@pnpm/releasing.commands 1100.4.4 → 1100.5.0

package/lib/deploy/createDeployFiles.d.ts

@@ -20,4 +20,4 @@ export interface DeployFiles {
     manifest: ProjectManifest;
     workspaceManifest?: DeployWorkspaceManifest;
 }
-export declare function createDeployFiles({ allProjects, deployDir, lockfile, lockfileDir, patchedDependencies, selectedProjectManifest, projectId, rootProjectManifestDir, allowBuilds }: CreateDeployFilesOptions): DeployFiles;
+export declare function createDeployFiles({ allProjects, deployDir, lockfile, lockfileDir, patchedDependencies, selectedProjectManifest, projectId, rootProjectManifestDir, allowBuilds, }: CreateDeployFilesOptions): DeployFiles;

package/lib/publish/batchPublish.d.ts

@@ -0,0 +1,20 @@
+import type { Config, ConfigContext } from '@pnpm/config.reader';
+import type { Project } from '@pnpm/types';
+import { type PublishSummary } from '../tarball/publishSummary.js';
+import type { PublishRecursiveOpts } from './recursivePublish.js';
+export declare const BATCH_PUBLISH_ENDPOINT = "/-/pnpm/v1/publish";
+export type BatchPublishOptions = PublishRecursiveOpts & Pick<Config, 'embedReadme' | 'ignoreScripts' | 'nodeLinker' | 'packGzipLevel' | 'skipManifestObfuscation'> & Partial<Pick<ConfigContext, 'hooks'>>;
+/**
+ * Publish all {@link pkgs} by sending a single `PUT /-/pnpm/v1/publish` request per target
+ * registry, instead of one request per package. The endpoint is not part of the standard npm
+ * registry API — the registry has to implement it explicitly (pnpr does), so this whole code
+ * path is opt-in via the `--batch` flag.
+ *
+ * Every package is packed (and its `prepublishOnly`/`prepublish` scripts run) before anything
+ * is sent, so a package that fails to pack aborts the publish before any package reaches the
+ * registry. The `publish`/`postpublish` scripts run only after the requests succeeded.
+ *
+ * @param pkgs packages to publish, already filtered (no private packages, no already-published
+ *   versions) and in dependency order.
+ */
+export declare function batchPublishPackages(pkgs: Project[], opts: BatchPublishOptions): Promise<PublishSummary[]>;

package/lib/publish/batchPublish.js

@@ -0,0 +1,201 @@
+import { createHash } from 'node:crypto';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { PnpmError } from '@pnpm/error';
+import { globalInfo, globalWarn } from '@pnpm/logger';
+import { withOtpHandling } from '@pnpm/network.web-auth';
+import { rimraf } from '@zkochan/rimraf';
+import npmFetch from 'npm-registry-fetch';
+import { realpathMissing } from 'realpath-missing';
+import semver from 'semver';
+import { temporaryDirectory } from 'tempy';
+import { createPublishSummary } from '../tarball/publishSummary.js';
+import * as pack from './pack.js';
+import { runScriptsIfPresent } from './publish.js';
+import { createPublishContext, createPublishOptions, findRegistryInfo, isPublishAccess, } from './publishPackedPkg.js';
+export const BATCH_PUBLISH_ENDPOINT = '/-/pnpm/v1/publish';
+/**
+ * Publish all {@link pkgs} by sending a single `PUT /-/pnpm/v1/publish` request per target
+ * registry, instead of one request per package. The endpoint is not part of the standard npm
+ * registry API — the registry has to implement it explicitly (pnpr does), so this whole code
+ * path is opt-in via the `--batch` flag.
+ *
+ * Every package is packed (and its `prepublishOnly`/`prepublish` scripts run) before anything
+ * is sent, so a package that fails to pack aborts the publish before any package reaches the
+ * registry. The `publish`/`postpublish` scripts run only after the requests succeeded.
+ *
+ * @param pkgs packages to publish, already filtered (no private packages, no already-published
+ *   versions) and in dependency order.
+ */
+export async function batchPublishPackages(pkgs, opts) {
+    if (opts.stage) {
+        throw new PnpmError('BATCH_PUBLISH_NO_STAGE', 'Staged publishing cannot be combined with --batch');
+    }
+    if (opts.provenance) {
+        throw new PnpmError('BATCH_PUBLISH_NO_PROVENANCE', 'Provenance statements cannot be generated when publishing with --batch', {
+            hint: 'Provenance is bound to a single package, but --batch sends many packages in one request. Publish without --batch to attach provenance.',
+        });
+    }
+    const packedByRegistry = new Map();
+    const packedPkgs = [];
+    for (const project of pkgs) {
+        // eslint-disable-next-line no-await-in-loop
+        const packedPkg = await packPkgForBatch(project, opts);
+        const publishConfigRegistry = typeof packedPkg.publishedManifest.publishConfig?.registry === 'string'
+            ? packedPkg.publishedManifest.publishConfig.registry
+            : undefined;
+        const { registry } = findRegistryInfo(packedPkg.publishedManifest, opts, publishConfigRegistry);
+        let group = packedByRegistry.get(registry);
+        if (!group) {
+            group = [];
+            packedByRegistry.set(registry, group);
+        }
+        group.push(packedPkg);
+        packedPkgs.push(packedPkg);
+    }
+    for (const [registry, group] of packedByRegistry.entries()) {
+        for (const { summary } of group) {
+            globalInfo(`📦 ${summary.id} → ${registry}`);
+        }
+        if (opts.dryRun) {
+            globalWarn(`Skip publishing ${group.length} package(s) to ${registry} (dry run)`);
+            continue;
+        }
+        // eslint-disable-next-line no-await-in-loop
+        await multiPublishToRegistry(registry, group, opts);
+        globalInfo(`✅ Published ${group.length} package(s) to ${registry} in a single request`);
+    }
+    if (!opts.ignoreScripts) {
+        for (const { project } of packedPkgs) {
+            // eslint-disable-next-line no-await-in-loop
+            await runScriptsIfPresent(await lifecycleOpts(project.rootDir, opts), ['publish', 'postpublish'], project.manifest);
+        }
+    }
+    return packedPkgs.map(({ summary }) => summary);
+}
+async function packPkgForBatch(project, opts) {
+    if (!opts.ignoreScripts) {
+        await runScriptsIfPresent(await lifecycleOpts(project.rootDir, opts), ['prepublishOnly', 'prepublish'], project.manifest);
+    }
+    // The tarball is packed into a temporary directory and read into memory right away — the
+    // request body carries it base64-encoded, so nothing needs to stay on disk.
+    const packDestination = temporaryDirectory();
+    try {
+        const packResult = await pack.api({
+            ...opts,
+            dir: project.rootDir,
+            packDestination,
+            dryRun: false,
+        });
+        const tarballData = await fs.readFile(packResult.tarballPath);
+        return {
+            project,
+            publishedManifest: packResult.publishedManifest,
+            tarballData,
+            summary: createPublishSummary(packResult, tarballData),
+        };
+    }
+    finally {
+        await rimraf(packDestination);
+    }
+}
+async function lifecycleOpts(pkgRoot, opts) {
+    return {
+        depPath: pkgRoot,
+        extraBinPaths: opts.extraBinPaths,
+        extraEnv: opts.extraEnv,
+        pkgRoot,
+        rootModulesDir: await realpathMissing(path.join(pkgRoot, 'node_modules')),
+        stdio: 'inherit',
+        unsafePerm: true, // when running scripts explicitly, assume that they're trusted.
+        userAgent: opts.userAgent,
+    };
+}
+async function multiPublishToRegistry(registry, group, opts) {
+    // A package-scoped OIDC token cannot authorize a request that publishes many packages, so the
+    // OIDC exchange is skipped and only statically configured credentials are used.
+    const publishOptions = await createPublishOptions(group[0].publishedManifest, opts, { oidc: false });
+    const body = {
+        packages: group.map((packedPkg) => createPublishDocument(packedPkg, registry, opts)),
+    };
+    const fetchOptions = {
+        method: 'GET',
+        retry: {
+            factor: opts.fetchRetryFactor,
+            maxTimeout: opts.fetchRetryMaxtimeout,
+            minTimeout: opts.fetchRetryMintimeout,
+            retries: opts.fetchRetries,
+        },
+        timeout: opts.fetchTimeout,
+    };
+    try {
+        await withOtpHandling({
+            context: createPublishContext(opts),
+            fetchOptions,
+            operation: async (otp) => npmFetch(BATCH_PUBLISH_ENDPOINT, {
+                ...publishOptions,
+                access: publishOptions.access ?? undefined,
+                otp,
+                method: 'PUT',
+                body,
+                ignoreBody: true,
+            }),
+        });
+    }
+    catch (err) {
+        const statusCode = err.statusCode;
+        if (statusCode === 404 || statusCode === 405) {
+            throw new PnpmError('BATCH_PUBLISH_UNSUPPORTED', `The registry at ${registry} does not support publishing multiple packages in a single request`, {
+                hint: `Retry without the --batch flag, or publish to a registry that implements "PUT ${BATCH_PUBLISH_ENDPOINT}" (for example, pnpr).`,
+            });
+        }
+        throw err;
+    }
+}
+/**
+ * Build the npm publish document for one package — the same JSON body `libnpmpublish` would
+ * send as the whole `PUT /:pkg` request. The batch publish request body is an array of these,
+ * which lets the registry reuse its single-package publish pipeline per entry.
+ */
+function createPublishDocument({ publishedManifest, tarballData }, registry, opts) {
+    const name = publishedManifest.name;
+    const version = semver.clean(publishedManifest.version);
+    if (!version) {
+        throw new PnpmError('BAD_SEMVER', `Invalid semver: ${publishedManifest.version}`);
+    }
+    const publishConfigAccess = publishedManifest.publishConfig?.access;
+    const access = opts.access ?? (isPublishAccess(publishConfigAccess) ? publishConfigAccess : null);
+    if (!name.startsWith('@') && access === 'restricted') {
+        throw new PnpmError('UNSCOPED_RESTRICTED', `Can't restrict access to the unscoped package ${name}`);
+    }
+    const tarballName = `${name}-${version}.tgz`;
+    const manifest = {
+        ...publishedManifest,
+        _id: `${name}@${version}`,
+        version,
+        _nodeVersion: process.versions.node,
+        dist: {
+            integrity: `sha512-${createHash('sha512').update(tarballData).digest('base64')}`,
+            shasum: createHash('sha1').update(tarballData).digest('hex'),
+            // libnpmpublish stores an http:// URL on purpose (clients fetch via HTTPS regardless when
+            // the registry is HTTPS); keep the wire format identical to a single-package publish.
+            tarball: new URL(`${name}/-/${tarballName}`, registry).href.replace(/^https:\/\//, 'http://'),
+        },
+    };
+    return {
+        _id: name,
+        name,
+        description: publishedManifest.description,
+        'dist-tags': { [opts.tag ?? 'latest']: version },
+        versions: { [version]: manifest },
+        access,
+        _attachments: {
+            [tarballName]: {
+                content_type: 'application/octet-stream',
+                data: tarballData.toString('base64'),
+                length: tarballData.length,
+            },
+        },
+    };
+}
+//# sourceMappingURL=batchPublish.js.map

package/lib/publish/extractManifestFromPacked.d.ts

@@ -1,7 +1,7 @@
 import { PnpmError } from '@pnpm/error';
 import type { ExportedManifest } from '@pnpm/releasing.exportable-manifest';
 declare const TARBALL_SUFFIXES: readonly ['.tar.gz', '.tgz'];
-export type TarballSuffix = (typeof TARBALL_SUFFIXES)[number];
+export type TarballSuffix = typeof TARBALL_SUFFIXES[number];
 export type TarballPath = `${string}${TarballSuffix}`;
 export declare const isTarballPath: (path: string) => path is TarballPath;
 export declare function extractManifestFromPacked<Output = ExportedManifest>(tarballPath: TarballPath): Promise<Output>;

package/lib/publish/oidc/authToken.d.ts

@@ -43,7 +43,7 @@ export interface AuthTokenParams {
  * @see https://github.com/npm/cli/blob/7d900c46/lib/utils/oidc.js#L112-L142 for npm's implementation.
  * @see https://github.com/yarnpkg/berry/blob/bafbef55/packages/plugin-npm/sources/npmHttpUtils.ts#L626-L641 for yarn's implementation.
  */
-export declare function fetchAuthToken({ context: { fetch }, options, idToken, packageName, registry }: AuthTokenParams): Promise<string>;
+export declare function fetchAuthToken({ context: { fetch, }, options, idToken, packageName, registry, }: AuthTokenParams): Promise<string>;
 export declare abstract class AuthTokenError extends PnpmError {
 }
 export declare class AuthTokenFetchError extends AuthTokenError {

package/lib/publish/oidc/idToken.d.ts

@@ -57,7 +57,7 @@ export interface IdTokenParams {
  * @see https://github.com/npm/cli/blob/7d900c46/lib/utils/oidc.js#L37-L110 for npm's implementation
  * @see https://github.com/yarnpkg/berry/blob/bafbef55/packages/plugin-npm/sources/npmHttpUtils.ts#L594-L624 for yarn's implementation
  */
-export declare function getIdToken({ context: { Date, ciInfo: { GITHUB_ACTIONS }, fetch, globalInfo, process: { env } }, options, registry }: IdTokenParams): Promise<string | undefined>;
+export declare function getIdToken({ context: { Date, ciInfo: { GITHUB_ACTIONS }, fetch, globalInfo, process: { env }, }, options, registry, }: IdTokenParams): Promise<string | undefined>;
 export declare abstract class IdTokenError extends PnpmError {
 }
 export declare class IdTokenGitHubWorkflowIncorrectPermissionsError extends IdTokenError {

package/lib/publish/oidc/provenance.d.ts

@@ -50,7 +50,7 @@ export interface ProvenanceParams {
  *
  * @see https://github.com/npm/cli/blob/7d900c46/lib/utils/oidc.js#L145-L164 for npm's implementation.
  */
-export declare function determineProvenance({ authToken, idToken, options, packageName, registry, context: { ciInfo: { GITHUB_ACTIONS, GITLAB }, fetch, process: { env } } }: ProvenanceParams): Promise<boolean | undefined>;
+export declare function determineProvenance({ authToken, idToken, options, packageName, registry, context: { ciInfo: { GITHUB_ACTIONS, GITLAB }, fetch, process: { env }, }, }: ProvenanceParams): Promise<boolean | undefined>;
 export declare abstract class ProvenanceError extends PnpmError {
 }
 export declare class ProvenanceMalformedIdTokenError extends ProvenanceError {

package/lib/publish/otp.d.ts

@@ -35,4 +35,4 @@ export interface OtpParams {
  * @see https://github.com/npm/cli/blob/7d900c46/lib/utils/otplease.js for npm's implementation.
  * @see https://github.com/npm/npm-profile/blob/main/lib/index.js for the webauth polling flow.
  */
-export declare function publishWithOtpHandling({ context, manifest, publishOptions, tarballData }: OtpParams): Promise<OtpPublishResponse>;
+export declare function publishWithOtpHandling({ context, manifest, publishOptions, tarballData, }: OtpParams): Promise<OtpPublishResponse>;

package/lib/publish/publish.js

@@ -35,6 +35,7 @@ export function rcOptionsTypes() {
 export function cliOptionsTypes() {
     return {
         ...rcOptionsTypes(),
+        batch: Boolean,
         'dry-run': Boolean,
         force: Boolean,
         json: Boolean,
@@ -100,6 +101,10 @@ export function help() {
                         name: '--recursive',
                         shortAlias: '-r',
                     },
+                    {
+                        description: 'Send all packages to the registry in a single request instead of one request per package. Requires --recursive and a registry that implements the "/-/pnpm/v1/publish" endpoint (for example, pnpr)',
+                        name: '--batch',
+                    },
                 ],
             },
             FILTERING,
@@ -126,6 +131,11 @@ export async function handler(opts, params) {
     return result;
 }
 export async function publish(opts, params) {
+    if (opts.batch && !opts.recursive) {
+        throw new PnpmError('BATCH_PUBLISH_REQUIRES_RECURSIVE', '--batch can only be used together with --recursive', {
+            hint: 'Run "pnpm publish -r --batch" to publish all workspace packages in a single request.',
+        });
+    }
     if (opts.gitChecks !== false && await isGitRepo()) {
         if (!(await isWorkingTreeClean())) {
             throw new PnpmError('GIT_UNCLEAN', 'Unclean working tree. Commit or stash changes first.', {

package/lib/publish/publishPackedPkg.d.ts

@@ -1,9 +1,11 @@
 import type { Config } from '@pnpm/config.reader';
 import { PnpmError } from '@pnpm/error';
 import type { ExportedManifest } from '@pnpm/releasing.exportable-manifest';
+import { type RegistryConfig } from '@pnpm/types';
 import { type PublishSummary } from '../tarball/publishSummary.js';
 import { type OtpContext, type PublishOptionsWithDefaultAccess } from './otp.js';
 import type { PackResult } from './pack.js';
+import { type NormalizedRegistryUrl } from './registryConfigKeys.js';
 export type { PublishSummary };
 export type PublishPackedPkgOptions = Pick<Config, 'configByUri' | 'dryRun' | 'fetchRetries' | 'fetchRetryFactor' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'fetchTimeout' | 'registries' | 'tag' | 'userAgent'> & Partial<Pick<Config, 'ca' | 'cert' | 'httpProxy' | 'httpsProxy' | 'key' | 'localAddress' | 'noProxy' | 'strictSsl'>> & {
     access?: 'public' | 'restricted';
@@ -27,10 +29,31 @@ type StagePublishOptions = PublishOptionsWithDefaultAccess & {
     stage?: boolean;
 };
 /**
- * @internal Exported for unit testing of the access / registry / auth fallback rules. Not part of the package's
- *   public API.
+ * Build the libnpmpublish / npm-registry-fetch options (registry, auth, headers) for publishing
+ * {@link manifest}. When `oidc` is `false`, the per-package OIDC token exchange is skipped and only
+ * statically configured credentials are used — batch publish sends many packages in one request,
+ * which a package-scoped OIDC token cannot authorize.
+ *
+ * @internal Exported for unit testing of the access / registry / auth fallback rules and for batch
+ *   publish. Not part of the package's public API.
+ */
+export declare function createPublishOptions(manifest: ExportedManifest, options: PublishPackedPkgOptions, { oidc }?: {
+    oidc?: boolean;
+}): Promise<StagePublishOptions>;
+export declare function isPublishAccess(access: unknown): access is 'public' | 'restricted';
+interface RegistryInfo {
+    registry: NormalizedRegistryUrl;
+    config: RegistryConfig;
+}
+/**
+ * Find credentials and SSL info for a package's registry.
+ * Follows {@link https://docs.npmjs.com/cli/v10/configuring-npm/npmrc#auth-related-configuration}.
+ *
+ * The manifest's `publishConfig.registry`, when set, takes precedence over `registries`.
+ *
+ * @internal Exported for batch publish, which groups packages by their target registry.
  */
-export declare function createPublishOptions(manifest: ExportedManifest, options: PublishPackedPkgOptions): Promise<StagePublishOptions>;
+export declare function findRegistryInfo({ name }: ExportedManifest, { configByUri, registries }: Pick<Config, 'configByUri' | 'registries'>, publishConfigRegistry?: string): Partial<RegistryInfo>;
 export declare class PublishUnsupportedRegistryProtocolError extends PnpmError {
     readonly registryUrl: string;
     constructor(registryUrl: string);

package/lib/publish/publishPackedPkg.js

@@ -1,10 +1,9 @@
-import { createHash } from 'node:crypto';
 import fs from 'node:fs/promises';
-import path from 'node:path';
 import { PnpmError } from '@pnpm/error';
 import { globalInfo, globalWarn } from '@pnpm/logger';
 import { createDispatchedFetch } from '@pnpm/network.fetch';
-import { extractBundledDependencies } from '../tarball/publishSummary.js';
+import { DEFAULT_REGISTRY_SCOPE } from '@pnpm/types';
+import { createPublishSummary } from '../tarball/publishSummary.js';
 import { displayError } from './displayError.js';
 import { executeTokenHelper } from './executeTokenHelper.js';
 import { createFailedToPublishError } from './FailedToPublishError.js';
@@ -22,21 +21,7 @@ export async function publishPackedPkg(packResult, opts) {
     const { registry } = publishOptions;
     const isStage = opts.stage === true;
     globalInfo(`📦 ${name}@${version} → ${registry ?? 'the default registry'}`);
-    const summary = {
-        id: `${name}@${version}`,
-        name: name,
-        version: version,
-        size: tarballData.byteLength,
-        unpackedSize,
-        // SHA-1 is what `npm publish --json` reports as `shasum` for back-compat with the registry's
-        // legacy dist.shasum field; `integrity` below is the modern SRI hash.
-        shasum: createHash('sha1').update(tarballData).digest('hex'),
-        integrity: `sha512-${createHash('sha512').update(tarballData).digest('base64')}`,
-        filename: path.basename(tarballPath),
-        files: contents.map((file) => ({ path: file })),
-        entryCount: contents.length,
-        bundled: extractBundledDependencies(publishedManifest),
-    };
+    const summary = createPublishSummary({ publishedManifest, tarballPath, contents, unpackedSize }, tarballData);
     if (opts.dryRun) {
         globalWarn(`Skip ${isStage ? 'staging' : 'publishing'} ${name}@${version} (dry run)`);
         return summary;
@@ -71,15 +56,21 @@ export function createPublishContext(opts) {
     };
 }
 /**
- * @internal Exported for unit testing of the access / registry / auth fallback rules. Not part of the package's
- *   public API.
+ * Build the libnpmpublish / npm-registry-fetch options (registry, auth, headers) for publishing
+ * {@link manifest}. When `oidc` is `false`, the per-package OIDC token exchange is skipped and only
+ * statically configured credentials are used — batch publish sends many packages in one request,
+ * which a package-scoped OIDC token cannot authorize.
+ *
+ * @internal Exported for unit testing of the access / registry / auth fallback rules and for batch
+ *   publish. Not part of the package's public API.
  */
-export async function createPublishOptions(manifest, options) {
+export async function createPublishOptions(manifest, options, { oidc = true } = {}) {
     const publishConfigRegistry = typeof manifest.publishConfig?.registry === 'string'
         ? manifest.publishConfig.registry
         : undefined;
     const { registry, config } = findRegistryInfo(manifest, options, publishConfigRegistry);
-    const { creds, tls } = config ?? {};
+    const tls = config?.tls;
+    const creds = config?.[DEFAULT_REGISTRY_SCOPE];
     const publishConfigAccess = manifest.publishConfig?.access;
     const access = options.access ?? (isPublishAccess(publishConfigAccess) ? publishConfigAccess : null);
     const { ci: isFromCI, fetchRetries, fetchRetryFactor, fetchRetryMaxtimeout, fetchRetryMintimeout, fetchTimeout: timeout, otp, provenance, provenanceFile, tag: defaultTag, userAgent, } = options;
@@ -102,6 +93,7 @@ export async function createPublishOptions(manifest, options) {
         provenance,
         provenanceFile,
         registry,
+        strictSSL: options.strictSsl, // npm-registry-fetch defaults to true; must be set explicitly to honour strictSsl: false
         userAgent,
         // Signal to the registry that the client supports web-based authentication.
         // Without this, the registry would never offer the web auth flow and would
@@ -121,21 +113,23 @@ export async function createPublishOptions(manifest, options) {
         publishOptions.stage = true;
     }
     if (registry) {
-        // OIDC takes precedence over a configured static `_authToken`, mirroring the npm CLI's
-        // behavior (see https://github.com/npm/cli/blob/7d900c46/lib/utils/oidc.js). Trusted
-        // publishing wins whenever the registry has it configured for the package; the static
-        // token is used only as a fallback when OIDC is not applicable.
-        const oidcTokenProvenance = await fetchTokenAndProvenanceByOidc(manifest.name, registry, options);
-        if (oidcTokenProvenance?.authToken) {
-            publishOptions.token = oidcTokenProvenance.authToken;
+        if (oidc) {
+            // OIDC takes precedence over a configured static `_authToken`, mirroring the npm CLI's
+            // behavior (see https://github.com/npm/cli/blob/7d900c46/lib/utils/oidc.js). Trusted
+            // publishing wins whenever the registry has it configured for the package; the static
+            // token is used only as a fallback when OIDC is not applicable.
+            const oidcTokenProvenance = await fetchTokenAndProvenanceByOidc(manifest.name, registry, options);
+            if (oidcTokenProvenance?.authToken) {
+                publishOptions.token = oidcTokenProvenance.authToken;
+            }
+            publishOptions.provenance ??= oidcTokenProvenance?.provenance;
         }
-        publishOptions.provenance ??= oidcTokenProvenance?.provenance;
         appendAuthOptionsForRegistry(publishOptions, registry);
     }
     pruneUndefined(publishOptions);
     return publishOptions;
 }
-function isPublishAccess(access) {
+export function isPublishAccess(access) {
     return access === 'public' || access === 'restricted';
 }
 /**
@@ -143,8 +137,10 @@ function isPublishAccess(access) {
  * Follows {@link https://docs.npmjs.com/cli/v10/configuring-npm/npmrc#auth-related-configuration}.
  *
  * The manifest's `publishConfig.registry`, when set, takes precedence over `registries`.
+ *
+ * @internal Exported for batch publish, which groups packages by their target registry.
  */
-function findRegistryInfo({ name }, { configByUri, registries }, publishConfigRegistry) {
+export function findRegistryInfo({ name }, { configByUri, registries }, publishConfigRegistry) {
     // eslint-disable-next-line regexp/no-unused-capturing-group
     const scopedMatches = /@(?<scope>[^/]+)\/(?<slug>[^/]+)/.exec(name);
     const registryName = scopedMatches?.groups ? `@${scopedMatches.groups.scope}` : 'default';
@@ -154,6 +150,7 @@ function findRegistryInfo({ name }, { configByUri, registries }, publishConfigRe
         throw new PublishUnsupportedRegistryProtocolError(nonNormalizedRegistry);
     }
     const { normalizedUrl: registry, longestConfigKey: initialRegistryConfigKey, } = supportedRegistryInfo;
+    const credsScope = registryName === 'default' ? DEFAULT_REGISTRY_SCOPE : registryName;
     let creds;
     let tls = {};
     for (const registryConfigKey of allRegistryConfigKeys(initialRegistryConfigKey)) {
@@ -161,13 +158,17 @@ function findRegistryInfo({ name }, { configByUri, registries }, publishConfigRe
         if (!entry)
             continue;
         // Auth from longer path collectively overrides shorter path
-        creds ??= entry.creds;
+        creds ??= entry[credsScope] ?? entry[DEFAULT_REGISTRY_SCOPE];
         // TLS from longer path individually overrides shorter path
         tls = { ...entry.tls, ...tls };
     }
+    const config = { tls };
+    if (creds) {
+        config[DEFAULT_REGISTRY_SCOPE] = creds;
+    }
     return {
         registry,
-        config: { creds, tls },
+        config,
     };
 }
 function extractToken({ authToken, tokenHelper, }) {

package/lib/publish/recursivePublish.d.ts

@@ -5,6 +5,7 @@ export type PublishRecursiveOpts = Required<Pick<Config, 'bin' | 'cacheDir' | 'd
     argv: {
         original: string[];
     };
+    batch?: boolean;
     reportSummary?: boolean;
 } & PublishPackedPkgOptions;
 export type RecursivePublishedPackage = PublishSummary | {

package/lib/publish/recursivePublish.js

@@ -6,6 +6,7 @@ import { sortProjects } from '@pnpm/workspace.projects-sorter';
 import pFilter from 'p-filter';
 import { pick } from 'ramda';
 import { writeJsonFile } from 'write-json-file';
+import { batchPublishPackages } from './batchPublish.js';
 import { publish } from './publish.js';
 export async function recursivePublish(opts) {
     const pkgs = Object.values(opts.selectedProjectsGraph).map((wsPkg) => wsPkg.package);
@@ -56,46 +57,55 @@ export async function recursivePublish(opts) {
         }
         const chunks = sortProjects(opts.selectedProjectsGraph);
         const tag = opts.tag ?? 'latest';
-        const commandArgs = opts.stage ? ['stage', 'publish'] : ['publish'];
-        for (const chunk of chunks) {
-            // We can't run publish concurrently due to the npm CLI asking for OTP.
-            // NOTE: If we solve the OTP issue, we still need to limit packages concurrency.
-            // Otherwise, publishing will consume too much resources.
-            // See related issue: https://github.com/pnpm/pnpm/issues/6968
-            for (const pkgDir of chunk) {
-                if (!publishedPkgDirs.has(pkgDir))
-                    continue;
-                const pkg = opts.selectedProjectsGraph[pkgDir].package;
-                const registry = pkg.manifest.publishConfig?.registry ?? pickRegistryForPackage(opts.registries, pkg.manifest.name);
-                // eslint-disable-next-line no-await-in-loop
-                const publishResult = await publish({
-                    ...opts,
-                    dir: pkg.rootDir,
-                    argv: {
-                        original: [
-                            ...commandArgs,
-                            '--tag',
-                            tag,
-                            '--registry',
-                            registry,
-                            ...appendedArgs,
-                        ],
-                    },
-                    gitChecks: false,
-                    recursive: false,
-                }, [pkg.rootDir]);
-                if (publishResult?.publishSummary != null) {
-                    publishedPackages.push(publishResult.publishSummary);
-                }
-                else {
-                    // Fallback for paths that don't produce a full PublishSummary (e.g. dry run via the
-                    // legacy npm-CLI bridge, or future call sites that bypass publishPackedPkg).
-                    const publishedManifest = publishResult?.publishedManifest ?? publishResult?.manifest;
-                    if (publishedManifest != null) {
-                        publishedPackages.push(pick(['name', 'version'], publishedManifest));
+        if (opts.batch) {
+            const sortedPkgs = chunks
+                .flat()
+                .filter((pkgDir) => publishedPkgDirs.has(pkgDir))
+                .map((pkgDir) => opts.selectedProjectsGraph[pkgDir].package);
+            publishedPackages.push(...await batchPublishPackages(sortedPkgs, { ...opts, tag }));
+        }
+        else {
+            const commandArgs = opts.stage ? ['stage', 'publish'] : ['publish'];
+            for (const chunk of chunks) {
+                // We can't run publish concurrently due to the npm CLI asking for OTP.
+                // NOTE: If we solve the OTP issue, we still need to limit packages concurrency.
+                // Otherwise, publishing will consume too much resources.
+                // See related issue: https://github.com/pnpm/pnpm/issues/6968
+                for (const pkgDir of chunk) {
+                    if (!publishedPkgDirs.has(pkgDir))
+                        continue;
+                    const pkg = opts.selectedProjectsGraph[pkgDir].package;
+                    const registry = pkg.manifest.publishConfig?.registry ?? pickRegistryForPackage(opts.registries, pkg.manifest.name);
+                    // eslint-disable-next-line no-await-in-loop
+                    const publishResult = await publish({
+                        ...opts,
+                        dir: pkg.rootDir,
+                        argv: {
+                            original: [
+                                ...commandArgs,
+                                '--tag',
+                                tag,
+                                '--registry',
+                                registry,
+                                ...appendedArgs,
+                            ],
+                        },
+                        gitChecks: false,
+                        recursive: false,
+                    }, [pkg.rootDir]);
+                    if (publishResult?.publishSummary != null) {
+                        publishedPackages.push(publishResult.publishSummary);
                     }
-                    else if (publishResult?.exitCode) {
-                        return { exitCode: publishResult.exitCode, publishedPackages };
+                    else {
+                        // Fallback for paths that don't produce a full PublishSummary (e.g. dry run via the
+                        // legacy npm-CLI bridge, or future call sites that bypass publishPackedPkg).
+                        const publishedManifest = publishResult?.publishedManifest ?? publishResult?.manifest;
+                        if (publishedManifest != null) {
+                            publishedPackages.push(pick(['name', 'version'], publishedManifest));
+                        }
+                        else if (publishResult?.exitCode) {
+                            return { exitCode: publishResult.exitCode, publishedPackages };
+                        }
                     }
                 }
             }

package/lib/stage/context.js

@@ -8,7 +8,7 @@ export function createStageContext(opts, packageName) {
     return {
         opts,
         registry,
-        authHeaderValue: getAuthHeaderByUri(registry),
+        authHeaderValue: packageName ? getAuthHeaderByUri(registry, { pkgName: packageName }) : getAuthHeaderByUri(registry),
         fetchFromRegistry: createFetchFromRegistry(opts),
     };
 }

package/lib/stage/types.d.ts

@@ -1,6 +1,6 @@
 import * as publishCommand from '../publish/publish.js';
 export declare const STAGE_SUBCOMMANDS: readonly ['publish', 'list', 'view', 'approve', 'reject', 'download'];
-export type StageSubcommand = (typeof STAGE_SUBCOMMANDS)[number];
+export type StageSubcommand = typeof STAGE_SUBCOMMANDS[number];
 /**
  * Options accepted by every `pnpm stage` subcommand.
  *

package/lib/tarball/publishSummary.d.ts

@@ -1,3 +1,4 @@
+import type { ExportedManifest } from '@pnpm/releasing.exportable-manifest';
 /**
  * Per-package summary describing a successful publish, modeled after `npm publish --json`.
  * Returned to callers and serialized to stdout when `pnpm publish --json` is used.
@@ -28,6 +29,13 @@ export interface PublishSummary {
     /** Staged publish identifier returned by the registry. Only present for staged publishes. */
     stageId?: string;
 }
+export interface PackedPkgInfo {
+    publishedManifest: ExportedManifest;
+    tarballPath: string;
+    contents: string[];
+    unpackedSize: number;
+}
+export declare function createPublishSummary({ publishedManifest, tarballPath, contents, unpackedSize }: PackedPkgInfo, tarballData: Buffer): PublishSummary;
 /**
  * Normalize the two equivalent manifest keys (`bundledDependencies` and `bundleDependencies`)
  * into a flat list of dependency names, matching npm's interpretation.

package/lib/tarball/publishSummary.js

@@ -1,3 +1,23 @@
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+export function createPublishSummary({ publishedManifest, tarballPath, contents, unpackedSize }, tarballData) {
+    const { name, version } = publishedManifest;
+    return {
+        id: `${name}@${version}`,
+        name: name,
+        version: version,
+        size: tarballData.byteLength,
+        unpackedSize,
+        // SHA-1 is what `npm publish --json` reports as `shasum` for back-compat with the registry's
+        // legacy dist.shasum field; `integrity` below is the modern SRI hash.
+        shasum: createHash('sha1').update(tarballData).digest('hex'),
+        integrity: `sha512-${createHash('sha512').update(tarballData).digest('base64')}`,
+        filename: path.basename(tarballPath),
+        files: contents.map((file) => ({ path: file })),
+        entryCount: contents.length,
+        bundled: extractBundledDependencies(publishedManifest),
+    };
+}
 /**
  * Normalize the two equivalent manifest keys (`bundledDependencies` and `bundleDependencies`)
  * into a flat list of dependency names, matching npm's interpretation.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/releasing.commands",
-  "version": "1100.4.4",
+  "version": "1100.5.0",
   "description": "Commands for deploy, pack, and publish",
   "keywords": [
     "pnpm",
@@ -38,61 +38,62 @@
     "libnpmpublish": "^11.2.0",
     "normalize-path": "^3.0.0",
     "normalize-registry-url": "2.0.1",
+    "npm-registry-fetch": "^19.0.0",
     "p-filter": "^4.1.0",
     "p-limit": "^7.3.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "realpath-missing": "^2.0.0",
     "render-help": "^2.0.0",
-    "semver": "^7.8.1",
+    "semver": "^7.8.4",
     "tar-stream": "^3.2.0",
     "tempy": "3.0.0",
     "tinyglobby": "^0.2.16",
     "validate-npm-package-name": "7.0.2",
     "write-json-file": "^7.0.0",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/bins.resolver": "1100.0.7",
+    "@pnpm/bins.resolver": "1100.0.8",
     "@pnpm/catalogs.types": "1100.0.0",
-    "@pnpm/cli.common-cli-options-help": "1100.0.2",
-    "@pnpm/cli.utils": "1101.0.11",
-    "@pnpm/config.pick-registry-for-package": "1100.0.8",
-    "@pnpm/config.reader": "1101.8.0",
+    "@pnpm/config.pick-registry-for-package": "1100.0.9",
+    "@pnpm/config.reader": "1101.9.0",
+    "@pnpm/engine.runtime.commands": "1100.1.5",
+    "@pnpm/deps.path": "1100.0.8",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/deps.path": "1100.0.7",
-    "@pnpm/engine.runtime.commands": "1100.1.4",
-    "@pnpm/engine.runtime.node-resolver": "1101.1.6",
+    "@pnpm/engine.runtime.node-resolver": "1101.1.7",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/exec.lifecycle": "1100.0.17",
-    "@pnpm/fetching.directory-fetcher": "1100.0.16",
-    "@pnpm/exec.pnpm-cli-runner": "1100.0.1",
-    "@pnpm/fs.indexed-pkg-importer": "1100.0.13",
+    "@pnpm/cli.utils": "1101.0.12",
+    "@pnpm/fs.indexed-pkg-importer": "1100.0.14",
+    "@pnpm/cli.common-cli-options-help": "1100.0.2",
     "@pnpm/fs.is-empty-dir-or-nothing": "1100.0.0",
-    "@pnpm/fs.packlist": "1100.0.1",
-    "@pnpm/installing.client": "1100.2.7",
-    "@pnpm/lockfile.fs": "1100.1.4",
-    "@pnpm/lockfile.types": "1100.0.10",
-    "@pnpm/installing.commands": "1100.8.0",
-    "@pnpm/network.auth-header": "1101.1.1",
-    "@pnpm/network.fetch": "1100.1.2",
+    "@pnpm/installing.commands": "1100.9.0",
+    "@pnpm/exec.lifecycle": "1100.0.18",
+    "@pnpm/exec.pnpm-cli-runner": "1100.0.1",
+    "@pnpm/fetching.directory-fetcher": "1100.0.17",
+    "@pnpm/installing.client": "1100.2.8",
+    "@pnpm/lockfile.types": "1100.0.11",
+    "@pnpm/lockfile.fs": "1100.1.5",
+    "@pnpm/network.web-auth": "1101.1.1",
+    "@pnpm/releasing.exportable-manifest": "1100.1.6",
+    "@pnpm/resolving.resolver-base": "1100.4.2",
+    "@pnpm/network.fetch": "1100.1.3",
+    "@pnpm/workspace.projects-filter": "1100.0.21",
+    "@pnpm/network.auth-header": "1101.1.2",
+    "@pnpm/types": "1101.3.2",
     "@pnpm/network.git-utils": "1100.0.1",
-    "@pnpm/network.web-auth": "1101.1.0",
-    "@pnpm/releasing.exportable-manifest": "1100.1.5",
-    "@pnpm/resolving.resolver-base": "1100.4.1",
-    "@pnpm/types": "1101.3.1",
-    "@pnpm/workspace.projects-filter": "1100.0.20",
-    "@pnpm/workspace.projects-sorter": "1100.0.6"
+    "@pnpm/fs.packlist": "1100.0.1",
+    "@pnpm/workspace.projects-sorter": "1100.0.7"
   },
   "peerDependencies": {
-    "@pnpm/logger": "^1001.0.1"
+    "@pnpm/logger": "^1100.0.0"
   },
   "devDependencies": {
-    "@jest/globals": "30.3.0",
+    "@jest/globals": "30.4.1",
     "@types/cross-spawn": "^6.0.6",
     "@types/is-windows": "^1.0.2",
-    "@types/libnpmpublish": "^9.0.1",
+    "@types/libnpmpublish": "^11.2.0",
+    "@types/npm-registry-fetch": "^8.0.9",
     "@types/proxyquire": "^1.3.31",
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
-    "@types/tar": "^7.0.87",
     "@types/tar-stream": "^3.1.4",
     "@types/validate-npm-package-name": "^4.0.2",
     "ci-info": "^4.4.0",
@@ -100,18 +101,18 @@
     "is-windows": "^1.0.2",
     "load-json-file": "^7.0.1",
     "tar": "^7.5.15",
-    "undici": "^7.26.0",
+    "undici": "^7.27.2",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/assert-project": "1100.0.15",
-    "@pnpm/catalogs.config": "1100.0.0",
-    "@pnpm/hooks.pnpmfile": "1100.0.14",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/prepare": "1100.0.15",
-    "@pnpm/releasing.commands": "1100.4.4",
+    "@pnpm/hooks.pnpmfile": "1100.0.15",
+    "@pnpm/assert-project": "1100.0.16",
+    "@pnpm/prepare": "1100.0.16",
     "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/releasing.commands": "1100.5.0",
     "@pnpm/test-ipc-server": "1100.0.0",
-    "@pnpm/testing.command-defaults": "1100.0.5",
-    "@pnpm/testing.registry-mock": "1100.0.5"
+    "@pnpm/testing.command-defaults": "1100.0.6",
+    "@pnpm/testing.registry-mock": "1100.0.6",
+    "@pnpm/catalogs.config": "1100.0.0"
   },
   "engines": {
     "node": ">=22.13"