Walkthrough

Registry authentication resolution is changed to prioritize package scope before falling back to registry URL, enabling different auth tokens for scopes sharing the same registry host. Both TypeScript and Rust stacks receive a new DEFAULT_REGISTRY_SCOPE (@) constant, a restructured credential model keyed by scope, an extended auth-header API accepting pkgName context, and updated call sites across config parsing, tarball fetching, metadata resolving, and the pnpr server protocol. The pnpm login --scope command now writes scope-specific _authToken entries and registry mappings, enabling end-to-end scope-aware authentication.

Changes

Scoped Registry Auth

Sequence Diagram(s)

sequenceDiagram
  participant npmrc as .npmrc / env
  participant ConfigReader as ConfigReader (TS)<br/>NpmrcAuth (Rust)
  participant AuthHeaders as AuthHeaders<br/>Auth Lookup
  participant Resolver as Package Resolver
  participant Registry as Registry HTTP

  npmrc->>ConfigReader: //npm.pkg.github.com/@orgA:_authToken=TOKEN_A<br/>//npm.pkg.github.com/@orgB:_authToken=TOKEN_B
  ConfigReader->>ConfigReader: parse scope from registry key<br/>store nested [registry][`@orgA`] = TOKEN_A<br/>store nested [registry][`@orgB`] = TOKEN_B
  ConfigReader->>AuthHeaders: build from nested creds<br/>via getAuthHeadersFromCreds
  Resolver->>AuthHeaders: lookup_for_package(`@orgA/pkg`, registry)
  AuthHeaders->>AuthHeaders: extract `@orgA` scope
  AuthHeaders->>AuthHeaders: nerf-dart match<br/>scoped_by_scope[`@orgA`]
  AuthHeaders-->>Resolver: Bearer TOKEN_A
  Resolver->>Registry: GET /@orgA%2Fpkg<br/>Authorization: Bearer TOKEN_A
  Registry-->>Resolver: 200 OK package metadata

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related PRs

• pnpm/pnpm#11727: pnpm login --scope introduces writing @<scope>:registry=<registry> mappings, which the main PR's scope-aware config parsing (getNetworkConfigs, tryParseCredsKey scope splitting) consumes to route scoped credentials correctly.
• pnpm/pnpm#12299: Both PRs modify releasing/commands/src/publish/publishPackedPkg.ts—main PR refactors for scope-keyed credentials (DEFAULT_REGISTRY_SCOPE), while retrieved PR adds OIDC/batch support—making changes adjacent in the publish auth-credential path.
• pnpm/pnpm#11953: Both PRs touch network/auth-header and config/reader auth-credential plumbing for scope-aware default-registry vs. scoped lookup behavior across the stack.

Suggested reviewers

• ranm8

🐇 Hop hop, a scope has its own key,
No more one token for all — now scopes run free!
@orgA gets its bearer, @orgB gets its own,
GitHub packages bloom where mixed auth was stone.
The rabbit cheers: '@' maps the way home! 🎉

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Description

The pnpr server now deserializes authHeaders as a nested {[registryUri]: {[scope]: header}} map,
so older clients sending the previous flat {[registryUri]: header} shape will fail JSON parsing
and receive a 400. This breaks installs/resolution whenever pnpr client/server versions are skewed.

Code

pnpr/crates/pnpr/src/resolver/protocol.rs[R56-61]

+    /// and fetches private content as the caller. Keyed as
+    /// `auth_headers[registry_uri][scope]`; the `@` scope stores
+    /// registry-wide auth. Distinct from the request's HTTP
+    /// `Authorization` header (pnpr identity).
#[serde(default)]
-    pub auth_headers: BTreeMap<String, String>,
+    pub auth_headers: AuthHeadersByScope,

Evidence

ResolveRequest.auth_headers is now typed as AuthHeadersByScope under camelCase
deserialization, so the server expects nested objects; the handler returns BAD_REQUEST on any JSON
shape mismatch during serde_json::from_slice.

pnpr/crates/pnpr/src/resolver/protocol.rs[37-62]
pnpr/crates/pnpr/src/resolver.rs[210-214]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The pnpr `/v1` request schema changed for `authHeaders` from a flat map to a nested `by-scope` map. Because the server directly deserializes into the new type and returns `400 Bad Request` on any parse error, older clients (or any third-party client) still sending the old shape will break.
### Issue Context
- The server is at `/v1/...` but the request schema changed without versioning or backwards-compat deserialization.
- The resolver immediately rejects bodies that fail `serde_json::from_slice`.
### Fix Focus Areas
- pnpr/crates/pnpr/src/resolver/protocol.rs[38-62]
- pnpr/crates/pnpr/src/resolver.rs[210-223]
### Suggested fix approach
1. Introduce a backward-compatible wire type for `authHeaders`, e.g. an untagged enum:
- `Flat(BTreeMap<String, String>)` (legacy)
- `ByScope(AuthHeadersByScope)` (new)
2. In deserialization (or immediately after), normalize into `AuthHeadersByScope` by mapping the flat value into `{ registryUri: { "@": header } }`.
3. Keep internal logic working on the normalized `AuthHeadersByScope`.
4. (Optional) If you want to keep strictness, consider moving the new schema to `/v2` and keep `/v1` accepting the old schema.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Description

createGetAuthHeaderByURI only considers scope-specific credentials when opts.pkgName is
provided, but multiple package-specific commands still call it as getAuthHeader(registryUrl)
without passing the package name. This causes scope-specific tokens (e.g.
//npm.pkg.github.com/@org:_authToken) to be ignored and can break operations on private scoped
packages with 401/403 when no registry-wide @ credential is set.

Code

network/auth-header/src/index.ts[R41-53]

if (!uri.endsWith('/')) {
uri += '/'
}
const parsedUri = new URL(uri)
const basic = basicAuth(parsedUri)
if (basic) return basic
+  const scope = getScope(opts?.pkgName)
+  if (scope) {
+    const scopedAuth = getScopedAuthHeaderByNerfedURI(authHeaders.scopedAuthHeaderValueByURI, maxParts.maxScopedParts, uri, scope)
+    if (scopedAuth) return scopedAuth
+  }
+  return getAuthHeaderByNerfedURI(authHeaders.authHeaderValueByURI, maxParts.maxParts, uri)
+}

Evidence

The new auth-header implementation only checks scoped headers when opts.pkgName is provided;
otherwise it immediately falls back to registry-wide auth. The listed command paths all have a
concrete packageName in hand but still call getAuthHeader(registryUrl) without passing it, so
scope-specific auth entries cannot be selected on those requests.

network/auth-header/src/index.ts[41-53]
registry-access/commands/src/deprecation/common.ts[39-50]
registry-access/commands/src/distTag.ts[276-283]
registry-access/commands/src/owner.ts[157-187]
registry-access/commands/src/unpublish.ts[100-114]
registry-access/commands/src/star/common.ts[132-138]
deps/inspection/commands/src/fetchPackageInfo.ts[41-73]
releasing/commands/src/stage/context.ts[22-32]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`createGetAuthHeaderByURI()` now prefers scope-specific auth only when the caller supplies `opts.pkgName` (so it can derive `@scope`). Several package-specific commands still compute `authHeaderValue` by calling `getAuthHeader(registryUrl)` without the package name, so scoped tokens are never selected on those paths.
### Issue Context
This PR changes auth config shape to `configByUri[registryUrl][scope]` and updates the auth-header lookup to resolve scoped credentials before falling back to registry-wide `@` credentials.
### Fix
Update package-specific callsites to pass the known package name:
- Change `getAuthHeader(registryUrl)` to `getAuthHeader(registryUrl, { pkgName: packageName })` (or equivalent variable) wherever the operation targets a specific package.
- Where helpers exist (e.g. `getAuthHeaderForRegistry(configByUri, registryUrl)`), extend them to accept `pkgName?: string` and thread it through.
- For stage context, `createStageContext(opts, packageName?)` should call `getAuthHeaderByUri(registry, { pkgName: packageName })` when `packageName` is provided.
### Fix Focus Areas
- registry-access/commands/src/deprecation/common.ts[39-50]
- registry-access/commands/src/distTag.ts[276-283]
- registry-access/commands/src/owner.ts[157-187]
- registry-access/commands/src/unpublish.ts[100-114]
- registry-access/commands/src/star/common.ts[132-138]
- deps/inspection/commands/src/fetchPackageInfo.ts[41-73]
- releasing/commands/src/stage/context.ts[22-32]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Description

In pacquet_network::AuthHeaders::from_map(), two different scoped-auth key syntaxes (":@scope" and
"/@scope") are collapsed into the same (registry_uri, scope) bucket, but because the input is a
HashMap, whichever token wins is nondeterministic. This can cause flaky or surprising authentication
when both syntaxes exist for the same registry+scope during migration.

Code

pacquet/crates/network/src/auth.rs[R98-109]

+    pub fn from_map(headers: HashMap<String, String>) -> Self {
+        let mut by_uri = HashMap::new();
+        let mut scoped_by_uri: HashMap<String, HashMap<String, String>> = HashMap::new();
+        for (uri, value) in headers {
+            let uri = normalize_auth_key(uri);
+            if let Some((registry_uri, scope)) = split_scoped_auth_key(&uri) {
+                scoped_by_uri.entry(registry_uri).or_default().insert(scope, value);
+            } else {
+                by_uri.insert(uri, value);
+            }
+        }
+        Self::from_parts(by_uri, scoped_by_uri)

Evidence

from_map() iterates a HashMap and uses split_scoped_auth_key() (which supports both ":@" and "/@"
scoped syntaxes) to derive a shared (registry_uri, scope) key; it then inserts into
scoped_by_uri[registry_uri][scope] without deterministic collision handling, so duplicate syntaxes
for the same scope overwrite in an order that depends on HashMap iteration.

pacquet/crates/network/src/auth.rs[94-110]
pacquet/crates/network/src/auth.rs[288-305]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`AuthHeaders::from_map` collapses multiple scoped-auth key syntaxes into the same `(registry_uri, scope)` slot. Because it iterates a `HashMap`, collision resolution depends on iteration order, which is nondeterministic, so the chosen token/header can vary between runs.

### Issue Context
Both `//host/:@scope` (colon syntax) and `//host/@scope` (path syntax) are accepted by `split_scoped_auth_key`. If both appear (common during transition when new tooling writes one form and existing config has the other), `insert(scope, value)` overwrites based on iteration order.

### Fix Focus Areas
- pacquet/crates/network/src/auth.rs[98-110]
- pacquet/crates/network/src/auth.rs[288-305]

### Implementation guidance
- Ensure deterministic precedence when two inputs map to the same `(registry_uri, scope)`:
 - Option A: Change `from_map` to accept/convert to an ordered map (e.g., iterate keys in sorted order) before inserting into `scoped_by_uri`.
 - Option B: Track if `(registry_uri, scope)` already exists and apply a documented precedence rule (e.g., prefer `:@` form, or prefer the lexicographically-longer/more-specific raw key), or return an explicit error/warning on duplicates.
 - Option C: If preserving caller precedence is desired, take an ordered sequence (Vec/BTreeMap) rather than a HashMap so “last wins” is stable.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Description

getNetworkConfigs() strips a trailing package scope segment from auth keys (e.g.
//host/@scope:_authToken) but does not apply the same scope split/normalization to TLS keys
(//host/@scope:ca|cert|key). This can store TLS material under configByUri["//host/@scope"] which
dispatcher TLS matching never selects for real requests to https://host/…, causing mTLS/custom-CA
config to be skipped.

Code

config/reader/src/getNetworkConfigs.ts[R90-121]

if (!credsField) {
 throw new Error(`Unexpected key: ${match.groups.key}`)
}
-  return { registry, credsField }
+  return { ...splitScopeFromRegistry(registry), credsField }
+}
+
+function getScopedCreds (rawCredsByScope: Record<string, RawCreds> = {}): Record<string, Creds> {
+  const scopedCreds: Record<string, Creds> = {}
+  for (const [scope, rawCreds] of Object.entries(rawCredsByScope)) {
+    const creds = parseCreds(rawCreds)
+    if (creds) {
+      scopedCreds[scope] = creds
+    }
+  }
+  return scopedCreds
+}
+
+function splitScopeFromRegistry (registry: string): { registry: string, scope?: string } {
+  if (!registry.startsWith('//')) return { registry }
+  const trimmed = registry.endsWith('/') ? registry.slice(0, -1) : registry
+  const lastSlashIndex = trimmed.lastIndexOf('/')
+  if (lastSlashIndex === -1) return { registry }
+  const scope = trimmed.slice(lastSlashIndex + 1)
+  if (!isPackageScope(scope)) return { registry }
+  return {
+    registry: trimmed.slice(0, lastSlashIndex + 1),
+    scope,
+  }
+}
+
+function isPackageScope (scope: string): boolean {
+  return scope.startsWith('@') && scope.length > 1

Evidence

TLS parsing stores entries under the raw registry prefix from the .npmrc key, while auth parsing
was changed to split a trailing @scope segment off the registry key. Dispatcher TLS selection
matches by the nerf-darted request URL and shorter prefixes, so a TLS key stored under
//host/@scope/ cannot be selected for requests to https://host/... (nerf-dart //host/).

config/reader/src/getNetworkConfigs.ts[23-41]
config/reader/src/getNetworkConfigs.ts[83-118]
network/fetch/src/dispatcher.ts[393-433]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`getNetworkConfigs()` now supports scope-suffixed auth keys by splitting `//host/@scope` into `{ registry: "//host/", scope: "@scope" }`, but TLS parsing (`:ca`, `:cert`, `:key`) still uses the raw prefix as the configByUri key. If a user writes TLS keys with a scope suffix (mirroring the new auth syntax), the TLS ends up stored under `configByUri['//host/@scope']` and is never matched for outgoing requests to `https://host/...`.
### Issue Context
`network/fetch` selects TLS settings by matching the *request URL* via nerf-dart prefix walk; it cannot match a longer key like `//host/@scope/` when the request nerf-dart is `//host/`.
### Fix Focus Areas
- config/reader/src/getNetworkConfigs.ts[32-42]
- config/reader/src/getNetworkConfigs.ts[83-143]
- network/fetch/src/dispatcher.ts[393-433]
### What to change
1. In `tryParseSslKey`, normalize/scope-split the `registry` prefix the same way as auth keys:
- If the registry key starts with `//` and ends with a package scope segment, strip that scope and store TLS under the base registry URI.
- Ensure a consistent trailing `/` for TLS keys as well (so downstream matching is stable).
2. Add/extend a unit test in `config/reader/test/getNetworkConfigs.test.ts` that includes a scoped TLS key (e.g. `//npm.pkg.github.com/@orgA:ca=...`) and asserts TLS lands under `//npm.pkg.github.com/` (not under the scoped key).
### Acceptance criteria
- TLS settings specified with a scope suffix are applied to requests to the base registry host/path.
- Existing non-scoped TLS behavior remains unchanged.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Description

splitScopeFromRegistry (and the mirrored Rust logic) treats any registry key whose last path
segment starts with @ as a package scope and strips it from the registry URI. This breaks
registries whose actual URL prefix legitimately ends with an @… path segment, causing credentials
to be looked up under the wrong registry prefix (missing auth) or applied more broadly than
intended.

Code

config/reader/src/getNetworkConfigs.ts[R107-121]

+function splitScopeFromRegistry (registry: string): { registry: string, scope?: string } {
+  if (!registry.startsWith('//')) return { registry }
+  const trimmed = registry.endsWith('/') ? registry.slice(0, -1) : registry
+  const lastSlashIndex = trimmed.lastIndexOf('/')
+  if (lastSlashIndex === -1) return { registry }
+  const scope = trimmed.slice(lastSlashIndex + 1)
+  if (!isPackageScope(scope)) return { registry }
+  return {
+    registry: trimmed.slice(0, lastSlashIndex + 1),
+    scope,
+  }
+}
+
+function isPackageScope (scope: string): boolean {
+  return scope.startsWith('@') && scope.length > 1

Evidence

The new parsing logic strips the final @… segment whenever it matches `startsWith('@') && length >
1`, which changes the registry key used to store creds; the Rust implementation applies the same
heuristic when interpreting auth keys. The codebase defines registry config keys as including
arbitrary “rest of the URI”, so @ is a plausible (and valid) path-segment character, making this
inference ambiguous for some real registry prefixes.

config/reader/src/getNetworkConfigs.ts[83-122]
pacquet/crates/network/src/auth.rs[291-315]
releasing/commands/src/publish/registryConfigKeys.ts[36-41]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`splitScopeFromRegistry()` infers “scope-specific auth” solely from the last path segment starting with `@`. This makes `.npmrc` URL prefixes that *legitimately* end with an `@…` segment ambiguous and can reroute credentials to a different registry key.
Concrete example that will be misparsed:
- User intends a literal prefix token:
- `//reg.example.com/repos/@npm/:_authToken=TOKEN`
- Current behavior:
- parsed as `registry=//reg.example.com/repos/` and `scope=@npm`
- requests to `https://reg.example.com/repos/@npm/...` for **unscoped** packages won’t see the token (no `pkgName` scope match), leading to 401/403.
### Issue Context
This ambiguity exists in both the TS config parsing and the Rust auth lookup, so the behavior is systemic.
### Fix Focus Areas
- config/reader/src/getNetworkConfigs.ts[107-121]
- pacquet/crates/network/src/auth.rs[291-303]
### Suggested fix direction
Implement an ambiguity-safe strategy, e.g.:
1. **Preserve literal-path semantics in addition to scoped semantics** for keys whose last segment looks like a scope:
- When detecting a scope-like last segment, store creds in both:
- `configByUri[baseRegistry][scope]` (new behavior), and
- `configByUri[fullRegistryPrefix][DEFAULT_REGISTRY_SCOPE]` (literal prefix fallback)
- Optionally emit a warning when both interpretations are possible.
OR
2. Add a stricter disambiguation rule (and document it) so only truly intended scope keys are split, while leaving literal path prefixes untouched.
Choose a strategy that does not regress the new feature tests while avoiding silent auth breakage for path prefixes that end in `@…`.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

🐞 Bugs (5) 📘 Rule violations (0) 📎 Requirement gaps (0)

🐞 Bugs (5) 📘 Rule violations (0) 📎 Requirement gaps (0)

• Store registry auth as per-registry, per-package-scope entries ("@" is default scope).
• Prefer scope auth for scoped packages across metadata, tarballs, and registry commands.
• Forward scoped auth to pnpr/pacquet as structured authHeaders[registryUri][scope].

The following are alternative approaches to this PR:

Recommendation: The PR’s approach (explicit per-registry, per-scope credentials with '@' as the default and pkgName-aware lookup) is the most robust and debuggable way to support multiple tokens on the same registry host. The main thing to watch is compatibility: ensure any remaining internal/third-party callers are updated for the new RegistryConfig shape and the expanded GetAuthHeader(uri, {pkgName}) signature.

getNetworkConfigs.ts Parse registry creds into per-scope entries keyed by registry URI +60/-8

Parse registry creds into per-scope entries keyed by registry URI

• Reworks credential parsing to group creds under 'configByUri[registryUri][scope]' with '@' as the default scope. Supports extracting scopes from both colon-separated ('.../:@scope') and slash-suffixed ('.../@scope') auth keys and normalizes registry keys.

config/reader/src/getNetworkConfigs.ts

---

misc.ts Introduce DEFAULT_REGISTRY_SCOPE and redefine RegistryConfig as scope-indexed creds +3/-1

Introduce DEFAULT_REGISTRY_SCOPE and redefine RegistryConfig as scope-indexed creds

• Adds 'DEFAULT_REGISTRY_SCOPE = '@'' and changes 'RegistryConfig' from a single 'creds' field to an index signature keyed by '@scope'. Keeps 'tls' alongside scope entries.

core/types/src/misc.ts

---

index.ts Expand GetAuthHeader to accept optional pkgName +5/-1

Expand GetAuthHeader to accept optional pkgName

• Introduces 'GetAuthHeaderOptions' and changes 'GetAuthHeader' to '(uri, opts?) => header' to support scope-aware lookup.

fetching/types/src/index.ts

---

getAuthHeadersFromConfig.ts Build auth headers for default and scoped registry credentials +50/-6

Build auth headers for default and scoped registry credentials

• Changes header construction to emit both a registry-wide header map and a scoped-by-registry map. Adds 'getAuthHeadersByScope()' to produce the pnpr wire shape 'authHeaders[uri][scope]' and normalizes URI keys with trailing slashes.

network/auth-header/src/getAuthHeadersFromConfig.ts

---

npmrc_auth.rs Parse and store creds as [registry_uri][scope] and build structured AuthHeaders +84/-23

Parse and store creds as [registry_uri][scope] and build structured AuthHeaders

• Replaces 'creds_by_uri' with 'creds_by_scope_by_uri' using '@' as the default scope. Adds scope splitting logic (colon and slash forms), pins unscoped creds into the default scope, and builds 'AuthHeaders' via 'from_parts' with both registry-wide and scoped headers.

pacquet/crates/config/src/npmrc_auth.rs

---

auth.rs Add scope-aware auth lookup and structured forwarding shape +169/-11

Add scope-aware auth lookup and structured forwarding shape

• Introduces 'DEFAULT_REGISTRY_SCOPE', stores scoped headers indexed by scope, and adds 'for_url_with_package()' to prefer scope credentials when pkg is scoped. Adds 'to_by_scope()' and 'from_by_scope()' to round-trip the pnpr wire format.

pacquet/crates/network/src/auth.rs

---

lib.rs Change pnpr client options to use AuthHeadersByScope +5/-4

Change pnpr client options to use AuthHeadersByScope

• Updates 'ResolveOptions' and 'VerifyLockfileOptions' to send auth as 'auth_headers[registry_uri][scope]' (with '@' as default scope).

pacquet/crates/pnpr-client/src/lib.rs

---

resolveViaPnprServer.ts Define pnpr client auth headers as [registry][scope] map +6/-3

Define pnpr client auth headers as [registry][scope] map

• Introduces 'AuthHeadersByScope' and updates 'ResolveViaPnprServerOptions' to forward scoped credentials with '@' as the registry-wide default scope.

pnpr/client/src/resolveViaPnprServer.ts

---

protocol.rs Update pnpr protocol to accept AuthHeadersByScope +6/-5

Update pnpr protocol to accept AuthHeadersByScope

• Changes the resolver request schema to accept 'auth_headers[registry_uri][scope]' and updates documentation comments accordingly.

pnpr/crates/pnpr/src/resolver/protocol.rs

---

login.ts Write login tokens to scoped auth keys when --scope is used +3/-8

Write login tokens to scoped auth keys when --scope is used

• Updates 'pnpm login' to persist '_authToken' under '//registry/:@scope:_authToken' when a scope is provided, while still writing unscoped tokens to '//registry/:_authToken'. Keeps writing the '@scope:registry' mapping for future installs.

auth/commands/src/login.ts

---

fetchPackageInfo.ts Pass packageName into registry auth lookup +1/-1

Pass packageName into registry auth lookup

• Updates metadata fetching to call 'getAuthHeader(registry, { pkgName })' so scoped packages can select scope-specific auth headers.

deps/inspection/commands/src/fetchPackageInfo.ts

---

remoteTarballFetcher.ts Thread pkg name into tarball auth header lookup +5/-4

Thread pkg name into tarball auth header lookup

• Extends download options to optionally include 'pkg' and uses 'pkg.name' when calling 'getAuthHeaderByURI(url, { pkgName })'. Keeps backward compatibility when 'pkg' is absent.

fetching/tarball-fetcher/src/remoteTarballFetcher.ts

---

index.ts Forward auth headers to pnpr by scope +2/-2

Forward auth headers to pnpr by scope

• Switches pnpr forwarding from a flat header map to 'authHeaders[registryUri][scope]' via 'getAuthHeadersByScope()'. Keeps pnpr identity header ('authorization') separate from upstream registry auth.

installing/deps-installer/src/install/index.ts

---

index.ts Prefer scope auth in createGetAuthHeaderByURI when pkgName is scoped +71/-10

Prefer scope auth in createGetAuthHeaderByURI when pkgName is scoped

• Updates 'createGetAuthHeaderByURI' to accept optional '{ pkgName }' and select scope-specific headers before falling back to registry-wide auth. Optimizes lookups by indexing scoped headers by scope to avoid unnecessary URI-prefix walks.

network/auth-header/src/index.ts

---

install.rs Send pnpr auth headers as structured by-scope map +1/-6

Send pnpr auth headers as structured by-scope map

• Changes pnpr request construction to forward 'state.config.auth_headers.to_by_scope()' rather than flattening to '(uri, value)' pairs.

pacquet/crates/cli/src/cli_args/install.rs

---

package.rs Use package-aware auth lookup for registry requests +1/-1

Use package-aware auth lookup for registry requests

• Changes registry fetch requests to call 'auth_headers.for_url_with_package(..., Some(name))' so scope-specific creds are applied consistently.

pacquet/crates/registry/src/package.rs

---

package_version.rs Use package-aware auth lookup for version fetches +1/-1

Use package-aware auth lookup for version fetches

• Updates version registry requests to prefer scope creds using 'for_url_with_package'.

pacquet/crates/registry/src/package_version.rs

---

fetch_attestation_published_at.rs Apply scope-aware auth when fetching attestations +1/-1

Apply scope-aware auth when fetching attestations

• Uses 'for_url_with_package(..., Some(pkg_name))' so attestation endpoints respect package-scope auth.

pacquet/crates/resolving-npm-resolver/src/fetch_attestation_published_at.rs

---

fetch_full_metadata.rs Apply scope-aware auth when fetching metadata +1/-1

Apply scope-aware auth when fetching metadata

• Uses 'for_url_with_package(..., Some(pkg_name))' during metadata fetch, aligning with pnpm’s scoped auth precedence.

pacquet/crates/resolving-npm-resolver/src/fetch_full_metadata.rs

---

fetch_full_metadata_cached.rs Apply scope-aware auth when fetching cached metadata +1/-1

Apply scope-aware auth when fetching cached metadata

• Updates cached metadata fetch to use 'for_url_with_package' so cache paths don’t bypass scoped auth selection.

pacquet/crates/resolving-npm-resolver/src/fetch_full_metadata_cached.rs

---

lib.rs Apply package-aware auth to tarball downloads (tgz/zip) +2/-2

Apply package-aware auth to tarball downloads (tgz/zip)

• Updates tarball fetchers to resolve auth with 'for_url_with_package(package_url, Some(package_id))', ensuring scoped tokens are applied even when tarball hosts differ.

pacquet/crates/tarball/src/lib.rs

---

resolver.rs Rebuild request auth from structured by-scope map +2/-6

Rebuild request auth from structured by-scope map

• Switches request auth construction to 'AuthHeaders::from_by_scope(request.auth_headers)' for both resolve and verify endpoints.

pnpr/crates/pnpr/src/resolver.rs

---

common.ts Use packageName-aware auth header for deprecation requests +1/-1

Use packageName-aware auth header for deprecation requests

• Passes '{ pkgName: packageName }' into auth header lookup to ensure scoped packages use scoped credentials.

registry-access/commands/src/deprecation/common.ts

---

distTag.ts Use package-scope auth for dist-tag operations +6/-5

Use package-scope auth for dist-tag operations

• Updates dist-tag subcommands to select auth based on the target package name, not just the registry URL.

registry-access/commands/src/distTag.ts

---

owner.ts Use package-scope auth for owner operations +7/-6

Use package-scope auth for owner operations

• Updates owner list/add/remove to select auth headers using the package name so scoped packages can use scoped registry tokens.

registry-access/commands/src/owner.ts

---

common.ts Use optional packageName-aware auth header for star/unstar +4/-3

Use optional packageName-aware auth header for star/unstar

• Updates star/unstar auth lookup to pass pkgName when available, allowing scoped auth to be selected.

registry-access/commands/src/star/common.ts

---

unpublish.ts Use packageName-aware auth header for unpublish +1/-1

Use packageName-aware auth header for unpublish

• Passes '{ pkgName: packageName }' into auth header selection so scoped unpublishes can use scoped credentials.

registry-access/commands/src/unpublish.ts

---

publishPackedPkg.ts Preserve package-scoped publish creds when computing libnpmpublish options +10/-4

Preserve package-scoped publish creds when computing libnpmpublish options

• Updates registry info resolution to select creds by package scope (named registry key or '@') and then collapse to libnpmpublish’s default auth slot. Keeps TLS merge behavior while shifting auth selection to the new scoped config shape.

releasing/commands/src/publish/publishPackedPkg.ts

---

context.ts Use packageName-aware auth lookup for stage context +1/-1

Use packageName-aware auth lookup for stage context

• Updates stage context to pass pkgName into auth header lookup when stage actions are package-specific.

releasing/commands/src/stage/context.ts

---

createNpmResolutionVerifier.ts Thread pkgName into auth lookup for metadata, abbreviated meta, and attestations +7/-6

Thread pkgName into auth lookup for metadata, abbreviated meta, and attestations

• Updates verifier options to use the new 'GetAuthHeader' signature and passes package names into auth header selection across metadata/attestation fetches.

resolving/npm-resolver/src/createNpmResolutionVerifier.ts

---

index.ts Thread pkgName into resolver auth lookup for package picking +3/-3

Thread pkgName into resolver auth lookup for package picking

• Updates npm resolution flows to call 'getAuthHeaderValueByURI(registry, { pkgName: spec.name })' so scope-specific tokens apply during metadata resolution.

resolving/npm-resolver/src/index.ts

---

index.ts Adopt new GetAuthHeader signature in tarball fetcher +1/-1

Adopt new GetAuthHeader signature in tarball fetcher

• Updates the tarball fetcher context type so 'getAuthHeaderByURI' supports optional '{ pkgName }' during lookup.

fetching/tarball-fetcher/src/index.ts

---

lib.rs Update env auth presence check for scoped credential store +1/-1

Update env auth presence check for scoped credential store

• Switches the condition for enabling env-scoped auth from 'creds_by_uri' to the new 'creds_by_scope_by_uri' structure.

pacquet/crates/config/src/lib.rs

---

lib.rs Re-export scoped-auth types and constants +1/-1

Re-export scoped-auth types and constants

• Exports 'AuthHeadersByScope' and 'DEFAULT_REGISTRY_SCOPE' for consumers (pnpr client/server and config).

pacquet/crates/network/src/lib.rs

---

login.test.ts Add/adjust login tests for scoped token persistence +45/-4

Add/adjust login tests for scoped token persistence

• Updates expectations to ensure scoped logins do not overwrite the registry-wide auth slot. Adds coverage for path registries and for '--scope' normalization behavior.

auth/commands/test/login.test.ts

---

getNetworkConfigs.test.ts Update network config tests for '@' default scope and scoped auth grouping +49/-5

Update network config tests for '@' default scope and scoped auth grouping

• Updates existing fixtures from 'creds' to the '@' default scope entry. Adds tests verifying that multiple scope tokens are grouped under a single normalized registry URI for both colon and slash key formats.

config/reader/test/getNetworkConfigs.test.ts

---

index.ts Adjust config reader integration expectations for new auth shape +11/-11

Adjust config reader integration expectations for new auth shape

• Updates assertions to reflect 'configByUri[uri]['@']' rather than 'configByUri[uri].creds'. Preserves security-related expectations that project-level auth keys are ignored/pinned as before.

config/reader/test/index.ts

---

index.ts Update audit test fixture for '@' auth scope +1/-1

Update audit test fixture for '@' auth scope

• Migrates the test config from 'creds.authToken' to '{'@': {authToken}}' for registry auth.

deps/compliance/commands/test/audit/index.ts

---

fetch.ts Test tarball downloads pass pkgName into auth lookup +92/-0

Test tarball downloads pass pkgName into auth lookup

• Adds a regression test ensuring tarball downloads attach scoped auth when 'pkg.name' is provided. Adds a second test verifying downloads still work without a package name.

fetching/tarball-fetcher/test/fetch.ts

---

auth.ts Update deps-installer auth tests to new RegistryConfig shape +7/-7

Update deps-installer auth tests to new RegistryConfig shape

• Migrates multiple fixtures from 'creds' to '{'@': ...}' for token/basic auth while preserving test intent around authenticated installs.

installing/deps-installer/test/install/auth.ts

---

getAuthHeaderByURI.ts Add tests for package-scope auth precedence and path registries +43/-7

Add tests for package-scope auth precedence and path registries

• Updates fixtures to use '{'@': ...}' and adds coverage ensuring '@scope' auth overrides registry auth for scoped packages (including path registries). Verifies URL basic auth still takes priority.

network/auth-header/test/getAuthHeaderByURI.ts

---

getAuthHeadersFromConfig.test.ts Test structured auth header outputs and by-scope conversion +65/-15

Test structured auth header outputs and by-scope conversion

• Updates tests for the new 'AuthHeaders' return shape and adds coverage for scoped headers plus 'getAuthHeadersByScope()' conversion.

network/auth-header/test/getAuthHeadersFromConfig.test.ts

---

tests.rs Extend pacquet npmrc auth tests for scope-specific tokens +99/-40

Extend pacquet npmrc auth tests for scope-specific tokens

• Updates existing assertions for the new creds structure and adds new tests for colon and slash scoped keys, precedence of scoped over registry-wide auth, and parity with pnpm behavior.

pacquet/crates/config/src/npmrc_auth/tests.rs

---

tests.rs Add pacquet tests for scoped auth precedence and round-tripping +118/-1

Add pacquet tests for scoped auth precedence and round-tripping

• Adds coverage mirroring pnpm: scoped auth wins, registry path is preserved, structured forwarding round-trips, and URL basic auth overrides scoped auth.

pacquet/crates/network/src/auth/tests.rs

---

integration.rs Update pnpr integration tests for structured auth headers +20/-8

Update pnpr integration tests for structured auth headers

• Adjusts request-body assertions and test helpers to build 'AuthHeadersByScope', ensuring forwarded upstream credentials are transmitted in the new shape.

pacquet/crates/pnpr-client/tests/integration.rs

---

tests.rs Test scoped auth is used for metadata fetches +54/-0

Test scoped auth is used for metadata fetches

• Adds a test verifying a scoped package fetch attaches the scoped bearer token in the Authorization header.

pacquet/crates/resolving-npm-resolver/src/fetch_full_metadata/tests.rs

---

tests.rs Test scoped auth is attached based on package id +42/-0

Test scoped auth is attached based on package id

• Adds a regression test that scoped credentials are applied when tarball URL alone would not match but the package id indicates a scoped package.

pacquet/crates/tarball/src/tests.rs

---

switchCliVersion.test.ts Update CLI version switch tests for new auth config shape +3/-9

Update CLI version switch tests for new auth config shape

• Migrates config fixtures from 'creds' to '{'@': ...}' for package-manager and project registry auth in tests.

pnpm/src/switchCliVersion.test.ts

---

syncEnvLockfile.test.ts Update env lockfile sync tests for new auth config shape +3/-9

Update env lockfile sync tests for new auth config shape

• Updates registry auth fixtures to use the '@' default scope entry in 'configByUri'.

pnpm/src/syncEnvLockfile.test.ts

---

deprecate.ts Update deprecate tests for '@' auth scope +1/-3

Update deprecate tests for '@' auth scope

• Migrates registry config fixtures from 'creds' to '{'@': {basicAuth}}'.

registry-access/commands/test/deprecate.ts

---

dist-tag.ts Add test asserting dist-tag uses package-scoped auth +35/-3

Add test asserting dist-tag uses package-scoped auth

• Updates fixtures to new auth shape and adds a mock-agent test verifying the scoped token is attached for '@scope/pkg'.

registry-access/commands/test/dist-tag.ts

---

star.ts Update star tests for '@' auth scope +1/-3

Update star tests for '@' auth scope

• Migrates fixture from 'creds' to '{'@': {authToken}}'.

registry-access/commands/test/star.ts

---

unpublish.ts Update unpublish tests for '@' auth scope +1/-3

Update unpublish tests for '@' auth scope

• Migrates fixture from 'creds' to '{'@': {basicAuth}}'.

registry-access/commands/test/unpublish.ts

---

whoami.ts Update whoami tests for '@' auth scope +1/-3

Update whoami tests for '@' auth scope

• Migrates fixture from 'creds' to '{'@': {authToken}}'.

registry-access/commands/test/whoami.ts

---

batchPublish.test.ts Update batch publish tests for '@' auth scope +2/-2

Update batch publish tests for '@' auth scope

• Migrates test config fixtures from 'creds' to '{'@': ...}' for token and basic auth.

releasing/commands/test/publish/batchPublish.test.ts

---

publish.ts Update publish tests for '@' auth scope +3/-9

Update publish tests for '@' auth scope

• Migrates publish-related fixtures (basic auth and token helper) from 'creds' to '{'@': ...}'.

releasing/commands/test/publish/publish.ts

---

publishConfigAccess.test.ts Add test: publish prefers package-scoped token over registry-wide token +20/-0

Add test: publish prefers package-scoped token over registry-wide token

• Adds coverage ensuring 'createPublishOptions()' selects '@scope' token for '@scope/pkg' even when a registry-wide token exists.

releasing/commands/test/publish/publishConfigAccess.test.ts

---

recursivePublish.ts Update recursive publish tests for '@' auth scope +1/-3

Update recursive publish tests for '@' auth scope

• Migrates fixture from 'creds' to '{'@': {basicAuth}}' for registry auth.

releasing/commands/test/publish/recursivePublish.ts

---

stage.test.ts Add stage test asserting package-scoped auth is used for list filters +24/-0

Add stage test asserting package-scoped auth is used for list filters

• Adds a regression test verifying stage list requests attach the scoped token when filtering on a scoped package name.

releasing/commands/test/stage.test.ts

---

createNpmResolutionVerifier.test.ts Test verifier passes pkgName to auth header lookup +35/-0

Test verifier passes pkgName to auth header lookup

• Adds a regression test ensuring scoped package verification results in auth lookup receiving the package name and attaching the scoped bearer header.

resolving/npm-resolver/test/createNpmResolutionVerifier.test.ts

---

index.ts Test resolver passes pkgName to auth header lookup +25/-0

Test resolver passes pkgName to auth header lookup

• Adds coverage ensuring 'resolveFromNpm()' passes the scoped package name into auth header lookup and uses the scoped token in registry requests.

resolving/npm-resolver/test/index.ts

---

scoped-registry-auth.md Document scope-specific auth keys and behavior +34/-0

Document scope-specific auth keys and behavior

• Adds a changeset describing the new auth key format ('//registry/:@scope:_authToken') with '@' as the registry-wide fallback. Includes an example and notes that 'pnpm login --scope' writes the scoped key.

.changeset/scoped-registry-auth.md

---

Cargo.toml Add pacquet-network dependency for AuthHeadersByScope +1/-0

Add pacquet-network dependency for AuthHeadersByScope

• Adds 'pacquet-network' as a workspace dependency so pnpr-client can use the structured auth header type.

pacquet/crates/pnpr-client/Cargo.toml

---