@vltpkg/cli-js 1.0.10 → 1.1.0

package/{chunk-WAYVHANF.js → chunk-6LEMBT22.js}

@@ -13,14 +13,39 @@ import {
   actual,
   callLimit,
   createVirtualRoot
-} from "./chunk-FUCQ7ARR.js";
+} from "./chunk-47M7IZ5P.js";
 import {
   SecurityArchive
-} from "./chunk-2YJ5MESP.js";
+} from "./chunk-ZDQJWRCU.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
 
+// ../../src/cli-sdk/src/is-vlt-installed.ts
+import { lstatSync } from "node:fs";
+import { resolve } from "node:path";
+var lstat = (path) => {
+  try {
+    return lstatSync(path, { throwIfNoEntry: false });
+  } catch {
+    return void 0;
+  }
+};
+var isDir = (path) => !!lstat(path)?.isDirectory();
+var isFile = (path) => !!lstat(path)?.isFile();
+var isVltInstalled = (projectRoot) => isDir(resolve(projectRoot, "node_modules/.vlt")) || isFile(resolve(projectRoot, "node_modules/.vlt-lock.json"));
+var assertVltInstalled = (projectRoot, command) => {
+  if (isVltInstalled(projectRoot)) return;
+  const nodeModules = resolve(projectRoot, "node_modules");
+  const hint = isDir(nodeModules) ? `run \`vlt install\` to rebuild it before running \`vlt ${command}\`` : `run \`vlt install\` before running \`vlt ${command}\``;
+  throw error(`No vlt install found in ${nodeModules}
+
+  ${hint}`, {
+    code: "EQUERY",
+    path: nodeModules
+  });
+};
+
 // ../../src/cli-sdk/src/query-host-contexts.ts
 import { homedir as homedir2 } from "node:os";
 import { parse, posix } from "node:path";
@@ -115,7 +140,7 @@ var reloadConfig = async (folder) => {
     unload("project");
   } catch {
   }
-  const { Config } = await import("./config-66ARNESN.js");
+  const { Config } = await import("./config-ZPH7V77F.js");
   return Config.load(folder, process.argv, true);
 };
 
@@ -126,7 +151,6 @@ try {
 } catch {
 }
 var home2 = foundHome ?? posix.dirname(posix.format(parse(process.cwd())));
-var isVltInstalled = (folder) => !!folder.resolve("node_modules/.vlt").lstatSync()?.isDirectory() || !!folder.resolve("node_modules/.vlt-lock.json").lstatSync()?.isFile();
 var getPossibleProjectKeys = (folder, scurry) => {
   const relativePath = posix.relative(
     scurry.cwd.fullpathPosix(),
@@ -196,7 +220,7 @@ var createHostContextsMap = async (conf) => {
     for (const folder of projectFolders) {
       try {
         const config = await reloadConfig(folder.fullpath());
-        if (!isVltInstalled(folder)) {
+        if (!isVltInstalled(folder.fullpath())) {
           continue;
         }
         const graph = actual.load({
@@ -234,5 +258,6 @@ var createHostContextsMap = async (conf) => {
 };
 
 export {
+  assertVltInstalled,
   createHostContextsMap
 };

package/chunk-A75UYRJC.js

@@ -0,0 +1,75 @@
+var global = globalThis;
+import {Buffer} from "node:buffer";
+import {setTimeout as _vlt_setTimeout,clearTimeout as _vlt_clearTimeout,setImmediate as _vlt_setImmediate,clearImmediate as _vlt_clearImmediate,setInterval as _vlt_setInterval,clearInterval as _vlt_clearInterval} from "node:timers";
+globalThis.setTimeout = _vlt_setTimeout;
+globalThis.clearTimeout = _vlt_clearTimeout;
+globalThis.setImmediate = _vlt_setImmediate;
+globalThis.clearImmediate = _vlt_clearImmediate;
+globalThis.setInterval = _vlt_setInterval;
+globalThis.clearInterval = _vlt_clearInterval;
+import {createRequire as _vlt_createRequire} from "node:module";
+var require = _vlt_createRequire(import.meta.filename);
+import {
+  error
+} from "./chunk-WZWDS3W4.js";
+import {
+  __glob
+} from "./chunk-PZLD7RTK.js";
+
+// import("./commands/**/*.ts") in ../../src/cli-sdk/src/load-command.ts
+var globImport_commands_ts = __glob({
+  "./commands/access.ts": () => import("./access-GLWBGQLN.js"),
+  "./commands/bugs.ts": () => import("./bugs-OCQYFWFE.js"),
+  "./commands/build.ts": () => import("./build-CPWGNTCM.js"),
+  "./commands/cache.ts": () => import("./cache-SL7DQMY2.js"),
+  "./commands/ci.ts": () => import("./ci-O2RSLTBX.js"),
+  "./commands/config.ts": () => import("./config-ZBIF32GS.js"),
+  "./commands/create.ts": () => import("./create-2JX4RV5U.js"),
+  "./commands/deprecate.ts": () => import("./deprecate-XJLP2TUW.js"),
+  "./commands/dist-tag.ts": () => import("./dist-tag-F6ZFWGQU.js"),
+  "./commands/docs.ts": () => import("./docs-IJCZZ4V6.js"),
+  "./commands/exec-cache.ts": () => import("./exec-cache-AG77OOEE.js"),
+  "./commands/exec-local.ts": () => import("./exec-local-QXPWC4QG.js"),
+  "./commands/exec.ts": () => import("./exec-IWSS2LUA.js"),
+  "./commands/help.ts": () => import("./help-TGNDNWLP.js"),
+  "./commands/init.ts": () => import("./init-WU7BRPKR.js"),
+  "./commands/install.ts": () => import("./install-74XKB5N7.js"),
+  "./commands/install/reporter.ts": () => import("./reporter-ZW7OMRZT.js"),
+  "./commands/list.ts": () => import("./list-TOEC6Q3A.js"),
+  "./commands/login.ts": () => import("./login-WJYMAFSL.js"),
+  "./commands/logout.ts": () => import("./logout-MTRQWI3L.js"),
+  "./commands/pack.ts": () => import("./pack-FFWGLSNC.js"),
+  "./commands/ping.ts": () => import("./ping-DWUVTCJB.js"),
+  "./commands/pkg.ts": () => import("./pkg-KNZW5FIA.js"),
+  "./commands/profile.ts": () => import("./profile-6W2ABNXL.js"),
+  "./commands/publish.ts": () => import("./publish-HGNUONU3.js"),
+  "./commands/query.ts": () => import("./query-FSCYPETX.js"),
+  "./commands/registry.ts": () => import("./registry-YTJZ3AQD.js"),
+  "./commands/repo.ts": () => import("./repo-OVIKYYWA.js"),
+  "./commands/run-exec.ts": () => import("./run-exec-YJSMWMMP.js"),
+  "./commands/run.ts": () => import("./run-UPV3RPQJ.js"),
+  "./commands/setup.ts": () => import("./setup-7DPMAPUY.js"),
+  "./commands/token.ts": () => import("./token-GA73ER5V.js"),
+  "./commands/uninstall.ts": () => import("./uninstall-E3VKSC3B.js"),
+  "./commands/unpublish.ts": () => import("./unpublish-Q6MQHBPQ.js"),
+  "./commands/update.ts": () => import("./update-4CC44TR5.js"),
+  "./commands/version.ts": () => import("./version-CRZBXNDG.js"),
+  "./commands/view.ts": () => import("./view-ILUULGSO.js"),
+  "./commands/whoami.ts": () => import("./whoami-Z4TSLYTR.js")
+});
+
+// ../../src/cli-sdk/src/load-command.ts
+var loadCommand = async (command) => {
+  try {
+    return await globImport_commands_ts(`./commands/${command}.ts`);
+  } catch (e) {
+    throw error("Could not load command", {
+      found: command,
+      cause: e
+    });
+  }
+};
+
+export {
+  loadCommand
+};

package/{chunk-HAYXR3MW.js → chunk-APMYKJI2.js}

@@ -12,7 +12,7 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   promiseSpawn,
   which
-} from "./chunk-LPIBYUMT.js";
+} from "./chunk-U7TEQCBN.js";
 
 // ../../src/url-open/src/index.ts
 import { release } from "node:os";

package/{chunk-B5IILBX7.js → chunk-BUXPKRYB.js}

@@ -14,12 +14,12 @@ import {
 } from "./chunk-RIYFGX27.js";
 import {
   createHostContextsMap
-} from "./chunk-WAYVHANF.js";
+} from "./chunk-6LEMBT22.js";
 import {
   stderr,
   stdout,
   styleTextStdout
-} from "./chunk-VL7RJVNN.js";
+} from "./chunk-TNEMFBP5.js";
 import {
   require_emoji_regex
 } from "./chunk-VTEFO2FT.js";
@@ -27,10 +27,10 @@ import {
   Query,
   actual,
   isRunResult
-} from "./chunk-FUCQ7ARR.js";
+} from "./chunk-47M7IZ5P.js";
 import {
   Monorepo
-} from "./chunk-USTJECVS.js";
+} from "./chunk-X2AWQGYG.js";
 import {
   isErrorWithCause
 } from "./chunk-VFBCWAOC.js";

package/{chunk-5HPGL5WS.js → chunk-CBASIDQH.js}

@@ -12,7 +12,7 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   commandAliases,
   jack
-} from "./chunk-MNK55XSE.js";
+} from "./chunk-CEHPRPGQ.js";
 
 // ../../src/cli-sdk/src/config/usage.ts
 var toArr = (v) => Array.isArray(v) ? v : [v];

package/{chunk-MNK55XSE.js → chunk-CEHPRPGQ.js}

@@ -1203,6 +1203,10 @@ var definition = j2.heading("Configuration").description(
 
      Command-specific fields may be set in a nested \`command\` object that
      overrides any options defined at the top level.
+
+     Object type values given in the environment or on the command line
+     are merged key by key over the config files (command line wins over
+     environment); other values replace them.
     `
 ).flag({
   color: {
@@ -1266,6 +1270,12 @@ var definition = j2.heading("Configuration").description(
                     alias must be configured (e.g. via \`vlt setup\`) before it
                     can be used. The \`gh\` and \`jsr\` aliases have built-in
                     defaults that can be overridden here.
+
+                    Aliases given on the command line or in
+                    \`VLT_REGISTRIES\` (newline-delimited) merge with the
+                    configured ones, later sources winning per key. Pass
+                    \`--save-config\` to \`install\`, \`add\` or
+                    \`update\` to save them to \`vlt.json\`.
                     `
   },
   "scoped-registries": {
@@ -1689,6 +1699,17 @@ var definition = j2.heading("Configuration").description(
                     This is useful if a package already exists in
                     devDependencies or optionalDependencies, but you want to
                     move it to be a non-optional production dependency.`
+  },
+  "save-config": {
+    description: `Save the registry and git host options given on the
+                    command line or via \`VLT_*\` env (\`--registry\`,
+                    \`--registries\`, \`--default-registry-alias\`,
+                    \`--scoped-registries\`, \`--jsr-registries\`,
+                    \`--git-hosts\`, \`--git-host-archives\`) to the
+                    project \`vlt.json\` (or the user one with
+                    \`--config=user\`) after a successful \`install\`,
+                    \`add\` or \`update\`. Values a config file already
+                    has are left alone.`
   }
 }).opt({
   "save-prefix": {

package/{chunk-BSPUKIWY.js → chunk-CF5EGH4W.js}

@@ -9,10 +9,13 @@ globalThis.setInterval = _vlt_setInterval;
 globalThis.clearInterval = _vlt_clearInterval;
 import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
+import {
+  asUnknownSpecPrefix
+} from "./chunk-2PWSMJD7.js";
 import {
   addKey,
   asDependency
-} from "./chunk-FUCQ7ARR.js";
+} from "./chunk-47M7IZ5P.js";
 import {
   joinDepIDTuple,
   splitDepID
@@ -65,6 +68,13 @@ var rebaseFileSpec = (spec, importerPath, scurryCwd, specOptions, monorepo) => {
   if (rebasedPath === spec.file) return spec;
   return Spec.parseArgs(rebasedPath, specOptions);
 };
+var parseArg = (item, options) => {
+  try {
+    return Spec.parseArgs(item, options);
+  } catch (er) {
+    throw asUnknownSpecPrefix(er);
+  }
+};
 var parseAddArgs = (config, scurry, monorepo) => {
   const add = new AddImportersDependenciesMapImpl();
   const items = config.positionals;
@@ -74,7 +84,7 @@ var parseAddArgs = (config, scurry, monorepo) => {
   const parsedItems = [];
   let hasFileSpecs = false;
   for (const item of items) {
-    const spec = Spec.parseArgs(item, specOptions);
+    const spec = parseArg(item, specOptions);
     parsedItems.push({ spec, type });
     if (spec.type === "file") hasFileSpecs = true;
     add.modifiedDependencies = true;

package/{chunk-P5S2TFCF.js → chunk-CTQSUNNE.js}

@@ -20,13 +20,16 @@ import {
   pickManifest,
   resolve,
   revs
-} from "./chunk-USTJECVS.js";
+} from "./chunk-X2AWQGYG.js";
 import {
   Spec
 } from "./chunk-XKVU23NC.js";
+import {
+  registryErrorMessage
+} from "./chunk-SNOBGFNM.js";
 import {
   logRequest
-} from "./chunk-UBLFPJHV.js";
+} from "./chunk-U7TEQCBN.js";
 import {
   asPackument
 } from "./chunk-VFBCWAOC.js";
@@ -83,6 +86,7 @@ var rename = platform !== "win32" ? fsRename : (async function(oldPath, newPath)
 var debug = debuglog("vlt");
 var xdg = new XDG("vlt");
 var delimiter = "~";
+var PACKUMENT_ACCEPT = "application/vnd.vlt.packument-v1+json; q=1.0, application/json; q=0.8, */*; q=0.1";
 var manifestCacheMaxAge = 5 * 60 * 1e3;
 var noRegistryError = (spec) => error(
   'No registry configured to resolve this spec. Set "registry" in vlt.json, pass --registry, or run `vlt login --registry=<url>`. See https://docs.vlt.sh/cli',
@@ -119,7 +123,7 @@ var PackageInfoClient = class {
   #tarPoolPromise;
   async getRegistryClient() {
     if (this.#registryClient) return this.#registryClient;
-    this.#registryClientPromise ??= import("./src-J4BAYOBO.js").then(({ RegistryClient }) => {
+    this.#registryClientPromise ??= import("./src-XJT4IJSV.js").then(({ RegistryClient }) => {
       this.#registryClient = new RegistryClient(this.options);
       return this.#registryClient;
     });
@@ -228,7 +232,7 @@ var PackageInfoClient = class {
             throw this.#resolveError(
               spec,
               options,
-              `Registry returned HTTP ${response.statusCode} when fetching the tarball for ${spec}. The resolved version may have been unpublished, or the registry may be misconfigured or unreachable.`,
+              `${registryErrorMessage(response)} when fetching the tarball for ${spec}. The resolved version may have been unpublished, or the registry may be misconfigured or unreachable.`,
               {
                 url: r.resolved,
                 response
@@ -286,7 +290,7 @@ var PackageInfoClient = class {
           throw this.#resolveError(
             spec,
             options,
-            "failed to fetch remote tarball",
+            `failed to fetch remote tarball: ${registryErrorMessage(response)}`,
             {
               url: r.resolved,
               response
@@ -462,7 +466,7 @@ var PackageInfoClient = class {
             throw this.#resolveError(
               spec,
               options,
-              `Registry returned HTTP ${response.statusCode} when fetching the tarball for ${spec} at ${tarball}. The version may have been unpublished, or the registry may be misconfigured or unreachable.`,
+              `${registryErrorMessage(response)} when fetching the tarball for ${spec} at ${tarball}. The version may have been unpublished, or the registry may be misconfigured or unreachable.`,
               { response, url: tarball }
             );
           }
@@ -542,7 +546,7 @@ var PackageInfoClient = class {
           throw this.#resolveError(
             spec,
             options,
-            "failed to fetch URL",
+            `failed to fetch URL: ${registryErrorMessage(response)}`,
             { response, url: remoteURL }
           );
         }
@@ -645,7 +649,7 @@ var PackageInfoClient = class {
             throw this.#resolveError(
               s,
               options,
-              "failed to fetch URL",
+              `failed to fetch URL: ${registryErrorMessage(response)}`,
               { response, url: remoteURL }
             );
           }
@@ -755,7 +759,7 @@ var PackageInfoClient = class {
   }
   async #fetchPackument(spec, options, pakuURL, useCache) {
     const response = await (await this.getRegistryClient()).request(pakuURL, {
-      headers: { accept: "application/json" },
+      headers: { accept: PACKUMENT_ACCEPT },
       ...useCache === false ? { useCache } : {},
       // costs a conditional GET per moving selector on an otherwise warm
       // cache, install included. 304s are cheap but not free; the
@@ -766,7 +770,7 @@ var PackageInfoClient = class {
       throw this.#resolveError(
         spec,
         options,
-        "failed to fetch packument",
+        `failed to fetch packument: ${registryErrorMessage(response)}`,
         {
           url: pakuURL,
           response

package/{chunk-NWLS3VOQ.js → chunk-GJGQTRAT.js}

@@ -11,16 +11,18 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   urlOpen
-} from "./chunk-HAYXR3MW.js";
+} from "./chunk-APMYKJI2.js";
+import {
+  assertOk,
+  registryErrorMessage
+} from "./chunk-SNOBGFNM.js";
 import {
   loadPackageJson
 } from "./chunk-E74WGW5C.js";
 import {
-  I
-} from "./chunk-LPIBYUMT.js";
-import {
+  I,
   logRequest
-} from "./chunk-UBLFPJHV.js";
+} from "./chunk-U7TEQCBN.js";
 import {
   asError
 } from "./chunk-VFBCWAOC.js";
@@ -1074,7 +1076,7 @@ var require_util = __commonJS({
         return new BodyAsyncIterable(body);
       } else if (body && isFormDataLike(body)) {
         return body;
-      } else if (body && typeof body !== "string" && !ArrayBuffer.isView(body) && isIterable2(body)) {
+      } else if (body && typeof body !== "string" && !ArrayBuffer.isView(body) && isIterable3(body)) {
         return new BodyAsyncIterable(body);
       } else {
         return body;
@@ -1195,7 +1197,7 @@ var require_util = __commonJS({
     function isAsyncIterable(obj) {
       return !!(obj != null && typeof obj[Symbol.asyncIterator] === "function");
     }
-    function isIterable2(obj) {
+    function isIterable3(obj) {
       return !!(obj != null && (typeof obj[Symbol.iterator] === "function" || typeof obj[Symbol.asyncIterator] === "function"));
     }
     function hasSafeIterator(obj) {
@@ -1806,7 +1808,7 @@ var require_util = __commonJS({
       parseURL,
       getServerName,
       isStream,
-      isIterable: isIterable2,
+      isIterable: isIterable3,
       hasSafeIterator,
       isAsyncIterable,
       isDestroyed,
@@ -2115,7 +2117,7 @@ var require_request = __commonJS({
       destroy,
       isBuffer,
       isFormDataLike,
-      isIterable: isIterable2,
+      isIterable: isIterable3,
       hasSafeIterator,
       isBlobLike,
       serializePathWithQuery,
@@ -2230,7 +2232,7 @@ var require_request = __commonJS({
           this.body = body.byteLength ? Buffer.from(body) : null;
         } else if (typeof body === "string") {
           this.body = body.length ? Buffer.from(body) : null;
-        } else if (isFormDataLike(body) || isIterable2(body) || isBlobLike(body)) {
+        } else if (isFormDataLike(body) || isIterable3(body) || isBlobLike(body)) {
           this.body = body;
         } else {
           throw new InvalidArgumentError("body must be a string, a Buffer, a Readable stream, an iterable, or an async iterable");
@@ -26601,6 +26603,19 @@ var CacheEntry = class _CacheEntry {
   get statusCode() {
     return this.#statusCode;
   }
+  /**
+   * True when the registry answered with a 2xx.
+   *
+   * `RegistryClient.request()` resolves for every status, so this is how
+   * code holding a real CacheEntry asks "did it work?".
+   *
+   * Note this is the strict form. Use it only where a genuine CacheEntry
+   * is guaranteed; `assertOk` uses the loose range check because it is
+   * also handed duck-typed responses.
+   */
+  get ok() {
+    return this.#statusCode >= 200 && this.#statusCode < 300;
+  }
   get headers() {
     return this.#headers;
   }
@@ -26953,9 +26968,9 @@ var __CODE_SPLIT_SCRIPT_NAME2 = resolve3(import.meta.dirname, "registry-client-s
 var isDeno2 = globalThis.Deno != void 0;
 var didProcessBeforeExitHook2 = false;
 var registered2 = /* @__PURE__ */ new Map();
-var register2 = (path, method, url) => {
+var register2 = (path, method, url, accept) => {
   const r = registered2.get(path) ?? /* @__PURE__ */ new Set();
-  const key = `${method} ${url}`;
+  const key = `${method} ${url}${accept ? ` ${String(accept)}` : ""}`;
   r.add(key);
   registered2.set(path, r);
   if (!didProcessBeforeExitHook2) {
@@ -27005,6 +27020,33 @@ var bun = isBun ? proc.versions.bun : void 0;
 var deno = isDeno3 ? proc.versions.deno : void 0;
 var node = isNode ? proc.versions.node : void 0;
 
+// ../../src/registry-client/src/get-header.ts
+var isIterable2 = (o) => !!o && typeof o === "object" && Symbol.iterator in o;
+var getHeader = (headers, key) => {
+  if (!headers) return void 0;
+  key = key.toLowerCase();
+  if (Array.isArray(headers)) {
+    if (!headers.length) return void 0;
+    if (Array.isArray(headers[0])) {
+      for (const [k, v] of headers) {
+        if (k.toLowerCase() === key) return v;
+      }
+    } else if (headers.length % 2 === 0) {
+      for (let i = 0; i < headers.length; i += 2) {
+        if (headers[i]?.toLowerCase() === key) return headers[i + 1];
+      }
+    }
+  } else if (isIterable2(headers)) {
+    for (const [k, v] of headers) {
+      if (k.toLowerCase() === key) return v;
+    }
+  } else {
+    for (const [k, v] of Object.entries(headers)) {
+      if (k.toLowerCase() === key) return v;
+    }
+  }
+};
+
 // ../../src/registry-client/src/handle-304-response.ts
 var handleCacheHitResponse = (resp, entry) => {
   if (resp.statusCode !== 304 && resp.statusCode !== 412 || !entry)
@@ -27053,6 +27095,9 @@ var otplease = async (client, options, response) => {
   );
   if (wwwAuth.has("ipaddress")) {
     throw error("Authorization is not allowed from your ip address", {
+      code: "ENEEDAUTH",
+      status: response.statusCode,
+      method: options.method,
       response
     });
   }
@@ -27085,17 +27130,30 @@ var otplease = async (client, options, response) => {
       }
     }
     throw error("Unrecognized OTP authentication challenge", {
+      code: "ENEEDAUTH",
+      status: response.statusCode,
+      method: options.method,
       response
     });
   }
   if (wwwAuth.has("bearer")) {
     throw error(
       "Missing or invalid authentication token. Run `vlt login` or `vlt token add` to authenticate.",
-      { response }
+      {
+        code: "ENEEDAUTH",
+        status: response.statusCode,
+        method: options.method,
+        response
+      }
     );
   }
   if (wwwAuth.size) {
-    throw error("Unknown authentication challenge", { response });
+    throw error("Unknown authentication challenge", {
+      code: "ENEEDAUTH",
+      status: response.statusCode,
+      method: options.method,
+      response
+    });
   }
   const text = await responseBodyText(response).catch(() => "");
   if (text.toLowerCase().includes("one-time pass")) {
@@ -27446,7 +27504,40 @@ var RegistryClient = class {
    */
   async scroll(url, options = {}, seek) {
     const resp = await this.request(url, options);
-    const { objects, urls } = resp.json();
+    const { statusCode } = resp;
+    if (statusCode < 200 || statusCode >= 300) {
+      let detail;
+      try {
+        const body2 = resp.json();
+        if (body2 && typeof body2 === "object" && "error" in body2) {
+          detail = body2.error;
+        }
+      } catch {
+      }
+      const status = STATUS_CODES[statusCode];
+      throw error(
+        `Failed to fetch paginated results: ${statusCode}${status ? ` ${status}` : ""}${typeof detail === "string" && detail ? `: ${detail}` : ""}`,
+        { code: "EREQUEST", status: statusCode, url: String(url) }
+      );
+    }
+    let body;
+    try {
+      body = resp.json();
+    } catch (cause) {
+      throw error("Invalid JSON in paginated registry response", {
+        code: "EREQUEST",
+        url: String(url),
+        cause
+      });
+    }
+    if (!body || typeof body !== "object" || !("objects" in body) || !Array.isArray(body.objects) || !("urls" in body) || !body.urls || typeof body.urls !== "object" || Array.isArray(body.urls) || "next" in body.urls && body.urls.next !== null && body.urls.next !== void 0 && typeof body.urls.next !== "string") {
+      throw error("Invalid pagination in registry response", {
+        code: "EREQUEST",
+        url: String(url)
+      });
+    }
+    const objects = body.objects;
+    const urls = body.urls;
     return urls.next && !(seek && objects.some(seek)) ? objects.concat(await this.scroll(urls.next, options, seek)) : objects;
   }
   /**
@@ -27465,17 +27556,41 @@ var RegistryClient = class {
     const s = tok.replace(/^(Bearer|Basic) /i, "");
     const base = registryBase(registry);
     const tokensUrl = new URL("-/npm/v1/tokens", base);
-    const record = await this.seek(tokensUrl, ({ token }) => s.startsWith(token), {
-      useCache: false
-    }).catch(() => void 0);
-    if (record) {
-      const { key } = record;
-      await this.request(
-        new URL(`-/npm/v1/tokens/token/${key}`, base),
-        { useCache: false, method: "DELETE" }
-      );
+    const stillLive = `Removing the local credential anyway; revoke the token in the registry UI if it is still live.`;
+    try {
+      let record;
+      try {
+        record = await this.seek(tokensUrl, ({ token }) => s.startsWith(token), {
+          useCache: false
+        });
+      } catch (er) {
+        log3(
+          `Could not list tokens at ${tokensUrl}: ${asError(er).message}
+` + stillLive
+        );
+      }
+      if (record) {
+        const deleteUrl = new URL(
+          `-/npm/v1/tokens/token/${record.key}`,
+          base
+        );
+        const failed = (detail) => log3(
+          `Failed to revoke the token on the registry: ${detail}
+` + stillLive
+        );
+        try {
+          const response = await this.request(deleteUrl, {
+            useCache: false,
+            method: "DELETE"
+          });
+          if (!response.ok) failed(registryErrorMessage(response));
+        } catch (er) {
+          failed(asError(er).message);
+        }
+      }
+    } finally {
+      await deleteToken(registry, this.identity);
     }
-    await deleteToken(registry, this.identity);
   }
   /**
    * Log into the registry specified.
@@ -27579,11 +27694,19 @@ var RegistryClient = class {
       }
       return await this.#checkLogin(url, options);
     }
+    assertOk(response, {
+      message: "Web login failed",
+      url,
+      advice: (statusCode) => statusCode === 404 ? "This registry does not implement the web login endpoint." : void 0
+    });
     if (response.statusCode === 200) {
       const token = getTokenResponse(response.json());
       if (token) return token;
     }
     throw error("Invalid response from web login endpoint", {
+      code: "EREQUEST",
+      url,
+      status: response.statusCode,
       response
     });
   }
@@ -27657,7 +27780,12 @@ var RegistryClient = class {
     }
     const forcedFallback = forceRevalidate && entry?.staleWhileRevalidate ? entry : void 0;
     if (!forceRevalidate && staleWhileRevalidate && entry?.staleWhileRevalidate && m) {
-      register2(dirname3(this.cache.path()), m, url);
+      register2(
+        dirname3(this.cache.path()),
+        m,
+        url,
+        getHeader(options.headers, "accept")
+      );
       logRequest(url, "stale", { method });
       return entry;
     }