@vltpkg/registry-client 1.0.0-rc.27 → 1.0.0-rc.29

package/dist/auth.d.ts

@@ -1,5 +1,16 @@
 import { Keychain } from '@vltpkg/keychain';
 export type Token = `Bearer ${string}` | `Basic ${string}`;
+/**
+ * Normalize a registry URL into a stable key that preserves the
+ * path prefix.  The result is `origin + pathname` with trailing
+ * slashes stripped so that
+ *   `https://r.io/luke/`  and  `https://r.io/luke`
+ * both produce the same key.
+ *
+ * For plain-origin registries the result is identical to the old
+ * `new URL(url).origin` behaviour (e.g. `https://registry.npmjs.org`).
+ */
+export declare const normalizeRegistryKey: (url: string) => string;
 export declare const keychains: Map<string, Keychain<Token>>;
 /**
  * In-memory token store for OIDC-exchanged tokens.
@@ -13,3 +24,13 @@ export declare const isToken: (t: any) => t is Token;
 export declare const deleteToken: (registry: string, identity: string) => Promise<void>;
 export declare const setToken: (registry: string, token: Token, identity: string) => Promise<void>;
 export declare const getToken: (registry: string, identity: string) => Promise<Token | undefined>;
+/**
+ * Find the best matching token for a request URL by performing a
+ * longest-prefix match against all known registry keys (runtime
+ * tokens, env-var registries, and keychain entries).
+ *
+ * This is used by `RegistryClient.request()` which only has the
+ * full request URL — not the configured registry URL that was used
+ * to construct it.
+ */
+export declare const getTokenByURL: (requestUrl: string, identity: string) => Promise<Token | undefined>;

package/dist/auth.js

@@ -1,4 +1,18 @@
 import { Keychain } from '@vltpkg/keychain';
+/**
+ * Normalize a registry URL into a stable key that preserves the
+ * path prefix.  The result is `origin + pathname` with trailing
+ * slashes stripped so that
+ *   `https://r.io/luke/`  and  `https://r.io/luke`
+ * both produce the same key.
+ *
+ * For plain-origin registries the result is identical to the old
+ * `new URL(url).origin` behaviour (e.g. `https://registry.npmjs.org`).
+ */
+export const normalizeRegistryKey = (url) => {
+    const u = new URL(url);
+    return (u.origin + u.pathname).replace(/\/+$/, '');
+};
 // just exported for testing
 export const keychains = new Map();
 /**
@@ -7,7 +21,7 @@ export const keychains = new Map();
  */
 export const runtimeTokens = new Map();
 export const setRuntimeToken = (registry, token) => {
-    runtimeTokens.set(new URL(registry).origin, token);
+    runtimeTokens.set(normalizeRegistryKey(registry), token);
 };
 export const clearRuntimeTokens = () => {
     runtimeTokens.clear();
@@ -26,28 +40,69 @@ export const isToken = (t) => typeof t === 'string' &&
 export const deleteToken = async (registry, identity) => {
     const kc = getKC(identity);
     await kc.load();
-    kc.delete(new URL(registry).origin);
+    kc.delete(normalizeRegistryKey(registry));
     await kc.save();
 };
 export const setToken = async (registry, token, identity) => {
     const kc = getKC(identity);
-    return kc.set(new URL(registry).origin, token);
+    return kc.set(normalizeRegistryKey(registry), token);
 };
 export const getToken = async (registry, identity) => {
     const kc = getKC(identity);
-    registry = new URL(registry).origin;
+    const key = normalizeRegistryKey(registry);
     // Runtime tokens (e.g. from OIDC exchange) take precedence
-    const rt = runtimeTokens.get(registry);
+    const rt = runtimeTokens.get(key);
     if (rt)
         return rt;
     const envReg = process.env.VLT_REGISTRY;
-    if (envReg && registry === new URL(envReg).origin) {
+    if (envReg && key === normalizeRegistryKey(envReg)) {
         const envTok = process.env.VLT_TOKEN;
         if (envTok)
             return `Bearer ${envTok}`;
     }
-    const tok = process.env[`VLT_TOKEN_${registry.replace(/[^a-zA-Z0-9]+/g, '_')}`];
+    const tok = process.env[`VLT_TOKEN_${key.replace(/[^a-zA-Z0-9]+/g, '_')}`];
     if (tok)
         return `Bearer ${tok}`;
-    return kc.get(registry);
+    return kc.get(key);
+};
+/**
+ * Find the best matching token for a request URL by performing a
+ * longest-prefix match against all known registry keys (runtime
+ * tokens, env-var registries, and keychain entries).
+ *
+ * This is used by `RegistryClient.request()` which only has the
+ * full request URL — not the configured registry URL that was used
+ * to construct it.
+ */
+export const getTokenByURL = async (requestUrl, identity) => {
+    const normalized = normalizeRegistryKey(requestUrl);
+    // Collect all known registry keys.
+    const candidates = [...runtimeTokens.keys()];
+    const envReg = process.env.VLT_REGISTRY;
+    if (envReg) {
+        candidates.push(normalizeRegistryKey(envReg));
+    }
+    const kc = getKC(identity);
+    // Keychain entries
+    for (const k of await kc.keys()) {
+        candidates.push(k);
+    }
+    // Find the longest candidate key that is a prefix of the
+    // normalized request URL.
+    let bestKey;
+    let bestLen = 0;
+    for (const candidate of candidates) {
+        if (candidate.length > bestLen &&
+            (normalized === candidate ||
+                normalized.startsWith(candidate + '/'))) {
+            bestKey = candidate;
+            bestLen = candidate.length;
+        }
+    }
+    if (bestKey) {
+        return getToken(bestKey, identity);
+    }
+    // Fall back to origin-only match (handles VLT_TOKEN_* env vars
+    // which we can't enumerate by URL).
+    return getToken(requestUrl, identity);
 };

package/dist/index.d.ts

@@ -3,14 +3,14 @@ import type { Integrity } from '@vltpkg/types';
 import type { Dispatcher } from 'undici';
 import { RetryAgent } from 'undici';
 import type { Token } from './auth.ts';
-import { clearRuntimeTokens, deleteToken, getKC, isToken, keychains, runtimeTokens, setRuntimeToken, setToken } from './auth.ts';
+import { clearRuntimeTokens, deleteToken, getKC, getTokenByURL, isToken, keychains, normalizeRegistryKey, runtimeTokens, setRuntimeToken, setToken } from './auth.ts';
 import type { JSONObj } from './cache-entry.ts';
 import { CacheEntry } from './cache-entry.ts';
 import type { TokenResponse } from './token-response.ts';
 import type { WebAuthChallenge } from './web-auth-challenge.ts';
 import { oidc } from './oidc.ts';
 import type { OidcOptions } from './oidc.ts';
-export { CacheEntry, clearRuntimeTokens, deleteToken, getKC, isToken, keychains, oidc, runtimeTokens, setRuntimeToken, setToken, type JSONObj, type OidcOptions, type Token, type TokenResponse, type WebAuthChallenge, };
+export { CacheEntry, clearRuntimeTokens, deleteToken, getKC, getTokenByURL, isToken, keychains, normalizeRegistryKey, oidc, runtimeTokens, setRuntimeToken, setToken, type JSONObj, type OidcOptions, type Token, type TokenResponse, type WebAuthChallenge, };
 export type CacheableMethod = 'GET' | 'HEAD';
 export declare const isCacheableMethod: (m: unknown) => m is CacheableMethod;
 export type RegistryClientOptions = {

package/dist/index.js

@@ -10,7 +10,7 @@ import { setTimeout } from 'node:timers/promises';
 import { loadPackageJson } from 'package-json-from-dist';
 import { Agent, RetryAgent } from 'undici';
 import { addHeader } from "./add-header.js";
-import { clearRuntimeTokens, deleteToken, getKC, getToken, isToken, keychains, runtimeTokens, setRuntimeToken, setToken, } from "./auth.js";
+import { clearRuntimeTokens, deleteToken, getKC, getToken, getTokenByURL, isToken, keychains, normalizeRegistryKey, runtimeTokens, setRuntimeToken, setToken, } from "./auth.js";
 import { CacheEntry } from "./cache-entry.js";
 import { register } from "./cache-revalidate.js";
 import { bun, deno, node } from "./env.js";
@@ -22,7 +22,7 @@ import { getTokenResponse } from "./token-response.js";
 import { getWebAuthChallenge } from "./web-auth-challenge.js";
 import { getEncondedValue } from "./string-encoding.js";
 import { oidc } from "./oidc.js";
-export { CacheEntry, clearRuntimeTokens, deleteToken, getKC, isToken, keychains, oidc, runtimeTokens, setRuntimeToken, setToken, };
+export { CacheEntry, clearRuntimeTokens, deleteToken, getKC, getTokenByURL, isToken, keychains, normalizeRegistryKey, oidc, runtimeTokens, setRuntimeToken, setToken, };
 export const isCacheableMethod = (m) => m === 'GET' || m === 'HEAD';
 const { version } = loadPackageJson(import.meta.filename, process.env.__VLT_INTERNAL_REGISTRY_CLIENT_PACKAGE_JSON);
 const nua = globalThis.navigator?.userAgent ??
@@ -213,7 +213,6 @@ export class RegistryClient {
         const { useCache = !!m } = options;
         signal?.throwIfAborted();
         // first, try to get from the cache before making any request.
-        const { origin } = u;
         const key = `${method !== 'GET' ? method + ' ' : ''}${u}`;
         const buffer = useCache ?
             await this.cache.fetch(key, { context: { integrity } })
@@ -247,7 +246,7 @@ export class RegistryClient {
         }
         options.method = options.method ?? 'GET';
         // will remove if we don't have a token.
-        options.headers = addHeader(options.headers, 'authorization', await getToken(origin, this.identity));
+        options.headers = addHeader(options.headers, 'authorization', await getTokenByURL(String(u), this.identity));
         let response = null;
         try {
             response = await this.agent.request(options);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/registry-client",
   "description": "Fetch package artifacts and metadata from registries",
-  "version": "1.0.0-rc.27",
+  "version": "1.0.0-rc.29",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -13,14 +13,14 @@
     "url": "http://vlt.sh"
   },
   "dependencies": {
-    "@vltpkg/cache": "1.0.0-rc.27",
-    "@vltpkg/cache-unzip": "1.0.0-rc.27",
-    "@vltpkg/error-cause": "1.0.0-rc.27",
-    "@vltpkg/keychain": "1.0.0-rc.27",
-    "@vltpkg/output": "1.0.0-rc.27",
-    "@vltpkg/types": "1.0.0-rc.27",
-    "@vltpkg/url-open": "1.0.0-rc.27",
-    "@vltpkg/xdg": "1.0.0-rc.27",
+    "@vltpkg/cache": "1.0.0-rc.29",
+    "@vltpkg/cache-unzip": "1.0.0-rc.29",
+    "@vltpkg/error-cause": "1.0.0-rc.29",
+    "@vltpkg/keychain": "1.0.0-rc.29",
+    "@vltpkg/output": "1.0.0-rc.29",
+    "@vltpkg/types": "1.0.0-rc.29",
+    "@vltpkg/url-open": "1.0.0-rc.29",
+    "@vltpkg/xdg": "1.0.0-rc.29",
     "cache-control-parser": "^2.0.6",
     "package-json-from-dist": "^1.0.1",
     "undici": "^7.16.0"