@pnpm/registry-access.commands 1100.3.7 → 1100.4.1

package/CHANGELOG.md

@@ -0,0 +1,430 @@
+# @pnpm/registry-access.commands
+
+## 1100.4.1
+
+### Patch Changes
+
+- @pnpm/config.reader@1101.11.2
+
+## 1100.4.0
+
+### Minor Changes
+
+- 508b8c2: Added the `pnpm access` command for managing package access and visibility on the registry, supporting listing packages and collaborators, getting and setting package status and MFA requirements, and granting or revoking team access.
+
+### Patch Changes
+
+- Updated dependencies [9318a11]
+- Updated dependencies [5a4daec]
+  - @pnpm/config.reader@1101.11.1
+
+## 1100.3.7
+
+### Patch Changes
+
+- Updated dependencies [3425e80]
+- Updated dependencies [806c3ec]
+- Updated dependencies [c121235]
+- Updated dependencies [1e81761]
+  - @pnpm/config.reader@1101.11.0
+  - @pnpm/network.web-auth@1101.2.0
+  - @pnpm/registry-access.client@1100.1.6
+
+## 1100.3.6
+
+### Patch Changes
+
+- Updated dependencies [05b95ab]
+- Updated dependencies [852d537]
+  - @pnpm/network.fetch@1100.1.4
+  - @pnpm/error@1100.0.1
+  - @pnpm/registry-access.client@1100.1.5
+  - @pnpm/cli.utils@1101.0.13
+  - @pnpm/config.reader@1101.10.1
+  - @pnpm/network.auth-header@1101.1.3
+  - @pnpm/network.web-auth@1101.1.2
+
+## 1100.3.5
+
+### Patch Changes
+
+- Updated dependencies [302a2f7]
+- Updated dependencies [0474a9c]
+  - @pnpm/config.reader@1101.10.0
+
+## 1100.3.4
+
+### Patch Changes
+
+- a31faa7: Updated dependency ranges. Notably:
+
+  - `@pnpm/logger` peer dependency range moved to `^1100.0.0`.
+  - `msgpackr` 1.11.8 → 2.0.4 (store index files remain byte-compatible in both directions).
+  - `open` ^7.4.2 → ^11.0.0, `memoize` ^10 → ^11, `cli-truncate` ^5 → ^6, `pidtree` ^0.6 → ^1.
+  - `@yarnpkg/core` 4.5.0 → 4.8.0, `@rushstack/worker-pool` 0.7.7 → 0.7.18, `@cyclonedx/cyclonedx-library` 10.0.0 → 10.1.0, `@pnpm/config.nerf-dart` ^1 → ^2, `@pnpm/log.group` 3.0.2 → 4.0.1, `@pnpm/util.lex-comparator` ^3 → ^4.
+
+- Updated dependencies [61810aa]
+- Updated dependencies [681b593]
+- Updated dependencies [a31faa7]
+  - @pnpm/config.reader@1101.9.0
+  - @pnpm/network.auth-header@1101.1.2
+  - @pnpm/types@1101.3.2
+  - @pnpm/cli.utils@1101.0.12
+  - @pnpm/network.fetch@1100.1.3
+  - @pnpm/network.web-auth@1101.1.1
+  - @pnpm/config.pick-registry-for-package@1100.0.9
+  - @pnpm/resolving.registry.types@1100.1.3
+  - @pnpm/registry-access.client@1100.1.4
+
+## 1100.3.3
+
+### Patch Changes
+
+- Updated dependencies [bc9ed78]
+- Updated dependencies [615c669]
+  - @pnpm/config.reader@1101.8.0
+  - @pnpm/network.fetch@1100.1.2
+  - @pnpm/cli.utils@1101.0.11
+  - @pnpm/registry-access.client@1100.1.3
+
+## 1100.3.2
+
+### Patch Changes
+
+- Updated dependencies [822beb5]
+- Updated dependencies [3537020]
+- Updated dependencies [894ea6a]
+- Updated dependencies [6b5d91a]
+- Updated dependencies [027196b]
+- Updated dependencies [1017c36]
+- Updated dependencies [bf1b731]
+  - @pnpm/config.reader@1101.7.0
+  - @pnpm/types@1101.3.1
+  - @pnpm/cli.utils@1101.0.10
+  - @pnpm/config.pick-registry-for-package@1100.0.8
+  - @pnpm/network.auth-header@1101.1.1
+  - @pnpm/network.fetch@1100.1.1
+  - @pnpm/resolving.registry.types@1100.1.2
+  - @pnpm/registry-access.client@1100.1.2
+
+## 1100.3.1
+
+### Patch Changes
+
+- Updated dependencies [60a1eec]
+- Updated dependencies [5192edf]
+- Updated dependencies [a017bf3]
+  - @pnpm/network.fetch@1100.1.0
+  - @pnpm/network.auth-header@1101.1.0
+  - @pnpm/config.reader@1101.6.0
+  - @pnpm/types@1101.3.0
+  - @pnpm/registry-access.client@1100.1.1
+  - @pnpm/cli.utils@1101.0.9
+  - @pnpm/config.pick-registry-for-package@1100.0.7
+  - @pnpm/resolving.registry.types@1100.1.1
+
+## 1100.3.0
+
+### Minor Changes
+
+- 2cadfb5: Replaced `enquirer` with `@inquirer/prompts` for all interactive prompts. Fixes the `update -i` scrolling overflow bug where long choice lists were clipped in the terminal [#6643](https://github.com/pnpm/pnpm/issues/6643).
+
+  **User-facing changes:**
+
+  - `pnpm update -i` / `pnpm update -i --latest`: Scrolling now works correctly when many packages are available; the new library uses visual-line-aware pagination via `usePagination`
+  - `pnpm audit --fix -i`: Same scrolling fix for vulnerability selection
+  - `pnpm approve-builds`: Interactive build approval prompts updated
+  - `pnpm patch`: Version selection and "apply to all" prompts updated
+  - `pnpm patch-remove`: Patch removal selection updated
+  - `pnpm publish`: Branch confirmation prompt updated
+  - `pnpm login`: Credential prompts updated
+  - `pnpm run` / `pnpm exec` (with `verifyDepsBeforeRun=prompt`): Confirmation prompt updated
+
+  Vim-style `j`/`k` keys still work for up/down navigation in all interactive prompts.
+
+  **Internal:** The `OtpEnquirer` and `LoginEnquirer` DI interfaces changed from `{ prompt }` to `{ input }` / `{ input, password }` respectively. Plugins or custom builds that inject their own enquirer mock will need to update.
+
+### Patch Changes
+
+- b1fa2d5: Fix `pnpm dist-tag add` and `pnpm dist-tag rm` against npmjs.org failing without `--otp` with `[ERR_PNPM_UNAUTHORIZED] You must be logged in to set dist-tag … "You must provide a one-time pass. Upgrade your client to npm@latest in order to use 2FA."`. pnpm now sends `npm-auth-type: web` on dist-tag writes and surfaces the resulting OTP challenge through the existing browser-based 2FA flow (the same `withOtpHandling` helper used by `pnpm publish`), so the browser opens, the user authenticates, and the dist-tag is set on retry. `--otp=<code>` continues to work via the classic flow.
+- Updated dependencies [b1fa2d5]
+- Updated dependencies [a39a83d]
+- Updated dependencies [2cadfb5]
+- Updated dependencies [1e9ab29]
+  - @pnpm/registry-access.client@1100.1.0
+  - @pnpm/network.fetch@1100.0.8
+  - @pnpm/config.reader@1101.5.0
+  - @pnpm/network.web-auth@1101.1.0
+  - @pnpm/resolving.registry.types@1100.1.0
+
+## 1100.2.16
+
+### Patch Changes
+
+- ae21758: Refactor the dist-tag-add and login (classic adduser) handlers to delegate their PUTs to a new shared package `@pnpm/registry-access.client`. Downstream tests in this monorepo now use these helpers (via `@pnpm/testing.registry-mock`) instead of `addDistTag` / `addUser` from `@pnpm/registry-mock`, which relied on the unmaintained `anonymous-npm-registry-client`.
+- Updated dependencies [a23956e]
+- Updated dependencies [35d2355]
+  - @pnpm/config.reader@1101.4.1
+  - @pnpm/network.auth-header@1101.0.0
+  - @pnpm/types@1101.2.0
+  - @pnpm/cli.utils@1101.0.8
+  - @pnpm/config.pick-registry-for-package@1100.0.6
+  - @pnpm/network.fetch@1100.0.7
+  - @pnpm/resolving.registry.types@1100.0.5
+  - @pnpm/registry-access.client@1100.0.1
+
+## 1100.2.15
+
+### Patch Changes
+
+- Updated dependencies [3b62f9d]
+- Updated dependencies [212315d]
+  - @pnpm/config.reader@1101.4.0
+  - @pnpm/cli.utils@1101.0.7
+
+## 1100.2.14
+
+### Patch Changes
+
+- Updated dependencies [097983f]
+  - @pnpm/config.pick-registry-for-package@1100.0.5
+
+## 1100.2.13
+
+### Patch Changes
+
+- d1b340f: Fixed `pnpm login` and `pnpm logout` ignoring `registries.default` from `pnpm-workspace.yaml` [#10099](https://github.com/pnpm/pnpm/issues/10099).
+- Updated dependencies [3687b0e]
+- Updated dependencies [ced20cb]
+- Updated dependencies [d1b340f]
+- Updated dependencies [64afc92]
+  - @pnpm/config.reader@1101.3.3
+  - @pnpm/types@1101.1.1
+  - @pnpm/cli.utils@1101.0.6
+  - @pnpm/config.pick-registry-for-package@1100.0.4
+  - @pnpm/network.auth-header@1100.0.3
+  - @pnpm/network.fetch@1100.0.6
+  - @pnpm/resolving.registry.types@1100.0.4
+
+## 1100.2.12
+
+### Patch Changes
+
+- Updated dependencies [020ac45]
+- Updated dependencies [d3f8408]
+- Updated dependencies [a62f959]
+- Updated dependencies [ba2c884]
+- Updated dependencies [8df408c]
+  - @pnpm/config.reader@1101.3.2
+  - @pnpm/network.fetch@1100.0.5
+  - @pnpm/cli.utils@1101.0.5
+
+## 1100.2.11
+
+### Patch Changes
+
+- Updated dependencies [18a464f]
+  - @pnpm/network.fetch@1100.0.4
+  - @pnpm/cli.utils@1101.0.4
+  - @pnpm/config.reader@1101.3.1
+
+## 1100.2.10
+
+### Patch Changes
+
+- 601317e: Added `pnpm owner` command to manage package owners on the registry.
+- Updated dependencies [20e7aff]
+- Updated dependencies [b61e268]
+- Updated dependencies [e1e29c1]
+  - @pnpm/network.fetch@1100.0.3
+  - @pnpm/config.reader@1101.3.0
+  - @pnpm/types@1101.1.0
+  - @pnpm/cli.utils@1101.0.3
+  - @pnpm/config.pick-registry-for-package@1100.0.3
+  - @pnpm/network.auth-header@1100.0.2
+  - @pnpm/resolving.registry.types@1100.0.3
+
+## 1100.2.9
+
+### Patch Changes
+
+- Updated dependencies [e9e876c]
+  - @pnpm/config.reader@1101.2.2
+
+## 1100.2.8
+
+### Patch Changes
+
+- Updated dependencies [707a879]
+  - @pnpm/config.reader@1101.2.1
+
+## 1100.2.7
+
+### Patch Changes
+
+- Updated dependencies [8fdd9a9]
+- Updated dependencies [5f34a8d]
+- Updated dependencies [c969392]
+- Updated dependencies [817b1b4]
+- Updated dependencies [c969392]
+- Updated dependencies [2de318b]
+  - @pnpm/config.reader@1101.2.0
+
+## 1100.2.6
+
+### Patch Changes
+
+- Updated dependencies [42a8f29]
+  - @pnpm/config.reader@1101.1.4
+
+## 1100.2.5
+
+### Patch Changes
+
+- Updated dependencies [184ce26]
+  - @pnpm/config.pick-registry-for-package@1100.0.2
+  - @pnpm/resolving.registry.types@1100.0.2
+  - @pnpm/config.reader@1101.1.3
+  - @pnpm/network.fetch@1100.0.2
+  - @pnpm/cli.utils@1101.0.2
+
+## 1100.2.4
+
+### Patch Changes
+
+- @pnpm/cli.utils@1101.0.1
+
+## 1100.2.3
+
+### Patch Changes
+
+- Updated dependencies [0fbcf74]
+  - @pnpm/config.reader@1101.1.2
+
+## 1100.2.2
+
+### Patch Changes
+
+- @pnpm/config.reader@1101.1.1
+
+## 1100.2.1
+
+### Patch Changes
+
+- Updated dependencies [7d25bc1]
+- Updated dependencies [9e0833c]
+  - @pnpm/config.reader@1101.1.0
+
+## 1100.2.0
+
+### Minor Changes
+
+- 75942bf: Implemented native `star`, `unstar`, `stars`, and `whoami` commands.
+
+### Patch Changes
+
+- Updated dependencies [cee550a]
+- Updated dependencies [4ab3d9b]
+- Updated dependencies [9af708a]
+- Updated dependencies [ea2a7fb]
+- Updated dependencies [ff7733c]
+  - @pnpm/cli.utils@1101.0.0
+  - @pnpm/config.reader@1101.0.0
+
+## 1100.1.0
+
+### Minor Changes
+
+- b738043: Add native `pnpm ping` command to test registry connectivity.
+  Provides a simple way to verify connectivity to the configured registry without requiring external tools.
+- f2083f4: Implemented native `search` command and its aliases (`s`, `se`, `find`).
+
+### Patch Changes
+
+- Updated dependencies [ff28085]
+  - @pnpm/types@1101.0.0
+  - @pnpm/cli.utils@1100.0.1
+  - @pnpm/config.pick-registry-for-package@1100.0.1
+  - @pnpm/config.reader@1100.0.1
+  - @pnpm/network.auth-header@1100.0.1
+  - @pnpm/network.fetch@1100.0.1
+  - @pnpm/resolving.registry.types@1100.0.1
+
+## 1000.1.0
+
+### Minor Changes
+
+- 853be66: Added native `pnpm dist-tag` command with `ls`, `add`, and `rm` subcommands [#11128](https://github.com/pnpm/pnpm/issues/11128).
+- 2c90d40: Added native `pnpm deprecate` and `pnpm undeprecate` commands that interact with the npm registry directly instead of delegating to the npm CLI [#11120](https://github.com/pnpm/pnpm/pull/11120).
+
+### Patch Changes
+
+- Updated dependencies [7730a7f]
+- Updated dependencies [ae8b816]
+- Updated dependencies [facdd71]
+- Updated dependencies [3c72b6b]
+- Updated dependencies [9f5c0e3]
+- Updated dependencies [76718b3]
+- Updated dependencies [a8f016c]
+- Updated dependencies [cc1b8e3]
+- Updated dependencies [90bd3c3]
+- Updated dependencies [1cc61e8]
+- Updated dependencies [606f53e]
+- Updated dependencies [c7203b9]
+- Updated dependencies [bb17724]
+- Updated dependencies [da2429d]
+- Updated dependencies [1cc61e8]
+- Updated dependencies [491a84f]
+- Updated dependencies [fb8962f]
+- Updated dependencies [f0ae1b9]
+- Updated dependencies [b1ad9c7]
+- Updated dependencies [0dfa8b8]
+- Updated dependencies [7fab2a2]
+- Updated dependencies [cb367b9]
+- Updated dependencies [543c7e4]
+- Updated dependencies [075aa99]
+- Updated dependencies [ae43ac7]
+- Updated dependencies [ccec8e7]
+- Updated dependencies [4158906]
+- Updated dependencies [ac944ef]
+- Updated dependencies [d3d6938]
+- Updated dependencies [7d2fd48]
+- Updated dependencies [cc7c0d2]
+- Updated dependencies [efb48dc]
+- Updated dependencies [d5d4eed]
+- Updated dependencies [095f659]
+- Updated dependencies [96704a1]
+- Updated dependencies [bb8baa7]
+- Updated dependencies [cb367b9]
+- Updated dependencies [7b1c189]
+- Updated dependencies [51b04c3]
+- Updated dependencies [6c480a4]
+- Updated dependencies [d01b81f]
+- Updated dependencies [3ed41f4]
+- Updated dependencies [8ffb1a7]
+- Updated dependencies [05fb1ae]
+- Updated dependencies [71de2b3]
+- Updated dependencies [10bc391]
+- Updated dependencies [831f574]
+- Updated dependencies [2df8b71]
+- Updated dependencies [ed1a7fe]
+- Updated dependencies [15549a9]
+- Updated dependencies [cc7c0d2]
+- Updated dependencies [5bf7768]
+- Updated dependencies [ae43ac7]
+- Updated dependencies [a5fdbf9]
+- Updated dependencies [9d3f00b]
+- Updated dependencies [efb48dc]
+- Updated dependencies [6b3d87a]
+- Updated dependencies [9587dac]
+- Updated dependencies [09a999a]
+- Updated dependencies [559f903]
+- Updated dependencies [3574905]
+  - @pnpm/config.reader@1005.0.0
+  - @pnpm/types@1001.0.0
+  - @pnpm/cli.utils@1002.0.0
+  - @pnpm/config.pick-registry-for-package@1001.0.0
+  - @pnpm/network.auth-header@1001.0.0
+  - @pnpm/error@1001.0.0
+  - @pnpm/network.fetch@1001.0.0
+  - @pnpm/resolving.registry.types@1000.1.0

package/lib/access.d.ts

@@ -0,0 +1,16 @@
+import { type CreateFetchFromRegistryOptions } from '@pnpm/network.fetch';
+import type { Registries, RegistryConfig } from '@pnpm/types';
+import { rcOptionsTypes } from './common.js';
+export { rcOptionsTypes };
+export declare function cliOptionsTypes(): Record<string, unknown>;
+export declare const commandNames: string[];
+export declare function help(): string;
+export interface AccessOptions extends CreateFetchFromRegistryOptions {
+    cliOptions?: {
+        json?: boolean;
+        otp?: string;
+    };
+    configByUri?: Record<string, RegistryConfig>;
+    registries?: Registries;
+}
+export declare function handler(opts: AccessOptions, params: string[]): Promise<string>;

package/lib/access.js

@@ -0,0 +1,496 @@
+import { docsUrl } from '@pnpm/cli.utils';
+import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
+import { PnpmError } from '@pnpm/error';
+import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
+import { createFetchFromRegistry } from '@pnpm/network.fetch';
+import npa from '@pnpm/npm-package-arg';
+import { renderHelp } from 'render-help';
+import { normalizeRegistryUrl, rcOptionsTypes } from './common.js';
+export { rcOptionsTypes };
+const DEFAULT_REGISTRY_URL = 'https://registry.npmjs.org/';
+const ERROR_BODY_LIMIT = 64 * 1024;
+function getRegistries(opts) {
+    return opts.registries ?? { default: DEFAULT_REGISTRY_URL };
+}
+export function cliOptionsTypes() {
+    return {
+        ...rcOptionsTypes(),
+        json: Boolean,
+        otp: String,
+    };
+}
+export const commandNames = ['access'];
+export function help() {
+    return renderHelp({
+        description: 'Manages package access and visibility on the registry.',
+        descriptionLists: [
+            {
+                title: 'Commands',
+                list: [
+                    {
+                        description: 'List packages a user, scope, or team can access.',
+                        name: 'list packages',
+                    },
+                    {
+                        description: 'List collaborators on a package.',
+                        name: 'list collaborators',
+                    },
+                    {
+                        description: 'Get the public/restricted status of a package.',
+                        name: 'get status',
+                    },
+                    {
+                        description: 'Set the package visibility (public/private).',
+                        name: 'set status',
+                    },
+                    {
+                        description: 'Set the 2FA requirement for a package (none/publish/automation).',
+                        name: 'set mfa',
+                    },
+                    {
+                        description: 'Grant read-only or read-write access to a team.',
+                        name: 'grant',
+                    },
+                    {
+                        description: 'Revoke a team\'s access to a package.',
+                        name: 'revoke',
+                    },
+                ],
+            },
+            {
+                title: 'Options',
+                list: [
+                    {
+                        description: 'The base URL of the npm registry.',
+                        name: '--registry <url>',
+                    },
+                    {
+                        description: 'Output results in JSON format.',
+                        name: '--json',
+                    },
+                    {
+                        description: 'One-time password for registries that require two-factor authentication.',
+                        name: '--otp',
+                    },
+                ],
+            },
+        ],
+        url: docsUrl('access'),
+        usages: [
+            'pnpm access list packages [<user>|<scope>|<scope:team>]',
+            'pnpm access list collaborators [<package> [<user>]]',
+            'pnpm access get status [<package>]',
+            'pnpm access set status=public|private [<package>]',
+            'pnpm access set mfa=none|publish|automation [<package>]',
+            'pnpm access grant <read-only|read-write> <scope:team> [<package>]',
+            'pnpm access revoke <scope:team> [<package>]',
+        ],
+    });
+}
+export async function handler(opts, params) {
+    if (params.length === 0) {
+        throw new PnpmError('ACCESS_SUBCOMMAND_REQUIRED', 'A subcommand is required (e.g., "list packages", "get status", "set status=public", "grant", "revoke")');
+    }
+    const first = params[0];
+    const second = params[1];
+    if (first === 'list' && second === 'packages') {
+        return listPackages(opts, params.slice(2));
+    }
+    if (first === 'list' && second === 'collaborators') {
+        return listCollaborators(opts, params.slice(2));
+    }
+    if (first === 'ls' && (second == null || second === 'packages')) {
+        return listPackages(opts, second === 'packages' ? params.slice(2) : params.slice(1));
+    }
+    if (first === 'get' && second === 'status') {
+        return getStatus(opts, params.slice(2));
+    }
+    if (first === 'set') {
+        if (second == null) {
+            throw new PnpmError('ACCESS_SET_REQUIRED', 'A value is required (e.g., "status=public" or "mfa=none")');
+        }
+        if (second.startsWith('status=')) {
+            return setStatus(opts, params.slice(1));
+        }
+        if (second.startsWith('mfa=')) {
+            return setMfa(opts, params.slice(1));
+        }
+        throw new PnpmError('ACCESS_SET_INVALID', `Unknown set parameter "${second}". Use "status=public|private" or "mfa=none|publish|automation".`);
+    }
+    if (first === 'grant') {
+        return grantAccess(opts, params.slice(1));
+    }
+    if (first === 'revoke') {
+        return revokeAccess(opts, params.slice(1));
+    }
+    // Handle deprecated npm access forms: public/restricted
+    if (first === 'public') {
+        return setStatus(opts, ['status=public', ...params.slice(1)]);
+    }
+    if (first === 'restricted') {
+        return setStatus(opts, ['status=restricted', ...params.slice(1)]);
+    }
+    throw new PnpmError('ACCESS_UNKNOWN_SUBCOMMAND', `Unknown subcommand: ${params.join(' ')}. Run "pnpm help access" for available subcommands.`);
+}
+async function listPackages(opts, params) {
+    const registries = getRegistries(opts);
+    const fetchFromRegistry = createFetchFromRegistry(opts);
+    const authHeader = getAuthHeaderForRegistry(opts.configByUri, registries.default ?? DEFAULT_REGISTRY_URL);
+    const jsonMode = opts.cliOptions?.json ?? false;
+    const ctx = { registries, fetchFromRegistry, authHeader, jsonMode };
+    let entity;
+    let entityType;
+    if (params.length > 0) {
+        const raw = params[0];
+        if (raw.includes(':')) {
+            entityType = 'team';
+            entity = raw;
+        }
+        else if (raw.startsWith('@')) {
+            entityType = 'org';
+            entity = raw.replace(/^@/, '');
+        }
+        else {
+            entityType = 'user';
+            entity = raw;
+        }
+    }
+    if (entityType == null || entity == null) {
+        return listOwnPackages(ctx);
+    }
+    return listEntityPackages(entityType, entity, ctx);
+}
+async function listOwnPackages(ctx) {
+    const registryUrl = normalizeRegistryUrl(ctx.registries.default ?? DEFAULT_REGISTRY_URL);
+    const url = new URL('-/-/package?format=cli', registryUrl).href;
+    return fetchListResponse(url, ctx);
+}
+async function listEntityPackages(entityType, entity, ctx) {
+    const registryUrl = normalizeRegistryUrl(ctx.registries.default ?? DEFAULT_REGISTRY_URL);
+    let listUrl;
+    if (entityType === 'team') {
+        const [scope, team] = entity.split(':');
+        listUrl = new URL(`-/team/${encodeURIComponent(scope.startsWith('@') ? scope.slice(1) : scope)}/${encodeURIComponent(team)}/package?format=cli`, registryUrl).href;
+    }
+    else if (entityType === 'org') {
+        listUrl = new URL(`-/org/${encodeURIComponent(entity)}/package?format=cli`, registryUrl).href;
+    }
+    else {
+        listUrl = new URL(`-/user/${encodeURIComponent(entity)}/package?format=cli`, registryUrl).href;
+    }
+    return fetchListResponse(listUrl, ctx);
+}
+async function fetchListResponse(url, ctx) {
+    const response = await ctx.fetchFromRegistry(url, {
+        authHeaderValue: ctx.authHeader,
+    });
+    if (!response.ok) {
+        await throwRegistryError(response, 'list packages from');
+    }
+    const data = await response.json();
+    if (ctx.jsonMode) {
+        return JSON.stringify(data, null, 2);
+    }
+    return formatPackagesList(data);
+}
+function formatPackagesList(data) {
+    const lines = [];
+    for (const [pkg, access] of Object.entries(data)) {
+        if (typeof access === 'string') {
+            lines.push(`${pkg}: ${access}`);
+        }
+        else {
+            lines.push(pkg);
+        }
+    }
+    return lines.sort().join('\n');
+}
+async function listCollaborators(opts, params) {
+    if (params.length === 0) {
+        throw new PnpmError('ACCESS_LIST_COLLABORATORS_PACKAGE_REQUIRED', 'Package name is required (e.g., pnpm access list collaborators @scope/pkg)');
+    }
+    const packageName = params[0];
+    const user = params[1];
+    const registries = getRegistries(opts);
+    const registryUrl = pickRegistryForPackage(registries, packageName);
+    const authHeader = getAuthHeaderForRegistry(opts.configByUri, registryUrl, packageName);
+    const fetchFromRegistry = createFetchFromRegistry(opts);
+    const jsonMode = opts.cliOptions?.json ?? false;
+    let collaboratorsUrl;
+    if (user) {
+        collaboratorsUrl = new URL(`-/package/${escapePackageName(packageName)}/collaborators?format=cli&user=${encodeURIComponent(user)}`, normalizeRegistryUrl(registryUrl)).href;
+    }
+    else {
+        collaboratorsUrl = new URL(`-/package/${escapePackageName(packageName)}/collaborators?format=cli`, normalizeRegistryUrl(registryUrl)).href;
+    }
+    const response = await fetchFromRegistry(collaboratorsUrl, {
+        authHeaderValue: authHeader,
+    });
+    if (!response.ok) {
+        if (response.status === 404) {
+            throw new PnpmError('PACKAGE_NOT_FOUND', `Package "${packageName}" not found in registry`);
+        }
+        await throwRegistryError(response, 'list collaborators for');
+    }
+    const data = await response.json();
+    if (jsonMode) {
+        return JSON.stringify(data, null, 2);
+    }
+    return formatCollaboratorsList(data);
+}
+function formatCollaboratorsList(data) {
+    const lines = [];
+    for (const entry of data) {
+        const user = entry.user ?? entry.username ?? 'unknown';
+        const email = entry.email ?? '';
+        const permissions = entry.permissions ?? 'read-only';
+        lines.push(`${String(user)}${email ? ` <${email}>` : ''}: ${permissions}`);
+    }
+    return lines.sort().join('\n');
+}
+async function getStatus(opts, params) {
+    if (params.length === 0) {
+        throw new PnpmError('ACCESS_GET_STATUS_PACKAGE_REQUIRED', 'Package name is required (e.g., pnpm access get status @scope/pkg)');
+    }
+    const packageName = params[0];
+    const registries = getRegistries(opts);
+    const registryUrl = pickRegistryForPackage(registries, packageName);
+    const authHeader = getAuthHeaderForRegistry(opts.configByUri, registryUrl, packageName);
+    const fetchFromRegistry = createFetchFromRegistry(opts);
+    const jsonMode = opts.cliOptions?.json ?? false;
+    const accessUrl = new URL(`-/package/${escapePackageName(packageName)}/access`, normalizeRegistryUrl(registryUrl)).href;
+    const response = await fetchFromRegistry(accessUrl, {
+        authHeaderValue: authHeader,
+    });
+    if (!response.ok) {
+        if (response.status === 404) {
+            throw new PnpmError('PACKAGE_NOT_FOUND', `Package "${packageName}" not found in registry`);
+        }
+        await throwRegistryError(response, 'get status of');
+    }
+    const data = await response.json();
+    if (jsonMode) {
+        return JSON.stringify(data, null, 2);
+    }
+    const lines = [];
+    if (data.access) {
+        lines.push(`package: ${packageName}`);
+        lines.push(`access: ${data.access}`);
+    }
+    else {
+        lines.push(`package: ${packageName}`);
+        lines.push('access: public');
+    }
+    return lines.join('\n');
+}
+async function setStatus(opts, params) {
+    if (params.length === 0 || !params[0].startsWith('status=')) {
+        throw new PnpmError('ACCESS_SET_STATUS_REQUIRED', 'Package visibility is required (e.g., pnpm access set status=public @scope/pkg)');
+    }
+    const accessValue = params[0].slice('status='.length);
+    if (accessValue !== 'public' && accessValue !== 'private' && accessValue !== 'restricted') {
+        throw new PnpmError('ACCESS_SET_STATUS_INVALID', `Invalid access value "${accessValue}". Must be "public" or "private".`);
+    }
+    const normalizedAccess = accessValue === 'private' || accessValue === 'restricted' ? 'restricted' : 'public';
+    const packageName = params[1];
+    if (!packageName) {
+        throw new PnpmError('ACCESS_SET_STATUS_PACKAGE_REQUIRED', 'Package name is required (e.g., pnpm access set status=public @scope/pkg)');
+    }
+    if (!packageName.startsWith('@')) {
+        throw new PnpmError('ACCESS_SET_STATUS_UNSCOPED', 'Access settings can only be changed for scoped packages (@scope/name). Unscoped packages are always public.');
+    }
+    const registries = getRegistries(opts);
+    const registryUrl = pickRegistryForPackage(registries, packageName);
+    const authHeader = getAuthHeaderForRegistry(opts.configByUri, registryUrl, packageName);
+    const fetchFromRegistry = createFetchFromRegistry(opts);
+    const otp = opts.cliOptions?.otp;
+    const accessUrl = new URL(`-/package/${escapePackageName(packageName)}/access`, normalizeRegistryUrl(registryUrl)).href;
+    const response = await fetchFromRegistry(accessUrl, {
+        authHeaderValue: authHeader,
+        method: 'POST',
+        headers: {
+            'content-type': 'application/json',
+            ...(otp ? { 'npm-otp': otp } : {}),
+        },
+        body: JSON.stringify({ access: normalizedAccess }),
+    });
+    if (!response.ok) {
+        await throwRegistryError(response, `set access to "${normalizedAccess}" for`);
+    }
+    return `${packageName}: ${normalizedAccess === 'public' ? 'public' : 'restricted'}`;
+}
+async function setMfa(opts, params) {
+    if (params.length === 0 || !params[0].startsWith('mfa=')) {
+        throw new PnpmError('ACCESS_SET_MFA_REQUIRED', 'MFA level is required (e.g., pnpm access set mfa=automation @scope/pkg)');
+    }
+    const mfaValue = params[0].slice('mfa='.length);
+    if (!['none', 'publish', 'automation'].includes(mfaValue)) {
+        throw new PnpmError('ACCESS_SET_MFA_INVALID', `Invalid MFA value "${mfaValue}". Must be "none", "publish", or "automation".`);
+    }
+    const packageName = params[1];
+    if (!packageName) {
+        throw new PnpmError('ACCESS_SET_MFA_PACKAGE_REQUIRED', 'Package name is required (e.g., pnpm access set mfa=automation @scope/pkg)');
+    }
+    const registries = getRegistries(opts);
+    const registryUrl = pickRegistryForPackage(registries, packageName);
+    const authHeader = getAuthHeaderForRegistry(opts.configByUri, registryUrl, packageName);
+    const fetchFromRegistry = createFetchFromRegistry(opts);
+    const otp = opts.cliOptions?.otp;
+    const accessUrl = new URL(`-/package/${escapePackageName(packageName)}/access`, normalizeRegistryUrl(registryUrl)).href;
+    const publishRequiresTfa = mfaValue !== 'none';
+    const response = await fetchFromRegistry(accessUrl, {
+        authHeaderValue: authHeader,
+        method: 'POST',
+        headers: {
+            'content-type': 'application/json',
+            ...(otp ? { 'npm-otp': otp } : {}),
+        },
+        body: JSON.stringify({ publish_requires_tfa: publishRequiresTfa }),
+    });
+    if (!response.ok) {
+        await throwRegistryError(response, 'set MFA for');
+    }
+    return `${packageName}: mfa=${mfaValue}`;
+}
+async function grantAccess(opts, params) {
+    if (params.length < 2) {
+        throw new PnpmError('ACCESS_GRANT_ARGS_REQUIRED', 'Permissions and scope:team are required (e.g., pnpm access grant read-only @scope:developers @scope/pkg)');
+    }
+    const permissions = params[0];
+    if (permissions !== 'read-only' && permissions !== 'read-write') {
+        throw new PnpmError('ACCESS_GRANT_INVALID_PERMISSIONS', `Invalid permissions "${permissions}". Must be "read-only" or "read-write".`);
+    }
+    const scopeTeam = params[1];
+    if (!scopeTeam.includes(':')) {
+        throw new PnpmError('ACCESS_GRANT_INVALID_TEAM', `Invalid team "${scopeTeam}". Format must be "scope:team".`);
+    }
+    const packageName = params[2];
+    if (!packageName) {
+        throw new PnpmError('ACCESS_GRANT_PACKAGE_REQUIRED', 'Package name is required (e.g., pnpm access grant read-only @scope:developers @scope/pkg)');
+    }
+    const [scope, team] = scopeTeam.split(':');
+    const registries = getRegistries(opts);
+    const registryUrl = pickRegistryForPackage(registries, packageName);
+    const authHeader = getAuthHeaderForRegistry(opts.configByUri, registryUrl, packageName);
+    const fetchFromRegistry = createFetchFromRegistry(opts);
+    const otp = opts.cliOptions?.otp;
+    const grantUrl = new URL(`-/team/${encodeURIComponent(scope.startsWith('@') ? scope.slice(1) : scope)}/${encodeURIComponent(team)}/package`, normalizeRegistryUrl(registryUrl)).href;
+    const response = await fetchFromRegistry(grantUrl, {
+        authHeaderValue: authHeader,
+        method: 'PUT',
+        headers: {
+            'content-type': 'application/json',
+            ...(otp ? { 'npm-otp': otp } : {}),
+        },
+        body: JSON.stringify({ package: packageName, permissions }),
+    });
+    if (!response.ok) {
+        await throwRegistryError(response, `grant ${permissions} access for ${scopeTeam} on`);
+    }
+    return `+${scopeTeam} (${permissions}): ${packageName}`;
+}
+async function revokeAccess(opts, params) {
+    if (params.length < 1) {
+        throw new PnpmError('ACCESS_REVOKE_ARGS_REQUIRED', 'scope:team and package name are required (e.g., pnpm access revoke @scope:developers @scope/pkg)');
+    }
+    const scopeTeam = params[0];
+    if (!scopeTeam.includes(':')) {
+        throw new PnpmError('ACCESS_REVOKE_INVALID_TEAM', `Invalid team "${scopeTeam}". Format must be "scope:team".`);
+    }
+    const packageName = params[1];
+    if (!packageName) {
+        throw new PnpmError('ACCESS_REVOKE_PACKAGE_REQUIRED', 'Package name is required (e.g., pnpm access revoke @scope:developers @scope/pkg)');
+    }
+    const [scope, team] = scopeTeam.split(':');
+    const registries = getRegistries(opts);
+    const registryUrl = pickRegistryForPackage(registries, packageName);
+    const authHeader = getAuthHeaderForRegistry(opts.configByUri, registryUrl, packageName);
+    const fetchFromRegistry = createFetchFromRegistry(opts);
+    const otp = opts.cliOptions?.otp;
+    const revokeUrl = new URL(`-/team/${encodeURIComponent(scope.startsWith('@') ? scope.slice(1) : scope)}/${encodeURIComponent(team)}/package`, normalizeRegistryUrl(registryUrl)).href;
+    const response = await fetchFromRegistry(revokeUrl, {
+        authHeaderValue: authHeader,
+        method: 'DELETE',
+        headers: {
+            'content-type': 'application/json',
+            ...(otp ? { 'npm-otp': otp } : {}),
+        },
+        body: JSON.stringify({ package: packageName }),
+    });
+    if (!response.ok) {
+        await throwRegistryError(response, `revoke ${scopeTeam}'s access to`);
+    }
+    return `-${scopeTeam}: ${packageName}`;
+}
+function getAuthHeaderForRegistry(configByUri, registryUrl, packageName) {
+    const getAuthHeader = createGetAuthHeaderByURI(configByUri ?? {});
+    return getAuthHeader(registryUrl, packageName ? { pkgName: packageName } : undefined);
+}
+function escapePackageName(packageName) {
+    let parsed;
+    try {
+        parsed = npa(packageName);
+    }
+    catch {
+        throw new PnpmError('ACCESS_INVALID_PACKAGE_NAME', `Invalid package name "${packageName}"`);
+    }
+    return parsed.escapedName ?? encodeURIComponent(packageName).replace(/^%40/, '@');
+}
+async function throwRegistryError(response, action) {
+    const errorBody = sanitize(await readErrorBody(response));
+    if (response.status === 401) {
+        throw new PnpmError('UNAUTHORIZED', `You must be logged in to ${action} packages. ${errorBody}`);
+    }
+    if (response.status === 403) {
+        throw new PnpmError('FORBIDDEN', `You do not have permission to ${action} this package. ${errorBody}`);
+    }
+    if (response.status === 404) {
+        throw new PnpmError('PACKAGE_NOT_FOUND', `Package not found in registry. ${errorBody}`);
+    }
+    if (response.status === 422) {
+        throw new PnpmError('ACCESS_VALIDATION_ERROR', `Invalid request: ${errorBody}`);
+    }
+    throw new PnpmError('REGISTRY_ERROR', `Failed to ${action} package: ${response.status} ${response.statusText}. ${errorBody}`);
+}
+async function readErrorBody(response) {
+    const reader = response.body?.getReader();
+    if (reader == null)
+        return '';
+    const chunks = [];
+    let total = 0;
+    let truncated = false;
+    while (total < ERROR_BODY_LIMIT) {
+        // eslint-disable-next-line no-await-in-loop
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        const need = ERROR_BODY_LIMIT - total;
+        if (value.length > need) {
+            chunks.push(value.subarray(0, need));
+            truncated = true;
+            break;
+        }
+        chunks.push(value);
+        total += value.length;
+    }
+    reader.cancel().catch(() => { });
+    let body = new TextDecoder().decode(Buffer.concat(chunks));
+    if (truncated) {
+        if (body.length > 0 && !body.endsWith(' ')) {
+            body += ' ';
+        }
+        body += '(response body truncated)';
+    }
+    return body;
+}
+function sanitize(text) {
+    let result = '';
+    for (let i = 0; i < text.length; i++) {
+        const code = text.charCodeAt(i);
+        if ((code > 31 && code !== 127) || code === 9 || code === 10) {
+            result += text[i];
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=access.js.map

package/lib/index.d.ts

@@ -1,3 +1,4 @@
+import * as access from './access.js';
 import * as deprecate from './deprecation/deprecate.js';
 import * as undeprecate from './deprecation/undeprecate.js';
 import * as distTag from './distTag.js';
@@ -9,4 +10,4 @@ import * as stars from './star/stars.js';
 import * as unstar from './star/unstar.js';
 import * as unpublish from './unpublish.js';
 import * as whoami from './whoami.js';
-export { deprecate, distTag, owner, ping, search, star, stars, undeprecate, unpublish, unstar, whoami };
+export { access, deprecate, distTag, owner, ping, search, star, stars, undeprecate, unpublish, unstar, whoami };

package/lib/index.js

@@ -1,3 +1,4 @@
+import * as access from './access.js';
 import * as deprecate from './deprecation/deprecate.js';
 import * as undeprecate from './deprecation/undeprecate.js';
 import * as distTag from './distTag.js';
@@ -9,5 +10,5 @@ import * as stars from './star/stars.js';
 import * as unstar from './star/unstar.js';
 import * as unpublish from './unpublish.js';
 import * as whoami from './whoami.js';
-export { deprecate, distTag, owner, ping, search, star, stars, undeprecate, unpublish, unstar, whoami };
+export { access, deprecate, distTag, owner, ping, search, star, stars, undeprecate, unpublish, unstar, whoami };
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/registry-access.commands",
-  "version": "1100.3.7",
+  "version": "1100.4.1",
   "description": "Commands for managing packages on the registry",
   "keywords": [
     "pnpm",
@@ -28,37 +28,37 @@
   ],
   "dependencies": {
     "@inquirer/prompts": "^8.4.3",
-    "@pnpm/npm-package-arg": "^2.0.0",
-    "chalk": "^5.6.2",
-    "ramda": "npm:@pnpm/ramda@0.28.1",
-    "render-help": "^2.0.0",
-    "semver": "^7.8.4",
+    "@pnpm/cli.utils": "1101.0.13",
     "@pnpm/config.pick-registry-for-package": "1100.0.9",
+    "@pnpm/config.reader": "1101.11.2",
     "@pnpm/error": "1100.0.1",
-    "@pnpm/cli.utils": "1101.0.13",
-    "@pnpm/network.web-auth": "1101.2.0",
-    "@pnpm/network.fetch": "1100.1.4",
-    "@pnpm/config.reader": "1101.11.0",
     "@pnpm/network.auth-header": "1101.1.3",
+    "@pnpm/network.fetch": "1100.1.4",
+    "@pnpm/network.web-auth": "1101.2.0",
+    "@pnpm/npm-package-arg": "^2.0.0",
     "@pnpm/registry-access.client": "1100.1.6",
+    "@pnpm/resolving.registry.types": "1100.1.3",
     "@pnpm/types": "1101.3.2",
-    "@pnpm/resolving.registry.types": "1100.1.3"
+    "chalk": "^5.6.2",
+    "ramda": "npm:@pnpm/ramda@0.28.1",
+    "render-help": "^2.0.0",
+    "semver": "^7.8.4"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@types/ramda": "0.31.1",
-    "@types/semver": "7.7.1",
-    "execa": "npm:safe-execa@0.3.0",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/registry-access.commands": "1100.3.7",
+    "@pnpm/prepare": "1100.0.18",
+    "@pnpm/registry-access.commands": "1100.4.1",
+    "@pnpm/releasing.commands": "1100.5.5",
     "@pnpm/testing.command-defaults": "1100.0.8",
     "@pnpm/testing.mock-agent": "1101.0.4",
-    "@pnpm/prepare": "1100.0.18",
     "@pnpm/testing.registry-mock": "1100.0.8",
-    "@pnpm/releasing.commands": "1100.5.3"
+    "@types/ramda": "0.31.1",
+    "@types/semver": "7.7.1",
+    "execa": "npm:safe-execa@0.3.0"
   },
   "engines": {
     "node": ">=22.13"