[schmitch]

A follow-up to #463 (npm registries), found by checking it against what main changed while it was open, chiefly the access levels of #460. It was stacked on #463's branch while that sat in the merge queue; #463 has merged, and this PR now targets main. It fixes no issue of its own, and npm behaves the same before and after it.

Changes

• Wording. Since RBAC: ordered access levels (read < write < delete) for grants and token scopes #460 a grant gives the level read, write or delete, each including the ones below it. docs/npm.md, the npm changelog fragment and the repository form's deployment-policy help text said "the write/delete permission"; they now name the levels. The Permissions table in docs/npm.md has a Level column and links to deployment.md#access-levels.
• docs/deployment.md. The table of access levels and the writer role now name npm's publish, dist-tags and deprecations (write) and npm unpublish (delete). "delete tags" now reads "delete image tags": removing an npm dist-tag takes write.
• docs/format-plugins.md. The crate layout lists crates/formats/npm next to NuGet and raw.
• A test for RBAC: ordered access levels (read < write < delete) for grants and token scopes #460's rule that a content selector on a write grant filters reads as well as publishes. a_selector_on_a_write_grant_scopes_publishes_and_reads gives a user write on @acme/* only. The user publishes and tags @acme packages and reads nothing else: packument (abbreviated and full), tarball and search. A publish outside the scope answers 403, and a dist-tag or a deprecation outside it answers 404.
• unpublishing_takes_the_delete_permission is renamed unpublishing_takes_the_delete_level, and a comment in state.rs now lists npm among the formats with all three kinds.

Tests

Run locally:

• cargo fmt --all --check; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo xtask changelog --check
• cargo test -p forge-server --test npm: 13 passed
• web: tsc, vitest (417)

🤖 Generated with Claude Code

https://claude.ai/code/session_01BaGpNGgkQV54XvgL5D9ay2

[schmitch]

The merge queue's first run of this PR (run 768) failed two checks. Neither comes from this PR's change; both passed on the PR's own run of the same tree.

• npm-e2e: FAIL: yarn npm whoami, with Yarn dying of EPIPE. That is a race in .github/scripts/npm-e2e.sh from npm registries as a built-in format plugin: hosted, proxy and group repositories with npm login #463: yarn npm whoami | grep -q … closes the pipe at the match, and Yarn's next write kills it. The fix is npm e2e: stop Yarn dying of EPIPE when a grep -q closes its pipe #468, against main. It isn't on this branch because the branch is queued and can't take pushes.
• test: redis_integration could not pull mirror.gcr.io/library/redis:7 (IOError … bytes remaining on stream). That's an image download breaking off; no code is involved.

The re-queued run uses the same script, so it can hit the race again until #468 merges.

---

Generated by Claude Code