@pnpm/pnpr 0.0.0-26052901 → 0.0.0-26060501

package/LICENSE.md

@@ -0,0 +1,91 @@
+# PolyForm Shield License 1.0.0
+
+<https://polyformproject.org/licenses/shield/1.0.0>
+
+Required Notice: Copyright 2026 Zoltan Kochan (https://kochan.io)
+
+## Acceptance
+
+In order to get any license under these terms, you must agree to them as both strict obligations and conditions to all your licenses.
+
+## Copyright License
+
+The licensor grants you a copyright license for the software to do everything you might do with the software that would otherwise infringe the licensor's copyright in it for any permitted purpose.  However, you may only distribute the software according to [Distribution License](#distribution-license) and make changes or new works based on the software according to [Changes and New Works License](#changes-and-new-works-license).
+
+## Distribution License
+
+The licensor grants you an additional copyright license to distribute copies of the software.  Your license to distribute covers distributing the software with changes and new works permitted by [Changes and New Works License](#changes-and-new-works-license).
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from you also gets a copy of these terms or the URL for them above, as well as copies of any plain-text lines beginning with `Required Notice:` that the licensor provided with the software.  For example:
+
+> Required Notice: Copyright Yoyodyne, Inc. (http://example.com)
+
+## Changes and New Works License
+
+The licensor grants you an additional copyright license to make changes and new works based on the software for any permitted purpose.
+
+## Patent License
+
+The licensor grants you a patent license for the software that covers patent claims the licensor can license, or becomes able to license, that you would infringe by using the software.
+
+## Noncompete
+
+Any purpose is a permitted purpose, except for providing any product that competes with the software or any product the licensor or any of its affiliates provides using the software.
+
+## Competition
+
+Goods and services compete even when they provide functionality through different kinds of interfaces or for different technical platforms.  Applications can compete with services, libraries with plugins, frameworks with development tools, and so on, even if they're written in different programming languages or for different computer architectures.  Goods and services compete even when provided free of charge.  If you market a product as a practical substitute for the software or another product, it definitely competes.
+
+## New Products
+
+If you are using the software to provide a product that does not compete, but the licensor or any of its affiliates brings your product into competition by providing a new version of the software or another product using the software, you may continue using versions of the software available under these terms beforehand to provide your competing product, but not any later versions.
+
+## Discontinued Products
+
+You may begin using the software to compete with a product or service that the licensor or any of its affiliates has stopped providing, unless the licensor includes a plain-text line beginning with `Licensor Line of Business:` with the software that mentions that line of business.  For example:
+
+> Licensor Line of Business: YoyodyneCMS Content Management System (http://example.com/cms)
+
+## Sales of Business
+
+If the licensor or any of its affiliates sells a line of business developing the software or using the software to provide a product, the buyer can also enforce [Noncompete](#noncompete) for that product.
+
+## Fair Use
+
+You may have "fair use" rights for the software under the law. These terms do not limit them.
+
+## No Other Rights
+
+These terms do not allow you to sublicense or transfer any of your licenses to anyone else, or prevent the licensor from granting licenses to anyone else.  These terms do not imply any other licenses.
+
+## Patent Defense
+
+If you make any written claim that the software infringes or contributes to infringement of any patent, your patent license for the software granted under these terms ends immediately. If your company makes such a claim, your patent license ends immediately for work on behalf of your company.
+
+## Violations
+
+The first time you are notified in writing that you have violated any of these terms, or done anything with the software not covered by your licenses, your licenses can nonetheless continue if you come into full compliance with these terms, and take practical steps to correct past violations, within 32 days of receiving notice.  Otherwise, all your licenses end immediately.
+
+## No Liability
+
+***As far as the law allows, the software comes as is, without any warranty or condition, and the licensor will not be liable to you for any damages arising out of these terms or the use or nature of the software, under any kind of legal claim.***
+
+## Definitions
+
+The **licensor** is the individual or entity offering these terms, and the **software** is the software the licensor makes available under these terms.
+
+A **product** can be a good or service, or a combination of them.
+
+**You** refers to the individual or entity agreeing to these terms.
+
+**Your company** is any legal entity, sole proprietorship, or other kind of organization that you work for, plus all its affiliates.
+
+**Affiliates** means the other organizations than an organization has control over, is under the control of, or is under common control with.
+
+**Control** means ownership of substantially all the assets of an entity, or the power to direct its management and policies by vote, contract, or otherwise.  Control can be direct or indirect.
+
+**Your licenses** are all the licenses granted to you for the software under these terms.
+
+**Use** means anything you do with the software requiring one of your licenses.

package/README.md

@@ -41,6 +41,7 @@ pnpm config set registry http://127.0.0.1:4873/
 | `-c, --config <path>` | Path to a verdaccio-shaped YAML config. When omitted, the bundled default is used. |
 | `--listen <addr>` | Address to bind to. Defaults to `127.0.0.1:4873`. |
 | `--storage <path>` | Override the storage directory from the loaded config. |
+| `--cache <path>` | Override the disposable proxy-cache directory (the mirror of upstream registries plus the install-accelerator store). Defaults to a `.pnpr-cache` subdirectory of `--storage`. |
 | `--public-url <url>` | URL clients should use to reach the server, used when rewriting `dist.tarball` in served packuments. Defaults to `http://<listen>`. |
 | `--packument-ttl-secs <n>` | Seconds before a cached packument is considered stale and refetched. |
 
@@ -76,3 +77,171 @@ Pass it with `-c`:
 ```sh
 pnpr -c ./pnpr.yaml
 ```
+
+### Storing hosted packages in S3 / Cloudflare R2
+
+`pnpr` keeps two kinds of data:
+
+- **Hosted** — the source of truth: packages published to this server
+  plus anything served in static mode. This lives under `storage`.
+- **Cache** — the disposable mirror of upstream registries plus the
+  install-accelerator store. This lives under `cache` (defaults to
+  `<storage>/.pnpr-cache`).
+
+By default both are local directories. Adding an `s3:` block moves the
+**hosted** store into an S3-compatible object store, so the durable data
+is replicated by the provider and can be shared by several stateless
+`pnpr` replicas. The cache and the install-accelerator databases always
+stay on local disk — only the hosted store is pluggable.
+
+Because any S3-compatible endpoint works, this also covers **Cloudflare
+R2**, **MinIO**, **Backblaze B2**, **Wasabi**, etc. — point `endpoint`
+at the right host.
+
+```yaml
+storage: ./storage   # still backs the local cache + upload staging
+
+s3:
+  bucket: my-pnpr-packages
+  region: auto
+  # Omit `endpoint` for AWS S3. For R2 use the account endpoint:
+  endpoint: https://<account-id>.r2.cloudflarestorage.com
+  # Optional key prefix, so one bucket can hold more than the hosted store:
+  prefix: packages
+  # Credentials. Omit these to fall back to the standard
+  # AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY environment variables.
+  accessKeyId: ${PNPR_S3_ACCESS_KEY_ID}
+  secretAccessKey: ${PNPR_S3_SECRET_ACCESS_KEY}
+```
+
+| Key | Required | Description |
+| --- | --- | --- |
+| `bucket` | yes | Bucket the hosted packages are stored in. |
+| `region` | no | AWS S3 needs a real region (e.g. `us-east-1`); Cloudflare R2 uses `auto`. |
+| `endpoint` | no | Custom endpoint for S3-compatible providers. Omit for AWS S3; for R2 it's `https://<account-id>.r2.cloudflarestorage.com`; for MinIO it's e.g. `http://127.0.0.1:9000`. |
+| `prefix` | no | Key prefix every object is stored under. |
+| `accessKeyId` | no | Access key. Falls back to `AWS_ACCESS_KEY_ID` when unset. |
+| `secretAccessKey` | no | Secret key. Falls back to `AWS_SECRET_ACCESS_KEY` when unset. |
+| `forcePathStyle` | no | Use path-style addressing (`endpoint/bucket/key`) instead of virtual-hosted (`bucket.endpoint/key`). MinIO typically needs `true`; AWS and R2 work with the default. |
+| `allowHttp` | no | Allow plain-HTTP endpoints — needed for a local MinIO over `http://`. Defaults to HTTPS-only. |
+
+Any `${ENV_VAR}` in the config is substituted from the environment
+before parsing, so secrets can be kept out of the file. Keeping the
+credentials in `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` and
+omitting them from the YAML works too.
+
+Run it the same way as any other config:
+
+```sh
+AWS_ACCESS_KEY_ID=… AWS_SECRET_ACCESS_KEY=… pnpr -c ./pnpr.yaml
+```
+
+A complete R2 example, end to end:
+
+```yaml
+# pnpr.yaml
+storage: ./storage
+
+s3:
+  bucket: my-pnpr-packages
+  region: auto
+  endpoint: https://abc123def456.r2.cloudflarestorage.com
+
+uplinks:
+  npmjs:
+    url: https://registry.npmjs.org/
+
+packages:
+  '**':
+    access: $all
+    publish: $authenticated
+    proxy: npmjs
+```
+
+```sh
+export AWS_ACCESS_KEY_ID="<r2-access-key-id>"
+export AWS_SECRET_ACCESS_KEY="<r2-secret-access-key>"
+pnpr -c ./pnpr.yaml --listen 0.0.0.0:4873 --public-url https://registry.example.com
+```
+
+(`--public-url` is what rewrites the `dist.tarball` URLs in served
+packuments, so clients fetch tarballs back through this server rather
+than the upstream.)
+
+A local MinIO over plain HTTP needs `forcePathStyle` and `allowHttp`:
+
+```yaml
+s3:
+  bucket: pnpr
+  region: us-east-1
+  endpoint: http://127.0.0.1:9000
+  forcePathStyle: true
+  allowHttp: true
+  accessKeyId: minioadmin
+  secretAccessKey: minioadmin
+```
+
+### Storing users and tokens in a networked SQLite database
+
+Auth state — the registered users and their bearer tokens — is the other
+piece of per-instance disk state. By default users live in an
+htpasswd file and tokens in a local SQLite database (see `auth:` above),
+so two `pnpr` replicas don't see each other's accounts. Adding a
+`backend:` block moves both into one **networked SQLite** database
+(libsql / [Turso](https://turso.tech)), so several stateless replicas
+share a consistent set of logins and tokens — the auth half of running
+`pnpr` horizontally scaled.
+
+The schema is the same SQLite the local backend uses (the `tokens` table
+is identical; users move from the htpasswd file into a `users` table), so
+a database can be migrated between the two. Token lookups happen on the
+request hot path, so the database should be low-latency from the server.
+
+```yaml
+storage: ./storage
+
+backend:
+  libsql:
+    # libsql/Turso database URL. `libsql://…` for Turso, or
+    # `http://127.0.0.1:8080` for a local `sqld`.
+    url: ${PNPR_LIBSQL_URL}
+    # Bearer token for the database. Omit for an unauthenticated local
+    # `sqld`.
+    authToken: ${PNPR_LIBSQL_TOKEN}
+```
+
+| Key | Required | Description |
+| --- | --- | --- |
+| `url` | yes | Database URL — `libsql://<db>.turso.io` (Turso) or `http://<host>:<port>` (self-hosted `sqld`). |
+| `authToken` | no | Bearer token for the database. Omit for an unauthenticated local `sqld`. |
+| `replicaPath` | no | Path to a local **embedded replica**. When set, reads (token lookups) hit this local file instead of a network round-trip; writes still go to the primary. Absent ⇒ every read is a remote query. |
+| `syncIntervalSecs` | no | How often (seconds) the embedded replica pulls from the primary. Only meaningful with `replicaPath`; bounds how stale a read can be (token-revocation lag). `0` disables background sync. Defaults to `60`. |
+
+Token lookups happen on the request hot path, so for a remote primary
+(e.g. Turso) set `replicaPath` to serve reads from a local replica:
+
+```yaml
+backend:
+  libsql:
+    url: ${PNPR_LIBSQL_URL}
+    authToken: ${PNPR_LIBSQL_TOKEN}
+    replicaPath: ./auth-replica.db
+    syncIntervalSecs: 60
+```
+
+The trade-off is read freshness: an embedded replica reflects another
+replica's writes (a token issued or revoked elsewhere) only after the
+next background sync, so lower `syncIntervalSecs` means less
+revocation lag. Omit `replicaPath` to always read the primary directly.
+
+When the `backend:` block is absent, auth stays on local disk and the
+`auth.htpasswd` / `auth.tokens` settings apply as before. The
+`auth.htpasswd.max_users` registration cap is honored either way.
+
+## License
+
+Source-available under the [PolyForm Shield License 1.0.0](https://github.com/pnpm/pnpm/blob/main/pnpr/LICENSE.md) — **not** open source. You may run, modify, and self-host pnpr for any purpose except providing a product that competes with it. Commercial / non-compete licenses are available from Zoltan Kochan (<https://kochan.io>).
+
+## Trademark notice
+
+pnpr is not affiliated with, endorsed by, or sponsored by npm, Inc., GitHub, or Microsoft. "npm" is a trademark of npm, Inc., used here only to describe compatibility with the npm registry protocol.

package/package.json

@@ -6,7 +6,7 @@
     "npm",
     "registry"
   ],
-  "license": "MIT",
+  "license": "SEE LICENSE IN LICENSE.md",
   "homepage": "https://github.com/pnpm/pnpm/tree/main/pnpr",
   "bugs": "https://github.com/pnpm/pnpm/issues",
   "repository": {
@@ -18,16 +18,17 @@
     "node": ">=18.*"
   },
   "files": [
-    "bin/pnpr"
+    "bin/pnpr",
+    "LICENSE.md"
   ],
-  "version": "0.0.0-26052901",
+  "version": "0.0.0-26060501",
   "optionalDependencies": {
-    "@pnpm/pnpr.win32-x64": "0.0.0-26052901",
-    "@pnpm/pnpr.win32-arm64": "0.0.0-26052901",
-    "@pnpm/pnpr.darwin-x64": "0.0.0-26052901",
-    "@pnpm/pnpr.darwin-arm64": "0.0.0-26052901",
-    "@pnpm/pnpr.linux-x64": "0.0.0-26052901",
-    "@pnpm/pnpr.linux-arm64": "0.0.0-26052901"
+    "@pnpm/pnpr.win32-x64": "0.0.0-26060501",
+    "@pnpm/pnpr.win32-arm64": "0.0.0-26060501",
+    "@pnpm/pnpr.darwin-x64": "0.0.0-26060501",
+    "@pnpm/pnpr.darwin-arm64": "0.0.0-26060501",
+    "@pnpm/pnpr.linux-x64": "0.0.0-26060501",
+    "@pnpm/pnpr.linux-arm64": "0.0.0-26060501"
   },
   "bin": {
     "pnpr": "bin/pnpr"

package/LICENSE

@@ -1,22 +0,0 @@
-The MIT License (MIT)
-
-Copyright (c) 2015-2016 Rico Sta. Cruz and other contributors
-Copyright (c) 2016-2026 Zoltan Kochan and other contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.