@pnpm/releasing.commands 1100.6.0 → 1100.6.2

package/lib/publish/pack.js

@@ -1,408 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import { createGzip } from 'node:zlib';
-import { getBinsFromPackageManifest } from '@pnpm/bins.resolver';
-import { FILTERING } from '@pnpm/cli.common-cli-options-help';
-import { readProjectManifest } from '@pnpm/cli.utils';
-import { getDefaultWorkspaceConcurrency, getWorkspaceConcurrency, types as allTypes } from '@pnpm/config.reader';
-import { PnpmError } from '@pnpm/error';
-import { packlist } from '@pnpm/fs.packlist';
-import { logger } from '@pnpm/logger';
-import { createExportableManifest, readReadmeFile } from '@pnpm/releasing.exportable-manifest';
-import { changelogStorage, readPendingChangelog, renderChangelog } from '@pnpm/releasing.versioning';
-import { sortFilteredProjects } from '@pnpm/workspace.projects-sorter';
-import chalk from 'chalk';
-import pLimit from 'p-limit';
-import { pick } from 'ramda';
-import { realpathMissing } from 'realpath-missing';
-import { renderHelp } from 'render-help';
-import tar from 'tar-stream';
-import { glob } from 'tinyglobby';
-import validateNpmPackageName from 'validate-npm-package-name';
-import { fetchPreviousChangelog } from './previousChangelog.js';
-import { runScriptsIfPresent } from './publish.js';
-const LICENSE_GLOB = 'LICEN{S,C}E{,.*}'; // cspell:disable-line
-export function rcOptionsTypes() {
-    return {
-        ...cliOptionsTypes(),
-        ...pick([
-            'npm-path',
-            'skip-manifest-obfuscation',
-        ], allTypes),
-    };
-}
-export function cliOptionsTypes() {
-    return {
-        out: String,
-        recursive: Boolean,
-        ...pick([
-            'dry-run',
-            'pack-destination',
-            'pack-gzip-level',
-            'json',
-            'skip-manifest-obfuscation',
-            'workspace-concurrency',
-        ], allTypes),
-    };
-}
-export const commandNames = ['pack'];
-export function help() {
-    return renderHelp({
-        description: 'Create a tarball from a package',
-        usages: ['pnpm pack'],
-        descriptionLists: [
-            {
-                title: 'Options',
-                list: [
-                    {
-                        description: 'Does everything `pnpm pack` would do except actually writing the tarball to disk.',
-                        name: '--dry-run',
-                    },
-                    {
-                        description: 'Directory in which `pnpm pack` will save tarballs. The default is the current working directory.',
-                        name: '--pack-destination <dir>',
-                    },
-                    {
-                        description: 'Prints the packed tarball and contents in the json format.',
-                        name: '--json',
-                    },
-                    {
-                        description: 'Customizes the output path for the tarball. Use `%s` and `%v` to include the package name and version, e.g., `%s.tgz` or `some-dir/%s-%v.tgz`. By default, the tarball is saved in the current working directory with the name `<package-name>-<version>.tgz`.',
-                        name: '--out <path>',
-                    },
-                    {
-                        description: 'Pack all packages from the workspace',
-                        name: '--recursive',
-                        shortAlias: '-r',
-                    },
-                    {
-                        description: 'Skip pnpm\'s manifest obfuscation: keep the original `packageManager` field and publish lifecycle scripts in the packed manifest instead of stripping them. The pnpm-specific `pnpm` field is still omitted.',
-                        name: '--skip-manifest-obfuscation',
-                    },
-                    {
-                        description: `Set the maximum number of concurrency. Default is ${getDefaultWorkspaceConcurrency()}. For unlimited concurrency use Infinity.`,
-                        name: '--workspace-concurrency <number>',
-                    },
-                ],
-            },
-            FILTERING,
-        ],
-    });
-}
-export async function handler(opts) {
-    const packedPackages = [];
-    if (opts.recursive) {
-        const selectedProjectsGraph = opts.selectedProjectsGraph;
-        const pkgsToPack = [];
-        for (const { package: pkg } of Object.values(selectedProjectsGraph)) {
-            if (pkg.manifest.name && pkg.manifest.version) {
-                pkgsToPack.push(pkg);
-            }
-        }
-        const packedPkgDirs = new Set(pkgsToPack.map(({ rootDir }) => rootDir));
-        if (packedPkgDirs.size === 0) {
-            logger.info({
-                message: 'There are no packages that should be packed',
-                prefix: opts.dir,
-            });
-        }
-        const chunks = sortFilteredProjects({
-            selectedProjectsGraph,
-            allProjectsGraph: opts.allProjectsGraph,
-            prodAllProjectsGraph: opts.prodAllProjectsGraph,
-            prodOnlySelectedProjectDirs: opts.prodOnlySelectedProjectDirs,
-        });
-        const limitPack = pLimit(getWorkspaceConcurrency(opts.workspaceConcurrency));
-        const resolvedOpts = { ...opts };
-        if (opts.out) {
-            resolvedOpts.out = path.resolve(opts.dir, opts.out);
-        }
-        else if (opts.packDestination) {
-            resolvedOpts.packDestination = path.resolve(opts.dir, opts.packDestination);
-        }
-        else {
-            resolvedOpts.packDestination = path.resolve(opts.dir);
-        }
-        for (const chunk of chunks) {
-            // eslint-disable-next-line no-await-in-loop
-            await Promise.all(chunk.map(pkgDir => limitPack(async () => {
-                if (!packedPkgDirs.has(pkgDir))
-                    return;
-                const pkg = selectedProjectsGraph[pkgDir].package;
-                const packResult = await api({
-                    ...resolvedOpts,
-                    dir: pkg.rootDir,
-                });
-                packedPackages.push(toPackResultJson(packResult));
-            })));
-        }
-    }
-    else {
-        const packResult = await api(opts);
-        packedPackages.push(toPackResultJson(packResult));
-    }
-    if (opts.json) {
-        return JSON.stringify(packedPackages.length > 1 ? packedPackages : packedPackages[0], null, 2);
-    }
-    return packedPackages.map(({ name, version, filename, files }) => `${opts.unicode ? '📦 ' : 'package:'} ${name}@${version}
-${chalk.blueBright('Tarball Contents')}
-${files.map(({ path }) => path).join('\n')}
-${chalk.blueBright('Tarball Details')}
-${filename}`).join('\n\n');
-}
-export async function api(opts) {
-    const { manifest: entryManifest, fileName: manifestFileName } = await readProjectManifest(opts.dir, opts);
-    preventBundledDependenciesWithoutHoistedNodeLinker(opts.nodeLinker, entryManifest);
-    const _runScriptsIfPresent = runScriptsIfPresent.bind(null, {
-        depPath: opts.dir,
-        extraBinPaths: opts.extraBinPaths,
-        extraEnv: opts.extraEnv,
-        pkgRoot: opts.dir,
-        rootModulesDir: await realpathMissing(path.join(opts.dir, 'node_modules')),
-        stdio: 'inherit',
-        unsafePerm: true, // when running scripts explicitly, assume that they're trusted.
-        userAgent: opts.userAgent,
-    });
-    if (!opts.ignoreScripts) {
-        await _runScriptsIfPresent([
-            'prepack',
-            'prepare',
-        ], entryManifest);
-    }
-    const dir = entryManifest.publishConfig?.directory
-        ? path.join(opts.dir, entryManifest.publishConfig.directory)
-        : opts.dir;
-    // always read the latest manifest, as "prepack" or "prepare" script may modify package manifest.
-    const { manifest } = await readProjectManifest(dir, opts);
-    preventBundledDependenciesWithoutHoistedNodeLinker(opts.nodeLinker, manifest);
-    if (!manifest.name) {
-        throw new PnpmError('PACKAGE_NAME_NOT_FOUND', `Package name is not defined in the ${manifestFileName}.`);
-    }
-    if (!validateNpmPackageName(manifest.name).validForOldPackages) {
-        throw new PnpmError('INVALID_PACKAGE_NAME', `Invalid package name "${manifest.name}".`);
-    }
-    if (!manifest.version) {
-        throw new PnpmError('PACKAGE_VERSION_NOT_FOUND', `Package version is not defined in the ${manifestFileName}.`);
-    }
-    const publishManifest = await createPublishManifest({
-        projectDir: dir,
-        modulesDir: path.join(opts.dir, 'node_modules'),
-        manifest,
-        embedReadme: opts.embedReadme,
-        catalogs: opts.catalogs ?? {},
-        hooks: opts.hooks,
-        skipManifestObfuscation: opts.skipManifestObfuscation,
-    });
-    // Strip semver build metadata (the `+<build>` segment) from the published version so that
-    // the tarball, the manifest packed inside it, and the metadata sent to the registry all agree.
-    // libnpmpublish runs `semver.clean()` on `manifest.version` before computing the provenance
-    // subject, which removes build metadata. Leaving it in here would mismatch the version embedded
-    // in the tarball's package.json and cause the registry to reject the publish with a 422 when
-    // verifying the sigstore provenance bundle. See https://github.com/pnpm/pnpm/issues/11518.
-    publishManifest.version = stripBuildMetadata(publishManifest.version);
-    let tarballName;
-    let packDestination;
-    const normalizedName = manifest.name.replace('@', '').replace('/', '-');
-    if (opts.out) {
-        if (opts.packDestination) {
-            throw new PnpmError('INVALID_OPTION', 'Cannot use --pack-destination and --out together');
-        }
-        const preparedOut = opts.out.replaceAll('%s', normalizedName).replaceAll('%v', publishManifest.version);
-        const parsedOut = path.parse(preparedOut);
-        packDestination = parsedOut.dir ? parsedOut.dir : opts.packDestination;
-        tarballName = parsedOut.base;
-    }
-    else {
-        tarballName = `${normalizedName}-${publishManifest.version}.tgz`;
-        packDestination = opts.packDestination;
-    }
-    const files = await packlist(dir, {
-        manifest: publishManifest,
-        workspaceDir: opts.workspaceDir,
-    });
-    const filesMap = Object.fromEntries(files.map((file) => [`package/${file}`, path.join(dir, file)]));
-    // cspell:disable-next-line
-    if (opts.workspaceDir != null && dir !== opts.workspaceDir && !files.some((file) => /LICEN[CS]E(?:\..+)?/i.test(file))) {
-        const { workspaceDir } = opts;
-        const licenses = await glob([LICENSE_GLOB], { cwd: workspaceDir, expandDirectories: false });
-        await Promise.all(licenses.map(async (license) => {
-            const licensePath = path.join(workspaceDir, license);
-            // Only inject a regular file. A symlink could point outside the workspace and leak its
-            // target's bytes into the published tarball, so `lstat()` (which does not follow symlinks)
-            // rejects it — matching pacquet's inject_workspace_license.
-            const stats = await fs.promises.lstat(licensePath);
-            if (stats.isFile()) {
-                filesMap[`package/${license}`] = licensePath;
-            }
-        }));
-    }
-    // In `registry` changelog storage the package carries no committed
-    // CHANGELOG.md; its section was parked at `pnpm version -r` time and is
-    // composed here on top of the previously published version's changelog and
-    // packed in. A composed entry supersedes any stale committed CHANGELOG.md.
-    const injectedEntries = {};
-    const composedChangelog = await composeRegistryChangelog(opts, manifest.name, manifest.version);
-    if (composedChangelog != null) {
-        delete filesMap['package/CHANGELOG.md'];
-        injectedEntries['package/CHANGELOG.md'] = composedChangelog;
-    }
-    const destDir = packDestination
-        ? (path.isAbsolute(packDestination) ? packDestination : path.join(dir, packDestination ?? '.'))
-        : dir;
-    if (!opts.dryRun) {
-        await fs.promises.mkdir(destDir, { recursive: true });
-    }
-    // Derive `contents` and `unpackedSize` from `filesMap` (the full set of tar entries) rather than
-    // from `files` (the packlist subset) so that:
-    //   - workspace LICENSE files appended to `filesMap` after the packlist call are included; and
-    //   - `package.yaml` / `package.json5` entries are reported under the name they actually have in
-    //     the tar (`package.json`), since `packPkg()` rewrites them.
-    // The `stat()` pass must run before `postpack`, which may delete prepack-generated files that
-    // were packed. See https://github.com/pnpm/pnpm/issues/12775.
-    const sizes = await Promise.all(Object.entries(filesMap).map(async ([name, source]) => {
-        if (isManifestEntry(name)) {
-            return Buffer.byteLength(JSON.stringify(publishManifest, null, 2));
-        }
-        const stat = await fs.promises.stat(source);
-        return stat.size;
-    }));
-    const injectedSize = Object.values(injectedEntries).reduce((acc, content) => acc + Buffer.byteLength(content), 0);
-    const unpackedSize = sizes.reduce((acc, size) => acc + size, 0) + injectedSize;
-    const packedContents = Array.from(new Set([
-        ...Object.keys(filesMap).map((name) => isManifestEntry(name)
-            ? 'package.json'
-            : name.replace(/^package\//, '')),
-        ...Object.keys(injectedEntries).map((name) => name.replace(/^package\//, '')),
-    ])).sort((a, b) => a.localeCompare(b, 'en'));
-    if (!opts.dryRun) {
-        await packPkg({
-            destFile: path.join(destDir, tarballName),
-            filesMap,
-            injectedEntries,
-            modulesDir: path.join(opts.dir, 'node_modules'),
-            packGzipLevel: opts.packGzipLevel,
-            manifest: publishManifest,
-            bins: [
-                ...(await getBinsFromPackageManifest(publishManifest, dir)).map(({ path }) => path),
-                ...(manifest.publishConfig?.executableFiles ?? [])
-                    .map((executableFile) => path.join(dir, executableFile)),
-            ],
-        });
-        if (!opts.ignoreScripts) {
-            await _runScriptsIfPresent(['postpack'], entryManifest);
-        }
-    }
-    let packedTarballPath;
-    if (opts.dir !== destDir) {
-        packedTarballPath = path.join(destDir, tarballName);
-    }
-    else {
-        packedTarballPath = path.relative(opts.dir, path.join(dir, tarballName));
-    }
-    return {
-        publishedManifest: await withRegistryReadme(publishManifest, dir),
-        contents: packedContents,
-        tarballPath: packedTarballPath,
-        unpackedSize,
-    };
-}
-/**
- * The readme is always sent to the registry as package metadata, matching the npm CLI, so that
- * registries can render it on the package page. The `embed-readme` setting only controls whether
- * the readme is additionally written into the `package.json` inside the tarball (via
- * `createExportableManifest`), which is why it is added to the returned manifest here rather than
- * to the packed one.
- */
-async function withRegistryReadme(manifest, projectDir) {
-    if (manifest.readme != null)
-        return manifest;
-    const readme = await readReadmeFile(projectDir);
-    if (readme == null)
-        return manifest;
-    return { ...manifest, readme };
-}
-// True when a `package/<path>` tar key names the package manifest, which is
-// packed as a single serialized `package/package.json` entry and reported as
-// `package.json` in the contents listing regardless of the source file name.
-function isManifestEntry(name) {
-    return name === 'package/package.json' || name === 'package/package.json5' || name === 'package/package.yaml';
-}
-/**
- * The CHANGELOG.md to pack for a `registry`-storage release: its parked
- * section (written at `pnpm version -r` time) rendered on top of the
- * previously published version's changelog. `undefined` when storage is
- * `repository`, there is no workspace, or the release has no parked section
- * (an ordinary `pnpm pack` of a package that is not mid-release).
- */
-async function composeRegistryChangelog(opts, pkgName, version) {
-    if (changelogStorage(opts.versioning) !== 'registry' || opts.workspaceDir == null)
-        return undefined;
-    const section = await readPendingChangelog(opts.workspaceDir, pkgName, version);
-    if (section == null)
-        return undefined;
-    const previous = opts.registries != null
-        ? await fetchPreviousChangelog(opts, pkgName, version)
-        : undefined;
-    return renderChangelog(previous ?? null, pkgName, section);
-}
-function stripBuildMetadata(version) {
-    const plusIndex = version.indexOf('+');
-    return plusIndex === -1 ? version : version.slice(0, plusIndex);
-}
-function preventBundledDependenciesWithoutHoistedNodeLinker(nodeLinker, manifest) {
-    if (nodeLinker === 'hoisted')
-        return;
-    for (const key of ['bundledDependencies', 'bundleDependencies']) {
-        const bundledDependencies = manifest[key];
-        if (bundledDependencies) {
-            throw new PnpmError('BUNDLED_DEPENDENCIES_WITHOUT_HOISTED', `${key} does not work with "nodeLinker: ${nodeLinker}"`, {
-                hint: `Add "nodeLinker: hoisted" to pnpm-workspace.yaml or delete ${key} from the root package.json to resolve this error`,
-            });
-        }
-    }
-}
-async function packPkg(opts) {
-    const { destFile, filesMap, injectedEntries, bins, manifest, } = opts;
-    const mtime = new Date('1985-10-26T08:15:00.000Z');
-    const pack = tar.pack();
-    await Promise.all(Object.entries(filesMap).map(async ([name, source]) => {
-        const isExecutable = bins.some((bin) => path.relative(bin, source) === '');
-        const mode = isExecutable ? 0o755 : 0o644;
-        if (isManifestEntry(name)) {
-            pack.entry({ mode, mtime, name: 'package/package.json' }, JSON.stringify(manifest, null, 2));
-            return;
-        }
-        pack.entry({ mode, mtime, name }, fs.readFileSync(source));
-    }));
-    for (const [name, content] of Object.entries(injectedEntries ?? {})) {
-        pack.entry({ mode: 0o644, mtime, name }, content);
-    }
-    const tarball = fs.createWriteStream(destFile);
-    pack.pipe(createGzip({ level: opts.packGzipLevel })).pipe(tarball);
-    pack.finalize();
-    return new Promise((resolve, reject) => {
-        tarball.on('close', () => {
-            resolve();
-        }).on('error', reject);
-    });
-}
-async function createPublishManifest(opts) {
-    const { projectDir, embedReadme, modulesDir, manifest, catalogs, hooks, skipManifestObfuscation } = opts;
-    return createExportableManifest(projectDir, manifest, {
-        catalogs,
-        hooks,
-        embedReadme,
-        modulesDir,
-        skipManifestObfuscation,
-    });
-}
-function toPackResultJson(packResult) {
-    const { publishedManifest, contents, tarballPath } = packResult;
-    return {
-        name: publishedManifest.name,
-        version: publishedManifest.version,
-        filename: tarballPath,
-        files: contents.map((file) => ({ path: file })),
-    };
-}
-//# sourceMappingURL=pack.js.map

package/lib/publish/previousChangelog.d.ts

@@ -1,19 +0,0 @@
-import type { Config } from '@pnpm/config.reader';
-import { type CreateFetchFromRegistryOptions } from '@pnpm/network.fetch';
-export type PreviousChangelogOptions = CreateFetchFromRegistryOptions & Pick<Config, 'registries' | 'fetchRetries' | 'fetchRetryFactor' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'fetchTimeout'>;
-/**
- * The `CHANGELOG.md` packed into the highest published version of `pkgName`
- * that is semver-lower than `version` — the changelog the section for
- * `version` is prepended onto in `registry` storage. `undefined` when the
- * package is new, has no earlier published version, or that version's tarball
- * carried no changelog.
- */
-export declare function fetchPreviousChangelog(opts: PreviousChangelogOptions, pkgName: string, version: string): Promise<string | undefined>;
-/**
- * The `CHANGELOG.md` packed into the published `pkgName@version` exactly, or
- * `undefined` when that version is not published (or carried no changelog).
- * Used to confirm a release actually carries its composed section before the
- * intents behind it are garbage-collected.
- */
-export declare function fetchPublishedChangelog(opts: PreviousChangelogOptions, pkgName: string, version: string): Promise<string | undefined>;
-export declare function changelogHasSection(changelog: string, section: string): boolean;

package/lib/publish/previousChangelog.js

@@ -1,182 +0,0 @@
-import { gunzipSync } from 'node:zlib';
-import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
-import { PnpmError } from '@pnpm/error';
-import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
-import { createFetchFromRegistry } from '@pnpm/network.fetch';
-import { fetchMetadataFromFromRegistry } from '@pnpm/resolving.npm-resolver';
-import { lt, rsort, valid } from 'semver';
-import tar from 'tar-stream';
-const CHANGELOG_ENTRY = 'package/CHANGELOG.md';
-/**
- * Caps the previous tarball we buffer and decompress to compose the changelog.
- * The bytes come from a registry/proxy, so an unbounded read or a highly
- * compressible ("gzip bomb") tarball could OOM release automation. A composed
- * changelog is best-effort — exceeding the cap just skips the history prepend —
- * so this bound can be generous while still defeating the amplification attack.
- */
-const MAX_TARBALL_BYTES = 256 * 1024 * 1024;
-function createRegistryClient(opts) {
-    return {
-        fetch: createFetchFromRegistry(opts),
-        getAuthHeader: createGetAuthHeaderByURI(opts.configByUri ?? {}),
-    };
-}
-/**
- * The `CHANGELOG.md` packed into the highest published version of `pkgName`
- * that is semver-lower than `version` — the changelog the section for
- * `version` is prepended onto in `registry` storage. `undefined` when the
- * package is new, has no earlier published version, or that version's tarball
- * carried no changelog.
- */
-export async function fetchPreviousChangelog(opts, pkgName, version) {
-    const client = createRegistryClient(opts);
-    const meta = await fetchPackument(client, opts, pkgName);
-    if (meta == null)
-        return undefined;
-    const previousVersion = pickPreviousVersion(meta, version);
-    if (previousVersion == null)
-        return undefined;
-    return downloadTarballChangelog(client, pkgName, meta, previousVersion);
-}
-/**
- * The `CHANGELOG.md` packed into the published `pkgName@version` exactly, or
- * `undefined` when that version is not published (or carried no changelog).
- * Used to confirm a release actually carries its composed section before the
- * intents behind it are garbage-collected.
- */
-export async function fetchPublishedChangelog(opts, pkgName, version) {
-    const client = createRegistryClient(opts);
-    const meta = await fetchPackument(client, opts, pkgName);
-    if (meta?.versions[version] == null)
-        return undefined;
-    return downloadTarballChangelog(client, pkgName, meta, version);
-}
-export function changelogHasSection(changelog, section) {
-    return changelog.includes(section.trim());
-}
-async function fetchPackument(client, opts, pkgName) {
-    const registry = pickRegistryForPackage(opts.registries, pkgName);
-    let fetchResult;
-    try {
-        fetchResult = await fetchMetadataFromFromRegistry({
-            fetch: client.fetch,
-            retry: {
-                factor: opts.fetchRetryFactor,
-                maxTimeout: opts.fetchRetryMaxtimeout,
-                minTimeout: opts.fetchRetryMintimeout,
-                retries: opts.fetchRetries,
-            },
-            timeout: opts.fetchTimeout ?? 60000,
-            fetchWarnTimeoutMs: 10000,
-        }, pkgName, {
-            registry,
-            authHeaderValue: client.getAuthHeader(registry, { pkgName }),
-            fullMetadata: false,
-        });
-    }
-    catch (err) {
-        // A package with no published version yet has no changelog to build on.
-        if (err != null && typeof err === 'object' && 'code' in err && err.code === 'ERR_PNPM_FETCH_404') {
-            return undefined;
-        }
-        throw err;
-    }
-    return fetchResult.notModified ? undefined : fetchResult.meta;
-}
-/** Highest published version of the package that is semver-lower than `version`. */
-function pickPreviousVersion(meta, version) {
-    const candidates = Object.keys(meta.versions).filter((candidate) => valid(candidate) != null && lt(candidate, version));
-    return candidates.length > 0 ? rsort(candidates)[0] : undefined;
-}
-async function downloadTarballChangelog(client, pkgName, meta, version) {
-    const tarballUrl = meta.versions[version]?.dist?.tarball;
-    if (tarballUrl == null)
-        return undefined;
-    const response = await client.fetch(tarballUrl, { authHeaderValue: client.getAuthHeader(tarballUrl, { pkgName }) });
-    if (!response.ok) {
-        throw new PnpmError('CHANGELOG_TARBALL_FETCH_FAILED', `Failed to download ${pkgName}@${version} tarball (${response.status}) to compose the changelog: ${tarballUrl}`);
-    }
-    const tarballData = await readCapped(response, MAX_TARBALL_BYTES);
-    if (tarballData == null)
-        return undefined;
-    return extractTarballEntry(tarballData, CHANGELOG_ENTRY);
-}
-/**
- * Reads a response body into a buffer, stopping (and returning `undefined`) as
- * soon as it exceeds `maxBytes` — bounding the actual download rather than
- * trusting a `content-length` header, which may be absent or lie.
- */
-async function readCapped(response, maxBytes) {
-    const reader = response.body?.getReader();
-    if (reader == null) {
-        const buffer = Buffer.from(await response.arrayBuffer());
-        return buffer.byteLength > maxBytes ? undefined : buffer;
-    }
-    const chunks = [];
-    let total = 0;
-    for (;;) {
-        // Streaming a body is inherently sequential — each read must await the
-        // previous chunk — so the successive awaits here are intentional.
-        // eslint-disable-next-line no-await-in-loop
-        const { done, value } = await reader.read();
-        if (done)
-            break;
-        total += value.byteLength;
-        if (total > maxBytes) {
-            // Best-effort cleanup: a cancel failure must not turn the over-cap path
-            // into a hard error — the caller just gets no changelog either way.
-            // eslint-disable-next-line no-await-in-loop
-            await reader.cancel().catch(() => { });
-            return undefined;
-        }
-        chunks.push(Buffer.from(value));
-    }
-    return Buffer.concat(chunks);
-}
-/**
- * Reads one entry's contents out of a (optionally gzipped) tarball buffer.
- * Composing the changelog is best-effort, so any decode/parse failure —
- * including a gzip bomb tripping the inflate cap — resolves to `undefined`
- * (no history prepend) rather than throwing.
- */
-async function extractTarballEntry(tarballData, entryName) {
-    const tarData = gunzipCapped(tarballData);
-    if (tarData == null)
-        return undefined;
-    const extract = tar.extract();
-    return new Promise((resolve) => {
-        let contents;
-        extract.on('entry', (header, stream, next) => {
-            if (header.name !== entryName) {
-                stream.resume();
-                stream.on('end', next);
-                stream.on('error', () => resolve(undefined));
-                return;
-            }
-            const chunks = [];
-            stream.on('data', (chunk) => chunks.push(Buffer.from(chunk)));
-            stream.on('error', () => resolve(undefined));
-            stream.on('end', () => {
-                contents = Buffer.concat(chunks).toString('utf8');
-                next();
-            });
-        });
-        extract.on('error', () => resolve(undefined));
-        extract.on('finish', () => resolve(contents));
-        extract.end(tarData);
-    });
-}
-/**
- * Inflates a published `.tgz`, capped at `MAX_TARBALL_BYTES` of output so a
- * gzip bomb throws rather than ballooning memory. Returns `undefined` on that
- * cap or any other decode failure — the caller treats it as no changelog.
- */
-function gunzipCapped(tarballData) {
-    try {
-        return gunzipSync(tarballData, { maxOutputLength: MAX_TARBALL_BYTES });
-    }
-    catch {
-        return undefined;
-    }
-}
-//# sourceMappingURL=previousChangelog.js.map

package/lib/publish/publish.d.ts

@@ -1,40 +0,0 @@
-import { type Config, type ConfigContext } from '@pnpm/config.reader';
-import { type RunLifecycleHookOptions } from '@pnpm/exec.lifecycle';
-import type { ExportedManifest } from '@pnpm/releasing.exportable-manifest';
-import type { ProjectManifest } from '@pnpm/types';
-import { type PublishSummary } from './publishPackedPkg.js';
-import { type PublishRecursiveOpts, type RecursivePublishedPackage } from './recursivePublish.js';
-export declare function rcOptionsTypes(): Record<string, unknown>;
-export declare function cliOptionsTypes(): Record<string, unknown>;
-export declare const commandNames: string[];
-export declare function help(): string;
-export declare function handler(opts: Omit<PublishRecursiveOpts, 'workspaceDir'> & {
-    argv: {
-        original: string[];
-    };
-    engineStrict?: boolean;
-    json?: boolean;
-    recursive?: boolean;
-    workspaceDir?: string;
-} & Pick<Config, 'bin' | 'gitChecks' | 'ignoreScripts' | 'pnpmHomeDir' | 'publishBranch' | 'embedReadme' | 'skipManifestObfuscation' | 'versioning'> & Pick<ConfigContext, 'allProjects'>, params: string[]): Promise<{
-    exitCode?: number;
-    output?: string;
-} | undefined>;
-export interface PublishResult {
-    exitCode?: number;
-    manifest?: ProjectManifest;
-    publishedManifest?: ExportedManifest;
-    /** Per-package summary in the npm-CLI `--json` shape; only populated for single-package publish. */
-    publishSummary?: PublishSummary;
-    /** Per-package summaries collected by recursive publish. */
-    publishedPackages?: RecursivePublishedPackage[];
-}
-export declare function publish(opts: Omit<PublishRecursiveOpts, 'workspaceDir'> & {
-    argv: {
-        original: string[];
-    };
-    engineStrict?: boolean;
-    recursive?: boolean;
-    workspaceDir?: string;
-} & Pick<Config, 'bin' | 'gitChecks' | 'ignoreScripts' | 'pnpmHomeDir' | 'publishBranch' | 'embedReadme' | 'packGzipLevel' | 'skipManifestObfuscation' | 'versioning'> & Pick<ConfigContext, 'allProjects'>, params: string[]): Promise<PublishResult>;
-export declare function runScriptsIfPresent(opts: RunLifecycleHookOptions, scriptNames: string[], manifest: ProjectManifest): Promise<void>;