@vltpkg/cli-js 1.0.10 → 1.1.1

package/{chunk-NWLS3VOQ.js → chunk-DS7YMIHP.js}

@@ -11,16 +11,18 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   urlOpen
-} from "./chunk-HAYXR3MW.js";
+} from "./chunk-APMYKJI2.js";
 import {
-  loadPackageJson
-} from "./chunk-E74WGW5C.js";
+  assertOk,
+  registryErrorMessage
+} from "./chunk-SNOBGFNM.js";
 import {
-  I
-} from "./chunk-LPIBYUMT.js";
+  userAgent
+} from "./chunk-YBVTY6ZW.js";
 import {
+  I,
   logRequest
-} from "./chunk-UBLFPJHV.js";
+} from "./chunk-U7TEQCBN.js";
 import {
   asError
 } from "./chunk-VFBCWAOC.js";
@@ -934,33 +936,33 @@ var require_tree = __commonJS({
           throw new TypeError("Unreachable");
         }
         let index = 0;
-        let node2 = this;
+        let node = this;
         while (true) {
           const code = key.charCodeAt(index);
           if (code > 127) {
             throw new TypeError("key must be ascii string");
           }
-          if (node2.code === code) {
+          if (node.code === code) {
             if (length === ++index) {
-              node2.value = value;
+              node.value = value;
               break;
-            } else if (node2.middle !== null) {
-              node2 = node2.middle;
+            } else if (node.middle !== null) {
+              node = node.middle;
             } else {
-              node2.middle = new _TstNode(key, value, index);
+              node.middle = new _TstNode(key, value, index);
               break;
             }
-          } else if (node2.code < code) {
-            if (node2.left !== null) {
-              node2 = node2.left;
+          } else if (node.code < code) {
+            if (node.left !== null) {
+              node = node.left;
             } else {
-              node2.left = new _TstNode(key, value, index);
+              node.left = new _TstNode(key, value, index);
               break;
             }
-          } else if (node2.right !== null) {
-            node2 = node2.right;
+          } else if (node.right !== null) {
+            node = node.right;
           } else {
-            node2.right = new _TstNode(key, value, index);
+            node.right = new _TstNode(key, value, index);
             break;
           }
         }
@@ -972,21 +974,21 @@ var require_tree = __commonJS({
       search(key) {
         const keylength = key.length;
         let index = 0;
-        let node2 = this;
-        while (node2 !== null && index < keylength) {
+        let node = this;
+        while (node !== null && index < keylength) {
           let code = key[index];
           if (code <= 90 && code >= 65) {
             code |= 32;
           }
-          while (node2 !== null) {
-            if (code === node2.code) {
+          while (node !== null) {
+            if (code === node.code) {
               if (keylength === ++index) {
-                return node2;
+                return node;
               }
-              node2 = node2.middle;
+              node = node.middle;
               break;
             }
-            node2 = node2.code < code ? node2.left : node2.right;
+            node = node.code < code ? node.left : node.right;
           }
         }
         return null;
@@ -1074,7 +1076,7 @@ var require_util = __commonJS({
         return new BodyAsyncIterable(body);
       } else if (body && isFormDataLike(body)) {
         return body;
-      } else if (body && typeof body !== "string" && !ArrayBuffer.isView(body) && isIterable2(body)) {
+      } else if (body && typeof body !== "string" && !ArrayBuffer.isView(body) && isIterable3(body)) {
         return new BodyAsyncIterable(body);
       } else {
         return body;
@@ -1195,7 +1197,7 @@ var require_util = __commonJS({
     function isAsyncIterable(obj) {
       return !!(obj != null && typeof obj[Symbol.asyncIterator] === "function");
     }
-    function isIterable2(obj) {
+    function isIterable3(obj) {
       return !!(obj != null && (typeof obj[Symbol.iterator] === "function" || typeof obj[Symbol.asyncIterator] === "function"));
     }
     function hasSafeIterator(obj) {
@@ -1806,7 +1808,7 @@ var require_util = __commonJS({
       parseURL,
       getServerName,
       isStream,
-      isIterable: isIterable2,
+      isIterable: isIterable3,
       hasSafeIterator,
       isAsyncIterable,
       isDestroyed,
@@ -1928,14 +1930,14 @@ var require_diagnostics = __commonJS({
         "undici:client:beforeConnect",
         (evt) => {
           const {
-            connectParams: { version: version2, protocol, port, host }
+            connectParams: { version, protocol, port, host }
           } = evt;
           debugLog(
             "connecting to %s%s using %s%s",
             host,
             port ? `:${port}` : "",
             protocol,
-            version2
+            version
           );
         }
       );
@@ -1943,14 +1945,14 @@ var require_diagnostics = __commonJS({
         "undici:client:connected",
         (evt) => {
           const {
-            connectParams: { version: version2, protocol, port, host }
+            connectParams: { version, protocol, port, host }
           } = evt;
           debugLog(
             "connected to %s%s using %s%s",
             host,
             port ? `:${port}` : "",
             protocol,
-            version2
+            version
           );
         }
       );
@@ -1958,7 +1960,7 @@ var require_diagnostics = __commonJS({
         "undici:client:connectError",
         (evt) => {
           const {
-            connectParams: { version: version2, protocol, port, host },
+            connectParams: { version, protocol, port, host },
             error: error2
           } = evt;
           debugLog(
@@ -1966,7 +1968,7 @@ var require_diagnostics = __commonJS({
             host,
             port ? `:${port}` : "",
             protocol,
-            version2,
+            version,
             error2.message
           );
         }
@@ -2115,7 +2117,7 @@ var require_request = __commonJS({
       destroy,
       isBuffer,
       isFormDataLike,
-      isIterable: isIterable2,
+      isIterable: isIterable3,
       hasSafeIterator,
       isBlobLike,
       serializePathWithQuery,
@@ -2230,7 +2232,7 @@ var require_request = __commonJS({
           this.body = body.byteLength ? Buffer.from(body) : null;
         } else if (typeof body === "string") {
           this.body = body.length ? Buffer.from(body) : null;
-        } else if (isFormDataLike(body) || isIterable2(body) || isBlobLike(body)) {
+        } else if (isFormDataLike(body) || isIterable3(body) || isBlobLike(body)) {
           this.body = body;
         } else {
           throw new InvalidArgumentError("body must be a string, a Buffer, a Readable stream, an iterable, or an async iterable");
@@ -10153,10 +10155,10 @@ var require_socks5_client = __commonJS({
         if (this.buffer.length < 2) {
           return;
         }
-        const version2 = this.buffer[0];
+        const version = this.buffer[0];
         const method = this.buffer[1];
-        if (version2 !== SOCKS_VERSION) {
-          throw new Socks5ProxyError(`Invalid SOCKS version: ${version2}`, "UND_ERR_SOCKS5_VERSION");
+        if (version !== SOCKS_VERSION) {
+          throw new Socks5ProxyError(`Invalid SOCKS version: ${version}`, "UND_ERR_SOCKS5_VERSION");
         }
         if (method === AUTH_METHODS.NO_ACCEPTABLE) {
           throw new Socks5ProxyError("No acceptable authentication method", "UND_ERR_SOCKS5_AUTH_REJECTED");
@@ -10201,10 +10203,10 @@ var require_socks5_client = __commonJS({
         if (this.buffer.length < 2) {
           return;
         }
-        const version2 = this.buffer[0];
+        const version = this.buffer[0];
         const status = this.buffer[1];
-        if (version2 !== 1) {
-          throw new Socks5ProxyError(`Invalid auth sub-negotiation version: ${version2}`, "UND_ERR_SOCKS5_AUTH_VERSION");
+        if (version !== 1) {
+          throw new Socks5ProxyError(`Invalid auth sub-negotiation version: ${version}`, "UND_ERR_SOCKS5_AUTH_VERSION");
         }
         if (status !== 0) {
           throw new Socks5ProxyError("Authentication failed", "UND_ERR_SOCKS5_AUTH_FAILED");
@@ -10251,11 +10253,11 @@ var require_socks5_client = __commonJS({
         if (this.buffer.length < 4) {
           return;
         }
-        const version2 = this.buffer[0];
+        const version = this.buffer[0];
         const reply = this.buffer[1];
         const addressType = this.buffer[3];
-        if (version2 !== SOCKS_VERSION) {
-          throw new Socks5ProxyError(`Invalid SOCKS version in reply: ${version2}`, "UND_ERR_SOCKS5_REPLY_VERSION");
+        if (version !== SOCKS_VERSION) {
+          throw new Socks5ProxyError(`Invalid SOCKS version in reply: ${version}`, "UND_ERR_SOCKS5_REPLY_VERSION");
         }
         let responseLength = 4;
         if (addressType === ADDRESS_TYPES.IPV4) {
@@ -23908,24 +23910,24 @@ var require_sender = __commonJS({
               this.#socket.write(createFrame(item, hint), cb);
             }
           } else {
-            const node3 = {
+            const node2 = {
               promise: null,
               callback: cb,
               frame: createFrame(item, hint)
             };
-            this.#queue.push(node3);
+            this.#queue.push(node2);
           }
           return;
         }
-        const node2 = {
+        const node = {
           promise: item.arrayBuffer().then((ab) => {
-            node2.promise = null;
-            node2.frame = createFrame(ab, hint);
+            node.promise = null;
+            node.frame = createFrame(ab, hint);
           }),
           callback: cb,
           frame: null
         };
-        this.#queue.push(node2);
+        this.#queue.push(node);
         if (!this.#running) {
           this.#run();
         }
@@ -23934,12 +23936,12 @@ var require_sender = __commonJS({
         this.#running = true;
         const queue = this.#queue;
         while (!queue.isEmpty()) {
-          const node2 = queue.shift();
-          if (node2.promise !== null) {
-            await node2.promise;
+          const node = queue.shift();
+          if (node.promise !== null) {
+            await node.promise;
           }
-          this.#socket.write(node2.frame, node2.callback);
-          node2.callback = node2.frame = null;
+          this.#socket.write(node.frame, node.callback);
+          node.callback = node.frame = null;
         }
         this.#running = false;
       }
@@ -26113,29 +26115,29 @@ var handleBeforeExit = () => {
     }
     args.push(__CODE_SPLIT_SCRIPT_NAME, path);
     registered.delete(path);
-    const proc3 = spawn(process.execPath, args, {
+    const proc2 = spawn(process.execPath, args, {
       detached,
       stdio: ["pipe", "ignore", "ignore"],
       env
     });
     for (const key of r) {
-      proc3.stdin.write(`${key}\0`);
+      proc2.stdin.write(`${key}\0`);
     }
-    proc3.stdin.end();
+    proc2.stdin.end();
     if (detached) {
-      proc3.unref();
+      proc2.unref();
     }
   }
 };
 
 // ../../src/registry-client/src/index.ts
+var import_undici3 = __toESM(require_undici(), 1);
 import { randomUUID } from "node:crypto";
 import { readFileSync as readFileSync2 } from "node:fs";
 import { STATUS_CODES } from "node:http";
 import { availableParallelism } from "node:os";
 import { dirname as dirname3, resolve as resolve4 } from "node:path";
 import { setTimeout as setTimeout2 } from "node:timers/promises";
-var import_undici3 = __toESM(require_undici(), 1);
 
 // ../../src/registry-client/src/is-iterable.ts
 var isIterable = (o) => !!o && typeof o === "object" && Symbol.iterator in o;
@@ -26143,27 +26145,23 @@ var isIterable = (o) => !!o && typeof o === "object" && Symbol.iterator in o;
 // ../../src/registry-client/src/delete-header.ts
 var deleteHeader = (headers, key) => {
   if (!headers) return {};
+  const lk = key.toLowerCase();
   if (Array.isArray(headers)) {
     if (!headers.length) return headers;
-    if (Array.isArray(headers[0])) {
-      const index = headers.findIndex(
-        ([k]) => k.toLowerCase() === key.toLowerCase()
-      );
-      if (index !== -1) headers.splice(index, 1);
-    } else {
-      const h = headers;
-      for (let i = 0; i < h.length; i += 2) {
-        if (h[i]?.toLowerCase() === key.toLowerCase()) {
-          headers.splice(i, 2);
-          break;
-        }
-      }
+    const step = Array.isArray(headers[0]) ? 1 : 2;
+    for (let i = 0; i < headers.length; ) {
+      const h = headers[i];
+      const k = Array.isArray(h) ? h[0] : h;
+      if (k.toLowerCase() === lk) headers.splice(i, step);
+      else i += step;
     }
     return headers;
   } else if (isIterable(headers)) {
     return deleteHeader([...headers], key);
   } else {
-    delete headers[key];
+    for (const k of Object.keys(headers)) {
+      if (k.toLowerCase() === lk) delete headers[k];
+    }
     return headers;
   }
 };
@@ -26341,18 +26339,11 @@ var getTokenByURL = async (requestUrl, identity) => {
   for (const k of await kc.keys()) {
     candidates.push(k);
   }
-  let bestKey;
-  let bestLen = 0;
-  for (const candidate of candidates) {
-    if (candidate.length > bestLen && (normalized === candidate || normalized.startsWith(candidate + "/"))) {
-      bestKey = candidate;
-      bestLen = candidate.length;
-    }
-  }
-  if (bestKey) {
-    return getToken(bestKey, identity);
+  const matches = candidates.filter((c) => normalized === c || normalized.startsWith(c + "/")).sort((a, b) => b.length - a.length);
+  for (const key of matches) {
+    const tok = await getToken(key, identity);
+    if (tok) return tok;
   }
-  return getToken(requestUrl, identity);
 };
 
 // ../../src/registry-client/src/cache-entry.ts
@@ -26601,6 +26592,19 @@ var CacheEntry = class _CacheEntry {
   get statusCode() {
     return this.#statusCode;
   }
+  /**
+   * True when the registry answered with a 2xx.
+   *
+   * `RegistryClient.request()` resolves for every status, so this is how
+   * code holding a real CacheEntry asks "did it work?".
+   *
+   * Note this is the strict form. Use it only where a genuine CacheEntry
+   * is guaranteed; `assertOk` uses the loose range check because it is
+   * also handed duck-typed responses.
+   */
+  get ok() {
+    return this.#statusCode >= 200 && this.#statusCode < 300;
+  }
   get headers() {
     return this.#headers;
   }
@@ -26953,9 +26957,9 @@ var __CODE_SPLIT_SCRIPT_NAME2 = resolve3(import.meta.dirname, "registry-client-s
 var isDeno2 = globalThis.Deno != void 0;
 var didProcessBeforeExitHook2 = false;
 var registered2 = /* @__PURE__ */ new Map();
-var register2 = (path, method, url) => {
+var register2 = (path, method, url, accept) => {
   const r = registered2.get(path) ?? /* @__PURE__ */ new Set();
-  const key = `${method} ${url}`;
+  const key = `${method} ${url}${accept ? ` ${String(accept)}` : ""}`;
   r.add(key);
   registered2.set(path, r);
   if (!didProcessBeforeExitHook2) {
@@ -26979,31 +26983,47 @@ var handleBeforeExit2 = () => {
     args.push(__CODE_SPLIT_SCRIPT_NAME2, path);
     registered2.delete(path);
     const detached = !(isDeno2 && process.platform === "win32");
-    const proc3 = spawn2(process.execPath, args, {
+    const proc2 = spawn2(process.execPath, args, {
       detached,
       stdio: ["pipe", "ignore", "ignore"],
       env
     });
     for (const key of r) {
-      proc3.stdin.write(`${key}\0`);
+      proc2.stdin.write(`${key}\0`);
     }
-    proc3.stdin.end();
+    proc2.stdin.end();
     if (detached) {
-      proc3.unref();
+      proc2.unref();
     }
   }
 };
 
-// ../../src/registry-client/src/env.ts
-import proc from "node:process";
-var { Deno, Bun } = globalThis;
-var isObj = (v) => typeof v === "object" && !!v;
-var isDeno3 = isObj(Deno);
-var isBun = !isDeno3 && isObj(Bun);
-var isNode = !isDeno3 && !isBun && "node" in proc.versions;
-var bun = isBun ? proc.versions.bun : void 0;
-var deno = isDeno3 ? proc.versions.deno : void 0;
-var node = isNode ? proc.versions.node : void 0;
+// ../../src/registry-client/src/get-header.ts
+var isIterable2 = (o) => !!o && typeof o === "object" && Symbol.iterator in o;
+var getHeader = (headers, key) => {
+  if (!headers) return void 0;
+  key = key.toLowerCase();
+  if (Array.isArray(headers)) {
+    if (!headers.length) return void 0;
+    if (Array.isArray(headers[0])) {
+      for (const [k, v] of headers) {
+        if (k.toLowerCase() === key) return v;
+      }
+    } else if (headers.length % 2 === 0) {
+      for (let i = 0; i < headers.length; i += 2) {
+        if (headers[i]?.toLowerCase() === key) return headers[i + 1];
+      }
+    }
+  } else if (isIterable2(headers)) {
+    for (const [k, v] of headers) {
+      if (k.toLowerCase() === key) return v;
+    }
+  } else {
+    for (const [k, v] of Object.entries(headers)) {
+      if (k.toLowerCase() === key) return v;
+    }
+  }
+};
 
 // ../../src/registry-client/src/handle-304-response.ts
 var handleCacheHitResponse = (resp, entry) => {
@@ -27053,6 +27073,9 @@ var otplease = async (client, options, response) => {
   );
   if (wwwAuth.has("ipaddress")) {
     throw error("Authorization is not allowed from your ip address", {
+      code: "ENEEDAUTH",
+      status: response.statusCode,
+      method: options.method,
       response
     });
   }
@@ -27085,17 +27108,30 @@ var otplease = async (client, options, response) => {
       }
     }
     throw error("Unrecognized OTP authentication challenge", {
+      code: "ENEEDAUTH",
+      status: response.statusCode,
+      method: options.method,
       response
     });
   }
   if (wwwAuth.has("bearer")) {
     throw error(
       "Missing or invalid authentication token. Run `vlt login` or `vlt token add` to authenticate.",
-      { response }
+      {
+        code: "ENEEDAUTH",
+        status: response.statusCode,
+        method: options.method,
+        response
+      }
     );
   }
   if (wwwAuth.size) {
-    throw error("Unknown authentication challenge", { response });
+    throw error("Unknown authentication challenge", {
+      code: "ENEEDAUTH",
+      status: response.statusCode,
+      method: options.method,
+      response
+    });
   }
   const text = await responseBodyText(response).catch(() => "");
   if (text.toLowerCase().includes("one-time pass")) {
@@ -27111,8 +27147,8 @@ var otplease = async (client, options, response) => {
 
 // ../../src/registry-client/src/proxy.ts
 var import_undici = __toESM(require_undici(), 1);
-import proc2 from "node:process";
-var hasProxyEnv = () => !!(proc2.env.http_proxy ?? proc2.env.HTTP_PROXY) || !!(proc2.env.https_proxy ?? proc2.env.HTTPS_PROXY);
+import proc from "node:process";
+var hasProxyEnv = () => !!(proc.env.http_proxy ?? proc.env.HTTP_PROXY) || !!(proc.env.https_proxy ?? proc.env.HTTPS_PROXY);
 var getDispatcher = (options) => hasProxyEnv() ? new import_undici.EnvHttpProxyAgent(options) : new import_undici.Agent(options);
 
 // ../../src/registry-client/src/redirect.ts
@@ -27145,6 +27181,12 @@ var redirect = (options, response, from) => {
   };
   delete nextOptions.path;
   redirections.add(String(nextURL));
+  if (nextURL.origin !== from.origin) {
+    nextOptions.headers = deleteHeader(
+      nextOptions.headers,
+      "authorization"
+    );
+  }
   switch (response.statusCode) {
     case 303: {
       nextOptions.method = "GET";
@@ -27362,12 +27404,6 @@ var exchangeToken = async (idToken, packageName, registry) => {
 var log3 = (msg) => console.error(msg);
 var isCacheableMethod = (m) => m === "GET" || m === "HEAD";
 var cacheKey = (method, url) => `${method !== "GET" ? method + " " : ""}${url}`;
-var { version } = loadPackageJson(
-  import.meta.filename,
-  "registry-client-package.json"
-);
-var nua = globalThis.navigator?.userAgent ?? (bun ? `Bun/${bun}` : deno ? `Deno/${deno}` : node ? `Node.js/${node}` : "(unknown platform)");
-var userAgent = `@vltpkg/registry-client/${version} ${nua}`;
 var agentOptions = {
   bodyTimeout: 6e5,
   headersTimeout: 6e5,
@@ -27446,7 +27482,40 @@ var RegistryClient = class {
    */
   async scroll(url, options = {}, seek) {
     const resp = await this.request(url, options);
-    const { objects, urls } = resp.json();
+    const { statusCode } = resp;
+    if (statusCode < 200 || statusCode >= 300) {
+      let detail;
+      try {
+        const body2 = resp.json();
+        if (body2 && typeof body2 === "object" && "error" in body2) {
+          detail = body2.error;
+        }
+      } catch {
+      }
+      const status = STATUS_CODES[statusCode];
+      throw error(
+        `Failed to fetch paginated results: ${statusCode}${status ? ` ${status}` : ""}${typeof detail === "string" && detail ? `: ${detail}` : ""}`,
+        { code: "EREQUEST", status: statusCode, url: String(url) }
+      );
+    }
+    let body;
+    try {
+      body = resp.json();
+    } catch (cause) {
+      throw error("Invalid JSON in paginated registry response", {
+        code: "EREQUEST",
+        url: String(url),
+        cause
+      });
+    }
+    if (!body || typeof body !== "object" || !("objects" in body) || !Array.isArray(body.objects) || !("urls" in body) || !body.urls || typeof body.urls !== "object" || Array.isArray(body.urls) || "next" in body.urls && body.urls.next !== null && body.urls.next !== void 0 && typeof body.urls.next !== "string") {
+      throw error("Invalid pagination in registry response", {
+        code: "EREQUEST",
+        url: String(url)
+      });
+    }
+    const objects = body.objects;
+    const urls = body.urls;
     return urls.next && !(seek && objects.some(seek)) ? objects.concat(await this.scroll(urls.next, options, seek)) : objects;
   }
   /**
@@ -27465,17 +27534,41 @@ var RegistryClient = class {
     const s = tok.replace(/^(Bearer|Basic) /i, "");
     const base = registryBase(registry);
     const tokensUrl = new URL("-/npm/v1/tokens", base);
-    const record = await this.seek(tokensUrl, ({ token }) => s.startsWith(token), {
-      useCache: false
-    }).catch(() => void 0);
-    if (record) {
-      const { key } = record;
-      await this.request(
-        new URL(`-/npm/v1/tokens/token/${key}`, base),
-        { useCache: false, method: "DELETE" }
-      );
+    const stillLive = `Removing the local credential anyway; revoke the token in the registry UI if it is still live.`;
+    try {
+      let record;
+      try {
+        record = await this.seek(tokensUrl, ({ token }) => s.startsWith(token), {
+          useCache: false
+        });
+      } catch (er) {
+        log3(
+          `Could not list tokens at ${tokensUrl}: ${asError(er).message}
+` + stillLive
+        );
+      }
+      if (record) {
+        const deleteUrl = new URL(
+          `-/npm/v1/tokens/token/${record.key}`,
+          base
+        );
+        const failed = (detail) => log3(
+          `Failed to revoke the token on the registry: ${detail}
+` + stillLive
+        );
+        try {
+          const response = await this.request(deleteUrl, {
+            useCache: false,
+            method: "DELETE"
+          });
+          if (!response.ok) failed(registryErrorMessage(response));
+        } catch (er) {
+          failed(asError(er).message);
+        }
+      }
+    } finally {
+      await deleteToken(registry, this.identity);
     }
-    await deleteToken(registry, this.identity);
   }
   /**
    * Log into the registry specified.
@@ -27579,11 +27672,19 @@ var RegistryClient = class {
       }
       return await this.#checkLogin(url, options);
     }
+    assertOk(response, {
+      message: "Web login failed",
+      url,
+      advice: (statusCode) => statusCode === 404 ? "This registry does not implement the web login endpoint." : void 0
+    });
     if (response.statusCode === 200) {
       const token = getTokenResponse(response.json());
       if (token) return token;
     }
     throw error("Invalid response from web login endpoint", {
+      code: "EREQUEST",
+      url,
+      status: response.statusCode,
       response
     });
   }
@@ -27657,13 +27758,19 @@ var RegistryClient = class {
     }
     const forcedFallback = forceRevalidate && entry?.staleWhileRevalidate ? entry : void 0;
     if (!forceRevalidate && staleWhileRevalidate && entry?.staleWhileRevalidate && m) {
-      register2(dirname3(this.cache.path()), m, url);
+      register2(
+        dirname3(this.cache.path()),
+        m,
+        url,
+        getHeader(options.headers, "accept")
+      );
       logRequest(url, "stale", { method });
       return entry;
     }
     logRequest(url, "start", { method });
     const requestStart = Date.now();
     setCacheHeaders(options, entry);
+    const redirected = redirections.size > 0;
     redirections.add(String(url));
     options.path = u.pathname.replace(/\/+$/, "") + u.search;
     options.origin = u.origin;
@@ -27691,11 +27798,13 @@ var RegistryClient = class {
       );
     }
     options.method = options.method ?? "GET";
-    options.headers = addHeader(
-      options.headers,
-      "authorization",
-      await getTokenByURL(String(u), this.identity)
-    );
+    if (!redirected || !getHeader(options.headers, "authorization")) {
+      options.headers = addHeader(
+        options.headers,
+        "authorization",
+        await getTokenByURL(String(u), this.identity)
+      );
+    }
     let response = null;
     try {
       response = await this.agent.request(
@@ -27815,7 +27924,6 @@ export {
   oidc,
   isCacheableMethod,
   cacheKey,
-  userAgent,
   RegistryClient
 };
 /*! Bundled license information: