new endpoints

api/base.yaml

@@ -19,36 +19,36 @@ tags:
     x-displayName: Introduction
     description: |
       This is the API documentation for the npm registry. For information about the npm registry, website, and command-line interface (CLI), please refer to [https://docs.npmjs.com](https://docs.npmjs.com).
-  
+
   - name: Authentication
     x-displayName: Authentication & Authorization
     description: |
       The npm registry API supports multiple types of bearer tokens for authentication:
 
       **Token Types:**
 
-      **1. npm Session Token (`npmSessionToken`)**  
+      **1. npm Session Token (`npmSessionToken`)**
       Traditional npm session tokens created via `npm login`. These tokens:
       - Are tied to a user account
       - Inherit the user's permissions
       - Have limited expiration
       - **Required for:** User account management, token creation/management
 
-      **2. npm Access Token (`npmAccessToken`)**  
+      **2. npm Access Token (`npmAccessToken`)**
       Fine-grained tokens with specific permissions:
       - Can be scoped to specific packages and organizations
       - Can be scoped to specific operations (read, write, publish)
       - Have configurable expiration
       - **Supported for:** Most package operations where explicitly documented
 
-      **3. OIDC id_token (`oidcIdToken`)**  
+      **3. OIDC id_token (`oidcIdToken`)**
       Tokens from supported Identity Providers (CI/CD systems):
       - From GitHub Actions, GitLab CI, CircleCI, etc.
       - Must have `aud` claim set to `npm:registry.npmjs.org`
       - Short-lived tokens
       - **Required for:** OIDC token exchange only
 
-      **4. OIDC Exchange Token (`oidcExchangeToken`)**  
+      **4. OIDC Exchange Token (`oidcExchangeToken`)**
       Short-lived tokens obtained from OIDC token exchange:
       - Package-scoped permissions
       - Limited lifetime (typically 1 hour)
@@ -91,6 +91,10 @@ x-tagGroups:
       - Tokens
       - OIDC
       - Trust
+      - Access
+      - Org
+      - Team
+      - Search
 
 components:
   securitySchemes:
@@ -102,28 +106,28 @@ components:
       description: |
         OIDC id_token from a supported Identity Provider (IdP) such as GitHub Actions, GitLab CI, or CircleCI.
         The `aud` (audience) claim must be set to `npm:registry.npmjs.org`.
-        
+
         **Supported Identity Providers:**
         - GitHub Actions
         - GitLab CI
         - CircleCI
-    
+
     # Traditional npm user access tokens
     npmSessionToken:
       type: http
       scheme: bearer
       description: |
         Traditional npm session token created via `npm login`.
         These tokens are tied to a user account and inherit the user's permissions.
-    
+
     # Granular Access Tokens (GAT) - fine-grained tokens with specific permissions
     npmAccessToken:
       type: http
       scheme: bearer
       description: |
         Granular Access Token (GAT) with fine-grained permissions.
         These tokens can be scoped to specific packages and operations.
-    
+
     # Alias for npmAccessToken - for backward compatibility
     granularAccessToken:
       type: http
@@ -132,7 +136,7 @@ components:
         Granular Access Token (GAT) with fine-grained permissions.
         These tokens can be scoped to specific packages and operations.
         (Alias for npmAccessToken)
-    
+
     # Short-lived tokens obtained from OIDC token exchange
     oidcExchangeToken:
       type: http
@@ -141,4 +145,4 @@ components:
         Short-lived npm registry token obtained by exchanging an OIDC id_token
         via the `/oidc/token/exchange` endpoint. These tokens are package-scoped
         and have limited lifetime (typically 1 hour).
-    
+

api/merge-config.yaml

@@ -1,6 +1,10 @@
 inputs:
   - inputFile: base.yaml
+  - inputFile: registry.npmjs.com/access.yaml
   - inputFile: registry.npmjs.com/oidc.yaml
+  - inputFile: registry.npmjs.com/org.yaml
+  - inputFile: registry.npmjs.com/search.yaml
+  - inputFile: registry.npmjs.com/team.yaml
   - inputFile: registry.npmjs.com/token.yaml
   - inputFile: registry.npmjs.com/trust.yaml
 

api/registry.npmjs.com/access.yaml

@@ -0,0 +1,178 @@
+components:
+  responses:
+    PackageAccessLevels:
+      description: 'Packages with their access levels'
+      content:
+        application/json:
+          schema:
+            type: object
+            additionalProperties:
+              type: string
+            example:
+              '@npmcli/arborist': read-write
+              '@npmcli/config': read-only
+    PackageVisibility:
+      description: 'Packages with their visibility'
+      content:
+        application/json:
+          schema:
+            type: object
+            additionalProperties:
+              type: string
+            example:
+              '@npmcli/arborist': public
+              '@npmcli/hidden': private
+    UserAccessLevels:
+      description: User access levels
+      content:
+        application/json:
+          schema:
+            type: object
+            additionalProperties:
+              type: string
+            example:
+              npm: read-write
+              microsoft: read-only
+paths:
+  /-/team/{orgName}/{teamName}/package:
+    parameters:
+      - $ref: './api/shared-components.yaml#/components/parameters/OrgName'
+      - $ref: './api/shared-components.yaml#/components/parameters/TeamName'
+      - $ref: './api/shared-components.yaml#/components/parameters/RequiredBearerToken'
+    get:
+      tags:
+        - Access
+      summary: Get all packages for a team
+      description: Get all of the packages a team has access to, as well as the access level that team has for each package.
+      operationId: getTeamPackageGrants
+      security:
+        - npmSessionToken: []
+      responses:
+        '200':
+          $ref: '#/components/responses/PackageAccessLevels'
+        '401':
+          $ref: './api/shared-components.yaml#/components/responses/Unauthorized'
+    put:
+      tags:
+        - Access
+      summary: Grant access to a package for a team
+      operationId: createTeamPackageGrant
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                package:
+                  type: string
+                  description: The name of the package to give access to
+                permissions:
+                  type: string
+                  enum:
+                    - read-only
+                    - read-write
+                  description: The access level of the package to grant to the team
+      security:
+        - npmSessionToken: []
+      responses:
+        '201':
+          $ref: './api/shared-components.yaml#/components/responses/EmptySuccess'
+        '401':
+          $ref: './api/shared-components.yaml#/components/responses/Unauthorized'
+    delete:
+      tags:
+        - Access
+      summary: Remove access to a package for a team
+      operationId: deleteTeamPackageGrant
+      security:
+        - npmSessionToken: []
+      responses:
+        '204':
+          $ref: './api/shared-components.yaml#/components/responses/EmptySuccess'
+        '401':
+          $ref: './api/shared-components.yaml#/components/responses/Unauthorized'
+  /-/org/{orgName}/package:
+    parameters:
+      - $ref: './api/shared-components.yaml#/components/parameters/OrgName'
+      - $ref: './api/shared-components.yaml#/components/parameters/RequiredBearerToken'
+    get:
+      tags:
+        - Access
+      summary: Get all packages for an org
+      description: Get all of the packages an org has access to, as well a the access level that org has for each pacakge.
+      operationId: getOrgPackages
+      security:
+        - npmSessionToken: []
+      responses:
+        '200':
+          $ref: '#/components/responses/PackageAccessLevels'
+        '401':
+          $ref: './api/shared-components.yaml#/components/responses/Unauthorized'
+  /-/package/{escapedPackageName}/collaborators:
+    parameters:
+      - $ref: './api/shared-components.yaml#/components/parameters/EscapedPackageName'
+      - $ref: './api/shared-components.yaml#/components/parameters/RequiredBearerToken'
+    get:
+      tags:
+        - Access
+      summary: Get all of the users that have access to a package, as well as the access level that user has for each package.
+      operationId: getPackageCollaborators
+      security:
+        - npmSessionToken: []
+      responses:
+        '200':
+          $ref: '#/components/responses/UserAccessLevels'
+        '401':
+          $ref: './api/shared-components.yaml#/components/responses/Unauthorized'
+  /-/package/{escapedPackageName}/visibility:
+    parameters:
+      - $ref: './api/shared-components.yaml#/components/parameters/EscapedPackageName'
+      - $ref: './api/shared-components.yaml#/components/parameters/RequiredBearerToken'
+    get:
+      tags:
+        - Access
+      summary: Get the visibility of a package.
+      operationId: getPackageVisibility
+      security:
+        - npmSessionToken: []
+      responses:
+        '200':
+          $ref: '#/components/responses/PackageVisibility'
+        '401':
+          $ref: './api/shared-components.yaml#/components/responses/Unauthorized'
+  /-/package/{escapedPackageName}/access:
+    parameters:
+      - $ref: './api/shared-components.yaml#/components/parameters/EscapedPackageName'
+    post:
+      tags:
+        - Access
+      summary: Sets the various access levels for a package.
+      operationId: setPackageAccess
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                # cidr_whitelist?
+                access:
+                  type: string
+                  enum:
+                    - public
+                    - private
+                  description: Visibility of a package
+                publish_requires_tfa:
+                  type: boolean
+                  description: Whether publishing this package requires multifactor auth
+                automation_token_overrides_tfa:
+                  type: boolean
+                  description: Whether or not automation tokens override the requirement for multifactor auth
+      security:
+        - npmSessionToken: []
+      responses:
+        '200':
+          $ref: './api/shared-components.yaml#/components/responses/EmptySuccess'
+        '401':
+          $ref: './api/shared-components.yaml#/components/responses/Unauthorized'