nx 23.1.1 → 23.1.3

package/dist/src/utils/package-manager.js

@@ -13,8 +13,10 @@ exports.copyPackageManagerConfigurationFiles = copyPackageManagerConfigurationFi
 exports.createTempNpmDirectory = createTempNpmDirectory;
 exports.resolvePackageVersionUsingRegistry = resolvePackageVersionUsingRegistry;
 exports.resolvePackageVersionUsingInstallation = resolvePackageVersionUsingInstallation;
+exports.getWorkspaceRegistryUrlForDisplay = getWorkspaceRegistryUrlForDisplay;
 exports.packageRegistryView = packageRegistryView;
 exports.packageRegistryPack = packageRegistryPack;
+exports.clearPackageManagerVersionCache = clearPackageManagerVersionCache;
 exports.getPackageWorkspaces = getPackageWorkspaces;
 exports.addPackagePathToWorkspaces = addPackagePathToWorkspaces;
 const child_process_1 = require("child_process");
@@ -30,9 +32,36 @@ const file_utils_1 = require("../project-graph/file-utils");
 const catalog_1 = require("./catalog");
 const fileutils_1 = require("./fileutils");
 const installation_directory_1 = require("./installation-directory");
+const logger_1 = require("./logger");
 const package_json_1 = require("./package-json");
+const shell_quoting_1 = require("./shell-quoting");
 const workspace_root_1 = require("./workspace-root");
 const execAsync = (0, util_1.promisify)(child_process_1.exec);
+const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+/**
+ * Shell-less spawn for the registry-bridged fetches: `exec` goes through
+ * /bin/sh, which is dash on Debian-family systems, and dash drops environment
+ * names that are not valid shell identifiers, i.e. every `//...:_authToken`
+ * credential and `@scope:registry` entry the overlay carries. Windows stays on
+ * `exec`, with every argument quoted, because Node refuses to execFile the
+ * package manager's `.cmd` shim without a shell.
+ *
+ * That quoting is the whole defence on Windows, so it goes through
+ * quoteShellArg, which throws on the one argument it cannot make safe.
+ */
+function execPackageManagerAsync(pm, args, options) {
+    if (process.platform === 'win32') {
+        return execAsync([pm, ...args].map(shell_quoting_1.quoteShellArg).join(' '), options);
+    }
+    return execFileAsync(pm, args, options);
+}
+/** Same split, and the same quoting, for a blocking caller. */
+function execPackageManagerSync(pm, args, options) {
+    if (process.platform === 'win32') {
+        return (0, child_process_1.execSync)([pm, ...args].map(shell_quoting_1.quoteShellArg).join(' '), options);
+    }
+    return (0, child_process_1.execFileSync)(pm, args, options);
+}
 /**
  * Detects which package manager is used in the workspace based on the lock file.
  */
@@ -408,6 +437,27 @@ function copyPackageManagerConfigurationFiles(root, destination) {
         }
     }
 }
+/**
+ * A non-JS workspace has no root package.json and keeps its package manager
+ * files under the Nx installation directory instead.
+ */
+function getPackageManagerConfigRoot() {
+    if ((0, fs_1.existsSync)((0, path_1.join)(workspace_root_1.workspaceRoot, 'package.json'))) {
+        return workspace_root_1.workspaceRoot;
+    }
+    const installationPath = (0, installation_directory_1.getNxInstallationPath)(workspace_root_1.workspaceRoot);
+    // The installation directory can be missing or not a directory, and spawning
+    // with such a cwd fails outright (ENOENT/ENOTDIR).
+    try {
+        return (0, fs_1.statSync)(installationPath).isDirectory()
+            ? installationPath
+            : workspace_root_1.workspaceRoot;
+    }
+    catch (e) {
+        logger_1.logger.verbose(`Failed to stat the Nx installation directory at "${installationPath}".`, e);
+        return workspace_root_1.workspaceRoot;
+    }
+}
 /**
  * Creates a temporary directory where you can run package manager commands safely.
  *
@@ -424,8 +474,7 @@ function createTempNpmDirectory(skipCopy = false) {
     // A package.json is needed for pnpm pack and for .npmrc to resolve
     (0, fileutils_1.writeJsonFile)(`${dir}/package.json`, {});
     if (!skipCopy) {
-        const isNonJs = !(0, fs_1.existsSync)((0, path_1.join)(workspace_root_1.workspaceRoot, 'package.json'));
-        copyPackageManagerConfigurationFiles(isNonJs ? (0, installation_directory_1.getNxInstallationPath)(workspace_root_1.workspaceRoot) : workspace_root_1.workspaceRoot, dir);
+        copyPackageManagerConfigurationFiles(getPackageManagerConfigRoot(), dir);
     }
     const cleanup = async () => {
         try {
@@ -444,7 +493,9 @@ function createTempNpmDirectory(skipCopy = false) {
 async function resolvePackageVersionUsingRegistry(packageName, version) {
     try {
         const resolvedVersion = (0, catalog_1.resolveCatalogReferenceIfNeeded)(packageName, version);
-        const result = await packageRegistryView(packageName, resolvedVersion, 'version');
+        const result = await packageRegistryView(packageName, resolvedVersion, [
+            'version',
+        ]);
         if (!result) {
             throw new Error(`Unable to resolve version ${packageName}@${resolvedVersion}.`);
         }
@@ -466,10 +517,30 @@ async function resolvePackageVersionUsingRegistry(packageName, version) {
             .replace(/'/g, '');
         return finalResolvedVersion;
     }
-    catch {
-        throw new Error(`Unable to resolve version ${packageName}@${version}.`);
+    catch (e) {
+        // npm masks a URL credential only in the password position, so a bare token
+        // in the registry URL survives into the error kept as the cause.
+        throw new Error(`Unable to resolve version ${packageName}@${version}.`, {
+            cause: redactErrorCause(e),
+        });
     }
 }
+// Masks the userinfo in a URL: `user`, `user:pass`, or a bare token.
+function redactUrlCredentials(text) {
+    return text.replace(/([a-z][a-z0-9+.-]*:\/\/)[^/@\s]+@/gi, '$1***@');
+}
+function redactErrorCause(error) {
+    if (error && typeof error === 'object') {
+        const e = error;
+        // An exec error carries the command and both output streams as fields.
+        for (const field of ['message', 'stack', 'stderr', 'stdout', 'cmd']) {
+            if (typeof e[field] === 'string') {
+                e[field] = redactUrlCredentials(e[field]);
+            }
+        }
+    }
+    return error;
+}
 /**
  * Return the resolved version for a given package and version tag using by
  * installing it in a temporary directory and fetching the version from the
@@ -498,12 +569,86 @@ async function resolvePackageVersionUsingInstallation(packageName, version) {
         await cleanup();
     }
 }
-async function packageRegistryView(pkg, version, args, 
-// `forceNpm` runs the view through npm even in a pnpm workspace: npm projects
-// a field across every matched version, whereas `pnpm view <pkg>@<range>`
-// collapses to the single highest match (breaks per-version field queries).
-options) {
-    let pm = detectPackageManager();
+/**
+ * What every registry-bound npm spawn resolves the same way: where npm runs,
+ * and an environment reproducing the workspace package manager's own registry,
+ * auth and TLS resolution for `pkg`. `buildEnv` adds the caller's own entries.
+ */
+function createRegistrySpawnContext(pkg) {
+    // Deferred so the registry resolvers load only for the commands that spawn
+    // npm, not with every package-manager.ts import.
+    const { getNpmSpawnRegistryEnv, getPackageScope, ignoresNpmConfigEnv, mergeNpmConfigEnv, } = require('./registry-config');
+    const workspacePm = detectPackageManager();
+    const configRoot = getPackageManagerConfigRoot();
+    const workspacePmVersion = getPackageManagerVersionSafe(workspacePm, configRoot);
+    return {
+        workspacePm,
+        workspacePmVersion,
+        configRoot,
+        scope: getPackageScope(pkg),
+        buildEnv: (extra) => mergeNpmConfigEnv(process.env, {
+            ...getNpmSpawnRegistryEnv(pkg, configRoot, workspacePm, workspacePmVersion),
+            ...extra,
+        }, ignoresNpmConfigEnv(workspacePm, workspacePmVersion)),
+    };
+}
+/**
+ * The registry the fetch for `pkg` went to, with its userinfo masked because a
+ * registry URL can carry a bare token. The lookup is spawned the way
+ * `packageRegistryView` spawns the fetch this describes (same manager, same
+ * environment), so a registry the package manager keeps outside the .npmrc
+ * chain and a scope resolved for itself both land on the value that fetch used.
+ * Null where the manager yields no usable registry URL; throws where it cannot be run.
+ */
+function getWorkspaceRegistryUrlForDisplay(pkg) {
+    const { workspacePm, workspacePmVersion, configRoot, scope, buildEnv } = createRegistrySpawnContext(pkg);
+    const { pm, env, usesNativePnpm } = resolveRegistrySpawnTarget(workspacePm, workspacePmVersion, buildEnv);
+    // Ask for the package scope first. Native pnpm can keep the workspace
+    // `registries.default` separate from the flat `registry`, so it is queried
+    // in between.
+    const keys = scope ? [`${scope}:registry`] : [];
+    if (usesNativePnpm) {
+        keys.push('registries.default');
+    }
+    keys.push('registry');
+    for (const key of keys) {
+        const value = execPackageManagerSync(pm, ['config', 'get', key], {
+            cwd: configRoot,
+            timeout: 5000,
+            windowsHide: true,
+            encoding: 'utf-8',
+            // The downgraded pin warns on stderr, which is noise on a path that only
+            // decorates an error message.
+            stdio: ['ignore', 'pipe', 'ignore'],
+            env,
+        }).trim();
+        if (!value || value === 'undefined' || value === 'null') {
+            continue;
+        }
+        // A present but unusable answer (a `registries:` map with a non-string
+        // default serializes as JSON; a non-HTTP(S) scheme) also aborted the fetch
+        // this describes, so a key below it was never contacted either.
+        if (!URL.canParse(value)) {
+            return null;
+        }
+        const protocol = new URL(value).protocol;
+        if (protocol !== 'http:' && protocol !== 'https:') {
+            return null;
+        }
+        return redactUrlCredentials(value);
+    }
+    return null;
+}
+/**
+ * Which manager answers a registry read for this workspace, and the environment
+ * it reads under. pnpm 11 reimplemented `view` natively, resolving registry and
+ * credentials (tokenHelper included) itself, so it runs on the untouched
+ * environment; pnpm 10 passed `view` through to the npm CLI, which needs the
+ * overlay. Shared so a lookup describing a fetch cannot resolve against a
+ * different environment than the fetch used.
+ */
+function resolveRegistrySpawnTarget(workspacePm, workspacePmVersion, buildEnv, options) {
+    let pm = workspacePm;
     if (options?.forceNpm || pm === 'yarn' || pm === 'bun') {
         /**
          * yarn has `yarn info` but it behaves differently than (p)npm,
@@ -517,46 +662,98 @@ options) {
          */
         pm = 'npm';
     }
+    if (pm === 'pnpm' && ((0, semver_1.parse)(workspacePmVersion)?.major ?? 0) >= 11) {
+        return { pm, env: process.env, usesNativePnpm: true };
+    }
+    // npm_config_force downgrades npm's `devEngines.packageManager` enforcement,
+    // which otherwise aborts even a read-only lookup when the pin sets
+    // `onFail: error`. Only set for npm so a pnpm spawn is untouched.
+    return {
+        pm,
+        env: buildEnv(pm === 'npm' ? { npm_config_force: 'true' } : {}),
+        usesNativePnpm: false,
+    };
+}
+async function packageRegistryView(pkg, version, args, 
+// `forceNpm` runs the view through npm even in a pnpm workspace: npm projects
+// a field across every matched version, whereas `pnpm view <pkg>@<range>`
+// collapses to the single highest match (breaks per-version field queries).
+options) {
+    const { workspacePm, workspacePmVersion, configRoot, buildEnv } = createRegistrySpawnContext(pkg);
+    const { pm, env } = resolveRegistrySpawnTarget(workspacePm, workspacePmVersion, buildEnv, options);
     // An empty version means we want the full packument; omit the trailing `@`.
-    // Quote the spec so range operators (e.g. `>=0.0.0`) are not parsed as shell
-    // redirections.
     const spec = version ? `${pkg}@${version}` : pkg;
-    // npm enforces `devEngines.packageManager` on every command, even a read-only
-    // `view`; in a yarn/bun workspace we run npm, so a non-npm pin with
-    // `onFail: error` aborts the lookup. force downgrades that to a warning.
-    // Scoped to npm so a `pnpm view` spawn is left untouched.
-    const { stdout } = await execAsync(`${pm} view "${spec}" ${args}`, {
-        windowsHide: true,
-        ...(pm === 'npm'
-            ? { env: { ...process.env, npm_config_force: 'true' } }
-            : {}),
-    });
-    return stdout.toString().trim();
+    try {
+        const { stdout } = await execPackageManagerAsync(pm, ['view', spec, ...args], {
+            windowsHide: true,
+            cwd: configRoot,
+            env,
+        });
+        return stdout.toString().trim();
+    }
+    catch (e) {
+        throw redactErrorCause(e);
+    }
 }
-async function packageRegistryPack(cwd, pkg, version, options) {
-    /**
-     * Only `npm pack` supports downloading a tarball of a specified remote
-     * package. `yarn` packs the active workspace, `pnpm pack` only packs
-     * the local project, and `bun` doesn't support pack.
-     *
-     * @see https://github.com/nrwl/nx/pull/9667#discussion_r842553994
-     */
+/**
+ * Only `npm pack` supports downloading a tarball of a specified remote
+ * package. `yarn` packs the active workspace, `pnpm pack` only packs
+ * the local project, and `bun` doesn't support pack.
+ *
+ * @param packDestination Directory passed to npm's `--pack-destination`, where
+ * the `.tgz` is written.
+ * @see https://github.com/nrwl/nx/pull/9667#discussion_r842553994
+ */
+async function packageRegistryPack(packDestination, pkg, version, options) {
     const pm = 'npm';
-    const { stdout } = await execAsync(`${pm} pack ${pkg}@${version}`, {
-        cwd,
-        windowsHide: true,
-        // npm enforces `devEngines.packageManager` even on `pack`; force keeps the
-        // download working in workspaces that pin a non-npm manager (onFail: error).
-        env: {
-            ...process.env,
-            npm_config_force: 'true',
-            ...(options?.bypassMinReleaseAge
-                ? { npm_config_min_release_age: '0' }
-                : {}),
-        },
-    });
-    const tarballPath = stdout.trim();
-    return { tarballPath };
+    const { configRoot, buildEnv } = createRegistrySpawnContext(pkg);
+    // Run from the config root, not the temp dir, so npm reads the workspace
+    // .npmrc natively; --pack-destination still writes the tarball to the temp
+    // dir. npm prints the tarball basename to stdout.
+    try {
+        const { stdout } = await execPackageManagerAsync(pm, ['pack', `${pkg}@${version}`, '--pack-destination', packDestination], {
+            cwd: configRoot,
+            windowsHide: true,
+            env: buildEnv({
+                // downgrade npm's devEngines.packageManager enforcement (onFail:
+                // error) to a warning so pack still runs in a non-npm workspace
+                npm_config_force: 'true',
+                ...(options?.bypassMinReleaseAge
+                    ? { npm_config_min_release_age: '0' }
+                    : {}),
+            }),
+        });
+        const tarballPath = stdout.trim();
+        return { tarballPath };
+    }
+    catch (e) {
+        throw redactErrorCause(e);
+    }
+}
+// The version probe shells out when the packageManager field is absent, and
+// packageRegistryView/packageRegistryPack run in tight resolution loops.
+const packageManagerVersionCache = new Map();
+/**
+ * A null version is tolerated per package manager: pnpm and yarn skip bridging,
+ * bun assumes a current version.
+ */
+function getPackageManagerVersionSafe(packageManager, root) {
+    const key = `${packageManager}:${root}`;
+    if (!packageManagerVersionCache.has(key)) {
+        let version = null;
+        try {
+            version = getPackageManagerVersion(packageManager, root);
+        }
+        catch (e) {
+            logger_1.logger.verbose(`Failed to determine the ${packageManager} version in "${root}".`, e);
+        }
+        packageManagerVersionCache.set(key, version);
+    }
+    return packageManagerVersionCache.get(key);
+}
+// Test-only: production never re-resolves a version mid-run.
+function clearPackageManagerVersionCache() {
+    packageManagerVersionCache.clear();
 }
 /**
  * Gets the workspaces defined in the package manager configuration.

package/dist/src/utils/provenance.js

@@ -3,7 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ProvenanceError = void 0;
 exports.ensurePackageHasProvenance = ensurePackageHasProvenance;
 exports.getNxPackageGroup = getNxPackageGroup;
-const child_process_1 = require("child_process");
 const module_1 = require("module");
 const fileutils_1 = require("./fileutils");
 const package_manager_1 = require("./package-manager");
@@ -21,7 +20,10 @@ async function ensurePackageHasProvenance(packageName, packageVersion) {
         return;
     }
     try {
-        const result = await (0, package_manager_1.packageRegistryView)(packageName, packageVersion, '--json --silent');
+        const result = await (0, package_manager_1.packageRegistryView)(packageName, packageVersion, [
+            '--json',
+            '--silent',
+        ]);
         const parsed = JSON.parse(result);
         // `npm view <pkg>@<spec> --json` returns a bare object on npm <= 11 but an
         // array on npm 12 and pnpm, even for a single resolved version. A version
@@ -77,19 +79,9 @@ class ProvenanceError extends Error {
     constructor(packageName, packageVersion, error) {
         let customRegistry = undefined;
         try {
-            const packageManager = (0, package_manager_1.detectPackageManager)();
-            const commands = (0, package_manager_1.getPackageManagerCommand)(packageManager);
-            // Try to get registry from current package manager, fall back to npm
-            const registryCommand = commands.getRegistryUrl ?? 'npm config get registry';
-            const registry = (0, child_process_1.execSync)(registryCommand, {
-                timeout: 5000,
-                windowsHide: true,
-                encoding: 'utf-8',
-            }).trim();
+            const registry = (0, package_manager_1.getWorkspaceRegistryUrlForDisplay)(packageName);
             // Only consider it custom if it's not the default npm registry
-            if (registry &&
-                registry !== 'undefined' &&
-                !registry.includes('registry.npmjs.org')) {
+            if (registry && !registry.includes('registry.npmjs.org')) {
                 customRegistry = registry;
             }
         }

package/dist/src/utils/registry-config/bun.d.ts

@@ -0,0 +1,2 @@
+import { type NpmConfigEnv } from './utils';
+export declare function getBunSpawnRegistryEnv(packageName: string, root: string, bunVersion: string | null): NpmConfigEnv;

package/dist/src/utils/registry-config/bun.js

@@ -0,0 +1,257 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getBunSpawnRegistryEnv = getBunSpawnRegistryEnv;
+const path_1 = require("path");
+const semver_1 = require("semver");
+const bunfig_1 = require("../package-manager-config/bunfig");
+const npmrc_1 = require("../package-manager-config/npmrc");
+const utils_1 = require("./utils");
+/*
+ * bun registry resolution (verified on 1.2.23 and 1.3.14, gates bisected):
+ *
+ * CLI --registry > BUN_CONFIG_REGISTRY > NPM_CONFIG_REGISTRY >
+ * npm_config_registry > project .npmrc > global ($XDG_CONFIG_HOME else
+ * $HOME)/.npmrc > project bunfig.toml > global bunfig > registry.npmjs.org.
+ * .npmrc beats bunfig at every level, including scoped keys. Env registry
+ * values must start with http(s):// or they are ignored. .npmrc support
+ * exists from bun 1.1.18; [install].ca/cafile from 1.1.31. When
+ * XDG_CONFIG_HOME is set, bun reads $XDG_CONFIG_HOME/.npmrc INSTEAD of
+ * ~/.npmrc, which npm always reads.
+ * See https://github.com/oven-sh/bun/blob/bun-v1.2.23/src/install/PackageManager.zig#L791
+ *
+ * The final default/scoped registry is always injected: bun does not read
+ * npm-only surfaces (e.g. $PREFIX/etc/npmrc), so npm must not fall back to
+ * them.
+ */
+const BUN_DEFAULT_REGISTRY = 'https://registry.npmjs.org/';
+function getBunSpawnRegistryEnv(packageName, root, bunVersion) {
+    const env = {};
+    const scope = (0, utils_1.getPackageScope)(packageName);
+    const npmrcSupported = !bunVersion || (0, semver_1.gte)(bunVersion, '1.1.18');
+    const tlsSupported = !bunVersion || (0, semver_1.gte)(bunVersion, '1.1.31');
+    const globalConfigBase = (0, bunfig_1.getBunGlobalConfigBase)(process.env);
+    const projectNpmrc = npmrcSupported
+        ? readBunNpmrcMap((0, path_1.join)(root, '.npmrc'))
+        : null;
+    const globalNpmrc = npmrcSupported && globalConfigBase
+        ? readBunNpmrcMap((0, path_1.join)(globalConfigBase, '.npmrc'))
+        : null;
+    const projectBunfig = readBunfigInstall((0, path_1.join)(root, 'bunfig.toml'));
+    const globalBunfig = globalConfigBase
+        ? readBunfigInstall((0, path_1.join)(globalConfigBase, '.bunfig.toml'))
+        : null;
+    // Swap npm's userconfig so the auth/TLS keys npm reads natively come from
+    // the same file bun would use.
+    if (npmrcSupported && process.env.XDG_CONFIG_HOME) {
+        env['npm_config_userconfig'] = (0, path_1.join)(process.env.XDG_CONFIG_HOME, '.npmrc');
+    }
+    const envRegistry = [
+        process.env.BUN_CONFIG_REGISTRY,
+        process.env.NPM_CONFIG_REGISTRY,
+        process.env.npm_config_registry,
+    ].find((value) => value && /^https?:\/\//.test(value));
+    // An .npmrc registry goes through both of bun's expansions: its ini reader
+    // resolves `${VAR}` anywhere in the value, and the scope it then builds
+    // resolves a whole-value `$VAR`. Without the second, `registry=$MY_REGISTRY`
+    // stays a literal npm rejects as an invalid URL.
+    const npmrcRegistryValue = (key) => {
+        const raw = projectNpmrc?.get(key) ?? globalNpmrc?.get(key);
+        return raw === undefined
+            ? undefined
+            : expandBunRegistryUrl((0, utils_1.expandEnvVars)(raw));
+    };
+    const bunfigValue = (read, fallbackUrl) => {
+        for (const install of [projectBunfig, globalBunfig]) {
+            if (!install) {
+                continue;
+            }
+            const value = read(install);
+            if (value !== undefined) {
+                return normalizeBunRegistryValue(value, fallbackUrl);
+            }
+        }
+        return undefined;
+    };
+    const npmrcRegistry = npmrcRegistryValue('registry');
+    const defaultPick = envRegistry
+        ? { url: envRegistry }
+        : npmrcRegistry
+            ? { url: npmrcRegistry }
+            : (bunfigValue((install) => install.registry, BUN_DEFAULT_REGISTRY) ?? {
+                url: BUN_DEFAULT_REGISTRY,
+            });
+    (0, utils_1.setRegistry)(env, defaultPick.url);
+    applyBunAuth(env, defaultPick);
+    if (scope) {
+        const npmrcScoped = npmrcRegistryValue(`${scope}:registry`);
+        // [install.scopes] keys are accepted with or without the leading @.
+        const scopedPick = npmrcScoped
+            ? { url: npmrcScoped }
+            : (bunfigValue((install) => install.scopes?.[scope] ?? install.scopes?.[scope.slice(1)], 
+            // A scope entry that declares only credentials keeps the default
+            // registry as its url, so its token still reaches the right host.
+            defaultPick.url) ?? defaultPick);
+        (0, utils_1.setScopedRegistry)(env, scope, scopedPick.url);
+        if (scopedPick !== defaultPick) {
+            applyBunAuth(env, scopedPick);
+        }
+    }
+    if (tlsSupported) {
+        // .npmrc TLS keys beat bunfig's; npm reads the npmrc family natively.
+        const npmrcHasTls = projectNpmrc?.has('cafile') ||
+            projectNpmrc?.has('ca') ||
+            globalNpmrc?.has('cafile') ||
+            globalNpmrc?.has('ca');
+        if (!npmrcHasTls) {
+            const cafile = projectBunfig?.cafile ?? globalBunfig?.cafile;
+            if (cafile) {
+                // bun resolves cafile relative to the project dir.
+                (0, utils_1.setCafile)(env, (0, path_1.resolve)(root, cafile));
+            }
+            else {
+                const ca = projectBunfig?.ca ?? globalBunfig?.ca;
+                if (ca) {
+                    // npm reconstructs a config array from the env by splitting the
+                    // value on a blank line.
+                    env['npm_config_ca'] = Array.isArray(ca) ? ca.join('\n\n') : ca;
+                }
+            }
+        }
+    }
+    return env;
+}
+// bun silently resolves as though an .npmrc it cannot read were absent
+// (verified on 1.3.13, EACCES and EISDIR both), so collapse that state the
+// same way rather than warning or aborting.
+function readBunNpmrcMap(path) {
+    const map = (0, npmrc_1.readNpmrcMap)(path);
+    return map === 'unreadable' ? null : map;
+}
+function normalizeBunRegistryValue(value, fallbackUrl) {
+    if (typeof value !== 'string') {
+        const result = {
+            url: value.url ? expandBunRegistryUrl(value.url) : fallbackUrl,
+        };
+        for (const field of ['token', 'username', 'password']) {
+            const expanded = expandBunAuthValue(value[field]);
+            if (expanded !== undefined) {
+                result[field] = expanded;
+            }
+        }
+        return result;
+    }
+    const expanded = expandBunRegistryUrl(value);
+    try {
+        const url = new URL(expanded);
+        if (url.username || url.password) {
+            // bun treats a username with no password as no credentials at all.
+            const credentials = url.username && url.password
+                ? { username: url.username, password: url.password }
+                : url.password
+                    ? // `https://:token@host/` carries a token as the bare password.
+                        { token: url.password }
+                    : {};
+            url.username = '';
+            url.password = '';
+            return { url: url.toString(), ...credentials };
+        }
+    }
+    catch { }
+    return { url: expanded };
+}
+// bun expands a whole-value `$VARNAME` (no braces) in bunfig credential fields
+// via env.getAuto; an unset var keeps the literal, and `${VAR}` is expanded
+// only in its .npmrc.
+function expandBunAuthValue(value) {
+    if (value === undefined || value.length < 2 || value[0] !== '$') {
+        return value;
+    }
+    return process.env[value.slice(1)] ?? value;
+}
+// Bun expands a `$`-prefixed bunfig registry URL (Scope.fromAPI): it looks up
+// the name with surrounding slashes trimmed and uses it only when the result is
+// longer than one character, else keeps the literal.
+function expandBunRegistryUrl(value) {
+    if (!value || value[0] !== '$') {
+        return value;
+    }
+    const name = value.slice(1).replace(/^\/+|\/+$/g, '');
+    const replaced = process.env[name];
+    return replaced && replaced.length > 1 ? replaced : value;
+}
+function applyBunAuth(env, value) {
+    if (value.token) {
+        (0, utils_1.setAuthToken)(env, value.url, value.token);
+    }
+    else if (value.username && value.password) {
+        const dart = (0, utils_1.requestNerfDart)(value.url);
+        if (dart) {
+            env[`npm_config_${dart}:username`] = value.username;
+            // npm expects _password base64-encoded.
+            env[`npm_config_${dart}:_password`] = Buffer.from(value.password).toString('base64');
+        }
+    }
+}
+function readBunfigInstall(path) {
+    const parsed = (0, bunfig_1.readBunfigRaw)(path);
+    if (parsed === null || parsed === 'unreadable') {
+        return null;
+    }
+    if (parsed === 'invalid') {
+        // The throw reaches the caller's fall-open. Skipping the file instead would
+        // pin npm to the default registry as though the workspace configured none,
+        // overriding a registry npm resolves from a file of its own.
+        throw new Error(`The bunfig at ${path} could not be parsed.`);
+    }
+    const install = parsed.install;
+    if (!install || typeof install !== 'object' || Array.isArray(install)) {
+        return null;
+    }
+    validateBunfigInstall(install, path);
+    return install;
+}
+/**
+ * bun type-checks the [install] table before it resolves anything and aborts on
+ * a value of the wrong shape. Reproduce that rather than carrying a number into
+ * a URL parse or a path join, where it would throw somewhere unrelated or
+ * bridge a value bun never accepted.
+ */
+function validateBunfigInstall(install, path) {
+    const fail = (what) => {
+        throw new Error(`The bunfig at ${path} declares ${what}.`);
+    };
+    if (install.registry !== undefined) {
+        validateBunRegistryValue(install.registry, 'install.registry', fail);
+    }
+    if (install.scopes !== undefined) {
+        if (typeof install.scopes !== 'object' || Array.isArray(install.scopes)) {
+            fail('an install.scopes that is not a table');
+        }
+        for (const [key, value] of Object.entries(install.scopes)) {
+            validateBunRegistryValue(value, `install.scopes["${key}"]`, fail);
+        }
+    }
+    if (install.cafile !== undefined && typeof install.cafile !== 'string') {
+        fail('an install.cafile that is not a string');
+    }
+    if (install.ca !== undefined &&
+        typeof install.ca !== 'string' &&
+        !(Array.isArray(install.ca) &&
+            install.ca.every((entry) => typeof entry === 'string'))) {
+        fail('an install.ca that is neither a string nor an array of strings');
+    }
+}
+function validateBunRegistryValue(value, setting, fail) {
+    if (typeof value === 'string') {
+        return;
+    }
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        fail(`a ${setting} that is neither a URL string nor a table`);
+    }
+    for (const field of ['url', 'token', 'username', 'password']) {
+        const field_ = value[field];
+        if (field_ !== undefined && typeof field_ !== 'string') {
+            fail(`a ${setting}.${field} that is not a string`);
+        }
+    }
+}