project = await prepareGenericEmptyProject(\n        packageName,\n        version,\n        port,\n        token,\n        registryUrl,\n        dependencies,\n        devDependencies\n      );\n      // pnpm 11.24+ enforces a minimumReleaseAge cooldown by default, which\n      // rejects the just-published packages these tests install\n      // (ERR_PNPM_NO_MATURE_MATCHING_VERSION). Disable it per project via\n      // pnpm-workspace.yaml — the file also marks the temp folder as its own\n      // workspace root, isolating it from any parent workspace. Tests that\n      // exercise the cooldown itself overwrite this file with their own config.\n      await writeFile(join(project.tempFolder, 'pnpm-workspace.yaml'), 'minimumReleaseAge: 0\\n');\n      return project;\n    },\n  };\n\n  return adapter;\n}\n"],"mappings":";;;;;;;;;AASA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,wBAAwB;AAEjD,IAAM,oCAAoB,IAAI,IAAI;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAID,IAAM,oCAAoB,IAAI,IAAI;CAChC;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,qBAAqB,SAA8B;CAC1D,MAAM,QAAQ,SAAS,QAAQ,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE;CAChD,IAAI,SAAS,IAAI;EACf,QAAM,4CAA4C,KAAK;EACvD,OAAO;CACT;CACA,OAAO;AACT;AAGA,IAAM,2BAA2B;AAEjC,SAAS,cAAc,KAAqB;CAC1C,IAAI;EACF,QAAA,GAAO,cAAA,SAAA,CAAS,GAAG,IAAI,aAAa;GAAE,UAAU;GAAQ,SAAS;EAAK,CAAC,CAAC,CAAC,KAAK;CAChF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,uBAAuB,UAAwB;CACtD,MAAM,QAAQ,SAAS,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE;CACjD,IAAI,CAAC,OAAO,MAAM,KAAK,KAAK,QAAQ,0BAClC,MAAM,IAAI,MACR,QAAQ,SAAS,8CAA8C,0BACjE;AAEJ;AAEA,SAAS,YAAY,SAAyB;CAC5C,MAAM,MAAM,QAAQ;CACpB,QAAM,+BAA+B,GAAG;CACxC,MAAM,UAAA,GAAS,cAAA,SAAA,CAAS,aAAa,EAAE,UAAU,OAAO,CAAC,CAAC,CAAC,KAAK;CAChE,CAAA,GAAA,cAAA,SAAA,CAAS,yBAAyB,OAAO,IAAI,IAAI,oBAAoB;EACnE,UAAU;EACV,SAAS;CACX,CAAC;CACD,MAAM,MAAM,GAAG,OAAO;CACtB,MAAM,YAAY,cAAc,GAAG;CACnC,QAAM,2BAA2B,WAAW,GAAG;CAC/C,QAAQ,IAAI,yBAAyB,WAAW;CAChD,OAAO;AACT;AAEA,SAAS,eAAe,SAAkB,SAA0B;CAClE,IAAI,SAAS,OAAO;CACpB,IAAI,SAAS,OAAO,YAAY,OAAO;CACvC,OAAO;AACT;AAEA,SAAgB,kBAAkB,SAAkB,SAAyC;CAC3F,MAAM,MAAM,eAAe,SAAS,OAAO;CAC3C,MAAM,WAAW,cAAc,GAAG;CAClC,uBAAuB,QAAQ;CAC/B,QAAM,2CAA2C,KAAK,QAAQ;CA2E9D,OAAO;EAxEL,MAAM,QAAQ;EACd,MAAM;EACN;EACA,UAAU,qBAAqB,QAAQ;EAEvC,YAAY,KAAuB;GACjC,OAAO,CAAC,cAAc,GAAG;EAC3B;EAEA,UAAU,QAA0B;GAClC,OAAO,CAAC,YAAY,MAAM;EAC5B;EAEA,KAAK,SAAuB,GAAG,MAAqC;GAElE,IADc,SAAS,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,EAC3C,KAAS,IAAI;IAEf,MAAM,MAAM,KAAK;IACjB,IAAI,QAAQ,eAAe,QAAQ,eAAe,QAAQ,aAAa,QAAQ,YAC7E,OAAO,KAAK,QAAQ,MAAM,MAAM,YAAY,CAAC,EAAE,WAAW,YAAY,CAAC;IAGzE,IAAI,QAAQ,aAAa;KAGvB,MAAM,SAAS;KACf,IAAI,KAAK,SAAS,UAAU,KAAK,YAAY,IAC3C,OAAO;MAAC;MAAe,KAAK;MAAI,GAAG,KAAK,MAAM,CAAC;KAAC;IAEpD;IAEA,IAAI,QAAQ,WACV,OAAO,KAAK,QACT,MACC,CAAC,EAAE,WAAW,YAAY,KAC1B,CAAC,EAAE,WAAW,YAAY,KAC1B,CAAC,EAAE,WAAW,uBAAuB,CACzC;GAEJ;GACA,OAAO,gBAAA,KAAK,SAAS,KAAK,IAAI;EAChC;EAEA,MAAM,eACJ,aACA,SACA,aACA,MACA,OACA,eAAuC,CAAC,GACxC,kBAA0C,CAAC,GACV;GACjC,MAAM,UAAU,MAAM,gBAAA,2BACpB,aACA,SACA,MACA,OACA,aACA,cACA,eACF;GAOA,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,QAAQ,YAAY,qBAAqB,GAAG,wBAAwB;GACzF,OAAO;EACT;CAGK;AACT"}
+{"version":3,"file":"pnpm.cjs","names":[],"sources":["../../../src/adapters/pnpm.ts"],"sourcesContent":["import { SpawnOptions, execSync } from 'child_process';\nimport buildDebug from 'debug';\nimport { writeFile } from 'fs/promises';\nimport { join } from 'path';\n\nimport { ExecOutput, PackageManagerAdapter } from '../types';\nimport { exec } from '../utils/process';\nimport { prepareGenericEmptyProject } from '../utils/project';\n\nconst debug = buildDebug('verdaccio:e2e-cli:pnpm');\n\n// pnpm removed ping and search; the dist-tag output changed (no --json) and needs adapted assertions\nconst PNPM_COMMANDS = new Set(['publish', 'unpublish', 'install', 'info', 'audit', 'deprecate']);\n\n// pnpm 8, 9 and 10 are no longer supported by the suite.\nconst PNPM_MIN_SUPPORTED_MAJOR = 11;\n\nfunction detectVersion(bin: string): string {\n  try {\n    return execSync(`${bin} --version`, { encoding: 'utf8', timeout: 5000 }).trim();\n  } catch {\n    return 'unknown';\n  }\n}\n\nfunction assertSupportedVersion(resolved: string): void {\n  const major = parseInt(resolved.split('.')[0], 10);\n  if (!Number.isNaN(major) && major < PNPM_MIN_SUPPORTED_MAJOR) {\n    throw new Error(\n      `pnpm@${resolved} is not supported. Minimum supported major: ${PNPM_MIN_SUPPORTED_MAJOR}`\n    );\n  }\n}\n\nfunction installPnpm(version: string): string {\n  const pkg = `pnpm@${version}`;\n  debug('installing %s into temp dir', pkg);\n  const tmpDir = execSync('mktemp -d', { encoding: 'utf8' }).trim();\n  execSync(`npm install --prefix \"${tmpDir}\" ${pkg} --loglevel=error`, {\n    encoding: 'utf8',\n    timeout: 30000,\n  });\n  const bin = `${tmpDir}/node_modules/.bin/pnpm`;\n  const installed = detectVersion(bin);\n  debug('installed pnpm %s at %s', installed, bin);\n  console.log(`  Auto-installed pnpm ${installed}`);\n  return bin;\n}\n\nfunction resolvePnpmBin(binPath?: string, version?: string): string {\n  if (binPath) return binPath;\n  if (version) return installPnpm(version);\n  return 'pnpm';\n}\n\nexport function createPnpmAdapter(binPath?: string, version?: string): PackageManagerAdapter {\n  const bin = resolvePnpmBin(binPath, version);\n  const resolved = detectVersion(bin);\n  assertSupportedVersion(resolved);\n  debug('creating pnpm adapter with bin: %s (%s)', bin, resolved);\n\n  const adapter: PackageManagerAdapter = {\n    name: `pnpm@${resolved}`,\n    type: 'pnpm',\n    bin,\n    supports: PNPM_COMMANDS,\n\n    registryArg(url: string): string[] {\n      return ['--registry', url];\n    },\n\n    prefixArg(folder: string): string[] {\n      return ['--prefix', folder];\n    },\n\n    exec(options: SpawnOptions, ...args: string[]): Promise<ExecOutput> {\n      const major = parseInt(resolved.split('.')[0], 10);\n      if (major >= 11) {\n        // pnpm v11: native deprecate/unpublish don't support --json\n        const cmd = args[0];\n        if (cmd === 'deprecate' || cmd === 'unpublish' || cmd === 'publish' || cmd === 'dist-tag') {\n          args = args.filter((a) => a !== '--json' && !a.startsWith('--loglevel'));\n        }\n        // pnpm v11: un-deprecate uses `undeprecate` command instead of `deprecate pkg \"\"`\n        if (cmd === 'deprecate') {\n          // Check if message arg is empty string (un-deprecate)\n          // args: ['deprecate', 'pkg@version', '', ...flags]\n          const msgIdx = 2; // message is the third arg\n          if (args.length > msgIdx && args[msgIdx] === '') {\n            args = ['undeprecate', args[1], ...args.slice(3)];\n          }\n        }\n        // pnpm v11: native version command doesn't accept --registry, --loglevel, or --no--git-tag-version\n        if (cmd === 'version') {\n          args = args.filter(\n            (a) =>\n              !a.startsWith('--registry') &&\n              !a.startsWith('--loglevel') &&\n              !a.startsWith('--no--git-tag-version')\n          );\n        }\n      }\n      return exec(options, bin, args);\n    },\n\n    async prepareProject(\n      packageName: string,\n      version: string,\n      registryUrl: string,\n      port: number,\n      token: string,\n      dependencies: Record<string, string> = {},\n      devDependencies: Record<string, string> = {}\n    ): Promise<{ tempFolder: string }> {\n      const project = await prepareGenericEmptyProject(\n        packageName,\n        version,\n        port,\n        token,\n        registryUrl,\n        dependencies,\n        devDependencies\n      );\n      // pnpm 11.24+ enforces a minimumReleaseAge cooldown by default, which\n      // rejects the just-published packages these tests install\n      // (ERR_PNPM_NO_MATURE_MATCHING_VERSION). Disable it per project via\n      // pnpm-workspace.yaml — the file also marks the temp folder as its own\n      // workspace root, isolating it from any parent workspace. Tests that\n      // exercise the cooldown itself overwrite this file with their own config.\n      await writeFile(join(project.tempFolder, 'pnpm-workspace.yaml'), 'minimumReleaseAge: 0\\n');\n      return project;\n    },\n  };\n\n  return adapter;\n}\n"],"mappings":";;;;;;;;;AASA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,wBAAwB;AAGjD,IAAM,gCAAgB,IAAI,IAAI;CAAC;CAAW;CAAa;CAAW;CAAQ;CAAS;AAAW,CAAC;AAG/F,IAAM,2BAA2B;AAEjC,SAAS,cAAc,KAAqB;CAC1C,IAAI;EACF,QAAA,GAAO,cAAA,SAAA,CAAS,GAAG,IAAI,aAAa;GAAE,UAAU;GAAQ,SAAS;EAAK,CAAC,CAAC,CAAC,KAAK;CAChF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,uBAAuB,UAAwB;CACtD,MAAM,QAAQ,SAAS,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE;CACjD,IAAI,CAAC,OAAO,MAAM,KAAK,KAAK,QAAQ,0BAClC,MAAM,IAAI,MACR,QAAQ,SAAS,8CAA8C,0BACjE;AAEJ;AAEA,SAAS,YAAY,SAAyB;CAC5C,MAAM,MAAM,QAAQ;CACpB,QAAM,+BAA+B,GAAG;CACxC,MAAM,UAAA,GAAS,cAAA,SAAA,CAAS,aAAa,EAAE,UAAU,OAAO,CAAC,CAAC,CAAC,KAAK;CAChE,CAAA,GAAA,cAAA,SAAA,CAAS,yBAAyB,OAAO,IAAI,IAAI,oBAAoB;EACnE,UAAU;EACV,SAAS;CACX,CAAC;CACD,MAAM,MAAM,GAAG,OAAO;CACtB,MAAM,YAAY,cAAc,GAAG;CACnC,QAAM,2BAA2B,WAAW,GAAG;CAC/C,QAAQ,IAAI,yBAAyB,WAAW;CAChD,OAAO;AACT;AAEA,SAAS,eAAe,SAAkB,SAA0B;CAClE,IAAI,SAAS,OAAO;CACpB,IAAI,SAAS,OAAO,YAAY,OAAO;CACvC,OAAO;AACT;AAEA,SAAgB,kBAAkB,SAAkB,SAAyC;CAC3F,MAAM,MAAM,eAAe,SAAS,OAAO;CAC3C,MAAM,WAAW,cAAc,GAAG;CAClC,uBAAuB,QAAQ;CAC/B,QAAM,2CAA2C,KAAK,QAAQ;CA2E9D,OAAO;EAxEL,MAAM,QAAQ;EACd,MAAM;EACN;EACA,UAAU;EAEV,YAAY,KAAuB;GACjC,OAAO,CAAC,cAAc,GAAG;EAC3B;EAEA,UAAU,QAA0B;GAClC,OAAO,CAAC,YAAY,MAAM;EAC5B;EAEA,KAAK,SAAuB,GAAG,MAAqC;GAElE,IADc,SAAS,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,EAC3C,KAAS,IAAI;IAEf,MAAM,MAAM,KAAK;IACjB,IAAI,QAAQ,eAAe,QAAQ,eAAe,QAAQ,aAAa,QAAQ,YAC7E,OAAO,KAAK,QAAQ,MAAM,MAAM,YAAY,CAAC,EAAE,WAAW,YAAY,CAAC;IAGzE,IAAI,QAAQ,aAAa;KAGvB,MAAM,SAAS;KACf,IAAI,KAAK,SAAS,UAAU,KAAK,YAAY,IAC3C,OAAO;MAAC;MAAe,KAAK;MAAI,GAAG,KAAK,MAAM,CAAC;KAAC;IAEpD;IAEA,IAAI,QAAQ,WACV,OAAO,KAAK,QACT,MACC,CAAC,EAAE,WAAW,YAAY,KAC1B,CAAC,EAAE,WAAW,YAAY,KAC1B,CAAC,EAAE,WAAW,uBAAuB,CACzC;GAEJ;GACA,OAAO,gBAAA,KAAK,SAAS,KAAK,IAAI;EAChC;EAEA,MAAM,eACJ,aACA,SACA,aACA,MACA,OACA,eAAuC,CAAC,GACxC,kBAA0C,CAAC,GACV;GACjC,MAAM,UAAU,MAAM,gBAAA,2BACpB,aACA,SACA,MACA,OACA,aACA,cACA,eACF;GAOA,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,QAAQ,YAAY,qBAAqB,GAAG,wBAAwB;GACzF,OAAO;EACT;CAGK;AACT"}

package/build/cjs/index.cjs

@@ -9,9 +9,10 @@ const require_upm = require("./adapters/upm.cjs");
 const require_yarn_modern = require("./adapters/yarn-modern.cjs");
 require("./adapters/index.cjs");
 const require_runner = require("./runner.cjs");
+const require_http_client = require("./utils/http-client.cjs");
 const require_index$1 = require("./scenarios/index.cjs");
-const require_index$2 = require("./tests/index.cjs");
 const require_registry_client = require("./utils/registry-client.cjs");
+const require_index$2 = require("./tests/index.cjs");
 let debug = require("debug");
 debug = require_runtime.__toESM(debug, 1);
 //#region src/index.ts
@@ -165,6 +166,7 @@ async function main(argv = process.argv) {
 		printHelp();
 		process.exit(1);
 	}
+	options.registry = require_http_client.stripTrailingSlashes(options.registry);
 	const { createTempFolder } = await Promise.resolve().then(() => require("./utils/project.cjs"));
 	const runDir = await createTempFolder("e2e-run");
 	process.chdir(runDir);

package/build/cjs/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":[],"sources":["../../src/index.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport {\n  createBunAdapter,\n  createDenoAdapter,\n  createNpmAdapter,\n  createNubAdapter,\n  createPnpmAdapter,\n  createUpmAdapter,\n  createYarnModernAdapter,\n} from './adapters';\nimport { runAll } from './runner';\nimport { allTests } from './tests';\nimport { CliOptions, PackageManagerAdapter } from './types';\nimport { createUser, pingRegistry } from './utils/registry-client';\n\nconst debug = buildDebug('verdaccio:e2e-cli');\n\nfunction parsePmSpec(filter: string): { name: string; version?: string; binPath?: string } {\n  // --pm yarn-modern@3, --pm npm@10, --pm npm=/path/to/bin\n  const eqIdx = filter.indexOf('=');\n  if (eqIdx !== -1) {\n    return { name: filter.slice(0, eqIdx).toLowerCase(), binPath: filter.slice(eqIdx + 1) };\n  }\n  const atIdx = filter.indexOf('@');\n  if (atIdx !== -1) {\n    return { name: filter.slice(0, atIdx).toLowerCase(), version: filter.slice(atIdx + 1) };\n  }\n  return { name: filter.toLowerCase() };\n}\n\nfunction parseAdapters(pmFilters?: string[]): PackageManagerAdapter[] {\n  if (!pmFilters || pmFilters.length === 0) {\n    return [createNpmAdapter()];\n  }\n\n  const adapters: PackageManagerAdapter[] = [];\n\n  for (const filter of pmFilters) {\n    const { name, version, binPath } = parsePmSpec(filter);\n\n    if (name === 'npm') {\n      adapters.push(createNpmAdapter(binPath, version));\n    } else if (name === 'pnpm') {\n      adapters.push(createPnpmAdapter(binPath, version));\n    } else if (name === 'yarn-classic' || name === 'yarn1') {\n      throw new Error(\n        'yarn classic (v1) is no longer supported. Use yarn-modern (Yarn 3+) instead.'\n      );\n    } else if (name === 'yarn-modern' || name === 'yarn') {\n      adapters.push(createYarnModernAdapter(binPath, version));\n    } else if (name === 'bun') {\n      adapters.push(createBunAdapter(binPath, version));\n    } else if (name === 'deno') {\n      adapters.push(createDenoAdapter(binPath, version));\n    } else if (name === 'upm') {\n      adapters.push(createUpmAdapter(binPath, version));\n    } else if (name === 'nub') {\n      adapters.push(createNubAdapter(binPath, version));\n    } else {\n      throw new Error(\n        `Unknown package manager: \"${name}\". Supported: npm, pnpm, yarn-modern, bun, deno, upm, nub`\n      );\n    }\n  }\n\n  return adapters;\n}\n\nfunction parseArgs(argv: string[]): CliOptions {\n  const options: CliOptions = {\n    registry: '',\n    pm: [],\n    test: [],\n    skipTest: [],\n    concurrency: 1,\n    timeout: 50000,\n    verbose: false,\n  };\n\n  for (let i = 2; i < argv.length; i++) {\n    const arg = argv[i];\n\n    if (arg === '--registry' || arg === '-r') {\n      options.registry = argv[++i];\n    } else if (arg === '--pm') {\n      options.pm!.push(argv[++i]);\n    } else if (arg === '--test' || arg === '-t') {\n      options.test!.push(argv[++i]);\n    } else if (arg === '--concurrency' || arg === '-c') {\n      options.concurrency = parseInt(argv[++i], 10);\n    } else if (arg === '--timeout') {\n      options.timeout = parseInt(argv[++i], 10);\n    } else if (arg === '--token') {\n      options.token = argv[++i];\n    } else if (arg === '--uplink-port') {\n      options.uplinkPort = parseInt(argv[++i], 10);\n    } else if (arg === '--print-config') {\n      options.printConfig = true;\n    } else if (arg === '--server') {\n      options.server = argv[++i];\n    } else if (arg.startsWith('--server=')) {\n      options.server = arg.split('=')[1];\n    } else if (arg === '--skip-test') {\n      options.skipTest!.push(argv[++i]);\n    } else if (arg.startsWith('--skip-test=')) {\n      options.skipTest!.push(arg.split('=')[1]);\n    } else if (arg === '--verbose' || arg === '-v') {\n      options.verbose = true;\n    } else if (arg === '--help' || arg === '-h') {\n      printHelp();\n      process.exit(0);\n    } else if (arg.startsWith('--registry=')) {\n      options.registry = arg.split('=')[1];\n    } else if (arg.startsWith('--pm=')) {\n      options.pm!.push(arg.split('=')[1]);\n    } else if (arg.startsWith('--test=')) {\n      options.test!.push(arg.split('=')[1]);\n    } else if (arg.startsWith('--token=')) {\n      options.token = arg.split('=')[1];\n    } else if (arg.startsWith('--timeout=')) {\n      options.timeout = parseInt(arg.split('=')[1], 10);\n    } else if (arg.startsWith('--uplink-port=')) {\n      options.uplinkPort = parseInt(arg.split('=')[1], 10);\n    } else {\n      console.error(`Unknown argument: ${arg}`);\n      printHelp();\n      process.exit(1);\n    }\n  }\n\n  return options;\n}\n\nfunction printHelp(): void {\n  console.log(`\n  @verdaccio/e2e-cli - Run Verdaccio e2e tests against any running registry\n\n  Usage:\n    verdaccio-e2e --registry <url> [options]\n\n  Required:\n    -r, --registry <url>    Verdaccio registry URL (e.g. http://localhost:4873)\n\n  Options:\n    --pm <name[@version]>   Package manager to test (can be repeated)\n                            Supported: npm (10-12), pnpm (10+),\n                                       yarn-modern (or yarn, Yarn 3+), bun, deno,\n                                       upm (install/ci only), nub (install/ci only)\n                            Examples: --pm npm@10 --pm pnpm@11\n                                      --pm yarn-modern@4\n                                      --pm yarn-modern@3\n                                      --pm bun\n                                      --pm npm --pm pnpm  (uses system version)\n                            Auto-installs the requested yarn version if needed\n                            Default: npm\n\n    -t, --test <name>       Filter tests by name (can be repeated)\n                            Available: publish, install, ci, audit, info, deprecate,\n                                       dist-tags, ping, search, unpublish\n                            Scenarios: scenario:install-multiple-deps,\n                                       scenario:minimum-release-age (pnpm 11.1+),\n                                       scenario:tarballs (npm adapter),\n                                       scenario:metadata (npm adapter),\n                                       scenario:search (npm adapter; the\n                                         uplink sub-tests also need\n                                         --uplink-port / E2E_UPLINK_PORT),\n                                       scenario:uplink-failure (npm adapter,\n                                         needs --uplink-port / E2E_UPLINK_PORT\n                                         and a registry started with the config\n                                         from --print-config)\n                            Default: all supported by the PM\n\n    --skip-test <name>      Skip a test by name (can be repeated). Unlike\n                            --test, the rest of the battery still runs and\n                            the skipped tests are reported as SKIP\n\n    --token <token>         Auth token (skips user creation)\n    --timeout <ms>          Per-test timeout (default: 50000)\n    --uplink-port <port>    Port for the mock uplink used by\n                            scenario:uplink-failure (default: $E2E_UPLINK_PORT)\n    --print-config          Print the recommended registry config for the full\n                            battery (max_body_size, mock uplink) and exit\n    --server <name>         Registry server the printed config targets:\n                            verdaccio (default) or pnpr. pnpr's config has no\n                            mock uplink (its registry namespaces can't claim\n                            the unscoped dynamic e2e-uplink-* names), so run\n                            it without --uplink-port and the uplink tests skip\n    -v, --verbose           Enable debug output\n    -h, --help              Show this help\n  `);\n}\n\nexport async function main(argv: string[] = process.argv): Promise<void> {\n  const options = parseArgs(argv);\n\n  if (options.printConfig) {\n    const { buildE2EConfig, buildPnprE2EConfig, DEFAULT_UPLINK_PORT } =\n      await import('./utils/e2e-config');\n    const server = options.server ?? 'verdaccio';\n    if (server === 'pnpr') {\n      process.stdout.write(buildPnprE2EConfig());\n    } else if (server === 'verdaccio') {\n      process.stdout.write(buildE2EConfig(options.uplinkPort ?? DEFAULT_UPLINK_PORT));\n    } else {\n      console.error(`Unknown --server: \"${server}\". Supported: verdaccio, pnpr`);\n      process.exit(1);\n    }\n    process.exit(0);\n  }\n\n  // Expose the mock uplink port to scenarios (scenario:uplink-failure gates on it).\n  if (options.uplinkPort) {\n    process.env.E2E_UPLINK_PORT = String(options.uplinkPort);\n  }\n\n  if (!options.registry) {\n    console.error('Error: --registry is required\\n');\n    printHelp();\n    process.exit(1);\n  }\n\n  // Run from a temp dir to isolate from the host project's packageManager, .yarnrc.yml, etc.\n  const { createTempFolder } = await import('./utils/project');\n  const runDir = await createTempFolder('e2e-run');\n  process.chdir(runDir);\n\n  if (options.verbose) {\n    const { setVerbose } = await import('./utils/process');\n    setVerbose(true);\n  }\n\n  // Ensure registry is reachable\n  console.log(`Checking registry at ${options.registry}...`);\n  const alive = await pingRegistry(options.registry);\n  if (!alive) {\n    console.error(`Error: Registry at ${options.registry} is not reachable`);\n    process.exit(1);\n  }\n  console.log(`Registry is alive.`);\n\n  // Get auth token\n  let token = options.token;\n  if (!token) {\n    console.log('Creating test user...');\n    const auth = await createUser(options.registry);\n    token = auth.token;\n    console.log(`User \"${auth.user}\" created.`);\n  }\n\n  // Build adapter list\n  const adapters = parseAdapters(options.pm);\n  console.log(`Adapters: ${adapters.map((a) => a.name).join(', ')}`);\n\n  // Filter tests\n  const tests =\n    options.test && options.test.length > 0\n      ? allTests.filter((t) => options.test!.includes(t.name))\n      : allTests;\n\n  console.log(`Tests: ${tests.map((t) => t.name).join(', ')}`);\n\n  if (options.skipTest && options.skipTest.length > 0) {\n    console.log(`Skipping tests: ${options.skipTest.join(', ')}`);\n  }\n\n  // Run\n  const { exitCode } = await runAll(adapters, tests, options.registry, token, {\n    timeout: options.timeout,\n    concurrency: options.concurrency,\n    testFilter: options.test,\n    skipTests: options.skipTest,\n  });\n\n  process.exit(exitCode);\n}\n\n// Re-export for programmatic usage\nexport { allTests } from './tests';\nexport { allScenarios } from './scenarios';\nexport {\n  createBunAdapter,\n  createDenoAdapter,\n  createNpmAdapter,\n  createNubAdapter,\n  createPnpmAdapter,\n  createUpmAdapter,\n  createYarnModernAdapter,\n} from './adapters';\nexport { runAll, runSuite } from './runner';\nexport type { PackageManagerAdapter, TestDefinition, TestContext, CliOptions } from './types';\n"],"mappings":";;;;;;;;;;;;;;;;;CAgBc,GAAA,MAAA,QAAA,CAAW,mBAAmB;AAE5C,SAAS,YAAY,QAAsE;CAEzF,MAAM,QAAQ,OAAO,QAAQ,GAAG;CAChC,IAAI,UAAU,IACZ,OAAO;EAAE,MAAM,OAAO,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY;EAAG,SAAS,OAAO,MAAM,QAAQ,CAAC;CAAE;CAExF,MAAM,QAAQ,OAAO,QAAQ,GAAG;CAChC,IAAI,UAAU,IACZ,OAAO;EAAE,MAAM,OAAO,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY;EAAG,SAAS,OAAO,MAAM,QAAQ,CAAC;CAAE;CAExF,OAAO,EAAE,MAAM,OAAO,YAAY,EAAE;AACtC;AAEA,SAAS,cAAc,WAA+C;CACpE,IAAI,CAAC,aAAa,UAAU,WAAW,GACrC,OAAO,CAAC,YAAA,iBAAiB,CAAC;CAG5B,MAAM,WAAoC,CAAC;CAE3C,KAAK,MAAM,UAAU,WAAW;EAC9B,MAAM,EAAE,MAAM,SAAS,YAAY,YAAY,MAAM;EAErD,IAAI,SAAS,OACX,SAAS,KAAK,YAAA,iBAAiB,SAAS,OAAO,CAAC;OAC3C,IAAI,SAAS,QAClB,SAAS,KAAK,aAAA,kBAAkB,SAAS,OAAO,CAAC;OAC5C,IAAI,SAAS,kBAAkB,SAAS,SAC7C,MAAM,IAAI,MACR,8EACF;OACK,IAAI,SAAS,iBAAiB,SAAS,QAC5C,SAAS,KAAK,oBAAA,wBAAwB,SAAS,OAAO,CAAC;OAClD,IAAI,SAAS,OAClB,SAAS,KAAK,YAAA,iBAAiB,SAAS,OAAO,CAAC;OAC3C,IAAI,SAAS,QAClB,SAAS,KAAK,aAAA,kBAAkB,SAAS,OAAO,CAAC;OAC5C,IAAI,SAAS,OAClB,SAAS,KAAK,YAAA,iBAAiB,SAAS,OAAO,CAAC;OAC3C,IAAI,SAAS,OAClB,SAAS,KAAK,YAAA,iBAAiB,SAAS,OAAO,CAAC;OAEhD,MAAM,IAAI,MACR,6BAA6B,KAAK,0DACpC;CAEJ;CAEA,OAAO;AACT;AAEA,SAAS,UAAU,MAA4B;CAC7C,MAAM,UAAsB;EAC1B,UAAU;EACV,IAAI,CAAC;EACL,MAAM,CAAC;EACP,UAAU,CAAC;EACX,aAAa;EACb,SAAS;EACT,SAAS;CACX;CAEA,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;EACpC,MAAM,MAAM,KAAK;EAEjB,IAAI,QAAQ,gBAAgB,QAAQ,MAClC,QAAQ,WAAW,KAAK,EAAE;OACrB,IAAI,QAAQ,QACjB,QAAQ,GAAI,KAAK,KAAK,EAAE,EAAE;OACrB,IAAI,QAAQ,YAAY,QAAQ,MACrC,QAAQ,KAAM,KAAK,KAAK,EAAE,EAAE;OACvB,IAAI,QAAQ,mBAAmB,QAAQ,MAC5C,QAAQ,cAAc,SAAS,KAAK,EAAE,IAAI,EAAE;OACvC,IAAI,QAAQ,aACjB,QAAQ,UAAU,SAAS,KAAK,EAAE,IAAI,EAAE;OACnC,IAAI,QAAQ,WACjB,QAAQ,QAAQ,KAAK,EAAE;OAClB,IAAI,QAAQ,iBACjB,QAAQ,aAAa,SAAS,KAAK,EAAE,IAAI,EAAE;OACtC,IAAI,QAAQ,kBACjB,QAAQ,cAAc;OACjB,IAAI,QAAQ,YACjB,QAAQ,SAAS,KAAK,EAAE;OACnB,IAAI,IAAI,WAAW,WAAW,GACnC,QAAQ,SAAS,IAAI,MAAM,GAAG,CAAC,CAAC;OAC3B,IAAI,QAAQ,eACjB,QAAQ,SAAU,KAAK,KAAK,EAAE,EAAE;OAC3B,IAAI,IAAI,WAAW,cAAc,GACtC,QAAQ,SAAU,KAAK,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE;OACnC,IAAI,QAAQ,eAAe,QAAQ,MACxC,QAAQ,UAAU;OACb,IAAI,QAAQ,YAAY,QAAQ,MAAM;GAC3C,UAAU;GACV,QAAQ,KAAK,CAAC;EAChB,OAAO,IAAI,IAAI,WAAW,aAAa,GACrC,QAAQ,WAAW,IAAI,MAAM,GAAG,CAAC,CAAC;OAC7B,IAAI,IAAI,WAAW,OAAO,GAC/B,QAAQ,GAAI,KAAK,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE;OAC7B,IAAI,IAAI,WAAW,SAAS,GACjC,QAAQ,KAAM,KAAK,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE;OAC/B,IAAI,IAAI,WAAW,UAAU,GAClC,QAAQ,QAAQ,IAAI,MAAM,GAAG,CAAC,CAAC;OAC1B,IAAI,IAAI,WAAW,YAAY,GACpC,QAAQ,UAAU,SAAS,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE;OAC3C,IAAI,IAAI,WAAW,gBAAgB,GACxC,QAAQ,aAAa,SAAS,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE;OAC9C;GACL,QAAQ,MAAM,qBAAqB,KAAK;GACxC,UAAU;GACV,QAAQ,KAAK,CAAC;EAChB;CACF;CAEA,OAAO;AACT;AAEA,SAAS,YAAkB;CACzB,QAAQ,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDX;AACH;AAEA,eAAsB,KAAK,OAAiB,QAAQ,MAAqB;CACvE,MAAM,UAAU,UAAU,IAAI;CAE9B,IAAI,QAAQ,aAAa;EACvB,MAAM,EAAE,gBAAgB,oBAAoB,wBAC1C,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,wBAAA,CAAA;EACR,MAAM,SAAS,QAAQ,UAAU;EACjC,IAAI,WAAW,QACb,QAAQ,OAAO,MAAM,mBAAmB,CAAC;OACpC,IAAI,WAAW,aACpB,QAAQ,OAAO,MAAM,eAAe,QAAQ,cAAc,mBAAmB,CAAC;OACzE;GACL,QAAQ,MAAM,sBAAsB,OAAO,8BAA8B;GACzE,QAAQ,KAAK,CAAC;EAChB;EACA,QAAQ,KAAK,CAAC;CAChB;CAGA,IAAI,QAAQ,YACV,QAAQ,IAAI,kBAAkB,OAAO,QAAQ,UAAU;CAGzD,IAAI,CAAC,QAAQ,UAAU;EACrB,QAAQ,MAAM,iCAAiC;EAC/C,UAAU;EACV,QAAQ,KAAK,CAAC;CAChB;CAGA,MAAM,EAAE,qBAAqB,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,qBAAA,CAAA;CACnC,MAAM,SAAS,MAAM,iBAAiB,SAAS;CAC/C,QAAQ,MAAM,MAAM;CAEpB,IAAI,QAAQ,SAAS;EACnB,MAAM,EAAE,eAAe,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,qBAAA,CAAA;EAC7B,WAAW,IAAI;CACjB;CAGA,QAAQ,IAAI,wBAAwB,QAAQ,SAAS,IAAI;CAEzD,IAAI,CAAC,MADe,wBAAA,aAAa,QAAQ,QAAQ,GACrC;EACV,QAAQ,MAAM,sBAAsB,QAAQ,SAAS,kBAAkB;EACvE,QAAQ,KAAK,CAAC;CAChB;CACA,QAAQ,IAAI,oBAAoB;CAGhC,IAAI,QAAQ,QAAQ;CACpB,IAAI,CAAC,OAAO;EACV,QAAQ,IAAI,uBAAuB;EACnC,MAAM,OAAO,MAAM,wBAAA,WAAW,QAAQ,QAAQ;EAC9C,QAAQ,KAAK;EACb,QAAQ,IAAI,SAAS,KAAK,KAAK,WAAW;CAC5C;CAGA,MAAM,WAAW,cAAc,QAAQ,EAAE;CACzC,QAAQ,IAAI,aAAa,SAAS,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG;CAGjE,MAAM,QACJ,QAAQ,QAAQ,QAAQ,KAAK,SAAS,IAClC,gBAAA,SAAS,QAAQ,MAAM,QAAQ,KAAM,SAAS,EAAE,IAAI,CAAC,IACrD,gBAAA;CAEN,QAAQ,IAAI,UAAU,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG;CAE3D,IAAI,QAAQ,YAAY,QAAQ,SAAS,SAAS,GAChD,QAAQ,IAAI,mBAAmB,QAAQ,SAAS,KAAK,IAAI,GAAG;CAI9D,MAAM,EAAE,aAAa,MAAM,eAAA,OAAO,UAAU,OAAO,QAAQ,UAAU,OAAO;EAC1E,SAAS,QAAQ;EACjB,aAAa,QAAQ;EACrB,YAAY,QAAQ;EACpB,WAAW,QAAQ;CACrB,CAAC;CAED,QAAQ,KAAK,QAAQ;AACvB"}
+{"version":3,"file":"index.cjs","names":[],"sources":["../../src/index.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport {\n  createBunAdapter,\n  createDenoAdapter,\n  createNpmAdapter,\n  createNubAdapter,\n  createPnpmAdapter,\n  createUpmAdapter,\n  createYarnModernAdapter,\n} from './adapters';\nimport { runAll } from './runner';\nimport { allTests } from './tests';\nimport { CliOptions, PackageManagerAdapter } from './types';\nimport { stripTrailingSlashes } from './utils/http-client';\nimport { createUser, pingRegistry } from './utils/registry-client';\n\nconst debug = buildDebug('verdaccio:e2e-cli');\n\nfunction parsePmSpec(filter: string): { name: string; version?: string; binPath?: string } {\n  // --pm yarn-modern@3, --pm npm@10, --pm npm=/path/to/bin\n  const eqIdx = filter.indexOf('=');\n  if (eqIdx !== -1) {\n    return { name: filter.slice(0, eqIdx).toLowerCase(), binPath: filter.slice(eqIdx + 1) };\n  }\n  const atIdx = filter.indexOf('@');\n  if (atIdx !== -1) {\n    return { name: filter.slice(0, atIdx).toLowerCase(), version: filter.slice(atIdx + 1) };\n  }\n  return { name: filter.toLowerCase() };\n}\n\nfunction parseAdapters(pmFilters?: string[]): PackageManagerAdapter[] {\n  if (!pmFilters || pmFilters.length === 0) {\n    return [createNpmAdapter()];\n  }\n\n  const adapters: PackageManagerAdapter[] = [];\n\n  for (const filter of pmFilters) {\n    const { name, version, binPath } = parsePmSpec(filter);\n\n    if (name === 'npm') {\n      adapters.push(createNpmAdapter(binPath, version));\n    } else if (name === 'pnpm') {\n      adapters.push(createPnpmAdapter(binPath, version));\n    } else if (name === 'yarn-classic' || name === 'yarn1') {\n      throw new Error(\n        'yarn classic (v1) is no longer supported. Use yarn-modern (Yarn 3+) instead.'\n      );\n    } else if (name === 'yarn-modern' || name === 'yarn') {\n      adapters.push(createYarnModernAdapter(binPath, version));\n    } else if (name === 'bun') {\n      adapters.push(createBunAdapter(binPath, version));\n    } else if (name === 'deno') {\n      adapters.push(createDenoAdapter(binPath, version));\n    } else if (name === 'upm') {\n      adapters.push(createUpmAdapter(binPath, version));\n    } else if (name === 'nub') {\n      adapters.push(createNubAdapter(binPath, version));\n    } else {\n      throw new Error(\n        `Unknown package manager: \"${name}\". Supported: npm, pnpm, yarn-modern, bun, deno, upm, nub`\n      );\n    }\n  }\n\n  return adapters;\n}\n\nfunction parseArgs(argv: string[]): CliOptions {\n  const options: CliOptions = {\n    registry: '',\n    pm: [],\n    test: [],\n    skipTest: [],\n    concurrency: 1,\n    timeout: 50000,\n    verbose: false,\n  };\n\n  for (let i = 2; i < argv.length; i++) {\n    const arg = argv[i];\n\n    if (arg === '--registry' || arg === '-r') {\n      options.registry = argv[++i];\n    } else if (arg === '--pm') {\n      options.pm!.push(argv[++i]);\n    } else if (arg === '--test' || arg === '-t') {\n      options.test!.push(argv[++i]);\n    } else if (arg === '--concurrency' || arg === '-c') {\n      options.concurrency = parseInt(argv[++i], 10);\n    } else if (arg === '--timeout') {\n      options.timeout = parseInt(argv[++i], 10);\n    } else if (arg === '--token') {\n      options.token = argv[++i];\n    } else if (arg === '--uplink-port') {\n      options.uplinkPort = parseInt(argv[++i], 10);\n    } else if (arg === '--print-config') {\n      options.printConfig = true;\n    } else if (arg === '--server') {\n      options.server = argv[++i];\n    } else if (arg.startsWith('--server=')) {\n      options.server = arg.split('=')[1];\n    } else if (arg === '--skip-test') {\n      options.skipTest!.push(argv[++i]);\n    } else if (arg.startsWith('--skip-test=')) {\n      options.skipTest!.push(arg.split('=')[1]);\n    } else if (arg === '--verbose' || arg === '-v') {\n      options.verbose = true;\n    } else if (arg === '--help' || arg === '-h') {\n      printHelp();\n      process.exit(0);\n    } else if (arg.startsWith('--registry=')) {\n      options.registry = arg.split('=')[1];\n    } else if (arg.startsWith('--pm=')) {\n      options.pm!.push(arg.split('=')[1]);\n    } else if (arg.startsWith('--test=')) {\n      options.test!.push(arg.split('=')[1]);\n    } else if (arg.startsWith('--token=')) {\n      options.token = arg.split('=')[1];\n    } else if (arg.startsWith('--timeout=')) {\n      options.timeout = parseInt(arg.split('=')[1], 10);\n    } else if (arg.startsWith('--uplink-port=')) {\n      options.uplinkPort = parseInt(arg.split('=')[1], 10);\n    } else {\n      console.error(`Unknown argument: ${arg}`);\n      printHelp();\n      process.exit(1);\n    }\n  }\n\n  return options;\n}\n\nfunction printHelp(): void {\n  console.log(`\n  @verdaccio/e2e-cli - Run Verdaccio e2e tests against any running registry\n\n  Usage:\n    verdaccio-e2e --registry <url> [options]\n\n  Required:\n    -r, --registry <url>    Verdaccio registry URL (e.g. http://localhost:4873)\n\n  Options:\n    --pm <name[@version]>   Package manager to test (can be repeated)\n                            Supported: npm (10-12), pnpm (10+),\n                                       yarn-modern (or yarn, Yarn 3+), bun, deno,\n                                       upm (install/ci only), nub (install/ci only)\n                            Examples: --pm npm@10 --pm pnpm@11\n                                      --pm yarn-modern@4\n                                      --pm yarn-modern@3\n                                      --pm bun\n                                      --pm npm --pm pnpm  (uses system version)\n                            Auto-installs the requested yarn version if needed\n                            Default: npm\n\n    -t, --test <name>       Filter tests by name (can be repeated)\n                            Available: publish, install, ci, audit, info, deprecate,\n                                       dist-tags, ping, search, unpublish\n                            Scenarios: scenario:install-multiple-deps,\n                                       scenario:minimum-release-age (pnpm 11.1+),\n                                       scenario:tarballs (npm adapter),\n                                       scenario:metadata (npm adapter),\n                                       scenario:search (npm adapter; the\n                                         uplink sub-tests also need\n                                         --uplink-port / E2E_UPLINK_PORT),\n                                       scenario:uplink-failure (npm adapter,\n                                         needs --uplink-port / E2E_UPLINK_PORT\n                                         and a registry started with the config\n                                         from --print-config)\n                            Default: all supported by the PM\n\n    --skip-test <name>      Skip a test by name (can be repeated). Unlike\n                            --test, the rest of the battery still runs and\n                            the skipped tests are reported as SKIP\n\n    --token <token>         Auth token (skips user creation)\n    --timeout <ms>          Per-test timeout (default: 50000)\n    --uplink-port <port>    Port for the mock uplink used by\n                            scenario:uplink-failure (default: $E2E_UPLINK_PORT)\n    --print-config          Print the recommended registry config for the full\n                            battery (max_body_size, mock uplink) and exit\n    --server <name>         Registry server the printed config targets:\n                            verdaccio (default) or pnpr. pnpr's config has no\n                            mock uplink (its registry namespaces can't claim\n                            the unscoped dynamic e2e-uplink-* names), so run\n                            it without --uplink-port and the uplink tests skip\n    -v, --verbose           Enable debug output\n    -h, --help              Show this help\n  `);\n}\n\nexport async function main(argv: string[] = process.argv): Promise<void> {\n  const options = parseArgs(argv);\n\n  if (options.printConfig) {\n    const { buildE2EConfig, buildPnprE2EConfig, DEFAULT_UPLINK_PORT } =\n      await import('./utils/e2e-config');\n    const server = options.server ?? 'verdaccio';\n    if (server === 'pnpr') {\n      process.stdout.write(buildPnprE2EConfig());\n    } else if (server === 'verdaccio') {\n      process.stdout.write(buildE2EConfig(options.uplinkPort ?? DEFAULT_UPLINK_PORT));\n    } else {\n      console.error(`Unknown --server: \"${server}\". Supported: verdaccio, pnpr`);\n      process.exit(1);\n    }\n    process.exit(0);\n  }\n\n  // Expose the mock uplink port to scenarios (scenario:uplink-failure gates on it).\n  if (options.uplinkPort) {\n    process.env.E2E_UPLINK_PORT = String(options.uplinkPort);\n  }\n\n  if (!options.registry) {\n    console.error('Error: --registry is required\\n');\n    printHelp();\n    process.exit(1);\n  }\n  // URLs are built as `${registry}/-/...`; a trailing slash (pnpr's `/npm/`) would double it\n  options.registry = stripTrailingSlashes(options.registry);\n\n  // Run from a temp dir to isolate from the host project's packageManager, .yarnrc.yml, etc.\n  const { createTempFolder } = await import('./utils/project');\n  const runDir = await createTempFolder('e2e-run');\n  process.chdir(runDir);\n\n  if (options.verbose) {\n    const { setVerbose } = await import('./utils/process');\n    setVerbose(true);\n  }\n\n  // Ensure registry is reachable\n  console.log(`Checking registry at ${options.registry}...`);\n  const alive = await pingRegistry(options.registry);\n  if (!alive) {\n    console.error(`Error: Registry at ${options.registry} is not reachable`);\n    process.exit(1);\n  }\n  console.log(`Registry is alive.`);\n\n  // Get auth token\n  let token = options.token;\n  if (!token) {\n    console.log('Creating test user...');\n    const auth = await createUser(options.registry);\n    token = auth.token;\n    console.log(`User \"${auth.user}\" created.`);\n  }\n\n  // Build adapter list\n  const adapters = parseAdapters(options.pm);\n  console.log(`Adapters: ${adapters.map((a) => a.name).join(', ')}`);\n\n  // Filter tests\n  const tests =\n    options.test && options.test.length > 0\n      ? allTests.filter((t) => options.test!.includes(t.name))\n      : allTests;\n\n  console.log(`Tests: ${tests.map((t) => t.name).join(', ')}`);\n\n  if (options.skipTest && options.skipTest.length > 0) {\n    console.log(`Skipping tests: ${options.skipTest.join(', ')}`);\n  }\n\n  // Run\n  const { exitCode } = await runAll(adapters, tests, options.registry, token, {\n    timeout: options.timeout,\n    concurrency: options.concurrency,\n    testFilter: options.test,\n    skipTests: options.skipTest,\n  });\n\n  process.exit(exitCode);\n}\n\n// Re-export for programmatic usage\nexport { allTests } from './tests';\nexport { allScenarios } from './scenarios';\nexport {\n  createBunAdapter,\n  createDenoAdapter,\n  createNpmAdapter,\n  createNubAdapter,\n  createPnpmAdapter,\n  createUpmAdapter,\n  createYarnModernAdapter,\n} from './adapters';\nexport { runAll, runSuite } from './runner';\nexport type { PackageManagerAdapter, TestDefinition, TestContext, CliOptions } from './types';\n"],"mappings":";;;;;;;;;;;;;;;;;;CAiBc,GAAA,MAAA,QAAA,CAAW,mBAAmB;AAE5C,SAAS,YAAY,QAAsE;CAEzF,MAAM,QAAQ,OAAO,QAAQ,GAAG;CAChC,IAAI,UAAU,IACZ,OAAO;EAAE,MAAM,OAAO,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY;EAAG,SAAS,OAAO,MAAM,QAAQ,CAAC;CAAE;CAExF,MAAM,QAAQ,OAAO,QAAQ,GAAG;CAChC,IAAI,UAAU,IACZ,OAAO;EAAE,MAAM,OAAO,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY;EAAG,SAAS,OAAO,MAAM,QAAQ,CAAC;CAAE;CAExF,OAAO,EAAE,MAAM,OAAO,YAAY,EAAE;AACtC;AAEA,SAAS,cAAc,WAA+C;CACpE,IAAI,CAAC,aAAa,UAAU,WAAW,GACrC,OAAO,CAAC,YAAA,iBAAiB,CAAC;CAG5B,MAAM,WAAoC,CAAC;CAE3C,KAAK,MAAM,UAAU,WAAW;EAC9B,MAAM,EAAE,MAAM,SAAS,YAAY,YAAY,MAAM;EAErD,IAAI,SAAS,OACX,SAAS,KAAK,YAAA,iBAAiB,SAAS,OAAO,CAAC;OAC3C,IAAI,SAAS,QAClB,SAAS,KAAK,aAAA,kBAAkB,SAAS,OAAO,CAAC;OAC5C,IAAI,SAAS,kBAAkB,SAAS,SAC7C,MAAM,IAAI,MACR,8EACF;OACK,IAAI,SAAS,iBAAiB,SAAS,QAC5C,SAAS,KAAK,oBAAA,wBAAwB,SAAS,OAAO,CAAC;OAClD,IAAI,SAAS,OAClB,SAAS,KAAK,YAAA,iBAAiB,SAAS,OAAO,CAAC;OAC3C,IAAI,SAAS,QAClB,SAAS,KAAK,aAAA,kBAAkB,SAAS,OAAO,CAAC;OAC5C,IAAI,SAAS,OAClB,SAAS,KAAK,YAAA,iBAAiB,SAAS,OAAO,CAAC;OAC3C,IAAI,SAAS,OAClB,SAAS,KAAK,YAAA,iBAAiB,SAAS,OAAO,CAAC;OAEhD,MAAM,IAAI,MACR,6BAA6B,KAAK,0DACpC;CAEJ;CAEA,OAAO;AACT;AAEA,SAAS,UAAU,MAA4B;CAC7C,MAAM,UAAsB;EAC1B,UAAU;EACV,IAAI,CAAC;EACL,MAAM,CAAC;EACP,UAAU,CAAC;EACX,aAAa;EACb,SAAS;EACT,SAAS;CACX;CAEA,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;EACpC,MAAM,MAAM,KAAK;EAEjB,IAAI,QAAQ,gBAAgB,QAAQ,MAClC,QAAQ,WAAW,KAAK,EAAE;OACrB,IAAI,QAAQ,QACjB,QAAQ,GAAI,KAAK,KAAK,EAAE,EAAE;OACrB,IAAI,QAAQ,YAAY,QAAQ,MACrC,QAAQ,KAAM,KAAK,KAAK,EAAE,EAAE;OACvB,IAAI,QAAQ,mBAAmB,QAAQ,MAC5C,QAAQ,cAAc,SAAS,KAAK,EAAE,IAAI,EAAE;OACvC,IAAI,QAAQ,aACjB,QAAQ,UAAU,SAAS,KAAK,EAAE,IAAI,EAAE;OACnC,IAAI,QAAQ,WACjB,QAAQ,QAAQ,KAAK,EAAE;OAClB,IAAI,QAAQ,iBACjB,QAAQ,aAAa,SAAS,KAAK,EAAE,IAAI,EAAE;OACtC,IAAI,QAAQ,kBACjB,QAAQ,cAAc;OACjB,IAAI,QAAQ,YACjB,QAAQ,SAAS,KAAK,EAAE;OACnB,IAAI,IAAI,WAAW,WAAW,GACnC,QAAQ,SAAS,IAAI,MAAM,GAAG,CAAC,CAAC;OAC3B,IAAI,QAAQ,eACjB,QAAQ,SAAU,KAAK,KAAK,EAAE,EAAE;OAC3B,IAAI,IAAI,WAAW,cAAc,GACtC,QAAQ,SAAU,KAAK,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE;OACnC,IAAI,QAAQ,eAAe,QAAQ,MACxC,QAAQ,UAAU;OACb,IAAI,QAAQ,YAAY,QAAQ,MAAM;GAC3C,UAAU;GACV,QAAQ,KAAK,CAAC;EAChB,OAAO,IAAI,IAAI,WAAW,aAAa,GACrC,QAAQ,WAAW,IAAI,MAAM,GAAG,CAAC,CAAC;OAC7B,IAAI,IAAI,WAAW,OAAO,GAC/B,QAAQ,GAAI,KAAK,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE;OAC7B,IAAI,IAAI,WAAW,SAAS,GACjC,QAAQ,KAAM,KAAK,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE;OAC/B,IAAI,IAAI,WAAW,UAAU,GAClC,QAAQ,QAAQ,IAAI,MAAM,GAAG,CAAC,CAAC;OAC1B,IAAI,IAAI,WAAW,YAAY,GACpC,QAAQ,UAAU,SAAS,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE;OAC3C,IAAI,IAAI,WAAW,gBAAgB,GACxC,QAAQ,aAAa,SAAS,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE;OAC9C;GACL,QAAQ,MAAM,qBAAqB,KAAK;GACxC,UAAU;GACV,QAAQ,KAAK,CAAC;EAChB;CACF;CAEA,OAAO;AACT;AAEA,SAAS,YAAkB;CACzB,QAAQ,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDX;AACH;AAEA,eAAsB,KAAK,OAAiB,QAAQ,MAAqB;CACvE,MAAM,UAAU,UAAU,IAAI;CAE9B,IAAI,QAAQ,aAAa;EACvB,MAAM,EAAE,gBAAgB,oBAAoB,wBAC1C,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,wBAAA,CAAA;EACR,MAAM,SAAS,QAAQ,UAAU;EACjC,IAAI,WAAW,QACb,QAAQ,OAAO,MAAM,mBAAmB,CAAC;OACpC,IAAI,WAAW,aACpB,QAAQ,OAAO,MAAM,eAAe,QAAQ,cAAc,mBAAmB,CAAC;OACzE;GACL,QAAQ,MAAM,sBAAsB,OAAO,8BAA8B;GACzE,QAAQ,KAAK,CAAC;EAChB;EACA,QAAQ,KAAK,CAAC;CAChB;CAGA,IAAI,QAAQ,YACV,QAAQ,IAAI,kBAAkB,OAAO,QAAQ,UAAU;CAGzD,IAAI,CAAC,QAAQ,UAAU;EACrB,QAAQ,MAAM,iCAAiC;EAC/C,UAAU;EACV,QAAQ,KAAK,CAAC;CAChB;CAEA,QAAQ,WAAW,oBAAA,qBAAqB,QAAQ,QAAQ;CAGxD,MAAM,EAAE,qBAAqB,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,qBAAA,CAAA;CACnC,MAAM,SAAS,MAAM,iBAAiB,SAAS;CAC/C,QAAQ,MAAM,MAAM;CAEpB,IAAI,QAAQ,SAAS;EACnB,MAAM,EAAE,eAAe,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,qBAAA,CAAA;EAC7B,WAAW,IAAI;CACjB;CAGA,QAAQ,IAAI,wBAAwB,QAAQ,SAAS,IAAI;CAEzD,IAAI,CAAC,MADe,wBAAA,aAAa,QAAQ,QAAQ,GACrC;EACV,QAAQ,MAAM,sBAAsB,QAAQ,SAAS,kBAAkB;EACvE,QAAQ,KAAK,CAAC;CAChB;CACA,QAAQ,IAAI,oBAAoB;CAGhC,IAAI,QAAQ,QAAQ;CACpB,IAAI,CAAC,OAAO;EACV,QAAQ,IAAI,uBAAuB;EACnC,MAAM,OAAO,MAAM,wBAAA,WAAW,QAAQ,QAAQ;EAC9C,QAAQ,KAAK;EACb,QAAQ,IAAI,SAAS,KAAK,KAAK,WAAW;CAC5C;CAGA,MAAM,WAAW,cAAc,QAAQ,EAAE;CACzC,QAAQ,IAAI,aAAa,SAAS,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG;CAGjE,MAAM,QACJ,QAAQ,QAAQ,QAAQ,KAAK,SAAS,IAClC,gBAAA,SAAS,QAAQ,MAAM,QAAQ,KAAM,SAAS,EAAE,IAAI,CAAC,IACrD,gBAAA;CAEN,QAAQ,IAAI,UAAU,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG;CAE3D,IAAI,QAAQ,YAAY,QAAQ,SAAS,SAAS,GAChD,QAAQ,IAAI,mBAAmB,QAAQ,SAAS,KAAK,IAAI,GAAG;CAI9D,MAAM,EAAE,aAAa,MAAM,eAAA,OAAO,UAAU,OAAO,QAAQ,UAAU,OAAO;EAC1E,SAAS,QAAQ;EACjB,aAAa,QAAQ;EACrB,YAAY,QAAQ;EACpB,WAAW,QAAQ;CACrB,CAAC;CAED,QAAQ,KAAK,QAAQ;AACvB"}

package/build/cjs/scenarios/minimum-release-age.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"minimum-release-age.cjs","names":[],"sources":["../../../src/scenarios/minimum-release-age.ts"],"sourcesContent":["import assert from 'assert';\nimport { writeFile } from 'fs/promises';\nimport { join } from 'path';\n\nimport { PackageManagerAdapter, TestContext, TestDefinition } from '../types';\nimport { trace } from '../utils/process';\n\n/**\n * Scenario: minimum-release-age (pnpm 11.1+ only)\n *\n * Exercises pnpm's `minimumReleaseAge` cooldown together with\n * `minimumReleaseAgeExclude`. With a 7-day (10080 minute) cooldown, freshly\n * published versions are normally not installable until they age past the\n * threshold — but packages matching the exclude globs bypass the check.\n *\n *   minimumReleaseAge: 10080\n *   minimumReleaseAgeStrict: true\n *   minimumReleaseAgeExclude:\n *     - '@verdaccio/*'\n *     - 'verdaccio-*'\n *\n * minimumReleaseAgeStrict is required on pnpm 12: without it, pnpm 12\n * auto-adds new direct dependencies to minimumReleaseAgeExclude instead of\n * failing. pnpm 11 enforces the cooldown unconditionally and ignores the key.\n *\n * The scenario publishes brand-new (age ~0) packages and asserts:\n *   - an excluded scoped package   (@verdaccio/*) installs despite the cooldown\n *   - an excluded unscoped package (verdaccio-*)  installs despite the cooldown\n *   - a non-excluded package is blocked by the cooldown (proving it is active)\n *\n * pnpm reads these settings from `pnpm-workspace.yaml`, mirroring the\n * configuration used by the repo root. The cooldown is only enforced from\n * pnpm 11.1.0 onward (11.0.x silently ignores it), so the scenario is gated to\n * that version range — see {@link isPnpm11Plus}.\n */\n\nconst MINIMUM_RELEASE_AGE = 10080; // 7 days, in minutes\nconst MINIMUM_RELEASE_AGE_EXCLUDE = ['@verdaccio/*', 'verdaccio-*'];\n\nconst PNPM_WORKSPACE_YAML = [\n  `minimumReleaseAge: ${MINIMUM_RELEASE_AGE}`,\n  // pnpm 12 no longer blocks new direct dependencies by default: it auto-adds\n  // them to minimumReleaseAgeExclude in pnpm-workspace.yaml and proceeds.\n  // minimumReleaseAgeStrict restores the blocking behavior this scenario\n  // asserts (ERR_PNPM_NO_MATURE_MATCHING_VERSION); pnpm 11 ignores the key.\n  'minimumReleaseAgeStrict: true',\n  'minimumReleaseAgeExclude:',\n  ...MINIMUM_RELEASE_AGE_EXCLUDE.map((glob) => `  - '${glob}'`),\n  '',\n].join('\\n');\n\n/**\n * True only for pnpm versions that actually enforce minimumReleaseAge.\n *\n * The cooldown is honored in pnpm 11.1.0+, but it is silently ignored in\n * 11.0.0 / 11.0.1 (and the 11.0.0 release candidates) — those versions install\n * brand-new packages regardless of the configured cooldown. We scope this\n * scenario to pnpm 11.1.0 and newer so it doesn't false-fail on that regression.\n */\nexport function isPnpm11Plus(adapter: PackageManagerAdapter): boolean {\n  if (adapter.type !== 'pnpm') {\n    return false;\n  }\n  const match = adapter.name.match(/pnpm@(\\d+)\\.(\\d+)/);\n  if (!match) {\n    return false;\n  }\n  const major = parseInt(match[1], 10);\n  const minor = parseInt(match[2], 10);\n  return major > 11 || (major === 11 && minor >= 1);\n}\n\nasync function publishPackage(ctx: TestContext, pkgName: string, version: string): Promise<void> {\n  trace('publishing %s@%s', pkgName, version);\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    pkgName,\n    version,\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token\n  );\n  await ctx.adapter.exec(\n    { cwd: tempFolder },\n    'publish',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n  trace('published %s@%s', pkgName, version);\n}\n\n/**\n * Build a consumer project with the minimumReleaseAge cooldown configured in\n * pnpm-workspace.yaml, depending on the given packages.\n */\nasync function prepareCooldownConsumer(\n  ctx: TestContext,\n  consumerName: string,\n  dependencies: Record<string, string>\n): Promise<string> {\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    consumerName,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token,\n    dependencies\n  );\n  await writeFile(join(tempFolder, 'pnpm-workspace.yaml'), PNPM_WORKSPACE_YAML);\n  trace('prepared cooldown consumer %s at %s', consumerName, tempFolder);\n  return tempFolder;\n}\n\nasync function testMinimumReleaseAge(ctx: TestContext): Promise<void> {\n  const id = ctx.runId;\n\n  const excludedScoped = `@verdaccio/release-age-${id}`;\n  const excludedUnscoped = `verdaccio-release-age-${id}`;\n  const blocked = `e2e-release-age-blocked-${id}`;\n\n  // --- Phase 1: Publish brand-new (age ~0) packages ---\n  await ctx.subTest('publish fresh packages', async () => {\n    await publishPackage(ctx, excludedScoped, '1.0.0');\n    await publishPackage(ctx, excludedUnscoped, '1.0.0');\n    await publishPackage(ctx, blocked, '1.0.0');\n  });\n\n  // --- Phase 2: Excluded packages install despite the cooldown ---\n  await ctx.subTest('excluded packages bypass the cooldown', async () => {\n    const tempFolder = await prepareCooldownConsumer(ctx, `@verdaccio/consumer-excluded-${id}`, {\n      [excludedScoped]: '1.0.0',\n      [excludedUnscoped]: '1.0.0',\n    });\n\n    // Should succeed: both deps match the exclude globs.\n    await ctx.adapter.exec(\n      { cwd: tempFolder },\n      'install',\n      ...ctx.adapter.registryArg(ctx.registryUrl)\n    );\n\n    trace('excluded packages installed successfully under cooldown');\n  });\n\n  // --- Phase 3: Non-excluded fresh package is blocked by the cooldown ---\n  await ctx.subTest('non-excluded fresh package is blocked', async () => {\n    const tempFolder = await prepareCooldownConsumer(ctx, `e2e-consumer-blocked-${id}`, {\n      [blocked]: '1.0.0',\n    });\n\n    let errorMessage = '';\n    try {\n      await ctx.adapter.exec(\n        { cwd: tempFolder },\n        'install',\n        // pnpm 12's parser rejects the `--flag=false` form; --no-frozen-lockfile\n        // is accepted by pnpm 10, 11 and 12 alike\n        '--no-frozen-lockfile',\n        ...ctx.adapter.registryArg(ctx.registryUrl)\n      );\n    } catch (err) {\n      errorMessage = err instanceof Error ? err.message : String(err);\n      trace('install correctly rejected by cooldown: %s', errorMessage.split('\\n')[0]);\n    }\n\n    assert.ok(\n      errorMessage,\n      `Expected install of fresh non-excluded package \"${blocked}\" to be blocked by ` +\n        `minimumReleaseAge (${MINIMUM_RELEASE_AGE} min), but it succeeded`\n    );\n    // pnpm reports ERR_PNPM_NO_MATURE_MATCHING_VERSION / \"minimumReleaseAge\" when a\n    // version is too new. Assert the failure is the cooldown, not an unrelated error.\n    assert.ok(\n      /minimumReleaseAge|NO_MATURE_MATCHING_VERSION/i.test(errorMessage),\n      `Install of \"${blocked}\" failed for an unexpected reason (expected a minimumReleaseAge ` +\n        `cooldown error):\\n${errorMessage}`\n    );\n  });\n}\n\nexport const minimumReleaseAgeScenario: TestDefinition = {\n  name: 'scenario:minimum-release-age',\n  requires: ['publish', 'install'],\n  appliesTo: isPnpm11Plus,\n  run: testMinimumReleaseAge,\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,IAAM,sBAAsB;AAG5B,IAAM,sBAAsB;CAC1B,sBAAsB;CAKtB;CACA;CACA,GAAG,CAVgC,gBAAgB,aAUhD,CAAA,CAA4B,KAAK,SAAS,QAAQ,KAAK,EAAE;CAC5D;AACF,CAAC,CAAC,KAAK,IAAI;;;;;;;;;AAUX,SAAgB,aAAa,SAAyC;CACpE,IAAI,QAAQ,SAAS,QACnB,OAAO;CAET,MAAM,QAAQ,QAAQ,KAAK,MAAM,mBAAmB;CACpD,IAAI,CAAC,OACH,OAAO;CAET,MAAM,QAAQ,SAAS,MAAM,IAAI,EAAE;CACnC,MAAM,QAAQ,SAAS,MAAM,IAAI,EAAE;CACnC,OAAO,QAAQ,MAAO,UAAU,MAAM,SAAS;AACjD;AAEA,eAAe,eAAe,KAAkB,SAAiB,SAAgC;CAC/F,gBAAA,MAAM,oBAAoB,SAAS,OAAO;CAC1C,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,SACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;CACA,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CACA,gBAAA,MAAM,mBAAmB,SAAS,OAAO;AAC3C;;;;;AAMA,eAAe,wBACb,KACA,cACA,cACiB;CACjB,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,cACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,OACJ,YACF;CACA,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,YAAY,qBAAqB,GAAG,mBAAmB;CAC5E,gBAAA,MAAM,uCAAuC,cAAc,UAAU;CACrE,OAAO;AACT;AAEA,eAAe,sBAAsB,KAAiC;CACpE,MAAM,KAAK,IAAI;CAEf,MAAM,iBAAiB,0BAA0B;CACjD,MAAM,mBAAmB,yBAAyB;CAClD,MAAM,UAAU,2BAA2B;CAG3C,MAAM,IAAI,QAAQ,0BAA0B,YAAY;EACtD,MAAM,eAAe,KAAK,gBAAgB,OAAO;EACjD,MAAM,eAAe,KAAK,kBAAkB,OAAO;EACnD,MAAM,eAAe,KAAK,SAAS,OAAO;CAC5C,CAAC;CAGD,MAAM,IAAI,QAAQ,yCAAyC,YAAY;EACrE,MAAM,aAAa,MAAM,wBAAwB,KAAK,gCAAgC,MAAM;IACzF,iBAAiB;IACjB,mBAAmB;EACtB,CAAC;EAGD,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EAEA,gBAAA,MAAM,yDAAyD;CACjE,CAAC;CAGD,MAAM,IAAI,QAAQ,yCAAyC,YAAY;EACrE,MAAM,aAAa,MAAM,wBAAwB,KAAK,wBAAwB,MAAM,GACjF,UAAU,QACb,CAAC;EAED,IAAI,eAAe;EACnB,IAAI;GACF,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WAGA,wBACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EACF,SAAS,KAAK;GACZ,eAAe,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GAC9D,gBAAA,MAAM,8CAA8C,aAAa,MAAM,IAAI,CAAC,CAAC,EAAE;EACjF;EAEA,OAAA,QAAO,GACL,cACA,mDAAmD,QAAQ,wCACnC,oBAAoB,wBAC9C;EAGA,OAAA,QAAO,GACL,gDAAgD,KAAK,YAAY,GACjE,eAAe,QAAQ,oFACA,cACzB;CACF,CAAC;AACH;AAEA,IAAa,4BAA4C;CACvD,MAAM;CACN,UAAU,CAAC,WAAW,SAAS;CAC/B,WAAW;CACX,KAAK;AACP"}
+{"version":3,"file":"minimum-release-age.cjs","names":[],"sources":["../../../src/scenarios/minimum-release-age.ts"],"sourcesContent":["import assert from 'assert';\nimport { writeFile } from 'fs/promises';\nimport { join } from 'path';\n\nimport { PackageManagerAdapter, TestContext, TestDefinition } from '../types';\nimport { trace } from '../utils/process';\n\n/**\n * Scenario: minimum-release-age (pnpm 11.1+ only)\n *\n * Exercises pnpm's `minimumReleaseAge` cooldown together with\n * `minimumReleaseAgeExclude`. With a 7-day (10080 minute) cooldown, freshly\n * published versions are normally not installable until they age past the\n * threshold — but packages matching the exclude globs bypass the check.\n *\n *   minimumReleaseAge: 10080\n *   minimumReleaseAgeStrict: true\n *   minimumReleaseAgeExclude:\n *     - '@verdaccio/*'\n *     - 'verdaccio-*'\n *\n * minimumReleaseAgeStrict is required on pnpm 12: without it, pnpm 12\n * auto-adds new direct dependencies to minimumReleaseAgeExclude instead of\n * failing. pnpm 11 enforces the cooldown unconditionally and ignores the key.\n *\n * The scenario publishes brand-new (age ~0) packages and asserts:\n *   - an excluded scoped package   (@verdaccio/*) installs despite the cooldown\n *   - an excluded unscoped package (verdaccio-*)  installs despite the cooldown\n *   - a non-excluded package is blocked by the cooldown (proving it is active)\n *\n * pnpm reads these settings from `pnpm-workspace.yaml`, mirroring the\n * configuration used by the repo root. The cooldown is only enforced from\n * pnpm 11.1.0 onward (11.0.x silently ignores it), so the scenario is gated to\n * that version range — see {@link isPnpm11Plus}.\n */\n\nconst MINIMUM_RELEASE_AGE = 10080; // 7 days, in minutes\nconst MINIMUM_RELEASE_AGE_EXCLUDE = ['@verdaccio/*', 'verdaccio-*'];\n\nconst PNPM_WORKSPACE_YAML = [\n  `minimumReleaseAge: ${MINIMUM_RELEASE_AGE}`,\n  // pnpm 12 no longer blocks new direct dependencies by default: it auto-adds\n  // them to minimumReleaseAgeExclude in pnpm-workspace.yaml and proceeds.\n  // minimumReleaseAgeStrict restores the blocking behavior this scenario\n  // asserts (ERR_PNPM_NO_MATURE_MATCHING_VERSION); pnpm 11 ignores the key.\n  'minimumReleaseAgeStrict: true',\n  'minimumReleaseAgeExclude:',\n  ...MINIMUM_RELEASE_AGE_EXCLUDE.map((glob) => `  - '${glob}'`),\n  '',\n].join('\\n');\n\n/**\n * True only for pnpm versions that actually enforce minimumReleaseAge.\n *\n * The cooldown is honored in pnpm 11.1.0+, but it is silently ignored in\n * 11.0.0 / 11.0.1 (and the 11.0.0 release candidates) — those versions install\n * brand-new packages regardless of the configured cooldown. We scope this\n * scenario to pnpm 11.1.0 and newer so it doesn't false-fail on that regression.\n */\nexport function isPnpm11Plus(adapter: PackageManagerAdapter): boolean {\n  if (adapter.type !== 'pnpm') {\n    return false;\n  }\n  const match = adapter.name.match(/pnpm@(\\d+)\\.(\\d+)/);\n  if (!match) {\n    return false;\n  }\n  const major = parseInt(match[1], 10);\n  const minor = parseInt(match[2], 10);\n  return major > 11 || (major === 11 && minor >= 1);\n}\n\nasync function publishPackage(ctx: TestContext, pkgName: string, version: string): Promise<void> {\n  trace('publishing %s@%s', pkgName, version);\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    pkgName,\n    version,\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token\n  );\n  await ctx.adapter.exec(\n    { cwd: tempFolder },\n    'publish',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n  trace('published %s@%s', pkgName, version);\n}\n\n/**\n * Build a consumer project with the minimumReleaseAge cooldown configured in\n * pnpm-workspace.yaml, depending on the given packages.\n */\nasync function prepareCooldownConsumer(\n  ctx: TestContext,\n  consumerName: string,\n  dependencies: Record<string, string>\n): Promise<string> {\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    consumerName,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token,\n    dependencies\n  );\n  await writeFile(join(tempFolder, 'pnpm-workspace.yaml'), PNPM_WORKSPACE_YAML);\n  trace('prepared cooldown consumer %s at %s', consumerName, tempFolder);\n  return tempFolder;\n}\n\nasync function testMinimumReleaseAge(ctx: TestContext): Promise<void> {\n  const id = ctx.runId;\n\n  const excludedScoped = `@verdaccio/release-age-${id}`;\n  const excludedUnscoped = `verdaccio-release-age-${id}`;\n  const blocked = `e2e-release-age-blocked-${id}`;\n\n  // --- Phase 1: Publish brand-new (age ~0) packages ---\n  await ctx.subTest('publish fresh packages', async () => {\n    await publishPackage(ctx, excludedScoped, '1.0.0');\n    await publishPackage(ctx, excludedUnscoped, '1.0.0');\n    await publishPackage(ctx, blocked, '1.0.0');\n  });\n\n  // --- Phase 2: Excluded packages install despite the cooldown ---\n  await ctx.subTest('excluded packages bypass the cooldown', async () => {\n    const tempFolder = await prepareCooldownConsumer(ctx, `@verdaccio/consumer-excluded-${id}`, {\n      [excludedScoped]: '1.0.0',\n      [excludedUnscoped]: '1.0.0',\n    });\n\n    // Should succeed: both deps match the exclude globs.\n    await ctx.adapter.exec(\n      { cwd: tempFolder },\n      'install',\n      ...ctx.adapter.registryArg(ctx.registryUrl)\n    );\n\n    trace('excluded packages installed successfully under cooldown');\n  });\n\n  // --- Phase 3: Non-excluded fresh package is blocked by the cooldown ---\n  await ctx.subTest('non-excluded fresh package is blocked', async () => {\n    const tempFolder = await prepareCooldownConsumer(ctx, `e2e-consumer-blocked-${id}`, {\n      [blocked]: '1.0.0',\n    });\n\n    let errorMessage = '';\n    try {\n      await ctx.adapter.exec(\n        { cwd: tempFolder },\n        'install',\n        // pnpm 12's parser rejects the `--flag=false` form; --no-frozen-lockfile\n        // is accepted by pnpm 11 and 12 alike\n        '--no-frozen-lockfile',\n        ...ctx.adapter.registryArg(ctx.registryUrl)\n      );\n    } catch (err) {\n      errorMessage = err instanceof Error ? err.message : String(err);\n      trace('install correctly rejected by cooldown: %s', errorMessage.split('\\n')[0]);\n    }\n\n    assert.ok(\n      errorMessage,\n      `Expected install of fresh non-excluded package \"${blocked}\" to be blocked by ` +\n        `minimumReleaseAge (${MINIMUM_RELEASE_AGE} min), but it succeeded`\n    );\n    // pnpm reports ERR_PNPM_NO_MATURE_MATCHING_VERSION / \"minimumReleaseAge\" when a\n    // version is too new. Assert the failure is the cooldown, not an unrelated error.\n    assert.ok(\n      /minimumReleaseAge|NO_MATURE_MATCHING_VERSION/i.test(errorMessage),\n      `Install of \"${blocked}\" failed for an unexpected reason (expected a minimumReleaseAge ` +\n        `cooldown error):\\n${errorMessage}`\n    );\n  });\n}\n\nexport const minimumReleaseAgeScenario: TestDefinition = {\n  name: 'scenario:minimum-release-age',\n  requires: ['publish', 'install'],\n  appliesTo: isPnpm11Plus,\n  run: testMinimumReleaseAge,\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,IAAM,sBAAsB;AAG5B,IAAM,sBAAsB;CAC1B,sBAAsB;CAKtB;CACA;CACA,GAAG,CAVgC,gBAAgB,aAUhD,CAAA,CAA4B,KAAK,SAAS,QAAQ,KAAK,EAAE;CAC5D;AACF,CAAC,CAAC,KAAK,IAAI;;;;;;;;;AAUX,SAAgB,aAAa,SAAyC;CACpE,IAAI,QAAQ,SAAS,QACnB,OAAO;CAET,MAAM,QAAQ,QAAQ,KAAK,MAAM,mBAAmB;CACpD,IAAI,CAAC,OACH,OAAO;CAET,MAAM,QAAQ,SAAS,MAAM,IAAI,EAAE;CACnC,MAAM,QAAQ,SAAS,MAAM,IAAI,EAAE;CACnC,OAAO,QAAQ,MAAO,UAAU,MAAM,SAAS;AACjD;AAEA,eAAe,eAAe,KAAkB,SAAiB,SAAgC;CAC/F,gBAAA,MAAM,oBAAoB,SAAS,OAAO;CAC1C,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,SACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;CACA,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CACA,gBAAA,MAAM,mBAAmB,SAAS,OAAO;AAC3C;;;;;AAMA,eAAe,wBACb,KACA,cACA,cACiB;CACjB,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,cACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,OACJ,YACF;CACA,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,YAAY,qBAAqB,GAAG,mBAAmB;CAC5E,gBAAA,MAAM,uCAAuC,cAAc,UAAU;CACrE,OAAO;AACT;AAEA,eAAe,sBAAsB,KAAiC;CACpE,MAAM,KAAK,IAAI;CAEf,MAAM,iBAAiB,0BAA0B;CACjD,MAAM,mBAAmB,yBAAyB;CAClD,MAAM,UAAU,2BAA2B;CAG3C,MAAM,IAAI,QAAQ,0BAA0B,YAAY;EACtD,MAAM,eAAe,KAAK,gBAAgB,OAAO;EACjD,MAAM,eAAe,KAAK,kBAAkB,OAAO;EACnD,MAAM,eAAe,KAAK,SAAS,OAAO;CAC5C,CAAC;CAGD,MAAM,IAAI,QAAQ,yCAAyC,YAAY;EACrE,MAAM,aAAa,MAAM,wBAAwB,KAAK,gCAAgC,MAAM;IACzF,iBAAiB;IACjB,mBAAmB;EACtB,CAAC;EAGD,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EAEA,gBAAA,MAAM,yDAAyD;CACjE,CAAC;CAGD,MAAM,IAAI,QAAQ,yCAAyC,YAAY;EACrE,MAAM,aAAa,MAAM,wBAAwB,KAAK,wBAAwB,MAAM,GACjF,UAAU,QACb,CAAC;EAED,IAAI,eAAe;EACnB,IAAI;GACF,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WAGA,wBACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EACF,SAAS,KAAK;GACZ,eAAe,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GAC9D,gBAAA,MAAM,8CAA8C,aAAa,MAAM,IAAI,CAAC,CAAC,EAAE;EACjF;EAEA,OAAA,QAAO,GACL,cACA,mDAAmD,QAAQ,wCACnC,oBAAoB,wBAC9C;EAGA,OAAA,QAAO,GACL,gDAAgD,KAAK,YAAY,GACjE,eAAe,QAAQ,oFACA,cACzB;CACF,CAAC;AACH;AAEA,IAAa,4BAA4C;CACvD,MAAM;CACN,UAAU,CAAC,WAAW,SAAS;CAC/B,WAAW;CACX,KAAK;AACP"}

package/build/cjs/tests/login.cjs

@@ -1,5 +1,6 @@
 const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
 const require_project = require("../utils/project.cjs");
+const require_registry_client = require("../utils/registry-client.cjs");
 let debug = require("debug");
 debug = require_runtime.__toESM(debug, 1);
 let path = require("path");
@@ -114,6 +115,29 @@ async function testLogin(ctx) {
 		const who2 = await yarnWhoami(ctx, tf);
 		assert.default.ok(who2.includes(user2), `Expected "${user2}" after switch but got "${who2}"`);
 	});
+	for (const client of [
+		"npm",
+		"yarn",
+		"pnpm"
+	]) {
+		await ctx.subTest(`${client} logs an existing user in with the Basic retry`, async () => {
+			const user = `login-retry-${client}-${id}`;
+			const password = "retry-password-123";
+			await require_registry_client.createUser(ctx.registryUrl, user, password);
+			const token = await require_registry_client.legacyLogin(ctx.registryUrl, user, password, client);
+			assert.default.strictEqual(await require_registry_client.whoami(ctx.registryUrl, token), user);
+		});
+		await ctx.subTest(`${client} registers a new user`, async () => {
+			const user = `login-new-${client}-${id}`;
+			const token = await require_registry_client.legacyLogin(ctx.registryUrl, user, "retry-password-123", client);
+			assert.default.strictEqual(await require_registry_client.whoami(ctx.registryUrl, token), user);
+		});
+		await ctx.subTest(`${client} cannot log an existing user in with a wrong password`, async () => {
+			const user = `login-wrong-${client}-${id}`;
+			await require_registry_client.createUser(ctx.registryUrl, user, "retry-password-123");
+			await assert.default.rejects(require_registry_client.legacyLogin(ctx.registryUrl, user, "wrong-password", client), (error) => error instanceof require_registry_client.LegacyLoginError && error.status === 401);
+		});
+	}
 }
 var loginTest = {
 	name: "login",

package/build/cjs/tests/login.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"login.cjs","names":[],"sources":["../../../src/tests/login.ts"],"sourcesContent":["import assert from 'assert';\nimport buildDebug from 'debug';\nimport { writeFile } from 'fs/promises';\nimport * as YAML from 'js-yaml';\nimport { join } from 'path';\n\nimport { TestContext, TestDefinition } from '../types';\nimport { createTempFolder, getPackageJSON, getREADME } from '../utils/project';\n\nconst debug = buildDebug('verdaccio:e2e-cli:test:login');\n\n/**\n * Creates a project with registry config but WITHOUT auth token,\n * so whoami will use the token saved by login to ~/.yarnrc.yml.\n */\nasync function prepareLoginProject(ctx: TestContext, name: string): Promise<string> {\n  debug('preparing project for %s (no auth token)', name);\n  const tempFolder = await createTempFolder(name);\n  const yamlContent = YAML.dump({\n    npmRegistryServer: ctx.registryUrl,\n    enableImmutableInstalls: false,\n    unsafeHttpWhitelist: ['localhost'],\n  });\n  await writeFile(join(tempFolder, '.yarnrc.yml'), yamlContent);\n  await writeFile(join(tempFolder, 'package.json'), JSON.stringify({ name, version: '1.0.0' }));\n  if (ctx.adapter.importPlugin) {\n    debug('importing npm-login plugin into %s', tempFolder);\n    await ctx.adapter.importPlugin(tempFolder, 'npm-login');\n  }\n  return tempFolder;\n}\n\nasync function yarnLogin(\n  ctx: TestContext,\n  cwd: string,\n  user: string,\n  password: string,\n  email: string\n) {\n  debug('yarn npm login as %s', user);\n  return ctx.adapter.exec(\n    { cwd },\n    'login',\n    '--auth-type=legacy',\n    `--user=${user}`,\n    `--password=${password}`,\n    `--email=${email}`\n  );\n}\n\nasync function yarnWhoami(ctx: TestContext, cwd: string): Promise<string> {\n  const resp = await ctx.adapter.exec({ cwd }, 'whoami');\n  debug('yarn npm whoami: %s', resp.stdout);\n  return resp.stdout;\n}\n\nasync function testLogin(ctx: TestContext): Promise<void> {\n  const type = ctx.adapter.type;\n  const id = ctx.runId;\n\n  if (type !== 'yarn-modern') {\n    debug('login test only supported for yarn-modern, skipping %s', type);\n    return;\n  }\n\n  const user1 = `login-a-${id}`;\n  const password1 = 'test-password-123';\n  const email1 = `${user1}@test.example.com`;\n\n  await ctx.subTest('create new user + whoami', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login1-${id}`);\n    const loginResp = await yarnLogin(ctx, tf, user1, password1, email1);\n    assert.ok(\n      loginResp.stdout.includes('Logged in') || loginResp.stdout.includes('token saved'),\n      `Expected login success message but got \"${loginResp.stdout}\"`\n    );\n    const who = await yarnWhoami(ctx, tf);\n    assert.ok(who.includes(user1), `Expected whoami \"${user1}\" but got \"${who}\"`);\n  });\n\n  await ctx.subTest('legacy re-login is rejected without basic auth', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login2-${id}`);\n    let loginFailed = false;\n    try {\n      await yarnLogin(ctx, tf, user1, password1, email1);\n    } catch {\n      loginFailed = true;\n    }\n    assert.ok(loginFailed, 'Legacy re-login for an existing user should fail without Basic auth');\n  });\n\n  await ctx.subTest('wrong password fails', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login3-${id}`);\n    let loginFailed = false;\n    try {\n      await yarnLogin(ctx, tf, user1, 'wrong-password', email1);\n    } catch {\n      loginFailed = true;\n    }\n    assert.ok(loginFailed, 'Login with wrong password should have failed');\n  });\n\n  await ctx.subTest('login then publish', async () => {\n    const pkgName = `@verdaccio/login-pub-${id}`;\n    const publishUser = `login-pub-${id}`;\n    const publishPassword = 'publish-password-123';\n    const publishEmail = `${publishUser}@test.example.com`;\n    const tf = await createTempFolder(`login-pub-${id}`);\n    const yamlContent = YAML.dump({\n      npmRegistryServer: ctx.registryUrl,\n      enableImmutableInstalls: false,\n      unsafeHttpWhitelist: ['localhost'],\n    });\n    await writeFile(join(tf, '.yarnrc.yml'), yamlContent);\n    await writeFile(join(tf, 'package.json'), getPackageJSON(pkgName, '1.0.0'));\n    await writeFile(join(tf, 'README.md'), getREADME(pkgName));\n    if (ctx.adapter.importPlugin) {\n      await ctx.adapter.importPlugin(tf, 'npm-login');\n    }\n    await yarnLogin(ctx, tf, publishUser, publishPassword, publishEmail);\n    await ctx.adapter.exec({ cwd: tf }, 'install');\n    const pubResp = await ctx.adapter.exec({ cwd: tf }, 'publish');\n    assert.ok(\n      pubResp.stdout.includes('Package archive published'),\n      `Expected publish success but got \"${pubResp.stdout}\"`\n    );\n  });\n\n  await ctx.subTest('switch users', async () => {\n    const switchUser1 = `login-switch-a-${id}`;\n    const switchPassword1 = 'switch-password-123';\n    const switchEmail1 = `${switchUser1}@test.example.com`;\n    const user2 = `login-b-${id}`;\n    const password2 = 'other-password-456';\n    const email2 = `${user2}@test.example.com`;\n    const tf = await prepareLoginProject(ctx, `verdaccio-login5-${id}`);\n\n    await yarnLogin(ctx, tf, switchUser1, switchPassword1, switchEmail1);\n    const who1 = await yarnWhoami(ctx, tf);\n    assert.ok(who1.includes(switchUser1), `Expected \"${switchUser1}\" but got \"${who1}\"`);\n\n    await yarnLogin(ctx, tf, user2, password2, email2);\n    const who2 = await yarnWhoami(ctx, tf);\n    assert.ok(who2.includes(user2), `Expected \"${user2}\" after switch but got \"${who2}\"`);\n  });\n}\n\nexport const loginTest: TestDefinition = {\n  name: 'login',\n  requires: ['login'],\n  run: testLogin,\n};\n"],"mappings":";;;;;;;;;;;AASA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,8BAA8B;;;;;AAMvD,eAAe,oBAAoB,KAAkB,MAA+B;CAClF,QAAM,4CAA4C,IAAI;CACtD,MAAM,aAAa,MAAM,gBAAA,iBAAiB,IAAI;CAC9C,MAAM,cAAc,QAAK,KAAK;EAC5B,mBAAmB,IAAI;EACvB,yBAAyB;EACzB,qBAAqB,CAAC,WAAW;CACnC,CAAC;CACD,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,YAAY,aAAa,GAAG,WAAW;CAC5D,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,YAAY,cAAc,GAAG,KAAK,UAAU;EAAE;EAAM,SAAS;CAAQ,CAAC,CAAC;CAC5F,IAAI,IAAI,QAAQ,cAAc;EAC5B,QAAM,sCAAsC,UAAU;EACtD,MAAM,IAAI,QAAQ,aAAa,YAAY,WAAW;CACxD;CACA,OAAO;AACT;AAEA,eAAe,UACb,KACA,KACA,MACA,UACA,OACA;CACA,QAAM,wBAAwB,IAAI;CAClC,OAAO,IAAI,QAAQ,KACjB,EAAE,IAAI,GACN,SACA,sBACA,UAAU,QACV,cAAc,YACd,WAAW,OACb;AACF;AAEA,eAAe,WAAW,KAAkB,KAA8B;CACxE,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,EAAE,IAAI,GAAG,QAAQ;CACrD,QAAM,uBAAuB,KAAK,MAAM;CACxC,OAAO,KAAK;AACd;AAEA,eAAe,UAAU,KAAiC;CACxD,MAAM,OAAO,IAAI,QAAQ;CACzB,MAAM,KAAK,IAAI;CAEf,IAAI,SAAS,eAAe;EAC1B,QAAM,0DAA0D,IAAI;EACpE;CACF;CAEA,MAAM,QAAQ,WAAW;CACzB,MAAM,YAAY;CAClB,MAAM,SAAS,GAAG,MAAM;CAExB,MAAM,IAAI,QAAQ,4BAA4B,YAAY;EACxD,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,MAAM,YAAY,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACnE,OAAA,QAAO,GACL,UAAU,OAAO,SAAS,WAAW,KAAK,UAAU,OAAO,SAAS,aAAa,GACjF,2CAA2C,UAAU,OAAO,EAC9D;EACA,MAAM,MAAM,MAAM,WAAW,KAAK,EAAE;EACpC,OAAA,QAAO,GAAG,IAAI,SAAS,KAAK,GAAG,oBAAoB,MAAM,aAAa,IAAI,EAAE;CAC9E,CAAC;CAED,MAAM,IAAI,QAAQ,kDAAkD,YAAY;EAC9E,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,IAAI,cAAc;EAClB,IAAI;GACF,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACnD,QAAQ;GACN,cAAc;EAChB;EACA,OAAA,QAAO,GAAG,aAAa,qEAAqE;CAC9F,CAAC;CAED,MAAM,IAAI,QAAQ,wBAAwB,YAAY;EACpD,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,IAAI,cAAc;EAClB,IAAI;GACF,MAAM,UAAU,KAAK,IAAI,OAAO,kBAAkB,MAAM;EAC1D,QAAQ;GACN,cAAc;EAChB;EACA,OAAA,QAAO,GAAG,aAAa,8CAA8C;CACvE,CAAC;CAED,MAAM,IAAI,QAAQ,sBAAsB,YAAY;EAClD,MAAM,UAAU,wBAAwB;EACxC,MAAM,cAAc,aAAa;EACjC,MAAM,kBAAkB;EACxB,MAAM,eAAe,GAAG,YAAY;EACpC,MAAM,KAAK,MAAM,gBAAA,iBAAiB,aAAa,IAAI;EACnD,MAAM,cAAc,QAAK,KAAK;GAC5B,mBAAmB,IAAI;GACvB,yBAAyB;GACzB,qBAAqB,CAAC,WAAW;EACnC,CAAC;EACD,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,IAAI,aAAa,GAAG,WAAW;EACpD,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,IAAI,cAAc,GAAG,gBAAA,eAAe,SAAS,OAAO,CAAC;EAC1E,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,IAAI,WAAW,GAAG,gBAAA,UAAU,OAAO,CAAC;EACzD,IAAI,IAAI,QAAQ,cACd,MAAM,IAAI,QAAQ,aAAa,IAAI,WAAW;EAEhD,MAAM,UAAU,KAAK,IAAI,aAAa,iBAAiB,YAAY;EACnE,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,GAAG,GAAG,SAAS;EAC7C,MAAM,UAAU,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,GAAG,GAAG,SAAS;EAC7D,OAAA,QAAO,GACL,QAAQ,OAAO,SAAS,2BAA2B,GACnD,qCAAqC,QAAQ,OAAO,EACtD;CACF,CAAC;CAED,MAAM,IAAI,QAAQ,gBAAgB,YAAY;EAC5C,MAAM,cAAc,kBAAkB;EACtC,MAAM,kBAAkB;EACxB,MAAM,eAAe,GAAG,YAAY;EACpC,MAAM,QAAQ,WAAW;EACzB,MAAM,YAAY;EAClB,MAAM,SAAS,GAAG,MAAM;EACxB,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAElE,MAAM,UAAU,KAAK,IAAI,aAAa,iBAAiB,YAAY;EACnE,MAAM,OAAO,MAAM,WAAW,KAAK,EAAE;EACrC,OAAA,QAAO,GAAG,KAAK,SAAS,WAAW,GAAG,aAAa,YAAY,aAAa,KAAK,EAAE;EAEnF,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK,EAAE;EACrC,OAAA,QAAO,GAAG,KAAK,SAAS,KAAK,GAAG,aAAa,MAAM,0BAA0B,KAAK,EAAE;CACtF,CAAC;AACH;AAEA,IAAa,YAA4B;CACvC,MAAM;CACN,UAAU,CAAC,OAAO;CAClB,KAAK;AACP"}
+{"version":3,"file":"login.cjs","names":[],"sources":["../../../src/tests/login.ts"],"sourcesContent":["import assert from 'assert';\nimport buildDebug from 'debug';\nimport { writeFile } from 'fs/promises';\nimport * as YAML from 'js-yaml';\nimport { join } from 'path';\n\nimport { TestContext, TestDefinition } from '../types';\nimport { createTempFolder, getPackageJSON, getREADME } from '../utils/project';\nimport { LegacyLoginError, createUser, legacyLogin, whoami } from '../utils/registry-client';\n\nconst debug = buildDebug('verdaccio:e2e-cli:test:login');\n\n/**\n * Creates a project with registry config but WITHOUT auth token,\n * so whoami will use the token saved by login to ~/.yarnrc.yml.\n */\nasync function prepareLoginProject(ctx: TestContext, name: string): Promise<string> {\n  debug('preparing project for %s (no auth token)', name);\n  const tempFolder = await createTempFolder(name);\n  const yamlContent = YAML.dump({\n    npmRegistryServer: ctx.registryUrl,\n    enableImmutableInstalls: false,\n    unsafeHttpWhitelist: ['localhost'],\n  });\n  await writeFile(join(tempFolder, '.yarnrc.yml'), yamlContent);\n  await writeFile(join(tempFolder, 'package.json'), JSON.stringify({ name, version: '1.0.0' }));\n  if (ctx.adapter.importPlugin) {\n    debug('importing npm-login plugin into %s', tempFolder);\n    await ctx.adapter.importPlugin(tempFolder, 'npm-login');\n  }\n  return tempFolder;\n}\n\nasync function yarnLogin(\n  ctx: TestContext,\n  cwd: string,\n  user: string,\n  password: string,\n  email: string\n) {\n  debug('yarn npm login as %s', user);\n  return ctx.adapter.exec(\n    { cwd },\n    'login',\n    '--auth-type=legacy',\n    `--user=${user}`,\n    `--password=${password}`,\n    `--email=${email}`\n  );\n}\n\nasync function yarnWhoami(ctx: TestContext, cwd: string): Promise<string> {\n  const resp = await ctx.adapter.exec({ cwd }, 'whoami');\n  debug('yarn npm whoami: %s', resp.stdout);\n  return resp.stdout;\n}\n\nasync function testLogin(ctx: TestContext): Promise<void> {\n  const type = ctx.adapter.type;\n  const id = ctx.runId;\n\n  if (type !== 'yarn-modern') {\n    debug('login test only supported for yarn-modern, skipping %s', type);\n    return;\n  }\n\n  const user1 = `login-a-${id}`;\n  const password1 = 'test-password-123';\n  const email1 = `${user1}@test.example.com`;\n\n  await ctx.subTest('create new user + whoami', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login1-${id}`);\n    const loginResp = await yarnLogin(ctx, tf, user1, password1, email1);\n    assert.ok(\n      loginResp.stdout.includes('Logged in') || loginResp.stdout.includes('token saved'),\n      `Expected login success message but got \"${loginResp.stdout}\"`\n    );\n    const who = await yarnWhoami(ctx, tf);\n    assert.ok(who.includes(user1), `Expected whoami \"${user1}\" but got \"${who}\"`);\n  });\n\n  await ctx.subTest('legacy re-login is rejected without basic auth', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login2-${id}`);\n    let loginFailed = false;\n    try {\n      await yarnLogin(ctx, tf, user1, password1, email1);\n    } catch {\n      loginFailed = true;\n    }\n    assert.ok(loginFailed, 'Legacy re-login for an existing user should fail without Basic auth');\n  });\n\n  await ctx.subTest('wrong password fails', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login3-${id}`);\n    let loginFailed = false;\n    try {\n      await yarnLogin(ctx, tf, user1, 'wrong-password', email1);\n    } catch {\n      loginFailed = true;\n    }\n    assert.ok(loginFailed, 'Login with wrong password should have failed');\n  });\n\n  await ctx.subTest('login then publish', async () => {\n    const pkgName = `@verdaccio/login-pub-${id}`;\n    const publishUser = `login-pub-${id}`;\n    const publishPassword = 'publish-password-123';\n    const publishEmail = `${publishUser}@test.example.com`;\n    const tf = await createTempFolder(`login-pub-${id}`);\n    const yamlContent = YAML.dump({\n      npmRegistryServer: ctx.registryUrl,\n      enableImmutableInstalls: false,\n      unsafeHttpWhitelist: ['localhost'],\n    });\n    await writeFile(join(tf, '.yarnrc.yml'), yamlContent);\n    await writeFile(join(tf, 'package.json'), getPackageJSON(pkgName, '1.0.0'));\n    await writeFile(join(tf, 'README.md'), getREADME(pkgName));\n    if (ctx.adapter.importPlugin) {\n      await ctx.adapter.importPlugin(tf, 'npm-login');\n    }\n    await yarnLogin(ctx, tf, publishUser, publishPassword, publishEmail);\n    await ctx.adapter.exec({ cwd: tf }, 'install');\n    const pubResp = await ctx.adapter.exec({ cwd: tf }, 'publish');\n    assert.ok(\n      pubResp.stdout.includes('Package archive published'),\n      `Expected publish success but got \"${pubResp.stdout}\"`\n    );\n  });\n\n  await ctx.subTest('switch users', async () => {\n    const switchUser1 = `login-switch-a-${id}`;\n    const switchPassword1 = 'switch-password-123';\n    const switchEmail1 = `${switchUser1}@test.example.com`;\n    const user2 = `login-b-${id}`;\n    const password2 = 'other-password-456';\n    const email2 = `${user2}@test.example.com`;\n    const tf = await prepareLoginProject(ctx, `verdaccio-login5-${id}`);\n\n    await yarnLogin(ctx, tf, switchUser1, switchPassword1, switchEmail1);\n    const who1 = await yarnWhoami(ctx, tf);\n    assert.ok(who1.includes(switchUser1), `Expected \"${switchUser1}\" but got \"${who1}\"`);\n\n    await yarnLogin(ctx, tf, user2, password2, email2);\n    const who2 = await yarnWhoami(ctx, tf);\n    assert.ok(who2.includes(user2), `Expected \"${user2}\" after switch but got \"${who2}\"`);\n  });\n\n  // replayed over HTTP: what `npm login`, native `yarn npm login` and `pnpm login` send\n  for (const client of ['npm', 'yarn', 'pnpm'] as const) {\n    await ctx.subTest(`${client} logs an existing user in with the Basic retry`, async () => {\n      const user = `login-retry-${client}-${id}`;\n      const password = 'retry-password-123';\n      await createUser(ctx.registryUrl, user, password);\n\n      const token = await legacyLogin(ctx.registryUrl, user, password, client);\n      assert.strictEqual(await whoami(ctx.registryUrl, token), user);\n    });\n\n    await ctx.subTest(`${client} registers a new user`, async () => {\n      const user = `login-new-${client}-${id}`;\n\n      const token = await legacyLogin(ctx.registryUrl, user, 'retry-password-123', client);\n      assert.strictEqual(await whoami(ctx.registryUrl, token), user);\n    });\n\n    await ctx.subTest(\n      `${client} cannot log an existing user in with a wrong password`,\n      async () => {\n        const user = `login-wrong-${client}-${id}`;\n        await createUser(ctx.registryUrl, user, 'retry-password-123');\n\n        await assert.rejects(\n          legacyLogin(ctx.registryUrl, user, 'wrong-password', client),\n          (error: unknown) => error instanceof LegacyLoginError && error.status === 401\n        );\n      }\n    );\n  }\n}\n\nexport const loginTest: TestDefinition = {\n  name: 'login',\n  requires: ['login'],\n  run: testLogin,\n};\n"],"mappings":";;;;;;;;;;;;AAUA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,8BAA8B;;;;;AAMvD,eAAe,oBAAoB,KAAkB,MAA+B;CAClF,QAAM,4CAA4C,IAAI;CACtD,MAAM,aAAa,MAAM,gBAAA,iBAAiB,IAAI;CAC9C,MAAM,cAAc,QAAK,KAAK;EAC5B,mBAAmB,IAAI;EACvB,yBAAyB;EACzB,qBAAqB,CAAC,WAAW;CACnC,CAAC;CACD,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,YAAY,aAAa,GAAG,WAAW;CAC5D,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,YAAY,cAAc,GAAG,KAAK,UAAU;EAAE;EAAM,SAAS;CAAQ,CAAC,CAAC;CAC5F,IAAI,IAAI,QAAQ,cAAc;EAC5B,QAAM,sCAAsC,UAAU;EACtD,MAAM,IAAI,QAAQ,aAAa,YAAY,WAAW;CACxD;CACA,OAAO;AACT;AAEA,eAAe,UACb,KACA,KACA,MACA,UACA,OACA;CACA,QAAM,wBAAwB,IAAI;CAClC,OAAO,IAAI,QAAQ,KACjB,EAAE,IAAI,GACN,SACA,sBACA,UAAU,QACV,cAAc,YACd,WAAW,OACb;AACF;AAEA,eAAe,WAAW,KAAkB,KAA8B;CACxE,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,EAAE,IAAI,GAAG,QAAQ;CACrD,QAAM,uBAAuB,KAAK,MAAM;CACxC,OAAO,KAAK;AACd;AAEA,eAAe,UAAU,KAAiC;CACxD,MAAM,OAAO,IAAI,QAAQ;CACzB,MAAM,KAAK,IAAI;CAEf,IAAI,SAAS,eAAe;EAC1B,QAAM,0DAA0D,IAAI;EACpE;CACF;CAEA,MAAM,QAAQ,WAAW;CACzB,MAAM,YAAY;CAClB,MAAM,SAAS,GAAG,MAAM;CAExB,MAAM,IAAI,QAAQ,4BAA4B,YAAY;EACxD,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,MAAM,YAAY,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACnE,OAAA,QAAO,GACL,UAAU,OAAO,SAAS,WAAW,KAAK,UAAU,OAAO,SAAS,aAAa,GACjF,2CAA2C,UAAU,OAAO,EAC9D;EACA,MAAM,MAAM,MAAM,WAAW,KAAK,EAAE;EACpC,OAAA,QAAO,GAAG,IAAI,SAAS,KAAK,GAAG,oBAAoB,MAAM,aAAa,IAAI,EAAE;CAC9E,CAAC;CAED,MAAM,IAAI,QAAQ,kDAAkD,YAAY;EAC9E,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,IAAI,cAAc;EAClB,IAAI;GACF,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACnD,QAAQ;GACN,cAAc;EAChB;EACA,OAAA,QAAO,GAAG,aAAa,qEAAqE;CAC9F,CAAC;CAED,MAAM,IAAI,QAAQ,wBAAwB,YAAY;EACpD,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,IAAI,cAAc;EAClB,IAAI;GACF,MAAM,UAAU,KAAK,IAAI,OAAO,kBAAkB,MAAM;EAC1D,QAAQ;GACN,cAAc;EAChB;EACA,OAAA,QAAO,GAAG,aAAa,8CAA8C;CACvE,CAAC;CAED,MAAM,IAAI,QAAQ,sBAAsB,YAAY;EAClD,MAAM,UAAU,wBAAwB;EACxC,MAAM,cAAc,aAAa;EACjC,MAAM,kBAAkB;EACxB,MAAM,eAAe,GAAG,YAAY;EACpC,MAAM,KAAK,MAAM,gBAAA,iBAAiB,aAAa,IAAI;EACnD,MAAM,cAAc,QAAK,KAAK;GAC5B,mBAAmB,IAAI;GACvB,yBAAyB;GACzB,qBAAqB,CAAC,WAAW;EACnC,CAAC;EACD,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,IAAI,aAAa,GAAG,WAAW;EACpD,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,IAAI,cAAc,GAAG,gBAAA,eAAe,SAAS,OAAO,CAAC;EAC1E,OAAA,GAAM,YAAA,UAAA,EAAA,GAAU,KAAA,KAAA,CAAK,IAAI,WAAW,GAAG,gBAAA,UAAU,OAAO,CAAC;EACzD,IAAI,IAAI,QAAQ,cACd,MAAM,IAAI,QAAQ,aAAa,IAAI,WAAW;EAEhD,MAAM,UAAU,KAAK,IAAI,aAAa,iBAAiB,YAAY;EACnE,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,GAAG,GAAG,SAAS;EAC7C,MAAM,UAAU,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,GAAG,GAAG,SAAS;EAC7D,OAAA,QAAO,GACL,QAAQ,OAAO,SAAS,2BAA2B,GACnD,qCAAqC,QAAQ,OAAO,EACtD;CACF,CAAC;CAED,MAAM,IAAI,QAAQ,gBAAgB,YAAY;EAC5C,MAAM,cAAc,kBAAkB;EACtC,MAAM,kBAAkB;EACxB,MAAM,eAAe,GAAG,YAAY;EACpC,MAAM,QAAQ,WAAW;EACzB,MAAM,YAAY;EAClB,MAAM,SAAS,GAAG,MAAM;EACxB,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAElE,MAAM,UAAU,KAAK,IAAI,aAAa,iBAAiB,YAAY;EACnE,MAAM,OAAO,MAAM,WAAW,KAAK,EAAE;EACrC,OAAA,QAAO,GAAG,KAAK,SAAS,WAAW,GAAG,aAAa,YAAY,aAAa,KAAK,EAAE;EAEnF,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK,EAAE;EACrC,OAAA,QAAO,GAAG,KAAK,SAAS,KAAK,GAAG,aAAa,MAAM,0BAA0B,KAAK,EAAE;CACtF,CAAC;CAGD,KAAK,MAAM,UAAU;EAAC;EAAO;EAAQ;CAAM,GAAY;EACrD,MAAM,IAAI,QAAQ,GAAG,OAAO,iDAAiD,YAAY;GACvF,MAAM,OAAO,eAAe,OAAO,GAAG;GACtC,MAAM,WAAW;GACjB,MAAM,wBAAA,WAAW,IAAI,aAAa,MAAM,QAAQ;GAEhD,MAAM,QAAQ,MAAM,wBAAA,YAAY,IAAI,aAAa,MAAM,UAAU,MAAM;GACvE,OAAA,QAAO,YAAY,MAAM,wBAAA,OAAO,IAAI,aAAa,KAAK,GAAG,IAAI;EAC/D,CAAC;EAED,MAAM,IAAI,QAAQ,GAAG,OAAO,wBAAwB,YAAY;GAC9D,MAAM,OAAO,aAAa,OAAO,GAAG;GAEpC,MAAM,QAAQ,MAAM,wBAAA,YAAY,IAAI,aAAa,MAAM,sBAAsB,MAAM;GACnF,OAAA,QAAO,YAAY,MAAM,wBAAA,OAAO,IAAI,aAAa,KAAK,GAAG,IAAI;EAC/D,CAAC;EAED,MAAM,IAAI,QACR,GAAG,OAAO,wDACV,YAAY;GACV,MAAM,OAAO,eAAe,OAAO,GAAG;GACtC,MAAM,wBAAA,WAAW,IAAI,aAAa,MAAM,oBAAoB;GAE5D,MAAM,OAAA,QAAO,QACX,wBAAA,YAAY,IAAI,aAAa,MAAM,kBAAkB,MAAM,IAC1D,UAAmB,iBAAiB,wBAAA,oBAAoB,MAAM,WAAW,GAC5E;EACF,CACF;CACF;AACF;AAEA,IAAa,YAA4B;CACvC,MAAM;CACN,UAAU,CAAC,OAAO;CAClB,KAAK;AACP"}

package/build/cjs/tests/ping.cjs

@@ -1,4 +1,5 @@
 const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
+const require_http_client = require("../utils/http-client.cjs");
 let assert = require("assert");
 assert = require_runtime.__toESM(assert, 1);
 //#region src/tests/ping.ts
@@ -12,7 +13,7 @@ async function testPing(ctx) {
 	if (type === "yarn-modern") assert.default.ok(true, "ping succeeded");
 	else {
 		const parsedBody = JSON.parse(resp.stdout);
-		assert.default.strictEqual(parsedBody.registry, ctx.registryUrl + "/", `Expected registry "${ctx.registryUrl}/" but got "${parsedBody.registry}"`);
+		assert.default.strictEqual(require_http_client.stripTrailingSlashes(String(parsedBody.registry)), require_http_client.stripTrailingSlashes(ctx.registryUrl), `Expected registry "${ctx.registryUrl}/" but got "${parsedBody.registry}"`);
 	}
 }
 var pingTest = {

package/build/cjs/tests/ping.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ping.cjs","names":[],"sources":["../../../src/tests/ping.ts"],"sourcesContent":["import assert from 'assert';\n\nimport { TestContext, TestDefinition } from '../types';\n\nasync function testPing(ctx: TestContext): Promise<void> {\n  const type = ctx.adapter.type;\n\n  // Always run from a prepared project: its .npmrc carries the fresh token and\n  // shields the test from whatever the developer's global ~/.npmrc has for\n  // this registry (a stale token there would turn into a spurious E401).\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    `verdaccio-ping-${ctx.runId}`,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token\n  );\n  const cwd = tempFolder;\n  if (type === 'yarn-modern' && ctx.adapter.importPlugin) {\n    await ctx.adapter.importPlugin(tempFolder, 'npm-ping');\n  }\n\n  const jsonFlag = type === 'yarn-modern' ? [] : ['--json'];\n  const resp = await ctx.adapter.exec(\n    { cwd },\n    'ping',\n    ...jsonFlag,\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n\n  if (type === 'yarn-modern') {\n    // yarn npm ping succeeding (exit code 0) is sufficient proof the registry is reachable\n    assert.ok(true, 'ping succeeded');\n  } else {\n    const parsedBody = JSON.parse(resp.stdout);\n    assert.strictEqual(\n      parsedBody.registry,\n      ctx.registryUrl + '/',\n      `Expected registry \"${ctx.registryUrl}/\" but got \"${parsedBody.registry}\"`\n    );\n  }\n}\n\nexport const pingTest: TestDefinition = {\n  name: 'ping',\n  requires: ['ping'],\n  run: testPing,\n};\n"],"mappings":";;;;AAIA,eAAe,SAAS,KAAiC;CACvD,MAAM,OAAO,IAAI,QAAQ;CAKzB,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,kBAAkB,IAAI,SACtB,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;CACA,MAAM,MAAM;CACZ,IAAI,SAAS,iBAAiB,IAAI,QAAQ,cACxC,MAAM,IAAI,QAAQ,aAAa,YAAY,UAAU;CAGvD,MAAM,WAAW,SAAS,gBAAgB,CAAC,IAAI,CAAC,QAAQ;CACxD,MAAM,OAAO,MAAM,IAAI,QAAQ,KAC7B,EAAE,IAAI,GACN,QACA,GAAG,UACH,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CAEA,IAAI,SAAS,eAEX,OAAA,QAAO,GAAG,MAAM,gBAAgB;MAC3B;EACL,MAAM,aAAa,KAAK,MAAM,KAAK,MAAM;EACzC,OAAA,QAAO,YACL,WAAW,UACX,IAAI,cAAc,KAClB,sBAAsB,IAAI,YAAY,cAAc,WAAW,SAAS,EAC1E;CACF;AACF;AAEA,IAAa,WAA2B;CACtC,MAAM;CACN,UAAU,CAAC,MAAM;CACjB,KAAK;AACP"}
+{"version":3,"file":"ping.cjs","names":[],"sources":["../../../src/tests/ping.ts"],"sourcesContent":["import assert from 'assert';\n\nimport { TestContext, TestDefinition } from '../types';\nimport { stripTrailingSlashes } from '../utils/http-client';\n\nasync function testPing(ctx: TestContext): Promise<void> {\n  const type = ctx.adapter.type;\n\n  // Always run from a prepared project: its .npmrc carries the fresh token and\n  // shields the test from whatever the developer's global ~/.npmrc has for\n  // this registry (a stale token there would turn into a spurious E401).\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    `verdaccio-ping-${ctx.runId}`,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token\n  );\n  const cwd = tempFolder;\n  if (type === 'yarn-modern' && ctx.adapter.importPlugin) {\n    await ctx.adapter.importPlugin(tempFolder, 'npm-ping');\n  }\n\n  const jsonFlag = type === 'yarn-modern' ? [] : ['--json'];\n  const resp = await ctx.adapter.exec(\n    { cwd },\n    'ping',\n    ...jsonFlag,\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n\n  if (type === 'yarn-modern') {\n    // yarn npm ping succeeding (exit code 0) is sufficient proof the registry is reachable\n    assert.ok(true, 'ping succeeded');\n  } else {\n    const parsedBody = JSON.parse(resp.stdout);\n    // npm adds the trailing slash to a bare host but not to a path such as pnpr's /npm\n    assert.strictEqual(\n      stripTrailingSlashes(String(parsedBody.registry)),\n      stripTrailingSlashes(ctx.registryUrl),\n      `Expected registry \"${ctx.registryUrl}/\" but got \"${parsedBody.registry}\"`\n    );\n  }\n}\n\nexport const pingTest: TestDefinition = {\n  name: 'ping',\n  requires: ['ping'],\n  run: testPing,\n};\n"],"mappings":";;;;;AAKA,eAAe,SAAS,KAAiC;CACvD,MAAM,OAAO,IAAI,QAAQ;CAKzB,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,kBAAkB,IAAI,SACtB,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;CACA,MAAM,MAAM;CACZ,IAAI,SAAS,iBAAiB,IAAI,QAAQ,cACxC,MAAM,IAAI,QAAQ,aAAa,YAAY,UAAU;CAGvD,MAAM,WAAW,SAAS,gBAAgB,CAAC,IAAI,CAAC,QAAQ;CACxD,MAAM,OAAO,MAAM,IAAI,QAAQ,KAC7B,EAAE,IAAI,GACN,QACA,GAAG,UACH,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CAEA,IAAI,SAAS,eAEX,OAAA,QAAO,GAAG,MAAM,gBAAgB;MAC3B;EACL,MAAM,aAAa,KAAK,MAAM,KAAK,MAAM;EAEzC,OAAA,QAAO,YACL,oBAAA,qBAAqB,OAAO,WAAW,QAAQ,CAAC,GAChD,oBAAA,qBAAqB,IAAI,WAAW,GACpC,sBAAsB,IAAI,YAAY,cAAc,WAAW,SAAS,EAC1E;CACF;AACF;AAEA,IAAa,WAA2B;CACtC,MAAM;CACN,UAAU,CAAC,MAAM;CACjB,KAAK;AACP"}

package/build/cjs/utils/http-client.cjs

@@ -10,6 +10,12 @@ var ABBREVIATED_ACCEPT = "application/vnd.npm.install-v1+json";
 * Registry URL for a package name. Scoped names are encoded with the same
 * `%2f` form npm clients use: `@scope%2fname`.
 */
+/** `url` without trailing slashes; a loop instead of a regex, which CodeQL flags as ReDoS-prone. */
+function stripTrailingSlashes(url) {
+	let end = url.length;
+	while (end > 0 && url[end - 1] === "/") end--;
+	return url.slice(0, end);
+}
 function packumentUrl(registryUrl, pkgName) {
 	const encoded = pkgName.startsWith("@") ? pkgName.replaceAll("/", "%2f") : pkgName;
 	return `${registryUrl.replace(/\/$/, "")}/${encoded}`;
@@ -107,5 +113,6 @@ exports.computeDist = computeDist;
 exports.downloadTarball = downloadTarball;
 exports.fetchPackument = fetchPackument;
 exports.packumentUrl = packumentUrl;
+exports.stripTrailingSlashes = stripTrailingSlashes;
 
 //# sourceMappingURL=http-client.cjs.map

package/build/cjs/utils/http-client.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"http-client.cjs","names":[],"sources":["../../../src/utils/http-client.ts"],"sourcesContent":["import { createHash } from 'crypto';\nimport buildDebug from 'debug';\nimport { get } from 'http';\n\nconst debug = buildDebug('verdaccio:e2e-cli:http-client');\n\nexport type PackumentResponse = {\n  status: number;\n  headers: Headers;\n  /** Parsed JSON body, or undefined when the response is not JSON (e.g. 304) */\n  body?: any;\n};\n\nexport type TarballDownload = {\n  status: number;\n  headers: Headers;\n  /** Total bytes received */\n  bytes: number;\n  /** hex-encoded sha1 of the received bytes (matches dist.shasum) */\n  sha1: string;\n  /** `sha512-<base64>` of the received bytes (matches dist.integrity) */\n  integrity: string;\n};\n\nexport type FetchPackumentOptions = {\n  /** Request the abbreviated (install) metadata format */\n  abbreviated?: boolean;\n  /** Send If-None-Match with this value */\n  etag?: string;\n  /** Bearer token */\n  token?: string;\n};\n\nexport const ABBREVIATED_ACCEPT = 'application/vnd.npm.install-v1+json';\n\n/**\n * Registry URL for a package name. Scoped names are encoded with the same\n * `%2f` form npm clients use: `@scope%2fname`.\n */\nexport function packumentUrl(registryUrl: string, pkgName: string): string {\n  const encoded = pkgName.startsWith('@') ? pkgName.replaceAll('/', '%2f') : pkgName;\n  return `${registryUrl.replace(/\\/$/, '')}/${encoded}`;\n}\n\nexport async function fetchPackument(\n  registryUrl: string,\n  pkgName: string,\n  options: FetchPackumentOptions = {}\n): Promise<PackumentResponse> {\n  const url = packumentUrl(registryUrl, pkgName);\n  const headers: Record<string, string> = {};\n  if (options.abbreviated) {\n    headers['Accept'] = ABBREVIATED_ACCEPT;\n  }\n  if (options.etag) {\n    headers['If-None-Match'] = options.etag;\n  }\n  if (options.token) {\n    headers['Authorization'] = `Bearer ${options.token}`;\n  }\n  debug('GET %s %o', url, headers);\n\n  // Conditional requests must bypass fetch(): undici appends\n  // `cache-control: no-cache` whenever If-None-Match is present, which\n  // (correctly, per HTTP semantics) disables the server's 304 revalidation.\n  if (options.etag) {\n    return new Promise((resolve, reject) => {\n      get(url, { headers }, (response) => {\n        let text = '';\n        response.setEncoding('utf8');\n        response.on('data', (chunk) => (text += chunk));\n        response.on('end', () => {\n          let body: any;\n          try {\n            body = JSON.parse(text);\n          } catch {\n            body = undefined;\n          }\n          const responseHeaders = new Headers();\n          for (const [name, value] of Object.entries(response.headers)) {\n            if (value !== undefined) {\n              responseHeaders.set(name, Array.isArray(value) ? value.join(', ') : value);\n            }\n          }\n          resolve({ status: response.statusCode || 0, headers: responseHeaders, body });\n        });\n      }).on('error', reject);\n    });\n  }\n\n  const response = await fetch(url, { headers });\n  let body: any;\n  if (response.status !== 304) {\n    const text = await response.text();\n    try {\n      body = JSON.parse(text);\n    } catch {\n      body = undefined;\n    }\n  }\n  return { status: response.status, headers: response.headers, body };\n}\n\nexport type DownloadTarballOptions = {\n  signal?: AbortSignal;\n  token?: string;\n  /** Called after the first chunk of the body arrives (useful to abort mid-stream) */\n  onFirstChunk?: () => void;\n  /** Called after every chunk with the total bytes received so far (useful to abort at a threshold) */\n  onChunk?: (bytesReceived: number) => void;\n};\n\n/**\n * Download a tarball fully, computing sha1/sha512 integrity on the fly.\n * Rejects with the underlying error when aborted or the connection drops.\n */\nexport async function downloadTarball(\n  url: string,\n  options: DownloadTarballOptions = {}\n): Promise<TarballDownload> {\n  const headers: Record<string, string> = {};\n  if (options.token) {\n    headers['Authorization'] = `Bearer ${options.token}`;\n  }\n  debug('GET (tarball) %s', url);\n  const response = await fetch(url, { headers, signal: options.signal });\n\n  const sha1 = createHash('sha1');\n  const sha512 = createHash('sha512');\n  let bytes = 0;\n  let first = true;\n\n  if (response.body) {\n    for await (const chunk of response.body as any) {\n      const buf = Buffer.from(chunk);\n      bytes += buf.length;\n      sha1.update(buf);\n      sha512.update(buf);\n      if (first) {\n        first = false;\n        options.onFirstChunk?.();\n      }\n      options.onChunk?.(bytes);\n    }\n  }\n\n  return {\n    status: response.status,\n    headers: response.headers,\n    bytes,\n    sha1: sha1.digest('hex'),\n    integrity: `sha512-${sha512.digest('base64')}`,\n  };\n}\n\n/** Compute npm-style dist values (shasum/integrity) for a buffer. */\nexport function computeDist(buffer: Buffer): { shasum: string; integrity: string } {\n  return {\n    shasum: createHash('sha1').update(buffer).digest('hex'),\n    integrity: `sha512-${createHash('sha512').update(buffer).digest('base64')}`,\n  };\n}\n"],"mappings":";;;;;;AAIA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,+BAA+B;AA6BxD,IAAa,qBAAqB;;;;;AAMlC,SAAgB,aAAa,aAAqB,SAAyB;CACzE,MAAM,UAAU,QAAQ,WAAW,GAAG,IAAI,QAAQ,WAAW,KAAK,KAAK,IAAI;CAC3E,OAAO,GAAG,YAAY,QAAQ,OAAO,EAAE,EAAE,GAAG;AAC9C;AAEA,eAAsB,eACpB,aACA,SACA,UAAiC,CAAC,GACN;CAC5B,MAAM,MAAM,aAAa,aAAa,OAAO;CAC7C,MAAM,UAAkC,CAAC;CACzC,IAAI,QAAQ,aACV,QAAQ,YAAY;CAEtB,IAAI,QAAQ,MACV,QAAQ,mBAAmB,QAAQ;CAErC,IAAI,QAAQ,OACV,QAAQ,mBAAmB,UAAU,QAAQ;CAE/C,QAAM,aAAa,KAAK,OAAO;CAK/B,IAAI,QAAQ,MACV,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,CAAA,GAAA,KAAA,IAAA,CAAI,KAAK,EAAE,QAAQ,IAAI,aAAa;GAClC,IAAI,OAAO;GACX,SAAS,YAAY,MAAM;GAC3B,SAAS,GAAG,SAAS,UAAW,QAAQ,KAAM;GAC9C,SAAS,GAAG,aAAa;IACvB,IAAI;IACJ,IAAI;KACF,OAAO,KAAK,MAAM,IAAI;IACxB,QAAQ;KACN,OAAO,KAAA;IACT;IACA,MAAM,kBAAkB,IAAI,QAAQ;IACpC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,SAAS,OAAO,GACzD,IAAI,UAAU,KAAA,GACZ,gBAAgB,IAAI,MAAM,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK;IAG7E,QAAQ;KAAE,QAAQ,SAAS,cAAc;KAAG,SAAS;KAAiB;IAAK,CAAC;GAC9E,CAAC;EACH,CAAC,CAAC,CAAC,GAAG,SAAS,MAAM;CACvB,CAAC;CAGH,MAAM,WAAW,MAAM,MAAM,KAAK,EAAE,QAAQ,CAAC;CAC7C,IAAI;CACJ,IAAI,SAAS,WAAW,KAAK;EAC3B,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,IAAI;GACF,OAAO,KAAK,MAAM,IAAI;EACxB,QAAQ;GACN,OAAO,KAAA;EACT;CACF;CACA,OAAO;EAAE,QAAQ,SAAS;EAAQ,SAAS,SAAS;EAAS;CAAK;AACpE;;;;;AAeA,eAAsB,gBACpB,KACA,UAAkC,CAAC,GACT;CAC1B,MAAM,UAAkC,CAAC;CACzC,IAAI,QAAQ,OACV,QAAQ,mBAAmB,UAAU,QAAQ;CAE/C,QAAM,oBAAoB,GAAG;CAC7B,MAAM,WAAW,MAAM,MAAM,KAAK;EAAE;EAAS,QAAQ,QAAQ;CAAO,CAAC;CAErE,MAAM,QAAA,GAAO,OAAA,WAAA,CAAW,MAAM;CAC9B,MAAM,UAAA,GAAS,OAAA,WAAA,CAAW,QAAQ;CAClC,IAAI,QAAQ;CACZ,IAAI,QAAQ;CAEZ,IAAI,SAAS,MACX,WAAW,MAAM,SAAS,SAAS,MAAa;EAC9C,MAAM,MAAM,OAAO,KAAK,KAAK;EAC7B,SAAS,IAAI;EACb,KAAK,OAAO,GAAG;EACf,OAAO,OAAO,GAAG;EACjB,IAAI,OAAO;GACT,QAAQ;GACR,QAAQ,eAAe;EACzB;EACA,QAAQ,UAAU,KAAK;CACzB;CAGF,OAAO;EACL,QAAQ,SAAS;EACjB,SAAS,SAAS;EAClB;EACA,MAAM,KAAK,OAAO,KAAK;EACvB,WAAW,UAAU,OAAO,OAAO,QAAQ;CAC7C;AACF;;AAGA,SAAgB,YAAY,QAAuD;CACjF,OAAO;EACL,SAAA,GAAQ,OAAA,WAAA,CAAW,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,OAAO,KAAK;EACtD,WAAW,WAAA,GAAU,OAAA,WAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,OAAO,QAAQ;CAC1E;AACF"}
+{"version":3,"file":"http-client.cjs","names":[],"sources":["../../../src/utils/http-client.ts"],"sourcesContent":["import { createHash } from 'crypto';\nimport buildDebug from 'debug';\nimport { get } from 'http';\n\nconst debug = buildDebug('verdaccio:e2e-cli:http-client');\n\nexport type PackumentResponse = {\n  status: number;\n  headers: Headers;\n  /** Parsed JSON body, or undefined when the response is not JSON (e.g. 304) */\n  body?: any;\n};\n\nexport type TarballDownload = {\n  status: number;\n  headers: Headers;\n  /** Total bytes received */\n  bytes: number;\n  /** hex-encoded sha1 of the received bytes (matches dist.shasum) */\n  sha1: string;\n  /** `sha512-<base64>` of the received bytes (matches dist.integrity) */\n  integrity: string;\n};\n\nexport type FetchPackumentOptions = {\n  /** Request the abbreviated (install) metadata format */\n  abbreviated?: boolean;\n  /** Send If-None-Match with this value */\n  etag?: string;\n  /** Bearer token */\n  token?: string;\n};\n\nexport const ABBREVIATED_ACCEPT = 'application/vnd.npm.install-v1+json';\n\n/**\n * Registry URL for a package name. Scoped names are encoded with the same\n * `%2f` form npm clients use: `@scope%2fname`.\n */\n/** `url` without trailing slashes; a loop instead of a regex, which CodeQL flags as ReDoS-prone. */\nexport function stripTrailingSlashes(url: string): string {\n  let end = url.length;\n  while (end > 0 && url[end - 1] === '/') end--;\n  return url.slice(0, end);\n}\n\nexport function packumentUrl(registryUrl: string, pkgName: string): string {\n  const encoded = pkgName.startsWith('@') ? pkgName.replaceAll('/', '%2f') : pkgName;\n  return `${registryUrl.replace(/\\/$/, '')}/${encoded}`;\n}\n\nexport async function fetchPackument(\n  registryUrl: string,\n  pkgName: string,\n  options: FetchPackumentOptions = {}\n): Promise<PackumentResponse> {\n  const url = packumentUrl(registryUrl, pkgName);\n  const headers: Record<string, string> = {};\n  if (options.abbreviated) {\n    headers['Accept'] = ABBREVIATED_ACCEPT;\n  }\n  if (options.etag) {\n    headers['If-None-Match'] = options.etag;\n  }\n  if (options.token) {\n    headers['Authorization'] = `Bearer ${options.token}`;\n  }\n  debug('GET %s %o', url, headers);\n\n  // Conditional requests must bypass fetch(): undici appends\n  // `cache-control: no-cache` whenever If-None-Match is present, which\n  // (correctly, per HTTP semantics) disables the server's 304 revalidation.\n  if (options.etag) {\n    return new Promise((resolve, reject) => {\n      get(url, { headers }, (response) => {\n        let text = '';\n        response.setEncoding('utf8');\n        response.on('data', (chunk) => (text += chunk));\n        response.on('end', () => {\n          let body: any;\n          try {\n            body = JSON.parse(text);\n          } catch {\n            body = undefined;\n          }\n          const responseHeaders = new Headers();\n          for (const [name, value] of Object.entries(response.headers)) {\n            if (value !== undefined) {\n              responseHeaders.set(name, Array.isArray(value) ? value.join(', ') : value);\n            }\n          }\n          resolve({ status: response.statusCode || 0, headers: responseHeaders, body });\n        });\n      }).on('error', reject);\n    });\n  }\n\n  const response = await fetch(url, { headers });\n  let body: any;\n  if (response.status !== 304) {\n    const text = await response.text();\n    try {\n      body = JSON.parse(text);\n    } catch {\n      body = undefined;\n    }\n  }\n  return { status: response.status, headers: response.headers, body };\n}\n\nexport type DownloadTarballOptions = {\n  signal?: AbortSignal;\n  token?: string;\n  /** Called after the first chunk of the body arrives (useful to abort mid-stream) */\n  onFirstChunk?: () => void;\n  /** Called after every chunk with the total bytes received so far (useful to abort at a threshold) */\n  onChunk?: (bytesReceived: number) => void;\n};\n\n/**\n * Download a tarball fully, computing sha1/sha512 integrity on the fly.\n * Rejects with the underlying error when aborted or the connection drops.\n */\nexport async function downloadTarball(\n  url: string,\n  options: DownloadTarballOptions = {}\n): Promise<TarballDownload> {\n  const headers: Record<string, string> = {};\n  if (options.token) {\n    headers['Authorization'] = `Bearer ${options.token}`;\n  }\n  debug('GET (tarball) %s', url);\n  const response = await fetch(url, { headers, signal: options.signal });\n\n  const sha1 = createHash('sha1');\n  const sha512 = createHash('sha512');\n  let bytes = 0;\n  let first = true;\n\n  if (response.body) {\n    for await (const chunk of response.body as any) {\n      const buf = Buffer.from(chunk);\n      bytes += buf.length;\n      sha1.update(buf);\n      sha512.update(buf);\n      if (first) {\n        first = false;\n        options.onFirstChunk?.();\n      }\n      options.onChunk?.(bytes);\n    }\n  }\n\n  return {\n    status: response.status,\n    headers: response.headers,\n    bytes,\n    sha1: sha1.digest('hex'),\n    integrity: `sha512-${sha512.digest('base64')}`,\n  };\n}\n\n/** Compute npm-style dist values (shasum/integrity) for a buffer. */\nexport function computeDist(buffer: Buffer): { shasum: string; integrity: string } {\n  return {\n    shasum: createHash('sha1').update(buffer).digest('hex'),\n    integrity: `sha512-${createHash('sha512').update(buffer).digest('base64')}`,\n  };\n}\n"],"mappings":";;;;;;AAIA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,+BAA+B;AA6BxD,IAAa,qBAAqB;;;;;;AAOlC,SAAgB,qBAAqB,KAAqB;CACxD,IAAI,MAAM,IAAI;CACd,OAAO,MAAM,KAAK,IAAI,MAAM,OAAO,KAAK;CACxC,OAAO,IAAI,MAAM,GAAG,GAAG;AACzB;AAEA,SAAgB,aAAa,aAAqB,SAAyB;CACzE,MAAM,UAAU,QAAQ,WAAW,GAAG,IAAI,QAAQ,WAAW,KAAK,KAAK,IAAI;CAC3E,OAAO,GAAG,YAAY,QAAQ,OAAO,EAAE,EAAE,GAAG;AAC9C;AAEA,eAAsB,eACpB,aACA,SACA,UAAiC,CAAC,GACN;CAC5B,MAAM,MAAM,aAAa,aAAa,OAAO;CAC7C,MAAM,UAAkC,CAAC;CACzC,IAAI,QAAQ,aACV,QAAQ,YAAY;CAEtB,IAAI,QAAQ,MACV,QAAQ,mBAAmB,QAAQ;CAErC,IAAI,QAAQ,OACV,QAAQ,mBAAmB,UAAU,QAAQ;CAE/C,QAAM,aAAa,KAAK,OAAO;CAK/B,IAAI,QAAQ,MACV,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,CAAA,GAAA,KAAA,IAAA,CAAI,KAAK,EAAE,QAAQ,IAAI,aAAa;GAClC,IAAI,OAAO;GACX,SAAS,YAAY,MAAM;GAC3B,SAAS,GAAG,SAAS,UAAW,QAAQ,KAAM;GAC9C,SAAS,GAAG,aAAa;IACvB,IAAI;IACJ,IAAI;KACF,OAAO,KAAK,MAAM,IAAI;IACxB,QAAQ;KACN,OAAO,KAAA;IACT;IACA,MAAM,kBAAkB,IAAI,QAAQ;IACpC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,SAAS,OAAO,GACzD,IAAI,UAAU,KAAA,GACZ,gBAAgB,IAAI,MAAM,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK;IAG7E,QAAQ;KAAE,QAAQ,SAAS,cAAc;KAAG,SAAS;KAAiB;IAAK,CAAC;GAC9E,CAAC;EACH,CAAC,CAAC,CAAC,GAAG,SAAS,MAAM;CACvB,CAAC;CAGH,MAAM,WAAW,MAAM,MAAM,KAAK,EAAE,QAAQ,CAAC;CAC7C,IAAI;CACJ,IAAI,SAAS,WAAW,KAAK;EAC3B,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,IAAI;GACF,OAAO,KAAK,MAAM,IAAI;EACxB,QAAQ;GACN,OAAO,KAAA;EACT;CACF;CACA,OAAO;EAAE,QAAQ,SAAS;EAAQ,SAAS,SAAS;EAAS;CAAK;AACpE;;;;;AAeA,eAAsB,gBACpB,KACA,UAAkC,CAAC,GACT;CAC1B,MAAM,UAAkC,CAAC;CACzC,IAAI,QAAQ,OACV,QAAQ,mBAAmB,UAAU,QAAQ;CAE/C,QAAM,oBAAoB,GAAG;CAC7B,MAAM,WAAW,MAAM,MAAM,KAAK;EAAE;EAAS,QAAQ,QAAQ;CAAO,CAAC;CAErE,MAAM,QAAA,GAAO,OAAA,WAAA,CAAW,MAAM;CAC9B,MAAM,UAAA,GAAS,OAAA,WAAA,CAAW,QAAQ;CAClC,IAAI,QAAQ;CACZ,IAAI,QAAQ;CAEZ,IAAI,SAAS,MACX,WAAW,MAAM,SAAS,SAAS,MAAa;EAC9C,MAAM,MAAM,OAAO,KAAK,KAAK;EAC7B,SAAS,IAAI;EACb,KAAK,OAAO,GAAG;EACf,OAAO,OAAO,GAAG;EACjB,IAAI,OAAO;GACT,QAAQ;GACR,QAAQ,eAAe;EACzB;EACA,QAAQ,UAAU,KAAK;CACzB;CAGF,OAAO;EACL,QAAQ,SAAS;EACjB,SAAS,SAAS;EAClB;EACA,MAAM,KAAK,OAAO,KAAK;EACvB,WAAW,UAAU,OAAO,OAAO,QAAQ;CAC7C;AACF;;AAGA,SAAgB,YAAY,QAAuD;CACjF,OAAO;EACL,SAAA,GAAQ,OAAA,WAAA,CAAW,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,OAAO,KAAK;EACtD,WAAW,WAAA,GAAU,OAAA,WAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,OAAO,QAAQ;CAC1E;AACF"}

package/build/cjs/utils/registry-client.cjs

@@ -49,8 +49,67 @@ async function pingRegistry(registryUrl) {
 		return false;
 	}
 }
+var LegacyLoginError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+	}
+};
+/**
+* Replays the legacy login the way each client sends it. npm and Yarn retry a
+* 409 with Basic (Yarn on the GET too); pnpm sends Basic on a single PUT. A
+* registry that authenticates the first PUT is accepted too.
+*/
+async function legacyLogin(registryUrl, user, password, client) {
+	const userUrl = `${registryUrl}/-/user/org.couchdb.user:${encodeURIComponent(user)}`;
+	const basic = `Basic ${Buffer.from(`${user}:${password}`).toString("base64")}`;
+	const jsonHeaders = { "Content-Type": "application/json" };
+	const body = {
+		_id: `org.couchdb.user:${user}`,
+		name: user,
+		password,
+		type: "user",
+		roles: [],
+		date: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	const put = (url, headers) => fetch(url, {
+		method: "PUT",
+		headers,
+		body: JSON.stringify(body)
+	});
+	const first = await put(userUrl, client === "pnpm" ? {
+		...jsonHeaders,
+		Authorization: basic,
+		"npm-auth-type": "web"
+	} : jsonHeaders);
+	const firstBody = await first.json();
+	if (first.ok && firstBody.token) {
+		debug$1("%s: first PUT authenticated %s", client, user);
+		return firstBody.token;
+	}
+	if (first.status !== 409) throw new LegacyLoginError(`first PUT answered ${first.status}`, first.status);
+	const current = await fetch(`${userUrl}?write=true`, { headers: client === "yarn" ? { Authorization: basic } : {} });
+	if (!current.ok) throw new LegacyLoginError(`GET answered ${current.status}`, current.status);
+	const currentBody = await current.json();
+	for (const [key, value] of Object.entries(currentBody)) if (!body[key] || key === "roles") body[key] = value;
+	const second = await put(`${userUrl}/-rev/${body._rev}`, {
+		...jsonHeaders,
+		Authorization: basic
+	});
+	const secondBody = await second.json();
+	if (!second.ok || !secondBody.token) throw new LegacyLoginError(`PUT with revision answered ${second.status}`, second.status);
+	return secondBody.token;
+}
+async function whoami(registryUrl, token) {
+	const response = await fetch(`${registryUrl}/-/whoami`, { headers: { Authorization: `Bearer ${token}` } });
+	return response.ok ? (await response.json()).username : void 0;
+}
 //#endregion
+exports.LegacyLoginError = LegacyLoginError;
 exports.createUser = createUser;
+exports.legacyLogin = legacyLogin;
 exports.pingRegistry = pingRegistry;
+exports.whoami = whoami;
 
 //# sourceMappingURL=registry-client.cjs.map

package/build/cjs/utils/registry-client.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"registry-client.cjs","names":[],"sources":["../../../src/utils/registry-client.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { ping } from '@verdaccio/registry-cli';\n\nconst debug = buildDebug('verdaccio:e2e-cli:registry-client');\n\nexport type RegistryAuth = {\n  token: string;\n  user: string;\n};\n\n/**\n * Creates a user on the registry and returns the auth token.\n * Uses a unique username per run to avoid 409 conflicts.\n * Works against any running Verdaccio instance with htpasswd auth.\n */\nexport async function createUser(\n  registryUrl: string,\n  user = `e2e-user-${Date.now()}`,\n  password = 'e2e-test-password'\n): Promise<RegistryAuth> {\n  debug('creating user %s on %s', user, registryUrl);\n  const url = `${registryUrl}/-/user/org.couchdb.user:${encodeURIComponent(user)}`;\n  const response = await fetch(url, {\n    method: 'PUT',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      name: user,\n      password,\n      _id: `org.couchdb.user:${user}`,\n      type: 'user',\n      roles: [],\n      date: new Date().toISOString(),\n    }),\n  });\n\n  const body = (await response.json()) as any;\n\n  if (response.status === 201 || response.status === 200 || response.status === 409) {\n    const token = body.token;\n    if (token) {\n      debug('user %s authenticated, token obtained', user);\n      return { token, user };\n    }\n  }\n\n  throw new Error(\n    `Failed to create/login user \"${user}\" on ${registryUrl}: ${response.status} ${JSON.stringify(body)}`\n  );\n}\n\n/**\n * Ping the registry to check it's alive.\n * Uses @verdaccio/registry-cli ping.\n */\nexport async function pingRegistry(registryUrl: string): Promise<boolean> {\n  debug('pinging %s', registryUrl);\n  try {\n    const result = await ping(registryUrl);\n    return result.ok;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;AAIA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,mCAAmC;;;;;;AAY5D,eAAsB,WACpB,aACA,OAAO,YAAY,KAAK,IAAI,KAC5B,WAAW,qBACY;CACvB,QAAM,0BAA0B,MAAM,WAAW;CACjD,MAAM,MAAM,GAAG,YAAY,2BAA2B,mBAAmB,IAAI;CAC7E,MAAM,WAAW,MAAM,MAAM,KAAK;EAChC,QAAQ;EACR,SAAS,EAAE,gBAAgB,mBAAmB;EAC9C,MAAM,KAAK,UAAU;GACnB,MAAM;GACN;GACA,KAAK,oBAAoB;GACzB,MAAM;GACN,OAAO,CAAC;GACR,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;EAC/B,CAAC;CACH,CAAC;CAED,MAAM,OAAQ,MAAM,SAAS,KAAK;CAElC,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,OAAO,SAAS,WAAW,KAAK;EACjF,MAAM,QAAQ,KAAK;EACnB,IAAI,OAAO;GACT,QAAM,yCAAyC,IAAI;GACnD,OAAO;IAAE;IAAO;GAAK;EACvB;CACF;CAEA,MAAM,IAAI,MACR,gCAAgC,KAAK,OAAO,YAAY,IAAI,SAAS,OAAO,GAAG,KAAK,UAAU,IAAI,GACpG;AACF;;;;;AAMA,eAAsB,aAAa,aAAuC;CACxE,QAAM,cAAc,WAAW;CAC/B,IAAI;EAEF,QAAO,OAAA,GADc,wBAAA,KAAA,CAAK,WAAW,EAAA,CACvB;CAChB,QAAQ;EACN,OAAO;CACT;AACF"}
+{"version":3,"file":"registry-client.cjs","names":[],"sources":["../../../src/utils/registry-client.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { ping } from '@verdaccio/registry-cli';\n\nconst debug = buildDebug('verdaccio:e2e-cli:registry-client');\n\nexport type RegistryAuth = {\n  token: string;\n  user: string;\n};\n\n/**\n * Creates a user on the registry and returns the auth token.\n * Uses a unique username per run to avoid 409 conflicts.\n * Works against any running Verdaccio instance with htpasswd auth.\n */\nexport async function createUser(\n  registryUrl: string,\n  user = `e2e-user-${Date.now()}`,\n  password = 'e2e-test-password'\n): Promise<RegistryAuth> {\n  debug('creating user %s on %s', user, registryUrl);\n  const url = `${registryUrl}/-/user/org.couchdb.user:${encodeURIComponent(user)}`;\n  const response = await fetch(url, {\n    method: 'PUT',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      name: user,\n      password,\n      _id: `org.couchdb.user:${user}`,\n      type: 'user',\n      roles: [],\n      date: new Date().toISOString(),\n    }),\n  });\n\n  const body = (await response.json()) as any;\n\n  if (response.status === 201 || response.status === 200 || response.status === 409) {\n    const token = body.token;\n    if (token) {\n      debug('user %s authenticated, token obtained', user);\n      return { token, user };\n    }\n  }\n\n  throw new Error(\n    `Failed to create/login user \"${user}\" on ${registryUrl}: ${response.status} ${JSON.stringify(body)}`\n  );\n}\n\n/**\n * Ping the registry to check it's alive.\n * Uses @verdaccio/registry-cli ping.\n */\nexport async function pingRegistry(registryUrl: string): Promise<boolean> {\n  debug('pinging %s', registryUrl);\n  try {\n    const result = await ping(registryUrl);\n    return result.ok;\n  } catch {\n    return false;\n  }\n}\n\nexport class LegacyLoginError extends Error {\n  constructor(\n    message: string,\n    readonly status: number\n  ) {\n    super(message);\n  }\n}\n\n/**\n * Replays the legacy login the way each client sends it. npm and Yarn retry a\n * 409 with Basic (Yarn on the GET too); pnpm sends Basic on a single PUT. A\n * registry that authenticates the first PUT is accepted too.\n */\nexport async function legacyLogin(\n  registryUrl: string,\n  user: string,\n  password: string,\n  client: 'npm' | 'yarn' | 'pnpm'\n): Promise<string> {\n  const userUrl = `${registryUrl}/-/user/org.couchdb.user:${encodeURIComponent(user)}`;\n  const basic = `Basic ${Buffer.from(`${user}:${password}`).toString('base64')}`;\n  const jsonHeaders = { 'Content-Type': 'application/json' };\n  const body: Record<string, unknown> = {\n    _id: `org.couchdb.user:${user}`,\n    name: user,\n    password,\n    type: 'user',\n    roles: [],\n    date: new Date().toISOString(),\n  };\n\n  const put = (url: string, headers: Record<string, string>) =>\n    fetch(url, { method: 'PUT', headers, body: JSON.stringify(body) });\n\n  const first = await put(\n    userUrl,\n    client === 'pnpm'\n      ? { ...jsonHeaders, Authorization: basic, 'npm-auth-type': 'web' }\n      : jsonHeaders\n  );\n  const firstBody = (await first.json()) as any;\n  if (first.ok && firstBody.token) {\n    debug('%s: first PUT authenticated %s', client, user);\n    return firstBody.token;\n  }\n  if (first.status !== 409) {\n    throw new LegacyLoginError(`first PUT answered ${first.status}`, first.status);\n  }\n\n  const current = await fetch(`${userUrl}?write=true`, {\n    headers: client === 'yarn' ? { Authorization: basic } : {},\n  });\n  if (!current.ok) {\n    throw new LegacyLoginError(`GET answered ${current.status}`, current.status);\n  }\n  const currentBody = (await current.json()) as Record<string, unknown>;\n  for (const [key, value] of Object.entries(currentBody)) {\n    if (!body[key] || key === 'roles') {\n      body[key] = value;\n    }\n  }\n\n  const second = await put(`${userUrl}/-rev/${body._rev}`, {\n    ...jsonHeaders,\n    Authorization: basic,\n  });\n  const secondBody = (await second.json()) as any;\n  if (!second.ok || !secondBody.token) {\n    throw new LegacyLoginError(`PUT with revision answered ${second.status}`, second.status);\n  }\n  return secondBody.token;\n}\n\nexport async function whoami(registryUrl: string, token: string): Promise<string | undefined> {\n  const response = await fetch(`${registryUrl}/-/whoami`, {\n    headers: { Authorization: `Bearer ${token}` },\n  });\n  return response.ok ? ((await response.json()) as any).username : undefined;\n}\n"],"mappings":";;;;;AAIA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,mCAAmC;;;;;;AAY5D,eAAsB,WACpB,aACA,OAAO,YAAY,KAAK,IAAI,KAC5B,WAAW,qBACY;CACvB,QAAM,0BAA0B,MAAM,WAAW;CACjD,MAAM,MAAM,GAAG,YAAY,2BAA2B,mBAAmB,IAAI;CAC7E,MAAM,WAAW,MAAM,MAAM,KAAK;EAChC,QAAQ;EACR,SAAS,EAAE,gBAAgB,mBAAmB;EAC9C,MAAM,KAAK,UAAU;GACnB,MAAM;GACN;GACA,KAAK,oBAAoB;GACzB,MAAM;GACN,OAAO,CAAC;GACR,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;EAC/B,CAAC;CACH,CAAC;CAED,MAAM,OAAQ,MAAM,SAAS,KAAK;CAElC,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,OAAO,SAAS,WAAW,KAAK;EACjF,MAAM,QAAQ,KAAK;EACnB,IAAI,OAAO;GACT,QAAM,yCAAyC,IAAI;GACnD,OAAO;IAAE;IAAO;GAAK;EACvB;CACF;CAEA,MAAM,IAAI,MACR,gCAAgC,KAAK,OAAO,YAAY,IAAI,SAAS,OAAO,GAAG,KAAK,UAAU,IAAI,GACpG;AACF;;;;;AAMA,eAAsB,aAAa,aAAuC;CACxE,QAAM,cAAc,WAAW;CAC/B,IAAI;EAEF,QAAO,OAAA,GADc,wBAAA,KAAA,CAAK,WAAW,EAAA,CACvB;CAChB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,IAAa,mBAAb,cAAsC,MAAM;CAG/B;CAFX,YACE,SACA,QACA;EACA,MAAM,OAAO;EAFJ,KAAA,SAAA;CAGX;AACF;;;;;;AAOA,eAAsB,YACpB,aACA,MACA,UACA,QACiB;CACjB,MAAM,UAAU,GAAG,YAAY,2BAA2B,mBAAmB,IAAI;CACjF,MAAM,QAAQ,SAAS,OAAO,KAAK,GAAG,KAAK,GAAG,UAAU,CAAC,CAAC,SAAS,QAAQ;CAC3E,MAAM,cAAc,EAAE,gBAAgB,mBAAmB;CACzD,MAAM,OAAgC;EACpC,KAAK,oBAAoB;EACzB,MAAM;EACN;EACA,MAAM;EACN,OAAO,CAAC;EACR,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;CAC/B;CAEA,MAAM,OAAO,KAAa,YACxB,MAAM,KAAK;EAAE,QAAQ;EAAO;EAAS,MAAM,KAAK,UAAU,IAAI;CAAE,CAAC;CAEnE,MAAM,QAAQ,MAAM,IAClB,SACA,WAAW,SACP;EAAE,GAAG;EAAa,eAAe;EAAO,iBAAiB;CAAM,IAC/D,WACN;CACA,MAAM,YAAa,MAAM,MAAM,KAAK;CACpC,IAAI,MAAM,MAAM,UAAU,OAAO;EAC/B,QAAM,kCAAkC,QAAQ,IAAI;EACpD,OAAO,UAAU;CACnB;CACA,IAAI,MAAM,WAAW,KACnB,MAAM,IAAI,iBAAiB,sBAAsB,MAAM,UAAU,MAAM,MAAM;CAG/E,MAAM,UAAU,MAAM,MAAM,GAAG,QAAQ,cAAc,EACnD,SAAS,WAAW,SAAS,EAAE,eAAe,MAAM,IAAI,CAAC,EAC3D,CAAC;CACD,IAAI,CAAC,QAAQ,IACX,MAAM,IAAI,iBAAiB,gBAAgB,QAAQ,UAAU,QAAQ,MAAM;CAE7E,MAAM,cAAe,MAAM,QAAQ,KAAK;CACxC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,WAAW,GACnD,IAAI,CAAC,KAAK,QAAQ,QAAQ,SACxB,KAAK,OAAO;CAIhB,MAAM,SAAS,MAAM,IAAI,GAAG,QAAQ,QAAQ,KAAK,QAAQ;EACvD,GAAG;EACH,eAAe;CACjB,CAAC;CACD,MAAM,aAAc,MAAM,OAAO,KAAK;CACtC,IAAI,CAAC,OAAO,MAAM,CAAC,WAAW,OAC5B,MAAM,IAAI,iBAAiB,8BAA8B,OAAO,UAAU,OAAO,MAAM;CAEzF,OAAO,WAAW;AACpB;AAEA,eAAsB,OAAO,aAAqB,OAA4C;CAC5F,MAAM,WAAW,MAAM,MAAM,GAAG,YAAY,YAAY,EACtD,SAAS,EAAE,eAAe,UAAU,QAAQ,EAC9C,CAAC;CACD,OAAO,SAAS,MAAO,MAAM,SAAS,KAAK,EAAA,CAAW,WAAW,KAAA;AACnE"}

package/build/esm/adapters/bun.js

@@ -40,7 +40,8 @@ function createBunAdapter(binPath, _version) {
 			return ["--cwd", folder];
 		},
 		exec(options, ...args) {
-			if (args[0] === "info") {
+			const cmd = args[0];
+			if (cmd === "info") {
 				const pkgName = args[1];
 				const cleaned = args.slice(2).filter((a) => a !== "--registry").filter((a) => !a.startsWith("http"));
 				return exec(options, bin, [
@@ -49,6 +50,7 @@ function createBunAdapter(binPath, _version) {
 					...cleaned
 				]);
 			}
+			if (cmd === "publish") return exec(options, bin, args.filter((a) => a !== "--json"));
 			return exec(options, bin, args);
 		},
 		async prepareProject(packageName, version, registryUrl, port, token, dependencies = {}, devDependencies = {}) {

package/build/esm/adapters/bun.js.map

@@ -1 +1 @@
-{"version":3,"file":"bun.js","names":[],"sources":["../../../src/adapters/bun.ts"],"sourcesContent":["import { SpawnOptions, execSync } from 'child_process';\nimport buildDebug from 'debug';\n\nimport { ExecOutput, PackageManagerAdapter } from '../types';\nimport { exec } from '../utils/process';\nimport { prepareGenericEmptyProject } from '../utils/project';\n\nconst debug = buildDebug('verdaccio:e2e-cli:bun');\n\nconst BUN_SUPPORTED_COMMANDS = new Set(['publish', 'install', 'info', 'audit']);\n\nfunction detectVersion(bin: string): string {\n  try {\n    return execSync(`${bin} --version`, { encoding: 'utf8', timeout: 5000 }).trim();\n  } catch {\n    return 'unknown';\n  }\n}\n\nfunction resolveBunBin(binPath?: string): string {\n  if (binPath) return binPath;\n  return 'bun';\n}\n\nexport function createBunAdapter(binPath?: string, _version?: string): PackageManagerAdapter {\n  const bin = resolveBunBin(binPath);\n  const resolved = detectVersion(bin);\n  debug('creating bun adapter with bin: %s (%s)', bin, resolved);\n\n  const adapter: PackageManagerAdapter = {\n    name: `bun@${resolved}`,\n    type: 'bun',\n    bin,\n    supports: BUN_SUPPORTED_COMMANDS,\n\n    registryArg(url: string): string[] {\n      return ['--registry', url];\n    },\n\n    prefixArg(folder: string): string[] {\n      return ['--cwd', folder];\n    },\n\n    exec(options: SpawnOptions, ...args: string[]): Promise<ExecOutput> {\n      const cmd = args[0];\n\n      if (cmd === 'info') {\n        // bun info <pkg> reads registry from .npmrc, strip --registry <url>\n        const pkgName = args[1];\n        const filteredArgs = args.slice(2).filter((a) => a !== '--registry');\n        // also remove the URL that follows --registry\n        const cleaned = filteredArgs.filter((a) => !a.startsWith('http'));\n        return exec(options, bin, ['info', pkgName, ...cleaned]);\n      }\n\n      return exec(options, bin, args);\n    },\n\n    async prepareProject(\n      packageName: string,\n      version: string,\n      registryUrl: string,\n      port: number,\n      token: string,\n      dependencies: Record<string, string> = {},\n      devDependencies: Record<string, string> = {}\n    ): Promise<{ tempFolder: string }> {\n      return prepareGenericEmptyProject(\n        packageName,\n        version,\n        port,\n        token,\n        registryUrl,\n        dependencies,\n        devDependencies\n      );\n    },\n  };\n\n  return adapter;\n}\n"],"mappings":";;;;;AAOA,IAAM,QAAQ,WAAW,uBAAuB;AAEhD,IAAM,yCAAyB,IAAI,IAAI;CAAC;CAAW;CAAW;CAAQ;AAAO,CAAC;AAE9E,SAAS,cAAc,KAAqB;CAC1C,IAAI;EACF,OAAO,SAAS,GAAG,IAAI,aAAa;GAAE,UAAU;GAAQ,SAAS;EAAK,CAAC,CAAC,CAAC,KAAK;CAChF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,cAAc,SAA0B;CAC/C,IAAI,SAAS,OAAO;CACpB,OAAO;AACT;AAEA,SAAgB,iBAAiB,SAAkB,UAA0C;CAC3F,MAAM,MAAM,cAAc,OAAO;CACjC,MAAM,WAAW,cAAc,GAAG;CAClC,MAAM,0CAA0C,KAAK,QAAQ;CAoD7D,OAAO;EAjDL,MAAM,OAAO;EACb,MAAM;EACN;EACA,UAAU;EAEV,YAAY,KAAuB;GACjC,OAAO,CAAC,cAAc,GAAG;EAC3B;EAEA,UAAU,QAA0B;GAClC,OAAO,CAAC,SAAS,MAAM;EACzB;EAEA,KAAK,SAAuB,GAAG,MAAqC;GAGlE,IAFY,KAAK,OAEL,QAAQ;IAElB,MAAM,UAAU,KAAK;IAGrB,MAAM,UAFe,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,MAAM,MAAM,YAEvC,CAAA,CAAa,QAAQ,MAAM,CAAC,EAAE,WAAW,MAAM,CAAC;IAChE,OAAO,KAAK,SAAS,KAAK;KAAC;KAAQ;KAAS,GAAG;IAAO,CAAC;GACzD;GAEA,OAAO,KAAK,SAAS,KAAK,IAAI;EAChC;EAEA,MAAM,eACJ,aACA,SACA,aACA,MACA,OACA,eAAuC,CAAC,GACxC,kBAA0C,CAAC,GACV;GACjC,OAAO,2BACL,aACA,SACA,MACA,OACA,aACA,cACA,eACF;EACF;CAGK;AACT"}
+{"version":3,"file":"bun.js","names":[],"sources":["../../../src/adapters/bun.ts"],"sourcesContent":["import { SpawnOptions, execSync } from 'child_process';\nimport buildDebug from 'debug';\n\nimport { ExecOutput, PackageManagerAdapter } from '../types';\nimport { exec } from '../utils/process';\nimport { prepareGenericEmptyProject } from '../utils/project';\n\nconst debug = buildDebug('verdaccio:e2e-cli:bun');\n\nconst BUN_SUPPORTED_COMMANDS = new Set(['publish', 'install', 'info', 'audit']);\n\nfunction detectVersion(bin: string): string {\n  try {\n    return execSync(`${bin} --version`, { encoding: 'utf8', timeout: 5000 }).trim();\n  } catch {\n    return 'unknown';\n  }\n}\n\nfunction resolveBunBin(binPath?: string): string {\n  if (binPath) return binPath;\n  return 'bun';\n}\n\nexport function createBunAdapter(binPath?: string, _version?: string): PackageManagerAdapter {\n  const bin = resolveBunBin(binPath);\n  const resolved = detectVersion(bin);\n  debug('creating bun adapter with bin: %s (%s)', bin, resolved);\n\n  const adapter: PackageManagerAdapter = {\n    name: `bun@${resolved}`,\n    type: 'bun',\n    bin,\n    supports: BUN_SUPPORTED_COMMANDS,\n\n    registryArg(url: string): string[] {\n      return ['--registry', url];\n    },\n\n    prefixArg(folder: string): string[] {\n      return ['--cwd', folder];\n    },\n\n    exec(options: SpawnOptions, ...args: string[]): Promise<ExecOutput> {\n      const cmd = args[0];\n\n      if (cmd === 'info') {\n        // bun info <pkg> reads registry from .npmrc, strip --registry <url>\n        const pkgName = args[1];\n        const filteredArgs = args.slice(2).filter((a) => a !== '--registry');\n        // also remove the URL that follows --registry\n        const cleaned = filteredArgs.filter((a) => !a.startsWith('http'));\n        return exec(options, bin, ['info', pkgName, ...cleaned]);\n      }\n\n      if (cmd === 'publish') {\n        // bun 1.4.4 rejects `publish --json`; the publish test only checks the exit code for bun\n        return exec(\n          options,\n          bin,\n          args.filter((a) => a !== '--json')\n        );\n      }\n\n      return exec(options, bin, args);\n    },\n\n    async prepareProject(\n      packageName: string,\n      version: string,\n      registryUrl: string,\n      port: number,\n      token: string,\n      dependencies: Record<string, string> = {},\n      devDependencies: Record<string, string> = {}\n    ): Promise<{ tempFolder: string }> {\n      return prepareGenericEmptyProject(\n        packageName,\n        version,\n        port,\n        token,\n        registryUrl,\n        dependencies,\n        devDependencies\n      );\n    },\n  };\n\n  return adapter;\n}\n"],"mappings":";;;;;AAOA,IAAM,QAAQ,WAAW,uBAAuB;AAEhD,IAAM,yCAAyB,IAAI,IAAI;CAAC;CAAW;CAAW;CAAQ;AAAO,CAAC;AAE9E,SAAS,cAAc,KAAqB;CAC1C,IAAI;EACF,OAAO,SAAS,GAAG,IAAI,aAAa;GAAE,UAAU;GAAQ,SAAS;EAAK,CAAC,CAAC,CAAC,KAAK;CAChF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,cAAc,SAA0B;CAC/C,IAAI,SAAS,OAAO;CACpB,OAAO;AACT;AAEA,SAAgB,iBAAiB,SAAkB,UAA0C;CAC3F,MAAM,MAAM,cAAc,OAAO;CACjC,MAAM,WAAW,cAAc,GAAG;CAClC,MAAM,0CAA0C,KAAK,QAAQ;CA6D7D,OAAO;EA1DL,MAAM,OAAO;EACb,MAAM;EACN;EACA,UAAU;EAEV,YAAY,KAAuB;GACjC,OAAO,CAAC,cAAc,GAAG;EAC3B;EAEA,UAAU,QAA0B;GAClC,OAAO,CAAC,SAAS,MAAM;EACzB;EAEA,KAAK,SAAuB,GAAG,MAAqC;GAClE,MAAM,MAAM,KAAK;GAEjB,IAAI,QAAQ,QAAQ;IAElB,MAAM,UAAU,KAAK;IAGrB,MAAM,UAFe,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,MAAM,MAAM,YAEvC,CAAA,CAAa,QAAQ,MAAM,CAAC,EAAE,WAAW,MAAM,CAAC;IAChE,OAAO,KAAK,SAAS,KAAK;KAAC;KAAQ;KAAS,GAAG;IAAO,CAAC;GACzD;GAEA,IAAI,QAAQ,WAEV,OAAO,KACL,SACA,KACA,KAAK,QAAQ,MAAM,MAAM,QAAQ,CACnC;GAGF,OAAO,KAAK,SAAS,KAAK,IAAI;EAChC;EAEA,MAAM,eACJ,aACA,SACA,aACA,MACA,OACA,eAAuC,CAAC,GACxC,kBAA0C,CAAC,GACV;GACjC,OAAO,2BACL,aACA,SACA,MACA,OACA,aACA,cACA,eACF;EACF;CAGK;AACT"}

package/build/esm/adapters/pnpm.js

@@ -6,18 +6,7 @@ import { join } from "path";
 import { writeFile } from "fs/promises";
 //#region src/adapters/pnpm.ts
 var debug = buildDebug("verdaccio:e2e-cli:pnpm");
-var PNPM_V10_COMMANDS = /* @__PURE__ */ new Set([
-	"publish",
-	"unpublish",
-	"install",
-	"info",
-	"audit",
-	"deprecate",
-	"dist-tag",
-	"ping",
-	"search"
-]);
-var PNPM_V11_COMMANDS = /* @__PURE__ */ new Set([
+var PNPM_COMMANDS = /* @__PURE__ */ new Set([
 	"publish",
 	"unpublish",
 	"install",
@@ -25,15 +14,7 @@ var PNPM_V11_COMMANDS = /* @__PURE__ */ new Set([
 	"audit",
 	"deprecate"
 ]);
-function getSupportedCommands(version) {
-	const major = parseInt(version.split(".")[0], 10);
-	if (major >= 11) {
-		debug("pnpm v%d detected, using v11 command set", major);
-		return PNPM_V11_COMMANDS;
-	}
-	return PNPM_V10_COMMANDS;
-}
-var PNPM_MIN_SUPPORTED_MAJOR = 10;
+var PNPM_MIN_SUPPORTED_MAJOR = 11;
 function detectVersion(bin) {
 	try {
 		return execSync(`${bin} --version`, {
@@ -76,7 +57,7 @@ function createPnpmAdapter(binPath, version) {
 		name: `pnpm@${resolved}`,
 		type: "pnpm",
 		bin,
-		supports: getSupportedCommands(resolved),
+		supports: PNPM_COMMANDS,
 		registryArg(url) {
 			return ["--registry", url];
 		},

package/build/esm/adapters/pnpm.js.map

@@ -1 +1 @@
-{"version":3,"file":"pnpm.js","names":[],"sources":["../../../src/adapters/pnpm.ts"],"sourcesContent":["import { SpawnOptions, execSync } from 'child_process';\nimport buildDebug from 'debug';\nimport { writeFile } from 'fs/promises';\nimport { join } from 'path';\n\nimport { ExecOutput, PackageManagerAdapter } from '../types';\nimport { exec } from '../utils/process';\nimport { prepareGenericEmptyProject } from '../utils/project';\n\nconst debug = buildDebug('verdaccio:e2e-cli:pnpm');\n\nconst PNPM_V10_COMMANDS = new Set([\n  'publish',\n  'unpublish',\n  'install',\n  'info',\n  'audit',\n  'deprecate',\n  'dist-tag',\n  'ping',\n  'search',\n]);\n\n// pnpm v11 removed ping and search\n// dist-tag output format changed (no --json), needs adapted assertions\nconst PNPM_V11_COMMANDS = new Set([\n  'publish',\n  'unpublish',\n  'install',\n  'info',\n  'audit',\n  'deprecate',\n]);\n\nfunction getSupportedCommands(version: string): Set<string> {\n  const major = parseInt(version.split('.')[0], 10);\n  if (major >= 11) {\n    debug('pnpm v%d detected, using v11 command set', major);\n    return PNPM_V11_COMMANDS;\n  }\n  return PNPM_V10_COMMANDS;\n}\n\n// pnpm 8 and 9 are end-of-life and no longer supported by the suite.\nconst PNPM_MIN_SUPPORTED_MAJOR = 10;\n\nfunction detectVersion(bin: string): string {\n  try {\n    return execSync(`${bin} --version`, { encoding: 'utf8', timeout: 5000 }).trim();\n  } catch {\n    return 'unknown';\n  }\n}\n\nfunction assertSupportedVersion(resolved: string): void {\n  const major = parseInt(resolved.split('.')[0], 10);\n  if (!Number.isNaN(major) && major < PNPM_MIN_SUPPORTED_MAJOR) {\n    throw new Error(\n      `pnpm@${resolved} is not supported. Minimum supported major: ${PNPM_MIN_SUPPORTED_MAJOR}`\n    );\n  }\n}\n\nfunction installPnpm(version: string): string {\n  const pkg = `pnpm@${version}`;\n  debug('installing %s into temp dir', pkg);\n  const tmpDir = execSync('mktemp -d', { encoding: 'utf8' }).trim();\n  execSync(`npm install --prefix \"${tmpDir}\" ${pkg} --loglevel=error`, {\n    encoding: 'utf8',\n    timeout: 30000,\n  });\n  const bin = `${tmpDir}/node_modules/.bin/pnpm`;\n  const installed = detectVersion(bin);\n  debug('installed pnpm %s at %s', installed, bin);\n  console.log(`  Auto-installed pnpm ${installed}`);\n  return bin;\n}\n\nfunction resolvePnpmBin(binPath?: string, version?: string): string {\n  if (binPath) return binPath;\n  if (version) return installPnpm(version);\n  return 'pnpm';\n}\n\nexport function createPnpmAdapter(binPath?: string, version?: string): PackageManagerAdapter {\n  const bin = resolvePnpmBin(binPath, version);\n  const resolved = detectVersion(bin);\n  assertSupportedVersion(resolved);\n  debug('creating pnpm adapter with bin: %s (%s)', bin, resolved);\n\n  const adapter: PackageManagerAdapter = {\n    name: `pnpm@${resolved}`,\n    type: 'pnpm',\n    bin,\n    supports: getSupportedCommands(resolved),\n\n    registryArg(url: string): string[] {\n      return ['--registry', url];\n    },\n\n    prefixArg(folder: string): string[] {\n      return ['--prefix', folder];\n    },\n\n    exec(options: SpawnOptions, ...args: string[]): Promise<ExecOutput> {\n      const major = parseInt(resolved.split('.')[0], 10);\n      if (major >= 11) {\n        // pnpm v11: native deprecate/unpublish don't support --json\n        const cmd = args[0];\n        if (cmd === 'deprecate' || cmd === 'unpublish' || cmd === 'publish' || cmd === 'dist-tag') {\n          args = args.filter((a) => a !== '--json' && !a.startsWith('--loglevel'));\n        }\n        // pnpm v11: un-deprecate uses `undeprecate` command instead of `deprecate pkg \"\"`\n        if (cmd === 'deprecate') {\n          // Check if message arg is empty string (un-deprecate)\n          // args: ['deprecate', 'pkg@version', '', ...flags]\n          const msgIdx = 2; // message is the third arg\n          if (args.length > msgIdx && args[msgIdx] === '') {\n            args = ['undeprecate', args[1], ...args.slice(3)];\n          }\n        }\n        // pnpm v11: native version command doesn't accept --registry, --loglevel, or --no--git-tag-version\n        if (cmd === 'version') {\n          args = args.filter(\n            (a) =>\n              !a.startsWith('--registry') &&\n              !a.startsWith('--loglevel') &&\n              !a.startsWith('--no--git-tag-version')\n          );\n        }\n      }\n      return exec(options, bin, args);\n    },\n\n    async prepareProject(\n      packageName: string,\n      version: string,\n      registryUrl: string,\n      port: number,\n      token: string,\n      dependencies: Record<string, string> = {},\n      devDependencies: Record<string, string> = {}\n    ): Promise<{ tempFolder: string }> {\n      const project = await prepareGenericEmptyProject(\n        packageName,\n        version,\n        port,\n        token,\n        registryUrl,\n        dependencies,\n        devDependencies\n      );\n      // pnpm 11.24+ enforces a minimumReleaseAge cooldown by default, which\n      // rejects the just-published packages these tests install\n      // (ERR_PNPM_NO_MATURE_MATCHING_VERSION). Disable it per project via\n      // pnpm-workspace.yaml — the file also marks the temp folder as its own\n      // workspace root, isolating it from any parent workspace. Tests that\n      // exercise the cooldown itself overwrite this file with their own config.\n      await writeFile(join(project.tempFolder, 'pnpm-workspace.yaml'), 'minimumReleaseAge: 0\\n');\n      return project;\n    },\n  };\n\n  return adapter;\n}\n"],"mappings":";;;;;;;AASA,IAAM,QAAQ,WAAW,wBAAwB;AAEjD,IAAM,oCAAoB,IAAI,IAAI;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAID,IAAM,oCAAoB,IAAI,IAAI;CAChC;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,qBAAqB,SAA8B;CAC1D,MAAM,QAAQ,SAAS,QAAQ,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE;CAChD,IAAI,SAAS,IAAI;EACf,MAAM,4CAA4C,KAAK;EACvD,OAAO;CACT;CACA,OAAO;AACT;AAGA,IAAM,2BAA2B;AAEjC,SAAS,cAAc,KAAqB;CAC1C,IAAI;EACF,OAAO,SAAS,GAAG,IAAI,aAAa;GAAE,UAAU;GAAQ,SAAS;EAAK,CAAC,CAAC,CAAC,KAAK;CAChF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,uBAAuB,UAAwB;CACtD,MAAM,QAAQ,SAAS,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE;CACjD,IAAI,CAAC,OAAO,MAAM,KAAK,KAAK,QAAQ,0BAClC,MAAM,IAAI,MACR,QAAQ,SAAS,8CAA8C,0BACjE;AAEJ;AAEA,SAAS,YAAY,SAAyB;CAC5C,MAAM,MAAM,QAAQ;CACpB,MAAM,+BAA+B,GAAG;CACxC,MAAM,SAAS,SAAS,aAAa,EAAE,UAAU,OAAO,CAAC,CAAC,CAAC,KAAK;CAChE,SAAS,yBAAyB,OAAO,IAAI,IAAI,oBAAoB;EACnE,UAAU;EACV,SAAS;CACX,CAAC;CACD,MAAM,MAAM,GAAG,OAAO;CACtB,MAAM,YAAY,cAAc,GAAG;CACnC,MAAM,2BAA2B,WAAW,GAAG;CAC/C,QAAQ,IAAI,yBAAyB,WAAW;CAChD,OAAO;AACT;AAEA,SAAS,eAAe,SAAkB,SAA0B;CAClE,IAAI,SAAS,OAAO;CACpB,IAAI,SAAS,OAAO,YAAY,OAAO;CACvC,OAAO;AACT;AAEA,SAAgB,kBAAkB,SAAkB,SAAyC;CAC3F,MAAM,MAAM,eAAe,SAAS,OAAO;CAC3C,MAAM,WAAW,cAAc,GAAG;CAClC,uBAAuB,QAAQ;CAC/B,MAAM,2CAA2C,KAAK,QAAQ;CA2E9D,OAAO;EAxEL,MAAM,QAAQ;EACd,MAAM;EACN;EACA,UAAU,qBAAqB,QAAQ;EAEvC,YAAY,KAAuB;GACjC,OAAO,CAAC,cAAc,GAAG;EAC3B;EAEA,UAAU,QAA0B;GAClC,OAAO,CAAC,YAAY,MAAM;EAC5B;EAEA,KAAK,SAAuB,GAAG,MAAqC;GAElE,IADc,SAAS,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,EAC3C,KAAS,IAAI;IAEf,MAAM,MAAM,KAAK;IACjB,IAAI,QAAQ,eAAe,QAAQ,eAAe,QAAQ,aAAa,QAAQ,YAC7E,OAAO,KAAK,QAAQ,MAAM,MAAM,YAAY,CAAC,EAAE,WAAW,YAAY,CAAC;IAGzE,IAAI,QAAQ,aAAa;KAGvB,MAAM,SAAS;KACf,IAAI,KAAK,SAAS,UAAU,KAAK,YAAY,IAC3C,OAAO;MAAC;MAAe,KAAK;MAAI,GAAG,KAAK,MAAM,CAAC;KAAC;IAEpD;IAEA,IAAI,QAAQ,WACV,OAAO,KAAK,QACT,MACC,CAAC,EAAE,WAAW,YAAY,KAC1B,CAAC,EAAE,WAAW,YAAY,KAC1B,CAAC,EAAE,WAAW,uBAAuB,CACzC;GAEJ;GACA,OAAO,KAAK,SAAS,KAAK,IAAI;EAChC;EAEA,MAAM,eACJ,aACA,SACA,aACA,MACA,OACA,eAAuC,CAAC,GACxC,kBAA0C,CAAC,GACV;GACjC,MAAM,UAAU,MAAM,2BACpB,aACA,SACA,MACA,OACA,aACA,cACA,eACF;GAOA,MAAM,UAAU,KAAK,QAAQ,YAAY,qBAAqB,GAAG,wBAAwB;GACzF,OAAO;EACT;CAGK;AACT"}
+{"version":3,"file":"pnpm.js","names":[],"sources":["../../../src/adapters/pnpm.ts"],"sourcesContent":["import { SpawnOptions, execSync } from 'child_process';\nimport buildDebug from 'debug';\nimport { writeFile } from 'fs/promises';\nimport { join } from 'path';\n\nimport { ExecOutput, PackageManagerAdapter } from '../types';\nimport { exec } from '../utils/process';\nimport { prepareGenericEmptyProject } from '../utils/project';\n\nconst debug = buildDebug('verdaccio:e2e-cli:pnpm');\n\n// pnpm removed ping and search; the dist-tag output changed (no --json) and needs adapted assertions\nconst PNPM_COMMANDS = new Set(['publish', 'unpublish', 'install', 'info', 'audit', 'deprecate']);\n\n// pnpm 8, 9 and 10 are no longer supported by the suite.\nconst PNPM_MIN_SUPPORTED_MAJOR = 11;\n\nfunction detectVersion(bin: string): string {\n  try {\n    return execSync(`${bin} --version`, { encoding: 'utf8', timeout: 5000 }).trim();\n  } catch {\n    return 'unknown';\n  }\n}\n\nfunction assertSupportedVersion(resolved: string): void {\n  const major = parseInt(resolved.split('.')[0], 10);\n  if (!Number.isNaN(major) && major < PNPM_MIN_SUPPORTED_MAJOR) {\n    throw new Error(\n      `pnpm@${resolved} is not supported. Minimum supported major: ${PNPM_MIN_SUPPORTED_MAJOR}`\n    );\n  }\n}\n\nfunction installPnpm(version: string): string {\n  const pkg = `pnpm@${version}`;\n  debug('installing %s into temp dir', pkg);\n  const tmpDir = execSync('mktemp -d', { encoding: 'utf8' }).trim();\n  execSync(`npm install --prefix \"${tmpDir}\" ${pkg} --loglevel=error`, {\n    encoding: 'utf8',\n    timeout: 30000,\n  });\n  const bin = `${tmpDir}/node_modules/.bin/pnpm`;\n  const installed = detectVersion(bin);\n  debug('installed pnpm %s at %s', installed, bin);\n  console.log(`  Auto-installed pnpm ${installed}`);\n  return bin;\n}\n\nfunction resolvePnpmBin(binPath?: string, version?: string): string {\n  if (binPath) return binPath;\n  if (version) return installPnpm(version);\n  return 'pnpm';\n}\n\nexport function createPnpmAdapter(binPath?: string, version?: string): PackageManagerAdapter {\n  const bin = resolvePnpmBin(binPath, version);\n  const resolved = detectVersion(bin);\n  assertSupportedVersion(resolved);\n  debug('creating pnpm adapter with bin: %s (%s)', bin, resolved);\n\n  const adapter: PackageManagerAdapter = {\n    name: `pnpm@${resolved}`,\n    type: 'pnpm',\n    bin,\n    supports: PNPM_COMMANDS,\n\n    registryArg(url: string): string[] {\n      return ['--registry', url];\n    },\n\n    prefixArg(folder: string): string[] {\n      return ['--prefix', folder];\n    },\n\n    exec(options: SpawnOptions, ...args: string[]): Promise<ExecOutput> {\n      const major = parseInt(resolved.split('.')[0], 10);\n      if (major >= 11) {\n        // pnpm v11: native deprecate/unpublish don't support --json\n        const cmd = args[0];\n        if (cmd === 'deprecate' || cmd === 'unpublish' || cmd === 'publish' || cmd === 'dist-tag') {\n          args = args.filter((a) => a !== '--json' && !a.startsWith('--loglevel'));\n        }\n        // pnpm v11: un-deprecate uses `undeprecate` command instead of `deprecate pkg \"\"`\n        if (cmd === 'deprecate') {\n          // Check if message arg is empty string (un-deprecate)\n          // args: ['deprecate', 'pkg@version', '', ...flags]\n          const msgIdx = 2; // message is the third arg\n          if (args.length > msgIdx && args[msgIdx] === '') {\n            args = ['undeprecate', args[1], ...args.slice(3)];\n          }\n        }\n        // pnpm v11: native version command doesn't accept --registry, --loglevel, or --no--git-tag-version\n        if (cmd === 'version') {\n          args = args.filter(\n            (a) =>\n              !a.startsWith('--registry') &&\n              !a.startsWith('--loglevel') &&\n              !a.startsWith('--no--git-tag-version')\n          );\n        }\n      }\n      return exec(options, bin, args);\n    },\n\n    async prepareProject(\n      packageName: string,\n      version: string,\n      registryUrl: string,\n      port: number,\n      token: string,\n      dependencies: Record<string, string> = {},\n      devDependencies: Record<string, string> = {}\n    ): Promise<{ tempFolder: string }> {\n      const project = await prepareGenericEmptyProject(\n        packageName,\n        version,\n        port,\n        token,\n        registryUrl,\n        dependencies,\n        devDependencies\n      );\n      // pnpm 11.24+ enforces a minimumReleaseAge cooldown by default, which\n      // rejects the just-published packages these tests install\n      // (ERR_PNPM_NO_MATURE_MATCHING_VERSION). Disable it per project via\n      // pnpm-workspace.yaml — the file also marks the temp folder as its own\n      // workspace root, isolating it from any parent workspace. Tests that\n      // exercise the cooldown itself overwrite this file with their own config.\n      await writeFile(join(project.tempFolder, 'pnpm-workspace.yaml'), 'minimumReleaseAge: 0\\n');\n      return project;\n    },\n  };\n\n  return adapter;\n}\n"],"mappings":";;;;;;;AASA,IAAM,QAAQ,WAAW,wBAAwB;AAGjD,IAAM,gCAAgB,IAAI,IAAI;CAAC;CAAW;CAAa;CAAW;CAAQ;CAAS;AAAW,CAAC;AAG/F,IAAM,2BAA2B;AAEjC,SAAS,cAAc,KAAqB;CAC1C,IAAI;EACF,OAAO,SAAS,GAAG,IAAI,aAAa;GAAE,UAAU;GAAQ,SAAS;EAAK,CAAC,CAAC,CAAC,KAAK;CAChF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,uBAAuB,UAAwB;CACtD,MAAM,QAAQ,SAAS,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE;CACjD,IAAI,CAAC,OAAO,MAAM,KAAK,KAAK,QAAQ,0BAClC,MAAM,IAAI,MACR,QAAQ,SAAS,8CAA8C,0BACjE;AAEJ;AAEA,SAAS,YAAY,SAAyB;CAC5C,MAAM,MAAM,QAAQ;CACpB,MAAM,+BAA+B,GAAG;CACxC,MAAM,SAAS,SAAS,aAAa,EAAE,UAAU,OAAO,CAAC,CAAC,CAAC,KAAK;CAChE,SAAS,yBAAyB,OAAO,IAAI,IAAI,oBAAoB;EACnE,UAAU;EACV,SAAS;CACX,CAAC;CACD,MAAM,MAAM,GAAG,OAAO;CACtB,MAAM,YAAY,cAAc,GAAG;CACnC,MAAM,2BAA2B,WAAW,GAAG;CAC/C,QAAQ,IAAI,yBAAyB,WAAW;CAChD,OAAO;AACT;AAEA,SAAS,eAAe,SAAkB,SAA0B;CAClE,IAAI,SAAS,OAAO;CACpB,IAAI,SAAS,OAAO,YAAY,OAAO;CACvC,OAAO;AACT;AAEA,SAAgB,kBAAkB,SAAkB,SAAyC;CAC3F,MAAM,MAAM,eAAe,SAAS,OAAO;CAC3C,MAAM,WAAW,cAAc,GAAG;CAClC,uBAAuB,QAAQ;CAC/B,MAAM,2CAA2C,KAAK,QAAQ;CA2E9D,OAAO;EAxEL,MAAM,QAAQ;EACd,MAAM;EACN;EACA,UAAU;EAEV,YAAY,KAAuB;GACjC,OAAO,CAAC,cAAc,GAAG;EAC3B;EAEA,UAAU,QAA0B;GAClC,OAAO,CAAC,YAAY,MAAM;EAC5B;EAEA,KAAK,SAAuB,GAAG,MAAqC;GAElE,IADc,SAAS,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,EAC3C,KAAS,IAAI;IAEf,MAAM,MAAM,KAAK;IACjB,IAAI,QAAQ,eAAe,QAAQ,eAAe,QAAQ,aAAa,QAAQ,YAC7E,OAAO,KAAK,QAAQ,MAAM,MAAM,YAAY,CAAC,EAAE,WAAW,YAAY,CAAC;IAGzE,IAAI,QAAQ,aAAa;KAGvB,MAAM,SAAS;KACf,IAAI,KAAK,SAAS,UAAU,KAAK,YAAY,IAC3C,OAAO;MAAC;MAAe,KAAK;MAAI,GAAG,KAAK,MAAM,CAAC;KAAC;IAEpD;IAEA,IAAI,QAAQ,WACV,OAAO,KAAK,QACT,MACC,CAAC,EAAE,WAAW,YAAY,KAC1B,CAAC,EAAE,WAAW,YAAY,KAC1B,CAAC,EAAE,WAAW,uBAAuB,CACzC;GAEJ;GACA,OAAO,KAAK,SAAS,KAAK,IAAI;EAChC;EAEA,MAAM,eACJ,aACA,SACA,aACA,MACA,OACA,eAAuC,CAAC,GACxC,kBAA0C,CAAC,GACV;GACjC,MAAM,UAAU,MAAM,2BACpB,aACA,SACA,MACA,OACA,aACA,cACA,eACF;GAOA,MAAM,UAAU,KAAK,QAAQ,YAAY,qBAAqB,GAAG,wBAAwB;GACzF,OAAO;EACT;CAGK;AACT"}

package/build/esm/index.js

@@ -7,9 +7,10 @@ import { createUpmAdapter } from "./adapters/upm.js";
 import { createYarnModernAdapter } from "./adapters/yarn-modern.js";
 import "./adapters/index.js";
 import { runAll, runSuite } from "./runner.js";
+import { stripTrailingSlashes } from "./utils/http-client.js";
 import { allScenarios } from "./scenarios/index.js";
-import { allTests } from "./tests/index.js";
 import { createUser, pingRegistry } from "./utils/registry-client.js";
+import { allTests } from "./tests/index.js";
 import buildDebug from "debug";
 //#region src/index.ts
 buildDebug("verdaccio:e2e-cli");
@@ -162,6 +163,7 @@ async function main(argv = process.argv) {
 		printHelp();
 		process.exit(1);
 	}
+	options.registry = stripTrailingSlashes(options.registry);
 	const { createTempFolder } = await import("./utils/project.js");
 	const runDir = await createTempFolder("e2e-run");
 	process.chdir(runDir);

package/build/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../src/index.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport {\n  createBunAdapter,\n  createDenoAdapter,\n  createNpmAdapter,\n  createNubAdapter,\n  createPnpmAdapter,\n  createUpmAdapter,\n  createYarnModernAdapter,\n} from './adapters';\nimport { runAll } from './runner';\nimport { allTests } from './tests';\nimport { CliOptions, PackageManagerAdapter } from './types';\nimport { createUser, pingRegistry } from './utils/registry-client';\n\nconst debug = buildDebug('verdaccio:e2e-cli');\n\nfunction parsePmSpec(filter: string): { name: string; version?: string; binPath?: string } {\n  // --pm yarn-modern@3, --pm npm@10, --pm npm=/path/to/bin\n  const eqIdx = filter.indexOf('=');\n  if (eqIdx !== -1) {\n    return { name: filter.slice(0, eqIdx).toLowerCase(), binPath: filter.slice(eqIdx + 1) };\n  }\n  const atIdx = filter.indexOf('@');\n  if (atIdx !== -1) {\n    return { name: filter.slice(0, atIdx).toLowerCase(), version: filter.slice(atIdx + 1) };\n  }\n  return { name: filter.toLowerCase() };\n}\n\nfunction parseAdapters(pmFilters?: string[]): PackageManagerAdapter[] {\n  if (!pmFilters || pmFilters.length === 0) {\n    return [createNpmAdapter()];\n  }\n\n  const adapters: PackageManagerAdapter[] = [];\n\n  for (const filter of pmFilters) {\n    const { name, version, binPath } = parsePmSpec(filter);\n\n    if (name === 'npm') {\n      adapters.push(createNpmAdapter(binPath, version));\n    } else if (name === 'pnpm') {\n      adapters.push(createPnpmAdapter(binPath, version));\n    } else if (name === 'yarn-classic' || name === 'yarn1') {\n      throw new Error(\n        'yarn classic (v1) is no longer supported. Use yarn-modern (Yarn 3+) instead.'\n      );\n    } else if (name === 'yarn-modern' || name === 'yarn') {\n      adapters.push(createYarnModernAdapter(binPath, version));\n    } else if (name === 'bun') {\n      adapters.push(createBunAdapter(binPath, version));\n    } else if (name === 'deno') {\n      adapters.push(createDenoAdapter(binPath, version));\n    } else if (name === 'upm') {\n      adapters.push(createUpmAdapter(binPath, version));\n    } else if (name === 'nub') {\n      adapters.push(createNubAdapter(binPath, version));\n    } else {\n      throw new Error(\n        `Unknown package manager: \"${name}\". Supported: npm, pnpm, yarn-modern, bun, deno, upm, nub`\n      );\n    }\n  }\n\n  return adapters;\n}\n\nfunction parseArgs(argv: string[]): CliOptions {\n  const options: CliOptions = {\n    registry: '',\n    pm: [],\n    test: [],\n    skipTest: [],\n    concurrency: 1,\n    timeout: 50000,\n    verbose: false,\n  };\n\n  for (let i = 2; i < argv.length; i++) {\n    const arg = argv[i];\n\n    if (arg === '--registry' || arg === '-r') {\n      options.registry = argv[++i];\n    } else if (arg === '--pm') {\n      options.pm!.push(argv[++i]);\n    } else if (arg === '--test' || arg === '-t') {\n      options.test!.push(argv[++i]);\n    } else if (arg === '--concurrency' || arg === '-c') {\n      options.concurrency = parseInt(argv[++i], 10);\n    } else if (arg === '--timeout') {\n      options.timeout = parseInt(argv[++i], 10);\n    } else if (arg === '--token') {\n      options.token = argv[++i];\n    } else if (arg === '--uplink-port') {\n      options.uplinkPort = parseInt(argv[++i], 10);\n    } else if (arg === '--print-config') {\n      options.printConfig = true;\n    } else if (arg === '--server') {\n      options.server = argv[++i];\n    } else if (arg.startsWith('--server=')) {\n      options.server = arg.split('=')[1];\n    } else if (arg === '--skip-test') {\n      options.skipTest!.push(argv[++i]);\n    } else if (arg.startsWith('--skip-test=')) {\n      options.skipTest!.push(arg.split('=')[1]);\n    } else if (arg === '--verbose' || arg === '-v') {\n      options.verbose = true;\n    } else if (arg === '--help' || arg === '-h') {\n      printHelp();\n      process.exit(0);\n    } else if (arg.startsWith('--registry=')) {\n      options.registry = arg.split('=')[1];\n    } else if (arg.startsWith('--pm=')) {\n      options.pm!.push(arg.split('=')[1]);\n    } else if (arg.startsWith('--test=')) {\n      options.test!.push(arg.split('=')[1]);\n    } else if (arg.startsWith('--token=')) {\n      options.token = arg.split('=')[1];\n    } else if (arg.startsWith('--timeout=')) {\n      options.timeout = parseInt(arg.split('=')[1], 10);\n    } else if (arg.startsWith('--uplink-port=')) {\n      options.uplinkPort = parseInt(arg.split('=')[1], 10);\n    } else {\n      console.error(`Unknown argument: ${arg}`);\n      printHelp();\n      process.exit(1);\n    }\n  }\n\n  return options;\n}\n\nfunction printHelp(): void {\n  console.log(`\n  @verdaccio/e2e-cli - Run Verdaccio e2e tests against any running registry\n\n  Usage:\n    verdaccio-e2e --registry <url> [options]\n\n  Required:\n    -r, --registry <url>    Verdaccio registry URL (e.g. http://localhost:4873)\n\n  Options:\n    --pm <name[@version]>   Package manager to test (can be repeated)\n                            Supported: npm (10-12), pnpm (10+),\n                                       yarn-modern (or yarn, Yarn 3+), bun, deno,\n                                       upm (install/ci only), nub (install/ci only)\n                            Examples: --pm npm@10 --pm pnpm@11\n                                      --pm yarn-modern@4\n                                      --pm yarn-modern@3\n                                      --pm bun\n                                      --pm npm --pm pnpm  (uses system version)\n                            Auto-installs the requested yarn version if needed\n                            Default: npm\n\n    -t, --test <name>       Filter tests by name (can be repeated)\n                            Available: publish, install, ci, audit, info, deprecate,\n                                       dist-tags, ping, search, unpublish\n                            Scenarios: scenario:install-multiple-deps,\n                                       scenario:minimum-release-age (pnpm 11.1+),\n                                       scenario:tarballs (npm adapter),\n                                       scenario:metadata (npm adapter),\n                                       scenario:search (npm adapter; the\n                                         uplink sub-tests also need\n                                         --uplink-port / E2E_UPLINK_PORT),\n                                       scenario:uplink-failure (npm adapter,\n                                         needs --uplink-port / E2E_UPLINK_PORT\n                                         and a registry started with the config\n                                         from --print-config)\n                            Default: all supported by the PM\n\n    --skip-test <name>      Skip a test by name (can be repeated). Unlike\n                            --test, the rest of the battery still runs and\n                            the skipped tests are reported as SKIP\n\n    --token <token>         Auth token (skips user creation)\n    --timeout <ms>          Per-test timeout (default: 50000)\n    --uplink-port <port>    Port for the mock uplink used by\n                            scenario:uplink-failure (default: $E2E_UPLINK_PORT)\n    --print-config          Print the recommended registry config for the full\n                            battery (max_body_size, mock uplink) and exit\n    --server <name>         Registry server the printed config targets:\n                            verdaccio (default) or pnpr. pnpr's config has no\n                            mock uplink (its registry namespaces can't claim\n                            the unscoped dynamic e2e-uplink-* names), so run\n                            it without --uplink-port and the uplink tests skip\n    -v, --verbose           Enable debug output\n    -h, --help              Show this help\n  `);\n}\n\nexport async function main(argv: string[] = process.argv): Promise<void> {\n  const options = parseArgs(argv);\n\n  if (options.printConfig) {\n    const { buildE2EConfig, buildPnprE2EConfig, DEFAULT_UPLINK_PORT } =\n      await import('./utils/e2e-config');\n    const server = options.server ?? 'verdaccio';\n    if (server === 'pnpr') {\n      process.stdout.write(buildPnprE2EConfig());\n    } else if (server === 'verdaccio') {\n      process.stdout.write(buildE2EConfig(options.uplinkPort ?? DEFAULT_UPLINK_PORT));\n    } else {\n      console.error(`Unknown --server: \"${server}\". Supported: verdaccio, pnpr`);\n      process.exit(1);\n    }\n    process.exit(0);\n  }\n\n  // Expose the mock uplink port to scenarios (scenario:uplink-failure gates on it).\n  if (options.uplinkPort) {\n    process.env.E2E_UPLINK_PORT = String(options.uplinkPort);\n  }\n\n  if (!options.registry) {\n    console.error('Error: --registry is required\\n');\n    printHelp();\n    process.exit(1);\n  }\n\n  // Run from a temp dir to isolate from the host project's packageManager, .yarnrc.yml, etc.\n  const { createTempFolder } = await import('./utils/project');\n  const runDir = await createTempFolder('e2e-run');\n  process.chdir(runDir);\n\n  if (options.verbose) {\n    const { setVerbose } = await import('./utils/process');\n    setVerbose(true);\n  }\n\n  // Ensure registry is reachable\n  console.log(`Checking registry at ${options.registry}...`);\n  const alive = await pingRegistry(options.registry);\n  if (!alive) {\n    console.error(`Error: Registry at ${options.registry} is not reachable`);\n    process.exit(1);\n  }\n  console.log(`Registry is alive.`);\n\n  // Get auth token\n  let token = options.token;\n  if (!token) {\n    console.log('Creating test user...');\n    const auth = await createUser(options.registry);\n    token = auth.token;\n    console.log(`User \"${auth.user}\" created.`);\n  }\n\n  // Build adapter list\n  const adapters = parseAdapters(options.pm);\n  console.log(`Adapters: ${adapters.map((a) => a.name).join(', ')}`);\n\n  // Filter tests\n  const tests =\n    options.test && options.test.length > 0\n      ? allTests.filter((t) => options.test!.includes(t.name))\n      : allTests;\n\n  console.log(`Tests: ${tests.map((t) => t.name).join(', ')}`);\n\n  if (options.skipTest && options.skipTest.length > 0) {\n    console.log(`Skipping tests: ${options.skipTest.join(', ')}`);\n  }\n\n  // Run\n  const { exitCode } = await runAll(adapters, tests, options.registry, token, {\n    timeout: options.timeout,\n    concurrency: options.concurrency,\n    testFilter: options.test,\n    skipTests: options.skipTest,\n  });\n\n  process.exit(exitCode);\n}\n\n// Re-export for programmatic usage\nexport { allTests } from './tests';\nexport { allScenarios } from './scenarios';\nexport {\n  createBunAdapter,\n  createDenoAdapter,\n  createNpmAdapter,\n  createNubAdapter,\n  createPnpmAdapter,\n  createUpmAdapter,\n  createYarnModernAdapter,\n} from './adapters';\nexport { runAll, runSuite } from './runner';\nexport type { PackageManagerAdapter, TestDefinition, TestContext, CliOptions } from './types';\n"],"mappings":";;;;;;;;;;;;;;AAgBc,WAAW,mBAAmB;AAE5C,SAAS,YAAY,QAAsE;CAEzF,MAAM,QAAQ,OAAO,QAAQ,GAAG;CAChC,IAAI,UAAU,IACZ,OAAO;EAAE,MAAM,OAAO,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY;EAAG,SAAS,OAAO,MAAM,QAAQ,CAAC;CAAE;CAExF,MAAM,QAAQ,OAAO,QAAQ,GAAG;CAChC,IAAI,UAAU,IACZ,OAAO;EAAE,MAAM,OAAO,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY;EAAG,SAAS,OAAO,MAAM,QAAQ,CAAC;CAAE;CAExF,OAAO,EAAE,MAAM,OAAO,YAAY,EAAE;AACtC;AAEA,SAAS,cAAc,WAA+C;CACpE,IAAI,CAAC,aAAa,UAAU,WAAW,GACrC,OAAO,CAAC,iBAAiB,CAAC;CAG5B,MAAM,WAAoC,CAAC;CAE3C,KAAK,MAAM,UAAU,WAAW;EAC9B,MAAM,EAAE,MAAM,SAAS,YAAY,YAAY,MAAM;EAErD,IAAI,SAAS,OACX,SAAS,KAAK,iBAAiB,SAAS,OAAO,CAAC;OAC3C,IAAI,SAAS,QAClB,SAAS,KAAK,kBAAkB,SAAS,OAAO,CAAC;OAC5C,IAAI,SAAS,kBAAkB,SAAS,SAC7C,MAAM,IAAI,MACR,8EACF;OACK,IAAI,SAAS,iBAAiB,SAAS,QAC5C,SAAS,KAAK,wBAAwB,SAAS,OAAO,CAAC;OAClD,IAAI,SAAS,OAClB,SAAS,KAAK,iBAAiB,SAAS,OAAO,CAAC;OAC3C,IAAI,SAAS,QAClB,SAAS,KAAK,kBAAkB,SAAS,OAAO,CAAC;OAC5C,IAAI,SAAS,OAClB,SAAS,KAAK,iBAAiB,SAAS,OAAO,CAAC;OAC3C,IAAI,SAAS,OAClB,SAAS,KAAK,iBAAiB,SAAS,OAAO,CAAC;OAEhD,MAAM,IAAI,MACR,6BAA6B,KAAK,0DACpC;CAEJ;CAEA,OAAO;AACT;AAEA,SAAS,UAAU,MAA4B;CAC7C,MAAM,UAAsB;EAC1B,UAAU;EACV,IAAI,CAAC;EACL,MAAM,CAAC;EACP,UAAU,CAAC;EACX,aAAa;EACb,SAAS;EACT,SAAS;CACX;CAEA,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;EACpC,MAAM,MAAM,KAAK;EAEjB,IAAI,QAAQ,gBAAgB,QAAQ,MAClC,QAAQ,WAAW,KAAK,EAAE;OACrB,IAAI,QAAQ,QACjB,QAAQ,GAAI,KAAK,KAAK,EAAE,EAAE;OACrB,IAAI,QAAQ,YAAY,QAAQ,MACrC,QAAQ,KAAM,KAAK,KAAK,EAAE,EAAE;OACvB,IAAI,QAAQ,mBAAmB,QAAQ,MAC5C,QAAQ,cAAc,SAAS,KAAK,EAAE,IAAI,EAAE;OACvC,IAAI,QAAQ,aACjB,QAAQ,UAAU,SAAS,KAAK,EAAE,IAAI,EAAE;OACnC,IAAI,QAAQ,WACjB,QAAQ,QAAQ,KAAK,EAAE;OAClB,IAAI,QAAQ,iBACjB,QAAQ,aAAa,SAAS,KAAK,EAAE,IAAI,EAAE;OACtC,IAAI,QAAQ,kBACjB,QAAQ,cAAc;OACjB,IAAI,QAAQ,YACjB,QAAQ,SAAS,KAAK,EAAE;OACnB,IAAI,IAAI,WAAW,WAAW,GACnC,QAAQ,SAAS,IAAI,MAAM,GAAG,CAAC,CAAC;OAC3B,IAAI,QAAQ,eACjB,QAAQ,SAAU,KAAK,KAAK,EAAE,EAAE;OAC3B,IAAI,IAAI,WAAW,cAAc,GACtC,QAAQ,SAAU,KAAK,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE;OACnC,IAAI,QAAQ,eAAe,QAAQ,MACxC,QAAQ,UAAU;OACb,IAAI,QAAQ,YAAY,QAAQ,MAAM;GAC3C,UAAU;GACV,QAAQ,KAAK,CAAC;EAChB,OAAO,IAAI,IAAI,WAAW,aAAa,GACrC,QAAQ,WAAW,IAAI,MAAM,GAAG,CAAC,CAAC;OAC7B,IAAI,IAAI,WAAW,OAAO,GAC/B,QAAQ,GAAI,KAAK,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE;OAC7B,IAAI,IAAI,WAAW,SAAS,GACjC,QAAQ,KAAM,KAAK,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE;OAC/B,IAAI,IAAI,WAAW,UAAU,GAClC,QAAQ,QAAQ,IAAI,MAAM,GAAG,CAAC,CAAC;OAC1B,IAAI,IAAI,WAAW,YAAY,GACpC,QAAQ,UAAU,SAAS,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE;OAC3C,IAAI,IAAI,WAAW,gBAAgB,GACxC,QAAQ,aAAa,SAAS,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE;OAC9C;GACL,QAAQ,MAAM,qBAAqB,KAAK;GACxC,UAAU;GACV,QAAQ,KAAK,CAAC;EAChB;CACF;CAEA,OAAO;AACT;AAEA,SAAS,YAAkB;CACzB,QAAQ,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDX;AACH;AAEA,eAAsB,KAAK,OAAiB,QAAQ,MAAqB;CACvE,MAAM,UAAU,UAAU,IAAI;CAE9B,IAAI,QAAQ,aAAa;EACvB,MAAM,EAAE,gBAAgB,oBAAoB,wBAC1C,MAAM,OAAO;EACf,MAAM,SAAS,QAAQ,UAAU;EACjC,IAAI,WAAW,QACb,QAAQ,OAAO,MAAM,mBAAmB,CAAC;OACpC,IAAI,WAAW,aACpB,QAAQ,OAAO,MAAM,eAAe,QAAQ,cAAc,mBAAmB,CAAC;OACzE;GACL,QAAQ,MAAM,sBAAsB,OAAO,8BAA8B;GACzE,QAAQ,KAAK,CAAC;EAChB;EACA,QAAQ,KAAK,CAAC;CAChB;CAGA,IAAI,QAAQ,YACV,QAAQ,IAAI,kBAAkB,OAAO,QAAQ,UAAU;CAGzD,IAAI,CAAC,QAAQ,UAAU;EACrB,QAAQ,MAAM,iCAAiC;EAC/C,UAAU;EACV,QAAQ,KAAK,CAAC;CAChB;CAGA,MAAM,EAAE,qBAAqB,MAAM,OAAO;CAC1C,MAAM,SAAS,MAAM,iBAAiB,SAAS;CAC/C,QAAQ,MAAM,MAAM;CAEpB,IAAI,QAAQ,SAAS;EACnB,MAAM,EAAE,eAAe,MAAM,OAAO;EACpC,WAAW,IAAI;CACjB;CAGA,QAAQ,IAAI,wBAAwB,QAAQ,SAAS,IAAI;CAEzD,IAAI,CAAC,MADe,aAAa,QAAQ,QAAQ,GACrC;EACV,QAAQ,MAAM,sBAAsB,QAAQ,SAAS,kBAAkB;EACvE,QAAQ,KAAK,CAAC;CAChB;CACA,QAAQ,IAAI,oBAAoB;CAGhC,IAAI,QAAQ,QAAQ;CACpB,IAAI,CAAC,OAAO;EACV,QAAQ,IAAI,uBAAuB;EACnC,MAAM,OAAO,MAAM,WAAW,QAAQ,QAAQ;EAC9C,QAAQ,KAAK;EACb,QAAQ,IAAI,SAAS,KAAK,KAAK,WAAW;CAC5C;CAGA,MAAM,WAAW,cAAc,QAAQ,EAAE;CACzC,QAAQ,IAAI,aAAa,SAAS,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG;CAGjE,MAAM,QACJ,QAAQ,QAAQ,QAAQ,KAAK,SAAS,IAClC,SAAS,QAAQ,MAAM,QAAQ,KAAM,SAAS,EAAE,IAAI,CAAC,IACrD;CAEN,QAAQ,IAAI,UAAU,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG;CAE3D,IAAI,QAAQ,YAAY,QAAQ,SAAS,SAAS,GAChD,QAAQ,IAAI,mBAAmB,QAAQ,SAAS,KAAK,IAAI,GAAG;CAI9D,MAAM,EAAE,aAAa,MAAM,OAAO,UAAU,OAAO,QAAQ,UAAU,OAAO;EAC1E,SAAS,QAAQ;EACjB,aAAa,QAAQ;EACrB,YAAY,QAAQ;EACpB,WAAW,QAAQ;CACrB,CAAC;CAED,QAAQ,KAAK,QAAQ;AACvB"}
+{"version":3,"file":"index.js","names":[],"sources":["../../src/index.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport {\n  createBunAdapter,\n  createDenoAdapter,\n  createNpmAdapter,\n  createNubAdapter,\n  createPnpmAdapter,\n  createUpmAdapter,\n  createYarnModernAdapter,\n} from './adapters';\nimport { runAll } from './runner';\nimport { allTests } from './tests';\nimport { CliOptions, PackageManagerAdapter } from './types';\nimport { stripTrailingSlashes } from './utils/http-client';\nimport { createUser, pingRegistry } from './utils/registry-client';\n\nconst debug = buildDebug('verdaccio:e2e-cli');\n\nfunction parsePmSpec(filter: string): { name: string; version?: string; binPath?: string } {\n  // --pm yarn-modern@3, --pm npm@10, --pm npm=/path/to/bin\n  const eqIdx = filter.indexOf('=');\n  if (eqIdx !== -1) {\n    return { name: filter.slice(0, eqIdx).toLowerCase(), binPath: filter.slice(eqIdx + 1) };\n  }\n  const atIdx = filter.indexOf('@');\n  if (atIdx !== -1) {\n    return { name: filter.slice(0, atIdx).toLowerCase(), version: filter.slice(atIdx + 1) };\n  }\n  return { name: filter.toLowerCase() };\n}\n\nfunction parseAdapters(pmFilters?: string[]): PackageManagerAdapter[] {\n  if (!pmFilters || pmFilters.length === 0) {\n    return [createNpmAdapter()];\n  }\n\n  const adapters: PackageManagerAdapter[] = [];\n\n  for (const filter of pmFilters) {\n    const { name, version, binPath } = parsePmSpec(filter);\n\n    if (name === 'npm') {\n      adapters.push(createNpmAdapter(binPath, version));\n    } else if (name === 'pnpm') {\n      adapters.push(createPnpmAdapter(binPath, version));\n    } else if (name === 'yarn-classic' || name === 'yarn1') {\n      throw new Error(\n        'yarn classic (v1) is no longer supported. Use yarn-modern (Yarn 3+) instead.'\n      );\n    } else if (name === 'yarn-modern' || name === 'yarn') {\n      adapters.push(createYarnModernAdapter(binPath, version));\n    } else if (name === 'bun') {\n      adapters.push(createBunAdapter(binPath, version));\n    } else if (name === 'deno') {\n      adapters.push(createDenoAdapter(binPath, version));\n    } else if (name === 'upm') {\n      adapters.push(createUpmAdapter(binPath, version));\n    } else if (name === 'nub') {\n      adapters.push(createNubAdapter(binPath, version));\n    } else {\n      throw new Error(\n        `Unknown package manager: \"${name}\". Supported: npm, pnpm, yarn-modern, bun, deno, upm, nub`\n      );\n    }\n  }\n\n  return adapters;\n}\n\nfunction parseArgs(argv: string[]): CliOptions {\n  const options: CliOptions = {\n    registry: '',\n    pm: [],\n    test: [],\n    skipTest: [],\n    concurrency: 1,\n    timeout: 50000,\n    verbose: false,\n  };\n\n  for (let i = 2; i < argv.length; i++) {\n    const arg = argv[i];\n\n    if (arg === '--registry' || arg === '-r') {\n      options.registry = argv[++i];\n    } else if (arg === '--pm') {\n      options.pm!.push(argv[++i]);\n    } else if (arg === '--test' || arg === '-t') {\n      options.test!.push(argv[++i]);\n    } else if (arg === '--concurrency' || arg === '-c') {\n      options.concurrency = parseInt(argv[++i], 10);\n    } else if (arg === '--timeout') {\n      options.timeout = parseInt(argv[++i], 10);\n    } else if (arg === '--token') {\n      options.token = argv[++i];\n    } else if (arg === '--uplink-port') {\n      options.uplinkPort = parseInt(argv[++i], 10);\n    } else if (arg === '--print-config') {\n      options.printConfig = true;\n    } else if (arg === '--server') {\n      options.server = argv[++i];\n    } else if (arg.startsWith('--server=')) {\n      options.server = arg.split('=')[1];\n    } else if (arg === '--skip-test') {\n      options.skipTest!.push(argv[++i]);\n    } else if (arg.startsWith('--skip-test=')) {\n      options.skipTest!.push(arg.split('=')[1]);\n    } else if (arg === '--verbose' || arg === '-v') {\n      options.verbose = true;\n    } else if (arg === '--help' || arg === '-h') {\n      printHelp();\n      process.exit(0);\n    } else if (arg.startsWith('--registry=')) {\n      options.registry = arg.split('=')[1];\n    } else if (arg.startsWith('--pm=')) {\n      options.pm!.push(arg.split('=')[1]);\n    } else if (arg.startsWith('--test=')) {\n      options.test!.push(arg.split('=')[1]);\n    } else if (arg.startsWith('--token=')) {\n      options.token = arg.split('=')[1];\n    } else if (arg.startsWith('--timeout=')) {\n      options.timeout = parseInt(arg.split('=')[1], 10);\n    } else if (arg.startsWith('--uplink-port=')) {\n      options.uplinkPort = parseInt(arg.split('=')[1], 10);\n    } else {\n      console.error(`Unknown argument: ${arg}`);\n      printHelp();\n      process.exit(1);\n    }\n  }\n\n  return options;\n}\n\nfunction printHelp(): void {\n  console.log(`\n  @verdaccio/e2e-cli - Run Verdaccio e2e tests against any running registry\n\n  Usage:\n    verdaccio-e2e --registry <url> [options]\n\n  Required:\n    -r, --registry <url>    Verdaccio registry URL (e.g. http://localhost:4873)\n\n  Options:\n    --pm <name[@version]>   Package manager to test (can be repeated)\n                            Supported: npm (10-12), pnpm (10+),\n                                       yarn-modern (or yarn, Yarn 3+), bun, deno,\n                                       upm (install/ci only), nub (install/ci only)\n                            Examples: --pm npm@10 --pm pnpm@11\n                                      --pm yarn-modern@4\n                                      --pm yarn-modern@3\n                                      --pm bun\n                                      --pm npm --pm pnpm  (uses system version)\n                            Auto-installs the requested yarn version if needed\n                            Default: npm\n\n    -t, --test <name>       Filter tests by name (can be repeated)\n                            Available: publish, install, ci, audit, info, deprecate,\n                                       dist-tags, ping, search, unpublish\n                            Scenarios: scenario:install-multiple-deps,\n                                       scenario:minimum-release-age (pnpm 11.1+),\n                                       scenario:tarballs (npm adapter),\n                                       scenario:metadata (npm adapter),\n                                       scenario:search (npm adapter; the\n                                         uplink sub-tests also need\n                                         --uplink-port / E2E_UPLINK_PORT),\n                                       scenario:uplink-failure (npm adapter,\n                                         needs --uplink-port / E2E_UPLINK_PORT\n                                         and a registry started with the config\n                                         from --print-config)\n                            Default: all supported by the PM\n\n    --skip-test <name>      Skip a test by name (can be repeated). Unlike\n                            --test, the rest of the battery still runs and\n                            the skipped tests are reported as SKIP\n\n    --token <token>         Auth token (skips user creation)\n    --timeout <ms>          Per-test timeout (default: 50000)\n    --uplink-port <port>    Port for the mock uplink used by\n                            scenario:uplink-failure (default: $E2E_UPLINK_PORT)\n    --print-config          Print the recommended registry config for the full\n                            battery (max_body_size, mock uplink) and exit\n    --server <name>         Registry server the printed config targets:\n                            verdaccio (default) or pnpr. pnpr's config has no\n                            mock uplink (its registry namespaces can't claim\n                            the unscoped dynamic e2e-uplink-* names), so run\n                            it without --uplink-port and the uplink tests skip\n    -v, --verbose           Enable debug output\n    -h, --help              Show this help\n  `);\n}\n\nexport async function main(argv: string[] = process.argv): Promise<void> {\n  const options = parseArgs(argv);\n\n  if (options.printConfig) {\n    const { buildE2EConfig, buildPnprE2EConfig, DEFAULT_UPLINK_PORT } =\n      await import('./utils/e2e-config');\n    const server = options.server ?? 'verdaccio';\n    if (server === 'pnpr') {\n      process.stdout.write(buildPnprE2EConfig());\n    } else if (server === 'verdaccio') {\n      process.stdout.write(buildE2EConfig(options.uplinkPort ?? DEFAULT_UPLINK_PORT));\n    } else {\n      console.error(`Unknown --server: \"${server}\". Supported: verdaccio, pnpr`);\n      process.exit(1);\n    }\n    process.exit(0);\n  }\n\n  // Expose the mock uplink port to scenarios (scenario:uplink-failure gates on it).\n  if (options.uplinkPort) {\n    process.env.E2E_UPLINK_PORT = String(options.uplinkPort);\n  }\n\n  if (!options.registry) {\n    console.error('Error: --registry is required\\n');\n    printHelp();\n    process.exit(1);\n  }\n  // URLs are built as `${registry}/-/...`; a trailing slash (pnpr's `/npm/`) would double it\n  options.registry = stripTrailingSlashes(options.registry);\n\n  // Run from a temp dir to isolate from the host project's packageManager, .yarnrc.yml, etc.\n  const { createTempFolder } = await import('./utils/project');\n  const runDir = await createTempFolder('e2e-run');\n  process.chdir(runDir);\n\n  if (options.verbose) {\n    const { setVerbose } = await import('./utils/process');\n    setVerbose(true);\n  }\n\n  // Ensure registry is reachable\n  console.log(`Checking registry at ${options.registry}...`);\n  const alive = await pingRegistry(options.registry);\n  if (!alive) {\n    console.error(`Error: Registry at ${options.registry} is not reachable`);\n    process.exit(1);\n  }\n  console.log(`Registry is alive.`);\n\n  // Get auth token\n  let token = options.token;\n  if (!token) {\n    console.log('Creating test user...');\n    const auth = await createUser(options.registry);\n    token = auth.token;\n    console.log(`User \"${auth.user}\" created.`);\n  }\n\n  // Build adapter list\n  const adapters = parseAdapters(options.pm);\n  console.log(`Adapters: ${adapters.map((a) => a.name).join(', ')}`);\n\n  // Filter tests\n  const tests =\n    options.test && options.test.length > 0\n      ? allTests.filter((t) => options.test!.includes(t.name))\n      : allTests;\n\n  console.log(`Tests: ${tests.map((t) => t.name).join(', ')}`);\n\n  if (options.skipTest && options.skipTest.length > 0) {\n    console.log(`Skipping tests: ${options.skipTest.join(', ')}`);\n  }\n\n  // Run\n  const { exitCode } = await runAll(adapters, tests, options.registry, token, {\n    timeout: options.timeout,\n    concurrency: options.concurrency,\n    testFilter: options.test,\n    skipTests: options.skipTest,\n  });\n\n  process.exit(exitCode);\n}\n\n// Re-export for programmatic usage\nexport { allTests } from './tests';\nexport { allScenarios } from './scenarios';\nexport {\n  createBunAdapter,\n  createDenoAdapter,\n  createNpmAdapter,\n  createNubAdapter,\n  createPnpmAdapter,\n  createUpmAdapter,\n  createYarnModernAdapter,\n} from './adapters';\nexport { runAll, runSuite } from './runner';\nexport type { PackageManagerAdapter, TestDefinition, TestContext, CliOptions } from './types';\n"],"mappings":";;;;;;;;;;;;;;;AAiBc,WAAW,mBAAmB;AAE5C,SAAS,YAAY,QAAsE;CAEzF,MAAM,QAAQ,OAAO,QAAQ,GAAG;CAChC,IAAI,UAAU,IACZ,OAAO;EAAE,MAAM,OAAO,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY;EAAG,SAAS,OAAO,MAAM,QAAQ,CAAC;CAAE;CAExF,MAAM,QAAQ,OAAO,QAAQ,GAAG;CAChC,IAAI,UAAU,IACZ,OAAO;EAAE,MAAM,OAAO,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY;EAAG,SAAS,OAAO,MAAM,QAAQ,CAAC;CAAE;CAExF,OAAO,EAAE,MAAM,OAAO,YAAY,EAAE;AACtC;AAEA,SAAS,cAAc,WAA+C;CACpE,IAAI,CAAC,aAAa,UAAU,WAAW,GACrC,OAAO,CAAC,iBAAiB,CAAC;CAG5B,MAAM,WAAoC,CAAC;CAE3C,KAAK,MAAM,UAAU,WAAW;EAC9B,MAAM,EAAE,MAAM,SAAS,YAAY,YAAY,MAAM;EAErD,IAAI,SAAS,OACX,SAAS,KAAK,iBAAiB,SAAS,OAAO,CAAC;OAC3C,IAAI,SAAS,QAClB,SAAS,KAAK,kBAAkB,SAAS,OAAO,CAAC;OAC5C,IAAI,SAAS,kBAAkB,SAAS,SAC7C,MAAM,IAAI,MACR,8EACF;OACK,IAAI,SAAS,iBAAiB,SAAS,QAC5C,SAAS,KAAK,wBAAwB,SAAS,OAAO,CAAC;OAClD,IAAI,SAAS,OAClB,SAAS,KAAK,iBAAiB,SAAS,OAAO,CAAC;OAC3C,IAAI,SAAS,QAClB,SAAS,KAAK,kBAAkB,SAAS,OAAO,CAAC;OAC5C,IAAI,SAAS,OAClB,SAAS,KAAK,iBAAiB,SAAS,OAAO,CAAC;OAC3C,IAAI,SAAS,OAClB,SAAS,KAAK,iBAAiB,SAAS,OAAO,CAAC;OAEhD,MAAM,IAAI,MACR,6BAA6B,KAAK,0DACpC;CAEJ;CAEA,OAAO;AACT;AAEA,SAAS,UAAU,MAA4B;CAC7C,MAAM,UAAsB;EAC1B,UAAU;EACV,IAAI,CAAC;EACL,MAAM,CAAC;EACP,UAAU,CAAC;EACX,aAAa;EACb,SAAS;EACT,SAAS;CACX;CAEA,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;EACpC,MAAM,MAAM,KAAK;EAEjB,IAAI,QAAQ,gBAAgB,QAAQ,MAClC,QAAQ,WAAW,KAAK,EAAE;OACrB,IAAI,QAAQ,QACjB,QAAQ,GAAI,KAAK,KAAK,EAAE,EAAE;OACrB,IAAI,QAAQ,YAAY,QAAQ,MACrC,QAAQ,KAAM,KAAK,KAAK,EAAE,EAAE;OACvB,IAAI,QAAQ,mBAAmB,QAAQ,MAC5C,QAAQ,cAAc,SAAS,KAAK,EAAE,IAAI,EAAE;OACvC,IAAI,QAAQ,aACjB,QAAQ,UAAU,SAAS,KAAK,EAAE,IAAI,EAAE;OACnC,IAAI,QAAQ,WACjB,QAAQ,QAAQ,KAAK,EAAE;OAClB,IAAI,QAAQ,iBACjB,QAAQ,aAAa,SAAS,KAAK,EAAE,IAAI,EAAE;OACtC,IAAI,QAAQ,kBACjB,QAAQ,cAAc;OACjB,IAAI,QAAQ,YACjB,QAAQ,SAAS,KAAK,EAAE;OACnB,IAAI,IAAI,WAAW,WAAW,GACnC,QAAQ,SAAS,IAAI,MAAM,GAAG,CAAC,CAAC;OAC3B,IAAI,QAAQ,eACjB,QAAQ,SAAU,KAAK,KAAK,EAAE,EAAE;OAC3B,IAAI,IAAI,WAAW,cAAc,GACtC,QAAQ,SAAU,KAAK,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE;OACnC,IAAI,QAAQ,eAAe,QAAQ,MACxC,QAAQ,UAAU;OACb,IAAI,QAAQ,YAAY,QAAQ,MAAM;GAC3C,UAAU;GACV,QAAQ,KAAK,CAAC;EAChB,OAAO,IAAI,IAAI,WAAW,aAAa,GACrC,QAAQ,WAAW,IAAI,MAAM,GAAG,CAAC,CAAC;OAC7B,IAAI,IAAI,WAAW,OAAO,GAC/B,QAAQ,GAAI,KAAK,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE;OAC7B,IAAI,IAAI,WAAW,SAAS,GACjC,QAAQ,KAAM,KAAK,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE;OAC/B,IAAI,IAAI,WAAW,UAAU,GAClC,QAAQ,QAAQ,IAAI,MAAM,GAAG,CAAC,CAAC;OAC1B,IAAI,IAAI,WAAW,YAAY,GACpC,QAAQ,UAAU,SAAS,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE;OAC3C,IAAI,IAAI,WAAW,gBAAgB,GACxC,QAAQ,aAAa,SAAS,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE;OAC9C;GACL,QAAQ,MAAM,qBAAqB,KAAK;GACxC,UAAU;GACV,QAAQ,KAAK,CAAC;EAChB;CACF;CAEA,OAAO;AACT;AAEA,SAAS,YAAkB;CACzB,QAAQ,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDX;AACH;AAEA,eAAsB,KAAK,OAAiB,QAAQ,MAAqB;CACvE,MAAM,UAAU,UAAU,IAAI;CAE9B,IAAI,QAAQ,aAAa;EACvB,MAAM,EAAE,gBAAgB,oBAAoB,wBAC1C,MAAM,OAAO;EACf,MAAM,SAAS,QAAQ,UAAU;EACjC,IAAI,WAAW,QACb,QAAQ,OAAO,MAAM,mBAAmB,CAAC;OACpC,IAAI,WAAW,aACpB,QAAQ,OAAO,MAAM,eAAe,QAAQ,cAAc,mBAAmB,CAAC;OACzE;GACL,QAAQ,MAAM,sBAAsB,OAAO,8BAA8B;GACzE,QAAQ,KAAK,CAAC;EAChB;EACA,QAAQ,KAAK,CAAC;CAChB;CAGA,IAAI,QAAQ,YACV,QAAQ,IAAI,kBAAkB,OAAO,QAAQ,UAAU;CAGzD,IAAI,CAAC,QAAQ,UAAU;EACrB,QAAQ,MAAM,iCAAiC;EAC/C,UAAU;EACV,QAAQ,KAAK,CAAC;CAChB;CAEA,QAAQ,WAAW,qBAAqB,QAAQ,QAAQ;CAGxD,MAAM,EAAE,qBAAqB,MAAM,OAAO;CAC1C,MAAM,SAAS,MAAM,iBAAiB,SAAS;CAC/C,QAAQ,MAAM,MAAM;CAEpB,IAAI,QAAQ,SAAS;EACnB,MAAM,EAAE,eAAe,MAAM,OAAO;EACpC,WAAW,IAAI;CACjB;CAGA,QAAQ,IAAI,wBAAwB,QAAQ,SAAS,IAAI;CAEzD,IAAI,CAAC,MADe,aAAa,QAAQ,QAAQ,GACrC;EACV,QAAQ,MAAM,sBAAsB,QAAQ,SAAS,kBAAkB;EACvE,QAAQ,KAAK,CAAC;CAChB;CACA,QAAQ,IAAI,oBAAoB;CAGhC,IAAI,QAAQ,QAAQ;CACpB,IAAI,CAAC,OAAO;EACV,QAAQ,IAAI,uBAAuB;EACnC,MAAM,OAAO,MAAM,WAAW,QAAQ,QAAQ;EAC9C,QAAQ,KAAK;EACb,QAAQ,IAAI,SAAS,KAAK,KAAK,WAAW;CAC5C;CAGA,MAAM,WAAW,cAAc,QAAQ,EAAE;CACzC,QAAQ,IAAI,aAAa,SAAS,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG;CAGjE,MAAM,QACJ,QAAQ,QAAQ,QAAQ,KAAK,SAAS,IAClC,SAAS,QAAQ,MAAM,QAAQ,KAAM,SAAS,EAAE,IAAI,CAAC,IACrD;CAEN,QAAQ,IAAI,UAAU,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG;CAE3D,IAAI,QAAQ,YAAY,QAAQ,SAAS,SAAS,GAChD,QAAQ,IAAI,mBAAmB,QAAQ,SAAS,KAAK,IAAI,GAAG;CAI9D,MAAM,EAAE,aAAa,MAAM,OAAO,UAAU,OAAO,QAAQ,UAAU,OAAO;EAC1E,SAAS,QAAQ;EACjB,aAAa,QAAQ;EACrB,YAAY,QAAQ;EACpB,WAAW,QAAQ;CACrB,CAAC;CAED,QAAQ,KAAK,QAAQ;AACvB"}

package/build/esm/scenarios/minimum-release-age.js.map

@@ -1 +1 @@
-{"version":3,"file":"minimum-release-age.js","names":[],"sources":["../../../src/scenarios/minimum-release-age.ts"],"sourcesContent":["import assert from 'assert';\nimport { writeFile } from 'fs/promises';\nimport { join } from 'path';\n\nimport { PackageManagerAdapter, TestContext, TestDefinition } from '../types';\nimport { trace } from '../utils/process';\n\n/**\n * Scenario: minimum-release-age (pnpm 11.1+ only)\n *\n * Exercises pnpm's `minimumReleaseAge` cooldown together with\n * `minimumReleaseAgeExclude`. With a 7-day (10080 minute) cooldown, freshly\n * published versions are normally not installable until they age past the\n * threshold — but packages matching the exclude globs bypass the check.\n *\n *   minimumReleaseAge: 10080\n *   minimumReleaseAgeStrict: true\n *   minimumReleaseAgeExclude:\n *     - '@verdaccio/*'\n *     - 'verdaccio-*'\n *\n * minimumReleaseAgeStrict is required on pnpm 12: without it, pnpm 12\n * auto-adds new direct dependencies to minimumReleaseAgeExclude instead of\n * failing. pnpm 11 enforces the cooldown unconditionally and ignores the key.\n *\n * The scenario publishes brand-new (age ~0) packages and asserts:\n *   - an excluded scoped package   (@verdaccio/*) installs despite the cooldown\n *   - an excluded unscoped package (verdaccio-*)  installs despite the cooldown\n *   - a non-excluded package is blocked by the cooldown (proving it is active)\n *\n * pnpm reads these settings from `pnpm-workspace.yaml`, mirroring the\n * configuration used by the repo root. The cooldown is only enforced from\n * pnpm 11.1.0 onward (11.0.x silently ignores it), so the scenario is gated to\n * that version range — see {@link isPnpm11Plus}.\n */\n\nconst MINIMUM_RELEASE_AGE = 10080; // 7 days, in minutes\nconst MINIMUM_RELEASE_AGE_EXCLUDE = ['@verdaccio/*', 'verdaccio-*'];\n\nconst PNPM_WORKSPACE_YAML = [\n  `minimumReleaseAge: ${MINIMUM_RELEASE_AGE}`,\n  // pnpm 12 no longer blocks new direct dependencies by default: it auto-adds\n  // them to minimumReleaseAgeExclude in pnpm-workspace.yaml and proceeds.\n  // minimumReleaseAgeStrict restores the blocking behavior this scenario\n  // asserts (ERR_PNPM_NO_MATURE_MATCHING_VERSION); pnpm 11 ignores the key.\n  'minimumReleaseAgeStrict: true',\n  'minimumReleaseAgeExclude:',\n  ...MINIMUM_RELEASE_AGE_EXCLUDE.map((glob) => `  - '${glob}'`),\n  '',\n].join('\\n');\n\n/**\n * True only for pnpm versions that actually enforce minimumReleaseAge.\n *\n * The cooldown is honored in pnpm 11.1.0+, but it is silently ignored in\n * 11.0.0 / 11.0.1 (and the 11.0.0 release candidates) — those versions install\n * brand-new packages regardless of the configured cooldown. We scope this\n * scenario to pnpm 11.1.0 and newer so it doesn't false-fail on that regression.\n */\nexport function isPnpm11Plus(adapter: PackageManagerAdapter): boolean {\n  if (adapter.type !== 'pnpm') {\n    return false;\n  }\n  const match = adapter.name.match(/pnpm@(\\d+)\\.(\\d+)/);\n  if (!match) {\n    return false;\n  }\n  const major = parseInt(match[1], 10);\n  const minor = parseInt(match[2], 10);\n  return major > 11 || (major === 11 && minor >= 1);\n}\n\nasync function publishPackage(ctx: TestContext, pkgName: string, version: string): Promise<void> {\n  trace('publishing %s@%s', pkgName, version);\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    pkgName,\n    version,\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token\n  );\n  await ctx.adapter.exec(\n    { cwd: tempFolder },\n    'publish',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n  trace('published %s@%s', pkgName, version);\n}\n\n/**\n * Build a consumer project with the minimumReleaseAge cooldown configured in\n * pnpm-workspace.yaml, depending on the given packages.\n */\nasync function prepareCooldownConsumer(\n  ctx: TestContext,\n  consumerName: string,\n  dependencies: Record<string, string>\n): Promise<string> {\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    consumerName,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token,\n    dependencies\n  );\n  await writeFile(join(tempFolder, 'pnpm-workspace.yaml'), PNPM_WORKSPACE_YAML);\n  trace('prepared cooldown consumer %s at %s', consumerName, tempFolder);\n  return tempFolder;\n}\n\nasync function testMinimumReleaseAge(ctx: TestContext): Promise<void> {\n  const id = ctx.runId;\n\n  const excludedScoped = `@verdaccio/release-age-${id}`;\n  const excludedUnscoped = `verdaccio-release-age-${id}`;\n  const blocked = `e2e-release-age-blocked-${id}`;\n\n  // --- Phase 1: Publish brand-new (age ~0) packages ---\n  await ctx.subTest('publish fresh packages', async () => {\n    await publishPackage(ctx, excludedScoped, '1.0.0');\n    await publishPackage(ctx, excludedUnscoped, '1.0.0');\n    await publishPackage(ctx, blocked, '1.0.0');\n  });\n\n  // --- Phase 2: Excluded packages install despite the cooldown ---\n  await ctx.subTest('excluded packages bypass the cooldown', async () => {\n    const tempFolder = await prepareCooldownConsumer(ctx, `@verdaccio/consumer-excluded-${id}`, {\n      [excludedScoped]: '1.0.0',\n      [excludedUnscoped]: '1.0.0',\n    });\n\n    // Should succeed: both deps match the exclude globs.\n    await ctx.adapter.exec(\n      { cwd: tempFolder },\n      'install',\n      ...ctx.adapter.registryArg(ctx.registryUrl)\n    );\n\n    trace('excluded packages installed successfully under cooldown');\n  });\n\n  // --- Phase 3: Non-excluded fresh package is blocked by the cooldown ---\n  await ctx.subTest('non-excluded fresh package is blocked', async () => {\n    const tempFolder = await prepareCooldownConsumer(ctx, `e2e-consumer-blocked-${id}`, {\n      [blocked]: '1.0.0',\n    });\n\n    let errorMessage = '';\n    try {\n      await ctx.adapter.exec(\n        { cwd: tempFolder },\n        'install',\n        // pnpm 12's parser rejects the `--flag=false` form; --no-frozen-lockfile\n        // is accepted by pnpm 10, 11 and 12 alike\n        '--no-frozen-lockfile',\n        ...ctx.adapter.registryArg(ctx.registryUrl)\n      );\n    } catch (err) {\n      errorMessage = err instanceof Error ? err.message : String(err);\n      trace('install correctly rejected by cooldown: %s', errorMessage.split('\\n')[0]);\n    }\n\n    assert.ok(\n      errorMessage,\n      `Expected install of fresh non-excluded package \"${blocked}\" to be blocked by ` +\n        `minimumReleaseAge (${MINIMUM_RELEASE_AGE} min), but it succeeded`\n    );\n    // pnpm reports ERR_PNPM_NO_MATURE_MATCHING_VERSION / \"minimumReleaseAge\" when a\n    // version is too new. Assert the failure is the cooldown, not an unrelated error.\n    assert.ok(\n      /minimumReleaseAge|NO_MATURE_MATCHING_VERSION/i.test(errorMessage),\n      `Install of \"${blocked}\" failed for an unexpected reason (expected a minimumReleaseAge ` +\n        `cooldown error):\\n${errorMessage}`\n    );\n  });\n}\n\nexport const minimumReleaseAgeScenario: TestDefinition = {\n  name: 'scenario:minimum-release-age',\n  requires: ['publish', 'install'],\n  appliesTo: isPnpm11Plus,\n  run: testMinimumReleaseAge,\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,IAAM,sBAAsB;AAG5B,IAAM,sBAAsB;CAC1B,sBAAsB;CAKtB;CACA;CACA,GAAG,CAVgC,gBAAgB,aAUhD,CAAA,CAA4B,KAAK,SAAS,QAAQ,KAAK,EAAE;CAC5D;AACF,CAAC,CAAC,KAAK,IAAI;;;;;;;;;AAUX,SAAgB,aAAa,SAAyC;CACpE,IAAI,QAAQ,SAAS,QACnB,OAAO;CAET,MAAM,QAAQ,QAAQ,KAAK,MAAM,mBAAmB;CACpD,IAAI,CAAC,OACH,OAAO;CAET,MAAM,QAAQ,SAAS,MAAM,IAAI,EAAE;CACnC,MAAM,QAAQ,SAAS,MAAM,IAAI,EAAE;CACnC,OAAO,QAAQ,MAAO,UAAU,MAAM,SAAS;AACjD;AAEA,eAAe,eAAe,KAAkB,SAAiB,SAAgC;CAC/F,MAAM,oBAAoB,SAAS,OAAO;CAC1C,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,SACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;CACA,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CACA,MAAM,mBAAmB,SAAS,OAAO;AAC3C;;;;;AAMA,eAAe,wBACb,KACA,cACA,cACiB;CACjB,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,cACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,OACJ,YACF;CACA,MAAM,UAAU,KAAK,YAAY,qBAAqB,GAAG,mBAAmB;CAC5E,MAAM,uCAAuC,cAAc,UAAU;CACrE,OAAO;AACT;AAEA,eAAe,sBAAsB,KAAiC;CACpE,MAAM,KAAK,IAAI;CAEf,MAAM,iBAAiB,0BAA0B;CACjD,MAAM,mBAAmB,yBAAyB;CAClD,MAAM,UAAU,2BAA2B;CAG3C,MAAM,IAAI,QAAQ,0BAA0B,YAAY;EACtD,MAAM,eAAe,KAAK,gBAAgB,OAAO;EACjD,MAAM,eAAe,KAAK,kBAAkB,OAAO;EACnD,MAAM,eAAe,KAAK,SAAS,OAAO;CAC5C,CAAC;CAGD,MAAM,IAAI,QAAQ,yCAAyC,YAAY;EACrE,MAAM,aAAa,MAAM,wBAAwB,KAAK,gCAAgC,MAAM;IACzF,iBAAiB;IACjB,mBAAmB;EACtB,CAAC;EAGD,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EAEA,MAAM,yDAAyD;CACjE,CAAC;CAGD,MAAM,IAAI,QAAQ,yCAAyC,YAAY;EACrE,MAAM,aAAa,MAAM,wBAAwB,KAAK,wBAAwB,MAAM,GACjF,UAAU,QACb,CAAC;EAED,IAAI,eAAe;EACnB,IAAI;GACF,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WAGA,wBACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EACF,SAAS,KAAK;GACZ,eAAe,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GAC9D,MAAM,8CAA8C,aAAa,MAAM,IAAI,CAAC,CAAC,EAAE;EACjF;EAEA,OAAO,GACL,cACA,mDAAmD,QAAQ,wCACnC,oBAAoB,wBAC9C;EAGA,OAAO,GACL,gDAAgD,KAAK,YAAY,GACjE,eAAe,QAAQ,oFACA,cACzB;CACF,CAAC;AACH;AAEA,IAAa,4BAA4C;CACvD,MAAM;CACN,UAAU,CAAC,WAAW,SAAS;CAC/B,WAAW;CACX,KAAK;AACP"}
+{"version":3,"file":"minimum-release-age.js","names":[],"sources":["../../../src/scenarios/minimum-release-age.ts"],"sourcesContent":["import assert from 'assert';\nimport { writeFile } from 'fs/promises';\nimport { join } from 'path';\n\nimport { PackageManagerAdapter, TestContext, TestDefinition } from '../types';\nimport { trace } from '../utils/process';\n\n/**\n * Scenario: minimum-release-age (pnpm 11.1+ only)\n *\n * Exercises pnpm's `minimumReleaseAge` cooldown together with\n * `minimumReleaseAgeExclude`. With a 7-day (10080 minute) cooldown, freshly\n * published versions are normally not installable until they age past the\n * threshold — but packages matching the exclude globs bypass the check.\n *\n *   minimumReleaseAge: 10080\n *   minimumReleaseAgeStrict: true\n *   minimumReleaseAgeExclude:\n *     - '@verdaccio/*'\n *     - 'verdaccio-*'\n *\n * minimumReleaseAgeStrict is required on pnpm 12: without it, pnpm 12\n * auto-adds new direct dependencies to minimumReleaseAgeExclude instead of\n * failing. pnpm 11 enforces the cooldown unconditionally and ignores the key.\n *\n * The scenario publishes brand-new (age ~0) packages and asserts:\n *   - an excluded scoped package   (@verdaccio/*) installs despite the cooldown\n *   - an excluded unscoped package (verdaccio-*)  installs despite the cooldown\n *   - a non-excluded package is blocked by the cooldown (proving it is active)\n *\n * pnpm reads these settings from `pnpm-workspace.yaml`, mirroring the\n * configuration used by the repo root. The cooldown is only enforced from\n * pnpm 11.1.0 onward (11.0.x silently ignores it), so the scenario is gated to\n * that version range — see {@link isPnpm11Plus}.\n */\n\nconst MINIMUM_RELEASE_AGE = 10080; // 7 days, in minutes\nconst MINIMUM_RELEASE_AGE_EXCLUDE = ['@verdaccio/*', 'verdaccio-*'];\n\nconst PNPM_WORKSPACE_YAML = [\n  `minimumReleaseAge: ${MINIMUM_RELEASE_AGE}`,\n  // pnpm 12 no longer blocks new direct dependencies by default: it auto-adds\n  // them to minimumReleaseAgeExclude in pnpm-workspace.yaml and proceeds.\n  // minimumReleaseAgeStrict restores the blocking behavior this scenario\n  // asserts (ERR_PNPM_NO_MATURE_MATCHING_VERSION); pnpm 11 ignores the key.\n  'minimumReleaseAgeStrict: true',\n  'minimumReleaseAgeExclude:',\n  ...MINIMUM_RELEASE_AGE_EXCLUDE.map((glob) => `  - '${glob}'`),\n  '',\n].join('\\n');\n\n/**\n * True only for pnpm versions that actually enforce minimumReleaseAge.\n *\n * The cooldown is honored in pnpm 11.1.0+, but it is silently ignored in\n * 11.0.0 / 11.0.1 (and the 11.0.0 release candidates) — those versions install\n * brand-new packages regardless of the configured cooldown. We scope this\n * scenario to pnpm 11.1.0 and newer so it doesn't false-fail on that regression.\n */\nexport function isPnpm11Plus(adapter: PackageManagerAdapter): boolean {\n  if (adapter.type !== 'pnpm') {\n    return false;\n  }\n  const match = adapter.name.match(/pnpm@(\\d+)\\.(\\d+)/);\n  if (!match) {\n    return false;\n  }\n  const major = parseInt(match[1], 10);\n  const minor = parseInt(match[2], 10);\n  return major > 11 || (major === 11 && minor >= 1);\n}\n\nasync function publishPackage(ctx: TestContext, pkgName: string, version: string): Promise<void> {\n  trace('publishing %s@%s', pkgName, version);\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    pkgName,\n    version,\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token\n  );\n  await ctx.adapter.exec(\n    { cwd: tempFolder },\n    'publish',\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n  trace('published %s@%s', pkgName, version);\n}\n\n/**\n * Build a consumer project with the minimumReleaseAge cooldown configured in\n * pnpm-workspace.yaml, depending on the given packages.\n */\nasync function prepareCooldownConsumer(\n  ctx: TestContext,\n  consumerName: string,\n  dependencies: Record<string, string>\n): Promise<string> {\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    consumerName,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token,\n    dependencies\n  );\n  await writeFile(join(tempFolder, 'pnpm-workspace.yaml'), PNPM_WORKSPACE_YAML);\n  trace('prepared cooldown consumer %s at %s', consumerName, tempFolder);\n  return tempFolder;\n}\n\nasync function testMinimumReleaseAge(ctx: TestContext): Promise<void> {\n  const id = ctx.runId;\n\n  const excludedScoped = `@verdaccio/release-age-${id}`;\n  const excludedUnscoped = `verdaccio-release-age-${id}`;\n  const blocked = `e2e-release-age-blocked-${id}`;\n\n  // --- Phase 1: Publish brand-new (age ~0) packages ---\n  await ctx.subTest('publish fresh packages', async () => {\n    await publishPackage(ctx, excludedScoped, '1.0.0');\n    await publishPackage(ctx, excludedUnscoped, '1.0.0');\n    await publishPackage(ctx, blocked, '1.0.0');\n  });\n\n  // --- Phase 2: Excluded packages install despite the cooldown ---\n  await ctx.subTest('excluded packages bypass the cooldown', async () => {\n    const tempFolder = await prepareCooldownConsumer(ctx, `@verdaccio/consumer-excluded-${id}`, {\n      [excludedScoped]: '1.0.0',\n      [excludedUnscoped]: '1.0.0',\n    });\n\n    // Should succeed: both deps match the exclude globs.\n    await ctx.adapter.exec(\n      { cwd: tempFolder },\n      'install',\n      ...ctx.adapter.registryArg(ctx.registryUrl)\n    );\n\n    trace('excluded packages installed successfully under cooldown');\n  });\n\n  // --- Phase 3: Non-excluded fresh package is blocked by the cooldown ---\n  await ctx.subTest('non-excluded fresh package is blocked', async () => {\n    const tempFolder = await prepareCooldownConsumer(ctx, `e2e-consumer-blocked-${id}`, {\n      [blocked]: '1.0.0',\n    });\n\n    let errorMessage = '';\n    try {\n      await ctx.adapter.exec(\n        { cwd: tempFolder },\n        'install',\n        // pnpm 12's parser rejects the `--flag=false` form; --no-frozen-lockfile\n        // is accepted by pnpm 11 and 12 alike\n        '--no-frozen-lockfile',\n        ...ctx.adapter.registryArg(ctx.registryUrl)\n      );\n    } catch (err) {\n      errorMessage = err instanceof Error ? err.message : String(err);\n      trace('install correctly rejected by cooldown: %s', errorMessage.split('\\n')[0]);\n    }\n\n    assert.ok(\n      errorMessage,\n      `Expected install of fresh non-excluded package \"${blocked}\" to be blocked by ` +\n        `minimumReleaseAge (${MINIMUM_RELEASE_AGE} min), but it succeeded`\n    );\n    // pnpm reports ERR_PNPM_NO_MATURE_MATCHING_VERSION / \"minimumReleaseAge\" when a\n    // version is too new. Assert the failure is the cooldown, not an unrelated error.\n    assert.ok(\n      /minimumReleaseAge|NO_MATURE_MATCHING_VERSION/i.test(errorMessage),\n      `Install of \"${blocked}\" failed for an unexpected reason (expected a minimumReleaseAge ` +\n        `cooldown error):\\n${errorMessage}`\n    );\n  });\n}\n\nexport const minimumReleaseAgeScenario: TestDefinition = {\n  name: 'scenario:minimum-release-age',\n  requires: ['publish', 'install'],\n  appliesTo: isPnpm11Plus,\n  run: testMinimumReleaseAge,\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,IAAM,sBAAsB;AAG5B,IAAM,sBAAsB;CAC1B,sBAAsB;CAKtB;CACA;CACA,GAAG,CAVgC,gBAAgB,aAUhD,CAAA,CAA4B,KAAK,SAAS,QAAQ,KAAK,EAAE;CAC5D;AACF,CAAC,CAAC,KAAK,IAAI;;;;;;;;;AAUX,SAAgB,aAAa,SAAyC;CACpE,IAAI,QAAQ,SAAS,QACnB,OAAO;CAET,MAAM,QAAQ,QAAQ,KAAK,MAAM,mBAAmB;CACpD,IAAI,CAAC,OACH,OAAO;CAET,MAAM,QAAQ,SAAS,MAAM,IAAI,EAAE;CACnC,MAAM,QAAQ,SAAS,MAAM,IAAI,EAAE;CACnC,OAAO,QAAQ,MAAO,UAAU,MAAM,SAAS;AACjD;AAEA,eAAe,eAAe,KAAkB,SAAiB,SAAgC;CAC/F,MAAM,oBAAoB,SAAS,OAAO;CAC1C,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,SACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;CACA,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CACA,MAAM,mBAAmB,SAAS,OAAO;AAC3C;;;;;AAMA,eAAe,wBACb,KACA,cACA,cACiB;CACjB,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,cACA,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,OACJ,YACF;CACA,MAAM,UAAU,KAAK,YAAY,qBAAqB,GAAG,mBAAmB;CAC5E,MAAM,uCAAuC,cAAc,UAAU;CACrE,OAAO;AACT;AAEA,eAAe,sBAAsB,KAAiC;CACpE,MAAM,KAAK,IAAI;CAEf,MAAM,iBAAiB,0BAA0B;CACjD,MAAM,mBAAmB,yBAAyB;CAClD,MAAM,UAAU,2BAA2B;CAG3C,MAAM,IAAI,QAAQ,0BAA0B,YAAY;EACtD,MAAM,eAAe,KAAK,gBAAgB,OAAO;EACjD,MAAM,eAAe,KAAK,kBAAkB,OAAO;EACnD,MAAM,eAAe,KAAK,SAAS,OAAO;CAC5C,CAAC;CAGD,MAAM,IAAI,QAAQ,yCAAyC,YAAY;EACrE,MAAM,aAAa,MAAM,wBAAwB,KAAK,gCAAgC,MAAM;IACzF,iBAAiB;IACjB,mBAAmB;EACtB,CAAC;EAGD,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EAEA,MAAM,yDAAyD;CACjE,CAAC;CAGD,MAAM,IAAI,QAAQ,yCAAyC,YAAY;EACrE,MAAM,aAAa,MAAM,wBAAwB,KAAK,wBAAwB,MAAM,GACjF,UAAU,QACb,CAAC;EAED,IAAI,eAAe;EACnB,IAAI;GACF,MAAM,IAAI,QAAQ,KAChB,EAAE,KAAK,WAAW,GAClB,WAGA,wBACA,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;EACF,SAAS,KAAK;GACZ,eAAe,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GAC9D,MAAM,8CAA8C,aAAa,MAAM,IAAI,CAAC,CAAC,EAAE;EACjF;EAEA,OAAO,GACL,cACA,mDAAmD,QAAQ,wCACnC,oBAAoB,wBAC9C;EAGA,OAAO,GACL,gDAAgD,KAAK,YAAY,GACjE,eAAe,QAAQ,oFACA,cACzB;CACF,CAAC;AACH;AAEA,IAAa,4BAA4C;CACvD,MAAM;CACN,UAAU,CAAC,WAAW,SAAS;CAC/B,WAAW;CACX,KAAK;AACP"}

package/build/esm/tests/login.js

@@ -1,4 +1,5 @@
 import { createTempFolder, getPackageJSON, getREADME } from "../utils/project.js";
+import { LegacyLoginError, createUser, legacyLogin, whoami } from "../utils/registry-client.js";
 import buildDebug from "debug";
 import { join } from "path";
 import { writeFile } from "fs/promises";
@@ -110,6 +111,29 @@ async function testLogin(ctx) {
 		const who2 = await yarnWhoami(ctx, tf);
 		assert.ok(who2.includes(user2), `Expected "${user2}" after switch but got "${who2}"`);
 	});
+	for (const client of [
+		"npm",
+		"yarn",
+		"pnpm"
+	]) {
+		await ctx.subTest(`${client} logs an existing user in with the Basic retry`, async () => {
+			const user = `login-retry-${client}-${id}`;
+			const password = "retry-password-123";
+			await createUser(ctx.registryUrl, user, password);
+			const token = await legacyLogin(ctx.registryUrl, user, password, client);
+			assert.strictEqual(await whoami(ctx.registryUrl, token), user);
+		});
+		await ctx.subTest(`${client} registers a new user`, async () => {
+			const user = `login-new-${client}-${id}`;
+			const token = await legacyLogin(ctx.registryUrl, user, "retry-password-123", client);
+			assert.strictEqual(await whoami(ctx.registryUrl, token), user);
+		});
+		await ctx.subTest(`${client} cannot log an existing user in with a wrong password`, async () => {
+			const user = `login-wrong-${client}-${id}`;
+			await createUser(ctx.registryUrl, user, "retry-password-123");
+			await assert.rejects(legacyLogin(ctx.registryUrl, user, "wrong-password", client), (error) => error instanceof LegacyLoginError && error.status === 401);
+		});
+	}
 }
 var loginTest = {
 	name: "login",

package/build/esm/tests/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","names":[],"sources":["../../../src/tests/login.ts"],"sourcesContent":["import assert from 'assert';\nimport buildDebug from 'debug';\nimport { writeFile } from 'fs/promises';\nimport * as YAML from 'js-yaml';\nimport { join } from 'path';\n\nimport { TestContext, TestDefinition } from '../types';\nimport { createTempFolder, getPackageJSON, getREADME } from '../utils/project';\n\nconst debug = buildDebug('verdaccio:e2e-cli:test:login');\n\n/**\n * Creates a project with registry config but WITHOUT auth token,\n * so whoami will use the token saved by login to ~/.yarnrc.yml.\n */\nasync function prepareLoginProject(ctx: TestContext, name: string): Promise<string> {\n  debug('preparing project for %s (no auth token)', name);\n  const tempFolder = await createTempFolder(name);\n  const yamlContent = YAML.dump({\n    npmRegistryServer: ctx.registryUrl,\n    enableImmutableInstalls: false,\n    unsafeHttpWhitelist: ['localhost'],\n  });\n  await writeFile(join(tempFolder, '.yarnrc.yml'), yamlContent);\n  await writeFile(join(tempFolder, 'package.json'), JSON.stringify({ name, version: '1.0.0' }));\n  if (ctx.adapter.importPlugin) {\n    debug('importing npm-login plugin into %s', tempFolder);\n    await ctx.adapter.importPlugin(tempFolder, 'npm-login');\n  }\n  return tempFolder;\n}\n\nasync function yarnLogin(\n  ctx: TestContext,\n  cwd: string,\n  user: string,\n  password: string,\n  email: string\n) {\n  debug('yarn npm login as %s', user);\n  return ctx.adapter.exec(\n    { cwd },\n    'login',\n    '--auth-type=legacy',\n    `--user=${user}`,\n    `--password=${password}`,\n    `--email=${email}`\n  );\n}\n\nasync function yarnWhoami(ctx: TestContext, cwd: string): Promise<string> {\n  const resp = await ctx.adapter.exec({ cwd }, 'whoami');\n  debug('yarn npm whoami: %s', resp.stdout);\n  return resp.stdout;\n}\n\nasync function testLogin(ctx: TestContext): Promise<void> {\n  const type = ctx.adapter.type;\n  const id = ctx.runId;\n\n  if (type !== 'yarn-modern') {\n    debug('login test only supported for yarn-modern, skipping %s', type);\n    return;\n  }\n\n  const user1 = `login-a-${id}`;\n  const password1 = 'test-password-123';\n  const email1 = `${user1}@test.example.com`;\n\n  await ctx.subTest('create new user + whoami', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login1-${id}`);\n    const loginResp = await yarnLogin(ctx, tf, user1, password1, email1);\n    assert.ok(\n      loginResp.stdout.includes('Logged in') || loginResp.stdout.includes('token saved'),\n      `Expected login success message but got \"${loginResp.stdout}\"`\n    );\n    const who = await yarnWhoami(ctx, tf);\n    assert.ok(who.includes(user1), `Expected whoami \"${user1}\" but got \"${who}\"`);\n  });\n\n  await ctx.subTest('legacy re-login is rejected without basic auth', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login2-${id}`);\n    let loginFailed = false;\n    try {\n      await yarnLogin(ctx, tf, user1, password1, email1);\n    } catch {\n      loginFailed = true;\n    }\n    assert.ok(loginFailed, 'Legacy re-login for an existing user should fail without Basic auth');\n  });\n\n  await ctx.subTest('wrong password fails', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login3-${id}`);\n    let loginFailed = false;\n    try {\n      await yarnLogin(ctx, tf, user1, 'wrong-password', email1);\n    } catch {\n      loginFailed = true;\n    }\n    assert.ok(loginFailed, 'Login with wrong password should have failed');\n  });\n\n  await ctx.subTest('login then publish', async () => {\n    const pkgName = `@verdaccio/login-pub-${id}`;\n    const publishUser = `login-pub-${id}`;\n    const publishPassword = 'publish-password-123';\n    const publishEmail = `${publishUser}@test.example.com`;\n    const tf = await createTempFolder(`login-pub-${id}`);\n    const yamlContent = YAML.dump({\n      npmRegistryServer: ctx.registryUrl,\n      enableImmutableInstalls: false,\n      unsafeHttpWhitelist: ['localhost'],\n    });\n    await writeFile(join(tf, '.yarnrc.yml'), yamlContent);\n    await writeFile(join(tf, 'package.json'), getPackageJSON(pkgName, '1.0.0'));\n    await writeFile(join(tf, 'README.md'), getREADME(pkgName));\n    if (ctx.adapter.importPlugin) {\n      await ctx.adapter.importPlugin(tf, 'npm-login');\n    }\n    await yarnLogin(ctx, tf, publishUser, publishPassword, publishEmail);\n    await ctx.adapter.exec({ cwd: tf }, 'install');\n    const pubResp = await ctx.adapter.exec({ cwd: tf }, 'publish');\n    assert.ok(\n      pubResp.stdout.includes('Package archive published'),\n      `Expected publish success but got \"${pubResp.stdout}\"`\n    );\n  });\n\n  await ctx.subTest('switch users', async () => {\n    const switchUser1 = `login-switch-a-${id}`;\n    const switchPassword1 = 'switch-password-123';\n    const switchEmail1 = `${switchUser1}@test.example.com`;\n    const user2 = `login-b-${id}`;\n    const password2 = 'other-password-456';\n    const email2 = `${user2}@test.example.com`;\n    const tf = await prepareLoginProject(ctx, `verdaccio-login5-${id}`);\n\n    await yarnLogin(ctx, tf, switchUser1, switchPassword1, switchEmail1);\n    const who1 = await yarnWhoami(ctx, tf);\n    assert.ok(who1.includes(switchUser1), `Expected \"${switchUser1}\" but got \"${who1}\"`);\n\n    await yarnLogin(ctx, tf, user2, password2, email2);\n    const who2 = await yarnWhoami(ctx, tf);\n    assert.ok(who2.includes(user2), `Expected \"${user2}\" after switch but got \"${who2}\"`);\n  });\n}\n\nexport const loginTest: TestDefinition = {\n  name: 'login',\n  requires: ['login'],\n  run: testLogin,\n};\n"],"mappings":";;;;;;;AASA,IAAM,QAAQ,WAAW,8BAA8B;;;;;AAMvD,eAAe,oBAAoB,KAAkB,MAA+B;CAClF,MAAM,4CAA4C,IAAI;CACtD,MAAM,aAAa,MAAM,iBAAiB,IAAI;CAC9C,MAAM,cAAc,KAAK,KAAK;EAC5B,mBAAmB,IAAI;EACvB,yBAAyB;EACzB,qBAAqB,CAAC,WAAW;CACnC,CAAC;CACD,MAAM,UAAU,KAAK,YAAY,aAAa,GAAG,WAAW;CAC5D,MAAM,UAAU,KAAK,YAAY,cAAc,GAAG,KAAK,UAAU;EAAE;EAAM,SAAS;CAAQ,CAAC,CAAC;CAC5F,IAAI,IAAI,QAAQ,cAAc;EAC5B,MAAM,sCAAsC,UAAU;EACtD,MAAM,IAAI,QAAQ,aAAa,YAAY,WAAW;CACxD;CACA,OAAO;AACT;AAEA,eAAe,UACb,KACA,KACA,MACA,UACA,OACA;CACA,MAAM,wBAAwB,IAAI;CAClC,OAAO,IAAI,QAAQ,KACjB,EAAE,IAAI,GACN,SACA,sBACA,UAAU,QACV,cAAc,YACd,WAAW,OACb;AACF;AAEA,eAAe,WAAW,KAAkB,KAA8B;CACxE,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,EAAE,IAAI,GAAG,QAAQ;CACrD,MAAM,uBAAuB,KAAK,MAAM;CACxC,OAAO,KAAK;AACd;AAEA,eAAe,UAAU,KAAiC;CACxD,MAAM,OAAO,IAAI,QAAQ;CACzB,MAAM,KAAK,IAAI;CAEf,IAAI,SAAS,eAAe;EAC1B,MAAM,0DAA0D,IAAI;EACpE;CACF;CAEA,MAAM,QAAQ,WAAW;CACzB,MAAM,YAAY;CAClB,MAAM,SAAS,GAAG,MAAM;CAExB,MAAM,IAAI,QAAQ,4BAA4B,YAAY;EACxD,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,MAAM,YAAY,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACnE,OAAO,GACL,UAAU,OAAO,SAAS,WAAW,KAAK,UAAU,OAAO,SAAS,aAAa,GACjF,2CAA2C,UAAU,OAAO,EAC9D;EACA,MAAM,MAAM,MAAM,WAAW,KAAK,EAAE;EACpC,OAAO,GAAG,IAAI,SAAS,KAAK,GAAG,oBAAoB,MAAM,aAAa,IAAI,EAAE;CAC9E,CAAC;CAED,MAAM,IAAI,QAAQ,kDAAkD,YAAY;EAC9E,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,IAAI,cAAc;EAClB,IAAI;GACF,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACnD,QAAQ;GACN,cAAc;EAChB;EACA,OAAO,GAAG,aAAa,qEAAqE;CAC9F,CAAC;CAED,MAAM,IAAI,QAAQ,wBAAwB,YAAY;EACpD,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,IAAI,cAAc;EAClB,IAAI;GACF,MAAM,UAAU,KAAK,IAAI,OAAO,kBAAkB,MAAM;EAC1D,QAAQ;GACN,cAAc;EAChB;EACA,OAAO,GAAG,aAAa,8CAA8C;CACvE,CAAC;CAED,MAAM,IAAI,QAAQ,sBAAsB,YAAY;EAClD,MAAM,UAAU,wBAAwB;EACxC,MAAM,cAAc,aAAa;EACjC,MAAM,kBAAkB;EACxB,MAAM,eAAe,GAAG,YAAY;EACpC,MAAM,KAAK,MAAM,iBAAiB,aAAa,IAAI;EACnD,MAAM,cAAc,KAAK,KAAK;GAC5B,mBAAmB,IAAI;GACvB,yBAAyB;GACzB,qBAAqB,CAAC,WAAW;EACnC,CAAC;EACD,MAAM,UAAU,KAAK,IAAI,aAAa,GAAG,WAAW;EACpD,MAAM,UAAU,KAAK,IAAI,cAAc,GAAG,eAAe,SAAS,OAAO,CAAC;EAC1E,MAAM,UAAU,KAAK,IAAI,WAAW,GAAG,UAAU,OAAO,CAAC;EACzD,IAAI,IAAI,QAAQ,cACd,MAAM,IAAI,QAAQ,aAAa,IAAI,WAAW;EAEhD,MAAM,UAAU,KAAK,IAAI,aAAa,iBAAiB,YAAY;EACnE,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,GAAG,GAAG,SAAS;EAC7C,MAAM,UAAU,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,GAAG,GAAG,SAAS;EAC7D,OAAO,GACL,QAAQ,OAAO,SAAS,2BAA2B,GACnD,qCAAqC,QAAQ,OAAO,EACtD;CACF,CAAC;CAED,MAAM,IAAI,QAAQ,gBAAgB,YAAY;EAC5C,MAAM,cAAc,kBAAkB;EACtC,MAAM,kBAAkB;EACxB,MAAM,eAAe,GAAG,YAAY;EACpC,MAAM,QAAQ,WAAW;EACzB,MAAM,YAAY;EAClB,MAAM,SAAS,GAAG,MAAM;EACxB,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAElE,MAAM,UAAU,KAAK,IAAI,aAAa,iBAAiB,YAAY;EACnE,MAAM,OAAO,MAAM,WAAW,KAAK,EAAE;EACrC,OAAO,GAAG,KAAK,SAAS,WAAW,GAAG,aAAa,YAAY,aAAa,KAAK,EAAE;EAEnF,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK,EAAE;EACrC,OAAO,GAAG,KAAK,SAAS,KAAK,GAAG,aAAa,MAAM,0BAA0B,KAAK,EAAE;CACtF,CAAC;AACH;AAEA,IAAa,YAA4B;CACvC,MAAM;CACN,UAAU,CAAC,OAAO;CAClB,KAAK;AACP"}
+{"version":3,"file":"login.js","names":[],"sources":["../../../src/tests/login.ts"],"sourcesContent":["import assert from 'assert';\nimport buildDebug from 'debug';\nimport { writeFile } from 'fs/promises';\nimport * as YAML from 'js-yaml';\nimport { join } from 'path';\n\nimport { TestContext, TestDefinition } from '../types';\nimport { createTempFolder, getPackageJSON, getREADME } from '../utils/project';\nimport { LegacyLoginError, createUser, legacyLogin, whoami } from '../utils/registry-client';\n\nconst debug = buildDebug('verdaccio:e2e-cli:test:login');\n\n/**\n * Creates a project with registry config but WITHOUT auth token,\n * so whoami will use the token saved by login to ~/.yarnrc.yml.\n */\nasync function prepareLoginProject(ctx: TestContext, name: string): Promise<string> {\n  debug('preparing project for %s (no auth token)', name);\n  const tempFolder = await createTempFolder(name);\n  const yamlContent = YAML.dump({\n    npmRegistryServer: ctx.registryUrl,\n    enableImmutableInstalls: false,\n    unsafeHttpWhitelist: ['localhost'],\n  });\n  await writeFile(join(tempFolder, '.yarnrc.yml'), yamlContent);\n  await writeFile(join(tempFolder, 'package.json'), JSON.stringify({ name, version: '1.0.0' }));\n  if (ctx.adapter.importPlugin) {\n    debug('importing npm-login plugin into %s', tempFolder);\n    await ctx.adapter.importPlugin(tempFolder, 'npm-login');\n  }\n  return tempFolder;\n}\n\nasync function yarnLogin(\n  ctx: TestContext,\n  cwd: string,\n  user: string,\n  password: string,\n  email: string\n) {\n  debug('yarn npm login as %s', user);\n  return ctx.adapter.exec(\n    { cwd },\n    'login',\n    '--auth-type=legacy',\n    `--user=${user}`,\n    `--password=${password}`,\n    `--email=${email}`\n  );\n}\n\nasync function yarnWhoami(ctx: TestContext, cwd: string): Promise<string> {\n  const resp = await ctx.adapter.exec({ cwd }, 'whoami');\n  debug('yarn npm whoami: %s', resp.stdout);\n  return resp.stdout;\n}\n\nasync function testLogin(ctx: TestContext): Promise<void> {\n  const type = ctx.adapter.type;\n  const id = ctx.runId;\n\n  if (type !== 'yarn-modern') {\n    debug('login test only supported for yarn-modern, skipping %s', type);\n    return;\n  }\n\n  const user1 = `login-a-${id}`;\n  const password1 = 'test-password-123';\n  const email1 = `${user1}@test.example.com`;\n\n  await ctx.subTest('create new user + whoami', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login1-${id}`);\n    const loginResp = await yarnLogin(ctx, tf, user1, password1, email1);\n    assert.ok(\n      loginResp.stdout.includes('Logged in') || loginResp.stdout.includes('token saved'),\n      `Expected login success message but got \"${loginResp.stdout}\"`\n    );\n    const who = await yarnWhoami(ctx, tf);\n    assert.ok(who.includes(user1), `Expected whoami \"${user1}\" but got \"${who}\"`);\n  });\n\n  await ctx.subTest('legacy re-login is rejected without basic auth', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login2-${id}`);\n    let loginFailed = false;\n    try {\n      await yarnLogin(ctx, tf, user1, password1, email1);\n    } catch {\n      loginFailed = true;\n    }\n    assert.ok(loginFailed, 'Legacy re-login for an existing user should fail without Basic auth');\n  });\n\n  await ctx.subTest('wrong password fails', async () => {\n    const tf = await prepareLoginProject(ctx, `verdaccio-login3-${id}`);\n    let loginFailed = false;\n    try {\n      await yarnLogin(ctx, tf, user1, 'wrong-password', email1);\n    } catch {\n      loginFailed = true;\n    }\n    assert.ok(loginFailed, 'Login with wrong password should have failed');\n  });\n\n  await ctx.subTest('login then publish', async () => {\n    const pkgName = `@verdaccio/login-pub-${id}`;\n    const publishUser = `login-pub-${id}`;\n    const publishPassword = 'publish-password-123';\n    const publishEmail = `${publishUser}@test.example.com`;\n    const tf = await createTempFolder(`login-pub-${id}`);\n    const yamlContent = YAML.dump({\n      npmRegistryServer: ctx.registryUrl,\n      enableImmutableInstalls: false,\n      unsafeHttpWhitelist: ['localhost'],\n    });\n    await writeFile(join(tf, '.yarnrc.yml'), yamlContent);\n    await writeFile(join(tf, 'package.json'), getPackageJSON(pkgName, '1.0.0'));\n    await writeFile(join(tf, 'README.md'), getREADME(pkgName));\n    if (ctx.adapter.importPlugin) {\n      await ctx.adapter.importPlugin(tf, 'npm-login');\n    }\n    await yarnLogin(ctx, tf, publishUser, publishPassword, publishEmail);\n    await ctx.adapter.exec({ cwd: tf }, 'install');\n    const pubResp = await ctx.adapter.exec({ cwd: tf }, 'publish');\n    assert.ok(\n      pubResp.stdout.includes('Package archive published'),\n      `Expected publish success but got \"${pubResp.stdout}\"`\n    );\n  });\n\n  await ctx.subTest('switch users', async () => {\n    const switchUser1 = `login-switch-a-${id}`;\n    const switchPassword1 = 'switch-password-123';\n    const switchEmail1 = `${switchUser1}@test.example.com`;\n    const user2 = `login-b-${id}`;\n    const password2 = 'other-password-456';\n    const email2 = `${user2}@test.example.com`;\n    const tf = await prepareLoginProject(ctx, `verdaccio-login5-${id}`);\n\n    await yarnLogin(ctx, tf, switchUser1, switchPassword1, switchEmail1);\n    const who1 = await yarnWhoami(ctx, tf);\n    assert.ok(who1.includes(switchUser1), `Expected \"${switchUser1}\" but got \"${who1}\"`);\n\n    await yarnLogin(ctx, tf, user2, password2, email2);\n    const who2 = await yarnWhoami(ctx, tf);\n    assert.ok(who2.includes(user2), `Expected \"${user2}\" after switch but got \"${who2}\"`);\n  });\n\n  // replayed over HTTP: what `npm login`, native `yarn npm login` and `pnpm login` send\n  for (const client of ['npm', 'yarn', 'pnpm'] as const) {\n    await ctx.subTest(`${client} logs an existing user in with the Basic retry`, async () => {\n      const user = `login-retry-${client}-${id}`;\n      const password = 'retry-password-123';\n      await createUser(ctx.registryUrl, user, password);\n\n      const token = await legacyLogin(ctx.registryUrl, user, password, client);\n      assert.strictEqual(await whoami(ctx.registryUrl, token), user);\n    });\n\n    await ctx.subTest(`${client} registers a new user`, async () => {\n      const user = `login-new-${client}-${id}`;\n\n      const token = await legacyLogin(ctx.registryUrl, user, 'retry-password-123', client);\n      assert.strictEqual(await whoami(ctx.registryUrl, token), user);\n    });\n\n    await ctx.subTest(\n      `${client} cannot log an existing user in with a wrong password`,\n      async () => {\n        const user = `login-wrong-${client}-${id}`;\n        await createUser(ctx.registryUrl, user, 'retry-password-123');\n\n        await assert.rejects(\n          legacyLogin(ctx.registryUrl, user, 'wrong-password', client),\n          (error: unknown) => error instanceof LegacyLoginError && error.status === 401\n        );\n      }\n    );\n  }\n}\n\nexport const loginTest: TestDefinition = {\n  name: 'login',\n  requires: ['login'],\n  run: testLogin,\n};\n"],"mappings":";;;;;;;;AAUA,IAAM,QAAQ,WAAW,8BAA8B;;;;;AAMvD,eAAe,oBAAoB,KAAkB,MAA+B;CAClF,MAAM,4CAA4C,IAAI;CACtD,MAAM,aAAa,MAAM,iBAAiB,IAAI;CAC9C,MAAM,cAAc,KAAK,KAAK;EAC5B,mBAAmB,IAAI;EACvB,yBAAyB;EACzB,qBAAqB,CAAC,WAAW;CACnC,CAAC;CACD,MAAM,UAAU,KAAK,YAAY,aAAa,GAAG,WAAW;CAC5D,MAAM,UAAU,KAAK,YAAY,cAAc,GAAG,KAAK,UAAU;EAAE;EAAM,SAAS;CAAQ,CAAC,CAAC;CAC5F,IAAI,IAAI,QAAQ,cAAc;EAC5B,MAAM,sCAAsC,UAAU;EACtD,MAAM,IAAI,QAAQ,aAAa,YAAY,WAAW;CACxD;CACA,OAAO;AACT;AAEA,eAAe,UACb,KACA,KACA,MACA,UACA,OACA;CACA,MAAM,wBAAwB,IAAI;CAClC,OAAO,IAAI,QAAQ,KACjB,EAAE,IAAI,GACN,SACA,sBACA,UAAU,QACV,cAAc,YACd,WAAW,OACb;AACF;AAEA,eAAe,WAAW,KAAkB,KAA8B;CACxE,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,EAAE,IAAI,GAAG,QAAQ;CACrD,MAAM,uBAAuB,KAAK,MAAM;CACxC,OAAO,KAAK;AACd;AAEA,eAAe,UAAU,KAAiC;CACxD,MAAM,OAAO,IAAI,QAAQ;CACzB,MAAM,KAAK,IAAI;CAEf,IAAI,SAAS,eAAe;EAC1B,MAAM,0DAA0D,IAAI;EACpE;CACF;CAEA,MAAM,QAAQ,WAAW;CACzB,MAAM,YAAY;CAClB,MAAM,SAAS,GAAG,MAAM;CAExB,MAAM,IAAI,QAAQ,4BAA4B,YAAY;EACxD,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,MAAM,YAAY,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACnE,OAAO,GACL,UAAU,OAAO,SAAS,WAAW,KAAK,UAAU,OAAO,SAAS,aAAa,GACjF,2CAA2C,UAAU,OAAO,EAC9D;EACA,MAAM,MAAM,MAAM,WAAW,KAAK,EAAE;EACpC,OAAO,GAAG,IAAI,SAAS,KAAK,GAAG,oBAAoB,MAAM,aAAa,IAAI,EAAE;CAC9E,CAAC;CAED,MAAM,IAAI,QAAQ,kDAAkD,YAAY;EAC9E,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,IAAI,cAAc;EAClB,IAAI;GACF,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACnD,QAAQ;GACN,cAAc;EAChB;EACA,OAAO,GAAG,aAAa,qEAAqE;CAC9F,CAAC;CAED,MAAM,IAAI,QAAQ,wBAAwB,YAAY;EACpD,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAClE,IAAI,cAAc;EAClB,IAAI;GACF,MAAM,UAAU,KAAK,IAAI,OAAO,kBAAkB,MAAM;EAC1D,QAAQ;GACN,cAAc;EAChB;EACA,OAAO,GAAG,aAAa,8CAA8C;CACvE,CAAC;CAED,MAAM,IAAI,QAAQ,sBAAsB,YAAY;EAClD,MAAM,UAAU,wBAAwB;EACxC,MAAM,cAAc,aAAa;EACjC,MAAM,kBAAkB;EACxB,MAAM,eAAe,GAAG,YAAY;EACpC,MAAM,KAAK,MAAM,iBAAiB,aAAa,IAAI;EACnD,MAAM,cAAc,KAAK,KAAK;GAC5B,mBAAmB,IAAI;GACvB,yBAAyB;GACzB,qBAAqB,CAAC,WAAW;EACnC,CAAC;EACD,MAAM,UAAU,KAAK,IAAI,aAAa,GAAG,WAAW;EACpD,MAAM,UAAU,KAAK,IAAI,cAAc,GAAG,eAAe,SAAS,OAAO,CAAC;EAC1E,MAAM,UAAU,KAAK,IAAI,WAAW,GAAG,UAAU,OAAO,CAAC;EACzD,IAAI,IAAI,QAAQ,cACd,MAAM,IAAI,QAAQ,aAAa,IAAI,WAAW;EAEhD,MAAM,UAAU,KAAK,IAAI,aAAa,iBAAiB,YAAY;EACnE,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,GAAG,GAAG,SAAS;EAC7C,MAAM,UAAU,MAAM,IAAI,QAAQ,KAAK,EAAE,KAAK,GAAG,GAAG,SAAS;EAC7D,OAAO,GACL,QAAQ,OAAO,SAAS,2BAA2B,GACnD,qCAAqC,QAAQ,OAAO,EACtD;CACF,CAAC;CAED,MAAM,IAAI,QAAQ,gBAAgB,YAAY;EAC5C,MAAM,cAAc,kBAAkB;EACtC,MAAM,kBAAkB;EACxB,MAAM,eAAe,GAAG,YAAY;EACpC,MAAM,QAAQ,WAAW;EACzB,MAAM,YAAY;EAClB,MAAM,SAAS,GAAG,MAAM;EACxB,MAAM,KAAK,MAAM,oBAAoB,KAAK,oBAAoB,IAAI;EAElE,MAAM,UAAU,KAAK,IAAI,aAAa,iBAAiB,YAAY;EACnE,MAAM,OAAO,MAAM,WAAW,KAAK,EAAE;EACrC,OAAO,GAAG,KAAK,SAAS,WAAW,GAAG,aAAa,YAAY,aAAa,KAAK,EAAE;EAEnF,MAAM,UAAU,KAAK,IAAI,OAAO,WAAW,MAAM;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK,EAAE;EACrC,OAAO,GAAG,KAAK,SAAS,KAAK,GAAG,aAAa,MAAM,0BAA0B,KAAK,EAAE;CACtF,CAAC;CAGD,KAAK,MAAM,UAAU;EAAC;EAAO;EAAQ;CAAM,GAAY;EACrD,MAAM,IAAI,QAAQ,GAAG,OAAO,iDAAiD,YAAY;GACvF,MAAM,OAAO,eAAe,OAAO,GAAG;GACtC,MAAM,WAAW;GACjB,MAAM,WAAW,IAAI,aAAa,MAAM,QAAQ;GAEhD,MAAM,QAAQ,MAAM,YAAY,IAAI,aAAa,MAAM,UAAU,MAAM;GACvE,OAAO,YAAY,MAAM,OAAO,IAAI,aAAa,KAAK,GAAG,IAAI;EAC/D,CAAC;EAED,MAAM,IAAI,QAAQ,GAAG,OAAO,wBAAwB,YAAY;GAC9D,MAAM,OAAO,aAAa,OAAO,GAAG;GAEpC,MAAM,QAAQ,MAAM,YAAY,IAAI,aAAa,MAAM,sBAAsB,MAAM;GACnF,OAAO,YAAY,MAAM,OAAO,IAAI,aAAa,KAAK,GAAG,IAAI;EAC/D,CAAC;EAED,MAAM,IAAI,QACR,GAAG,OAAO,wDACV,YAAY;GACV,MAAM,OAAO,eAAe,OAAO,GAAG;GACtC,MAAM,WAAW,IAAI,aAAa,MAAM,oBAAoB;GAE5D,MAAM,OAAO,QACX,YAAY,IAAI,aAAa,MAAM,kBAAkB,MAAM,IAC1D,UAAmB,iBAAiB,oBAAoB,MAAM,WAAW,GAC5E;EACF,CACF;CACF;AACF;AAEA,IAAa,YAA4B;CACvC,MAAM;CACN,UAAU,CAAC,OAAO;CAClB,KAAK;AACP"}

package/build/esm/tests/ping.js

@@ -1,3 +1,4 @@
+import { stripTrailingSlashes } from "../utils/http-client.js";
 import assert from "assert";
 //#region src/tests/ping.ts
 async function testPing(ctx) {
@@ -10,7 +11,7 @@ async function testPing(ctx) {
 	if (type === "yarn-modern") assert.ok(true, "ping succeeded");
 	else {
 		const parsedBody = JSON.parse(resp.stdout);
-		assert.strictEqual(parsedBody.registry, ctx.registryUrl + "/", `Expected registry "${ctx.registryUrl}/" but got "${parsedBody.registry}"`);
+		assert.strictEqual(stripTrailingSlashes(String(parsedBody.registry)), stripTrailingSlashes(ctx.registryUrl), `Expected registry "${ctx.registryUrl}/" but got "${parsedBody.registry}"`);
 	}
 }
 var pingTest = {

package/build/esm/tests/ping.js.map

@@ -1 +1 @@
-{"version":3,"file":"ping.js","names":[],"sources":["../../../src/tests/ping.ts"],"sourcesContent":["import assert from 'assert';\n\nimport { TestContext, TestDefinition } from '../types';\n\nasync function testPing(ctx: TestContext): Promise<void> {\n  const type = ctx.adapter.type;\n\n  // Always run from a prepared project: its .npmrc carries the fresh token and\n  // shields the test from whatever the developer's global ~/.npmrc has for\n  // this registry (a stale token there would turn into a spurious E401).\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    `verdaccio-ping-${ctx.runId}`,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token\n  );\n  const cwd = tempFolder;\n  if (type === 'yarn-modern' && ctx.adapter.importPlugin) {\n    await ctx.adapter.importPlugin(tempFolder, 'npm-ping');\n  }\n\n  const jsonFlag = type === 'yarn-modern' ? [] : ['--json'];\n  const resp = await ctx.adapter.exec(\n    { cwd },\n    'ping',\n    ...jsonFlag,\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n\n  if (type === 'yarn-modern') {\n    // yarn npm ping succeeding (exit code 0) is sufficient proof the registry is reachable\n    assert.ok(true, 'ping succeeded');\n  } else {\n    const parsedBody = JSON.parse(resp.stdout);\n    assert.strictEqual(\n      parsedBody.registry,\n      ctx.registryUrl + '/',\n      `Expected registry \"${ctx.registryUrl}/\" but got \"${parsedBody.registry}\"`\n    );\n  }\n}\n\nexport const pingTest: TestDefinition = {\n  name: 'ping',\n  requires: ['ping'],\n  run: testPing,\n};\n"],"mappings":";;AAIA,eAAe,SAAS,KAAiC;CACvD,MAAM,OAAO,IAAI,QAAQ;CAKzB,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,kBAAkB,IAAI,SACtB,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;CACA,MAAM,MAAM;CACZ,IAAI,SAAS,iBAAiB,IAAI,QAAQ,cACxC,MAAM,IAAI,QAAQ,aAAa,YAAY,UAAU;CAGvD,MAAM,WAAW,SAAS,gBAAgB,CAAC,IAAI,CAAC,QAAQ;CACxD,MAAM,OAAO,MAAM,IAAI,QAAQ,KAC7B,EAAE,IAAI,GACN,QACA,GAAG,UACH,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CAEA,IAAI,SAAS,eAEX,OAAO,GAAG,MAAM,gBAAgB;MAC3B;EACL,MAAM,aAAa,KAAK,MAAM,KAAK,MAAM;EACzC,OAAO,YACL,WAAW,UACX,IAAI,cAAc,KAClB,sBAAsB,IAAI,YAAY,cAAc,WAAW,SAAS,EAC1E;CACF;AACF;AAEA,IAAa,WAA2B;CACtC,MAAM;CACN,UAAU,CAAC,MAAM;CACjB,KAAK;AACP"}
+{"version":3,"file":"ping.js","names":[],"sources":["../../../src/tests/ping.ts"],"sourcesContent":["import assert from 'assert';\n\nimport { TestContext, TestDefinition } from '../types';\nimport { stripTrailingSlashes } from '../utils/http-client';\n\nasync function testPing(ctx: TestContext): Promise<void> {\n  const type = ctx.adapter.type;\n\n  // Always run from a prepared project: its .npmrc carries the fresh token and\n  // shields the test from whatever the developer's global ~/.npmrc has for\n  // this registry (a stale token there would turn into a spurious E401).\n  const { tempFolder } = await ctx.adapter.prepareProject(\n    `verdaccio-ping-${ctx.runId}`,\n    '1.0.0',\n    ctx.registryUrl,\n    ctx.port,\n    ctx.token\n  );\n  const cwd = tempFolder;\n  if (type === 'yarn-modern' && ctx.adapter.importPlugin) {\n    await ctx.adapter.importPlugin(tempFolder, 'npm-ping');\n  }\n\n  const jsonFlag = type === 'yarn-modern' ? [] : ['--json'];\n  const resp = await ctx.adapter.exec(\n    { cwd },\n    'ping',\n    ...jsonFlag,\n    ...ctx.adapter.registryArg(ctx.registryUrl)\n  );\n\n  if (type === 'yarn-modern') {\n    // yarn npm ping succeeding (exit code 0) is sufficient proof the registry is reachable\n    assert.ok(true, 'ping succeeded');\n  } else {\n    const parsedBody = JSON.parse(resp.stdout);\n    // npm adds the trailing slash to a bare host but not to a path such as pnpr's /npm\n    assert.strictEqual(\n      stripTrailingSlashes(String(parsedBody.registry)),\n      stripTrailingSlashes(ctx.registryUrl),\n      `Expected registry \"${ctx.registryUrl}/\" but got \"${parsedBody.registry}\"`\n    );\n  }\n}\n\nexport const pingTest: TestDefinition = {\n  name: 'ping',\n  requires: ['ping'],\n  run: testPing,\n};\n"],"mappings":";;;AAKA,eAAe,SAAS,KAAiC;CACvD,MAAM,OAAO,IAAI,QAAQ;CAKzB,MAAM,EAAE,eAAe,MAAM,IAAI,QAAQ,eACvC,kBAAkB,IAAI,SACtB,SACA,IAAI,aACJ,IAAI,MACJ,IAAI,KACN;CACA,MAAM,MAAM;CACZ,IAAI,SAAS,iBAAiB,IAAI,QAAQ,cACxC,MAAM,IAAI,QAAQ,aAAa,YAAY,UAAU;CAGvD,MAAM,WAAW,SAAS,gBAAgB,CAAC,IAAI,CAAC,QAAQ;CACxD,MAAM,OAAO,MAAM,IAAI,QAAQ,KAC7B,EAAE,IAAI,GACN,QACA,GAAG,UACH,GAAG,IAAI,QAAQ,YAAY,IAAI,WAAW,CAC5C;CAEA,IAAI,SAAS,eAEX,OAAO,GAAG,MAAM,gBAAgB;MAC3B;EACL,MAAM,aAAa,KAAK,MAAM,KAAK,MAAM;EAEzC,OAAO,YACL,qBAAqB,OAAO,WAAW,QAAQ,CAAC,GAChD,qBAAqB,IAAI,WAAW,GACpC,sBAAsB,IAAI,YAAY,cAAc,WAAW,SAAS,EAC1E;CACF;AACF;AAEA,IAAa,WAA2B;CACtC,MAAM;CACN,UAAU,CAAC,MAAM;CACjB,KAAK;AACP"}

package/build/esm/utils/http-client.js

@@ -8,6 +8,12 @@ var ABBREVIATED_ACCEPT = "application/vnd.npm.install-v1+json";
 * Registry URL for a package name. Scoped names are encoded with the same
 * `%2f` form npm clients use: `@scope%2fname`.
 */
+/** `url` without trailing slashes; a loop instead of a regex, which CodeQL flags as ReDoS-prone. */
+function stripTrailingSlashes(url) {
+	let end = url.length;
+	while (end > 0 && url[end - 1] === "/") end--;
+	return url.slice(0, end);
+}
 function packumentUrl(registryUrl, pkgName) {
 	const encoded = pkgName.startsWith("@") ? pkgName.replaceAll("/", "%2f") : pkgName;
 	return `${registryUrl.replace(/\/$/, "")}/${encoded}`;
@@ -100,6 +106,6 @@ function computeDist(buffer) {
 	};
 }
 //#endregion
-export { ABBREVIATED_ACCEPT, computeDist, downloadTarball, fetchPackument, packumentUrl };
+export { ABBREVIATED_ACCEPT, computeDist, downloadTarball, fetchPackument, packumentUrl, stripTrailingSlashes };
 
 //# sourceMappingURL=http-client.js.map

package/build/esm/utils/http-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-client.js","names":[],"sources":["../../../src/utils/http-client.ts"],"sourcesContent":["import { createHash } from 'crypto';\nimport buildDebug from 'debug';\nimport { get } from 'http';\n\nconst debug = buildDebug('verdaccio:e2e-cli:http-client');\n\nexport type PackumentResponse = {\n  status: number;\n  headers: Headers;\n  /** Parsed JSON body, or undefined when the response is not JSON (e.g. 304) */\n  body?: any;\n};\n\nexport type TarballDownload = {\n  status: number;\n  headers: Headers;\n  /** Total bytes received */\n  bytes: number;\n  /** hex-encoded sha1 of the received bytes (matches dist.shasum) */\n  sha1: string;\n  /** `sha512-<base64>` of the received bytes (matches dist.integrity) */\n  integrity: string;\n};\n\nexport type FetchPackumentOptions = {\n  /** Request the abbreviated (install) metadata format */\n  abbreviated?: boolean;\n  /** Send If-None-Match with this value */\n  etag?: string;\n  /** Bearer token */\n  token?: string;\n};\n\nexport const ABBREVIATED_ACCEPT = 'application/vnd.npm.install-v1+json';\n\n/**\n * Registry URL for a package name. Scoped names are encoded with the same\n * `%2f` form npm clients use: `@scope%2fname`.\n */\nexport function packumentUrl(registryUrl: string, pkgName: string): string {\n  const encoded = pkgName.startsWith('@') ? pkgName.replaceAll('/', '%2f') : pkgName;\n  return `${registryUrl.replace(/\\/$/, '')}/${encoded}`;\n}\n\nexport async function fetchPackument(\n  registryUrl: string,\n  pkgName: string,\n  options: FetchPackumentOptions = {}\n): Promise<PackumentResponse> {\n  const url = packumentUrl(registryUrl, pkgName);\n  const headers: Record<string, string> = {};\n  if (options.abbreviated) {\n    headers['Accept'] = ABBREVIATED_ACCEPT;\n  }\n  if (options.etag) {\n    headers['If-None-Match'] = options.etag;\n  }\n  if (options.token) {\n    headers['Authorization'] = `Bearer ${options.token}`;\n  }\n  debug('GET %s %o', url, headers);\n\n  // Conditional requests must bypass fetch(): undici appends\n  // `cache-control: no-cache` whenever If-None-Match is present, which\n  // (correctly, per HTTP semantics) disables the server's 304 revalidation.\n  if (options.etag) {\n    return new Promise((resolve, reject) => {\n      get(url, { headers }, (response) => {\n        let text = '';\n        response.setEncoding('utf8');\n        response.on('data', (chunk) => (text += chunk));\n        response.on('end', () => {\n          let body: any;\n          try {\n            body = JSON.parse(text);\n          } catch {\n            body = undefined;\n          }\n          const responseHeaders = new Headers();\n          for (const [name, value] of Object.entries(response.headers)) {\n            if (value !== undefined) {\n              responseHeaders.set(name, Array.isArray(value) ? value.join(', ') : value);\n            }\n          }\n          resolve({ status: response.statusCode || 0, headers: responseHeaders, body });\n        });\n      }).on('error', reject);\n    });\n  }\n\n  const response = await fetch(url, { headers });\n  let body: any;\n  if (response.status !== 304) {\n    const text = await response.text();\n    try {\n      body = JSON.parse(text);\n    } catch {\n      body = undefined;\n    }\n  }\n  return { status: response.status, headers: response.headers, body };\n}\n\nexport type DownloadTarballOptions = {\n  signal?: AbortSignal;\n  token?: string;\n  /** Called after the first chunk of the body arrives (useful to abort mid-stream) */\n  onFirstChunk?: () => void;\n  /** Called after every chunk with the total bytes received so far (useful to abort at a threshold) */\n  onChunk?: (bytesReceived: number) => void;\n};\n\n/**\n * Download a tarball fully, computing sha1/sha512 integrity on the fly.\n * Rejects with the underlying error when aborted or the connection drops.\n */\nexport async function downloadTarball(\n  url: string,\n  options: DownloadTarballOptions = {}\n): Promise<TarballDownload> {\n  const headers: Record<string, string> = {};\n  if (options.token) {\n    headers['Authorization'] = `Bearer ${options.token}`;\n  }\n  debug('GET (tarball) %s', url);\n  const response = await fetch(url, { headers, signal: options.signal });\n\n  const sha1 = createHash('sha1');\n  const sha512 = createHash('sha512');\n  let bytes = 0;\n  let first = true;\n\n  if (response.body) {\n    for await (const chunk of response.body as any) {\n      const buf = Buffer.from(chunk);\n      bytes += buf.length;\n      sha1.update(buf);\n      sha512.update(buf);\n      if (first) {\n        first = false;\n        options.onFirstChunk?.();\n      }\n      options.onChunk?.(bytes);\n    }\n  }\n\n  return {\n    status: response.status,\n    headers: response.headers,\n    bytes,\n    sha1: sha1.digest('hex'),\n    integrity: `sha512-${sha512.digest('base64')}`,\n  };\n}\n\n/** Compute npm-style dist values (shasum/integrity) for a buffer. */\nexport function computeDist(buffer: Buffer): { shasum: string; integrity: string } {\n  return {\n    shasum: createHash('sha1').update(buffer).digest('hex'),\n    integrity: `sha512-${createHash('sha512').update(buffer).digest('base64')}`,\n  };\n}\n"],"mappings":";;;;AAIA,IAAM,QAAQ,WAAW,+BAA+B;AA6BxD,IAAa,qBAAqB;;;;;AAMlC,SAAgB,aAAa,aAAqB,SAAyB;CACzE,MAAM,UAAU,QAAQ,WAAW,GAAG,IAAI,QAAQ,WAAW,KAAK,KAAK,IAAI;CAC3E,OAAO,GAAG,YAAY,QAAQ,OAAO,EAAE,EAAE,GAAG;AAC9C;AAEA,eAAsB,eACpB,aACA,SACA,UAAiC,CAAC,GACN;CAC5B,MAAM,MAAM,aAAa,aAAa,OAAO;CAC7C,MAAM,UAAkC,CAAC;CACzC,IAAI,QAAQ,aACV,QAAQ,YAAY;CAEtB,IAAI,QAAQ,MACV,QAAQ,mBAAmB,QAAQ;CAErC,IAAI,QAAQ,OACV,QAAQ,mBAAmB,UAAU,QAAQ;CAE/C,MAAM,aAAa,KAAK,OAAO;CAK/B,IAAI,QAAQ,MACV,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,IAAI,KAAK,EAAE,QAAQ,IAAI,aAAa;GAClC,IAAI,OAAO;GACX,SAAS,YAAY,MAAM;GAC3B,SAAS,GAAG,SAAS,UAAW,QAAQ,KAAM;GAC9C,SAAS,GAAG,aAAa;IACvB,IAAI;IACJ,IAAI;KACF,OAAO,KAAK,MAAM,IAAI;IACxB,QAAQ;KACN,OAAO,KAAA;IACT;IACA,MAAM,kBAAkB,IAAI,QAAQ;IACpC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,SAAS,OAAO,GACzD,IAAI,UAAU,KAAA,GACZ,gBAAgB,IAAI,MAAM,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK;IAG7E,QAAQ;KAAE,QAAQ,SAAS,cAAc;KAAG,SAAS;KAAiB;IAAK,CAAC;GAC9E,CAAC;EACH,CAAC,CAAC,CAAC,GAAG,SAAS,MAAM;CACvB,CAAC;CAGH,MAAM,WAAW,MAAM,MAAM,KAAK,EAAE,QAAQ,CAAC;CAC7C,IAAI;CACJ,IAAI,SAAS,WAAW,KAAK;EAC3B,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,IAAI;GACF,OAAO,KAAK,MAAM,IAAI;EACxB,QAAQ;GACN,OAAO,KAAA;EACT;CACF;CACA,OAAO;EAAE,QAAQ,SAAS;EAAQ,SAAS,SAAS;EAAS;CAAK;AACpE;;;;;AAeA,eAAsB,gBACpB,KACA,UAAkC,CAAC,GACT;CAC1B,MAAM,UAAkC,CAAC;CACzC,IAAI,QAAQ,OACV,QAAQ,mBAAmB,UAAU,QAAQ;CAE/C,MAAM,oBAAoB,GAAG;CAC7B,MAAM,WAAW,MAAM,MAAM,KAAK;EAAE;EAAS,QAAQ,QAAQ;CAAO,CAAC;CAErE,MAAM,OAAO,WAAW,MAAM;CAC9B,MAAM,SAAS,WAAW,QAAQ;CAClC,IAAI,QAAQ;CACZ,IAAI,QAAQ;CAEZ,IAAI,SAAS,MACX,WAAW,MAAM,SAAS,SAAS,MAAa;EAC9C,MAAM,MAAM,OAAO,KAAK,KAAK;EAC7B,SAAS,IAAI;EACb,KAAK,OAAO,GAAG;EACf,OAAO,OAAO,GAAG;EACjB,IAAI,OAAO;GACT,QAAQ;GACR,QAAQ,eAAe;EACzB;EACA,QAAQ,UAAU,KAAK;CACzB;CAGF,OAAO;EACL,QAAQ,SAAS;EACjB,SAAS,SAAS;EAClB;EACA,MAAM,KAAK,OAAO,KAAK;EACvB,WAAW,UAAU,OAAO,OAAO,QAAQ;CAC7C;AACF;;AAGA,SAAgB,YAAY,QAAuD;CACjF,OAAO;EACL,QAAQ,WAAW,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,OAAO,KAAK;EACtD,WAAW,UAAU,WAAW,QAAQ,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,OAAO,QAAQ;CAC1E;AACF"}
+{"version":3,"file":"http-client.js","names":[],"sources":["../../../src/utils/http-client.ts"],"sourcesContent":["import { createHash } from 'crypto';\nimport buildDebug from 'debug';\nimport { get } from 'http';\n\nconst debug = buildDebug('verdaccio:e2e-cli:http-client');\n\nexport type PackumentResponse = {\n  status: number;\n  headers: Headers;\n  /** Parsed JSON body, or undefined when the response is not JSON (e.g. 304) */\n  body?: any;\n};\n\nexport type TarballDownload = {\n  status: number;\n  headers: Headers;\n  /** Total bytes received */\n  bytes: number;\n  /** hex-encoded sha1 of the received bytes (matches dist.shasum) */\n  sha1: string;\n  /** `sha512-<base64>` of the received bytes (matches dist.integrity) */\n  integrity: string;\n};\n\nexport type FetchPackumentOptions = {\n  /** Request the abbreviated (install) metadata format */\n  abbreviated?: boolean;\n  /** Send If-None-Match with this value */\n  etag?: string;\n  /** Bearer token */\n  token?: string;\n};\n\nexport const ABBREVIATED_ACCEPT = 'application/vnd.npm.install-v1+json';\n\n/**\n * Registry URL for a package name. Scoped names are encoded with the same\n * `%2f` form npm clients use: `@scope%2fname`.\n */\n/** `url` without trailing slashes; a loop instead of a regex, which CodeQL flags as ReDoS-prone. */\nexport function stripTrailingSlashes(url: string): string {\n  let end = url.length;\n  while (end > 0 && url[end - 1] === '/') end--;\n  return url.slice(0, end);\n}\n\nexport function packumentUrl(registryUrl: string, pkgName: string): string {\n  const encoded = pkgName.startsWith('@') ? pkgName.replaceAll('/', '%2f') : pkgName;\n  return `${registryUrl.replace(/\\/$/, '')}/${encoded}`;\n}\n\nexport async function fetchPackument(\n  registryUrl: string,\n  pkgName: string,\n  options: FetchPackumentOptions = {}\n): Promise<PackumentResponse> {\n  const url = packumentUrl(registryUrl, pkgName);\n  const headers: Record<string, string> = {};\n  if (options.abbreviated) {\n    headers['Accept'] = ABBREVIATED_ACCEPT;\n  }\n  if (options.etag) {\n    headers['If-None-Match'] = options.etag;\n  }\n  if (options.token) {\n    headers['Authorization'] = `Bearer ${options.token}`;\n  }\n  debug('GET %s %o', url, headers);\n\n  // Conditional requests must bypass fetch(): undici appends\n  // `cache-control: no-cache` whenever If-None-Match is present, which\n  // (correctly, per HTTP semantics) disables the server's 304 revalidation.\n  if (options.etag) {\n    return new Promise((resolve, reject) => {\n      get(url, { headers }, (response) => {\n        let text = '';\n        response.setEncoding('utf8');\n        response.on('data', (chunk) => (text += chunk));\n        response.on('end', () => {\n          let body: any;\n          try {\n            body = JSON.parse(text);\n          } catch {\n            body = undefined;\n          }\n          const responseHeaders = new Headers();\n          for (const [name, value] of Object.entries(response.headers)) {\n            if (value !== undefined) {\n              responseHeaders.set(name, Array.isArray(value) ? value.join(', ') : value);\n            }\n          }\n          resolve({ status: response.statusCode || 0, headers: responseHeaders, body });\n        });\n      }).on('error', reject);\n    });\n  }\n\n  const response = await fetch(url, { headers });\n  let body: any;\n  if (response.status !== 304) {\n    const text = await response.text();\n    try {\n      body = JSON.parse(text);\n    } catch {\n      body = undefined;\n    }\n  }\n  return { status: response.status, headers: response.headers, body };\n}\n\nexport type DownloadTarballOptions = {\n  signal?: AbortSignal;\n  token?: string;\n  /** Called after the first chunk of the body arrives (useful to abort mid-stream) */\n  onFirstChunk?: () => void;\n  /** Called after every chunk with the total bytes received so far (useful to abort at a threshold) */\n  onChunk?: (bytesReceived: number) => void;\n};\n\n/**\n * Download a tarball fully, computing sha1/sha512 integrity on the fly.\n * Rejects with the underlying error when aborted or the connection drops.\n */\nexport async function downloadTarball(\n  url: string,\n  options: DownloadTarballOptions = {}\n): Promise<TarballDownload> {\n  const headers: Record<string, string> = {};\n  if (options.token) {\n    headers['Authorization'] = `Bearer ${options.token}`;\n  }\n  debug('GET (tarball) %s', url);\n  const response = await fetch(url, { headers, signal: options.signal });\n\n  const sha1 = createHash('sha1');\n  const sha512 = createHash('sha512');\n  let bytes = 0;\n  let first = true;\n\n  if (response.body) {\n    for await (const chunk of response.body as any) {\n      const buf = Buffer.from(chunk);\n      bytes += buf.length;\n      sha1.update(buf);\n      sha512.update(buf);\n      if (first) {\n        first = false;\n        options.onFirstChunk?.();\n      }\n      options.onChunk?.(bytes);\n    }\n  }\n\n  return {\n    status: response.status,\n    headers: response.headers,\n    bytes,\n    sha1: sha1.digest('hex'),\n    integrity: `sha512-${sha512.digest('base64')}`,\n  };\n}\n\n/** Compute npm-style dist values (shasum/integrity) for a buffer. */\nexport function computeDist(buffer: Buffer): { shasum: string; integrity: string } {\n  return {\n    shasum: createHash('sha1').update(buffer).digest('hex'),\n    integrity: `sha512-${createHash('sha512').update(buffer).digest('base64')}`,\n  };\n}\n"],"mappings":";;;;AAIA,IAAM,QAAQ,WAAW,+BAA+B;AA6BxD,IAAa,qBAAqB;;;;;;AAOlC,SAAgB,qBAAqB,KAAqB;CACxD,IAAI,MAAM,IAAI;CACd,OAAO,MAAM,KAAK,IAAI,MAAM,OAAO,KAAK;CACxC,OAAO,IAAI,MAAM,GAAG,GAAG;AACzB;AAEA,SAAgB,aAAa,aAAqB,SAAyB;CACzE,MAAM,UAAU,QAAQ,WAAW,GAAG,IAAI,QAAQ,WAAW,KAAK,KAAK,IAAI;CAC3E,OAAO,GAAG,YAAY,QAAQ,OAAO,EAAE,EAAE,GAAG;AAC9C;AAEA,eAAsB,eACpB,aACA,SACA,UAAiC,CAAC,GACN;CAC5B,MAAM,MAAM,aAAa,aAAa,OAAO;CAC7C,MAAM,UAAkC,CAAC;CACzC,IAAI,QAAQ,aACV,QAAQ,YAAY;CAEtB,IAAI,QAAQ,MACV,QAAQ,mBAAmB,QAAQ;CAErC,IAAI,QAAQ,OACV,QAAQ,mBAAmB,UAAU,QAAQ;CAE/C,MAAM,aAAa,KAAK,OAAO;CAK/B,IAAI,QAAQ,MACV,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,IAAI,KAAK,EAAE,QAAQ,IAAI,aAAa;GAClC,IAAI,OAAO;GACX,SAAS,YAAY,MAAM;GAC3B,SAAS,GAAG,SAAS,UAAW,QAAQ,KAAM;GAC9C,SAAS,GAAG,aAAa;IACvB,IAAI;IACJ,IAAI;KACF,OAAO,KAAK,MAAM,IAAI;IACxB,QAAQ;KACN,OAAO,KAAA;IACT;IACA,MAAM,kBAAkB,IAAI,QAAQ;IACpC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,SAAS,OAAO,GACzD,IAAI,UAAU,KAAA,GACZ,gBAAgB,IAAI,MAAM,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK;IAG7E,QAAQ;KAAE,QAAQ,SAAS,cAAc;KAAG,SAAS;KAAiB;IAAK,CAAC;GAC9E,CAAC;EACH,CAAC,CAAC,CAAC,GAAG,SAAS,MAAM;CACvB,CAAC;CAGH,MAAM,WAAW,MAAM,MAAM,KAAK,EAAE,QAAQ,CAAC;CAC7C,IAAI;CACJ,IAAI,SAAS,WAAW,KAAK;EAC3B,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,IAAI;GACF,OAAO,KAAK,MAAM,IAAI;EACxB,QAAQ;GACN,OAAO,KAAA;EACT;CACF;CACA,OAAO;EAAE,QAAQ,SAAS;EAAQ,SAAS,SAAS;EAAS;CAAK;AACpE;;;;;AAeA,eAAsB,gBACpB,KACA,UAAkC,CAAC,GACT;CAC1B,MAAM,UAAkC,CAAC;CACzC,IAAI,QAAQ,OACV,QAAQ,mBAAmB,UAAU,QAAQ;CAE/C,MAAM,oBAAoB,GAAG;CAC7B,MAAM,WAAW,MAAM,MAAM,KAAK;EAAE;EAAS,QAAQ,QAAQ;CAAO,CAAC;CAErE,MAAM,OAAO,WAAW,MAAM;CAC9B,MAAM,SAAS,WAAW,QAAQ;CAClC,IAAI,QAAQ;CACZ,IAAI,QAAQ;CAEZ,IAAI,SAAS,MACX,WAAW,MAAM,SAAS,SAAS,MAAa;EAC9C,MAAM,MAAM,OAAO,KAAK,KAAK;EAC7B,SAAS,IAAI;EACb,KAAK,OAAO,GAAG;EACf,OAAO,OAAO,GAAG;EACjB,IAAI,OAAO;GACT,QAAQ;GACR,QAAQ,eAAe;EACzB;EACA,QAAQ,UAAU,KAAK;CACzB;CAGF,OAAO;EACL,QAAQ,SAAS;EACjB,SAAS,SAAS;EAClB;EACA,MAAM,KAAK,OAAO,KAAK;EACvB,WAAW,UAAU,OAAO,OAAO,QAAQ;CAC7C;AACF;;AAGA,SAAgB,YAAY,QAAuD;CACjF,OAAO;EACL,QAAQ,WAAW,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,OAAO,KAAK;EACtD,WAAW,UAAU,WAAW,QAAQ,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,OAAO,QAAQ;CAC1E;AACF"}

package/build/esm/utils/registry-client.js

@@ -47,7 +47,63 @@ async function pingRegistry(registryUrl) {
 		return false;
 	}
 }
+var LegacyLoginError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+	}
+};
+/**
+* Replays the legacy login the way each client sends it. npm and Yarn retry a
+* 409 with Basic (Yarn on the GET too); pnpm sends Basic on a single PUT. A
+* registry that authenticates the first PUT is accepted too.
+*/
+async function legacyLogin(registryUrl, user, password, client) {
+	const userUrl = `${registryUrl}/-/user/org.couchdb.user:${encodeURIComponent(user)}`;
+	const basic = `Basic ${Buffer.from(`${user}:${password}`).toString("base64")}`;
+	const jsonHeaders = { "Content-Type": "application/json" };
+	const body = {
+		_id: `org.couchdb.user:${user}`,
+		name: user,
+		password,
+		type: "user",
+		roles: [],
+		date: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	const put = (url, headers) => fetch(url, {
+		method: "PUT",
+		headers,
+		body: JSON.stringify(body)
+	});
+	const first = await put(userUrl, client === "pnpm" ? {
+		...jsonHeaders,
+		Authorization: basic,
+		"npm-auth-type": "web"
+	} : jsonHeaders);
+	const firstBody = await first.json();
+	if (first.ok && firstBody.token) {
+		debug("%s: first PUT authenticated %s", client, user);
+		return firstBody.token;
+	}
+	if (first.status !== 409) throw new LegacyLoginError(`first PUT answered ${first.status}`, first.status);
+	const current = await fetch(`${userUrl}?write=true`, { headers: client === "yarn" ? { Authorization: basic } : {} });
+	if (!current.ok) throw new LegacyLoginError(`GET answered ${current.status}`, current.status);
+	const currentBody = await current.json();
+	for (const [key, value] of Object.entries(currentBody)) if (!body[key] || key === "roles") body[key] = value;
+	const second = await put(`${userUrl}/-rev/${body._rev}`, {
+		...jsonHeaders,
+		Authorization: basic
+	});
+	const secondBody = await second.json();
+	if (!second.ok || !secondBody.token) throw new LegacyLoginError(`PUT with revision answered ${second.status}`, second.status);
+	return secondBody.token;
+}
+async function whoami(registryUrl, token) {
+	const response = await fetch(`${registryUrl}/-/whoami`, { headers: { Authorization: `Bearer ${token}` } });
+	return response.ok ? (await response.json()).username : void 0;
+}
 //#endregion
-export { createUser, pingRegistry };
+export { LegacyLoginError, createUser, legacyLogin, pingRegistry, whoami };
 
 //# sourceMappingURL=registry-client.js.map

package/build/esm/utils/registry-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry-client.js","names":[],"sources":["../../../src/utils/registry-client.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { ping } from '@verdaccio/registry-cli';\n\nconst debug = buildDebug('verdaccio:e2e-cli:registry-client');\n\nexport type RegistryAuth = {\n  token: string;\n  user: string;\n};\n\n/**\n * Creates a user on the registry and returns the auth token.\n * Uses a unique username per run to avoid 409 conflicts.\n * Works against any running Verdaccio instance with htpasswd auth.\n */\nexport async function createUser(\n  registryUrl: string,\n  user = `e2e-user-${Date.now()}`,\n  password = 'e2e-test-password'\n): Promise<RegistryAuth> {\n  debug('creating user %s on %s', user, registryUrl);\n  const url = `${registryUrl}/-/user/org.couchdb.user:${encodeURIComponent(user)}`;\n  const response = await fetch(url, {\n    method: 'PUT',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      name: user,\n      password,\n      _id: `org.couchdb.user:${user}`,\n      type: 'user',\n      roles: [],\n      date: new Date().toISOString(),\n    }),\n  });\n\n  const body = (await response.json()) as any;\n\n  if (response.status === 201 || response.status === 200 || response.status === 409) {\n    const token = body.token;\n    if (token) {\n      debug('user %s authenticated, token obtained', user);\n      return { token, user };\n    }\n  }\n\n  throw new Error(\n    `Failed to create/login user \"${user}\" on ${registryUrl}: ${response.status} ${JSON.stringify(body)}`\n  );\n}\n\n/**\n * Ping the registry to check it's alive.\n * Uses @verdaccio/registry-cli ping.\n */\nexport async function pingRegistry(registryUrl: string): Promise<boolean> {\n  debug('pinging %s', registryUrl);\n  try {\n    const result = await ping(registryUrl);\n    return result.ok;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;AAIA,IAAM,QAAQ,WAAW,mCAAmC;;;;;;AAY5D,eAAsB,WACpB,aACA,OAAO,YAAY,KAAK,IAAI,KAC5B,WAAW,qBACY;CACvB,MAAM,0BAA0B,MAAM,WAAW;CACjD,MAAM,MAAM,GAAG,YAAY,2BAA2B,mBAAmB,IAAI;CAC7E,MAAM,WAAW,MAAM,MAAM,KAAK;EAChC,QAAQ;EACR,SAAS,EAAE,gBAAgB,mBAAmB;EAC9C,MAAM,KAAK,UAAU;GACnB,MAAM;GACN;GACA,KAAK,oBAAoB;GACzB,MAAM;GACN,OAAO,CAAC;GACR,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;EAC/B,CAAC;CACH,CAAC;CAED,MAAM,OAAQ,MAAM,SAAS,KAAK;CAElC,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,OAAO,SAAS,WAAW,KAAK;EACjF,MAAM,QAAQ,KAAK;EACnB,IAAI,OAAO;GACT,MAAM,yCAAyC,IAAI;GACnD,OAAO;IAAE;IAAO;GAAK;EACvB;CACF;CAEA,MAAM,IAAI,MACR,gCAAgC,KAAK,OAAO,YAAY,IAAI,SAAS,OAAO,GAAG,KAAK,UAAU,IAAI,GACpG;AACF;;;;;AAMA,eAAsB,aAAa,aAAuC;CACxE,MAAM,cAAc,WAAW;CAC/B,IAAI;EAEF,QAAO,MADc,KAAK,WAAW,EAAA,CACvB;CAChB,QAAQ;EACN,OAAO;CACT;AACF"}
+{"version":3,"file":"registry-client.js","names":[],"sources":["../../../src/utils/registry-client.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { ping } from '@verdaccio/registry-cli';\n\nconst debug = buildDebug('verdaccio:e2e-cli:registry-client');\n\nexport type RegistryAuth = {\n  token: string;\n  user: string;\n};\n\n/**\n * Creates a user on the registry and returns the auth token.\n * Uses a unique username per run to avoid 409 conflicts.\n * Works against any running Verdaccio instance with htpasswd auth.\n */\nexport async function createUser(\n  registryUrl: string,\n  user = `e2e-user-${Date.now()}`,\n  password = 'e2e-test-password'\n): Promise<RegistryAuth> {\n  debug('creating user %s on %s', user, registryUrl);\n  const url = `${registryUrl}/-/user/org.couchdb.user:${encodeURIComponent(user)}`;\n  const response = await fetch(url, {\n    method: 'PUT',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      name: user,\n      password,\n      _id: `org.couchdb.user:${user}`,\n      type: 'user',\n      roles: [],\n      date: new Date().toISOString(),\n    }),\n  });\n\n  const body = (await response.json()) as any;\n\n  if (response.status === 201 || response.status === 200 || response.status === 409) {\n    const token = body.token;\n    if (token) {\n      debug('user %s authenticated, token obtained', user);\n      return { token, user };\n    }\n  }\n\n  throw new Error(\n    `Failed to create/login user \"${user}\" on ${registryUrl}: ${response.status} ${JSON.stringify(body)}`\n  );\n}\n\n/**\n * Ping the registry to check it's alive.\n * Uses @verdaccio/registry-cli ping.\n */\nexport async function pingRegistry(registryUrl: string): Promise<boolean> {\n  debug('pinging %s', registryUrl);\n  try {\n    const result = await ping(registryUrl);\n    return result.ok;\n  } catch {\n    return false;\n  }\n}\n\nexport class LegacyLoginError extends Error {\n  constructor(\n    message: string,\n    readonly status: number\n  ) {\n    super(message);\n  }\n}\n\n/**\n * Replays the legacy login the way each client sends it. npm and Yarn retry a\n * 409 with Basic (Yarn on the GET too); pnpm sends Basic on a single PUT. A\n * registry that authenticates the first PUT is accepted too.\n */\nexport async function legacyLogin(\n  registryUrl: string,\n  user: string,\n  password: string,\n  client: 'npm' | 'yarn' | 'pnpm'\n): Promise<string> {\n  const userUrl = `${registryUrl}/-/user/org.couchdb.user:${encodeURIComponent(user)}`;\n  const basic = `Basic ${Buffer.from(`${user}:${password}`).toString('base64')}`;\n  const jsonHeaders = { 'Content-Type': 'application/json' };\n  const body: Record<string, unknown> = {\n    _id: `org.couchdb.user:${user}`,\n    name: user,\n    password,\n    type: 'user',\n    roles: [],\n    date: new Date().toISOString(),\n  };\n\n  const put = (url: string, headers: Record<string, string>) =>\n    fetch(url, { method: 'PUT', headers, body: JSON.stringify(body) });\n\n  const first = await put(\n    userUrl,\n    client === 'pnpm'\n      ? { ...jsonHeaders, Authorization: basic, 'npm-auth-type': 'web' }\n      : jsonHeaders\n  );\n  const firstBody = (await first.json()) as any;\n  if (first.ok && firstBody.token) {\n    debug('%s: first PUT authenticated %s', client, user);\n    return firstBody.token;\n  }\n  if (first.status !== 409) {\n    throw new LegacyLoginError(`first PUT answered ${first.status}`, first.status);\n  }\n\n  const current = await fetch(`${userUrl}?write=true`, {\n    headers: client === 'yarn' ? { Authorization: basic } : {},\n  });\n  if (!current.ok) {\n    throw new LegacyLoginError(`GET answered ${current.status}`, current.status);\n  }\n  const currentBody = (await current.json()) as Record<string, unknown>;\n  for (const [key, value] of Object.entries(currentBody)) {\n    if (!body[key] || key === 'roles') {\n      body[key] = value;\n    }\n  }\n\n  const second = await put(`${userUrl}/-rev/${body._rev}`, {\n    ...jsonHeaders,\n    Authorization: basic,\n  });\n  const secondBody = (await second.json()) as any;\n  if (!second.ok || !secondBody.token) {\n    throw new LegacyLoginError(`PUT with revision answered ${second.status}`, second.status);\n  }\n  return secondBody.token;\n}\n\nexport async function whoami(registryUrl: string, token: string): Promise<string | undefined> {\n  const response = await fetch(`${registryUrl}/-/whoami`, {\n    headers: { Authorization: `Bearer ${token}` },\n  });\n  return response.ok ? ((await response.json()) as any).username : undefined;\n}\n"],"mappings":";;;AAIA,IAAM,QAAQ,WAAW,mCAAmC;;;;;;AAY5D,eAAsB,WACpB,aACA,OAAO,YAAY,KAAK,IAAI,KAC5B,WAAW,qBACY;CACvB,MAAM,0BAA0B,MAAM,WAAW;CACjD,MAAM,MAAM,GAAG,YAAY,2BAA2B,mBAAmB,IAAI;CAC7E,MAAM,WAAW,MAAM,MAAM,KAAK;EAChC,QAAQ;EACR,SAAS,EAAE,gBAAgB,mBAAmB;EAC9C,MAAM,KAAK,UAAU;GACnB,MAAM;GACN;GACA,KAAK,oBAAoB;GACzB,MAAM;GACN,OAAO,CAAC;GACR,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;EAC/B,CAAC;CACH,CAAC;CAED,MAAM,OAAQ,MAAM,SAAS,KAAK;CAElC,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,OAAO,SAAS,WAAW,KAAK;EACjF,MAAM,QAAQ,KAAK;EACnB,IAAI,OAAO;GACT,MAAM,yCAAyC,IAAI;GACnD,OAAO;IAAE;IAAO;GAAK;EACvB;CACF;CAEA,MAAM,IAAI,MACR,gCAAgC,KAAK,OAAO,YAAY,IAAI,SAAS,OAAO,GAAG,KAAK,UAAU,IAAI,GACpG;AACF;;;;;AAMA,eAAsB,aAAa,aAAuC;CACxE,MAAM,cAAc,WAAW;CAC/B,IAAI;EAEF,QAAO,MADc,KAAK,WAAW,EAAA,CACvB;CAChB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,IAAa,mBAAb,cAAsC,MAAM;CAG/B;CAFX,YACE,SACA,QACA;EACA,MAAM,OAAO;EAFJ,KAAA,SAAA;CAGX;AACF;;;;;;AAOA,eAAsB,YACpB,aACA,MACA,UACA,QACiB;CACjB,MAAM,UAAU,GAAG,YAAY,2BAA2B,mBAAmB,IAAI;CACjF,MAAM,QAAQ,SAAS,OAAO,KAAK,GAAG,KAAK,GAAG,UAAU,CAAC,CAAC,SAAS,QAAQ;CAC3E,MAAM,cAAc,EAAE,gBAAgB,mBAAmB;CACzD,MAAM,OAAgC;EACpC,KAAK,oBAAoB;EACzB,MAAM;EACN;EACA,MAAM;EACN,OAAO,CAAC;EACR,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;CAC/B;CAEA,MAAM,OAAO,KAAa,YACxB,MAAM,KAAK;EAAE,QAAQ;EAAO;EAAS,MAAM,KAAK,UAAU,IAAI;CAAE,CAAC;CAEnE,MAAM,QAAQ,MAAM,IAClB,SACA,WAAW,SACP;EAAE,GAAG;EAAa,eAAe;EAAO,iBAAiB;CAAM,IAC/D,WACN;CACA,MAAM,YAAa,MAAM,MAAM,KAAK;CACpC,IAAI,MAAM,MAAM,UAAU,OAAO;EAC/B,MAAM,kCAAkC,QAAQ,IAAI;EACpD,OAAO,UAAU;CACnB;CACA,IAAI,MAAM,WAAW,KACnB,MAAM,IAAI,iBAAiB,sBAAsB,MAAM,UAAU,MAAM,MAAM;CAG/E,MAAM,UAAU,MAAM,MAAM,GAAG,QAAQ,cAAc,EACnD,SAAS,WAAW,SAAS,EAAE,eAAe,MAAM,IAAI,CAAC,EAC3D,CAAC;CACD,IAAI,CAAC,QAAQ,IACX,MAAM,IAAI,iBAAiB,gBAAgB,QAAQ,UAAU,QAAQ,MAAM;CAE7E,MAAM,cAAe,MAAM,QAAQ,KAAK;CACxC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,WAAW,GACnD,IAAI,CAAC,KAAK,QAAQ,QAAQ,SACxB,KAAK,OAAO;CAIhB,MAAM,SAAS,MAAM,IAAI,GAAG,QAAQ,QAAQ,KAAK,QAAQ;EACvD,GAAG;EACH,eAAe;CACjB,CAAC;CACD,MAAM,aAAc,MAAM,OAAO,KAAK;CACtC,IAAI,CAAC,OAAO,MAAM,CAAC,WAAW,OAC5B,MAAM,IAAI,iBAAiB,8BAA8B,OAAO,UAAU,OAAO,MAAM;CAEzF,OAAO,WAAW;AACpB;AAEA,eAAsB,OAAO,aAAqB,OAA4C;CAC5F,MAAM,WAAW,MAAM,MAAM,GAAG,YAAY,YAAY,EACtD,SAAS,EAAE,eAAe,UAAU,QAAQ,EAC9C,CAAC;CACD,OAAO,SAAS,MAAO,MAAM,SAAS,KAAK,EAAA,CAAW,WAAW,KAAA;AACnE"}

package/build/utils/http-client.d.ts

@@ -27,6 +27,8 @@ export declare const ABBREVIATED_ACCEPT = "application/vnd.npm.install-v1+json";
  * Registry URL for a package name. Scoped names are encoded with the same
  * `%2f` form npm clients use: `@scope%2fname`.
  */
+/** `url` without trailing slashes; a loop instead of a regex, which CodeQL flags as ReDoS-prone. */
+export declare function stripTrailingSlashes(url: string): string;
 export declare function packumentUrl(registryUrl: string, pkgName: string): string;
 export declare function fetchPackument(registryUrl: string, pkgName: string, options?: FetchPackumentOptions): Promise<PackumentResponse>;
 export type DownloadTarballOptions = {

package/build/utils/registry-client.d.ts

@@ -13,3 +13,14 @@ export declare function createUser(registryUrl: string, user?: string, password?
  * Uses @verdaccio/registry-cli ping.
  */
 export declare function pingRegistry(registryUrl: string): Promise<boolean>;
+export declare class LegacyLoginError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
+/**
+ * Replays the legacy login the way each client sends it. npm and Yarn retry a
+ * 409 with Basic (Yarn on the GET too); pnpm sends Basic on a single PUT. A
+ * registry that authenticates the first PUT is accepted too.
+ */
+export declare function legacyLogin(registryUrl: string, user: string, password: string, client: 'npm' | 'yarn' | 'pnpm'): Promise<string>;
+export declare function whoami(registryUrl: string, token: string): Promise<string | undefined>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/e2e-cli",
-  "version": "3.4.0",
+  "version": "4.0.1",
   "type": "module",
   "license": "MIT",
   "description": "CLI tool to run Verdaccio e2e tests against any running registry",
@@ -30,7 +30,7 @@
     "@verdaccio/registry-cli": "^1.1.0",
     "debug": "4.4.3",
     "get-port": "7.2.0",
-    "js-yaml": "5.2.3"
+    "js-yaml": "5.4.1"
   },
   "devDependencies": {
     "@types/debug": "4.1.13",