[Aschenbath]

Corepack can fetch package-manager metadata and tarballs using registry-scoped credentials already present in npm configuration, so authenticated registries no longer require duplicating credentials in Corepack-specific environment variables.

• Read project and user .npmrc authentication, including user-config path overrides, _authToken, _auth, username / base64 _password, and environment-variable interpolation. Project settings override user settings and the most specific matching registry path wins.
• Select authentication in the shared HTTP layer, with explicit COREPACK_NPM_TOKEN and complete COREPACK_NPM_USERNAME / COREPACK_NPM_PASSWORD taking precedence.
• Restrict credentials to matching registry hosts, ports, and paths; re-evaluate authentication after redirects without expanding the scope of supplied authorization headers. Preserve redirect method/body semantics, ignore unscoped credentials and configuration supplied by dependencies.
• Add request-level security regressions and CLI download coverage for project/user token and Basic authentication using a registry path prefix; document supported configuration and precedence.

Validation:

• node node_modules/typescript/bin/tsc --noEmit
• node node_modules/eslint/bin/eslint.js --max-warnings=0
• env -u NODE_USE_ENV_PROXY -u http_proxy -u https_proxy -u all_proxy -u no_proxy NOCK_ENV=replay node node_modules/vitest/vitest.mjs run --exclude tests/config.test.ts --retry=0 --reporter=verbose: 8 files passed, 237 tests passed and 1 existing expected failure.
• env -u http_proxy -u https_proxy -u all_proxy -u no_proxy NODE_USE_ENV_PROXY=1 NOCK_ENV=replay node node_modules/vitest/vitest.mjs run tests/config.test.ts --retry=0 --reporter=verbose: 1 file and 1 test passed.

The complete suite is run using the repository's existing node_modules in two invocations because this machine requires a proxy for the live npm-key check, while the offline tests use deliberately invalid proxy URLs that Node rejects at startup with NODE_USE_ENV_PROXY=1. Inherited lowercase proxy variables are removed so the proxy-specific cases use their own local proxy. All 9 test files and 239 test cases are included, with retries disabled.

Closes #756

[aduh95]

This account has opened more than 10 PRs in the last 24 hours. This looks like bot activity, and will result in a ban if the behavior continues.