@pnpm/registry-access.commands 1100.2.15 → 1100.3.0

package/lib/deprecation/common.js

@@ -14,7 +14,7 @@ export function cliOptionsTypes() {
 }
 export async function updateDeprecation(opts, { deprecated, packageName, versionRange }) {
     const registryUrl = pickRegistryForPackage(opts.registries ?? { default: 'https://registry.npmjs.org/' }, packageName);
-    const getAuthHeader = createGetAuthHeaderByURI(opts.configByUri ?? {}, registryUrl);
+    const getAuthHeader = createGetAuthHeaderByURI(opts.configByUri ?? {});
     const authHeader = getAuthHeader(registryUrl);
     const packageUrl = new URL(npa(packageName).escapedName, registryUrl).href;
     const fetchFromRegistry = createFetchFromRegistry(opts);

package/lib/distTag.js

@@ -1,9 +1,14 @@
+import readline from 'node:readline';
+import { input } from '@inquirer/prompts';
 import { docsUrl } from '@pnpm/cli.utils';
 import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
 import { PnpmError } from '@pnpm/error';
+import { globalInfo, globalWarn } from '@pnpm/logger';
 import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
 import { createFetchFromRegistry } from '@pnpm/network.fetch';
+import { SyntheticOtpError, withOtpHandling, } from '@pnpm/network.web-auth';
 import npa from '@pnpm/npm-package-arg';
+import { setDistTag } from '@pnpm/registry-access.client';
 import { renderHelp } from 'render-help';
 import semver from 'semver';
 import { parsePackageSpec, rcOptionsTypes } from './common.js';
@@ -102,20 +107,22 @@ async function distTagAdd(opts, params) {
     const registryUrl = pickRegistryForPackage(opts.registries ?? { default: 'https://registry.npmjs.org/' }, packageName);
     const authHeader = getAuthHeaderForRegistry(opts.configByUri, registryUrl);
     const fetchFromRegistry = createFetchFromRegistry(opts);
-    const otp = opts.cliOptions?.otp;
-    const distTagUrl = getDistTagUrl(packageName, registryUrl, tag);
-    const response = await fetchFromRegistry(distTagUrl, {
-        authHeaderValue: authHeader,
-        method: 'PUT',
-        headers: {
-            'content-type': 'application/json',
-            ...(otp ? { 'npm-otp': otp } : {}),
-        },
-        body: JSON.stringify(version),
+    const cliOtp = opts.cliOptions?.otp;
+    const authType = cliOtp ? 'legacy' : 'web';
+    await withOtpHandling({
+        context: createOtpContext(opts),
+        fetchOptions: WEB_AUTH_FETCH_OPTIONS,
+        operation: (otp) => setDistTag({
+            packageName,
+            version,
+            distTag: tag,
+            registryUrl,
+            authHeader,
+            authType,
+            fetchFromRegistry,
+            otp: otp ?? cliOtp,
+        }),
     });
-    if (!response.ok) {
-        await throwRegistryError(response, `set dist-tag "${tag}" on`);
-    }
     return `+${tag}: ${packageName}@${version}`;
 }
 async function distTagRm(opts, params) {
@@ -130,27 +137,70 @@ async function distTagRm(opts, params) {
     const registryUrl = pickRegistryForPackage(opts.registries ?? { default: 'https://registry.npmjs.org/' }, packageName);
     const authHeader = getAuthHeaderForRegistry(opts.configByUri, registryUrl);
     const fetchFromRegistry = createFetchFromRegistry(opts);
-    const otp = opts.cliOptions?.otp;
+    const cliOtp = opts.cliOptions?.otp;
     // First check the tag exists
     const distTags = await fetchDistTags(packageName, registryUrl, fetchFromRegistry, authHeader);
     if (!(tag in distTags)) {
         throw new PnpmError('DIST_TAG_NOT_FOUND', `dist-tag "${tag}" is not set on package "${packageName}"`);
     }
     const distTagUrl = getDistTagUrl(packageName, registryUrl, tag);
+    const authType = cliOtp ? 'legacy' : 'web';
+    await withOtpHandling({
+        context: createOtpContext(opts),
+        fetchOptions: WEB_AUTH_FETCH_OPTIONS,
+        operation: (otp) => deleteDistTag({
+            authHeader,
+            authType,
+            distTagUrl,
+            fetchFromRegistry,
+            otp: otp ?? cliOtp,
+            tag,
+        }),
+    });
+    return `-${tag}: ${packageName}@${distTags[tag]}`;
+}
+async function deleteDistTag({ authHeader, authType, distTagUrl, fetchFromRegistry, otp, tag, }) {
     const response = await fetchFromRegistry(distTagUrl, {
         authHeaderValue: authHeader,
         method: 'DELETE',
         headers: {
+            'npm-auth-type': authType,
             ...(otp ? { 'npm-otp': otp } : {}),
         },
     });
-    if (!response.ok) {
-        await throwRegistryError(response, `remove dist-tag "${tag}" from`);
+    if (response.ok)
+        return;
+    const body = await response.text();
+    const action = `remove dist-tag "${tag}" from`;
+    if (response.status === 401) {
+        throw parseAuthError(body, action);
     }
-    return `-${tag}: ${packageName}@${distTags[tag]}`;
+    if (response.status === 403) {
+        throw new PnpmError('FORBIDDEN', `You do not have permission to ${action} this package. ${body}`);
+    }
+    throw new PnpmError('REGISTRY_ERROR', `Failed to ${action} package: ${response.status} ${response.statusText}. ${body}`);
+}
+function parseAuthError(body, action) {
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        parsed = undefined;
+    }
+    if (parsed != null && typeof parsed === 'object' && 'authUrl' in parsed && 'doneUrl' in parsed) {
+        return new SyntheticOtpError({
+            authUrl: typeof parsed.authUrl === 'string' ? parsed.authUrl : undefined,
+            doneUrl: typeof parsed.doneUrl === 'string' ? parsed.doneUrl : undefined,
+        });
+    }
+    if (/one-time pass/i.test(body)) {
+        return new SyntheticOtpError(undefined);
+    }
+    return new PnpmError('UNAUTHORIZED', `You must be logged in to ${action} packages. ${body}`);
 }
 function getAuthHeaderForRegistry(configByUri, registryUrl) {
-    const getAuthHeader = createGetAuthHeaderByURI(configByUri ?? {}, registryUrl);
+    const getAuthHeader = createGetAuthHeaderByURI(configByUri ?? {});
     return getAuthHeader(registryUrl);
 }
 function getDistTagUrl(packageName, registryUrl, tag) {
@@ -171,14 +221,22 @@ async function fetchDistTags(packageName, registryUrl, fetchFromRegistry, authHe
     }
     return await response.json();
 }
-async function throwRegistryError(response, action) {
-    const errorBody = await response.text();
-    if (response.status === 401) {
-        throw new PnpmError('UNAUTHORIZED', `You must be logged in to ${action} packages. ${errorBody}`);
-    }
-    if (response.status === 403) {
-        throw new PnpmError('FORBIDDEN', `You do not have permission to ${action} this package. ${errorBody}`);
-    }
-    throw new PnpmError('REGISTRY_ERROR', `Failed to ${action} package: ${response.status} ${response.statusText}. ${errorBody}`);
+const WEB_AUTH_FETCH_OPTIONS = {
+    method: 'GET',
+};
+// `withOtpHandling` polls `doneUrl` through `context.fetch`, so it must inherit
+// the command's proxy/TLS/`configByUri` config — otherwise the write succeeds
+// but the web-auth retry fails in custom-network environments.
+function createOtpContext(opts) {
+    return {
+        Date,
+        createReadlineInterface: readline.createInterface.bind(null, { input: process.stdin }),
+        enquirer: { input },
+        fetch: createFetchFromRegistry(opts),
+        globalInfo,
+        globalWarn,
+        process,
+        setTimeout,
+    };
 }
 //# sourceMappingURL=distTag.js.map

package/lib/owner.js

@@ -133,7 +133,7 @@ async function ownerRm(opts, params) {
     return `-${owner}: ${packageName}`;
 }
 function getAuthHeaderForRegistry(configByUri, registryUrl) {
-    const getAuthHeader = createGetAuthHeaderByURI(configByUri ?? {}, registryUrl);
+    const getAuthHeader = createGetAuthHeaderByURI(configByUri ?? {});
     return getAuthHeader(registryUrl);
 }
 function getOwnerUrl(escapedName, registryUrl, owner) {

package/lib/ping.js

@@ -38,7 +38,7 @@ export async function handler(opts) {
     const pingUrlObject = new URL('./-/ping', normalizedRegistryUrl);
     pingUrlObject.searchParams.set('write', 'true');
     const pingUrl = pingUrlObject.toString();
-    const getAuthHeader = createGetAuthHeaderByURI(opts.configByUri ?? {}, normalizedRegistryUrl);
+    const getAuthHeader = createGetAuthHeaderByURI(opts.configByUri ?? {});
     const authHeaderValue = getAuthHeader(normalizedRegistryUrl);
     const fetchFromRegistry = createFetchFromRegistry(opts);
     const start = Date.now();

package/lib/search.js

@@ -52,7 +52,7 @@ export async function handler(opts, params) {
     searchUrl.searchParams.set('text', query);
     searchUrl.searchParams.set('size', (opts.searchLimit ?? 20).toString());
     const fetchFromRegistry = createFetchFromRegistry(opts);
-    const getAuthHeader = createGetAuthHeaderByURI(opts.configByUri ?? {}, opts.registries?.default);
+    const getAuthHeader = createGetAuthHeaderByURI(opts.configByUri ?? {});
     const response = await fetchFromRegistry(searchUrl.toString(), {
         authHeaderValue: getAuthHeader(registry),
     });

package/lib/star/common.js

@@ -87,7 +87,7 @@ async function performLegacyStarAction(args) {
     }
 }
 export function getAuthHeaderForRegistry(configByUri, registryUrl) {
-    const getAuthHeader = createGetAuthHeaderByURI(configByUri ?? {}, registryUrl);
+    const getAuthHeader = createGetAuthHeaderByURI(configByUri ?? {});
     return getAuthHeader(registryUrl);
 }
 //# sourceMappingURL=common.js.map

package/lib/unpublish.js

@@ -54,7 +54,7 @@ export async function handler(opts, params) {
 }
 async function unpublishPackage(packageName, versionRange, opts) {
     const registryUrl = pickRegistryForPackage(opts.registries ?? { default: 'https://registry.npmjs.org/' }, packageName);
-    const getAuthHeader = createGetAuthHeaderByURI(opts.configByUri ?? {}, registryUrl);
+    const getAuthHeader = createGetAuthHeaderByURI(opts.configByUri ?? {});
     const authHeader = getAuthHeader(registryUrl);
     const packageUrl = new URL(npa(packageName).escapedName, registryUrl).href;
     const fetchFromRegistry = createFetchFromRegistry(opts);

package/lib/whoami.js

@@ -22,7 +22,7 @@ export function help() {
 }
 export async function handler(opts) {
     const registryUrl = normalizeRegistryUrl(opts.registries?.default ?? 'https://registry.npmjs.org/');
-    const getAuthHeader = createGetAuthHeaderByURI(opts.configByUri ?? {}, registryUrl);
+    const getAuthHeader = createGetAuthHeaderByURI(opts.configByUri ?? {});
     const authHeader = getAuthHeader(registryUrl);
     if (!authHeader) {
         throw new PnpmError('WHOAMI_UNAUTHORIZED', 'You must be logged in to use whoami');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/registry-access.commands",
-  "version": "1100.2.15",
+  "version": "1100.3.0",
   "description": "Commands for managing packages on the registry",
   "keywords": [
     "pnpm",
@@ -24,31 +24,38 @@
     "!*.map"
   ],
   "dependencies": {
+    "@inquirer/prompts": "^8.4.3",
     "@pnpm/npm-package-arg": "^2.0.0",
-    "chalk": "^5.6.0",
+    "chalk": "^5.6.2",
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "render-help": "^2.0.0",
-    "semver": "^7.7.2",
-    "@pnpm/cli.utils": "1101.0.7",
-    "@pnpm/config.reader": "1101.4.0",
+    "semver": "^7.8.1",
+    "@pnpm/cli.utils": "1101.0.8",
+    "@pnpm/config.pick-registry-for-package": "1100.0.6",
+    "@pnpm/config.reader": "1101.5.0",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/config.pick-registry-for-package": "1100.0.5",
-    "@pnpm/network.auth-header": "1100.0.3",
-    "@pnpm/resolving.registry.types": "1100.0.4",
-    "@pnpm/types": "1101.1.1",
-    "@pnpm/network.fetch": "1100.0.6"
+    "@pnpm/network.auth-header": "1101.0.0",
+    "@pnpm/network.fetch": "1100.0.8",
+    "@pnpm/network.web-auth": "1101.1.0",
+    "@pnpm/registry-access.client": "1100.1.0",
+    "@pnpm/types": "1101.2.0",
+    "@pnpm/resolving.registry.types": "1100.1.0"
+  },
+  "peerDependencies": {
+    "@pnpm/logger": "^1001.0.1"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
-    "@pnpm/registry-mock": "6.0.0",
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
     "execa": "npm:safe-execa@0.3.0",
-    "@pnpm/prepare": "1100.0.10",
-    "@pnpm/registry-access.commands": "1100.2.15",
-    "@pnpm/releasing.commands": "1100.3.0",
-    "@pnpm/testing.command-defaults": "1100.0.1",
-    "@pnpm/testing.mock-agent": "1100.0.6"
+    "@pnpm/logger": "1100.0.0",
+    "@pnpm/prepare": "1100.0.12",
+    "@pnpm/registry-access.commands": "1100.3.0",
+    "@pnpm/releasing.commands": "1100.4.0",
+    "@pnpm/testing.command-defaults": "1100.0.2",
+    "@pnpm/testing.registry-mock": "1100.0.2",
+    "@pnpm/testing.mock-agent": "1100.0.8"
   },
   "engines": {
     "node": ">=22.13"