@pnpm/registry-access.commands 1100.4.0 → 1100.5.0

package/CHANGELOG.md

@@ -0,0 +1,448 @@
+# @pnpm/registry-access.commands
+
+## 1100.5.0
+
+### Minor Changes
+
+- Added the `team` command for managing organization teams and team memberships on the registry, with create, destroy, add, rm, and ls subcommands and support for --otp, --parseable, and --json flags.
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/cli.utils@1101.0.14
+  - @pnpm/config.pick-registry-for-package@1100.0.10
+  - @pnpm/config.reader@1101.12.0
+  - @pnpm/network.auth-header@1101.1.4
+  - @pnpm/network.fetch@1100.1.5
+  - @pnpm/registry-access.client@1100.1.7
+  - @pnpm/resolving.registry.types@1100.1.4
+  - @pnpm/types@1101.4.0
+
+## 1100.4.1
+
+### Patch Changes
+
+- @pnpm/config.reader@1101.11.2
+
+## 1100.4.0
+
+### Minor Changes
+
+- 508b8c2: Added the `pnpm access` command for managing package access and visibility on the registry, supporting listing packages and collaborators, getting and setting package status and MFA requirements, and granting or revoking team access.
+
+### Patch Changes
+
+- Updated dependencies [9318a11]
+- Updated dependencies [5a4daec]
+  - @pnpm/config.reader@1101.11.1
+
+## 1100.3.7
+
+### Patch Changes
+
+- Updated dependencies [3425e80]
+- Updated dependencies [806c3ec]
+- Updated dependencies [c121235]
+- Updated dependencies [1e81761]
+  - @pnpm/config.reader@1101.11.0
+  - @pnpm/network.web-auth@1101.2.0
+  - @pnpm/registry-access.client@1100.1.6
+
+## 1100.3.6
+
+### Patch Changes
+
+- Updated dependencies [05b95ab]
+- Updated dependencies [852d537]
+  - @pnpm/network.fetch@1100.1.4
+  - @pnpm/error@1100.0.1
+  - @pnpm/registry-access.client@1100.1.5
+  - @pnpm/cli.utils@1101.0.13
+  - @pnpm/config.reader@1101.10.1
+  - @pnpm/network.auth-header@1101.1.3
+  - @pnpm/network.web-auth@1101.1.2
+
+## 1100.3.5
+
+### Patch Changes
+
+- Updated dependencies [302a2f7]
+- Updated dependencies [0474a9c]
+  - @pnpm/config.reader@1101.10.0
+
+## 1100.3.4
+
+### Patch Changes
+
+- a31faa7: Updated dependency ranges. Notably:
+
+  - `@pnpm/logger` peer dependency range moved to `^1100.0.0`.
+  - `msgpackr` 1.11.8 → 2.0.4 (store index files remain byte-compatible in both directions).
+  - `open` ^7.4.2 → ^11.0.0, `memoize` ^10 → ^11, `cli-truncate` ^5 → ^6, `pidtree` ^0.6 → ^1.
+  - `@yarnpkg/core` 4.5.0 → 4.8.0, `@rushstack/worker-pool` 0.7.7 → 0.7.18, `@cyclonedx/cyclonedx-library` 10.0.0 → 10.1.0, `@pnpm/config.nerf-dart` ^1 → ^2, `@pnpm/log.group` 3.0.2 → 4.0.1, `@pnpm/util.lex-comparator` ^3 → ^4.
+
+- Updated dependencies [61810aa]
+- Updated dependencies [681b593]
+- Updated dependencies [a31faa7]
+  - @pnpm/config.reader@1101.9.0
+  - @pnpm/network.auth-header@1101.1.2
+  - @pnpm/types@1101.3.2
+  - @pnpm/cli.utils@1101.0.12
+  - @pnpm/network.fetch@1100.1.3
+  - @pnpm/network.web-auth@1101.1.1
+  - @pnpm/config.pick-registry-for-package@1100.0.9
+  - @pnpm/resolving.registry.types@1100.1.3
+  - @pnpm/registry-access.client@1100.1.4
+
+## 1100.3.3
+
+### Patch Changes
+
+- Updated dependencies [bc9ed78]
+- Updated dependencies [615c669]
+  - @pnpm/config.reader@1101.8.0
+  - @pnpm/network.fetch@1100.1.2
+  - @pnpm/cli.utils@1101.0.11
+  - @pnpm/registry-access.client@1100.1.3
+
+## 1100.3.2
+
+### Patch Changes
+
+- Updated dependencies [822beb5]
+- Updated dependencies [3537020]
+- Updated dependencies [894ea6a]
+- Updated dependencies [6b5d91a]
+- Updated dependencies [027196b]
+- Updated dependencies [1017c36]
+- Updated dependencies [bf1b731]
+  - @pnpm/config.reader@1101.7.0
+  - @pnpm/types@1101.3.1
+  - @pnpm/cli.utils@1101.0.10
+  - @pnpm/config.pick-registry-for-package@1100.0.8
+  - @pnpm/network.auth-header@1101.1.1
+  - @pnpm/network.fetch@1100.1.1
+  - @pnpm/resolving.registry.types@1100.1.2
+  - @pnpm/registry-access.client@1100.1.2
+
+## 1100.3.1
+
+### Patch Changes
+
+- Updated dependencies [60a1eec]
+- Updated dependencies [5192edf]
+- Updated dependencies [a017bf3]
+  - @pnpm/network.fetch@1100.1.0
+  - @pnpm/network.auth-header@1101.1.0
+  - @pnpm/config.reader@1101.6.0
+  - @pnpm/types@1101.3.0
+  - @pnpm/registry-access.client@1100.1.1
+  - @pnpm/cli.utils@1101.0.9
+  - @pnpm/config.pick-registry-for-package@1100.0.7
+  - @pnpm/resolving.registry.types@1100.1.1
+
+## 1100.3.0
+
+### Minor Changes
+
+- 2cadfb5: Replaced `enquirer` with `@inquirer/prompts` for all interactive prompts. Fixes the `update -i` scrolling overflow bug where long choice lists were clipped in the terminal [#6643](https://github.com/pnpm/pnpm/issues/6643).
+
+  **User-facing changes:**
+
+  - `pnpm update -i` / `pnpm update -i --latest`: Scrolling now works correctly when many packages are available; the new library uses visual-line-aware pagination via `usePagination`
+  - `pnpm audit --fix -i`: Same scrolling fix for vulnerability selection
+  - `pnpm approve-builds`: Interactive build approval prompts updated
+  - `pnpm patch`: Version selection and "apply to all" prompts updated
+  - `pnpm patch-remove`: Patch removal selection updated
+  - `pnpm publish`: Branch confirmation prompt updated
+  - `pnpm login`: Credential prompts updated
+  - `pnpm run` / `pnpm exec` (with `verifyDepsBeforeRun=prompt`): Confirmation prompt updated
+
+  Vim-style `j`/`k` keys still work for up/down navigation in all interactive prompts.
+
+  **Internal:** The `OtpEnquirer` and `LoginEnquirer` DI interfaces changed from `{ prompt }` to `{ input }` / `{ input, password }` respectively. Plugins or custom builds that inject their own enquirer mock will need to update.
+
+### Patch Changes
+
+- b1fa2d5: Fix `pnpm dist-tag add` and `pnpm dist-tag rm` against npmjs.org failing without `--otp` with `[ERR_PNPM_UNAUTHORIZED] You must be logged in to set dist-tag … "You must provide a one-time pass. Upgrade your client to npm@latest in order to use 2FA."`. pnpm now sends `npm-auth-type: web` on dist-tag writes and surfaces the resulting OTP challenge through the existing browser-based 2FA flow (the same `withOtpHandling` helper used by `pnpm publish`), so the browser opens, the user authenticates, and the dist-tag is set on retry. `--otp=<code>` continues to work via the classic flow.
+- Updated dependencies [b1fa2d5]
+- Updated dependencies [a39a83d]
+- Updated dependencies [2cadfb5]
+- Updated dependencies [1e9ab29]
+  - @pnpm/registry-access.client@1100.1.0
+  - @pnpm/network.fetch@1100.0.8
+  - @pnpm/config.reader@1101.5.0
+  - @pnpm/network.web-auth@1101.1.0
+  - @pnpm/resolving.registry.types@1100.1.0
+
+## 1100.2.16
+
+### Patch Changes
+
+- ae21758: Refactor the dist-tag-add and login (classic adduser) handlers to delegate their PUTs to a new shared package `@pnpm/registry-access.client`. Downstream tests in this monorepo now use these helpers (via `@pnpm/testing.registry-mock`) instead of `addDistTag` / `addUser` from `@pnpm/registry-mock`, which relied on the unmaintained `anonymous-npm-registry-client`.
+- Updated dependencies [a23956e]
+- Updated dependencies [35d2355]
+  - @pnpm/config.reader@1101.4.1
+  - @pnpm/network.auth-header@1101.0.0
+  - @pnpm/types@1101.2.0
+  - @pnpm/cli.utils@1101.0.8
+  - @pnpm/config.pick-registry-for-package@1100.0.6
+  - @pnpm/network.fetch@1100.0.7
+  - @pnpm/resolving.registry.types@1100.0.5
+  - @pnpm/registry-access.client@1100.0.1
+
+## 1100.2.15
+
+### Patch Changes
+
+- Updated dependencies [3b62f9d]
+- Updated dependencies [212315d]
+  - @pnpm/config.reader@1101.4.0
+  - @pnpm/cli.utils@1101.0.7
+
+## 1100.2.14
+
+### Patch Changes
+
+- Updated dependencies [097983f]
+  - @pnpm/config.pick-registry-for-package@1100.0.5
+
+## 1100.2.13
+
+### Patch Changes
+
+- d1b340f: Fixed `pnpm login` and `pnpm logout` ignoring `registries.default` from `pnpm-workspace.yaml` [#10099](https://github.com/pnpm/pnpm/issues/10099).
+- Updated dependencies [3687b0e]
+- Updated dependencies [ced20cb]
+- Updated dependencies [d1b340f]
+- Updated dependencies [64afc92]
+  - @pnpm/config.reader@1101.3.3
+  - @pnpm/types@1101.1.1
+  - @pnpm/cli.utils@1101.0.6
+  - @pnpm/config.pick-registry-for-package@1100.0.4
+  - @pnpm/network.auth-header@1100.0.3
+  - @pnpm/network.fetch@1100.0.6
+  - @pnpm/resolving.registry.types@1100.0.4
+
+## 1100.2.12
+
+### Patch Changes
+
+- Updated dependencies [020ac45]
+- Updated dependencies [d3f8408]
+- Updated dependencies [a62f959]
+- Updated dependencies [ba2c884]
+- Updated dependencies [8df408c]
+  - @pnpm/config.reader@1101.3.2
+  - @pnpm/network.fetch@1100.0.5
+  - @pnpm/cli.utils@1101.0.5
+
+## 1100.2.11
+
+### Patch Changes
+
+- Updated dependencies [18a464f]
+  - @pnpm/network.fetch@1100.0.4
+  - @pnpm/cli.utils@1101.0.4
+  - @pnpm/config.reader@1101.3.1
+
+## 1100.2.10
+
+### Patch Changes
+
+- 601317e: Added `pnpm owner` command to manage package owners on the registry.
+- Updated dependencies [20e7aff]
+- Updated dependencies [b61e268]
+- Updated dependencies [e1e29c1]
+  - @pnpm/network.fetch@1100.0.3
+  - @pnpm/config.reader@1101.3.0
+  - @pnpm/types@1101.1.0
+  - @pnpm/cli.utils@1101.0.3
+  - @pnpm/config.pick-registry-for-package@1100.0.3
+  - @pnpm/network.auth-header@1100.0.2
+  - @pnpm/resolving.registry.types@1100.0.3
+
+## 1100.2.9
+
+### Patch Changes
+
+- Updated dependencies [e9e876c]
+  - @pnpm/config.reader@1101.2.2
+
+## 1100.2.8
+
+### Patch Changes
+
+- Updated dependencies [707a879]
+  - @pnpm/config.reader@1101.2.1
+
+## 1100.2.7
+
+### Patch Changes
+
+- Updated dependencies [8fdd9a9]
+- Updated dependencies [5f34a8d]
+- Updated dependencies [c969392]
+- Updated dependencies [817b1b4]
+- Updated dependencies [c969392]
+- Updated dependencies [2de318b]
+  - @pnpm/config.reader@1101.2.0
+
+## 1100.2.6
+
+### Patch Changes
+
+- Updated dependencies [42a8f29]
+  - @pnpm/config.reader@1101.1.4
+
+## 1100.2.5
+
+### Patch Changes
+
+- Updated dependencies [184ce26]
+  - @pnpm/config.pick-registry-for-package@1100.0.2
+  - @pnpm/resolving.registry.types@1100.0.2
+  - @pnpm/config.reader@1101.1.3
+  - @pnpm/network.fetch@1100.0.2
+  - @pnpm/cli.utils@1101.0.2
+
+## 1100.2.4
+
+### Patch Changes
+
+- @pnpm/cli.utils@1101.0.1
+
+## 1100.2.3
+
+### Patch Changes
+
+- Updated dependencies [0fbcf74]
+  - @pnpm/config.reader@1101.1.2
+
+## 1100.2.2
+
+### Patch Changes
+
+- @pnpm/config.reader@1101.1.1
+
+## 1100.2.1
+
+### Patch Changes
+
+- Updated dependencies [7d25bc1]
+- Updated dependencies [9e0833c]
+  - @pnpm/config.reader@1101.1.0
+
+## 1100.2.0
+
+### Minor Changes
+
+- 75942bf: Implemented native `star`, `unstar`, `stars`, and `whoami` commands.
+
+### Patch Changes
+
+- Updated dependencies [cee550a]
+- Updated dependencies [4ab3d9b]
+- Updated dependencies [9af708a]
+- Updated dependencies [ea2a7fb]
+- Updated dependencies [ff7733c]
+  - @pnpm/cli.utils@1101.0.0
+  - @pnpm/config.reader@1101.0.0
+
+## 1100.1.0
+
+### Minor Changes
+
+- b738043: Add native `pnpm ping` command to test registry connectivity.
+  Provides a simple way to verify connectivity to the configured registry without requiring external tools.
+- f2083f4: Implemented native `search` command and its aliases (`s`, `se`, `find`).
+
+### Patch Changes
+
+- Updated dependencies [ff28085]
+  - @pnpm/types@1101.0.0
+  - @pnpm/cli.utils@1100.0.1
+  - @pnpm/config.pick-registry-for-package@1100.0.1
+  - @pnpm/config.reader@1100.0.1
+  - @pnpm/network.auth-header@1100.0.1
+  - @pnpm/network.fetch@1100.0.1
+  - @pnpm/resolving.registry.types@1100.0.1
+
+## 1000.1.0
+
+### Minor Changes
+
+- 853be66: Added native `pnpm dist-tag` command with `ls`, `add`, and `rm` subcommands [#11128](https://github.com/pnpm/pnpm/issues/11128).
+- 2c90d40: Added native `pnpm deprecate` and `pnpm undeprecate` commands that interact with the npm registry directly instead of delegating to the npm CLI [#11120](https://github.com/pnpm/pnpm/pull/11120).
+
+### Patch Changes
+
+- Updated dependencies [7730a7f]
+- Updated dependencies [ae8b816]
+- Updated dependencies [facdd71]
+- Updated dependencies [3c72b6b]
+- Updated dependencies [9f5c0e3]
+- Updated dependencies [76718b3]
+- Updated dependencies [a8f016c]
+- Updated dependencies [cc1b8e3]
+- Updated dependencies [90bd3c3]
+- Updated dependencies [1cc61e8]
+- Updated dependencies [606f53e]
+- Updated dependencies [c7203b9]
+- Updated dependencies [bb17724]
+- Updated dependencies [da2429d]
+- Updated dependencies [1cc61e8]
+- Updated dependencies [491a84f]
+- Updated dependencies [fb8962f]
+- Updated dependencies [f0ae1b9]
+- Updated dependencies [b1ad9c7]
+- Updated dependencies [0dfa8b8]
+- Updated dependencies [7fab2a2]
+- Updated dependencies [cb367b9]
+- Updated dependencies [543c7e4]
+- Updated dependencies [075aa99]
+- Updated dependencies [ae43ac7]
+- Updated dependencies [ccec8e7]
+- Updated dependencies [4158906]
+- Updated dependencies [ac944ef]
+- Updated dependencies [d3d6938]
+- Updated dependencies [7d2fd48]
+- Updated dependencies [cc7c0d2]
+- Updated dependencies [efb48dc]
+- Updated dependencies [d5d4eed]
+- Updated dependencies [095f659]
+- Updated dependencies [96704a1]
+- Updated dependencies [bb8baa7]
+- Updated dependencies [cb367b9]
+- Updated dependencies [7b1c189]
+- Updated dependencies [51b04c3]
+- Updated dependencies [6c480a4]
+- Updated dependencies [d01b81f]
+- Updated dependencies [3ed41f4]
+- Updated dependencies [8ffb1a7]
+- Updated dependencies [05fb1ae]
+- Updated dependencies [71de2b3]
+- Updated dependencies [10bc391]
+- Updated dependencies [831f574]
+- Updated dependencies [2df8b71]
+- Updated dependencies [ed1a7fe]
+- Updated dependencies [15549a9]
+- Updated dependencies [cc7c0d2]
+- Updated dependencies [5bf7768]
+- Updated dependencies [ae43ac7]
+- Updated dependencies [a5fdbf9]
+- Updated dependencies [9d3f00b]
+- Updated dependencies [efb48dc]
+- Updated dependencies [6b3d87a]
+- Updated dependencies [9587dac]
+- Updated dependencies [09a999a]
+- Updated dependencies [559f903]
+- Updated dependencies [3574905]
+  - @pnpm/config.reader@1005.0.0
+  - @pnpm/types@1001.0.0
+  - @pnpm/cli.utils@1002.0.0
+  - @pnpm/config.pick-registry-for-package@1001.0.0
+  - @pnpm/network.auth-header@1001.0.0
+  - @pnpm/error@1001.0.0
+  - @pnpm/network.fetch@1001.0.0
+  - @pnpm/resolving.registry.types@1000.1.0

package/lib/access.js

@@ -5,10 +5,9 @@ import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
 import { createFetchFromRegistry } from '@pnpm/network.fetch';
 import npa from '@pnpm/npm-package-arg';
 import { renderHelp } from 'render-help';
-import { normalizeRegistryUrl, rcOptionsTypes } from './common.js';
+import { normalizeRegistryUrl, rcOptionsTypes, readErrorBody } from './common.js';
 export { rcOptionsTypes };
 const DEFAULT_REGISTRY_URL = 'https://registry.npmjs.org/';
-const ERROR_BODY_LIMIT = 64 * 1024;
 function getRegistries(opts) {
     return opts.registries ?? { default: DEFAULT_REGISTRY_URL };
 }
@@ -452,37 +451,6 @@ async function throwRegistryError(response, action) {
     }
     throw new PnpmError('REGISTRY_ERROR', `Failed to ${action} package: ${response.status} ${response.statusText}. ${errorBody}`);
 }
-async function readErrorBody(response) {
-    const reader = response.body?.getReader();
-    if (reader == null)
-        return '';
-    const chunks = [];
-    let total = 0;
-    let truncated = false;
-    while (total < ERROR_BODY_LIMIT) {
-        // eslint-disable-next-line no-await-in-loop
-        const { done, value } = await reader.read();
-        if (done)
-            break;
-        const need = ERROR_BODY_LIMIT - total;
-        if (value.length > need) {
-            chunks.push(value.subarray(0, need));
-            truncated = true;
-            break;
-        }
-        chunks.push(value);
-        total += value.length;
-    }
-    reader.cancel().catch(() => { });
-    let body = new TextDecoder().decode(Buffer.concat(chunks));
-    if (truncated) {
-        if (body.length > 0 && !body.endsWith(' ')) {
-            body += ' ';
-        }
-        body += '(response body truncated)';
-    }
-    return body;
-}
 function sanitize(text) {
     let result = '';
     for (let i = 0; i < text.length; i++) {

package/lib/common.d.ts

@@ -5,3 +5,9 @@ export declare function parsePackageSpec(spec: string): {
     versionRange: string | undefined;
 };
 export declare function normalizeRegistryUrl(registryUrl: string): string;
+/**
+ * Reads at most ERROR_BODY_LIMIT bytes of the response body. Registry
+ * responses are untrusted, so the read is bounded before decoding rather
+ * than truncated after buffering the whole body.
+ */
+export declare function readErrorBody(response: Response): Promise<string>;

package/lib/common.js

@@ -24,4 +24,41 @@ export function parsePackageSpec(spec) {
 export function normalizeRegistryUrl(registryUrl) {
     return registryUrl.endsWith('/') ? registryUrl : `${registryUrl}/`;
 }
+const ERROR_BODY_LIMIT = 64 * 1024;
+/**
+ * Reads at most ERROR_BODY_LIMIT bytes of the response body. Registry
+ * responses are untrusted, so the read is bounded before decoding rather
+ * than truncated after buffering the whole body.
+ */
+export async function readErrorBody(response) {
+    const reader = response.body?.getReader();
+    if (reader == null)
+        return '';
+    const chunks = [];
+    let total = 0;
+    let truncated = false;
+    while (total < ERROR_BODY_LIMIT) {
+        // eslint-disable-next-line no-await-in-loop
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        const need = ERROR_BODY_LIMIT - total;
+        if (value.length > need) {
+            chunks.push(value.subarray(0, need));
+            truncated = true;
+            break;
+        }
+        chunks.push(value);
+        total += value.length;
+    }
+    reader.cancel().catch(() => { });
+    let body = new TextDecoder().decode(Buffer.concat(chunks));
+    if (truncated) {
+        if (body.length > 0 && !body.endsWith(' ')) {
+            body += ' ';
+        }
+        body += '(response body truncated)';
+    }
+    return body;
+}
 //# sourceMappingURL=common.js.map

package/lib/index.d.ts

@@ -8,6 +8,7 @@ import * as search from './search.js';
 import * as star from './star/star.js';
 import * as stars from './star/stars.js';
 import * as unstar from './star/unstar.js';
+import * as team from './team.js';
 import * as unpublish from './unpublish.js';
 import * as whoami from './whoami.js';
-export { access, deprecate, distTag, owner, ping, search, star, stars, undeprecate, unpublish, unstar, whoami };
+export { access, deprecate, distTag, owner, ping, search, star, stars, team, undeprecate, unpublish, unstar, whoami };

package/lib/index.js

@@ -8,7 +8,8 @@ import * as search from './search.js';
 import * as star from './star/star.js';
 import * as stars from './star/stars.js';
 import * as unstar from './star/unstar.js';
+import * as team from './team.js';
 import * as unpublish from './unpublish.js';
 import * as whoami from './whoami.js';
-export { access, deprecate, distTag, owner, ping, search, star, stars, undeprecate, unpublish, unstar, whoami };
+export { access, deprecate, distTag, owner, ping, search, star, stars, team, undeprecate, unpublish, unstar, whoami };
 //# sourceMappingURL=index.js.map

package/lib/team.d.ts

@@ -0,0 +1,17 @@
+import { type CreateFetchFromRegistryOptions } from '@pnpm/network.fetch';
+import type { Registries, RegistryConfig } from '@pnpm/types';
+import { rcOptionsTypes } from './common.js';
+export { rcOptionsTypes };
+export declare function cliOptionsTypes(): Record<string, unknown>;
+export declare const commandNames: string[];
+export declare function help(): string;
+export interface TeamOptions extends CreateFetchFromRegistryOptions {
+    cliOptions?: {
+        otp?: string;
+        parseable?: boolean;
+        json?: boolean;
+    };
+    configByUri?: Record<string, RegistryConfig>;
+    registries?: Registries;
+}
+export declare function handler(opts: TeamOptions, params: string[]): Promise<string>;

package/lib/team.js

@@ -0,0 +1,341 @@
+import { docsUrl } from '@pnpm/cli.utils';
+import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
+import { PnpmError } from '@pnpm/error';
+import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
+import { createFetchFromRegistry } from '@pnpm/network.fetch';
+import { renderHelp } from 'render-help';
+import { normalizeRegistryUrl, rcOptionsTypes, readErrorBody } from './common.js';
+export { rcOptionsTypes };
+export function cliOptionsTypes() {
+    return {
+        ...rcOptionsTypes(),
+        otp: String,
+        parseable: Boolean,
+        json: Boolean,
+    };
+}
+export const commandNames = ['team'];
+export function help() {
+    return renderHelp({
+        description: 'Manage organization teams and team memberships.',
+        descriptionLists: [
+            {
+                title: 'Commands',
+                list: [
+                    {
+                        description: 'Create a new team in an organization.',
+                        name: 'create',
+                    },
+                    {
+                        description: 'Destroy an existing team.',
+                        name: 'destroy',
+                    },
+                    {
+                        description: 'Add a user to an existing team.',
+                        name: 'add',
+                    },
+                    {
+                        description: 'Remove a user from an existing team.',
+                        name: 'rm',
+                    },
+                    {
+                        description: 'List teams in an organization or users in a team.',
+                        name: 'ls',
+                    },
+                ],
+            },
+            {
+                title: 'Options',
+                list: [
+                    {
+                        description: 'The base URL of the npm registry.',
+                        name: '--registry <url>',
+                    },
+                    {
+                        description: 'One-time password for registries that require two-factor authentication.',
+                        name: '--otp',
+                    },
+                    {
+                        description: 'Output parseable results.',
+                        name: '--parseable',
+                    },
+                    {
+                        description: 'Output results as JSON.',
+                        name: '--json',
+                    },
+                ],
+            },
+        ],
+        url: docsUrl('team'),
+        usages: [
+            'pnpm team create <scope:team> [--otp <code>]',
+            'pnpm team destroy <scope:team> [--otp <code>]',
+            'pnpm team add <scope:team> <user> [--otp <code>]',
+            'pnpm team rm <scope:team> <user> [--otp <code>]',
+            'pnpm team ls <scope|scope:team>',
+        ],
+    });
+}
+export async function handler(opts, params) {
+    switch (params[0]) {
+        case 'create':
+            return teamCreate(opts, params.slice(1));
+        case 'destroy':
+            return teamDestroy(opts, params.slice(1));
+        case 'add':
+            return teamAdd(opts, params.slice(1));
+        case 'rm':
+            return teamRm(opts, params.slice(1));
+        case 'ls':
+        case 'list':
+            return teamLs(opts, params.slice(1));
+        default:
+            // When no subcommand is given, assume the first arg is a scope:team
+            // and list members, or a scope and list teams. This matches npm behavior
+            // where `npm team ls` is the default.
+            if (params.length > 0 && (params[0].startsWith('@') || params[0].startsWith(':'))) {
+                return teamLs(opts, params);
+            }
+            throw new PnpmError('TEAM_SUBCOMMAND_REQUIRED', 'Subcommand is required (create, destroy, add, rm, ls). Use `pnpm team ls <scope>` to list teams.');
+    }
+}
+async function teamCreate(opts, params) {
+    if (params.length === 0) {
+        throw new PnpmError('TEAM_CREATE_SCOPE_REQUIRED', 'Team scope is required (e.g., pnpm team create @org:newteam)');
+    }
+    const { scope, team } = parseScopeTeam(params[0]);
+    if (!team) {
+        throw new PnpmError('TEAM_CREATE_NAME_REQUIRED', 'Team name is required (e.g., pnpm team create @org:newteam)');
+    }
+    const { registryUrl, authHeader } = getRegistryAndAuthForOrg(opts, scope);
+    const fetchFromRegistry = createFetchFromRegistry(opts);
+    const otp = opts.cliOptions?.otp;
+    const teamUrl = getOrgTeamsUrl(registryUrl, scope);
+    const response = await fetchFromRegistry(teamUrl, {
+        authHeaderValue: authHeader,
+        method: 'PUT',
+        headers: {
+            'content-type': 'application/json',
+            ...(otp ? { 'npm-otp': otp } : {}),
+        },
+        body: JSON.stringify({ name: team }),
+    });
+    if (!response.ok) {
+        await throwRegistryError(response, `create team "${scope}:${team}"`);
+    }
+    return `+${scope}:${team}`;
+}
+async function teamDestroy(opts, params) {
+    if (params.length === 0) {
+        throw new PnpmError('TEAM_DESTROY_SCOPE_REQUIRED', 'Team scope is required (e.g., pnpm team destroy @org:newteam)');
+    }
+    const { scope, team } = parseScopeTeam(params[0]);
+    if (!team) {
+        throw new PnpmError('TEAM_DESTROY_NAME_REQUIRED', 'Team name is required (e.g., pnpm team destroy @org:newteam)');
+    }
+    const { registryUrl, authHeader } = getRegistryAndAuthForOrg(opts, scope);
+    const fetchFromRegistry = createFetchFromRegistry(opts);
+    const otp = opts.cliOptions?.otp;
+    const teamUrl = getTeamUrl(registryUrl, scope, team);
+    const response = await fetchFromRegistry(teamUrl, {
+        authHeaderValue: authHeader,
+        method: 'DELETE',
+        headers: {
+            ...(otp ? { 'npm-otp': otp } : {}),
+        },
+    });
+    if (!response.ok) {
+        await throwRegistryError(response, `destroy team "${scope}:${team}"`);
+    }
+    return `-${scope}:${team}`;
+}
+async function teamAdd(opts, params) {
+    if (params.length < 2) {
+        throw new PnpmError('TEAM_ADD_ARGS_REQUIRED', 'Team scope and user are required (e.g., pnpm team add @org:team username)');
+    }
+    const { scope, team } = parseScopeTeam(params[0]);
+    if (!team) {
+        throw new PnpmError('TEAM_ADD_NAME_REQUIRED', 'Team name is required (e.g., pnpm team add @org:team username)');
+    }
+    const username = params[1];
+    const { registryUrl, authHeader } = getRegistryAndAuthForOrg(opts, scope);
+    const fetchFromRegistry = createFetchFromRegistry(opts);
+    const otp = opts.cliOptions?.otp;
+    const membersUrl = getTeamMembersUrl(registryUrl, scope, team);
+    const response = await fetchFromRegistry(membersUrl, {
+        authHeaderValue: authHeader,
+        method: 'PUT',
+        headers: {
+            'content-type': 'application/json',
+            ...(otp ? { 'npm-otp': otp } : {}),
+        },
+        body: JSON.stringify({ user: username }),
+    });
+    if (!response.ok) {
+        await throwRegistryError(response, `add user "${username}" to team "${scope}:${team}"`);
+    }
+    return `+${username} added to @${scope}:${team}`;
+}
+async function teamRm(opts, params) {
+    if (params.length < 2) {
+        throw new PnpmError('TEAM_RM_ARGS_REQUIRED', 'Team scope and user are required (e.g., pnpm team rm @org:team username)');
+    }
+    const { scope, team } = parseScopeTeam(params[0]);
+    if (!team) {
+        throw new PnpmError('TEAM_RM_NAME_REQUIRED', 'Team name is required (e.g., pnpm team rm @org:team username)');
+    }
+    const username = params[1];
+    const { registryUrl, authHeader } = getRegistryAndAuthForOrg(opts, scope);
+    const fetchFromRegistry = createFetchFromRegistry(opts);
+    const otp = opts.cliOptions?.otp;
+    const membersUrl = getTeamMembersUrl(registryUrl, scope, team);
+    const response = await fetchFromRegistry(membersUrl, {
+        authHeaderValue: authHeader,
+        method: 'DELETE',
+        headers: {
+            'content-type': 'application/json',
+            ...(otp ? { 'npm-otp': otp } : {}),
+        },
+        body: JSON.stringify({ user: username }),
+    });
+    if (!response.ok) {
+        await throwRegistryError(response, `remove user "${username}" from team "${scope}:${team}"`);
+    }
+    return `-${username} removed from @${scope}:${team}`;
+}
+async function teamLs(opts, params) {
+    if (params.length === 0) {
+        throw new PnpmError('TEAM_LS_SCOPE_REQUIRED', 'Organization scope is required (e.g., pnpm team ls @org or pnpm team ls @org:team)');
+    }
+    const { scope, team } = parseScopeTeam(params[0]);
+    const { registryUrl, authHeader } = getRegistryAndAuthForOrg(opts, scope);
+    const fetchFromRegistry = createFetchFromRegistry(opts);
+    const parseable = opts.cliOptions?.parseable ?? false;
+    const json = opts.cliOptions?.json ?? false;
+    if (team) {
+        return teamListMembers({ scope, team, registryUrl, fetchFromRegistry, authHeader, parseable, json });
+    }
+    return teamListTeams({ scope, registryUrl, fetchFromRegistry, authHeader, parseable, json });
+}
+async function teamListTeams(options) {
+    const { scope, registryUrl, fetchFromRegistry, authHeader, parseable, json } = options;
+    const teamsUrl = getOrgTeamsUrl(registryUrl, scope);
+    const response = await fetchFromRegistry(teamsUrl, {
+        authHeaderValue: authHeader,
+    });
+    if (!response.ok) {
+        if (response.status === 404) {
+            throw new PnpmError('ORG_NOT_FOUND', `Organization "@${scope}" not found in registry`);
+        }
+        await throwRegistryError(response, `fetch teams for "@${scope}"`);
+    }
+    const teams = await response.json();
+    if (json) {
+        return JSON.stringify(teams.map(t => t.name), null, 2);
+    }
+    if (parseable) {
+        return teams.map(t => t.name).join('\n');
+    }
+    if (teams.length === 0) {
+        return `@${scope} has no teams`;
+    }
+    const lines = [`@${scope} has the following teams:`];
+    for (const { name } of teams) {
+        lines.push(`  @${scope}:${name}`);
+    }
+    return lines.join('\n');
+}
+async function teamListMembers(options) {
+    const { scope, team, registryUrl, fetchFromRegistry, authHeader, parseable, json } = options;
+    const membersUrl = getTeamMembersUrl(registryUrl, scope, team);
+    const response = await fetchFromRegistry(membersUrl, {
+        authHeaderValue: authHeader,
+    });
+    if (!response.ok) {
+        if (response.status === 404) {
+            throw new PnpmError('TEAM_NOT_FOUND', `Team "@${scope}:${team}" not found in registry`);
+        }
+        await throwRegistryError(response, `fetch team members for "@${scope}:${team}"`);
+    }
+    const members = await response.json();
+    if (json) {
+        return JSON.stringify(members.map(m => m.name), null, 2);
+    }
+    if (parseable) {
+        return members.map(m => m.name).join('\n');
+    }
+    if (members.length === 0) {
+        return `@${scope}:${team} has no members`;
+    }
+    const lines = [`@${scope}:${team} has the following members:`];
+    for (const { name } of members) {
+        lines.push(`  ${name}`);
+    }
+    return lines.join('\n');
+}
+/**
+ * Parse a scope:team string. Returns the scope (without @) and optional team name.
+ * Format: @scope or @scope:team
+ */
+function parseScopeTeam(spec) {
+    if (!spec.startsWith('@')) {
+        throw new PnpmError('TEAM_INVALID_SCOPE', `Team spec must start with @scope, got "${spec}". Use @scope or @scope:team format.`);
+    }
+    const inner = spec.slice(1);
+    if (!inner) {
+        throw new PnpmError('TEAM_INVALID_SCOPE', `Team spec must start with @scope, got "${spec}". Use @scope or @scope:team format.`);
+    }
+    const colonIndex = inner.indexOf(':');
+    if (colonIndex === -1) {
+        return { scope: inner };
+    }
+    const scope = inner.slice(0, colonIndex);
+    const team = inner.slice(colonIndex + 1);
+    if (!scope || !team) {
+        throw new PnpmError('TEAM_INVALID_SCOPE', `Team spec must start with @scope, got "${spec}". Use @scope or @scope:team format.`);
+    }
+    return { scope, team };
+}
+function getRegistryAndAuthForOrg(opts, scope) {
+    const pkgName = `@${scope}/__pnpm_team__`;
+    const registryUrl = pickRegistryForPackage(opts.registries ?? { default: 'https://registry.npmjs.org/' }, pkgName);
+    const authHeader = getAuthHeaderForRegistry(opts.configByUri, registryUrl, pkgName);
+    return { registryUrl, authHeader };
+}
+function getAuthHeaderForRegistry(configByUri, registryUrl, packageName) {
+    const getAuthHeader = createGetAuthHeaderByURI(configByUri ?? {});
+    return getAuthHeader(registryUrl, { pkgName: packageName });
+}
+function getOrgTeamsUrl(registryUrl, scope) {
+    return new URL(`-/org/${encodeURIComponent(scope)}/team`, normalizeRegistryUrl(registryUrl)).href;
+}
+function getTeamUrl(registryUrl, scope, team) {
+    return new URL(`-/team/${encodeURIComponent(scope)}/${encodeURIComponent(team)}`, normalizeRegistryUrl(registryUrl)).href;
+}
+function getTeamMembersUrl(registryUrl, scope, team) {
+    return new URL(`-/team/${encodeURIComponent(scope)}/${encodeURIComponent(team)}/user`, normalizeRegistryUrl(registryUrl)).href;
+}
+async function throwRegistryError(response, action) {
+    const errorBody = await readErrorBody(response);
+    const safeErrorBody = [...errorBody]
+        .filter(c => {
+        const code = c.charCodeAt(0);
+        return code > 0x1f && (code < 0x7f || code > 0x9f);
+    })
+        .join('')
+        .slice(0, 500);
+    if (response.status === 401) {
+        throw new PnpmError('UNAUTHORIZED', `You must be logged in to ${action}. ${safeErrorBody}`);
+    }
+    if (response.status === 403) {
+        throw new PnpmError('FORBIDDEN', `You do not have permission to ${action}. ${safeErrorBody}`);
+    }
+    if (response.status === 404) {
+        throw new PnpmError('NOT_FOUND', `Organization or team not found. ${safeErrorBody}`);
+    }
+    if (response.status === 409) {
+        throw new PnpmError('TEAM_CONFLICT', `Team operation failed due to conflict. ${safeErrorBody}`);
+    }
+    throw new PnpmError('REGISTRY_ERROR', `Failed to ${action}: ${response.status} ${response.statusText}. ${safeErrorBody}`);
+}
+//# sourceMappingURL=team.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/registry-access.commands",
-  "version": "1100.4.0",
+  "version": "1100.5.0",
   "description": "Commands for managing packages on the registry",
   "keywords": [
     "pnpm",
@@ -28,37 +28,37 @@
   ],
   "dependencies": {
     "@inquirer/prompts": "^8.4.3",
+    "@pnpm/cli.utils": "1101.0.14",
+    "@pnpm/config.pick-registry-for-package": "1100.0.10",
+    "@pnpm/config.reader": "1101.12.0",
+    "@pnpm/error": "1100.0.1",
+    "@pnpm/network.auth-header": "1101.1.4",
+    "@pnpm/network.fetch": "1100.1.5",
+    "@pnpm/network.web-auth": "1101.2.0",
     "@pnpm/npm-package-arg": "^2.0.0",
+    "@pnpm/registry-access.client": "1100.1.7",
+    "@pnpm/resolving.registry.types": "1100.1.4",
+    "@pnpm/types": "1101.4.0",
     "chalk": "^5.6.2",
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "render-help": "^2.0.0",
-    "semver": "^7.8.4",
-    "@pnpm/cli.utils": "1101.0.13",
-    "@pnpm/config.pick-registry-for-package": "1100.0.9",
-    "@pnpm/config.reader": "1101.11.1",
-    "@pnpm/error": "1100.0.1",
-    "@pnpm/network.fetch": "1100.1.4",
-    "@pnpm/network.web-auth": "1101.2.0",
-    "@pnpm/network.auth-header": "1101.1.3",
-    "@pnpm/registry-access.client": "1100.1.6",
-    "@pnpm/resolving.registry.types": "1100.1.3",
-    "@pnpm/types": "1101.3.2"
+    "semver": "^7.8.4"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
+    "@pnpm/logger": "1100.0.0",
+    "@pnpm/prepare": "1100.0.19",
+    "@pnpm/registry-access.commands": "1100.5.0",
+    "@pnpm/releasing.commands": "1100.6.0",
+    "@pnpm/testing.command-defaults": "1100.0.9",
+    "@pnpm/testing.mock-agent": "1101.0.5",
+    "@pnpm/testing.registry-mock": "1100.0.9",
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
-    "execa": "npm:safe-execa@0.3.0",
-    "@pnpm/logger": "1100.0.0",
-    "@pnpm/registry-access.commands": "1100.4.0",
-    "@pnpm/releasing.commands": "1100.5.4",
-    "@pnpm/testing.command-defaults": "1100.0.8",
-    "@pnpm/testing.mock-agent": "1101.0.4",
-    "@pnpm/prepare": "1100.0.18",
-    "@pnpm/testing.registry-mock": "1100.0.8"
+    "execa": "npm:safe-execa@0.3.0"
   },
   "engines": {
     "node": ">=22.13"