mirror of
https://github.com/pnpm/pnpm.git
synced 2026-07-14 01:32:40 -04:00
6a85968c12
Port `pnpm stage` (publish, list, view, approve, reject, download) to the Rust CLI, mirroring the TypeScript command's flags, error codes, endpoints, and output. `stage publish` reuses the publish pipeline (PublishArgs is split into a reusable PublishFlags, and the pipeline returns summaries instead of printing); approve/reject drive the shared OTP / web-auth flow; download summarizes the tarball with the same traversal protections as the TypeScript implementation. Also fixes the staged-publish route in pacquet-publish to POST -/stage/package/:pkg (libnpmpublish's stage route) instead of the regular packument PUT — previously unreachable because the CLI hardcoded stage: false. pnpr grows the server half: POST /-/stage/package/:pkg validates and authorizes like a direct publish and holds the document under a UUID; list/view/tarball inspect held records; approve replays the document through the regular validate/stage/commit flow; reject deletes it. Records persist under a reserved .staged/ namespace on the fs and S3 backends, with stage-id validation ahead of any path or object key. Shared plumbing: the capped response-body reader moves from the dist-tag command into pacquet-network, and pacquet-pack exports its en-locale path sort for the tarball summary. Also fixes a broken test on main (semantic conflict between pnpm/pnpm#12910 and pnpm/pnpm#12914): State::init no longer persists a scaffolded root package.json when a pnpm-workspace.yaml sits next to the missing manifest, so a verify-deps-before-run install can't turn the workspace root into a selectable project with the init template's failing test script.