id       = "verdaccio"
name     = "Verdaccio"
homepage = "https://verdaccio.org"
description = "A lightweight Node.js private proxy registry."
icon     = "SimpleIcons:verdaccio"
executables   = ["verdaccio"]

[dotfiles]

# packages/config/src/config-path.ts in verdaccio's own source builds the list
# of candidate config directories, in order: the XDG one — `XDG_CONFIG_HOME`
# falling back to `$HOME/.config` — then `%APPDATA%` when the platform is
# win32, then a working-directory fallback for a config shipped beside a
# project. `CONFIG_FILE = 'config.yaml'` is the file name in every one of them.
# There is no `~/Library/Application Support` case, so a Mac takes the dotted
# XDG path too; XDG on Unix plus %APPDATA% on Windows is exactly [configHome].
paths = ["[configHome]/verdaccio/config.yaml"]

# https://verdaccio.org/docs/configuration — the config verdaccio generates on
# first run sets `storage: ./storage`, resolved against the config file's own
# folder, and the page says the `.verdaccio-db` database "location is based on
# the config.yaml folder location". Both hold published tarballs and registry
# bookkeeping, not configuration. config-path.ts moves storage to
# `$XDG_DATA_HOME/verdaccio/storage` on a machine that resolved the XDG path,
# so that spelling is named as well.
exclude = [
  "[configHome]/verdaccio/storage/",
  "[configHome]/verdaccio/.verdaccio-db",
  "[xdgData]/verdaccio/storage/",
]

# The same default config sets `auth: htpasswd: file: ./htpasswd`, a file
# beside config.yaml. It is the registry's user database — one login and
# password hash per line — and nothing else, so it never syncs as content.
secret = ["[configHome]/verdaccio/htpasswd"]

# https://verdaccio.org/docs/uplinks documents the auth block on an uplink and
# says the `token` key is "not recommended by security concerns", offering
# `token_env` instead — which means a config that took the first option carries
# a registry token in the clear. The token is lifted out; `token_env`, which
# only names an environment variable, is left in place.
[[dotfiles.secret_paths]]
file  = "[configHome]/verdaccio/config.yaml"
match = { key_path = ["uplinks.*.auth.token"] }

# No machine_lines. `storage` and `auth.htpasswd.file` are relative to the
# config file in the shipped default, so they read the same on every machine. A
# user who replaced one with an absolute path has made it machine-local, but
# holding the key back by default would strand the setting for everyone who
# did not.

[commands]
format = 1
label = "Start registry"
description = "Start the Verdaccio private npm registry with a chosen listen address and config file."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.source]]
id = "docs"
kind = "manual"
url = "https://verdaccio.org/docs/cli"
revision = "2026-10-27"
evidence = """verdaccio --listen 4000 --config ./config.yaml
--listen / -l  localhost:4873  7000  Protocol + host + port to listen on
--config / -c  ~/.config/verdaccio/config.yaml  ./config.yaml  Location of the configuration file
--info / -i  Print local environment information
--version / -v  Show version information"""

[[commands.field]]
id = "listen"
label = "Listen address"
description = "Port, host:port or proto://host:port. Default localhost:4873."
type = "string"
option = ["--listen", "-l"]
suggestions = [{ value = "4873", label = "4873 (default port)" }, { value = "0.0.0.0:4873", label = "All interfaces" }]
sources = ["docs"]

[[commands.field]]
id = "config"
label = "Config file"
type = "path"
option = ["--config", "-c"]
path = { kind = "file", role = "input", must_exist = true }
sources = ["docs"]

[[commands.field]]
id = "info"
label = "Print environment info and exit"
type = "boolean"
option = ["--info", "-i"]
sources = ["docs"]

[[commands.task]]
id = "start"
label = "Start the registry"
fields = ["listen", "config"]

[[commands.group]]
id = "basic"
label = "Basic"
fields = ["listen", "config", "info"]