A package-manager configuration batch: an asymmetric global config model, pnpm 11 project-write alignment, and native implementations of the npm-only verbs.
Asymmetric global config
Two related config-home changes shipped together.
Global reads are now unconditional. Nub previously read pnpm's global config.yaml and auth.ini only when the current directory was a pnpm project — a bug that applied a project-incumbent gate to global files that have nothing to do with the project. Global and project-scoped reads are now decoupled.
Global writes go to neutral files only. When writing with --location user|global, Nub never touches a PM-branded global file — auth keys and scalar settings go to ~/.npmrc, which every tool reads, and never to pnpm's config.yaml or auth.ini.
Project-local writes align with pnpm 11. The write router mirrors pnpm's own split: auth and npm-shared keys go to .npmrc; non-shared scalar keys go to pnpm-workspace.yaml under a pnpm incumbent, and to the project .npmrc under a Nub-identity or npm/yarn/bun project. Map settings — overrides, allowBuilds, catalogs — are refused with a pointer to pnpm-workspace.yaml. (#35)
Native npm-only verbs
The verbs below previously returned an npm-only error. They are now implemented natively — no shell-out — each hitting the registry directly with the same .npmrc auth and registry client the installer already uses, or editing the local package.json. (#36)
| Verb | What it does |
|---|---|
search <q> | Registry search, pnpm-shape output plus --json |
whoami | Whoami with .npmrc bearer auth |
owner ls/add/rm | Collaborators read plus maintainers write |
token list/create/revoke | Token CRUD |
pkg get/set/delete/fix | Local package.json property-path edits |
set-script <name> <cmd> | Script sugar over the same writer |
The full release notes list every change in this release.