@vltpkg/cli-js 1.3.7 → 1.4.0

package/{chunk-CB65DPZ2.js → chunk-I7UMHYZX.js}

@@ -13,10 +13,10 @@ import {
   graphRun,
   graphRunSync,
   joinDepIDTuple
-} from "./chunk-SV4WK3KX.js";
+} from "./chunk-PLG3OYCX.js";
 import {
   Spec
-} from "./chunk-GZ5MYMBT.js";
+} from "./chunk-5IJTPZXP.js";
 import {
   load,
   parse as parse2,
@@ -43,7 +43,7 @@ import {
   parse,
   parseRange,
   satisfies
-} from "./chunk-IBGFQR23.js";
+} from "./chunk-FLH4YC6W.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
@@ -338,7 +338,7 @@ var require_promise_retry = __commonJS({
         fn = temp;
       }
       operation = retry.operation(options);
-      return new Promise(function(resolve5, reject) {
+      return new Promise(function(resolve6, reject) {
         operation.attempt(function(number) {
           Promise.resolve().then(function() {
             return fn(function(err) {
@@ -347,7 +347,7 @@ var require_promise_retry = __commonJS({
               }
               throw errcode(new Error("Retrying"), "EPROMISERETRY", { retried: err });
             }, number);
-          }).then(resolve5, function(err) {
+          }).then(resolve6, function(err) {
             if (isRetryError(err)) {
               err = err.retried;
               if (operation.retry(err || new Error())) {
@@ -3836,10 +3836,10 @@ var Minipass = class extends EventEmitter {
    * Return a void Promise that resolves once the stream ends.
    */
   async promise() {
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       this.on(DESTROYED, () => reject(new Error("stream destroyed")));
       this.on("error", (er) => reject(er));
-      this.on("end", () => resolve5());
+      this.on("end", () => resolve6());
     });
   }
   /**
@@ -3863,7 +3863,7 @@ var Minipass = class extends EventEmitter {
         return Promise.resolve({ done: false, value: res });
       if (this[EOF])
         return stop();
-      let resolve5;
+      let resolve6;
       let reject;
       const onerr = (er) => {
         this.off("data", ondata);
@@ -3877,19 +3877,19 @@ var Minipass = class extends EventEmitter {
         this.off("end", onend);
         this.off(DESTROYED, ondestroy);
         this.pause();
-        resolve5({ value, done: !!this[EOF] });
+        resolve6({ value, done: !!this[EOF] });
       };
       const onend = () => {
         this.off("error", onerr);
         this.off("data", ondata);
         this.off(DESTROYED, ondestroy);
         stop();
-        resolve5({ done: true, value: void 0 });
+        resolve6({ done: true, value: void 0 });
       };
       const ondestroy = () => onerr(new Error("stream destroyed"));
       return new Promise((res2, rej) => {
         reject = rej;
-        resolve5 = res2;
+        resolve6 = res2;
         this.once(DESTROYED, ondestroy);
         this.once("error", onerr);
         this.once("end", onend);
@@ -4865,9 +4865,9 @@ var PathBase = class {
     if (this.#asyncReaddirInFlight) {
       await this.#asyncReaddirInFlight;
     } else {
-      let resolve5 = () => {
+      let resolve6 = () => {
       };
-      this.#asyncReaddirInFlight = new Promise((res) => resolve5 = res);
+      this.#asyncReaddirInFlight = new Promise((res) => resolve6 = res);
       try {
         for (const e of await this.#fs.promises.readdir(fullpath, {
           withFileTypes: true
@@ -4880,7 +4880,7 @@ var PathBase = class {
         children.provisional = 0;
       }
       this.#asyncReaddirInFlight = void 0;
-      resolve5();
+      resolve6();
     }
     return children.slice(0, children.provisional);
   }
@@ -5110,7 +5110,7 @@ var PathScurryBase = class {
    *
    * @internal
    */
-  constructor(cwd = process.cwd(), pathImpl, sep2, { nocase, childrenCacheSize = 16 * 1024, fs = defaultFS } = {}) {
+  constructor(cwd = process.cwd(), pathImpl, sep3, { nocase, childrenCacheSize = 16 * 1024, fs = defaultFS } = {}) {
     this.#fs = fsFromOption(fs);
     if (cwd instanceof URL || cwd.startsWith("file://")) {
       cwd = fileURLToPath3(cwd);
@@ -5121,7 +5121,7 @@ var PathScurryBase = class {
     this.#resolveCache = new ResolveCache();
     this.#resolvePosixCache = new ResolveCache();
     this.#children = new ChildrenCache(childrenCacheSize);
-    const split = cwdPath.substring(this.rootPath.length).split(sep2);
+    const split = cwdPath.substring(this.rootPath.length).split(sep3);
     if (split.length === 1 && !split[0]) {
       split.pop();
     }
@@ -5718,7 +5718,126 @@ var Path = process.platform === "win32" ? PathWin32 : PathPosix;
 var PathScurry = process.platform === "win32" ? PathScurryWin32 : process.platform === "darwin" ? PathScurryDarwin : PathScurryPosix;
 
 // ../../src/workspaces/src/index.ts
-import { basename as basename2, posix as posix2, resolve as resolve4 } from "node:path";
+import { basename as basename2, posix as posix2, resolve as resolve5 } from "node:path";
+
+// ../../src/workspaces/src/pnpm-workspace.ts
+import { readFileSync as readFileSync3 } from "node:fs";
+import { resolve as resolve4 } from "node:path";
+var sep2 = (prev, flow) => !prev || (flow ? /[\s[,]/ : /\s/).test(prev);
+var skipQuoted = (s, i) => {
+  const q = s.charAt(i);
+  for (let j = i + 1; j < s.length && s.charAt(j) !== "\n"; j++) {
+    const c = s.charAt(j);
+    if (q === '"' && c === "\\") j++;
+    else if (c === q) {
+      if (q === "'" && s.charAt(j + 1) === "'") j++;
+      else return j + 1;
+    }
+  }
+  return -1;
+};
+var isQuote = (c) => c === "'" || c === '"';
+var stripComment = (line, flow) => {
+  for (let i = 0; i < line.length; i++) {
+    const c = line.charAt(i);
+    const prev = line.charAt(i - 1);
+    if (isQuote(c) && sep2(prev, flow)) {
+      const end = skipQuoted(line, i);
+      if (end < 0) break;
+      i = end - 1;
+    } else if (c === "#" && sep2(prev, false)) {
+      return line.slice(0, i).trimEnd();
+    }
+  }
+  return line.trimEnd();
+};
+var splitFlow = (s) => {
+  const items = [];
+  let start = 1;
+  for (let i = 1; i < s.length; i++) {
+    const c = s.charAt(i);
+    if (isQuote(c) && sep2(s.charAt(i - 1), true)) {
+      const end = skipQuoted(s, i);
+      if (end < 0) return void 0;
+      i = end - 1;
+    } else if (c === "[" || c === "{") {
+      return void 0;
+    } else if (c === "," || c === "]") {
+      const item = s.slice(start, i).trim();
+      if (item) items.push(item);
+      else if (c === ",") return void 0;
+      if (c === "]") {
+        return /^(?:\n|$)/.test(s.slice(i + 1)) ? items : void 0;
+      }
+      start = i + 1;
+    }
+  }
+  return void 0;
+};
+var splitBlock = (lines) => {
+  const items = [];
+  let indent;
+  for (const line of lines) {
+    const l = stripComment(line, false);
+    if (!l.trim()) continue;
+    const m = /^ *- +(?=\S)/.exec(l);
+    if (!m) {
+      if (/^\S/.test(l) && l !== "-") break;
+      return void 0;
+    }
+    const i = l.indexOf("-");
+    indent ??= i;
+    if (i !== indent) return void 0;
+    items.push(l.slice(m[0].length));
+  }
+  return items;
+};
+var scalar = (s, flow) => {
+  if (/^'(?:[^']|'')*'$/.test(s)) {
+    return s.slice(1, -1).replace(/''/g, "'");
+  }
+  if (s.startsWith('"')) {
+    try {
+      return JSON.parse(s);
+    } catch {
+      return void 0;
+    }
+  }
+  return /^[-?:,[\]{}#&*!|>'"%@`]/.test(s) || /: |:$|\s['"]/.test(s) || flow && /[{}\n]/.test(s) ? void 0 : s;
+};
+var parsePnpmWorkspacePackages = (yaml) => {
+  const lines = yaml.replace(/^\uFEFF/, "").split(/\r?\n/);
+  const keys = lines.flatMap((l, i) => {
+    const m = /^(['"]?)packages\1[ \t]*:(?=[ \t]|$)/.exec(l);
+    return m ? [{ i, value: l.slice(m[0].length) }] : [];
+  });
+  const [key, dup] = keys;
+  if (!key || dup) return void 0;
+  const flow = key.value.trimStart().startsWith("[");
+  const rest = stripComment(key.value, flow).trim();
+  const after = lines.slice(key.i + 1);
+  const raw = flow ? splitFlow(
+    [rest, ...after.map((l) => stripComment(l, true))].join("\n")
+  ) : rest ? void 0 : splitBlock(after);
+  const out = raw?.map((r) => scalar(r, flow));
+  if (!out?.every((v) => v !== void 0)) return void 0;
+  const globs = out.filter((v) => v !== "." && v !== "./");
+  return globs.some((g) => !g.startsWith("!")) ? globs : void 0;
+};
+var readPnpmWorkspacePackages = (projectRoot) => {
+  let yaml;
+  try {
+    yaml = readFileSync3(
+      resolve4(projectRoot, "pnpm-workspace.yaml"),
+      "utf8"
+    );
+  } catch {
+    return void 0;
+  }
+  return parsePnpmWorkspacePackages(yaml);
+};
+
+// ../../src/workspaces/src/index.ts
 var isSyntaxError = (err) => {
   if (err instanceof SyntaxError) return true;
   if (err instanceof Error) {
@@ -5812,11 +5931,14 @@ var resolveWSConfig = (projectRoot, packageJson = new PackageJson()) => {
     return { config: asWSConfig(fromVltJson), source: "vlt.json" };
   }
   const workspaces = packageJson.maybeRead(projectRoot)?.workspaces;
-  if (workspaces === void 0) return { config: {} };
+  if (workspaces === void 0) {
+    const packages = readPnpmWorkspacePackages(projectRoot);
+    return packages ? { config: { packages }, source: "pnpm-workspace.yaml" } : { config: {} };
+  }
   return {
     config: asManifestWSConfig(
       workspaces,
-      resolve4(projectRoot, "package.json")
+      resolve5(projectRoot, "package.json")
     ),
     source: "package.json"
   };
@@ -5854,16 +5976,17 @@ var Monorepo = class _Monorepo {
     return [...this.values()].length;
   }
   constructor(projectRoot, options = {}) {
-    this.projectRoot = resolve4(projectRoot);
+    this.projectRoot = resolve5(projectRoot);
     this.scurry = options.scurry ?? new PathScurry(projectRoot);
     this.packageJson = options.packageJson ?? new PackageJson();
     this.#config = options.config;
     if (options.load) this.load(options.load);
   }
   /**
-   * Load the workspace definitions from vlt.json, or from the root
-   * package.json when vlt.json declares none, canonicalizing the result
-   * into the effective `{[group:string]:string[]}` form.
+   * Load the workspace definitions from vlt.json, else the root
+   * package.json, else pnpm-workspace.yaml (see {@link resolveWSConfig}),
+   * canonicalizing the result into the effective
+   * `{[group:string]:string[]}` form.
    *
    * Eg:
    * - `"src/*"` => `{packages:["src/*"]}`
@@ -5941,7 +6064,7 @@ var Monorepo = class _Monorepo {
   // Either load a workspace from disk, or from our internal set,
   // and assign it to the named group
   #loadWS(path2, group) {
-    const fullpath = resolve4(this.projectRoot, path2);
+    const fullpath = resolve5(this.projectRoot, path2);
     const loaded = this.#workspaces.get(fullpath);
     if (loaded) return loaded;
     const fromCache = workspaceCache.get(fullpath);
@@ -6043,7 +6166,7 @@ var Monorepo = class _Monorepo {
         throw error(
           `Failed to parse package.json in workspace "${rel}"`,
           {
-            path: resolve4(this.projectRoot, rel, "package.json"),
+            path: resolve5(this.projectRoot, rel, "package.json"),
             cause: err
           }
         );
@@ -6235,8 +6358,9 @@ var Monorepo = class _Monorepo {
   /**
    * Convenience method to instantiate and load in one call.
    * Returns undefined if the project is not a monorepo workspaces root,
-   * meaning neither `vlt.json` nor the root `package.json` declares any
-   * workspaces. Otherwise returns the loaded Monorepo.
+   * meaning none of `vlt.json`, the root `package.json` or
+   * `pnpm-workspace.yaml` declares any workspaces. Otherwise returns
+   * the loaded Monorepo.
    */
   static maybeLoad(projectRoot, options = { load: {} }) {
     if (options.config) {

package/{chunk-2M2O6A4R.js → chunk-ISE4IRHF.js}

@@ -11,18 +11,18 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   asUnknownSpecPrefix
-} from "./chunk-A2TSRXZD.js";
+} from "./chunk-THSYN5EK.js";
 import {
   addKey,
   asDependency
-} from "./chunk-7BHHCB5C.js";
+} from "./chunk-OVPHE4O7.js";
 import {
   joinDepIDTuple,
   splitDepID
-} from "./chunk-SV4WK3KX.js";
+} from "./chunk-PLG3OYCX.js";
 import {
   Spec
-} from "./chunk-GZ5MYMBT.js";
+} from "./chunk-5IJTPZXP.js";
 
 // ../../src/cli-sdk/src/parse-add-remove-args.ts
 import { isAbsolute, relative, resolve } from "node:path";

package/{chunk-TLY4VGMH.js → chunk-LHPEBLOU.js}

@@ -12,7 +12,7 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   commandAliases,
   jack
-} from "./chunk-SE2FSMBR.js";
+} from "./chunk-WF6KLKRN.js";
 
 // ../../src/cli-sdk/src/config/usage.ts
 var toArr = (v) => Array.isArray(v) ? v : [v];

package/{chunk-EL4GVZK5.js → chunk-MKWPTN3C.js}

@@ -15,10 +15,10 @@ import {
 } from "./chunk-SRWDPPLX.js";
 import {
   minimatch
-} from "./chunk-CB65DPZ2.js";
+} from "./chunk-I7UMHYZX.js";
 import {
   Spec
-} from "./chunk-GZ5MYMBT.js";
+} from "./chunk-5IJTPZXP.js";
 import {
   parse,
   stringify

package/{chunk-QVPNKMUU.js → chunk-OAJ3PO3Z.js}

@@ -18,10 +18,10 @@ import {
   statusText,
   storeRoot,
   tokenRefusal
-} from "./chunk-6D54UN4T.js";
+} from "./chunk-SR2VOY5J.js";
 import {
   userAgent
-} from "./chunk-VBDNOU76.js";
+} from "./chunk-ZJMJ7MCT.js";
 import {
   I,
   logRequest
@@ -36,7 +36,7 @@ import {
   asError,
   integrityHex,
   integrityRE
-} from "./chunk-IBGFQR23.js";
+} from "./chunk-FLH4YC6W.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
@@ -11273,14 +11273,14 @@ var require_retry_agent = __commonJS({
         this.#options = options;
       }
       dispatch(opts, handler) {
-        const retry = new RetryHandler({
+        const retry2 = new RetryHandler({
           ...opts,
           retryOptions: this.#options
         }, {
           dispatch: this.#agent.dispatch.bind(this.#agent),
           handler
         });
-        return this.#agent.dispatch(opts, retry);
+        return this.#agent.dispatch(opts, retry2);
       }
       close() {
         return this.#agent.close();
@@ -13770,7 +13770,7 @@ var require_snapshot_recorder = __commonJS({
     "use strict";
     var { writeFile: writeFile3, readFile: readFile3, mkdir: mkdir3 } = __require("node:fs/promises");
     var { dirname: dirname4, resolve: resolve5 } = __require("node:path");
-    var { setTimeout: setTimeout3, clearTimeout: clearTimeout2 } = __require("node:timers");
+    var { setTimeout: setTimeout4, clearTimeout: clearTimeout2 } = __require("node:timers");
     var { InvalidArgumentError, UndiciError } = require_errors();
     var { hashId, isUrlExcludedFactory, normalizeHeaders, createHeaderFilters } = require_snapshot_utils();
     function formatRequestKey(opts, headerFilters, matchOptions = {}) {
@@ -14104,7 +14104,7 @@ var require_snapshot_recorder = __commonJS({
        * Schedules a flush (debounced to avoid excessive writes)
        */
       #scheduleFlush() {
-        this.#flushTimeout = setTimeout3(() => {
+        this.#flushTimeout = setTimeout4(() => {
           this.saveSnapshots().catch(() => {
           });
           if (this.#autoFlush) {
@@ -19487,7 +19487,7 @@ var require_request2 = __commonJS({
     var { URLSerializer } = require_data_url();
     var { kConstruct } = require_symbols();
     var assert = __require("node:assert");
-    var { getMaxListeners, setMaxListeners, defaultMaxListeners } = __require("node:events");
+    var { getMaxListeners, setMaxListeners: setMaxListeners2, defaultMaxListeners } = __require("node:events");
     var kAbortController = /* @__PURE__ */ Symbol("abortController");
     var requestFinalizer = new FinalizationRegistry(({ signal, abort }) => {
       signal.removeEventListener("abort", abort);
@@ -19727,7 +19727,7 @@ var require_request2 = __commonJS({
             const acRef = new WeakRef(ac);
             const abort = buildAbort(acRef);
             if (abortSignalHasEventHandlerLeakWarning && getMaxListeners(signal) === defaultMaxListeners) {
-              setMaxListeners(1500, signal);
+              setMaxListeners2(1500, signal);
             }
             util.addAbortListener(signal, abort);
             requestFinalizer.register(ac, { signal, abort }, abort);
@@ -26153,8 +26153,9 @@ import { randomUUID } from "node:crypto";
 import { closeSync, openSync, readFileSync as readFileSync2, readSync } from "node:fs";
 import { availableParallelism } from "node:os";
 import { dirname as dirname3, resolve as resolve4 } from "node:path";
+import { setMaxListeners } from "node:events";
 import { pipeline } from "node:stream";
-import { setTimeout as setTimeout2 } from "node:timers/promises";
+import { setTimeout as setTimeout3 } from "node:timers/promises";
 import { createGunzip } from "node:zlib";
 
 // ../../src/registry-client/src/is-iterable.ts
@@ -26320,10 +26321,15 @@ var getKC = (identity) => {
   return nkc;
 };
 var isToken = (t) => typeof t === "string" && (t.startsWith("Bearer ") || t.startsWith("Basic "));
-var deleteToken = async (registry, identity) => {
+var deleteToken = async (registry, identity, token) => {
   const kc = getKC(identity);
   await kc.load();
   kc.delete(normalizeRegistryKey(registry));
+  if (token) {
+    for (const key of kc.keysSync()) {
+      if (kc.getSync(key) === token) kc.delete(key);
+    }
+  }
   await kc.save();
 };
 var setToken = async (registry, token, identity) => {
@@ -26346,9 +26352,19 @@ var getToken = async (registry, identity) => {
   if (tok) return `Bearer ${tok}`;
   return kc.get(key);
 };
-var getTokenByURL = async (requestUrl, identity) => {
+var registryKeys = (o) => [
+  ...new Set(
+    [
+      o.registry,
+      ...Object.values(o.registries ?? {}),
+      ...Object.values(o["scoped-registries"] ?? {}),
+      ...Object.values(o["jsr-registries"] ?? {})
+    ].filter((u) => !!u && URL.canParse(u)).map(normalizeRegistryKey)
+  )
+];
+var getTokenByURL = async (requestUrl, identity, keys = []) => {
   const normalized = normalizeRegistryKey(requestUrl);
-  const candidates = [...runtimeTokens.keys()];
+  const candidates = [...runtimeTokens.keys(), ...keys];
   const envReg = process.env.VLT_REGISTRY;
   if (envReg) {
     candidates.push(normalizeRegistryKey(envReg));
@@ -27393,6 +27409,40 @@ var readBody = async (response, entry) => {
   });
 };
 
+// ../../src/registry-client/src/retry.ts
+import { setTimeout as setTimeout2 } from "node:timers/promises";
+var retry = (err, { state: { counter }, opts }, cb) => {
+  const { code, statusCode, headers } = err;
+  const { method } = opts;
+  const { signal } = opts;
+  const {
+    maxRetries,
+    minTimeout,
+    maxTimeout,
+    timeoutFactor,
+    methods,
+    statusCodes,
+    errorCodes
+  } = opts.retryOptions;
+  if (code && code !== "UND_ERR_REQ_RETRY" && !errorCodes.includes(code) || !methods.includes(method) || typeof statusCode === "number" && !statusCodes.includes(statusCode) || counter > maxRetries) {
+    cb(err);
+    return;
+  }
+  const ra = String(headers?.["retry-after"] ?? "");
+  const secs = Number(ra);
+  const after = Number.isNaN(secs) ? Date.parse(ra) - Date.now() : secs * 1e3;
+  const wait = Math.min(
+    after > 0 ? after : minTimeout * timeoutFactor ** (counter - 1),
+    maxTimeout
+  );
+  setTimeout2(wait, null, {
+    signal: signal instanceof AbortSignal ? signal : void 0
+  }).then(
+    () => cb(null),
+    (er) => cb(er)
+  );
+};
+
 // ../../src/registry-client/src/oidc.ts
 var import_undici2 = __toESM(require_undici(), 1);
 var log2 = (...args) => (
@@ -27573,10 +27623,22 @@ var RegistryClient = class {
   agent;
   cache;
   identity;
+  /** configured registry keys; `VLT_TOKEN_<key>` applies under each */
+  registryKeys;
   staleWhileRevalidateFactor;
   #session = randomUUID();
   #decoded = /* @__PURE__ */ new WeakMap();
+  // request() calls not settled yet, awaited by drain()
+  #inFlight = /* @__PURE__ */ new Set();
+  #signal;
+  /** the request's own signal joined with the client's */
+  #withSignal(own) {
+    const c = this.#signal;
+    return !c || own === c || !(own instanceof AbortSignal) ? own ?? c : AbortSignal.any([own, c]);
+  }
   constructor(options) {
+    this.#signal = options.signal;
+    if (options.signal) setMaxListeners(0, options.signal);
     const {
       cache = xdg.cache(),
       "fetch-retry-factor": timeoutFactor = 2,
@@ -27588,6 +27650,7 @@ var RegistryClient = class {
       // 48h for a 5min cache
     } = options;
     this.identity = identity;
+    this.registryKeys = registryKeys(options);
     this.staleWhileRevalidateFactor = staleWhileRevalidateFactor;
     const path = resolve4(cache, "registry-client");
     const store = options.storeRoot ?? storeRoot(cache);
@@ -27608,6 +27671,7 @@ var RegistryClient = class {
       minTimeout,
       maxTimeout,
       retryAfter: true,
+      retry,
       errorCodes: [
         "ECONNREFUSED",
         "ECONNRESET",
@@ -27710,7 +27774,7 @@ var RegistryClient = class {
         }
       }
     } finally {
-      await deleteToken(registry, this.identity);
+      await deleteToken(registry, this.identity, tok);
     }
   }
   /**
@@ -27811,7 +27875,7 @@ var RegistryClient = class {
       const rt = response.getHeaderString("retry-after");
       const retryAfter = rt ? Number(rt) : -1;
       if (retryAfter > 0) {
-        await setTimeout2(retryAfter * 1e3, null, { signal });
+        await setTimeout3(retryAfter * 1e3, null, { signal });
       }
       return await this.#checkLogin(url, options);
     }
@@ -27951,6 +28015,7 @@ var RegistryClient = class {
     const u = typeof url === "string" ? new URL(url) : url;
     const o = {
       ...options,
+      signal: this.#withSignal(options.signal),
       method: options.method ?? "GET",
       path: u.pathname.replace(/\/+$/, "") + u.search,
       origin: u.origin,
@@ -27971,7 +28036,11 @@ var RegistryClient = class {
     o.headers = addHeader(
       o.headers,
       "authorization",
-      await getTokenByURL(String(u), this.identity)
+      await getTokenByURL(
+        String(u),
+        this.identity,
+        this.registryKeys
+      )
     );
     logRequest(url, "start", { method: o.method });
     const requestStart = Date.now();
@@ -27994,7 +28063,29 @@ var RegistryClient = class {
     }
     return { statusCode: response.statusCode, body };
   }
+  /**
+   * Settle in-flight requests and their cache writes. Await before
+   * removing the cache dir.
+   */
+  async drain() {
+    do {
+      await Promise.all(this.#inFlight);
+      await this.cache.promise();
+    } while (this.#inFlight.size);
+  }
   async request(url, options = {}) {
+    options.signal = this.#withSignal(options.signal);
+    let settle;
+    const tracked = new Promise((res) => settle = res);
+    this.#inFlight.add(tracked);
+    try {
+      return await this.#request(url, options);
+    } finally {
+      this.#inFlight.delete(tracked);
+      settle();
+    }
+  }
+  async #request(url, options) {
     const u = typeof url === "string" ? new URL(url) : url;
     const {
       method = "GET",
@@ -28070,7 +28161,11 @@ var RegistryClient = class {
       options.headers = addHeader(
         options.headers,
         "authorization",
-        await getTokenByURL(String(u), this.identity)
+        await getTokenByURL(
+          String(u),
+          this.identity,
+          this.registryKeys
+        )
       );
     }
     let response = null;
@@ -28134,7 +28229,7 @@ var RegistryClient = class {
     if (response.statusCode === 401) {
       const otpResult = await otplease(this, options, response);
       if (otpResult && "retry" in otpResult) {
-        return await this.request(url, otpResult.retry);
+        return await this.#request(url, otpResult.retry);
       }
       if (otpResult && "bodyConsumed" in otpResult) {
         consumedBody = otpResult.bodyConsumed;
@@ -28162,7 +28257,7 @@ var RegistryClient = class {
       response.body.resume();
       const [nextURL, nextOptions] = redirect(options, result, url);
       if (nextOptions && nextURL) {
-        return await this.request(nextURL, nextOptions);
+        return await this.#request(nextURL, nextOptions);
       }
       return result;
     }
@@ -28188,6 +28283,7 @@ export {
   deleteToken,
   setToken,
   getToken,
+  registryKeys,
   getTokenByURL,
   CacheEntry,
   oidc,