@pnpm/pnpr.client 1.2.2 → 1.3.0

package/lib/resolveViaPnprServer.d.ts

@@ -1,6 +1,5 @@
 import type { LockfileFile, LockfileObject } from '@pnpm/lockfile.types';
 import type { ResponseMetadata } from './protocol.js';
-export type AuthHeadersByScope = Record<string, Record<string, string>>;
 export interface PnprProject {
     /** Relative dir within the workspace (e.g. "." or "packages/foo") */
     dir: string;
@@ -26,16 +25,11 @@ export interface ResolveViaPnprServerOptions {
     registry?: string;
     /** The client's named-registry aliases (`namedRegistries`). */
     namedRegistries?: Record<string, string>;
-    /**
-     * The caller's forwarded upstream credentials, keyed by nerf-darted
-     * registry URI and package scope, so the server resolves private
-     * content as the caller. The `@` scope stores registry-wide auth.
-     * Distinct from `authorization` (pnpr identity).
-     */
-    authHeaders?: AuthHeadersByScope;
     /**
      * `Authorization` for the pnpr server's own URL (`undefined` if none):
-     * identifies the caller to pnpr's gate.
+     * identifies the caller to pnpr's gate. The client never forwards its
+     * own upstream registry credentials — pnpr selects upstream credentials
+     * from its route policy, so none are placed in the request body.
      */
     authorization?: string;
     /** Overrides */
@@ -59,7 +53,7 @@ export interface ResolveViaPnprServerResult {
  * Resolve a project against a pnpr server and return the resolved
  * lockfile.
  *
- * `POST /v1/resolve` answers with an `application/x-ndjson` stream: one
+ * `POST /-/pnpr/v0/resolve` answers with an `application/x-ndjson` stream: one
  * `package` frame per resolved tarball as the server's tree walk yields
  * it, then exactly one terminal frame — `done` (full lockfile + stats),
  * `error`, or `violations`. pnpr serves no file content — the caller

package/lib/resolveViaPnprServer.js

@@ -7,7 +7,7 @@ import { convertToLockfileObject } from '@pnpm/lockfile.fs';
  * Resolve a project against a pnpr server and return the resolved
  * lockfile.
  *
- * `POST /v1/resolve` answers with an `application/x-ndjson` stream: one
+ * `POST /-/pnpr/v0/resolve` answers with an `application/x-ndjson` stream: one
  * `package` frame per resolved tarball as the server's tree walk yields
  * it, then exactly one terminal frame — `done` (full lockfile + stats),
  * `error`, or `violations`. pnpr serves no file content — the caller
@@ -25,7 +25,6 @@ export async function resolveViaPnprServer(opts) {
         projects,
         registry: opts.registry,
         namedRegistries: opts.namedRegistries,
-        authHeaders: opts.authHeaders,
         overrides: opts.overrides,
         nodeVersion: opts.nodeVersion ?? process.version.slice(1),
         os: process.platform,
@@ -55,7 +54,7 @@ export async function resolveViaPnprServer(opts) {
     };
 }
 /**
- * Parse the NDJSON `/v1/resolve` body and return its single terminal
+ * Parse the NDJSON `/-/pnpr/v0/resolve` body and return its single terminal
  * frame. `package` frames are skipped — this client fetches tarballs the
  * normal way after resolution rather than overlapping fetch with the
  * stream. Throws on an unknown frame type (so a protocol mismatch fails
@@ -72,13 +71,13 @@ function parseTerminalFrame(body) {
         if (frame.type === 'done' || frame.type === 'error' || frame.type === 'violations') {
             return frame;
         }
-        throw new Error(`pnpr server /v1/resolve stream emitted an unknown frame type: ${String(frame.type)}`);
+        throw new Error(`pnpr server /-/pnpr/v0/resolve stream emitted an unknown frame type: ${String(frame.type)}`);
     }
-    throw new Error('pnpr server /v1/resolve stream ended without a terminal frame');
+    throw new Error('pnpr server /-/pnpr/v0/resolve stream ended without a terminal frame');
 }
 const REQUEST_TIMEOUT = 600_000; // 10 minutes — server-side resolution can be slow on first run
 /**
- * `POST /v1/resolve` and return the full response body, decompressed.
+ * `POST /-/pnpr/v0/resolve` and return the full response body, decompressed.
  *
  * `urlPath` resolution normalizes the base to end with "/" so a path
  * prefix configured on the pnpr server URL (e.g. https://host/pnpr/) is
@@ -86,7 +85,7 @@ const REQUEST_TIMEOUT = 600_000; // 10 minutes — server-side resolution can be
  */
 async function postResolve(registryUrl, body, authorization) {
     const base = registryUrl.endsWith('/') ? registryUrl : `${registryUrl}/`;
-    const url = new URL('v1/resolve', base);
+    const url = new URL('-/pnpr/v0/resolve', base);
     const requestFn = url.protocol === 'https:' ? https.request : http.request;
     const headers = {
         'Content-Type': 'application/json',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/pnpr.client",
-  "version": "1.2.2",
+  "version": "1.3.0",
   "description": "Client for the pnpr server — resolves a project server-side and receives the resolved lockfile",
   "keywords": [
     "pnpm",
@@ -27,11 +27,11 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/lockfile.types": "1100.0.11",
-    "@pnpm/lockfile.fs": "1100.1.6"
+    "@pnpm/lockfile.fs": "1100.1.8",
+    "@pnpm/lockfile.types": "1100.0.13"
   },
   "devDependencies": {
-    "@pnpm/pnpr.client": "1.2.2",
+    "@pnpm/pnpr.client": "1.3.0",
     "@pnpm/types": "1101.3.2"
   },
   "engines": {