@vltpkg/cli-js 1.1.0 → 1.2.0

package/{chunk-GJGQTRAT.js → chunk-OE6VHHN4.js}

@@ -14,24 +14,28 @@ import {
 } from "./chunk-APMYKJI2.js";
 import {
   assertOk,
-  registryErrorMessage
-} from "./chunk-SNOBGFNM.js";
+  registryErrorMessage,
+  storeRoot,
+  tokenRefusal
+} from "./chunk-UQUIO7LW.js";
 import {
-  loadPackageJson
-} from "./chunk-E74WGW5C.js";
+  userAgent
+} from "./chunk-JTUZP2OD.js";
 import {
   I,
   logRequest
 } from "./chunk-U7TEQCBN.js";
-import {
-  asError
-} from "./chunk-VFBCWAOC.js";
 import {
   XDG
 } from "./chunk-XNLSTHDK.js";
 import {
   rimraf
 } from "./chunk-BHJT53TP.js";
+import {
+  asError,
+  integrityHex,
+  integrityRE
+} from "./chunk-G5BSQ6DP.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
@@ -936,33 +940,33 @@ var require_tree = __commonJS({
           throw new TypeError("Unreachable");
         }
         let index = 0;
-        let node2 = this;
+        let node = this;
         while (true) {
           const code = key.charCodeAt(index);
           if (code > 127) {
             throw new TypeError("key must be ascii string");
           }
-          if (node2.code === code) {
+          if (node.code === code) {
             if (length === ++index) {
-              node2.value = value;
+              node.value = value;
               break;
-            } else if (node2.middle !== null) {
-              node2 = node2.middle;
+            } else if (node.middle !== null) {
+              node = node.middle;
             } else {
-              node2.middle = new _TstNode(key, value, index);
+              node.middle = new _TstNode(key, value, index);
               break;
             }
-          } else if (node2.code < code) {
-            if (node2.left !== null) {
-              node2 = node2.left;
+          } else if (node.code < code) {
+            if (node.left !== null) {
+              node = node.left;
             } else {
-              node2.left = new _TstNode(key, value, index);
+              node.left = new _TstNode(key, value, index);
               break;
             }
-          } else if (node2.right !== null) {
-            node2 = node2.right;
+          } else if (node.right !== null) {
+            node = node.right;
           } else {
-            node2.right = new _TstNode(key, value, index);
+            node.right = new _TstNode(key, value, index);
             break;
           }
         }
@@ -974,21 +978,21 @@ var require_tree = __commonJS({
       search(key) {
         const keylength = key.length;
         let index = 0;
-        let node2 = this;
-        while (node2 !== null && index < keylength) {
+        let node = this;
+        while (node !== null && index < keylength) {
           let code = key[index];
           if (code <= 90 && code >= 65) {
             code |= 32;
           }
-          while (node2 !== null) {
-            if (code === node2.code) {
+          while (node !== null) {
+            if (code === node.code) {
               if (keylength === ++index) {
-                return node2;
+                return node;
               }
-              node2 = node2.middle;
+              node = node.middle;
               break;
             }
-            node2 = node2.code < code ? node2.left : node2.right;
+            node = node.code < code ? node.left : node.right;
           }
         }
         return null;
@@ -1930,14 +1934,14 @@ var require_diagnostics = __commonJS({
         "undici:client:beforeConnect",
         (evt) => {
           const {
-            connectParams: { version: version2, protocol, port, host }
+            connectParams: { version, protocol, port, host }
           } = evt;
           debugLog(
             "connecting to %s%s using %s%s",
             host,
             port ? `:${port}` : "",
             protocol,
-            version2
+            version
           );
         }
       );
@@ -1945,14 +1949,14 @@ var require_diagnostics = __commonJS({
         "undici:client:connected",
         (evt) => {
           const {
-            connectParams: { version: version2, protocol, port, host }
+            connectParams: { version, protocol, port, host }
           } = evt;
           debugLog(
             "connected to %s%s using %s%s",
             host,
             port ? `:${port}` : "",
             protocol,
-            version2
+            version
           );
         }
       );
@@ -1960,7 +1964,7 @@ var require_diagnostics = __commonJS({
         "undici:client:connectError",
         (evt) => {
           const {
-            connectParams: { version: version2, protocol, port, host },
+            connectParams: { version, protocol, port, host },
             error: error2
           } = evt;
           debugLog(
@@ -1968,7 +1972,7 @@ var require_diagnostics = __commonJS({
             host,
             port ? `:${port}` : "",
             protocol,
-            version2,
+            version,
             error2.message
           );
         }
@@ -10155,10 +10159,10 @@ var require_socks5_client = __commonJS({
         if (this.buffer.length < 2) {
           return;
         }
-        const version2 = this.buffer[0];
+        const version = this.buffer[0];
         const method = this.buffer[1];
-        if (version2 !== SOCKS_VERSION) {
-          throw new Socks5ProxyError(`Invalid SOCKS version: ${version2}`, "UND_ERR_SOCKS5_VERSION");
+        if (version !== SOCKS_VERSION) {
+          throw new Socks5ProxyError(`Invalid SOCKS version: ${version}`, "UND_ERR_SOCKS5_VERSION");
         }
         if (method === AUTH_METHODS.NO_ACCEPTABLE) {
           throw new Socks5ProxyError("No acceptable authentication method", "UND_ERR_SOCKS5_AUTH_REJECTED");
@@ -10203,10 +10207,10 @@ var require_socks5_client = __commonJS({
         if (this.buffer.length < 2) {
           return;
         }
-        const version2 = this.buffer[0];
+        const version = this.buffer[0];
         const status = this.buffer[1];
-        if (version2 !== 1) {
-          throw new Socks5ProxyError(`Invalid auth sub-negotiation version: ${version2}`, "UND_ERR_SOCKS5_AUTH_VERSION");
+        if (version !== 1) {
+          throw new Socks5ProxyError(`Invalid auth sub-negotiation version: ${version}`, "UND_ERR_SOCKS5_AUTH_VERSION");
         }
         if (status !== 0) {
           throw new Socks5ProxyError("Authentication failed", "UND_ERR_SOCKS5_AUTH_FAILED");
@@ -10253,11 +10257,11 @@ var require_socks5_client = __commonJS({
         if (this.buffer.length < 4) {
           return;
         }
-        const version2 = this.buffer[0];
+        const version = this.buffer[0];
         const reply = this.buffer[1];
         const addressType = this.buffer[3];
-        if (version2 !== SOCKS_VERSION) {
-          throw new Socks5ProxyError(`Invalid SOCKS version in reply: ${version2}`, "UND_ERR_SOCKS5_REPLY_VERSION");
+        if (version !== SOCKS_VERSION) {
+          throw new Socks5ProxyError(`Invalid SOCKS version in reply: ${version}`, "UND_ERR_SOCKS5_REPLY_VERSION");
         }
         let responseLength = 4;
         if (addressType === ADDRESS_TYPES.IPV4) {
@@ -23910,24 +23914,24 @@ var require_sender = __commonJS({
               this.#socket.write(createFrame(item, hint), cb);
             }
           } else {
-            const node3 = {
+            const node2 = {
               promise: null,
               callback: cb,
               frame: createFrame(item, hint)
             };
-            this.#queue.push(node3);
+            this.#queue.push(node2);
           }
           return;
         }
-        const node2 = {
+        const node = {
           promise: item.arrayBuffer().then((ab) => {
-            node2.promise = null;
-            node2.frame = createFrame(ab, hint);
+            node.promise = null;
+            node.frame = createFrame(ab, hint);
           }),
           callback: cb,
           frame: null
         };
-        this.#queue.push(node2);
+        this.#queue.push(node);
         if (!this.#running) {
           this.#run();
         }
@@ -23936,12 +23940,12 @@ var require_sender = __commonJS({
         this.#running = true;
         const queue = this.#queue;
         while (!queue.isEmpty()) {
-          const node2 = queue.shift();
-          if (node2.promise !== null) {
-            await node2.promise;
+          const node = queue.shift();
+          if (node.promise !== null) {
+            await node.promise;
           }
-          this.#socket.write(node2.frame, node2.callback);
-          node2.callback = node2.frame = null;
+          this.#socket.write(node.frame, node.callback);
+          node.callback = node.frame = null;
         }
         this.#running = false;
       }
@@ -25805,6 +25809,7 @@ var Cache = class _Cache extends I {
   #pending = /* @__PURE__ */ new Set();
   onDiskWrite;
   onDiskDelete;
+  store;
   /**
    * A list of the actions currently happening in the background
    */
@@ -25823,6 +25828,7 @@ var Cache = class _Cache extends I {
       onDiskWrite,
       onDiskDelete,
       path,
+      store,
       fetchMethod: _,
       sizeCalculation = options.maxSize || options.maxEntrySize ? (v, k) => v.length + k.length : void 0,
       ...lruOpts
@@ -25846,6 +25852,7 @@ var Cache = class _Cache extends I {
     });
     this.onDiskWrite = onDiskWrite;
     this.onDiskDelete = onDiskDelete;
+    this.store = store;
     this.#path = path;
   }
   /**
@@ -25971,16 +25978,14 @@ var Cache = class _Cache extends I {
    */
   integrityPath(integrity) {
     if (!integrity) return void 0;
-    const m = /^sha512-([a-zA-Z0-9/+]{86}==)$/.exec(integrity);
-    const hash2 = m?.[1];
-    if (!hash2) {
+    const hex = integrityHex(integrity);
+    if (!hex) {
       throw error("invalid integrity value", {
         found: integrity,
-        wanted: /^sha512-([a-zA-Z0-9/+]{86}==)$/
+        wanted: integrityRE
       });
     }
-    const base = Buffer.from(hash2, "base64").toString("hex");
-    return resolve(this.#path, base);
+    return resolve(this.#path, hex);
   }
   /**
    * Read synchronously from the fs cache storage if not already
@@ -26007,13 +26012,20 @@ var Cache = class _Cache extends I {
   }
   /* c8 ignore stop */
   /**
-   * Delete path and path + '.key'
+   * Delete path and path + '.key', and with an integrity, its
+   * integrity link and global store entry
    */
   async #diskDelete(path, integrity) {
-    const intPath = this.#maybeIntegrityPath(integrity);
     const paths = [path, path + ".key"];
-    if (intPath) paths.push(intPath);
-    return await rimraf(paths);
+    const hex = integrityHex(integrity);
+    if (hex) paths.push(resolve(this.#path, hex));
+    const deleted = await rimraf(paths);
+    if (hex && this.store) {
+      const entry = resolve(this.store, hex);
+      await rimraf(entry);
+      await rimraf([entry + ".json", entry + ".copied"]);
+    }
+    return deleted;
   }
   #maybeIntegrityPath(i) {
     try {
@@ -26090,9 +26102,10 @@ var __CODE_SPLIT_SCRIPT_NAME = resolve2(import.meta.dirname, "cache-unzip-src-un
 var isDeno = globalThis.Deno != void 0;
 var didProcessBeforeExitHook = false;
 var registered = /* @__PURE__ */ new Map();
-var register = (path, key) => {
-  const r = registered.get(path) ?? /* @__PURE__ */ new Set();
-  r.add(key);
+var register = (path, key, store, integrity) => {
+  const r = registered.get(path) ?? { keys: /* @__PURE__ */ new Map() };
+  r.keys.set(key, integrity ?? r.keys.get(key));
+  r.store ??= store;
   registered.set(path, r);
   if (!didProcessBeforeExitHook) {
     didProcessBeforeExitHook = true;
@@ -26101,8 +26114,8 @@ var register = (path, key) => {
 };
 var handleBeforeExit = () => {
   const compileCacheDir = module.getCompileCacheDir();
-  for (const [path, r] of registered) {
-    if (!r.size) return;
+  for (const [path, { keys, store }] of registered) {
+    if (!keys.size) return;
     const env = { ...process.env };
     if (compileCacheDir) env.NODE_COMPILE_CACHE ??= compileCacheDir;
     const args = [];
@@ -26114,30 +26127,33 @@ var handleBeforeExit = () => {
       );
     }
     args.push(__CODE_SPLIT_SCRIPT_NAME, path);
+    if (store) args.push(store);
     registered.delete(path);
-    const proc3 = spawn(process.execPath, args, {
+    const proc2 = spawn(process.execPath, args, {
       detached,
       stdio: ["pipe", "ignore", "ignore"],
       env
     });
-    for (const key of r) {
-      proc3.stdin.write(`${key}\0`);
+    for (const [key, integrity] of keys) {
+      proc2.stdin.write(
+        integrity ? `${key}	${integrity}\0` : `${key}\0`
+      );
     }
-    proc3.stdin.end();
+    proc2.stdin.end();
     if (detached) {
-      proc3.unref();
+      proc2.unref();
     }
   }
 };
 
 // ../../src/registry-client/src/index.ts
+var import_undici3 = __toESM(require_undici(), 1);
 import { randomUUID } from "node:crypto";
 import { readFileSync as readFileSync2 } from "node:fs";
 import { STATUS_CODES } from "node:http";
 import { availableParallelism } from "node:os";
 import { dirname as dirname3, resolve as resolve4 } from "node:path";
 import { setTimeout as setTimeout2 } from "node:timers/promises";
-var import_undici3 = __toESM(require_undici(), 1);
 
 // ../../src/registry-client/src/is-iterable.ts
 var isIterable = (o) => !!o && typeof o === "object" && Symbol.iterator in o;
@@ -26145,27 +26161,23 @@ var isIterable = (o) => !!o && typeof o === "object" && Symbol.iterator in o;
 // ../../src/registry-client/src/delete-header.ts
 var deleteHeader = (headers, key) => {
   if (!headers) return {};
+  const lk = key.toLowerCase();
   if (Array.isArray(headers)) {
     if (!headers.length) return headers;
-    if (Array.isArray(headers[0])) {
-      const index = headers.findIndex(
-        ([k]) => k.toLowerCase() === key.toLowerCase()
-      );
-      if (index !== -1) headers.splice(index, 1);
-    } else {
-      const h = headers;
-      for (let i = 0; i < h.length; i += 2) {
-        if (h[i]?.toLowerCase() === key.toLowerCase()) {
-          headers.splice(i, 2);
-          break;
-        }
-      }
+    const step = Array.isArray(headers[0]) ? 1 : 2;
+    for (let i = 0; i < headers.length; ) {
+      const h = headers[i];
+      const k = Array.isArray(h) ? h[0] : h;
+      if (k.toLowerCase() === lk) headers.splice(i, step);
+      else i += step;
     }
     return headers;
   } else if (isIterable(headers)) {
     return deleteHeader([...headers], key);
   } else {
-    delete headers[key];
+    for (const k of Object.keys(headers)) {
+      if (k.toLowerCase() === lk) delete headers[k];
+    }
     return headers;
   }
 };
@@ -26343,18 +26355,11 @@ var getTokenByURL = async (requestUrl, identity) => {
   for (const k of await kc.keys()) {
     candidates.push(k);
   }
-  let bestKey;
-  let bestLen = 0;
-  for (const candidate of candidates) {
-    if (candidate.length > bestLen && (normalized === candidate || normalized.startsWith(candidate + "/"))) {
-      bestKey = candidate;
-      bestLen = candidate.length;
-    }
-  }
-  if (bestKey) {
-    return getToken(bestKey, identity);
+  const matches = candidates.filter((c) => normalized === c || normalized.startsWith(c + "/")).sort((a, b) => b.length - a.length);
+  for (const key of matches) {
+    const tok = await getToken(key, identity);
+    if (tok) return tok;
   }
-  return getToken(requestUrl, identity);
 };
 
 // ../../src/registry-client/src/cache-entry.ts
@@ -26641,8 +26646,9 @@ var CacheEntry = class _CacheEntry {
    * This method **will throw** if the integrity values do not match.
    *
    * Note that this will *usually* not be true if the value is coming out of
-   * the cache, because the cache entries are un-gzipped in place. It should
-   * _only_ be called for artifacts that come from an actual http response.
+   * the cache, because cache entries not exploded into the global store are
+   * un-gzipped in place. It should _only_ be called for artifacts that come
+   * from an actual http response.
    *
    * Returns true if anything was actually verified.
    */
@@ -26659,6 +26665,29 @@ var CacheEntry = class _CacheEntry {
     }
     return true;
   }
+  /**
+   * Check the body against the RFC 9530 digest the server sent with it,
+   * for a response that had no expected integrity. A registry that omits
+   * `dist.integrity` labels every tarball, so a missing digest fails when
+   * `required`. Like {@link checkIntegrity}, only for an actual http
+   * response: cached bodies are un-gzipped in place.
+   *
+   * **Will throw** on a mismatch. Returns the hash of the body.
+   */
+  checkDigest(required, context = {}) {
+    const computed = this.integrityActual;
+    const { digest } = this;
+    if (digest ? digest !== computed : required) {
+      throw error("Integrity check failure", {
+        code: "EINTEGRITY",
+        response: this,
+        wanted: digest,
+        found: computed,
+        ...context
+      });
+    }
+    return computed;
+  }
   get integrityActual() {
     if (this.#integrityActual) return this.#integrityActual;
     const hash2 = createHash2("sha512");
@@ -26680,6 +26709,16 @@ var CacheEntry = class _CacheEntry {
   get integrity() {
     return this.#integrity;
   }
+  /**
+   * The sha-512 member of an RFC 9530 `Repr-Digest` (or `Content-Digest`)
+   * response header, as an SRI string. A registry that serves packuments
+   * without `dist.integrity` labels each tarball this way instead.
+   */
+  get digest() {
+    const value = this.getHeaderString("repr-digest") ?? this.getHeaderString("content-digest");
+    const m = value && /(?:^|,)\s*sha-512=:([A-Za-z0-9+/]{86}==):/.exec(value);
+    return m ? `sha512-${m[1]}` : void 0;
+  }
   /**
    * Give it a key, and it'll return the buffer of that header value
    */
@@ -26701,6 +26740,19 @@ var CacheEntry = class _CacheEntry {
   setHeader(h, value) {
     this.#headers = setRawHeader(this.#headers, h, value);
   }
+  /**
+   * Remove a header, if present
+   */
+  deleteHeader(h) {
+    const key = h.toLowerCase();
+    for (let i = 0; i < this.#headers.length; i += 2) {
+      const k = this.#headers[i];
+      if (k && getDecodedValue(k).toLowerCase() === key) {
+        this.#headers.splice(i, 2);
+        return;
+      }
+    }
+  }
   /**
    * Return the body of the entry as a Buffer
    */
@@ -26880,6 +26932,16 @@ var CacheEntry = class _CacheEntry {
     const gzipBytes = buffer.subarray(headSize, headSize + 2);
     return gzipBytes[0] === 31 && gzipBytes[1] === 139;
   }
+  /**
+   * Head-only check for a 200 non-JSON body with an integrity header,
+   * i.e. a tarball the global store can be built from.
+   */
+  static isTarballEntry(buffer) {
+    const parsed = _CacheEntry.#parseHead(buffer);
+    if (parsed?.statusCode !== 200 || !parsed.integrity) return false;
+    const ct = getRawHeader(parsed.headers, "content-type");
+    return !ct || !/\bjson\b/.test(getDecodedValue(ct));
+  }
   /**
    * Encode status + headers (no body) as they appear at the start of
    * an on-disk cache file.
@@ -26994,32 +27056,21 @@ var handleBeforeExit2 = () => {
     args.push(__CODE_SPLIT_SCRIPT_NAME2, path);
     registered2.delete(path);
     const detached = !(isDeno2 && process.platform === "win32");
-    const proc3 = spawn2(process.execPath, args, {
+    const proc2 = spawn2(process.execPath, args, {
       detached,
       stdio: ["pipe", "ignore", "ignore"],
       env
     });
     for (const key of r) {
-      proc3.stdin.write(`${key}\0`);
+      proc2.stdin.write(`${key}\0`);
     }
-    proc3.stdin.end();
+    proc2.stdin.end();
     if (detached) {
-      proc3.unref();
+      proc2.unref();
     }
   }
 };
 
-// ../../src/registry-client/src/env.ts
-import proc from "node:process";
-var { Deno, Bun } = globalThis;
-var isObj = (v) => typeof v === "object" && !!v;
-var isDeno3 = isObj(Deno);
-var isBun = !isDeno3 && isObj(Bun);
-var isNode = !isDeno3 && !isBun && "node" in proc.versions;
-var bun = isBun ? proc.versions.bun : void 0;
-var deno = isDeno3 ? proc.versions.deno : void 0;
-var node = isNode ? proc.versions.node : void 0;
-
 // ../../src/registry-client/src/get-header.ts
 var isIterable2 = (o) => !!o && typeof o === "object" && Symbol.iterator in o;
 var getHeader = (headers, key) => {
@@ -27137,6 +27188,10 @@ var otplease = async (client, options, response) => {
     });
   }
   if (wwwAuth.has("bearer")) {
+    const text2 = await responseBodyText(response).catch(() => "");
+    if (tokenRefusal({ statusCode: 401, text: () => text2 })) {
+      return { bodyConsumed: text2 };
+    }
     throw error(
       "Missing or invalid authentication token. Run `vlt login` or `vlt token add` to authenticate.",
       {
@@ -27169,8 +27224,8 @@ var otplease = async (client, options, response) => {
 
 // ../../src/registry-client/src/proxy.ts
 var import_undici = __toESM(require_undici(), 1);
-import proc2 from "node:process";
-var hasProxyEnv = () => !!(proc2.env.http_proxy ?? proc2.env.HTTP_PROXY) || !!(proc2.env.https_proxy ?? proc2.env.HTTPS_PROXY);
+import proc from "node:process";
+var hasProxyEnv = () => !!(proc.env.http_proxy ?? proc.env.HTTP_PROXY) || !!(proc.env.https_proxy ?? proc.env.HTTPS_PROXY);
 var getDispatcher = (options) => hasProxyEnv() ? new import_undici.EnvHttpProxyAgent(options) : new import_undici.Agent(options);
 
 // ../../src/registry-client/src/redirect.ts
@@ -27203,6 +27258,12 @@ var redirect = (options, response, from) => {
   };
   delete nextOptions.path;
   redirections.add(String(nextURL));
+  if (nextURL.origin !== from.origin) {
+    nextOptions.headers = deleteHeader(
+      nextOptions.headers,
+      "authorization"
+    );
+  }
   switch (response.statusCode) {
     case 303: {
       nextOptions.method = "GET";
@@ -27420,12 +27481,6 @@ var exchangeToken = async (idToken, packageName, registry) => {
 var log3 = (msg) => console.error(msg);
 var isCacheableMethod = (m) => m === "GET" || m === "HEAD";
 var cacheKey = (method, url) => `${method !== "GET" ? method + " " : ""}${url}`;
-var { version } = loadPackageJson(
-  import.meta.filename,
-  "registry-client-package.json"
-);
-var nua = globalThis.navigator?.userAgent ?? (bun ? `Bun/${bun}` : deno ? `Deno/${deno}` : node ? `Node.js/${node}` : "(unknown platform)");
-var userAgent = `@vltpkg/registry-client/${version} ${nua}`;
 var agentOptions = {
   bodyTimeout: 6e5,
   headersTimeout: 6e5,
@@ -27471,12 +27526,14 @@ var RegistryClient = class {
     this.identity = identity;
     this.staleWhileRevalidateFactor = staleWhileRevalidateFactor;
     const path = resolve4(cache, "registry-client");
+    const store = options.storeRoot ?? storeRoot(cache);
     this.cache = new Cache({
       path,
+      store,
       maxSize: parseCacheMaxSize(process.env.VLT_CACHE_MAX_SIZE),
       onDiskWrite(_path, key, data) {
-        if (CacheEntry.isGzipEntry(data)) {
-          register(path, key);
+        if (CacheEntry.isGzipEntry(data) || CacheEntry.isTarballEntry(data)) {
+          register(path, key, store);
         }
       }
     });
@@ -27750,12 +27807,32 @@ var RegistryClient = class {
         if (entry.statusCode !== 200 || !entry.valid || entry.isJSON) {
           continue;
         }
-        return { path, body: entry.buffer() };
+        return {
+          path,
+          key,
+          body: entry.buffer(),
+          integrity: entry.integrity,
+          gzip: CacheEntry.isGzipEntry(buf)
+        };
       }
     } catch {
     }
     return void 0;
   }
+  /**
+   * Queue the cached tarball at `key` (a {@link CachedBody} key) for the
+   * background child: exploded into the global store when that is on,
+   * else un-gzipped. `integrity` finds it when only the integrity path
+   * holds it.
+   */
+  queueForStore(key, integrity) {
+    register(
+      this.cache.path(),
+      key,
+      this.cache.store,
+      integrity
+    );
+  }
   async request(url, options = {}) {
     const u = typeof url === "string" ? new URL(url) : url;
     const {
@@ -27767,7 +27844,7 @@ var RegistryClient = class {
       staleWhileRevalidate = true,
       forceRevalidate = false
     } = options;
-    let { trustIntegrity } = options;
+    const { trustIntegrity, verifyDigest } = options;
     const m = isCacheableMethod(method) ? method : void 0;
     const { useCache = !!m } = options;
     signal?.throwIfAborted();
@@ -27792,6 +27869,7 @@ var RegistryClient = class {
     logRequest(url, "start", { method });
     const requestStart = Date.now();
     setCacheHeaders(options, entry);
+    const redirected = redirections.size > 0;
     redirections.add(String(url));
     options.path = u.pathname.replace(/\/+$/, "") + u.search;
     options.origin = u.origin;
@@ -27819,11 +27897,13 @@ var RegistryClient = class {
       );
     }
     options.method = options.method ?? "GET";
-    options.headers = addHeader(
-      options.headers,
-      "authorization",
-      await getTokenByURL(String(u), this.identity)
-    );
+    if (!redirected || !getHeader(options.headers, "authorization")) {
+      options.headers = addHeader(
+        options.headers,
+        "authorization",
+        await getTokenByURL(String(u), this.identity)
+      );
+    }
     let response = null;
     try {
       response = await this.agent.request(
@@ -27856,14 +27936,16 @@ var RegistryClient = class {
         durationMs: Date.now() - requestStart
       }
     );
-    if (result.getHeader("integrity")) {
-      trustIntegrity = true;
+    if (!trustIntegrity && !result.fromCache) {
+      result.deleteHeader("integrity");
+      if (result.isGzip) result.checkIntegrity({ url });
     }
-    if (result.isGzip && !trustIntegrity) {
-      result.checkIntegrity({ url });
+    if (verifyDigest && !integrity && !result.fromCache && result.statusCode === 200) {
+      result.checkDigest(verifyDigest === "required", { url });
     }
     const clobbersCachedEntry = forceRevalidate && !!entry && result.statusCode !== 200;
     if (useCache && !clobbersCachedEntry) {
+      const integrity2 = result.integrity ?? (result.statusCode === 200 && !result.isJSON ? result.integrityActual : void 0);
       const buffer2 = result.encode();
       this.cache.set(
         key,
@@ -27872,9 +27954,7 @@ var RegistryClient = class {
           buffer2.byteOffset,
           buffer2.byteLength
         ),
-        {
-          integrity: result.integrity
-        }
+        { integrity: integrity2 }
       );
     }
     return result;
@@ -27943,7 +28023,6 @@ export {
   oidc,
   isCacheableMethod,
   cacheKey,
-  userAgent,
   RegistryClient
 };
 /*! Bundled license information: