@pnpm/releasing.commands 1100.6.0 → 1100.6.2

package/lib/publish/publish.js

@@ -1,256 +0,0 @@
-import path from 'node:path';
-import { confirm } from '@inquirer/prompts';
-import { FILTERING } from '@pnpm/cli.common-cli-options-help';
-import { docsUrl, readProjectManifest } from '@pnpm/cli.utils';
-import { types as allTypes } from '@pnpm/config.reader';
-import { PnpmError } from '@pnpm/error';
-import { runLifecycleHook } from '@pnpm/exec.lifecycle';
-import { getCurrentBranch, isGitRepo, isRemoteHistoryClean, isWorkingTreeClean } from '@pnpm/network.git-utils';
-import { rimraf } from '@zkochan/rimraf';
-import { pick } from 'ramda';
-import { realpathMissing } from 'realpath-missing';
-import { renderHelp } from 'render-help';
-import { temporaryDirectory } from 'tempy';
-import { extractPublishManifestFromPacked, isTarballPath } from './extractManifestFromPacked.js';
-import { optionsWithOtpEnv } from './otpEnv.js';
-import * as pack from './pack.js';
-import { publishPackedPkg } from './publishPackedPkg.js';
-import { recursivePublish } from './recursivePublish.js';
-export function rcOptionsTypes() {
-    return pick([
-        'access',
-        'git-checks',
-        'ignore-scripts',
-        'skip-manifest-obfuscation',
-        'provenance',
-        'npm-path',
-        'otp',
-        'publish-branch',
-        'registry',
-        'tag',
-        'unsafe-perm',
-        'embed-readme',
-    ], allTypes);
-}
-export function cliOptionsTypes() {
-    return {
-        ...rcOptionsTypes(),
-        batch: Boolean,
-        'dry-run': Boolean,
-        force: Boolean,
-        json: Boolean,
-        otp: String,
-        recursive: Boolean,
-        'report-summary': Boolean,
-    };
-}
-export const commandNames = ['publish'];
-export function help() {
-    return renderHelp({
-        description: 'Publishes a package to the npm registry.',
-        descriptionLists: [
-            {
-                title: 'Options',
-                list: [
-                    {
-                        description: "Don't check if current branch is your publish branch, clean, and up to date",
-                        name: '--no-git-checks',
-                    },
-                    {
-                        description: 'Sets branch name to publish. Default is master',
-                        name: '--publish-branch',
-                    },
-                    {
-                        description: 'Does everything a publish would do except actually publishing to the registry',
-                        name: '--dry-run',
-                    },
-                    {
-                        description: 'Show information in JSON format',
-                        name: '--json',
-                    },
-                    {
-                        description: 'Registers the published package with the given tag. By default, the "latest" tag is used.',
-                        name: '--tag <tag>',
-                    },
-                    {
-                        description: 'Tells the registry whether this package should be published as public or restricted',
-                        name: '--access <public|restricted>',
-                    },
-                    {
-                        description: 'Ignores any publish related lifecycle scripts (prepublishOnly, postpublish, and the like)',
-                        name: '--ignore-scripts',
-                    },
-                    {
-                        description: 'Skip pnpm\'s manifest obfuscation: keep the original `packageManager` field and publish lifecycle scripts in the published manifest instead of stripping them. The pnpm-specific `pnpm` field is still omitted.',
-                        name: '--skip-manifest-obfuscation',
-                    },
-                    {
-                        description: 'Packages are proceeded to be published even if their current version is already in the registry. This is useful when a "prepublishOnly" script bumps the version of the package before it is published',
-                        name: '--force',
-                    },
-                    {
-                        description: 'Save the list of the newly published packages to "pnpm-publish-summary.json". Useful when some other tooling is used to report the list of published packages.',
-                        name: '--report-summary',
-                    },
-                    {
-                        description: 'When publishing packages that require two-factor authentication, this option can specify a one-time password',
-                        name: '--otp',
-                    },
-                    {
-                        description: 'Publish all packages from the workspace',
-                        name: '--recursive',
-                        shortAlias: '-r',
-                    },
-                    {
-                        description: 'Send all packages to the registry in a single request instead of one request per package. Requires --recursive and a registry that implements the "/-/pnpm/v1/publish" endpoint (for example, pnpr)',
-                        name: '--batch',
-                    },
-                ],
-            },
-            FILTERING,
-        ],
-        url: docsUrl('publish'),
-        usages: ['pnpm publish [<tarball>|<dir>] [--tag <tag>] [--access <public|restricted>] [options]'],
-    });
-}
-const GIT_CHECKS_HINT = 'If you want to disable Git checks on publish, set the "git-checks" setting to "false", or run again with "--no-git-checks".';
-export async function handler(opts, params) {
-    const result = await publish(opts, params);
-    // Emit per-package summaries on stdout when --json is set: single object for a single-package
-    // publish, array for recursive publish. Mirrors `pnpm pack --json`'s shape choice.
-    if (opts.json) {
-        if (result?.publishSummary) {
-            return { output: JSON.stringify(result.publishSummary, null, 2), exitCode: 0 };
-        }
-        if (result?.publishedPackages) {
-            return { output: JSON.stringify(result.publishedPackages, null, 2), exitCode: result.exitCode ?? 0 };
-        }
-    }
-    if (result?.manifest)
-        return;
-    return result;
-}
-export async function publish(opts, params) {
-    if (opts.batch && !opts.recursive) {
-        throw new PnpmError('BATCH_PUBLISH_REQUIRES_RECURSIVE', '--batch can only be used together with --recursive', {
-            hint: 'Run "pnpm publish -r --batch" to publish all workspace packages in a single request.',
-        });
-    }
-    if (opts.gitChecks !== false && await isGitRepo()) {
-        if (!(await isWorkingTreeClean())) {
-            throw new PnpmError('GIT_UNCLEAN', 'Unclean working tree. Commit or stash changes first.', {
-                hint: GIT_CHECKS_HINT,
-            });
-        }
-        const branches = opts.publishBranch ? [opts.publishBranch] : ['master', 'main'];
-        const currentBranch = await getCurrentBranch();
-        if (currentBranch === null) {
-            throw new PnpmError('GIT_UNKNOWN_BRANCH', `The Git HEAD may not attached to any branch, but your "publish-branch" is set to "${branches.join('|')}".`, {
-                hint: GIT_CHECKS_HINT,
-            });
-        }
-        if (!branches.includes(currentBranch)) {
-            let isConfirmed;
-            try {
-                isConfirmed = await confirm({
-                    message: `You're on branch "${currentBranch}" but your "publish-branch" is set to "${branches.join('|')}". Do you want to continue?`,
-                });
-            }
-            catch (err) {
-                if (err instanceof Error && err.name === 'ExitPromptError') {
-                    isConfirmed = false;
-                }
-                else {
-                    throw err;
-                }
-            }
-            if (!isConfirmed) {
-                throw new PnpmError('GIT_NOT_CORRECT_BRANCH', `Branch is not on '${branches.join('|')}'.`, {
-                    hint: GIT_CHECKS_HINT,
-                });
-            }
-        }
-        if (!(await isRemoteHistoryClean())) {
-            throw new PnpmError('GIT_NOT_LATEST', 'Remote history differs. Please pull changes.', {
-                hint: GIT_CHECKS_HINT,
-            });
-        }
-    }
-    if (opts.recursive && (opts.selectedProjectsGraph != null)) {
-        const { exitCode, publishedPackages } = await recursivePublish({
-            ...opts,
-            selectedProjectsGraph: opts.selectedProjectsGraph,
-            workspaceDir: opts.workspaceDir ?? process.cwd(),
-        });
-        return { exitCode, publishedPackages };
-    }
-    opts = optionsWithOtpEnv(opts, process.env);
-    const dirInParams = (params.length > 0) ? params[0] : undefined;
-    if (dirInParams != null && isTarballPath(dirInParams)) {
-        const tarballPath = dirInParams;
-        const publishedManifest = await extractPublishManifestFromPacked(tarballPath);
-        // Publishing a pre-built tarball bypasses `pack.api()`, so we don't have the file listing
-        // or unpacked size — those summary fields are reported as empty/zero.
-        const publishSummary = await publishPackedPkg({
-            tarballPath,
-            publishedManifest,
-            contents: [],
-            unpackedSize: 0,
-        }, opts);
-        return { exitCode: 0, publishSummary };
-    }
-    const dir = dirInParams ?? opts.dir ?? process.cwd();
-    const _runScriptsIfPresent = runScriptsIfPresent.bind(null, {
-        depPath: dir,
-        extraBinPaths: opts.extraBinPaths,
-        extraEnv: opts.extraEnv,
-        pkgRoot: dir,
-        rootModulesDir: await realpathMissing(path.join(dir, 'node_modules')),
-        stdio: 'inherit',
-        unsafePerm: true, // when running scripts explicitly, assume that they're trusted.
-        userAgent: opts.userAgent,
-    });
-    const { manifest } = await readProjectManifest(dir, opts);
-    // Unfortunately, we cannot support postpack at the moment
-    if (!opts.ignoreScripts) {
-        await _runScriptsIfPresent([
-            'prepublishOnly',
-            'prepublish',
-        ], manifest);
-    }
-    // We have to publish the tarball from another location.
-    // Otherwise, npm would publish the package with the package.json file
-    // from the current working directory, ignoring the package.json file
-    // that was generated and packed to the tarball.
-    const packDestination = temporaryDirectory();
-    let publishedManifest;
-    let publishSummary;
-    try {
-        const packResult = await pack.api({
-            ...opts,
-            dir,
-            packDestination,
-            dryRun: false,
-        });
-        publishSummary = await publishPackedPkg(packResult, opts);
-        publishedManifest = packResult.publishedManifest;
-    }
-    finally {
-        await rimraf(packDestination);
-    }
-    if (!opts.ignoreScripts) {
-        await _runScriptsIfPresent([
-            'publish',
-            'postpublish',
-        ], manifest);
-    }
-    return { manifest, publishedManifest, publishSummary };
-}
-export async function runScriptsIfPresent(opts, scriptNames, manifest) {
-    for (const scriptName of scriptNames) {
-        if (!manifest.scripts?.[scriptName])
-            continue;
-        await runLifecycleHook(scriptName, manifest, opts); // eslint-disable-line no-await-in-loop
-    }
-}
-//# sourceMappingURL=publish.js.map

package/lib/publish/publishPackedPkg.d.ts

@@ -1,79 +0,0 @@
-import type { Config } from '@pnpm/config.reader';
-import { PnpmError } from '@pnpm/error';
-import type { ExportedManifest } from '@pnpm/releasing.exportable-manifest';
-import { type RegistryConfig } from '@pnpm/types';
-import { type PublishSummary } from '../tarball/publishSummary.js';
-import { type OtpContext, type PublishOptionsWithDefaultAccess } from './otp.js';
-import type { PackResult } from './pack.js';
-import { type NormalizedRegistryUrl } from './registryConfigKeys.js';
-export type { PublishSummary };
-export type PublishPackedPkgOptions = Pick<Config, 'configByUri' | 'dryRun' | 'fetchRetries' | 'fetchRetryFactor' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'fetchTimeout' | 'registries' | 'tag' | 'userAgent'> & Partial<Pick<Config, 'ca' | 'cert' | 'httpProxy' | 'httpsProxy' | 'key' | 'localAddress' | 'noProxy' | 'strictSsl'>> & {
-    access?: 'public' | 'restricted';
-    ci?: boolean;
-    otp?: string;
-    provenance?: boolean;
-    provenanceFile?: string;
-    stage?: boolean;
-};
-export declare function publishPackedPkg(packResult: Pick<PackResult, 'publishedManifest' | 'tarballPath' | 'contents' | 'unpackedSize'>, opts: PublishPackedPkgOptions): Promise<PublishSummary>;
-/**
- * Builds the {@link OtpContext} used to drive the publish. The default fetch
- * is replaced by one that respects proxy / TLS / local-address settings, so
- * the `doneUrl` polling in the web-based authentication flow goes through
- * the same network configuration as the initial publish request (see
- * https://github.com/pnpm/pnpm/issues/11561).
- */
-export declare function createPublishContext(opts: PublishPackedPkgOptions): OtpContext;
-type StagePublishOptions = PublishOptionsWithDefaultAccess & {
-    command?: string;
-    stage?: boolean;
-};
-/**
- * Build the libnpmpublish / npm-registry-fetch options (registry, auth, headers) for publishing
- * {@link manifest}. When `oidc` is `false`, the per-package OIDC token exchange is skipped and only
- * statically configured credentials are used — batch publish sends many packages in one request,
- * which a package-scoped OIDC token cannot authorize.
- *
- * @internal Exported for unit testing of the access / registry / auth fallback rules and for batch
- *   publish. Not part of the package's public API.
- */
-export declare function createPublishOptions(manifest: ExportedManifest, options: PublishPackedPkgOptions, { oidc }?: {
-    oidc?: boolean;
-}): Promise<StagePublishOptions>;
-export declare function isPublishAccess(access: unknown): access is 'public' | 'restricted';
-interface RegistryInfo {
-    registry: NormalizedRegistryUrl;
-    config: RegistryConfig;
-}
-/**
- * Find credentials and SSL info for a package's registry.
- * Follows {@link https://docs.npmjs.com/cli/v10/configuring-npm/npmrc#auth-related-configuration}.
- *
- * The manifest's `publishConfig.registry`, when set, takes precedence over `registries`.
- *
- * @internal Exported for batch publish, which groups packages by their target registry.
- */
-export declare function findRegistryInfo({ name }: ExportedManifest, { configByUri, registries }: Pick<Config, 'configByUri' | 'registries'>, publishConfigRegistry?: string): Partial<RegistryInfo>;
-export declare class PublishUnsupportedRegistryProtocolError extends PnpmError {
-    readonly registryUrl: string;
-    constructor(registryUrl: string);
-}
-interface OidcTokenProvenanceResult {
-    authToken: string;
-    provenance?: boolean;
-}
-/**
- * Try fetching an authentication token and provenance by OpenID Connect.
- *
- * The result, when defined, is intended to take precedence over any statically configured
- * authentication. This mirrors the npm CLI's OIDC flow, which always attempts the exchange
- * in supported CI environments and overwrites a configured `_authToken` on success.
- *
- * @returns the OIDC-derived authToken (and provenance flag) on success, or `undefined` when
- *   OIDC is not applicable / not configured on the registry — in which case callers should
- *   fall back to whatever static authentication they already have.
- *
- * @internal Exported for unit testing of the precedence rules. Not part of the package's
- *   public API.
- */
-export declare function fetchTokenAndProvenanceByOidc(packageName: string, registry: string, options: PublishPackedPkgOptions): Promise<OidcTokenProvenanceResult | undefined>;

package/lib/publish/publishPackedPkg.js

@@ -1,298 +0,0 @@
-import fs from 'node:fs/promises';
-import { PnpmError, redactUrlCredentials } from '@pnpm/error';
-import { globalInfo, globalWarn } from '@pnpm/logger';
-import { createDispatchedFetch } from '@pnpm/network.fetch';
-import { DEFAULT_REGISTRY_SCOPE } from '@pnpm/types';
-import { createPublishSummary } from '../tarball/publishSummary.js';
-import { displayError } from './displayError.js';
-import { executeTokenHelper } from './executeTokenHelper.js';
-import { createFailedToPublishError } from './FailedToPublishError.js';
-import { AuthTokenError, fetchAuthToken } from './oidc/authToken.js';
-import { getIdToken, IdTokenError } from './oidc/idToken.js';
-import { determineProvenance, ProvenanceError } from './oidc/provenance.js';
-import { publishWithOtpHandling } from './otp.js';
-import { allRegistryConfigKeys, parseSupportedRegistryUrl } from './registryConfigKeys.js';
-import { SHARED_CONTEXT } from './utils/shared-context.js';
-export async function publishPackedPkg(packResult, opts) {
-    const { publishedManifest, tarballPath, contents, unpackedSize } = packResult;
-    const tarballData = await fs.readFile(tarballPath);
-    const publishOptions = await createPublishOptions(publishedManifest, opts);
-    const { name, version } = publishedManifest;
-    const { registry } = publishOptions;
-    const isStage = opts.stage === true;
-    // Redact any `user:pass@` credentials a registry= URL may carry so they don't leak into logs.
-    globalInfo(`📦 ${name}@${version} → ${registry != null ? redactUrlCredentials(registry) : 'the default registry'}`);
-    const summary = createPublishSummary({ publishedManifest, tarballPath, contents, unpackedSize }, tarballData);
-    if (opts.dryRun) {
-        globalWarn(`Skip ${isStage ? 'staging' : 'publishing'} ${name}@${version} (dry run)`);
-        return summary;
-    }
-    const context = createPublishContext(opts);
-    const response = await publishWithOtpHandling({
-        context,
-        manifest: publishedManifest,
-        publishOptions,
-        tarballData,
-    });
-    if (response.ok) {
-        if (isStage && response.stageId) {
-            summary.stageId = response.stageId;
-        }
-        globalInfo(`✅ ${isStage ? 'Staged' : 'Published'} package ${name}@${version}`);
-        return summary;
-    }
-    throw await createFailedToPublishError(packResult, response);
-}
-/**
- * Builds the {@link OtpContext} used to drive the publish. The default fetch
- * is replaced by one that respects proxy / TLS / local-address settings, so
- * the `doneUrl` polling in the web-based authentication flow goes through
- * the same network configuration as the initial publish request (see
- * https://github.com/pnpm/pnpm/issues/11561).
- */
-export function createPublishContext(opts) {
-    return {
-        ...SHARED_CONTEXT,
-        fetch: createDispatchedFetch({ ...opts, timeout: opts.fetchTimeout }),
-    };
-}
-/**
- * Build the libnpmpublish / npm-registry-fetch options (registry, auth, headers) for publishing
- * {@link manifest}. When `oidc` is `false`, the per-package OIDC token exchange is skipped and only
- * statically configured credentials are used — batch publish sends many packages in one request,
- * which a package-scoped OIDC token cannot authorize.
- *
- * @internal Exported for unit testing of the access / registry / auth fallback rules and for batch
- *   publish. Not part of the package's public API.
- */
-export async function createPublishOptions(manifest, options, { oidc = true } = {}) {
-    const publishConfigRegistry = typeof manifest.publishConfig?.registry === 'string'
-        ? manifest.publishConfig.registry
-        : undefined;
-    const { registry, config } = findRegistryInfo(manifest, options, publishConfigRegistry);
-    const tls = config?.tls;
-    const creds = config?.[DEFAULT_REGISTRY_SCOPE];
-    const publishConfigAccess = manifest.publishConfig?.access;
-    const access = options.access ?? (isPublishAccess(publishConfigAccess) ? publishConfigAccess : null);
-    const { ci: isFromCI, fetchRetries, fetchRetryFactor, fetchRetryMaxtimeout, fetchRetryMintimeout, fetchTimeout: timeout, otp, provenance, provenanceFile, tag: defaultTag, userAgent, } = options;
-    const npmCommand = options.stage === true ? 'stage' : 'publish';
-    const headers = {
-        'npm-auth-type': 'web',
-        'npm-command': npmCommand,
-    };
-    const publishOptions = {
-        access,
-        defaultTag,
-        fetchRetries,
-        fetchRetryFactor,
-        fetchRetryMaxtimeout,
-        fetchRetryMintimeout,
-        headers,
-        isFromCI,
-        otp,
-        timeout,
-        provenance,
-        provenanceFile,
-        registry,
-        strictSSL: options.strictSsl, // npm-registry-fetch defaults to true; must be set explicitly to honour strictSsl: false
-        userAgent,
-        // Signal to the registry that the client supports web-based authentication.
-        // Without this, the registry would never offer the web auth flow and would
-        // always fall back to prompting the user for an OTP code, even when the user
-        // has no OTP set up.
-        authType: 'web',
-        ca: tls?.ca,
-        cert: tls?.cert,
-        key: tls?.key,
-        npmCommand,
-        token: creds && extractToken(creds),
-        username: creds?.basicAuth?.username,
-        password: creds?.basicAuth?.password,
-    };
-    if (options.stage === true) {
-        publishOptions.command = 'stage';
-        publishOptions.stage = true;
-    }
-    if (registry) {
-        if (oidc) {
-            // OIDC takes precedence over a configured static `_authToken`, mirroring the npm CLI's
-            // behavior (see https://github.com/npm/cli/blob/7d900c46/lib/utils/oidc.js). Trusted
-            // publishing wins whenever the registry has it configured for the package; the static
-            // token is used only as a fallback when OIDC is not applicable.
-            const oidcTokenProvenance = await fetchTokenAndProvenanceByOidc(manifest.name, registry, options);
-            if (oidcTokenProvenance?.authToken) {
-                publishOptions.token = oidcTokenProvenance.authToken;
-            }
-            publishOptions.provenance ??= oidcTokenProvenance?.provenance;
-        }
-        appendAuthOptionsForRegistry(publishOptions, registry);
-    }
-    pruneUndefined(publishOptions);
-    return publishOptions;
-}
-export function isPublishAccess(access) {
-    return access === 'public' || access === 'restricted';
-}
-/**
- * Find credentials and SSL info for a package's registry.
- * Follows {@link https://docs.npmjs.com/cli/v10/configuring-npm/npmrc#auth-related-configuration}.
- *
- * The manifest's `publishConfig.registry`, when set, takes precedence over `registries`.
- *
- * @internal Exported for batch publish, which groups packages by their target registry.
- */
-export function findRegistryInfo({ name }, { configByUri, registries }, publishConfigRegistry) {
-    // eslint-disable-next-line regexp/no-unused-capturing-group
-    const scopedMatches = /@(?<scope>[^/]+)\/(?<slug>[^/]+)/.exec(name);
-    const registryName = scopedMatches?.groups ? `@${scopedMatches.groups.scope}` : 'default';
-    const nonNormalizedRegistry = publishConfigRegistry ?? registries[registryName] ?? registries.default;
-    const supportedRegistryInfo = parseSupportedRegistryUrl(nonNormalizedRegistry);
-    if (!supportedRegistryInfo) {
-        throw new PublishUnsupportedRegistryProtocolError(nonNormalizedRegistry);
-    }
-    const { normalizedUrl: registry, longestConfigKey: initialRegistryConfigKey, } = supportedRegistryInfo;
-    const credsScope = registryName === 'default' ? DEFAULT_REGISTRY_SCOPE : registryName;
-    let creds;
-    let tls = {};
-    for (const registryConfigKey of allRegistryConfigKeys(initialRegistryConfigKey)) {
-        const entry = configByUri[registryConfigKey];
-        if (!entry)
-            continue;
-        // Auth from longer path collectively overrides shorter path
-        creds ??= entry[credsScope] ?? entry[DEFAULT_REGISTRY_SCOPE];
-        // TLS from longer path individually overrides shorter path
-        tls = { ...entry.tls, ...tls };
-    }
-    const config = { tls };
-    if (creds) {
-        config[DEFAULT_REGISTRY_SCOPE] = creds;
-    }
-    return {
-        registry,
-        config,
-    };
-}
-function extractToken({ authToken, tokenHelper, }) {
-    if (authToken)
-        return authToken;
-    if (tokenHelper) {
-        return executeTokenHelper(tokenHelper, { globalWarn });
-    }
-    return undefined;
-}
-export class PublishUnsupportedRegistryProtocolError extends PnpmError {
-    registryUrl;
-    constructor(registryUrl) {
-        super('PUBLISH_UNSUPPORTED_REGISTRY_PROTOCOL', `Registry ${registryUrl} has an unsupported protocol`, {
-            hint: '`pnpm publish` only supports HTTP and HTTPS registries',
-        });
-        this.registryUrl = registryUrl;
-    }
-}
-/**
- * Try fetching an authentication token and provenance by OpenID Connect.
- *
- * The result, when defined, is intended to take precedence over any statically configured
- * authentication. This mirrors the npm CLI's OIDC flow, which always attempts the exchange
- * in supported CI environments and overwrites a configured `_authToken` on success.
- *
- * @returns the OIDC-derived authToken (and provenance flag) on success, or `undefined` when
- *   OIDC is not applicable / not configured on the registry — in which case callers should
- *   fall back to whatever static authentication they already have.
- *
- * @internal Exported for unit testing of the precedence rules. Not part of the package's
- *   public API.
- */
-export async function fetchTokenAndProvenanceByOidc(packageName, registry, options) {
-    let idToken;
-    try {
-        idToken = await getIdToken({
-            options,
-            registry,
-        });
-    }
-    catch (error) {
-        if (error instanceof IdTokenError) {
-            globalWarn(`Skipped OIDC: ${displayError(error)}`);
-            return undefined;
-        }
-        throw error;
-    }
-    if (!idToken) {
-        // OIDC is simply not applicable here — either we're outside of CI, or we're in a CI
-        // that doesn't natively drive OIDC and the user hasn't forwarded a token via
-        // `NPM_ID_TOKEN`. This is the common case for local publishes, so it must stay
-        // silent — only configuration *errors* in a supported CI environment surface as
-        // warnings, and those come back as `IdTokenError` and are handled above.
-        return undefined;
-    }
-    let authToken;
-    try {
-        authToken = await fetchAuthToken({
-            idToken,
-            options,
-            packageName,
-            registry,
-        });
-    }
-    catch (error) {
-        if (error instanceof AuthTokenError) {
-            globalWarn(`Skipped OIDC: ${displayError(error)}`);
-            return undefined;
-        }
-        throw error;
-    }
-    if (options.provenance != null) {
-        return {
-            authToken,
-            provenance: options.provenance,
-        };
-    }
-    let provenance;
-    try {
-        provenance = await determineProvenance({
-            authToken,
-            idToken,
-            options,
-            packageName,
-            registry,
-        });
-    }
-    catch (error) {
-        if (error instanceof ProvenanceError) {
-            // Don't lose the OIDC-derived authToken just because we couldn't determine the
-            // provenance flag — the publish itself can still go through, and that's what
-            // the npm CLI does too.
-            globalWarn(`Skipped setting provenance: ${displayError(error)}`);
-            return { authToken };
-        }
-        throw error;
-    }
-    return { authToken, provenance };
-}
-/**
- * Appends authentication information to {@link targetPublishOptions} to explicitly target {@link registry}.
- *
- * `libnpmpublish` has a quirk in which it only read the authentication information from `//<registry>:_authToken`
- * instead of `token`.
- * This function fixes that by making sure the registry specific authentication information exists.
- */
-function appendAuthOptionsForRegistry(targetPublishOptions, registry) {
-    const registryInfo = parseSupportedRegistryUrl(registry);
-    if (!registryInfo) {
-        globalWarn(`The registry ${registry} cannot be converted into a config key. Supplement is skipped. Subsequent libnpmpublish call may fail.`);
-        return;
-    }
-    const registryConfigKey = registryInfo.longestConfigKey;
-    targetPublishOptions[`${registryConfigKey}:_authToken`] ??= targetPublishOptions.token;
-    targetPublishOptions[`${registryConfigKey}:username`] ??= targetPublishOptions.username;
-    targetPublishOptions[`${registryConfigKey}:_password`] ??= targetPublishOptions.password && btoa(targetPublishOptions.password);
-}
-function pruneUndefined(object) {
-    for (const key in object) {
-        if (object[key] === undefined) {
-            delete object[key];
-        }
-    }
-}
-//# sourceMappingURL=publishPackedPkg.js.map

package/lib/publish/recursivePublish.d.ts

@@ -1,18 +0,0 @@
-import type { Config, ConfigContext } from '@pnpm/config.reader';
-import type { PublishPackedPkgOptions, PublishSummary } from './publishPackedPkg.js';
-export type PublishRecursiveOpts = Required<Pick<Config, 'bin' | 'cacheDir' | 'dir' | 'pnpmHomeDir' | 'configByUri' | 'registries' | 'workspaceDir'>> & Required<Pick<ConfigContext, 'cliOptions'>> & Partial<Pick<Config, 'tag' | 'ca' | 'catalogs' | 'cert' | 'fetchTimeout' | 'force' | 'dryRun' | 'extraBinPaths' | 'extraEnv' | 'fetchRetries' | 'fetchRetryFactor' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'key' | 'httpProxy' | 'httpsProxy' | 'localAddress' | 'lockfileDir' | 'noProxy' | 'npmPath' | 'offline' | 'strictSsl' | 'unsafePerm' | 'userAgent' | 'verifyStoreIntegrity' | 'versioning'>> & Partial<Pick<ConfigContext, 'selectedProjectsGraph' | 'allProjectsGraph' | 'prodAllProjectsGraph' | 'prodOnlySelectedProjectDirs'>> & {
-    access?: 'public' | 'restricted';
-    argv: {
-        original: string[];
-    };
-    batch?: boolean;
-    reportSummary?: boolean;
-} & PublishPackedPkgOptions;
-export type RecursivePublishedPackage = PublishSummary | {
-    name?: string;
-    version?: string;
-};
-export declare function recursivePublish(opts: PublishRecursiveOpts & Required<Pick<ConfigContext, 'selectedProjectsGraph'>>): Promise<{
-    exitCode: number;
-    publishedPackages: RecursivePublishedPackage[];
-}>;