@zaimokuza/dsh-plugin-hub 0.1.1 → 0.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zaimokuza/dsh-plugin-hub",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "private": false,
   "description": "Extensible DSH plugin marketplace and reusable enterprise marketplace runtime",
   "type": "module",
@@ -44,7 +44,7 @@
     "semver": "7.8.5",
     "tar": "7.5.22",
     "undici": "7.28.0",
-    "@zaimokuza/dsh-plugin-hub-catalog-demo": "0.1.0"
+    "@zaimokuza/dsh-plugin-hub-catalog-demo": "0.1.2"
   },
   "devDependencies": {
     "esbuild": "0.28.1",

package/src/identity.js

@@ -1,5 +1,11 @@
 export const MARKET_PACKAGE = '@zaimokuza/dsh-plugin-hub';
 export const CATALOG_PACKAGE = '@zaimokuza/dsh-plugin-hub-catalog-demo';
+export function normalizeRegistry(value) {
+  let url;
+  try { if (typeof value !== 'string') throw new Error(); url = new URL(value); } catch { throw new Error('npm registry must be an HTTPS URL without credentials / npm registry 必须是无凭据的 HTTPS 地址'); }
+  if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash) throw new Error('npm registry must be an HTTPS URL without credentials / npm registry 必须是无凭据的 HTTPS 地址');
+  return url.href.replace(/\/?$/, '/');
+}
 export function catalogVerification(value = 'if-present') {
   if (!['if-present', 'required', 'none'].includes(value)) throw new Error('catalogVerification must be if-present, required or none');
   return value;

package/src/index.js

@@ -8,6 +8,7 @@ import { dshEnvironment, createDshInstaller } from './dsh.js';
 import { PACKAGE_NAME, validateCatalog } from './catalog.js';
 import { createProviderApi } from './provider-api.js';
 import { readReleaseAge } from './release-age.js';
+import { readRegistry } from './registry-config.js';
 
 export const name = MARKET_PACKAGE;
 export const inject = ['webServer', 'connection'];
@@ -32,12 +33,10 @@ export async function apply(ctx, options = {}) {
   const source = { kind: 'npm', packageName: options.catalogPackage ?? CATALOG_PACKAGE };
   if (options.source) throw new Error('目录来源已改为 Nexus npm 包，请使用 catalogPackage 配置');
   if (!PACKAGE_NAME.test(source.packageName)) throw new Error('目录 npm 包名无效');
-  const registry = new URL(options.registry ?? 'https://registry.npmjs.org/');
-  if (registry.protocol !== 'https:' || registry.username || registry.password) throw new Error('npm registry 必须是无凭据的 HTTPS 地址');
-  const releaseAge = await readReleaseAge(environment.profileDir);
+  const [registry, releaseAge] = await Promise.all([readRegistry(options.registry, environment.profileDir), readReleaseAge(environment.profileDir)]);
   const sources = options.catalogSources ?? [{ id: 'company', displayName: source.packageName === CATALOG_PACKAGE ? 'Demo catalog' : brand.title, ...source, priority: 100 }];
   if (!Array.isArray(sources) || sources.length > 20 || sources.some(s => s?.kind !== 'npm')) throw new Error('catalogSources must contain at most 20 npm sources; JSON providers register through the plugin API');
-  const config = { source, sources, brand, identity, catalogVerification: catalogVerification(options.catalogVerification), packageName: options.packageName ?? MARKET_PACKAGE, registry: registry.href.replace(/\/?$/, '/'), cacheDir: join(environment.profileDir, '.dsh-plugin-hub', identity.id), ...releaseAge };
+  const config = { source, sources, brand, identity, catalogVerification: catalogVerification(options.catalogVerification), packageName: options.packageName ?? MARKET_PACKAGE, registry, cacheDir: join(environment.profileDir, '.dsh-plugin-hub', identity.id), ...releaseAge };
   const installer = createDshInstaller(environment, config);
   const market = new Marketplace({ config, host: environment.host, fetcher: createRegistryFetch(config.registry), installer });
   // The public package ships an independent catalog snapshot for first-open discovery.

package/src/registry-config.js

@@ -0,0 +1,27 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { normalizeRegistry } from './identity.js';
+
+const runFile = promisify(execFile);
+const DEFAULT_REGISTRY = 'https://registry.npmjs.org/';
+
+/** Match the profile directory used by DSH's pnpm installer, without downloading tools. */
+export async function readRegistry(explicit, cwd, { run = runFile, env = process.env, platform = process.platform } = {}) {
+  if (explicit !== undefined) return normalizeRegistry(explicit);
+  for (const manager of ['pnpm', 'npm']) {
+    let output;
+    try {
+      const { stdout } = await run(platform === 'win32' ? `${manager}.cmd` : manager, ['config', 'get', 'registry'], {
+        cwd, timeout: 5000, maxBuffer: 16384, windowsHide: true, shell: platform === 'win32',
+        env: { ...env, COREPACK_ENABLE_NETWORK: '0', COREPACK_ENABLE_PROJECT_SPEC: '0',
+          npm_config_manage_package_manager_versions: 'false', pnpm_config_manage_package_manager_versions: 'false' },
+      });
+      output = String(stdout).trim().split(/\r?\n/).at(-1);
+    } catch { continue; }
+    try { output = JSON.parse(output); } catch { /* npm commonly prints an unquoted URL. */ }
+    if (output == null || output === '' || output === 'undefined' || output === 'null') continue;
+    // A configured but invalid address is an error, not permission to query a public registry.
+    return normalizeRegistry(output);
+  }
+  return DEFAULT_REGISTRY;
+}