@pnpm/releasing.commands 1100.5.5 → 1100.6.0

package/lib/lane/index.js

@@ -0,0 +1,157 @@
+import { PnpmError } from '@pnpm/error';
+import { indexProjectRefs, toProjectDir } from '@pnpm/releasing.versioning';
+import { updateWorkspaceManifest } from '@pnpm/workspace.workspace-manifest-writer';
+import { renderHelp } from 'render-help';
+import { getReleasableProjects } from '../change/index.js';
+export function rcOptionsTypes() {
+    return {};
+}
+export function cliOptionsTypes() {
+    return {
+        recursive: Boolean,
+    };
+}
+export const commandNames = ['lane'];
+/**
+ * The reserved name of the default lane: every package is on it unless
+ * assigned elsewhere, packages on it release stable versions, and no
+ * prerelease lane can take the name.
+ */
+export const MAIN_LANE = 'main';
+export function help() {
+    return renderHelp({
+        description: 'Manages per-package release lanes. A lane is a parallel release track: while a package is on one, the bare "pnpm version -r" releases it as X.Y.Z-<lane>.N prereleases while the rest of the workspace keeps releasing stable versions. Moving a package back to the main lane releases its accumulated stable version on the next run. Membership lives under the versioning.lanes key of pnpm-workspace.yaml; this command is a convenience editor for that key.',
+        usages: [
+            'pnpm lane',
+            'pnpm lane <name> --filter <pattern>',
+            'pnpm lane main --filter <pattern>',
+        ],
+        descriptionLists: [
+            {
+                title: 'Options',
+                list: [
+                    {
+                        description: 'Select the packages to move between lanes',
+                        name: '--filter <pattern>',
+                    },
+                ],
+            },
+        ],
+    });
+}
+export async function handler(opts, params) {
+    const workspaceDir = opts.workspaceDir;
+    if (!workspaceDir) {
+        throw new PnpmError('WORKSPACE_ONLY', 'pnpm lane is only supported in a workspace');
+    }
+    if (params.length === 0) {
+        return renderLanes(opts.versioning?.lanes ?? {});
+    }
+    const laneName = params[0];
+    if ((opts.filter ?? []).length === 0) {
+        throw new PnpmError('VERSIONING_LANE_FILTER_REQUIRED', 'Select the packages to move with --filter, e.g. "pnpm lane alpha --filter <pkg>..."');
+    }
+    const refs = indexProjectRefs(opts.allProjects ?? [], workspaceDir);
+    const releasableDirs = new Set(getReleasableProjects(opts.allProjects ?? [], workspaceDir, opts.versioning).map((project) => project.dir));
+    const selected = Object.values(opts.selectedProjectsGraph ?? {})
+        .map((node) => ({
+        name: node.package.manifest.name,
+        dir: toProjectDir(workspaceDir, node.package.rootDir),
+    }))
+        .filter((project) => project.name != null && releasableDirs.has(project.dir));
+    if (selected.length === 0) {
+        throw new PnpmError('VERSIONING_NO_PACKAGES', 'The filter selected no releasable packages');
+    }
+    // Existing entries may reference projects by name or by directory; resolve
+    // them so assignments and removals key on the project, not the spelling.
+    const lanes = { ...opts.versioning?.lanes };
+    const laneByDir = new Map();
+    for (const [key, lane] of Object.entries(lanes)) {
+        for (const dir of refs.refToDirs(key)) {
+            laneByDir.set(dir, { key, lane });
+        }
+    }
+    let output;
+    if (laneName === MAIN_LANE) {
+        for (const project of selected) {
+            const existing = laneByDir.get(project.dir);
+            if (existing != null) {
+                delete lanes[existing.key];
+            }
+        }
+        output = `Moved to the main lane:\n${selected.map((project) => `  ${refFor(project, refs)}\n`).join('')}` +
+            'The accumulated stable versions release on the next "pnpm version -r" run.';
+    }
+    else {
+        if (laneName.toLowerCase() === MAIN_LANE) {
+            throw new PnpmError('VERSIONING_INVALID_LANE_NAME', `Invalid lane name: ${laneName}. "main" is the reserved default lane; spell it in lowercase to move packages back onto it.`);
+        }
+        // A purely numeric lane name is rejected because semver parses an
+        // all-digit prerelease identifier as a number, which changes sorting
+        // semantics.
+        if (!/^[0-9A-Z-]+$/i.test(laneName) || /^\d+$/.test(laneName)) {
+            throw new PnpmError('VERSIONING_INVALID_LANE_NAME', `Invalid lane name: ${laneName}. Lane names may contain only alphanumerics and hyphens, and cannot be purely numeric.`);
+        }
+        for (const project of selected) {
+            const existing = laneByDir.get(project.dir);
+            if (existing != null && existing.lane !== laneName) {
+                throw new PnpmError('VERSIONING_ALREADY_ON_LANE', `${refFor(project, refs)} is already on the "${existing.lane}" lane. Move it back with "pnpm lane main" first.`);
+            }
+            if (existing == null) {
+                lanes[refFor(project, refs)] = laneName;
+            }
+        }
+        output = `Moved to the "${laneName}" lane:\n${selected.map((project) => `  ${refFor(project, refs)}\n`).join('')}`;
+    }
+    const versioning = { ...opts.versioning };
+    if (Object.keys(lanes).length > 0) {
+        versioning.lanes = lanes;
+    }
+    else {
+        delete versioning.lanes;
+    }
+    await updateWorkspaceManifest(workspaceDir, {
+        updatedFields: {
+            versioning: Object.keys(versioning).length > 0 ? versioning : undefined,
+        },
+    });
+    return output;
+}
+/**
+ * How the project is referenced in versioning.lanes and in output: the bare
+ * name, or the directory path when the name is shared by several projects.
+ */
+function refFor(project, refs) {
+    return refs.nameToDirs(project.name).length > 1 ? `./${project.dir}` : project.name;
+}
+function renderLanes(lanes) {
+    const laneEntries = Object.entries(lanes);
+    if (laneEntries.length === 0) {
+        return 'All packages are on the main lane.';
+    }
+    const byLane = new Map();
+    for (const [ref, laneName] of laneEntries) {
+        let members = byLane.get(laneName);
+        if (members == null) {
+            members = [];
+            byLane.set(laneName, members);
+        }
+        members.push(ref);
+    }
+    let output = 'Lanes:\n';
+    for (const [laneName, members] of Array.from(byLane.entries()).sort(([left], [right]) => left.localeCompare(right))) {
+        output += `  ${laneName}:\n`;
+        for (const ref of members.sort()) {
+            output += `    ${ref}\n`;
+        }
+    }
+    return output;
+}
+export const lane = {
+    handler,
+    help,
+    commandNames,
+    cliOptionsTypes,
+    rcOptionsTypes,
+};
+//# sourceMappingURL=index.js.map

package/lib/publish/batchPublish.js

@@ -135,7 +135,7 @@ async function multiPublishToRegistry(registry, group, opts) {
             operation: async (otp) => npmFetch(BATCH_PUBLISH_ENDPOINT, {
                 ...publishOptions,
                 access: publishOptions.access ?? undefined,
-                otp,
+                otp: otp ?? publishOptions.otp,
                 method: 'PUT',
                 body,
                 ignoreBody: true,

package/lib/publish/extractManifestFromPacked.d.ts

@@ -5,6 +5,13 @@ export type TarballSuffix = typeof TARBALL_SUFFIXES[number];
 export type TarballPath = `${string}${TarballSuffix}`;
 export declare const isTarballPath: (path: string) => path is TarballPath;
 export declare function extractManifestFromPacked<Output = ExportedManifest>(tarballPath: TarballPath): Promise<Output>;
+/**
+ * Read the publish manifest from a pre-built tarball, filling in its `readme` from the tarball's
+ * root README file when the manifest doesn't already declare one. This mirrors the npm CLI, which
+ * reads the readme out of the tarball (via pacote's `fullReadJson`) so the registry gets it as
+ * metadata even though it isn't stored in the packed `package.json`.
+ */
+export declare function extractPublishManifestFromPacked(tarballPath: TarballPath): Promise<ExportedManifest>;
 export declare class PublishArchiveMissingManifestError extends PnpmError {
     readonly tarballPath: string;
     constructor(tarballPath: string);

package/lib/publish/extractManifestFromPacked.js

@@ -6,6 +6,30 @@ import tar from 'tar-stream';
 const TARBALL_SUFFIXES = ['.tar.gz', '.tgz'];
 export const isTarballPath = (path) => TARBALL_SUFFIXES.some(suffix => path.endsWith(suffix));
 export async function extractManifestFromPacked(tarballPath) {
+    const { manifest } = await extractEntriesFromPacked(tarballPath, false);
+    return JSON.parse(manifest);
+}
+/**
+ * Read the publish manifest from a pre-built tarball, filling in its `readme` from the tarball's
+ * root README file when the manifest doesn't already declare one. This mirrors the npm CLI, which
+ * reads the readme out of the tarball (via pacote's `fullReadJson`) so the registry gets it as
+ * metadata even though it isn't stored in the packed `package.json`.
+ */
+export async function extractPublishManifestFromPacked(tarballPath) {
+    const { manifest, readme } = await extractEntriesFromPacked(tarballPath, true);
+    const parsed = JSON.parse(manifest);
+    if (parsed.readme == null && readme != null) {
+        parsed.readme = readme;
+    }
+    return parsed;
+}
+/**
+ * Scan the tarball for `package/package.json` and, when `wantReadme` is set, the root
+ * `README.md`. The manifest-only path (`wantReadme` false) resolves as soon as the manifest
+ * entry is read and stops decompressing the rest of the archive; the publish path scans on
+ * because a README can appear after the manifest.
+ */
+async function extractEntriesFromPacked(tarballPath, wantReadme) {
     const extract = tar.extract();
     const gunzip = createGunzip();
     const tarballStream = fs.createReadStream(tarballPath);
@@ -19,47 +43,62 @@ export async function extractManifestFromPacked(tarballPath) {
         tarballStream.destroy();
     }
     const promise = new Promise((resolve, reject) => {
+        let settled = false;
+        let manifest;
+        let readme;
         function handleError(error) {
             cleanup();
             reject(error);
         }
+        function settle() {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            if (manifest == null) {
+                reject(new PublishArchiveMissingManifestError(tarballPath));
+                return;
+            }
+            resolve({ manifest, readme });
+        }
         tarballStream.once('error', handleError);
         gunzip.once('error', handleError);
-        let manifestFound = false;
         extract.on('entry', (header, stream, next) => {
             const normalizedPath = path.normalize(header.name).replaceAll('\\', '/');
-            if (normalizedPath !== 'package/package.json') {
+            const isManifest = normalizedPath === 'package/package.json';
+            const isReadme = wantReadme && /^package\/readme\.md$/i.test(normalizedPath);
+            if (!isManifest && !isReadme) {
                 stream.once('end', next);
                 stream.resume();
                 return;
             }
-            manifestFound = true;
             const chunks = [];
             stream.on('data', (chunk) => {
                 chunks.push(chunk);
             });
             stream.once('end', () => {
-                try {
-                    const text = Buffer.concat(chunks).toString();
-                    cleanup();
-                    resolve(text);
+                const text = Buffer.concat(chunks).toString();
+                if (isManifest) {
+                    manifest = text;
                 }
-                catch (error) {
-                    handleError(error);
+                else {
+                    readme = text;
                 }
+                // Stop early once every wanted entry has been captured, so the manifest-only
+                // path doesn't stream and decompress the remainder of the tarball.
+                if (manifest != null && (!wantReadme || readme != null)) {
+                    settle();
+                    return;
+                }
+                next();
             });
             stream.once('error', handleError);
         });
-        extract.once('finish', () => {
-            cleanup();
-            if (!manifestFound) {
-                reject(new PublishArchiveMissingManifestError(tarballPath));
-            }
-        });
+        extract.once('finish', settle);
         extract.once('error', handleError);
     });
     tarballStream.pipe(gunzip).pipe(extract);
-    return JSON.parse(await promise);
+    return promise;
 }
 export class PublishArchiveMissingManifestError extends PnpmError {
     tarballPath;

package/lib/publish/otp.js

@@ -28,11 +28,14 @@ export async function publishWithOtpHandling({ context = SHARED_CONTEXT, manifes
     return withOtpHandling({
         context,
         fetchOptions,
-        // When otp is undefined (first attempt), { ...publishOptions, otp } adds
-        // otp: undefined to the options. This is safe because libnpmpublish treats
-        // undefined the same as absent (unlike HTTP headers, where undefined gets
-        // coerced to the string "undefined").
-        operation: otp => publish(manifest, tarballData, { ...publishOptions, otp }),
+        // withOtpHandling first calls this with no otp, then retries with the otp
+        // it obtained from an OTP challenge. On the first attempt we fall back to
+        // the configured --otp (publishOptions.otp) so it is actually sent; a retry
+        // otp takes precedence over it. When both are undefined, passing
+        // otp: undefined is safe because libnpmpublish treats undefined the same as
+        // absent (unlike HTTP headers, where undefined gets coerced to the string
+        // "undefined").
+        operation: otp => publish(manifest, tarballData, { ...publishOptions, otp: otp ?? publishOptions.otp }),
     });
 }
 //# sourceMappingURL=otp.js.map

package/lib/publish/pack.d.ts

@@ -4,7 +4,7 @@ export declare function rcOptionsTypes(): Record<string, unknown>;
 export declare function cliOptionsTypes(): Record<string, unknown>;
 export declare const commandNames: string[];
 export declare function help(): string;
-export type PackOptions = Pick<UniversalOptions, 'dir'> & Pick<Config, 'catalogs' | 'ignoreScripts' | 'embedReadme' | 'packGzipLevel' | 'nodeLinker' | 'skipManifestObfuscation' | 'userAgent'> & Partial<Pick<Config, 'extraBinPaths' | 'extraEnv' | 'recursive' | 'workspaceConcurrency' | 'workspaceDir'>> & Partial<Pick<ConfigContext, 'hooks' | 'selectedProjectsGraph' | 'allProjectsGraph' | 'prodAllProjectsGraph' | 'prodOnlySelectedProjectDirs'>> & {
+export type PackOptions = Pick<UniversalOptions, 'dir'> & Pick<Config, 'catalogs' | 'ignoreScripts' | 'embedReadme' | 'packGzipLevel' | 'nodeLinker' | 'skipManifestObfuscation' | 'userAgent'> & Partial<Pick<Config, 'extraBinPaths' | 'extraEnv' | 'recursive' | 'workspaceConcurrency' | 'workspaceDir' | 'versioning' | 'registries' | 'configByUri' | 'fetchRetries' | 'fetchRetryFactor' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'fetchTimeout' | 'ca' | 'cert' | 'key' | 'strictSsl' | 'httpProxy' | 'httpsProxy' | 'noProxy' | 'localAddress'>> & Partial<Pick<ConfigContext, 'hooks' | 'selectedProjectsGraph' | 'allProjectsGraph' | 'prodAllProjectsGraph' | 'prodOnlySelectedProjectDirs'>> & {
     argv: {
         original: string[];
     };

package/lib/publish/pack.js

@@ -8,7 +8,8 @@ import { getDefaultWorkspaceConcurrency, getWorkspaceConcurrency, types as allTy
 import { PnpmError } from '@pnpm/error';
 import { packlist } from '@pnpm/fs.packlist';
 import { logger } from '@pnpm/logger';
-import { createExportableManifest } from '@pnpm/releasing.exportable-manifest';
+import { createExportableManifest, readReadmeFile } from '@pnpm/releasing.exportable-manifest';
+import { changelogStorage, readPendingChangelog, renderChangelog } from '@pnpm/releasing.versioning';
 import { sortFilteredProjects } from '@pnpm/workspace.projects-sorter';
 import chalk from 'chalk';
 import pLimit from 'p-limit';
@@ -18,6 +19,7 @@ import { renderHelp } from 'render-help';
 import tar from 'tar-stream';
 import { glob } from 'tinyglobby';
 import validateNpmPackageName from 'validate-npm-package-name';
+import { fetchPreviousChangelog } from './previousChangelog.js';
 import { runScriptsIfPresent } from './publish.js';
 const LICENSE_GLOB = 'LICEN{S,C}E{,.*}'; // cspell:disable-line
 export function rcOptionsTypes() {
@@ -216,6 +218,7 @@ export async function api(opts) {
     }
     const files = await packlist(dir, {
         manifest: publishManifest,
+        workspaceDir: opts.workspaceDir,
     });
     const filesMap = Object.fromEntries(files.map((file) => [`package/${file}`, path.join(dir, file)]));
     // cspell:disable-next-line
@@ -233,6 +236,16 @@ export async function api(opts) {
             }
         }));
     }
+    // In `registry` changelog storage the package carries no committed
+    // CHANGELOG.md; its section was parked at `pnpm version -r` time and is
+    // composed here on top of the previously published version's changelog and
+    // packed in. A composed entry supersedes any stale committed CHANGELOG.md.
+    const injectedEntries = {};
+    const composedChangelog = await composeRegistryChangelog(opts, manifest.name, manifest.version);
+    if (composedChangelog != null) {
+        delete filesMap['package/CHANGELOG.md'];
+        injectedEntries['package/CHANGELOG.md'] = composedChangelog;
+    }
     const destDir = packDestination
         ? (path.isAbsolute(packDestination) ? packDestination : path.join(dir, packDestination ?? '.'))
         : dir;
@@ -253,14 +266,19 @@ export async function api(opts) {
         const stat = await fs.promises.stat(source);
         return stat.size;
     }));
-    const unpackedSize = sizes.reduce((acc, size) => acc + size, 0);
-    const packedContents = Array.from(new Set(Object.keys(filesMap).map((name) => isManifestEntry(name)
-        ? 'package.json'
-        : name.replace(/^package\//, '')))).sort((a, b) => a.localeCompare(b, 'en'));
+    const injectedSize = Object.values(injectedEntries).reduce((acc, content) => acc + Buffer.byteLength(content), 0);
+    const unpackedSize = sizes.reduce((acc, size) => acc + size, 0) + injectedSize;
+    const packedContents = Array.from(new Set([
+        ...Object.keys(filesMap).map((name) => isManifestEntry(name)
+            ? 'package.json'
+            : name.replace(/^package\//, '')),
+        ...Object.keys(injectedEntries).map((name) => name.replace(/^package\//, '')),
+    ])).sort((a, b) => a.localeCompare(b, 'en'));
     if (!opts.dryRun) {
         await packPkg({
             destFile: path.join(destDir, tarballName),
             filesMap,
+            injectedEntries,
             modulesDir: path.join(opts.dir, 'node_modules'),
             packGzipLevel: opts.packGzipLevel,
             manifest: publishManifest,
@@ -282,18 +300,51 @@ export async function api(opts) {
         packedTarballPath = path.relative(opts.dir, path.join(dir, tarballName));
     }
     return {
-        publishedManifest: publishManifest,
+        publishedManifest: await withRegistryReadme(publishManifest, dir),
         contents: packedContents,
         tarballPath: packedTarballPath,
         unpackedSize,
     };
 }
+/**
+ * The readme is always sent to the registry as package metadata, matching the npm CLI, so that
+ * registries can render it on the package page. The `embed-readme` setting only controls whether
+ * the readme is additionally written into the `package.json` inside the tarball (via
+ * `createExportableManifest`), which is why it is added to the returned manifest here rather than
+ * to the packed one.
+ */
+async function withRegistryReadme(manifest, projectDir) {
+    if (manifest.readme != null)
+        return manifest;
+    const readme = await readReadmeFile(projectDir);
+    if (readme == null)
+        return manifest;
+    return { ...manifest, readme };
+}
 // True when a `package/<path>` tar key names the package manifest, which is
 // packed as a single serialized `package/package.json` entry and reported as
 // `package.json` in the contents listing regardless of the source file name.
 function isManifestEntry(name) {
     return name === 'package/package.json' || name === 'package/package.json5' || name === 'package/package.yaml';
 }
+/**
+ * The CHANGELOG.md to pack for a `registry`-storage release: its parked
+ * section (written at `pnpm version -r` time) rendered on top of the
+ * previously published version's changelog. `undefined` when storage is
+ * `repository`, there is no workspace, or the release has no parked section
+ * (an ordinary `pnpm pack` of a package that is not mid-release).
+ */
+async function composeRegistryChangelog(opts, pkgName, version) {
+    if (changelogStorage(opts.versioning) !== 'registry' || opts.workspaceDir == null)
+        return undefined;
+    const section = await readPendingChangelog(opts.workspaceDir, pkgName, version);
+    if (section == null)
+        return undefined;
+    const previous = opts.registries != null
+        ? await fetchPreviousChangelog(opts, pkgName, version)
+        : undefined;
+    return renderChangelog(previous ?? null, pkgName, section);
+}
 function stripBuildMetadata(version) {
     const plusIndex = version.indexOf('+');
     return plusIndex === -1 ? version : version.slice(0, plusIndex);
@@ -311,7 +362,7 @@ function preventBundledDependenciesWithoutHoistedNodeLinker(nodeLinker, manifest
     }
 }
 async function packPkg(opts) {
-    const { destFile, filesMap, bins, manifest, } = opts;
+    const { destFile, filesMap, injectedEntries, bins, manifest, } = opts;
     const mtime = new Date('1985-10-26T08:15:00.000Z');
     const pack = tar.pack();
     await Promise.all(Object.entries(filesMap).map(async ([name, source]) => {
@@ -323,6 +374,9 @@ async function packPkg(opts) {
         }
         pack.entry({ mode, mtime, name }, fs.readFileSync(source));
     }));
+    for (const [name, content] of Object.entries(injectedEntries ?? {})) {
+        pack.entry({ mode: 0o644, mtime, name }, content);
+    }
     const tarball = fs.createWriteStream(destFile);
     pack.pipe(createGzip({ level: opts.packGzipLevel })).pipe(tarball);
     pack.finalize();

package/lib/publish/previousChangelog.d.ts

@@ -0,0 +1,19 @@
+import type { Config } from '@pnpm/config.reader';
+import { type CreateFetchFromRegistryOptions } from '@pnpm/network.fetch';
+export type PreviousChangelogOptions = CreateFetchFromRegistryOptions & Pick<Config, 'registries' | 'fetchRetries' | 'fetchRetryFactor' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'fetchTimeout'>;
+/**
+ * The `CHANGELOG.md` packed into the highest published version of `pkgName`
+ * that is semver-lower than `version` — the changelog the section for
+ * `version` is prepended onto in `registry` storage. `undefined` when the
+ * package is new, has no earlier published version, or that version's tarball
+ * carried no changelog.
+ */
+export declare function fetchPreviousChangelog(opts: PreviousChangelogOptions, pkgName: string, version: string): Promise<string | undefined>;
+/**
+ * The `CHANGELOG.md` packed into the published `pkgName@version` exactly, or
+ * `undefined` when that version is not published (or carried no changelog).
+ * Used to confirm a release actually carries its composed section before the
+ * intents behind it are garbage-collected.
+ */
+export declare function fetchPublishedChangelog(opts: PreviousChangelogOptions, pkgName: string, version: string): Promise<string | undefined>;
+export declare function changelogHasSection(changelog: string, section: string): boolean;

package/lib/publish/previousChangelog.js

@@ -0,0 +1,182 @@
+import { gunzipSync } from 'node:zlib';
+import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
+import { PnpmError } from '@pnpm/error';
+import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
+import { createFetchFromRegistry } from '@pnpm/network.fetch';
+import { fetchMetadataFromFromRegistry } from '@pnpm/resolving.npm-resolver';
+import { lt, rsort, valid } from 'semver';
+import tar from 'tar-stream';
+const CHANGELOG_ENTRY = 'package/CHANGELOG.md';
+/**
+ * Caps the previous tarball we buffer and decompress to compose the changelog.
+ * The bytes come from a registry/proxy, so an unbounded read or a highly
+ * compressible ("gzip bomb") tarball could OOM release automation. A composed
+ * changelog is best-effort — exceeding the cap just skips the history prepend —
+ * so this bound can be generous while still defeating the amplification attack.
+ */
+const MAX_TARBALL_BYTES = 256 * 1024 * 1024;
+function createRegistryClient(opts) {
+    return {
+        fetch: createFetchFromRegistry(opts),
+        getAuthHeader: createGetAuthHeaderByURI(opts.configByUri ?? {}),
+    };
+}
+/**
+ * The `CHANGELOG.md` packed into the highest published version of `pkgName`
+ * that is semver-lower than `version` — the changelog the section for
+ * `version` is prepended onto in `registry` storage. `undefined` when the
+ * package is new, has no earlier published version, or that version's tarball
+ * carried no changelog.
+ */
+export async function fetchPreviousChangelog(opts, pkgName, version) {
+    const client = createRegistryClient(opts);
+    const meta = await fetchPackument(client, opts, pkgName);
+    if (meta == null)
+        return undefined;
+    const previousVersion = pickPreviousVersion(meta, version);
+    if (previousVersion == null)
+        return undefined;
+    return downloadTarballChangelog(client, pkgName, meta, previousVersion);
+}
+/**
+ * The `CHANGELOG.md` packed into the published `pkgName@version` exactly, or
+ * `undefined` when that version is not published (or carried no changelog).
+ * Used to confirm a release actually carries its composed section before the
+ * intents behind it are garbage-collected.
+ */
+export async function fetchPublishedChangelog(opts, pkgName, version) {
+    const client = createRegistryClient(opts);
+    const meta = await fetchPackument(client, opts, pkgName);
+    if (meta?.versions[version] == null)
+        return undefined;
+    return downloadTarballChangelog(client, pkgName, meta, version);
+}
+export function changelogHasSection(changelog, section) {
+    return changelog.includes(section.trim());
+}
+async function fetchPackument(client, opts, pkgName) {
+    const registry = pickRegistryForPackage(opts.registries, pkgName);
+    let fetchResult;
+    try {
+        fetchResult = await fetchMetadataFromFromRegistry({
+            fetch: client.fetch,
+            retry: {
+                factor: opts.fetchRetryFactor,
+                maxTimeout: opts.fetchRetryMaxtimeout,
+                minTimeout: opts.fetchRetryMintimeout,
+                retries: opts.fetchRetries,
+            },
+            timeout: opts.fetchTimeout ?? 60000,
+            fetchWarnTimeoutMs: 10000,
+        }, pkgName, {
+            registry,
+            authHeaderValue: client.getAuthHeader(registry, { pkgName }),
+            fullMetadata: false,
+        });
+    }
+    catch (err) {
+        // A package with no published version yet has no changelog to build on.
+        if (err != null && typeof err === 'object' && 'code' in err && err.code === 'ERR_PNPM_FETCH_404') {
+            return undefined;
+        }
+        throw err;
+    }
+    return fetchResult.notModified ? undefined : fetchResult.meta;
+}
+/** Highest published version of the package that is semver-lower than `version`. */
+function pickPreviousVersion(meta, version) {
+    const candidates = Object.keys(meta.versions).filter((candidate) => valid(candidate) != null && lt(candidate, version));
+    return candidates.length > 0 ? rsort(candidates)[0] : undefined;
+}
+async function downloadTarballChangelog(client, pkgName, meta, version) {
+    const tarballUrl = meta.versions[version]?.dist?.tarball;
+    if (tarballUrl == null)
+        return undefined;
+    const response = await client.fetch(tarballUrl, { authHeaderValue: client.getAuthHeader(tarballUrl, { pkgName }) });
+    if (!response.ok) {
+        throw new PnpmError('CHANGELOG_TARBALL_FETCH_FAILED', `Failed to download ${pkgName}@${version} tarball (${response.status}) to compose the changelog: ${tarballUrl}`);
+    }
+    const tarballData = await readCapped(response, MAX_TARBALL_BYTES);
+    if (tarballData == null)
+        return undefined;
+    return extractTarballEntry(tarballData, CHANGELOG_ENTRY);
+}
+/**
+ * Reads a response body into a buffer, stopping (and returning `undefined`) as
+ * soon as it exceeds `maxBytes` — bounding the actual download rather than
+ * trusting a `content-length` header, which may be absent or lie.
+ */
+async function readCapped(response, maxBytes) {
+    const reader = response.body?.getReader();
+    if (reader == null) {
+        const buffer = Buffer.from(await response.arrayBuffer());
+        return buffer.byteLength > maxBytes ? undefined : buffer;
+    }
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        // Streaming a body is inherently sequential — each read must await the
+        // previous chunk — so the successive awaits here are intentional.
+        // eslint-disable-next-line no-await-in-loop
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > maxBytes) {
+            // Best-effort cleanup: a cancel failure must not turn the over-cap path
+            // into a hard error — the caller just gets no changelog either way.
+            // eslint-disable-next-line no-await-in-loop
+            await reader.cancel().catch(() => { });
+            return undefined;
+        }
+        chunks.push(Buffer.from(value));
+    }
+    return Buffer.concat(chunks);
+}
+/**
+ * Reads one entry's contents out of a (optionally gzipped) tarball buffer.
+ * Composing the changelog is best-effort, so any decode/parse failure —
+ * including a gzip bomb tripping the inflate cap — resolves to `undefined`
+ * (no history prepend) rather than throwing.
+ */
+async function extractTarballEntry(tarballData, entryName) {
+    const tarData = gunzipCapped(tarballData);
+    if (tarData == null)
+        return undefined;
+    const extract = tar.extract();
+    return new Promise((resolve) => {
+        let contents;
+        extract.on('entry', (header, stream, next) => {
+            if (header.name !== entryName) {
+                stream.resume();
+                stream.on('end', next);
+                stream.on('error', () => resolve(undefined));
+                return;
+            }
+            const chunks = [];
+            stream.on('data', (chunk) => chunks.push(Buffer.from(chunk)));
+            stream.on('error', () => resolve(undefined));
+            stream.on('end', () => {
+                contents = Buffer.concat(chunks).toString('utf8');
+                next();
+            });
+        });
+        extract.on('error', () => resolve(undefined));
+        extract.on('finish', () => resolve(contents));
+        extract.end(tarData);
+    });
+}
+/**
+ * Inflates a published `.tgz`, capped at `MAX_TARBALL_BYTES` of output so a
+ * gzip bomb throws rather than ballooning memory. Returns `undefined` on that
+ * cap or any other decode failure — the caller treats it as no changelog.
+ */
+function gunzipCapped(tarballData) {
+    try {
+        return gunzipSync(tarballData, { maxOutputLength: MAX_TARBALL_BYTES });
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=previousChangelog.js.map