@pnpm/network.fetch 1100.1.7 → 1100.1.9

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @pnpm/fetch
 
+## 1100.1.9
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/core-loggers@1100.3.0
+  - @pnpm/types@1101.7.0
+
+## 1100.1.8
+
+### Patch Changes
+
+- Republished every package: the tarballs published by the v11.13.1 through v11.16.0 releases were missing most of their compiled files due to a packing bug [#13164](https://github.com/pnpm/pnpm/issues/13164).
+
+- Updated dependencies:
+  - @pnpm/core-loggers@1100.2.5
+  - @pnpm/error@1100.1.0
+  - @pnpm/fetching.types@1100.0.3
+  - @pnpm/types@1101.6.0
+
 ## 1100.1.7
 
 ### Patch Changes

package/lib/dispatcher.d.ts

@@ -0,0 +1,33 @@
+import type { TlsConfig } from '@pnpm/types';
+import { type Dispatcher } from 'undici';
+export type ClientCertificates = Record<string, TlsConfig>;
+export interface DispatcherOptions {
+    ca?: string | string[] | Buffer;
+    cert?: string | string[] | Buffer;
+    key?: string | Buffer;
+    localAddress?: string;
+    maxSockets?: number;
+    strictSsl?: boolean;
+    timeout?: number;
+    httpProxy?: string;
+    httpsProxy?: string;
+    noProxy?: boolean | string;
+    clientCertificates?: ClientCertificates;
+}
+/**
+ * Clear the dispatcher cache. Useful for testing.
+ */
+export declare function clearDispatcherCache(): void;
+/**
+ * Destroy the global dispatcher and every cached dispatcher, closing their open
+ * sockets. Intended for process shutdown only: once called, the module can no
+ * longer perform network requests. This is used to work around a Windows crash
+ * that happens when the process exits while sockets are still open
+ * (https://github.com/nodejs/node/issues/56645).
+ */
+export declare function destroyDispatchers(): Promise<void>;
+/**
+ * Get a dispatcher for the given URI and options.
+ * Returns undefined if no special configuration is needed (to use global dispatcher).
+ */
+export declare function getDispatcher(uri: string, opts: DispatcherOptions): Dispatcher | undefined;

package/lib/dispatcher.js

@@ -0,0 +1,380 @@
+import net from 'node:net';
+import tls from 'node:tls';
+import { URL } from 'node:url';
+import { nerfDart } from '@pnpm/config.nerf-dart';
+import { PnpmError } from '@pnpm/error';
+import { LRUCache } from 'lru-cache';
+import { SocksClient } from 'socks';
+import { Agent, getGlobalDispatcher, ProxyAgent, setGlobalDispatcher } from 'undici';
+const DEFAULT_MAX_SOCKETS = 50;
+const KEEP_ALIVE_TIMEOUT = 30_000; // 30 seconds
+const KEEP_ALIVE_MAX_TIMEOUT = 600_000; // 10 minutes
+// Set an optimized global dispatcher so that requests without custom options
+// (no proxy, no custom certs) still benefit from better keep-alive and Happy Eyeballs.
+//
+// Note: we intentionally do NOT enable HTTP/2 (allowH2) or HTTP/1.1 pipelining here.
+// With HTTP/2, undici multiplexes many streams over 1-2 TCP connections sharing a single
+// congestion window. In benchmarks this was slower than opening ~50 independent HTTP/1.1
+// connections that each get their own congestion window and can saturate bandwidth in parallel.
+const GLOBAL_DISPATCHER = new Agent({
+    connections: DEFAULT_MAX_SOCKETS,
+    keepAliveTimeout: KEEP_ALIVE_TIMEOUT,
+    keepAliveMaxTimeout: KEEP_ALIVE_MAX_TIMEOUT,
+    connect: {
+        autoSelectFamily: true,
+    },
+}).compose(stripSecFetchHeaders);
+setGlobalDispatcher(GLOBAL_DISPATCHER);
+// undici's fetch() automatically adds sec-fetch-* headers (e.g. sec-fetch-mode: cors)
+// per the Fetch spec. Some registries like Azure DevOps Artifacts interpret these as
+// browser requests and reject them with HTTP 400. Since pnpm is a CLI tool, these
+// headers serve no purpose and must be stripped.
+// See https://github.com/pnpm/pnpm/issues/11572
+function stripSecFetchHeaders(dispatch) {
+    return (opts, handler) => {
+        if (opts.headers) {
+            if (Array.isArray(opts.headers)) {
+                // Flat array format: [key1, val1, key2, val2, ...]
+                const filtered = [];
+                for (let i = 0; i < opts.headers.length; i += 2) {
+                    if (!opts.headers[i].toLowerCase().startsWith('sec-fetch-')) {
+                        filtered.push(opts.headers[i], opts.headers[i + 1]);
+                    }
+                }
+                opts = { ...opts, headers: filtered };
+            }
+            else if (typeof opts.headers === 'object') {
+                // undici also accepts an iterable of [key, value] pairs (e.g. a Map or
+                // web Headers). Use that iterator when present; otherwise fall back to
+                // Object.entries for plain IncomingHttpHeaders objects.
+                const entries = Symbol.iterator in opts.headers
+                    ? opts.headers
+                    : Object.entries(opts.headers);
+                const headers = {};
+                for (const [key, value] of entries) {
+                    if (!key.toLowerCase().startsWith('sec-fetch-')) {
+                        headers[key] = value;
+                    }
+                }
+                opts = { ...opts, headers };
+            }
+        }
+        return dispatch(opts, handler);
+    };
+}
+const DISPATCHER_CACHE = new LRUCache({
+    max: 50,
+    dispose: (dispatcher) => {
+        if (typeof dispatcher.close === 'function') {
+            void dispatcher.close();
+        }
+    },
+});
+/**
+ * Clear the dispatcher cache. Useful for testing.
+ */
+export function clearDispatcherCache() {
+    DISPATCHER_CACHE.clear();
+}
+/**
+ * Destroy the global dispatcher and every cached dispatcher, closing their open
+ * sockets. Intended for process shutdown only: once called, the module can no
+ * longer perform network requests. This is used to work around a Windows crash
+ * that happens when the process exits while sockets are still open
+ * (https://github.com/nodejs/node/issues/56645).
+ */
+export async function destroyDispatchers() {
+    // getGlobalDispatcher() is included in case something replaced GLOBAL_DISPATCHER
+    // via setGlobalDispatcher(); the Set removes the duplicate when it is still our own instance.
+    const dispatchers = new Set([
+        GLOBAL_DISPATCHER,
+        getGlobalDispatcher(),
+        ...DISPATCHER_CACHE.values(),
+    ]);
+    await Promise.allSettled(Array.from(dispatchers, dispatcher => dispatcher.destroy()));
+}
+/**
+ * Get a dispatcher for the given URI and options.
+ * Returns undefined if no special configuration is needed (to use global dispatcher).
+ */
+export function getDispatcher(uri, opts) {
+    // If no special options are set, use the global dispatcher
+    if (!needsCustomDispatcher(opts)) {
+        return undefined;
+    }
+    const parsedUri = new URL(uri);
+    if ((opts.httpProxy || opts.httpsProxy) && !checkNoProxy(parsedUri, opts)) {
+        const proxyDispatcher = getProxyDispatcher(parsedUri, opts);
+        if (proxyDispatcher)
+            return proxyDispatcher;
+    }
+    return getNonProxyDispatcher(parsedUri, opts);
+}
+function hasClientCertificates(certs) {
+    if (!certs)
+        return false;
+    for (const uri in certs) {
+        const entry = certs[uri];
+        if (entry.cert || entry.key || entry.ca)
+            return true;
+    }
+    return false;
+}
+function needsCustomDispatcher(opts) {
+    return Boolean(opts.httpProxy ||
+        opts.httpsProxy ||
+        opts.ca ||
+        opts.cert ||
+        opts.key ||
+        opts.localAddress ||
+        opts.strictSsl === false ||
+        hasClientCertificates(opts.clientCertificates) ||
+        opts.maxSockets);
+}
+function parseProxyUrl(proxy, protocol) {
+    let proxyUrl = proxy;
+    if (!proxyUrl.includes('://')) {
+        proxyUrl = `${protocol}//${proxyUrl}`;
+    }
+    try {
+        return new URL(proxyUrl);
+    }
+    catch {
+        throw new PnpmError('INVALID_PROXY', "Couldn't parse proxy URL", {
+            hint: 'If your proxy URL contains a username and password, make sure to URL-encode them ' +
+                '(you may use the encodeURIComponent function). For instance, ' +
+                'https-proxy=https://use%21r:pas%2As@my.proxy:1234/foo. ' +
+                'Do not encode the colon (:) between the username and password.',
+        });
+    }
+}
+function getSocksProxyType(protocol) {
+    switch (protocol.replace(':', '')) {
+        case 'socks4':
+        case 'socks4a':
+            return 4;
+        default:
+            return 5;
+    }
+}
+function getProxyDispatcher(parsedUri, opts) {
+    const isHttps = parsedUri.protocol === 'https:';
+    const proxy = isHttps ? opts.httpsProxy : opts.httpProxy;
+    if (!proxy)
+        return null;
+    const proxyUrl = parseProxyUrl(proxy, parsedUri.protocol);
+    const sslConfig = pickSettingByUrl(opts.clientCertificates, parsedUri.href);
+    const { ca, cert, key: certKey } = { ...opts, ...sslConfig };
+    const key = [
+        `proxy:${proxyUrl.protocol}//${proxyUrl.username}:${proxyUrl.password}@${proxyUrl.host}:${proxyUrl.port}`,
+        `https:${isHttps.toString()}`,
+        `local-address:${opts.localAddress ?? '>no-local-address<'}`,
+        `max-sockets:${(opts.maxSockets ?? DEFAULT_MAX_SOCKETS).toString()}`,
+        `strict-ssl:${isHttps ? Boolean(opts.strictSsl).toString() : '>no-strict-ssl<'}`,
+        `ca:${(isHttps && ca?.toString()) || '-'}`,
+        `cert:${(isHttps && cert?.toString()) || '-'}`,
+        `key:${(isHttps && certKey?.toString()) || '-'}`,
+    ].join(':');
+    if (DISPATCHER_CACHE.has(key)) {
+        return DISPATCHER_CACHE.get(key);
+    }
+    let dispatcher;
+    if (proxyUrl.protocol.startsWith('socks')) {
+        dispatcher = createSocksDispatcher(proxyUrl, parsedUri, opts, { ca, cert, key: certKey });
+    }
+    else {
+        dispatcher = createHttpProxyDispatcher(proxyUrl, isHttps, opts, { ca, cert, key: certKey });
+    }
+    dispatcher = dispatcher.compose(stripSecFetchHeaders);
+    DISPATCHER_CACHE.set(key, dispatcher);
+    return dispatcher;
+}
+function createHttpProxyDispatcher(proxyUrl, isHttps, opts, tlsConfig) {
+    return new ProxyAgent({
+        uri: proxyUrl.href,
+        token: proxyUrl.username
+            ? `Basic ${Buffer.from(`${decodeURIComponent(proxyUrl.username)}:${decodeURIComponent(proxyUrl.password)}`).toString('base64')}`
+            : undefined,
+        connections: opts.maxSockets ?? DEFAULT_MAX_SOCKETS,
+        keepAliveTimeout: KEEP_ALIVE_TIMEOUT,
+        keepAliveMaxTimeout: KEEP_ALIVE_MAX_TIMEOUT,
+        requestTls: isHttps
+            ? {
+                ca: tlsConfig.ca,
+                cert: tlsConfig.cert,
+                key: tlsConfig.key,
+                rejectUnauthorized: opts.strictSsl ?? true,
+                localAddress: opts.localAddress,
+            }
+            : undefined,
+        proxyTls: {
+            ca: opts.ca,
+            rejectUnauthorized: opts.strictSsl ?? true,
+        },
+    });
+}
+function createSocksDispatcher(proxyUrl, targetUri, opts, tlsConfig) {
+    const isHttps = targetUri.protocol === 'https:';
+    const socksType = getSocksProxyType(proxyUrl.protocol);
+    const proxyHost = proxyUrl.hostname;
+    const proxyPort = parseInt(proxyUrl.port, 10) || (socksType === 4 ? 1080 : 1080);
+    return new Agent({
+        connections: opts.maxSockets ?? DEFAULT_MAX_SOCKETS,
+        keepAliveTimeout: KEEP_ALIVE_TIMEOUT,
+        keepAliveMaxTimeout: KEEP_ALIVE_MAX_TIMEOUT,
+        connect: async (connectOpts, callback) => {
+            try {
+                const { socket } = await SocksClient.createConnection({
+                    proxy: {
+                        host: proxyHost,
+                        port: proxyPort,
+                        type: socksType,
+                        userId: proxyUrl.username ? decodeURIComponent(proxyUrl.username) : undefined,
+                        password: proxyUrl.password ? decodeURIComponent(proxyUrl.password) : undefined,
+                    },
+                    command: 'connect',
+                    destination: {
+                        host: connectOpts.hostname,
+                        port: parseInt(String(connectOpts.port), 10),
+                    },
+                });
+                if (isHttps) {
+                    const tlsOpts = {
+                        socket: socket,
+                        servername: connectOpts.hostname,
+                        ca: tlsConfig.ca,
+                        cert: tlsConfig.cert,
+                        key: tlsConfig.key,
+                        rejectUnauthorized: opts.strictSsl ?? true,
+                    };
+                    const tlsSocket = tls.connect(tlsOpts);
+                    tlsSocket.on('secureConnect', () => {
+                        callback(null, tlsSocket);
+                    });
+                    tlsSocket.on('error', (err) => {
+                        callback(err, null);
+                    });
+                }
+                else {
+                    callback(null, socket);
+                }
+            }
+            catch (err) {
+                callback(err, null);
+            }
+        },
+    });
+}
+function getNonProxyDispatcher(parsedUri, opts) {
+    const isHttps = parsedUri.protocol === 'https:';
+    const sslConfig = pickSettingByUrl(opts.clientCertificates, parsedUri.href);
+    const { ca, cert, key: certKey } = { ...opts, ...sslConfig };
+    const key = [
+        `https:${isHttps.toString()}`,
+        `local-address:${opts.localAddress ?? '>no-local-address<'}`,
+        `max-sockets:${(opts.maxSockets ?? DEFAULT_MAX_SOCKETS).toString()}`,
+        `strict-ssl:${isHttps ? Boolean(opts.strictSsl).toString() : '>no-strict-ssl<'}`,
+        `ca:${(isHttps && ca?.toString()) || '-'}`,
+        `cert:${(isHttps && cert?.toString()) || '-'}`,
+        `key:${(isHttps && certKey?.toString()) || '-'}`,
+    ].join(':');
+    if (DISPATCHER_CACHE.has(key)) {
+        return DISPATCHER_CACHE.get(key);
+    }
+    const connectTimeout = typeof opts.timeout !== 'number' || opts.timeout === 0
+        ? 0
+        : opts.timeout + 1;
+    const agent = new Agent({
+        connections: opts.maxSockets ?? DEFAULT_MAX_SOCKETS,
+        connectTimeout,
+        keepAliveTimeout: KEEP_ALIVE_TIMEOUT,
+        keepAliveMaxTimeout: KEEP_ALIVE_MAX_TIMEOUT,
+        connect: isHttps
+            ? {
+                autoSelectFamily: true,
+                ca,
+                cert,
+                key: certKey,
+                rejectUnauthorized: opts.strictSsl ?? true,
+                localAddress: opts.localAddress,
+            }
+            : {
+                autoSelectFamily: true,
+                localAddress: opts.localAddress,
+            },
+    });
+    const dispatcher = agent.compose(stripSecFetchHeaders);
+    DISPATCHER_CACHE.set(key, dispatcher);
+    return dispatcher;
+}
+function checkNoProxy(parsedUri, opts) {
+    const host = parsedUri.hostname
+        .split('.')
+        .filter(x => x)
+        .reverse();
+    if (typeof opts.noProxy === 'string') {
+        const noproxyArr = opts.noProxy.split(',').map(s => s.trim());
+        return noproxyArr.some(no => {
+            const noParts = no
+                .split('.')
+                .filter(x => x)
+                .reverse();
+            if (noParts.length === 0) {
+                return false;
+            }
+            for (let i = 0; i < noParts.length; i++) {
+                if (host[i] !== noParts[i]) {
+                    return false;
+                }
+            }
+            return true;
+        });
+    }
+    return opts.noProxy === true;
+}
+/**
+ * Pick SSL/TLS configuration by URL using nerf-dart matching.
+ * This matches the behavior of @pnpm/network.config's pickSettingByUrl.
+ */
+function pickSettingByUrl(settings, uri) {
+    if (!settings)
+        return undefined;
+    // Try exact match first
+    if (settings[uri])
+        return settings[uri];
+    // Use nerf-dart format for matching (e.g., //registry.npmjs.org/)
+    const nerf = nerfDart(uri);
+    if (settings[nerf])
+        return settings[nerf];
+    // Try without port
+    const parsedUrl = new URL(uri);
+    const withoutPort = removePort(parsedUrl);
+    if (settings[withoutPort])
+        return settings[withoutPort];
+    // Try progressively shorter nerf-dart paths
+    const maxParts = Object.keys(settings).reduce((max, key) => {
+        const parts = key.split('/').length;
+        return parts > max ? parts : max;
+    }, 0);
+    const parts = nerf.split('/');
+    for (let i = Math.min(parts.length, maxParts) - 1; i >= 3; i--) {
+        const key = `${parts.slice(0, i).join('/')}/`;
+        if (settings[key]) {
+            return settings[key];
+        }
+    }
+    // If the URL had a port, try again without it
+    if (withoutPort !== uri) {
+        return pickSettingByUrl(settings, withoutPort);
+    }
+    return undefined;
+}
+function removePort(parsedUrl) {
+    if (parsedUrl.port === '')
+        return parsedUrl.href;
+    const copy = new URL(parsedUrl.href);
+    copy.port = '';
+    const res = copy.toString();
+    return res.endsWith('/') ? res : `${res}/`;
+}
+//# sourceMappingURL=dispatcher.js.map

package/lib/fetch.d.ts

@@ -0,0 +1,22 @@
+import { type RetryTimeoutOptions } from '@zkochan/retry';
+import { type Dispatcher } from 'undici';
+export { type RetryTimeoutOptions };
+interface URLLike {
+    href: string;
+}
+export declare function isRedirect(statusCode: number): boolean;
+export type RequestInfo = string | URLLike | URL;
+export interface RequestInit extends globalThis.RequestInit {
+    retry?: RetryTimeoutOptions;
+    timeout?: number;
+    dispatcher?: Dispatcher;
+}
+export declare function fetch(url: RequestInfo, opts?: RequestInit): Promise<Response>;
+export declare class ResponseError extends Error {
+    res: Response;
+    code: number;
+    status: number;
+    statusCode: number;
+    url: string;
+    constructor(res: Response);
+}

package/lib/fetch.js

@@ -0,0 +1,109 @@
+import { requestRetryLogger } from '@pnpm/core-loggers';
+import { operation } from '@zkochan/retry';
+import { fetch as undiciFetch } from 'undici';
+export {};
+const NO_RETRY_ERROR_CODES = new Set([
+    'SELF_SIGNED_CERT_IN_CHAIN',
+    'ERR_OSSL_PEM_NO_START_LINE',
+]);
+const REDIRECT_CODES = new Set([301, 302, 303, 307, 308]);
+export function isRedirect(statusCode) {
+    return REDIRECT_CODES.has(statusCode);
+}
+export async function fetch(url, opts = {}) {
+    const retryOpts = opts.retry ?? {};
+    const maxRetries = retryOpts.retries ?? 2;
+    const op = operation({
+        factor: retryOpts.factor ?? 10,
+        maxTimeout: retryOpts.maxTimeout ?? 60000,
+        minTimeout: retryOpts.minTimeout ?? 10000,
+        randomize: false,
+        retries: maxRetries,
+    });
+    try {
+        return await new Promise((resolve, reject) => {
+            op.attempt(async (attempt) => {
+                const urlString = typeof url === 'string' ? url : url.href ?? url.toString();
+                const { retry: _retry, timeout, dispatcher, ...fetchOpts } = opts;
+                const signal = timeout ? AbortSignal.timeout(timeout) : undefined;
+                try {
+                    // undici's Response type differs slightly from globalThis.Response (iterator types),
+                    // requiring the double cast. This is a known TypeScript/undici compatibility issue.
+                    const res = await undiciFetch(urlString, { ...fetchOpts, signal, dispatcher });
+                    // A retry on 409 sometimes helps when making requests to the Bit registry.
+                    if ((res.status >= 500 && res.status < 600) || [408, 409, 420, 429].includes(res.status)) {
+                        throw new ResponseError(res);
+                    }
+                    else {
+                        resolve(res);
+                    }
+                }
+                catch (error) {
+                    // Undici errors may not pass isNativeError check, so we handle them more carefully
+                    const err = error;
+                    // Check error code in both error.code and error.cause.code (undici wraps errors)
+                    const errorCode = err?.code ?? err?.cause?.code;
+                    if (typeof errorCode === 'string' &&
+                        NO_RETRY_ERROR_CODES.has(errorCode)) {
+                        reject(error);
+                        return;
+                    }
+                    const retryTimeout = op.retry(err);
+                    if (retryTimeout === false) {
+                        reject(op.mainError());
+                        return;
+                    }
+                    // Extract error properties into a plain object because Error properties
+                    // are non-enumerable and don't serialize well through the logging system
+                    const errorInfo = {
+                        name: err.name,
+                        message: err.message,
+                        code: err.code,
+                        errno: err.errno,
+                        // For HTTP errors from ResponseError class
+                        status: err.status,
+                        statusCode: err.statusCode,
+                        // undici wraps the actual network error in a cause property
+                        cause: err.cause ? {
+                            code: err.cause.code,
+                            errno: err.cause.errno,
+                        } : undefined,
+                    };
+                    requestRetryLogger.debug({
+                        attempt,
+                        error: errorInfo,
+                        maxRetries,
+                        method: opts.method ?? 'GET',
+                        timeout: retryTimeout,
+                        url: urlString,
+                    });
+                }
+            });
+        });
+    }
+    catch (err) {
+        if (err instanceof ResponseError) {
+            return err.res;
+        }
+        throw err;
+    }
+}
+export class ResponseError extends Error {
+    res;
+    code;
+    status;
+    statusCode;
+    url;
+    constructor(res) {
+        super(res.statusText);
+        if (Error.captureStackTrace) {
+            Error.captureStackTrace(this, ResponseError);
+        }
+        this.name = this.constructor.name;
+        this.res = res;
+        // backward compat
+        this.code = this.status = this.statusCode = res.status;
+        this.url = res.url;
+    }
+}
+//# sourceMappingURL=fetch.js.map

package/lib/fetchFromRegistry.d.ts

@@ -0,0 +1,29 @@
+import { URL } from 'node:url';
+import type { FetchFromRegistry } from '@pnpm/fetching.types';
+import type { RegistryConfig } from '@pnpm/types';
+import { type DispatcherOptions } from './dispatcher.js';
+import { type RequestInit } from './fetch.js';
+export interface FetchWithDispatcherOptions extends RequestInit {
+    dispatcherOptions: DispatcherOptions;
+}
+export declare function fetchWithDispatcher(url: string | URL, opts: FetchWithDispatcherOptions): Promise<Response>;
+export interface CreateDispatchedFetchOptions extends DispatcherOptions {
+    /**
+     * Per-registry config (TLS, auth, etc.). When set, the matching TLS entries
+     * are automatically extracted into `clientCertificates` so callers don't
+     * have to do it themselves.
+     */
+    configByUri?: Record<string, RegistryConfig>;
+}
+/**
+ * Returns a {@link fetch} pre-bound to the given dispatcher options, so callers
+ * that need a fetch function (rather than a one-shot call) can route their
+ * requests through the configured proxy / TLS / local-address settings.
+ */
+export declare function createDispatchedFetch(opts: CreateDispatchedFetchOptions): (url: string | URL, opts?: RequestInit) => Promise<Response>;
+export type { DispatcherOptions };
+export interface CreateFetchFromRegistryOptions extends DispatcherOptions {
+    userAgent?: string;
+    configByUri?: Record<string, RegistryConfig>;
+}
+export declare function createFetchFromRegistry(defaultOpts: CreateFetchFromRegistryOptions): FetchFromRegistry;

package/lib/fetchFromRegistry.js

@@ -0,0 +1,133 @@
+import { URL } from 'node:url';
+import { redactUrlCredentials } from '@pnpm/error';
+import { getDispatcher } from './dispatcher.js';
+import { fetch, isRedirect } from './fetch.js';
+const USER_AGENT = 'pnpm'; // or maybe make it `${pkg.name}/${pkg.version} (+https://npm.im/${pkg.name})`
+const FULL_DOC = 'application/json';
+const ACCEPT_FULL_DOC = `${FULL_DOC}; q=1.0, */*`;
+const ABBREVIATED_DOC = 'application/vnd.npm.install-v1+json';
+const ACCEPT_ABBREVIATED_DOC = `${ABBREVIATED_DOC}; q=1.0, ${FULL_DOC}; q=0.8, */*`;
+const MAX_FOLLOWED_REDIRECTS = 20;
+export function fetchWithDispatcher(url, opts) {
+    const dispatcher = getDispatcher(url.toString(), {
+        ...opts.dispatcherOptions,
+        strictSsl: opts.dispatcherOptions.strictSsl ?? true,
+    });
+    return fetch(url, {
+        ...opts,
+        dispatcher,
+    });
+}
+/**
+ * Returns a {@link fetch} pre-bound to the given dispatcher options, so callers
+ * that need a fetch function (rather than a one-shot call) can route their
+ * requests through the configured proxy / TLS / local-address settings.
+ */
+export function createDispatchedFetch(opts) {
+    const dispatcherOptions = {
+        ...opts,
+        clientCertificates: opts.clientCertificates ?? extractTlsConfigs(opts.configByUri),
+    };
+    return (url, fetchOpts) => fetchWithDispatcher(url, { ...fetchOpts, dispatcherOptions });
+}
+export function createFetchFromRegistry(defaultOpts) {
+    const clientCertificates = extractTlsConfigs(defaultOpts.configByUri);
+    return async (url, opts) => {
+        const headers = {
+            'user-agent': USER_AGENT,
+            ...getHeaders({
+                auth: opts?.authHeaderValue,
+                fullMetadata: opts?.fullMetadata,
+                method: opts?.method,
+                userAgent: defaultOpts.userAgent,
+            }),
+        };
+        if (opts?.ifNoneMatch) {
+            headers['if-none-match'] = opts.ifNoneMatch;
+        }
+        if (opts?.ifModifiedSince) {
+            headers['if-modified-since'] = opts.ifModifiedSince;
+        }
+        // Merge caller-provided headers (e.g. content-type, npm-otp) on top
+        if (opts?.headers) {
+            const optsHeaders = opts.headers instanceof Headers
+                ? Object.fromEntries(opts.headers.entries())
+                : Array.isArray(opts.headers)
+                    ? Object.fromEntries(opts.headers)
+                    : opts.headers;
+            Object.assign(headers, optsHeaders);
+        }
+        let redirects = 0;
+        let urlObject = new URL(url);
+        const originalHost = urlObject.host;
+        /* eslint-disable no-await-in-loop */
+        while (true) {
+            const dispatcherOptions = {
+                ...defaultOpts,
+                ...opts,
+                strictSsl: defaultOpts.strictSsl ?? true,
+                clientCertificates,
+            };
+            const response = await fetchWithDispatcher(urlObject, {
+                dispatcherOptions,
+                body: opts?.body,
+                // if verifying integrity, native fetch must not decompress
+                headers,
+                method: opts?.method,
+                redirect: 'manual',
+                retry: opts?.retry,
+                timeout: opts?.timeout ?? 60000,
+            });
+            if (!isRedirect(response.status) || redirects >= MAX_FOLLOWED_REDIRECTS) {
+                return response;
+            }
+            redirects++;
+            // This is a workaround to remove authorization headers on redirect.
+            // Related pnpm issue: https://github.com/pnpm/pnpm/issues/1815
+            urlObject = resolveRedirectUrl(response, urlObject);
+            if (originalHost === urlObject.host)
+                continue;
+            if (headers['authorization']) {
+                delete headers.authorization;
+            }
+            delete headers['npm-otp'];
+        }
+        /* eslint-enable no-await-in-loop */
+    };
+}
+function getHeaders(opts) {
+    const headers = {};
+    // The abbreviated/full-metadata Accept header is meaningful only on package
+    // metadata reads. Setting it on writes (PUT/POST/DELETE) breaks npmjs.org's
+    // dist-tag endpoint, which rejects the request with a generic 400.
+    if (!opts.method || opts.method === 'GET' || opts.method === 'HEAD') {
+        headers.accept = opts.fullMetadata === true ? ACCEPT_FULL_DOC : ACCEPT_ABBREVIATED_DOC;
+    }
+    if (opts.auth) {
+        headers['authorization'] = opts.auth;
+    }
+    if (opts.userAgent) {
+        headers['user-agent'] = opts.userAgent;
+    }
+    return headers;
+}
+function extractTlsConfigs(configByUri) {
+    if (!configByUri)
+        return undefined;
+    let result;
+    for (const [uri, config] of Object.entries(configByUri)) {
+        if (config.tls) {
+            result ??= {};
+            result[uri] = config.tls;
+        }
+    }
+    return result;
+}
+function resolveRedirectUrl(response, currentUrl) {
+    const location = response.headers.get('location');
+    if (!location) {
+        throw new Error(`Redirect location header missing for ${redactUrlCredentials(currentUrl.toString())}`);
+    }
+    return new URL(location, currentUrl);
+}
+//# sourceMappingURL=fetchFromRegistry.js.map

package/lib/index.d.ts

@@ -0,0 +1,4 @@
+export { clearDispatcherCache, destroyDispatchers, getDispatcher } from './dispatcher.js';
+export { fetch, isRedirect, type RetryTimeoutOptions } from './fetch.js';
+export { createDispatchedFetch, type CreateDispatchedFetchOptions, createFetchFromRegistry, type CreateFetchFromRegistryOptions, type DispatcherOptions, fetchWithDispatcher } from './fetchFromRegistry.js';
+export type { FetchFromRegistry } from '@pnpm/fetching.types';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/network.fetch",
-  "version": "1100.1.7",
+  "version": "1100.1.9",
   "description": "Native fetch with retries",
   "keywords": [
     "pnpm",
@@ -30,12 +30,12 @@
   ],
   "dependencies": {
     "@pnpm/config.nerf-dart": "^2.0.1",
-    "@pnpm/core-loggers": "1100.2.4",
-    "@pnpm/error": "1100.0.1",
-    "@pnpm/fetching.types": "1100.0.2",
-    "@pnpm/types": "1101.5.0",
+    "@pnpm/core-loggers": "1100.3.0",
+    "@pnpm/error": "1100.1.0",
+    "@pnpm/fetching.types": "1100.0.3",
+    "@pnpm/types": "1101.7.0",
     "@zkochan/retry": "^0.2.0",
-    "lru-cache": "^11.5.0",
+    "lru-cache": "^11.5.2",
     "socks": "^2.8.9",
     "undici": "^7.27.2"
   },
@@ -45,7 +45,7 @@
   "devDependencies": {
     "@jest/globals": "30.4.1",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/network.fetch": "1100.1.7",
+    "@pnpm/network.fetch": "1100.1.9",
     "https-proxy-server-express": "0.1.2"
   },
   "engines": {