* docs(pnpr): remove stale duplicated docs and fix drifted claims
The crate README and OIDC.md under pnpr/crates/pnpr duplicated the website
docs and had drifted: a compilerCaches key that no longer exists, hardcoded
quota numbers, the old registry/ path. The pnpr.client README used the
pre-rename remoteSideEffectsCache spellings and claimed the artifact owner
must equal the username. Point both at pnpr/docs instead.
Also fix claims the code contradicts: the handshake is served when any
surface is enabled and advertises ecosystems, publish, and pipeline; the
resolve request field is registries, not namedRegistries; pnpm does not
call the handshake before an npm resolve; there is no config reload; the
packument TTL has no config key; and the --config help still described a
verdaccio-shaped file.
Install instructions now name the next dist-tag, because latest still
points at a July 2026 pre-alpha snapshot.
* docs(pnpr): address review on handshake, verify order, and root-mounted endpoints
* docs(pnpr): document the /npm/ registry bases on multi-ecosystem servers
- `GET /-/pnpr/v0/sign-in` lists the OIDC providers that offer browser
sign-in, so the UI's sign-in screen knows which buttons to show.
- `/-/oidc/{provider}/login?return=ui` records in the sealed login
cookie that the sign-in ends in the web UI. The callback then puts a
one-time code in an HttpOnly `__Host-` cookie and redirects to
`/-/ui/sign-in/oidc` instead of showing the token. The redirect is
relative, so it works behind a path prefix. No URL carries the code
or the token, so a forwarded link cannot sign another browser in.
`return=ui` is refused when pnpr serves no web UI.
- `POST /-/oidc/handoff` trades the code in that cookie for the session
token and clears the cookie. A code works once, within a minute.
Codes live in memory next to the sessions they carry, so the existing
affinity requirement for multi-replica OIDC sign-in covers them.
- Browser sessions and handoff codes are grouped in `BrowserSessions`.
Password sign-in needs no server change: the UI uses npm's login
endpoint.
The bundled web UI moves to pnpr-web 0.2.5, which adds the sign-in
screen.
pnpr now serves its web UI at /-/ui/ from the same origin, so the UI
needs no CORS setup and no server URL. The UI ships as the separate
`@pnpm/pnpr-ui` package, an optional peer dependency of `@pnpm/pnpr`.
pnpr finds it next to its own package (npm and pnpm both link a resolved
peer beside the package that declares it), or reads it from `ui.dir`,
and `ui.enabled: false` turns it off.
- Serving: files from the UI directory, `index.html` for every other
path outside `assets/`, a 404 for a missing hashed asset. The page
gets a relative `<base>` so deep routes and path prefixes work without
an absolute Vite base. Responses carry a CSP that keeps scripts and
requests on this origin.
- The UI source stays on bit.cloud. `pnpr/ui` is a workspace of its own
that pins `@pnpm/pnpr.apps.pnpr-web` from bit.cloud's registry and
builds it into `pnpr/npm/pnpr-ui/dist`.
- Release: a `build-pnpr-ui` job builds the bundle. The verify and
publish jobs download it. The smoke test installs the UI beside the
wrapper and checks that pnpr serves it. `@pnpm/pnpr-ui` releases in a
fixed group with `@pnpm/pnpr`.
Zoltan Kochan