@pnpm/registry-access.commands 1000.0.0

package/LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2015-2016 Rico Sta. Cruz and other contributors
+Copyright (c) 2016-2026 Zoltan Kochan and other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,13 @@
+# @pnpm/registry-access.commands
+
+> Commands for managing packages on the registry (deprecate, undeprecate)
+
+## Installation
+
+```sh
+pnpm add @pnpm/registry-access.commands
+```
+
+## License
+
+MIT

package/lib/common.d.ts

@@ -0,0 +1,5 @@
+export declare function rcOptionsTypes(): Record<string, unknown>;
+export declare function parsePackageSpec(spec: string): {
+    name: string;
+    versionRange: string | undefined;
+};

package/lib/common.js

@@ -0,0 +1,24 @@
+import { types as allTypes } from '@pnpm/config.reader';
+import { PnpmError } from '@pnpm/error';
+import npa from '@pnpm/npm-package-arg';
+import { pick } from 'ramda';
+export function rcOptionsTypes() {
+    return pick([
+        'registry',
+    ], allTypes);
+}
+export function parsePackageSpec(spec) {
+    let parsed;
+    try {
+        parsed = npa(spec);
+    }
+    catch {
+        throw new PnpmError('INVALID_PACKAGE_SPEC', `Invalid package spec: ${spec}`);
+    }
+    if (!parsed.name) {
+        throw new PnpmError('INVALID_PACKAGE_SPEC', `Invalid package spec: ${spec}`);
+    }
+    const versionRange = parsed.rawSpec || undefined;
+    return { name: parsed.name, versionRange };
+}
+//# sourceMappingURL=common.js.map

package/lib/deprecation/common.d.ts

@@ -0,0 +1,18 @@
+import { type CreateFetchFromRegistryOptions } from '@pnpm/network.fetch';
+import type { Registries, RegistryConfig } from '@pnpm/types';
+import { parsePackageSpec, rcOptionsTypes } from '../common.js';
+export { parsePackageSpec, rcOptionsTypes };
+export declare function cliOptionsTypes(): Record<string, unknown>;
+export interface DeprecateOptions extends CreateFetchFromRegistryOptions {
+    cliOptions: {
+        otp?: string;
+    };
+    configByUri?: Record<string, RegistryConfig>;
+    registries?: Registries;
+}
+interface UpdateDeprecationOptions {
+    deprecated: string | undefined;
+    packageName: string;
+    versionRange: string | undefined;
+}
+export declare function updateDeprecation(opts: DeprecateOptions, { deprecated, packageName, versionRange }: UpdateDeprecationOptions): Promise<string>;

package/lib/deprecation/common.js

@@ -0,0 +1,76 @@
+import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
+import { PnpmError } from '@pnpm/error';
+import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
+import { createFetchFromRegistry } from '@pnpm/network.fetch';
+import npa from '@pnpm/npm-package-arg';
+import semver from 'semver';
+import { parsePackageSpec, rcOptionsTypes } from '../common.js';
+export { parsePackageSpec, rcOptionsTypes };
+export function cliOptionsTypes() {
+    return {
+        ...rcOptionsTypes(),
+        otp: String,
+    };
+}
+export async function updateDeprecation(opts, { deprecated, packageName, versionRange }) {
+    const registryUrl = pickRegistryForPackage(opts.registries ?? { default: 'https://registry.npmjs.org/' }, packageName);
+    const getAuthHeader = createGetAuthHeaderByURI(opts.configByUri ?? {}, registryUrl);
+    const authHeader = getAuthHeader(registryUrl);
+    const packageUrl = new URL(npa(packageName).escapedName, registryUrl).href;
+    const fetchFromRegistry = createFetchFromRegistry(opts);
+    const getResponse = await fetchFromRegistry(packageUrl, {
+        authHeaderValue: authHeader,
+        fullMetadata: true,
+    });
+    if (!getResponse.ok) {
+        if (getResponse.status === 404) {
+            throw new PnpmError('PACKAGE_NOT_FOUND', `Package "${packageName}" not found in registry`);
+        }
+        throw new PnpmError('REGISTRY_ERROR', `Failed to fetch package info: ${getResponse.status} ${getResponse.statusText}`);
+    }
+    const pkg = await getResponse.json();
+    if (!pkg.versions || Object.keys(pkg.versions).length === 0) {
+        throw new PnpmError('NO_VERSIONS', `Package "${packageName}" has no versions`);
+    }
+    const versionsToUpdate = versionRange
+        ? getVersionsMatchingRange(pkg.versions, versionRange)
+        : Object.keys(pkg.versions);
+    if (versionsToUpdate.length === 0) {
+        throw new PnpmError('NO_MATCHING_VERSIONS', `No versions match "${versionRange}"`);
+    }
+    if (deprecated == null) {
+        const deprecatedVersions = versionsToUpdate.filter((ver) => pkg.versions[ver].deprecated);
+        if (deprecatedVersions.length === 0) {
+            throw new PnpmError('NOT_DEPRECATED', `No deprecated versions found in "${packageName}"${versionRange ? ` matching "${versionRange}"` : ''}`);
+        }
+    }
+    for (const ver of versionsToUpdate) {
+        pkg.versions[ver].deprecated = deprecated ?? '';
+    }
+    const otp = opts.cliOptions?.otp;
+    const putResponse = await fetchFromRegistry(packageUrl, {
+        authHeaderValue: authHeader,
+        method: 'PUT',
+        headers: {
+            'content-type': 'application/json',
+            ...(otp ? { 'npm-otp': otp } : {}),
+        },
+        body: JSON.stringify(pkg),
+    });
+    if (!putResponse.ok) {
+        const verb = deprecated != null ? 'deprecate' : 'undeprecate';
+        const errorBody = await putResponse.text();
+        if (putResponse.status === 401) {
+            throw new PnpmError('UNAUTHORIZED', `You must be logged in to ${verb} packages. ${errorBody}`);
+        }
+        if (putResponse.status === 403) {
+            throw new PnpmError('FORBIDDEN', `You do not have permission to ${verb} this package. ${errorBody}`);
+        }
+        throw new PnpmError('REGISTRY_ERROR', `Failed to ${verb} package: ${putResponse.status} ${putResponse.statusText}. ${errorBody}`);
+    }
+    return `Successfully ${deprecated != null ? 'deprecated' : 'un-deprecated'} ${versionsToUpdate.length} version(s) of ${packageName}`;
+}
+function getVersionsMatchingRange(versions, range) {
+    return Object.keys(versions).filter((v) => semver.satisfies(v, range));
+}
+//# sourceMappingURL=common.js.map

package/lib/deprecation/deprecate.d.ts

@@ -0,0 +1,5 @@
+import { cliOptionsTypes, type DeprecateOptions, rcOptionsTypes } from './common.js';
+export { cliOptionsTypes, rcOptionsTypes };
+export declare const commandNames: string[];
+export declare function help(): string;
+export declare function handler(opts: DeprecateOptions, params: string[]): Promise<string>;

package/lib/deprecation/deprecate.js

@@ -0,0 +1,43 @@
+import { docsUrl } from '@pnpm/cli.utils';
+import { PnpmError } from '@pnpm/error';
+import { renderHelp } from 'render-help';
+import { cliOptionsTypes, parsePackageSpec, rcOptionsTypes, updateDeprecation } from './common.js';
+export { cliOptionsTypes, rcOptionsTypes };
+export const commandNames = ['deprecate'];
+export function help() {
+    return renderHelp({
+        description: 'Deprecates a version of a package in the registry.',
+        descriptionLists: [
+            {
+                title: 'Options',
+                list: [
+                    {
+                        description: 'The base URL of the npm registry.',
+                        name: '--registry <url>',
+                    },
+                    {
+                        description: 'When publishing packages that require two-factor authentication, this option can specify a one-time password.',
+                        name: '--otp',
+                    },
+                ],
+            },
+        ],
+        url: docsUrl('deprecate'),
+        usages: [
+            'pnpm deprecate <package>[@<version>] <message>',
+        ],
+    });
+}
+export async function handler(opts, params) {
+    if (params.length === 0) {
+        throw new PnpmError('DEPRECATE_REQUIRED', 'Package name is required');
+    }
+    const packageSpec = params[0];
+    const deprecated = params.slice(1).join(' ');
+    if (deprecated === '') {
+        throw new PnpmError('DEPRECATE_MESSAGE_REQUIRED', 'Deprecation message is required. To un-deprecate, use the undeprecate command.');
+    }
+    const { name, versionRange } = parsePackageSpec(packageSpec);
+    return updateDeprecation(opts, { deprecated, packageName: name, versionRange });
+}
+//# sourceMappingURL=deprecate.js.map

package/lib/deprecation/undeprecate.d.ts

@@ -0,0 +1,5 @@
+import { cliOptionsTypes, type DeprecateOptions, rcOptionsTypes } from './common.js';
+export { cliOptionsTypes, rcOptionsTypes };
+export declare const commandNames: string[];
+export declare function help(): string;
+export declare function handler(opts: DeprecateOptions, params: string[]): Promise<string>;

package/lib/deprecation/undeprecate.js

@@ -0,0 +1,41 @@
+import { docsUrl } from '@pnpm/cli.utils';
+import { PnpmError } from '@pnpm/error';
+import { renderHelp } from 'render-help';
+import { cliOptionsTypes, parsePackageSpec, rcOptionsTypes, updateDeprecation } from './common.js';
+export { cliOptionsTypes, rcOptionsTypes };
+export const commandNames = ['undeprecate'];
+export function help() {
+    return renderHelp({
+        description: 'Removes deprecation from a version of a package in the registry. Only works on already deprecated versions.',
+        descriptionLists: [
+            {
+                title: 'Options',
+                list: [
+                    {
+                        description: 'The base URL of the npm registry.',
+                        name: '--registry <url>',
+                    },
+                    {
+                        description: 'When publishing packages that require two-factor authentication, this option can specify a one-time password.',
+                        name: '--otp',
+                    },
+                ],
+            },
+        ],
+        url: docsUrl('undeprecate'),
+        usages: [
+            'pnpm undeprecate <package>[@<version>]',
+        ],
+    });
+}
+export async function handler(opts, params) {
+    if (params.length === 0) {
+        throw new PnpmError('UNDEPRECATE_REQUIRED', 'Package name is required');
+    }
+    if (params.length > 1) {
+        throw new PnpmError('UNDEPRECATE_NO_MESSAGE', 'The undeprecate command does not accept a message.');
+    }
+    const { name, versionRange } = parsePackageSpec(params[0]);
+    return updateDeprecation(opts, { deprecated: undefined, packageName: name, versionRange });
+}
+//# sourceMappingURL=undeprecate.js.map

package/lib/distTag.d.ts

@@ -0,0 +1,15 @@
+import { type CreateFetchFromRegistryOptions } from '@pnpm/network.fetch';
+import type { Registries, RegistryConfig } from '@pnpm/types';
+import { rcOptionsTypes } from './common.js';
+export { rcOptionsTypes };
+export declare function cliOptionsTypes(): Record<string, unknown>;
+export declare const commandNames: string[];
+export declare function help(): string;
+export interface DistTagOptions extends CreateFetchFromRegistryOptions {
+    cliOptions: {
+        otp?: string;
+    };
+    configByUri?: Record<string, RegistryConfig>;
+    registries?: Registries;
+}
+export declare function handler(opts: DistTagOptions, params: string[]): Promise<string>;

package/lib/distTag.js

@@ -0,0 +1,184 @@
+import { docsUrl } from '@pnpm/cli.utils';
+import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
+import { PnpmError } from '@pnpm/error';
+import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
+import { createFetchFromRegistry } from '@pnpm/network.fetch';
+import npa from '@pnpm/npm-package-arg';
+import { renderHelp } from 'render-help';
+import semver from 'semver';
+import { parsePackageSpec, rcOptionsTypes } from './common.js';
+export { rcOptionsTypes };
+export function cliOptionsTypes() {
+    return {
+        ...rcOptionsTypes(),
+        otp: String,
+    };
+}
+export const commandNames = ['dist-tag', 'dist-tags'];
+export function help() {
+    return renderHelp({
+        description: 'Manages distribution tags for a package.',
+        descriptionLists: [
+            {
+                title: 'Commands',
+                list: [
+                    {
+                        description: 'List all dist-tags for a package. Default if no subcommand is given.',
+                        name: 'ls',
+                    },
+                    {
+                        description: 'Add a dist-tag to a specific version of a package.',
+                        name: 'add',
+                    },
+                    {
+                        description: 'Remove a dist-tag from a package.',
+                        name: 'rm',
+                    },
+                ],
+            },
+            {
+                title: 'Options',
+                list: [
+                    {
+                        description: 'The base URL of the npm registry.',
+                        name: '--registry <url>',
+                    },
+                    {
+                        description: 'When publishing packages that require two-factor authentication, this option can specify a one-time password.',
+                        name: '--otp',
+                    },
+                ],
+            },
+        ],
+        url: docsUrl('dist-tag'),
+        usages: [
+            'pnpm dist-tag ls [<package>]',
+            'pnpm dist-tag add <package>@<version> [<tag>]',
+            'pnpm dist-tag rm <package> <tag>',
+        ],
+    });
+}
+export async function handler(opts, params) {
+    const subcommand = params[0];
+    if (subcommand === 'add') {
+        return distTagAdd(opts, params.slice(1));
+    }
+    if (subcommand === 'rm') {
+        return distTagRm(opts, params.slice(1));
+    }
+    if (subcommand === 'ls' || subcommand === 'list') {
+        return distTagLs(opts, params.slice(1));
+    }
+    // Default: treat all params as arguments to ls
+    return distTagLs(opts, params);
+}
+async function distTagLs(opts, params) {
+    if (params.length === 0) {
+        throw new PnpmError('DIST_TAG_LS_PACKAGE_REQUIRED', 'Package name is required');
+    }
+    const packageName = params[0];
+    const registryUrl = pickRegistryForPackage(opts.registries ?? { default: 'https://registry.npmjs.org/' }, packageName);
+    const authHeader = getAuthHeaderForRegistry(opts.configByUri, registryUrl);
+    const fetchFromRegistry = createFetchFromRegistry(opts);
+    const distTags = await fetchDistTags(packageName, registryUrl, fetchFromRegistry, authHeader);
+    const lines = [];
+    for (const [tag, version] of Object.entries(distTags).sort(([a], [b]) => a.localeCompare(b))) {
+        lines.push(`${tag}: ${version}`);
+    }
+    return lines.join('\n');
+}
+async function distTagAdd(opts, params) {
+    if (params.length === 0) {
+        throw new PnpmError('DIST_TAG_ADD_SPEC_REQUIRED', 'Package name and version are required (e.g., pnpm dist-tag add pkg@1.0.0 latest)');
+    }
+    const { name: packageName, versionRange: version } = parsePackageSpec(params[0]);
+    if (!version) {
+        throw new PnpmError('DIST_TAG_ADD_VERSION_REQUIRED', 'Version is required (e.g., pnpm dist-tag add pkg@1.0.0 latest)');
+    }
+    if (!semver.valid(version)) {
+        throw new PnpmError('DIST_TAG_ADD_INVALID_VERSION', `Version must be an exact semver version, got "${version}"`);
+    }
+    const tag = params[1] ?? 'latest';
+    const registryUrl = pickRegistryForPackage(opts.registries ?? { default: 'https://registry.npmjs.org/' }, packageName);
+    const authHeader = getAuthHeaderForRegistry(opts.configByUri, registryUrl);
+    const fetchFromRegistry = createFetchFromRegistry(opts);
+    const otp = opts.cliOptions?.otp;
+    const distTagUrl = getDistTagUrl(packageName, registryUrl, tag);
+    const response = await fetchFromRegistry(distTagUrl, {
+        authHeaderValue: authHeader,
+        method: 'PUT',
+        headers: {
+            'content-type': 'application/json',
+            ...(otp ? { 'npm-otp': otp } : {}),
+        },
+        body: JSON.stringify(version),
+    });
+    if (!response.ok) {
+        await throwRegistryError(response, `set dist-tag "${tag}" on`);
+    }
+    return `+${tag}: ${packageName}@${version}`;
+}
+async function distTagRm(opts, params) {
+    if (params.length < 2) {
+        throw new PnpmError('DIST_TAG_RM_ARGS_REQUIRED', 'Package name and tag are required (e.g., pnpm dist-tag rm pkg tag)');
+    }
+    const packageName = params[0];
+    const tag = params[1];
+    if (tag === 'latest') {
+        throw new PnpmError('DIST_TAG_RM_LATEST', 'Removing the "latest" dist-tag is not allowed');
+    }
+    const registryUrl = pickRegistryForPackage(opts.registries ?? { default: 'https://registry.npmjs.org/' }, packageName);
+    const authHeader = getAuthHeaderForRegistry(opts.configByUri, registryUrl);
+    const fetchFromRegistry = createFetchFromRegistry(opts);
+    const otp = opts.cliOptions?.otp;
+    // First check the tag exists
+    const distTags = await fetchDistTags(packageName, registryUrl, fetchFromRegistry, authHeader);
+    if (!(tag in distTags)) {
+        throw new PnpmError('DIST_TAG_NOT_FOUND', `dist-tag "${tag}" is not set on package "${packageName}"`);
+    }
+    const distTagUrl = getDistTagUrl(packageName, registryUrl, tag);
+    const response = await fetchFromRegistry(distTagUrl, {
+        authHeaderValue: authHeader,
+        method: 'DELETE',
+        headers: {
+            ...(otp ? { 'npm-otp': otp } : {}),
+        },
+    });
+    if (!response.ok) {
+        await throwRegistryError(response, `remove dist-tag "${tag}" from`);
+    }
+    return `-${tag}: ${packageName}@${distTags[tag]}`;
+}
+function getAuthHeaderForRegistry(configByUri, registryUrl) {
+    const getAuthHeader = createGetAuthHeaderByURI(configByUri ?? {}, registryUrl);
+    return getAuthHeader(registryUrl);
+}
+function getDistTagUrl(packageName, registryUrl, tag) {
+    const encodedName = npa(packageName).escapedName;
+    return new URL(`-/package/${encodedName}/dist-tags/${encodeURIComponent(tag)}`, registryUrl).href;
+}
+async function fetchDistTags(packageName, registryUrl, fetchFromRegistry, authHeader) {
+    const encodedName = npa(packageName).escapedName;
+    const distTagsUrl = new URL(`-/package/${encodedName}/dist-tags`, registryUrl).href;
+    const response = await fetchFromRegistry(distTagsUrl, {
+        authHeaderValue: authHeader,
+    });
+    if (!response.ok) {
+        if (response.status === 404) {
+            throw new PnpmError('PACKAGE_NOT_FOUND', `Package "${packageName}" not found in registry`);
+        }
+        throw new PnpmError('REGISTRY_ERROR', `Failed to fetch package info: ${response.status} ${response.statusText}`);
+    }
+    return await response.json();
+}
+async function throwRegistryError(response, action) {
+    const errorBody = await response.text();
+    if (response.status === 401) {
+        throw new PnpmError('UNAUTHORIZED', `You must be logged in to ${action} packages. ${errorBody}`);
+    }
+    if (response.status === 403) {
+        throw new PnpmError('FORBIDDEN', `You do not have permission to ${action} this package. ${errorBody}`);
+    }
+    throw new PnpmError('REGISTRY_ERROR', `Failed to ${action} package: ${response.status} ${response.statusText}. ${errorBody}`);
+}
+//# sourceMappingURL=distTag.js.map

package/lib/index.d.ts

@@ -0,0 +1,5 @@
+import * as deprecate from './deprecation/deprecate.js';
+import * as undeprecate from './deprecation/undeprecate.js';
+import * as distTag from './distTag.js';
+import * as unpublish from './unpublish.js';
+export { deprecate, distTag, undeprecate, unpublish };

package/lib/index.js

@@ -0,0 +1,6 @@
+import * as deprecate from './deprecation/deprecate.js';
+import * as undeprecate from './deprecation/undeprecate.js';
+import * as distTag from './distTag.js';
+import * as unpublish from './unpublish.js';
+export { deprecate, distTag, undeprecate, unpublish };
+//# sourceMappingURL=index.js.map

package/lib/unpublish.d.ts

@@ -0,0 +1,16 @@
+import { type CreateFetchFromRegistryOptions } from '@pnpm/network.fetch';
+import type { Registries, RegistryConfig } from '@pnpm/types';
+import { rcOptionsTypes } from './common.js';
+export { rcOptionsTypes };
+export declare function cliOptionsTypes(): Record<string, unknown>;
+export declare const commandNames: string[];
+export declare function help(): string;
+export interface UnpublishOptions extends CreateFetchFromRegistryOptions {
+    cliOptions: {
+        force?: boolean;
+        otp?: string;
+    };
+    configByUri?: Record<string, RegistryConfig>;
+    registries?: Registries;
+}
+export declare function handler(opts: UnpublishOptions, params: string[]): Promise<string>;

package/lib/unpublish.js

@@ -0,0 +1,204 @@
+import { docsUrl } from '@pnpm/cli.utils';
+import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
+import { PnpmError } from '@pnpm/error';
+import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
+import { createFetchFromRegistry } from '@pnpm/network.fetch';
+import npa from '@pnpm/npm-package-arg';
+import { renderHelp } from 'render-help';
+import semver from 'semver';
+import { parsePackageSpec, rcOptionsTypes } from './common.js';
+export { rcOptionsTypes };
+export function cliOptionsTypes() {
+    return {
+        ...rcOptionsTypes(),
+        force: Boolean,
+        otp: String,
+    };
+}
+export const commandNames = ['unpublish'];
+export function help() {
+    return renderHelp({
+        description: 'Removes a package from the registry.',
+        descriptionLists: [
+            {
+                title: 'Options',
+                list: [
+                    {
+                        description: 'The base URL of the npm registry.',
+                        name: '--registry <url>',
+                    },
+                    {
+                        description: 'When publishing packages that require two-factor authentication, this option can specify a one-time password.',
+                        name: '--otp',
+                    },
+                    {
+                        description: 'Removes the package from the registry regardless of what version is currently published. Without this flag, pnpm will refuse to unpublish an entire package.',
+                        name: '--force',
+                    },
+                ],
+            },
+        ],
+        url: docsUrl('unpublish'),
+        usages: [
+            'pnpm unpublish [<package>[@<version>]]',
+        ],
+    });
+}
+export async function handler(opts, params) {
+    if (params.length === 0) {
+        throw new PnpmError('UNPUBLISH_REQUIRED', 'Package name is required');
+    }
+    const packageSpec = params[0];
+    const { name, versionRange } = parsePackageSpec(packageSpec);
+    return unpublishPackage(name, versionRange, opts);
+}
+async function unpublishPackage(packageName, versionRange, opts) {
+    const registryUrl = pickRegistryForPackage(opts.registries ?? { default: 'https://registry.npmjs.org/' }, packageName);
+    const getAuthHeader = createGetAuthHeaderByURI(opts.configByUri ?? {}, registryUrl);
+    const authHeader = getAuthHeader(registryUrl);
+    const packageUrl = new URL(npa(packageName).escapedName, registryUrl).href;
+    const fetchFromRegistry = createFetchFromRegistry(opts);
+    const pkg = await fetchPackument(packageUrl, fetchFromRegistry, authHeader);
+    const allVersions = pkg.versions;
+    if (!allVersions || Object.keys(allVersions).length === 0) {
+        throw new PnpmError('NO_VERSIONS', `Package "${packageName}" has no versions`);
+    }
+    const otp = opts.cliOptions?.otp;
+    if (!versionRange) {
+        return unpublishAll(packageUrl, pkg, fetchFromRegistry, authHeader, otp, opts.cliOptions);
+    }
+    const versionsToUnpublish = getVersionsMatchingRange(allVersions, versionRange);
+    if (versionsToUnpublish.length === 0) {
+        throw new PnpmError('NO_MATCHING_VERSIONS', `No versions match "${versionRange}"`);
+    }
+    // If removing all matched versions leaves none, treat as full unpublish
+    if (versionsToUnpublish.length === Object.keys(allVersions).length) {
+        return unpublishAll(packageUrl, pkg, fetchFromRegistry, authHeader, otp, opts.cliOptions);
+    }
+    return unpublishVersions(packageUrl, registryUrl, pkg, versionsToUnpublish, fetchFromRegistry, authHeader, otp);
+}
+async function fetchPackument(packageUrl, fetchFromRegistry, authHeader) {
+    const response = await fetchFromRegistry(packageUrl, {
+        authHeaderValue: authHeader,
+        fullMetadata: true,
+    });
+    if (!response.ok) {
+        if (response.status === 404) {
+            const url = new URL(packageUrl);
+            const packageName = decodeURIComponent(url.pathname.split('/').pop());
+            throw new PnpmError('PACKAGE_NOT_FOUND', `Package "${packageName}" not found in registry`);
+        }
+        throw new PnpmError('REGISTRY_ERROR', `Failed to fetch package info: ${response.status} ${response.statusText}`);
+    }
+    return await response.json();
+}
+async function unpublishVersions(packageUrl, registryUrl, pkg, versions, fetchFromRegistry, authHeader, otp) {
+    // Collect tarball URLs before mutating
+    const tarballs = [];
+    for (const version of versions) {
+        const versionData = pkg.versions[version];
+        if (versionData?.dist?.tarball) {
+            tarballs.push(versionData.dist.tarball);
+        }
+        delete pkg.versions[version];
+    }
+    // Update dist-tags: remove any tag pointing to removed versions
+    const removedSet = new Set(versions);
+    const latestVer = pkg['dist-tags'].latest;
+    for (const tag of Object.keys(pkg['dist-tags'])) {
+        if (removedSet.has(pkg['dist-tags'][tag])) {
+            delete pkg['dist-tags'][tag];
+        }
+    }
+    // If we removed 'latest', reassign it to the highest remaining version
+    if (latestVer && removedSet.has(latestVer)) {
+        const remaining = Object.keys(pkg.versions).sort(semver.compareLoose);
+        if (remaining.length > 0) {
+            pkg['dist-tags'].latest = remaining[remaining.length - 1];
+        }
+    }
+    // Clean up internal metadata
+    delete pkg._revisions;
+    delete pkg._attachments;
+    // PUT updated packument
+    const putResponse = await fetchFromRegistry(`${packageUrl}/-rev/${pkg._rev}`, {
+        authHeaderValue: authHeader,
+        method: 'PUT',
+        headers: {
+            'content-type': 'application/json',
+            ...(otp ? { 'npm-otp': otp } : {}),
+        },
+        body: JSON.stringify(pkg),
+    });
+    if (!putResponse.ok) {
+        await throwRegistryError(putResponse, 'unpublish');
+    }
+    // Delete each tarball
+    const registryOrigin = new URL(registryUrl).origin;
+    /* eslint-disable no-await-in-loop */
+    for (const tarball of tarballs) {
+        const updated = await fetchPackument(packageUrl, fetchFromRegistry, authHeader);
+        const tarballPathname = getTarballPathname(tarball, registryUrl);
+        const deleteResponse = await fetchFromRegistry(`${registryOrigin}/${tarballPathname}/-rev/${updated._rev}`, {
+            authHeaderValue: authHeader,
+            method: 'DELETE',
+            headers: {
+                ...(otp ? { 'npm-otp': otp } : {}),
+            },
+        });
+        // Some registries handle tarball cleanup automatically on packument update,
+        // so treat 404 as success.
+        if (!deleteResponse.ok && deleteResponse.status !== 404) {
+            await throwRegistryError(deleteResponse, 'unpublish');
+        }
+    }
+    /* eslint-enable no-await-in-loop */
+    return `Successfully unpublished ${versions.length} version(s) of ${pkg.name}`;
+}
+async function unpublishAll(packageUrl, pkg, fetchFromRegistry, authHeader, otp, cliOptions) {
+    const packageName = pkg.name;
+    const versionCount = Object.keys(pkg.versions).length;
+    const force = cliOptions?.force ?? false;
+    if (!force) {
+        const versionsList = Object.keys(pkg.versions).join(', ');
+        throw new PnpmError('UNPUBLISH_CONFIRM', `Run pnpm unpublish --force to remove all published versions of ${packageName} (${versionsList}) from the registry.
+This is a protection mechanism to prevent accidental unpublish of packages with many versions.
+If you want to unpublish a specific version, run pnpm unpublish ${packageName}@<version>`);
+    }
+    const deleteResponse = await fetchFromRegistry(`${packageUrl}/-rev/${pkg._rev}`, {
+        authHeaderValue: authHeader,
+        method: 'DELETE',
+        headers: {
+            ...(otp ? { 'npm-otp': otp } : {}),
+        },
+    });
+    if (!deleteResponse.ok) {
+        if (deleteResponse.status === 405) {
+            throw new PnpmError('UNPUBLISH_FORBIDDEN', 'This package cannot be completely unpublished. Deprecate it instead or contact npm support.');
+        }
+        await throwRegistryError(deleteResponse, 'unpublish');
+    }
+    return `Successfully unpublished all ${versionCount} version(s) of ${packageName}`;
+}
+async function throwRegistryError(response, verb) {
+    if (response.status === 401) {
+        throw new PnpmError('UNAUTHORIZED', `You must be logged in to ${verb} packages`);
+    }
+    if (response.status === 403) {
+        throw new PnpmError('FORBIDDEN', `You do not have permission to ${verb} this package`);
+    }
+    const errorBody = await response.text();
+    throw new PnpmError('REGISTRY_ERROR', `Failed to ${verb} package: ${response.status} ${response.statusText}. ${errorBody}`);
+}
+function getTarballPathname(tarballUrl, registryUrl) {
+    const registryPath = new URL(registryUrl).pathname.slice(1);
+    let tarballPath = new URL(tarballUrl).pathname.slice(1);
+    if (registryPath && tarballPath.startsWith(registryPath)) {
+        tarballPath = tarballPath.slice(registryPath.length);
+    }
+    return tarballPath;
+}
+function getVersionsMatchingRange(versions, range) {
+    return Object.keys(versions).filter((v) => semver.satisfies(v, range));
+}
+//# sourceMappingURL=unpublish.js.map

package/package.json

@@ -0,0 +1,64 @@
+{
+  "name": "@pnpm/registry-access.commands",
+  "version": "1000.0.0",
+  "description": "Commands for managing packages on the registry",
+  "keywords": [
+    "pnpm",
+    "pnpm11"
+  ],
+  "license": "MIT",
+  "funding": "https://opencollective.com/pnpm",
+  "repository": "https://github.com/pnpm/pnpm/tree/main/registry-access/commands",
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/registry-access/commands#readme",
+  "bugs": {
+    "url": "https://github.com/pnpm/pnpm/issues"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": "./lib/index.js"
+  },
+  "files": [
+    "lib",
+    "!*.map"
+  ],
+  "dependencies": {
+    "@pnpm/npm-package-arg": "^2.0.0",
+    "ramda": "npm:@pnpm/ramda@0.28.1",
+    "render-help": "^2.0.0",
+    "semver": "^7.7.2",
+    "@pnpm/cli.utils": "1001.2.8",
+    "@pnpm/config.reader": "1004.4.2",
+    "@pnpm/error": "1000.0.5",
+    "@pnpm/network.fetch": "1000.2.6",
+    "@pnpm/network.auth-header": "1000.0.6",
+    "@pnpm/config.pick-registry-for-package": "1000.0.11",
+    "@pnpm/resolving.registry.types": "1000.0.1",
+    "@pnpm/types": "1000.9.0"
+  },
+  "devDependencies": {
+    "@jest/globals": "30.3.0",
+    "@pnpm/registry-mock": "6.0.0-6",
+    "@types/ramda": "0.31.1",
+    "@types/semver": "7.7.1",
+    "execa": "npm:safe-execa@0.3.0",
+    "@pnpm/registry-access.commands": "1000.0.0",
+    "@pnpm/testing.command-defaults": "0.0.0",
+    "@pnpm/releasing.commands": "1000.0.0",
+    "@pnpm/prepare": "1000.0.4"
+  },
+  "engines": {
+    "node": ">=22.13"
+  },
+  "jest": {
+    "preset": "@pnpm/jest-config/with-registry"
+  },
+  "scripts": {
+    "start": "tsgo --watch",
+    "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",
+    "test": "pn compile && pn .test",
+    "compile": "tsgo --build && pn lint --fix",
+    ".test": "cross-env NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest"
+  }
+}