Encode slashes in package names in the registry manifest request (#5716)

* Encode slashes in package names in the registry manifest request

Co-Authored-By: Max Brosnahan <1177034+gingermusketeer@users.noreply.github.com>

* Update dummy.registry.ts

* Fix tests

* Add guide for Azure Artifacts

* Update azure-artifacts.md

* Update azure-artifacts.md

* Typo

---------

Co-authored-by: Jarred Sumner <709451+Jarred-Sumner@users.noreply.github.com>
Co-authored-by: Max Brosnahan <1177034+gingermusketeer@users.noreply.github.com>

3 files changed, 31 insertions, 2 deletions

diff --git a/src/env_loader.zig b/src/env_loader.zig
index 6957a1a26..213d14ab8 100644
--- a/src/env_loader.zig
+++ b/src/env_loader.zig
@@ -172,7 +172,12 @@ pub const Loader = struct {
     }
 
     pub fn getAuto(this: *const Loader, key: string) string {
-        return this.get(key) orelse key;
+        // If it's "" or "$", it's not a variable
+        if (key.len < 2 or key[0] != '$') {
+            return key;
+        }
+
+        return this.get(key[1..]) orelse key;
     }
 
     /// Load values from the environment into Define.
diff --git a/src/install/install.zig b/src/install/install.zig
index 722d46be1..158130b25 100644
--- a/src/install/install.zig
+++ b/src/install/install.zig
@@ -252,9 +252,22 @@ const NetworkTask = struct {
         warn_on_error: bool,
     ) !void {
         this.url_buf = blk: {
+
+            // Not all registries support scoped package names when fetching the manifest.
+            // registry.npmjs.org supports both "@storybook%2Faddons" and "@storybook/addons"
+            // Other registries like AWS codeartifact only support the former.
+            // "npm" CLI requests the manifest with the encoded name.
+            var arena = std.heap.ArenaAllocator.init(bun.default_allocator);
+            defer arena.deinit();
+            var stack_fallback_allocator = std.heap.stackFallback(512, arena.allocator());
+            var encoded_name = name;
+            if (strings.containsChar(name, '/')) {
+                encoded_name = try std.mem.replaceOwned(u8, stack_fallback_allocator.get(), name, "/", "%2f");
+            }
+
             const tmp = bun.JSC.URL.join(
                 bun.String.fromUTF8(scope.url.href),
-                bun.String.fromUTF8(name),
+                bun.String.fromUTF8(encoded_name),
             );
             defer tmp.deref();
 
diff --git a/src/install/npm.zig b/src/install/npm.zig
index 9f3f2952c..fec545b0c 100644
--- a/src/install/npm.zig
+++ b/src/install/npm.zig
@@ -68,6 +68,17 @@ pub const Registry = struct {
 
         pub fn fromAPI(name: string, registry_: Api.NpmRegistry, allocator: std.mem.Allocator, env: *DotEnv.Loader) !Scope {
             var registry = registry_;
+
+            // Support $ENV_VAR for registry URLs
+            if (strings.startsWithChar(registry_.url, '$')) {
+                // If it became "$ENV_VAR/", then we need to remove the trailing slash
+                if (env.get(strings.trim(registry_.url[1..], "/"))) |replaced_url| {
+                    if (replaced_url.len > 1) {
+                        registry.url = replaced_url;
+                    }
+                }
+            }
+
             var url = URL.parse(registry.url);
             var auth: string = "";