feat(access): manage registry package access

aube.usage.kdl

@@ -77,6 +77,66 @@ flag "-y --yes" help="Automatically answer yes to prompts" hide=#true global=#tr
 cmd __node-gyp-bootstrap hide=#true help="Bootstrap aube's cached node-gyp and print the executable path" {
     arg <PROJECT_DIR>
 }
+cmd access subcommand_required=#true help="Manage package access and visibility on the registry" {
+    flag --json help="Emit registry responses as JSON when the subcommand has a result"
+    flag --otp help="One-time password from a 2FA authenticator; sent as `npm-otp`" {
+        arg <OTP>
+    }
+    flag --fetch-retries help="Number of retry attempts for failed registry fetches" {
+        long_help "Number of retry attempts for failed registry fetches.\n\nOverrides `fetchRetries` / `fetch-retries` from `.npmrc` / `aube-workspace.yaml` when set. Pair with `--fetch-timeout` to fail fast in scripted test runs."
+        arg <N>
+    }
+    flag --fetch-retry-factor help="Exponential backoff factor between retry attempts" {
+        long_help "Exponential backoff factor between retry attempts.\n\nOverrides `fetchRetryFactor` / `fetch-retry-factor` from `.npmrc` / `aube-workspace.yaml` when set. Integer-only — the underlying `FetchPolicy.retry_factor` is `u32`. Fractional values like `1.5` are rejected by clap."
+        arg <N>
+    }
+    flag --fetch-retry-maxtimeout help="Upper bound (ms) on the computed retry backoff" {
+        long_help "Upper bound (ms) on the computed retry backoff.\n\nOverrides `fetchRetryMaxtimeout` / `fetch-retry-maxtimeout` from `.npmrc` / `aube-workspace.yaml` when set."
+        arg <MS>
+    }
+    flag --fetch-retry-mintimeout help="Lower bound (ms) on the computed retry backoff" {
+        long_help "Lower bound (ms) on the computed retry backoff.\n\nOverrides `fetchRetryMintimeout` / `fetch-retry-mintimeout` from `.npmrc` / `aube-workspace.yaml` when set."
+        arg <MS>
+    }
+    flag --fetch-timeout help="Per-request HTTP timeout in milliseconds" {
+        long_help "Per-request HTTP timeout in milliseconds.\n\nOverrides `fetchTimeout` / `fetch-timeout` from `.npmrc` / `aube-workspace.yaml` when set. Applied via `reqwest`'s `.timeout()` so it covers headers + body together."
+        arg <MS>
+    }
+    flag --registry help="Override the default registry URL for this invocation" {
+        long_help "Override the default registry URL for this invocation.\n\nUse this npm registry URL for package metadata, tarballs, audit requests, dist-tags, and registry writes."
+        arg <URL>
+    }
+    cmd get subcommand_required=#true help="Get package visibility status" {
+        cmd status help="Get a package's public or restricted status" {
+            arg <PACKAGE> help="Package name"
+        }
+    }
+    cmd grant help="Grant a team read-only or read-write access to a package" {
+        arg <PERMISSIONS> help="`read-only` or `read-write`"
+        arg <TEAM> help="Team in `@scope:team` form"
+        arg <PACKAGE> help="Package name"
+    }
+    cmd list subcommand_required=#true help="List packages visible to a user, organization, or team" {
+        cmd collaborators help="List collaborators for a package, optionally filtering to one user" {
+            arg <PACKAGE> help="Package name"
+            arg "[USER]" help="Optional user name" required=#false
+        }
+        cmd packages help="List packages visible to the current user or an optional entity" {
+            arg "[ENTITY]" help="User, `@organization`, or `@scope:team`" required=#false
+        }
+    }
+    cmd ls help="Alias for `list packages`" {
+        arg "[ENTITIES]…" help="User, `@organization`, or `@scope:team`. Also accepts pnpm's `packages [ENTITY]` compatibility form. Accepted forms are `aube access ls [ENTITY]` and `aube access ls packages [ENTITY]`" required=#false var=#true
+    }
+    cmd revoke help="Revoke a team's access to a package" {
+        arg <TEAM> help="Team in `@scope:team` form"
+        arg <PACKAGE> help="Package name"
+    }
+    cmd set help="Set package visibility or a publish MFA requirement" {
+        arg <SETTING> help="`status=public|private|restricted` or `mfa=none|publish|automation`"
+        arg <PACKAGE> help="Package name"
+    }
+}
 cmd activate help="Emit shell activation code for runtime tool shims" {
     arg <SHELL> help="Shell to emit activation code for" {
         choices bash fish zsh

crates/aube-codes/src/errors.rs

@@ -35,6 +35,7 @@ pub const ERR_AUBE_PEER_CONTEXT_NOT_CONVERGED: &str = "ERR_AUBE_PEER_CONTEXT_NOT
 
 // ── registry / network ──────────────────────────────────────────────
 pub const ERR_AUBE_PACKAGE_NOT_FOUND: &str = "ERR_AUBE_PACKAGE_NOT_FOUND";
+pub const ERR_AUBE_ACCESS_ENTITY_NOT_FOUND: &str = "ERR_AUBE_ACCESS_ENTITY_NOT_FOUND";
 pub const ERR_AUBE_VERSION_NOT_FOUND: &str = "ERR_AUBE_VERSION_NOT_FOUND";
 pub const ERR_AUBE_UNAUTHORIZED: &str = "ERR_AUBE_UNAUTHORIZED";
 pub const ERR_AUBE_OFFLINE: &str = "ERR_AUBE_OFFLINE";
@@ -88,6 +89,7 @@ pub const ERR_AUBE_COMPLETION_FAILED: &str = "ERR_AUBE_COMPLETION_FAILED";
 pub const ERR_AUBE_REMOVE_PRIOR_INSTALL_DIR: &str = "ERR_AUBE_REMOVE_PRIOR_INSTALL_DIR";
 pub const ERR_AUBE_CONFIG_NESTED_AUBE_KEY: &str = "ERR_AUBE_CONFIG_NESTED_AUBE_KEY";
 pub const ERR_AUBE_CONFLICTING_BUILD_FLAGS: &str = "ERR_AUBE_CONFLICTING_BUILD_FLAGS";
+pub const ERR_AUBE_ACCESS_INVALID_ARGUMENT: &str = "ERR_AUBE_ACCESS_INVALID_ARGUMENT";
 pub const ERR_AUBE_SHIM_CREATE_FAILED: &str = "ERR_AUBE_SHIM_CREATE_FAILED";
 pub const ERR_AUBE_SHIM_EXEC_FAILED: &str = "ERR_AUBE_SHIM_EXEC_FAILED";
 
@@ -264,6 +266,12 @@ pub const ALL: &[CodeMeta] = &[
         description: "Registry returned 404 for the package name.",
         exit_code: Some(40),
     },
+    CodeMeta {
+        name: ERR_AUBE_ACCESS_ENTITY_NOT_FOUND,
+        category: category::REGISTRY_NETWORK,
+        description: "Registry returned 404 for an access user, organization, or team.",
+        exit_code: None,
+    },
     CodeMeta {
         name: ERR_AUBE_VERSION_NOT_FOUND,
         category: category::REGISTRY_NETWORK,
@@ -466,6 +474,12 @@ pub const ALL: &[CodeMeta] = &[
         description: "`aube add` was passed the same package name in both `--allow-build` and `--deny-build`.",
         exit_code: None,
     },
+    CodeMeta {
+        name: ERR_AUBE_ACCESS_INVALID_ARGUMENT,
+        category: category::ENGINE_CLI,
+        description: "`aube access` received an invalid access setting, permission level, team, or package argument.",
+        exit_code: None,
+    },
     CodeMeta {
         name: ERR_AUBE_SHIM_CREATE_FAILED,
         category: category::ENGINE_CLI,

crates/aube-registry/src/client.rs

@@ -3,6 +3,7 @@ use crate::config::{FetchPolicy, NpmConfig};
 use std::collections::BTreeMap;
 use std::sync::Mutex;
 
+mod access;
 mod body;
 mod cache;
 mod dist_tags;