@pnpm/registry-access.commands 1100.4.1 → 1100.5.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @pnpm/registry-access.commands
 
+## 1100.5.0
+
+### Minor Changes
+
+- Added the `team` command for managing organization teams and team memberships on the registry, with create, destroy, add, rm, and ls subcommands and support for --otp, --parseable, and --json flags.
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/cli.utils@1101.0.14
+  - @pnpm/config.pick-registry-for-package@1100.0.10
+  - @pnpm/config.reader@1101.12.0
+  - @pnpm/network.auth-header@1101.1.4
+  - @pnpm/network.fetch@1100.1.5
+  - @pnpm/registry-access.client@1100.1.7
+  - @pnpm/resolving.registry.types@1100.1.4
+  - @pnpm/types@1101.4.0
+
 ## 1100.4.1
 
 ### Patch Changes

package/lib/access.js

@@ -5,10 +5,9 @@ import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
 import { createFetchFromRegistry } from '@pnpm/network.fetch';
 import npa from '@pnpm/npm-package-arg';
 import { renderHelp } from 'render-help';
-import { normalizeRegistryUrl, rcOptionsTypes } from './common.js';
+import { normalizeRegistryUrl, rcOptionsTypes, readErrorBody } from './common.js';
 export { rcOptionsTypes };
 const DEFAULT_REGISTRY_URL = 'https://registry.npmjs.org/';
-const ERROR_BODY_LIMIT = 64 * 1024;
 function getRegistries(opts) {
     return opts.registries ?? { default: DEFAULT_REGISTRY_URL };
 }
@@ -452,37 +451,6 @@ async function throwRegistryError(response, action) {
     }
     throw new PnpmError('REGISTRY_ERROR', `Failed to ${action} package: ${response.status} ${response.statusText}. ${errorBody}`);
 }
-async function readErrorBody(response) {
-    const reader = response.body?.getReader();
-    if (reader == null)
-        return '';
-    const chunks = [];
-    let total = 0;
-    let truncated = false;
-    while (total < ERROR_BODY_LIMIT) {
-        // eslint-disable-next-line no-await-in-loop
-        const { done, value } = await reader.read();
-        if (done)
-            break;
-        const need = ERROR_BODY_LIMIT - total;
-        if (value.length > need) {
-            chunks.push(value.subarray(0, need));
-            truncated = true;
-            break;
-        }
-        chunks.push(value);
-        total += value.length;
-    }
-    reader.cancel().catch(() => { });
-    let body = new TextDecoder().decode(Buffer.concat(chunks));
-    if (truncated) {
-        if (body.length > 0 && !body.endsWith(' ')) {
-            body += ' ';
-        }
-        body += '(response body truncated)';
-    }
-    return body;
-}
 function sanitize(text) {
     let result = '';
     for (let i = 0; i < text.length; i++) {

package/lib/common.d.ts

@@ -5,3 +5,9 @@ export declare function parsePackageSpec(spec: string): {
     versionRange: string | undefined;
 };
 export declare function normalizeRegistryUrl(registryUrl: string): string;
+/**
+ * Reads at most ERROR_BODY_LIMIT bytes of the response body. Registry
+ * responses are untrusted, so the read is bounded before decoding rather
+ * than truncated after buffering the whole body.
+ */
+export declare function readErrorBody(response: Response): Promise<string>;

package/lib/common.js

@@ -24,4 +24,41 @@ export function parsePackageSpec(spec) {
 export function normalizeRegistryUrl(registryUrl) {
     return registryUrl.endsWith('/') ? registryUrl : `${registryUrl}/`;
 }
+const ERROR_BODY_LIMIT = 64 * 1024;
+/**
+ * Reads at most ERROR_BODY_LIMIT bytes of the response body. Registry
+ * responses are untrusted, so the read is bounded before decoding rather
+ * than truncated after buffering the whole body.
+ */
+export async function readErrorBody(response) {
+    const reader = response.body?.getReader();
+    if (reader == null)
+        return '';
+    const chunks = [];
+    let total = 0;
+    let truncated = false;
+    while (total < ERROR_BODY_LIMIT) {
+        // eslint-disable-next-line no-await-in-loop
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        const need = ERROR_BODY_LIMIT - total;
+        if (value.length > need) {
+            chunks.push(value.subarray(0, need));
+            truncated = true;
+            break;
+        }
+        chunks.push(value);
+        total += value.length;
+    }
+    reader.cancel().catch(() => { });
+    let body = new TextDecoder().decode(Buffer.concat(chunks));
+    if (truncated) {
+        if (body.length > 0 && !body.endsWith(' ')) {
+            body += ' ';
+        }
+        body += '(response body truncated)';
+    }
+    return body;
+}
 //# sourceMappingURL=common.js.map

package/lib/index.d.ts

@@ -8,6 +8,7 @@ import * as search from './search.js';
 import * as star from './star/star.js';
 import * as stars from './star/stars.js';
 import * as unstar from './star/unstar.js';
+import * as team from './team.js';
 import * as unpublish from './unpublish.js';
 import * as whoami from './whoami.js';
-export { access, deprecate, distTag, owner, ping, search, star, stars, undeprecate, unpublish, unstar, whoami };
+export { access, deprecate, distTag, owner, ping, search, star, stars, team, undeprecate, unpublish, unstar, whoami };

package/lib/index.js

@@ -8,7 +8,8 @@ import * as search from './search.js';
 import * as star from './star/star.js';
 import * as stars from './star/stars.js';
 import * as unstar from './star/unstar.js';
+import * as team from './team.js';
 import * as unpublish from './unpublish.js';
 import * as whoami from './whoami.js';
-export { access, deprecate, distTag, owner, ping, search, star, stars, undeprecate, unpublish, unstar, whoami };
+export { access, deprecate, distTag, owner, ping, search, star, stars, team, undeprecate, unpublish, unstar, whoami };
 //# sourceMappingURL=index.js.map

package/lib/team.d.ts

@@ -0,0 +1,17 @@
+import { type CreateFetchFromRegistryOptions } from '@pnpm/network.fetch';
+import type { Registries, RegistryConfig } from '@pnpm/types';
+import { rcOptionsTypes } from './common.js';
+export { rcOptionsTypes };
+export declare function cliOptionsTypes(): Record<string, unknown>;
+export declare const commandNames: string[];
+export declare function help(): string;
+export interface TeamOptions extends CreateFetchFromRegistryOptions {
+    cliOptions?: {
+        otp?: string;
+        parseable?: boolean;
+        json?: boolean;
+    };
+    configByUri?: Record<string, RegistryConfig>;
+    registries?: Registries;
+}
+export declare function handler(opts: TeamOptions, params: string[]): Promise<string>;

package/lib/team.js

@@ -0,0 +1,341 @@
+import { docsUrl } from '@pnpm/cli.utils';
+import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
+import { PnpmError } from '@pnpm/error';
+import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
+import { createFetchFromRegistry } from '@pnpm/network.fetch';
+import { renderHelp } from 'render-help';
+import { normalizeRegistryUrl, rcOptionsTypes, readErrorBody } from './common.js';
+export { rcOptionsTypes };
+export function cliOptionsTypes() {
+    return {
+        ...rcOptionsTypes(),
+        otp: String,
+        parseable: Boolean,
+        json: Boolean,
+    };
+}
+export const commandNames = ['team'];
+export function help() {
+    return renderHelp({
+        description: 'Manage organization teams and team memberships.',
+        descriptionLists: [
+            {
+                title: 'Commands',
+                list: [
+                    {
+                        description: 'Create a new team in an organization.',
+                        name: 'create',
+                    },
+                    {
+                        description: 'Destroy an existing team.',
+                        name: 'destroy',
+                    },
+                    {
+                        description: 'Add a user to an existing team.',
+                        name: 'add',
+                    },
+                    {
+                        description: 'Remove a user from an existing team.',
+                        name: 'rm',
+                    },
+                    {
+                        description: 'List teams in an organization or users in a team.',
+                        name: 'ls',
+                    },
+                ],
+            },
+            {
+                title: 'Options',
+                list: [
+                    {
+                        description: 'The base URL of the npm registry.',
+                        name: '--registry <url>',
+                    },
+                    {
+                        description: 'One-time password for registries that require two-factor authentication.',
+                        name: '--otp',
+                    },
+                    {
+                        description: 'Output parseable results.',
+                        name: '--parseable',
+                    },
+                    {
+                        description: 'Output results as JSON.',
+                        name: '--json',
+                    },
+                ],
+            },
+        ],
+        url: docsUrl('team'),
+        usages: [
+            'pnpm team create <scope:team> [--otp <code>]',
+            'pnpm team destroy <scope:team> [--otp <code>]',
+            'pnpm team add <scope:team> <user> [--otp <code>]',
+            'pnpm team rm <scope:team> <user> [--otp <code>]',
+            'pnpm team ls <scope|scope:team>',
+        ],
+    });
+}
+export async function handler(opts, params) {
+    switch (params[0]) {
+        case 'create':
+            return teamCreate(opts, params.slice(1));
+        case 'destroy':
+            return teamDestroy(opts, params.slice(1));
+        case 'add':
+            return teamAdd(opts, params.slice(1));
+        case 'rm':
+            return teamRm(opts, params.slice(1));
+        case 'ls':
+        case 'list':
+            return teamLs(opts, params.slice(1));
+        default:
+            // When no subcommand is given, assume the first arg is a scope:team
+            // and list members, or a scope and list teams. This matches npm behavior
+            // where `npm team ls` is the default.
+            if (params.length > 0 && (params[0].startsWith('@') || params[0].startsWith(':'))) {
+                return teamLs(opts, params);
+            }
+            throw new PnpmError('TEAM_SUBCOMMAND_REQUIRED', 'Subcommand is required (create, destroy, add, rm, ls). Use `pnpm team ls <scope>` to list teams.');
+    }
+}
+async function teamCreate(opts, params) {
+    if (params.length === 0) {
+        throw new PnpmError('TEAM_CREATE_SCOPE_REQUIRED', 'Team scope is required (e.g., pnpm team create @org:newteam)');
+    }
+    const { scope, team } = parseScopeTeam(params[0]);
+    if (!team) {
+        throw new PnpmError('TEAM_CREATE_NAME_REQUIRED', 'Team name is required (e.g., pnpm team create @org:newteam)');
+    }
+    const { registryUrl, authHeader } = getRegistryAndAuthForOrg(opts, scope);
+    const fetchFromRegistry = createFetchFromRegistry(opts);
+    const otp = opts.cliOptions?.otp;
+    const teamUrl = getOrgTeamsUrl(registryUrl, scope);
+    const response = await fetchFromRegistry(teamUrl, {
+        authHeaderValue: authHeader,
+        method: 'PUT',
+        headers: {
+            'content-type': 'application/json',
+            ...(otp ? { 'npm-otp': otp } : {}),
+        },
+        body: JSON.stringify({ name: team }),
+    });
+    if (!response.ok) {
+        await throwRegistryError(response, `create team "${scope}:${team}"`);
+    }
+    return `+${scope}:${team}`;
+}
+async function teamDestroy(opts, params) {
+    if (params.length === 0) {
+        throw new PnpmError('TEAM_DESTROY_SCOPE_REQUIRED', 'Team scope is required (e.g., pnpm team destroy @org:newteam)');
+    }
+    const { scope, team } = parseScopeTeam(params[0]);
+    if (!team) {
+        throw new PnpmError('TEAM_DESTROY_NAME_REQUIRED', 'Team name is required (e.g., pnpm team destroy @org:newteam)');
+    }
+    const { registryUrl, authHeader } = getRegistryAndAuthForOrg(opts, scope);
+    const fetchFromRegistry = createFetchFromRegistry(opts);
+    const otp = opts.cliOptions?.otp;
+    const teamUrl = getTeamUrl(registryUrl, scope, team);
+    const response = await fetchFromRegistry(teamUrl, {
+        authHeaderValue: authHeader,
+        method: 'DELETE',
+        headers: {
+            ...(otp ? { 'npm-otp': otp } : {}),
+        },
+    });
+    if (!response.ok) {
+        await throwRegistryError(response, `destroy team "${scope}:${team}"`);
+    }
+    return `-${scope}:${team}`;
+}
+async function teamAdd(opts, params) {
+    if (params.length < 2) {
+        throw new PnpmError('TEAM_ADD_ARGS_REQUIRED', 'Team scope and user are required (e.g., pnpm team add @org:team username)');
+    }
+    const { scope, team } = parseScopeTeam(params[0]);
+    if (!team) {
+        throw new PnpmError('TEAM_ADD_NAME_REQUIRED', 'Team name is required (e.g., pnpm team add @org:team username)');
+    }
+    const username = params[1];
+    const { registryUrl, authHeader } = getRegistryAndAuthForOrg(opts, scope);
+    const fetchFromRegistry = createFetchFromRegistry(opts);
+    const otp = opts.cliOptions?.otp;
+    const membersUrl = getTeamMembersUrl(registryUrl, scope, team);
+    const response = await fetchFromRegistry(membersUrl, {
+        authHeaderValue: authHeader,
+        method: 'PUT',
+        headers: {
+            'content-type': 'application/json',
+            ...(otp ? { 'npm-otp': otp } : {}),
+        },
+        body: JSON.stringify({ user: username }),
+    });
+    if (!response.ok) {
+        await throwRegistryError(response, `add user "${username}" to team "${scope}:${team}"`);
+    }
+    return `+${username} added to @${scope}:${team}`;
+}
+async function teamRm(opts, params) {
+    if (params.length < 2) {
+        throw new PnpmError('TEAM_RM_ARGS_REQUIRED', 'Team scope and user are required (e.g., pnpm team rm @org:team username)');
+    }
+    const { scope, team } = parseScopeTeam(params[0]);
+    if (!team) {
+        throw new PnpmError('TEAM_RM_NAME_REQUIRED', 'Team name is required (e.g., pnpm team rm @org:team username)');
+    }
+    const username = params[1];
+    const { registryUrl, authHeader } = getRegistryAndAuthForOrg(opts, scope);
+    const fetchFromRegistry = createFetchFromRegistry(opts);
+    const otp = opts.cliOptions?.otp;
+    const membersUrl = getTeamMembersUrl(registryUrl, scope, team);
+    const response = await fetchFromRegistry(membersUrl, {
+        authHeaderValue: authHeader,
+        method: 'DELETE',
+        headers: {
+            'content-type': 'application/json',
+            ...(otp ? { 'npm-otp': otp } : {}),
+        },
+        body: JSON.stringify({ user: username }),
+    });
+    if (!response.ok) {
+        await throwRegistryError(response, `remove user "${username}" from team "${scope}:${team}"`);
+    }
+    return `-${username} removed from @${scope}:${team}`;
+}
+async function teamLs(opts, params) {
+    if (params.length === 0) {
+        throw new PnpmError('TEAM_LS_SCOPE_REQUIRED', 'Organization scope is required (e.g., pnpm team ls @org or pnpm team ls @org:team)');
+    }
+    const { scope, team } = parseScopeTeam(params[0]);
+    const { registryUrl, authHeader } = getRegistryAndAuthForOrg(opts, scope);
+    const fetchFromRegistry = createFetchFromRegistry(opts);
+    const parseable = opts.cliOptions?.parseable ?? false;
+    const json = opts.cliOptions?.json ?? false;
+    if (team) {
+        return teamListMembers({ scope, team, registryUrl, fetchFromRegistry, authHeader, parseable, json });
+    }
+    return teamListTeams({ scope, registryUrl, fetchFromRegistry, authHeader, parseable, json });
+}
+async function teamListTeams(options) {
+    const { scope, registryUrl, fetchFromRegistry, authHeader, parseable, json } = options;
+    const teamsUrl = getOrgTeamsUrl(registryUrl, scope);
+    const response = await fetchFromRegistry(teamsUrl, {
+        authHeaderValue: authHeader,
+    });
+    if (!response.ok) {
+        if (response.status === 404) {
+            throw new PnpmError('ORG_NOT_FOUND', `Organization "@${scope}" not found in registry`);
+        }
+        await throwRegistryError(response, `fetch teams for "@${scope}"`);
+    }
+    const teams = await response.json();
+    if (json) {
+        return JSON.stringify(teams.map(t => t.name), null, 2);
+    }
+    if (parseable) {
+        return teams.map(t => t.name).join('\n');
+    }
+    if (teams.length === 0) {
+        return `@${scope} has no teams`;
+    }
+    const lines = [`@${scope} has the following teams:`];
+    for (const { name } of teams) {
+        lines.push(`  @${scope}:${name}`);
+    }
+    return lines.join('\n');
+}
+async function teamListMembers(options) {
+    const { scope, team, registryUrl, fetchFromRegistry, authHeader, parseable, json } = options;
+    const membersUrl = getTeamMembersUrl(registryUrl, scope, team);
+    const response = await fetchFromRegistry(membersUrl, {
+        authHeaderValue: authHeader,
+    });
+    if (!response.ok) {
+        if (response.status === 404) {
+            throw new PnpmError('TEAM_NOT_FOUND', `Team "@${scope}:${team}" not found in registry`);
+        }
+        await throwRegistryError(response, `fetch team members for "@${scope}:${team}"`);
+    }
+    const members = await response.json();
+    if (json) {
+        return JSON.stringify(members.map(m => m.name), null, 2);
+    }
+    if (parseable) {
+        return members.map(m => m.name).join('\n');
+    }
+    if (members.length === 0) {
+        return `@${scope}:${team} has no members`;
+    }
+    const lines = [`@${scope}:${team} has the following members:`];
+    for (const { name } of members) {
+        lines.push(`  ${name}`);
+    }
+    return lines.join('\n');
+}
+/**
+ * Parse a scope:team string. Returns the scope (without @) and optional team name.
+ * Format: @scope or @scope:team
+ */
+function parseScopeTeam(spec) {
+    if (!spec.startsWith('@')) {
+        throw new PnpmError('TEAM_INVALID_SCOPE', `Team spec must start with @scope, got "${spec}". Use @scope or @scope:team format.`);
+    }
+    const inner = spec.slice(1);
+    if (!inner) {
+        throw new PnpmError('TEAM_INVALID_SCOPE', `Team spec must start with @scope, got "${spec}". Use @scope or @scope:team format.`);
+    }
+    const colonIndex = inner.indexOf(':');
+    if (colonIndex === -1) {
+        return { scope: inner };
+    }
+    const scope = inner.slice(0, colonIndex);
+    const team = inner.slice(colonIndex + 1);
+    if (!scope || !team) {
+        throw new PnpmError('TEAM_INVALID_SCOPE', `Team spec must start with @scope, got "${spec}". Use @scope or @scope:team format.`);
+    }
+    return { scope, team };
+}
+function getRegistryAndAuthForOrg(opts, scope) {
+    const pkgName = `@${scope}/__pnpm_team__`;
+    const registryUrl = pickRegistryForPackage(opts.registries ?? { default: 'https://registry.npmjs.org/' }, pkgName);
+    const authHeader = getAuthHeaderForRegistry(opts.configByUri, registryUrl, pkgName);
+    return { registryUrl, authHeader };
+}
+function getAuthHeaderForRegistry(configByUri, registryUrl, packageName) {
+    const getAuthHeader = createGetAuthHeaderByURI(configByUri ?? {});
+    return getAuthHeader(registryUrl, { pkgName: packageName });
+}
+function getOrgTeamsUrl(registryUrl, scope) {
+    return new URL(`-/org/${encodeURIComponent(scope)}/team`, normalizeRegistryUrl(registryUrl)).href;
+}
+function getTeamUrl(registryUrl, scope, team) {
+    return new URL(`-/team/${encodeURIComponent(scope)}/${encodeURIComponent(team)}`, normalizeRegistryUrl(registryUrl)).href;
+}
+function getTeamMembersUrl(registryUrl, scope, team) {
+    return new URL(`-/team/${encodeURIComponent(scope)}/${encodeURIComponent(team)}/user`, normalizeRegistryUrl(registryUrl)).href;
+}
+async function throwRegistryError(response, action) {
+    const errorBody = await readErrorBody(response);
+    const safeErrorBody = [...errorBody]
+        .filter(c => {
+        const code = c.charCodeAt(0);
+        return code > 0x1f && (code < 0x7f || code > 0x9f);
+    })
+        .join('')
+        .slice(0, 500);
+    if (response.status === 401) {
+        throw new PnpmError('UNAUTHORIZED', `You must be logged in to ${action}. ${safeErrorBody}`);
+    }
+    if (response.status === 403) {
+        throw new PnpmError('FORBIDDEN', `You do not have permission to ${action}. ${safeErrorBody}`);
+    }
+    if (response.status === 404) {
+        throw new PnpmError('NOT_FOUND', `Organization or team not found. ${safeErrorBody}`);
+    }
+    if (response.status === 409) {
+        throw new PnpmError('TEAM_CONFLICT', `Team operation failed due to conflict. ${safeErrorBody}`);
+    }
+    throw new PnpmError('REGISTRY_ERROR', `Failed to ${action}: ${response.status} ${response.statusText}. ${safeErrorBody}`);
+}
+//# sourceMappingURL=team.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/registry-access.commands",
-  "version": "1100.4.1",
+  "version": "1100.5.0",
   "description": "Commands for managing packages on the registry",
   "keywords": [
     "pnpm",
@@ -28,17 +28,17 @@
   ],
   "dependencies": {
     "@inquirer/prompts": "^8.4.3",
-    "@pnpm/cli.utils": "1101.0.13",
-    "@pnpm/config.pick-registry-for-package": "1100.0.9",
-    "@pnpm/config.reader": "1101.11.2",
+    "@pnpm/cli.utils": "1101.0.14",
+    "@pnpm/config.pick-registry-for-package": "1100.0.10",
+    "@pnpm/config.reader": "1101.12.0",
     "@pnpm/error": "1100.0.1",
-    "@pnpm/network.auth-header": "1101.1.3",
-    "@pnpm/network.fetch": "1100.1.4",
+    "@pnpm/network.auth-header": "1101.1.4",
+    "@pnpm/network.fetch": "1100.1.5",
     "@pnpm/network.web-auth": "1101.2.0",
     "@pnpm/npm-package-arg": "^2.0.0",
-    "@pnpm/registry-access.client": "1100.1.6",
-    "@pnpm/resolving.registry.types": "1100.1.3",
-    "@pnpm/types": "1101.3.2",
+    "@pnpm/registry-access.client": "1100.1.7",
+    "@pnpm/resolving.registry.types": "1100.1.4",
+    "@pnpm/types": "1101.4.0",
     "chalk": "^5.6.2",
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "render-help": "^2.0.0",
@@ -50,12 +50,12 @@
   "devDependencies": {
     "@jest/globals": "30.4.1",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/prepare": "1100.0.18",
-    "@pnpm/registry-access.commands": "1100.4.1",
-    "@pnpm/releasing.commands": "1100.5.5",
-    "@pnpm/testing.command-defaults": "1100.0.8",
-    "@pnpm/testing.mock-agent": "1101.0.4",
-    "@pnpm/testing.registry-mock": "1100.0.8",
+    "@pnpm/prepare": "1100.0.19",
+    "@pnpm/registry-access.commands": "1100.5.0",
+    "@pnpm/releasing.commands": "1100.6.0",
+    "@pnpm/testing.command-defaults": "1100.0.9",
+    "@pnpm/testing.mock-agent": "1101.0.5",
+    "@pnpm/testing.registry-mock": "1100.0.9",
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
     "execa": "npm:safe-execa@0.3.0"