@pnpm/releasing.commands 1100.7.0 → 1100.7.1

package/lib/publish/batchPublish.js

@@ -0,0 +1,201 @@
+import { createHash } from 'node:crypto';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { PnpmError } from '@pnpm/error';
+import { globalInfo, globalWarn } from '@pnpm/logger';
+import { withOtpHandling } from '@pnpm/network.web-auth';
+import { rimraf } from '@zkochan/rimraf';
+import npmFetch from 'npm-registry-fetch';
+import { realpathMissing } from 'realpath-missing';
+import semver from 'semver';
+import { temporaryDirectory } from 'tempy';
+import { createPublishSummary } from '../tarball/publishSummary.js';
+import * as pack from './pack.js';
+import { runScriptsIfPresent } from './publish.js';
+import { createPublishContext, createPublishOptions, findRegistryInfo, isPublishAccess, } from './publishPackedPkg.js';
+export const BATCH_PUBLISH_ENDPOINT = '/-/pnpm/v1/publish';
+/**
+ * Publish all {@link pkgs} by sending a single `PUT /-/pnpm/v1/publish` request per target
+ * registry, instead of one request per package. The endpoint is not part of the standard npm
+ * registry API — the registry has to implement it explicitly (pnpr does), so this whole code
+ * path is opt-in via the `--batch` flag.
+ *
+ * Every package is packed (and its `prepublishOnly`/`prepublish` scripts run) before anything
+ * is sent, so a package that fails to pack aborts the publish before any package reaches the
+ * registry. The `publish`/`postpublish` scripts run only after the requests succeeded.
+ *
+ * @param pkgs packages to publish, already filtered (no private packages, no already-published
+ *   versions) and in dependency order.
+ */
+export async function batchPublishPackages(pkgs, opts) {
+    if (opts.stage) {
+        throw new PnpmError('BATCH_PUBLISH_NO_STAGE', 'Staged publishing cannot be combined with --batch');
+    }
+    if (opts.provenance) {
+        throw new PnpmError('BATCH_PUBLISH_NO_PROVENANCE', 'Provenance statements cannot be generated when publishing with --batch', {
+            hint: 'Provenance is bound to a single package, but --batch sends many packages in one request. Publish without --batch to attach provenance.',
+        });
+    }
+    const packedByRegistry = new Map();
+    const packedPkgs = [];
+    for (const project of pkgs) {
+        // eslint-disable-next-line no-await-in-loop
+        const packedPkg = await packPkgForBatch(project, opts);
+        const publishConfigRegistry = typeof packedPkg.publishedManifest.publishConfig?.registry === 'string'
+            ? packedPkg.publishedManifest.publishConfig.registry
+            : undefined;
+        const { registry } = findRegistryInfo(packedPkg.publishedManifest, opts, publishConfigRegistry);
+        let group = packedByRegistry.get(registry);
+        if (!group) {
+            group = [];
+            packedByRegistry.set(registry, group);
+        }
+        group.push(packedPkg);
+        packedPkgs.push(packedPkg);
+    }
+    for (const [registry, group] of packedByRegistry.entries()) {
+        for (const { summary } of group) {
+            globalInfo(`📦 ${summary.id} → ${registry}`);
+        }
+        if (opts.dryRun) {
+            globalWarn(`Skip publishing ${group.length} package(s) to ${registry} (dry run)`);
+            continue;
+        }
+        // eslint-disable-next-line no-await-in-loop
+        await multiPublishToRegistry(registry, group, opts);
+        globalInfo(`✅ Published ${group.length} package(s) to ${registry} in a single request`);
+    }
+    if (!opts.ignoreScripts) {
+        for (const { project } of packedPkgs) {
+            // eslint-disable-next-line no-await-in-loop
+            await runScriptsIfPresent(await lifecycleOpts(project.rootDir, opts), ['publish', 'postpublish'], project.manifest);
+        }
+    }
+    return packedPkgs.map(({ summary }) => summary);
+}
+async function packPkgForBatch(project, opts) {
+    if (!opts.ignoreScripts) {
+        await runScriptsIfPresent(await lifecycleOpts(project.rootDir, opts), ['prepublishOnly', 'prepublish'], project.manifest);
+    }
+    // The tarball is packed into a temporary directory and read into memory right away — the
+    // request body carries it base64-encoded, so nothing needs to stay on disk.
+    const packDestination = temporaryDirectory();
+    try {
+        const packResult = await pack.api({
+            ...opts,
+            dir: project.rootDir,
+            packDestination,
+            dryRun: false,
+        });
+        const tarballData = await fs.readFile(packResult.tarballPath);
+        return {
+            project,
+            publishedManifest: packResult.publishedManifest,
+            tarballData,
+            summary: createPublishSummary(packResult, tarballData),
+        };
+    }
+    finally {
+        await rimraf(packDestination);
+    }
+}
+async function lifecycleOpts(pkgRoot, opts) {
+    return {
+        depPath: pkgRoot,
+        extraBinPaths: opts.extraBinPaths,
+        extraEnv: opts.extraEnv,
+        pkgRoot,
+        rootModulesDir: await realpathMissing(path.join(pkgRoot, 'node_modules')),
+        stdio: 'inherit',
+        unsafePerm: true, // when running scripts explicitly, assume that they're trusted.
+        userAgent: opts.userAgent,
+    };
+}
+async function multiPublishToRegistry(registry, group, opts) {
+    // A package-scoped OIDC token cannot authorize a request that publishes many packages, so the
+    // OIDC exchange is skipped and only statically configured credentials are used.
+    const publishOptions = await createPublishOptions(group[0].publishedManifest, opts, { oidc: false });
+    const body = {
+        packages: group.map((packedPkg) => createPublishDocument(packedPkg, registry, opts)),
+    };
+    const fetchOptions = {
+        method: 'GET',
+        retry: {
+            factor: opts.fetchRetryFactor,
+            maxTimeout: opts.fetchRetryMaxtimeout,
+            minTimeout: opts.fetchRetryMintimeout,
+            retries: opts.fetchRetries,
+        },
+        timeout: opts.fetchTimeout,
+    };
+    try {
+        await withOtpHandling({
+            context: createPublishContext(opts),
+            fetchOptions,
+            operation: async (otp) => npmFetch(BATCH_PUBLISH_ENDPOINT, {
+                ...publishOptions,
+                access: publishOptions.access ?? undefined,
+                otp: otp ?? publishOptions.otp,
+                method: 'PUT',
+                body,
+                ignoreBody: true,
+            }),
+        });
+    }
+    catch (err) {
+        const statusCode = err.statusCode;
+        if (statusCode === 404 || statusCode === 405) {
+            throw new PnpmError('BATCH_PUBLISH_UNSUPPORTED', `The registry at ${registry} does not support publishing multiple packages in a single request`, {
+                hint: `Retry without the --batch flag, or publish to a registry that implements "PUT ${BATCH_PUBLISH_ENDPOINT}" (for example, pnpr).`,
+            });
+        }
+        throw err;
+    }
+}
+/**
+ * Build the npm publish document for one package — the same JSON body `libnpmpublish` would
+ * send as the whole `PUT /:pkg` request. The batch publish request body is an array of these,
+ * which lets the registry reuse its single-package publish pipeline per entry.
+ */
+function createPublishDocument({ publishedManifest, tarballData }, registry, opts) {
+    const name = publishedManifest.name;
+    const version = semver.clean(publishedManifest.version);
+    if (!version) {
+        throw new PnpmError('BAD_SEMVER', `Invalid semver: ${publishedManifest.version}`);
+    }
+    const publishConfigAccess = publishedManifest.publishConfig?.access;
+    const access = opts.access ?? (isPublishAccess(publishConfigAccess) ? publishConfigAccess : null);
+    if (!name.startsWith('@') && access === 'restricted') {
+        throw new PnpmError('UNSCOPED_RESTRICTED', `Can't restrict access to the unscoped package ${name}`);
+    }
+    const tarballName = `${name}-${version}.tgz`;
+    const manifest = {
+        ...publishedManifest,
+        _id: `${name}@${version}`,
+        version,
+        _nodeVersion: process.versions.node,
+        dist: {
+            integrity: `sha512-${createHash('sha512').update(tarballData).digest('base64')}`,
+            shasum: createHash('sha1').update(tarballData).digest('hex'),
+            // libnpmpublish stores an http:// URL on purpose (clients fetch via HTTPS regardless when
+            // the registry is HTTPS); keep the wire format identical to a single-package publish.
+            tarball: new URL(`${name}/-/${tarballName}`, registry).href.replace(/^https:\/\//, 'http://'),
+        },
+    };
+    return {
+        _id: name,
+        name,
+        description: publishedManifest.description,
+        'dist-tags': { [opts.tag ?? 'latest']: version },
+        versions: { [version]: manifest },
+        access,
+        _attachments: {
+            [tarballName]: {
+                content_type: 'application/octet-stream',
+                data: tarballData.toString('base64'),
+                length: tarballData.length,
+            },
+        },
+    };
+}
+//# sourceMappingURL=batchPublish.js.map

package/lib/publish/displayError.d.ts

@@ -0,0 +1 @@
+export declare function displayError(error: unknown): string;

package/lib/publish/displayError.js

@@ -0,0 +1,23 @@
+export function displayError(error) {
+    if (typeof error !== 'object' || !error)
+        return JSON.stringify(error);
+    let code;
+    let body;
+    if ('code' in error && typeof error.code === 'string') {
+        code = error.code;
+    }
+    else if ('name' in error && typeof error.name === 'string') {
+        code = error.name;
+    }
+    if ('message' in error && typeof error.message === 'string') {
+        body = error.message;
+    }
+    if (code && body)
+        return `${code}: ${body}`;
+    if (code)
+        return code;
+    if (body)
+        return body;
+    return JSON.stringify(error);
+}
+//# sourceMappingURL=displayError.js.map

package/lib/publish/executeTokenHelper.d.ts

@@ -0,0 +1,4 @@
+export interface ExecuteTokenHelperOptions {
+    globalWarn: (message: string) => void;
+}
+export declare function executeTokenHelper([cmd, ...args]: [string, ...string[]], opts: ExecuteTokenHelperOptions): string;

package/lib/publish/executeTokenHelper.js

@@ -0,0 +1,17 @@
+import { sync as execa } from 'execa';
+export function executeTokenHelper([cmd, ...args], opts) {
+    const execResult = execa(cmd, args, {
+        stdio: 'pipe',
+    });
+    const stderr = execResult.stderr?.toString() ?? '';
+    if (stderr.trim()) {
+        for (const line of stderr.trimEnd().split('\n')) {
+            opts.globalWarn(`(tokenHelper stderr) ${line}`);
+        }
+    }
+    const token = (execResult.stdout?.toString() ?? '').trim();
+    // If the token helper output includes an auth scheme prefix (e.g. "Bearer ..."),
+    // strip it since libnpmpublish adds the scheme itself.
+    return token.replace(/^Bearer\s+/i, '');
+}
+//# sourceMappingURL=executeTokenHelper.js.map

package/lib/publish/extractManifestFromPacked.d.ts

@@ -0,0 +1,19 @@
+import { PnpmError } from '@pnpm/error';
+import type { ExportedManifest } from '@pnpm/releasing.exportable-manifest';
+declare const TARBALL_SUFFIXES: readonly ['.tar.gz', '.tgz'];
+export type TarballSuffix = typeof TARBALL_SUFFIXES[number];
+export type TarballPath = `${string}${TarballSuffix}`;
+export declare const isTarballPath: (path: string) => path is TarballPath;
+export declare function extractManifestFromPacked<Output = ExportedManifest>(tarballPath: TarballPath): Promise<Output>;
+/**
+ * Read the publish manifest from a pre-built tarball, filling in its `readme` from the tarball's
+ * root README file when the manifest doesn't already declare one. This mirrors the npm CLI, which
+ * reads the readme out of the tarball (via pacote's `fullReadJson`) so the registry gets it as
+ * metadata even though it isn't stored in the packed `package.json`.
+ */
+export declare function extractPublishManifestFromPacked(tarballPath: TarballPath): Promise<ExportedManifest>;
+export declare class PublishArchiveMissingManifestError extends PnpmError {
+    readonly tarballPath: string;
+    constructor(tarballPath: string);
+}
+export {};

package/lib/publish/extractManifestFromPacked.js

@@ -0,0 +1,110 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { createGunzip } from 'node:zlib';
+import { PnpmError } from '@pnpm/error';
+import tar from 'tar-stream';
+const TARBALL_SUFFIXES = ['.tar.gz', '.tgz'];
+export const isTarballPath = (path) => TARBALL_SUFFIXES.some(suffix => path.endsWith(suffix));
+export async function extractManifestFromPacked(tarballPath) {
+    const { manifest } = await extractEntriesFromPacked(tarballPath, false);
+    return JSON.parse(manifest);
+}
+/**
+ * Read the publish manifest from a pre-built tarball, filling in its `readme` from the tarball's
+ * root README file when the manifest doesn't already declare one. This mirrors the npm CLI, which
+ * reads the readme out of the tarball (via pacote's `fullReadJson`) so the registry gets it as
+ * metadata even though it isn't stored in the packed `package.json`.
+ */
+export async function extractPublishManifestFromPacked(tarballPath) {
+    const { manifest, readme } = await extractEntriesFromPacked(tarballPath, true);
+    const parsed = JSON.parse(manifest);
+    if (parsed.readme == null && readme != null) {
+        parsed.readme = readme;
+    }
+    return parsed;
+}
+/**
+ * Scan the tarball for `package/package.json` and, when `wantReadme` is set, the root
+ * `README.md`. The manifest-only path (`wantReadme` false) resolves as soon as the manifest
+ * entry is read and stops decompressing the rest of the archive; the publish path scans on
+ * because a README can appear after the manifest.
+ */
+async function extractEntriesFromPacked(tarballPath, wantReadme) {
+    const extract = tar.extract();
+    const gunzip = createGunzip();
+    const tarballStream = fs.createReadStream(tarballPath);
+    let cleanedUp = false;
+    function cleanup() {
+        if (cleanedUp)
+            return;
+        cleanedUp = true;
+        extract.destroy();
+        gunzip.destroy();
+        tarballStream.destroy();
+    }
+    const promise = new Promise((resolve, reject) => {
+        let settled = false;
+        let manifest;
+        let readme;
+        function handleError(error) {
+            cleanup();
+            reject(error);
+        }
+        function settle() {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            if (manifest == null) {
+                reject(new PublishArchiveMissingManifestError(tarballPath));
+                return;
+            }
+            resolve({ manifest, readme });
+        }
+        tarballStream.once('error', handleError);
+        gunzip.once('error', handleError);
+        extract.on('entry', (header, stream, next) => {
+            const normalizedPath = path.normalize(header.name).replaceAll('\\', '/');
+            const isManifest = normalizedPath === 'package/package.json';
+            const isReadme = wantReadme && /^package\/readme\.md$/i.test(normalizedPath);
+            if (!isManifest && !isReadme) {
+                stream.once('end', next);
+                stream.resume();
+                return;
+            }
+            const chunks = [];
+            stream.on('data', (chunk) => {
+                chunks.push(chunk);
+            });
+            stream.once('end', () => {
+                const text = Buffer.concat(chunks).toString();
+                if (isManifest) {
+                    manifest = text;
+                }
+                else {
+                    readme = text;
+                }
+                // Stop early once every wanted entry has been captured, so the manifest-only
+                // path doesn't stream and decompress the remainder of the tarball.
+                if (manifest != null && (!wantReadme || readme != null)) {
+                    settle();
+                    return;
+                }
+                next();
+            });
+            stream.once('error', handleError);
+        });
+        extract.once('finish', settle);
+        extract.once('error', handleError);
+    });
+    tarballStream.pipe(gunzip).pipe(extract);
+    return promise;
+}
+export class PublishArchiveMissingManifestError extends PnpmError {
+    tarballPath;
+    constructor(tarballPath) {
+        super('PUBLISH_ARCHIVE_MISSING_MANIFEST', `The archive ${tarballPath} does not contain package/package.json`);
+        this.tarballPath = tarballPath;
+    }
+}
+//# sourceMappingURL=extractManifestFromPacked.js.map

package/lib/publish/index.d.ts

@@ -0,0 +1,3 @@
+import * as pack from './pack.js';
+import * as publish from './publish.js';
+export { pack, publish };

package/lib/publish/index.js

@@ -0,0 +1,4 @@
+import * as pack from './pack.js';
+import * as publish from './publish.js';
+export { pack, publish };
+//# sourceMappingURL=index.js.map

package/lib/publish/oidc/authToken.d.ts

@@ -0,0 +1,73 @@
+import { PnpmError } from '@pnpm/error';
+import type { PublishPackedPkgOptions } from '../publishPackedPkg.js';
+export interface AuthTokenFetchOptions {
+    body?: '';
+    headers: {
+        Accept: 'application/json';
+        Authorization: `Bearer ${string}`;
+        'Content-Length': '0';
+    };
+    method?: 'POST';
+    retry?: {
+        factor?: number;
+        maxTimeout?: number;
+        minTimeout?: number;
+        randomize?: boolean;
+        retries?: number;
+    };
+    timeout?: number;
+}
+export interface AuthTokenFetchResponse {
+    readonly json: (this: this) => Promise<unknown>;
+    readonly ok: boolean;
+    readonly status: number;
+}
+export interface AuthTokenContext {
+    fetch: (url: string, options: AuthTokenFetchOptions) => Promise<AuthTokenFetchResponse>;
+}
+export type AuthTokenOptions = Pick<PublishPackedPkgOptions, 'fetchRetries' | 'fetchRetryFactor' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'fetchTimeout'>;
+export interface AuthTokenParams {
+    context?: AuthTokenContext;
+    idToken: string;
+    options?: AuthTokenOptions;
+    packageName: string;
+    registry: string;
+}
+/**
+ * Retrieve an `authToken` from the registry.
+ *
+ * @throws instances of subclasses of {@link AuthTokenError} which can be converted into warnings and skipped.
+ *
+ * @see https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect for GitHub Actions OIDC.
+ * @see https://api-docs.npmjs.com/#tag/OIDC/operation/exchangeOidcToken for NPM Registry OIDC.
+ * @see https://github.com/npm/cli/blob/7d900c46/lib/utils/oidc.js#L112-L142 for npm's implementation.
+ * @see https://github.com/yarnpkg/berry/blob/bafbef55/packages/plugin-npm/sources/npmHttpUtils.ts#L626-L641 for yarn's implementation.
+ */
+export declare function fetchAuthToken({ context: { fetch, }, options, idToken, packageName, registry, }: AuthTokenParams): Promise<string>;
+export declare abstract class AuthTokenError extends PnpmError {
+}
+export declare class AuthTokenFetchError extends AuthTokenError {
+    readonly errorSource: unknown;
+    readonly packageName: string;
+    readonly registry: string;
+    constructor(error: unknown, packageName: string, registry: string);
+}
+export declare class AuthTokenExchangeError extends AuthTokenError {
+    readonly errorResponse?: {
+        body?: {
+            message?: string;
+        };
+    };
+    readonly httpStatus: number;
+    constructor(errorResponse: AuthTokenExchangeError['errorResponse'], httpStatus: number);
+}
+export declare class AuthTokenJsonInterruptedError extends AuthTokenError {
+    readonly errorSource: unknown;
+    constructor(error: unknown);
+}
+export declare class AuthTokenMalformedJsonError extends AuthTokenError {
+    readonly malformedJsonResponse: unknown;
+    readonly packageName: string;
+    readonly registry: string;
+    constructor(malformedJsonResponse: unknown, packageName: string, registry: string);
+}

package/lib/publish/oidc/authToken.js

@@ -0,0 +1,97 @@
+import { PnpmError, redactUrlCredentials } from '@pnpm/error';
+import npa from '@pnpm/npm-package-arg';
+import { displayError } from '../displayError.js';
+import { SHARED_CONTEXT } from '../utils/shared-context.js';
+/**
+ * Retrieve an `authToken` from the registry.
+ *
+ * @throws instances of subclasses of {@link AuthTokenError} which can be converted into warnings and skipped.
+ *
+ * @see https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect for GitHub Actions OIDC.
+ * @see https://api-docs.npmjs.com/#tag/OIDC/operation/exchangeOidcToken for NPM Registry OIDC.
+ * @see https://github.com/npm/cli/blob/7d900c46/lib/utils/oidc.js#L112-L142 for npm's implementation.
+ * @see https://github.com/yarnpkg/berry/blob/bafbef55/packages/plugin-npm/sources/npmHttpUtils.ts#L626-L641 for yarn's implementation.
+ */
+export async function fetchAuthToken({ context: { fetch, } = SHARED_CONTEXT, options, idToken, packageName, registry, }) {
+    let response;
+    try {
+        response = await fetch(new URL(`/-/npm/v1/oidc/token/exchange/package/${npa(packageName).escapedName}`, registry).href, {
+            body: '',
+            headers: {
+                Accept: 'application/json',
+                Authorization: `Bearer ${idToken}`,
+                'Content-Length': '0',
+            },
+            method: 'POST',
+            retry: {
+                factor: options?.fetchRetryFactor,
+                maxTimeout: options?.fetchRetryMaxtimeout,
+                minTimeout: options?.fetchRetryMintimeout,
+                retries: options?.fetchRetries,
+            },
+            timeout: options?.fetchTimeout,
+        });
+    }
+    catch (error) {
+        throw new AuthTokenFetchError(error, packageName, registry);
+    }
+    if (!response.ok) {
+        const error = await response.json().catch(() => undefined);
+        throw new AuthTokenExchangeError(error, response.status);
+    }
+    let json;
+    try {
+        json = await response.json();
+    }
+    catch (error) {
+        throw new AuthTokenJsonInterruptedError(error);
+    }
+    if (!json || typeof json !== 'object' || !('token' in json) || typeof json.token !== 'string') {
+        throw new AuthTokenMalformedJsonError(json, packageName, registry);
+    }
+    return json.token;
+}
+export class AuthTokenError extends PnpmError {
+}
+export class AuthTokenFetchError extends AuthTokenError {
+    errorSource;
+    packageName;
+    registry;
+    constructor(error, packageName, registry) {
+        const redactedRegistry = redactUrlCredentials(registry);
+        super('AUTH_TOKEN_FETCH', `Failed to fetch authToken for package ${packageName} from registry ${redactedRegistry}: ${displayError(error)}`);
+        this.errorSource = error;
+        this.packageName = packageName;
+        this.registry = redactedRegistry;
+    }
+}
+export class AuthTokenExchangeError extends AuthTokenError {
+    errorResponse;
+    httpStatus;
+    constructor(errorResponse, httpStatus) {
+        const message = errorResponse?.body?.message ?? 'Unknown error';
+        super('AUTH_TOKEN_EXCHANGE', `Failed token exchange request with body message: ${message} (status code ${httpStatus})`);
+        this.errorResponse = errorResponse;
+        this.httpStatus = httpStatus;
+    }
+}
+export class AuthTokenJsonInterruptedError extends AuthTokenError {
+    errorSource;
+    constructor(error) {
+        super('AUTH_TOKEN_JSON_INTERRUPTED', `Fetching of authToken JSON interrupted: ${displayError(error)}`);
+        this.errorSource = error;
+    }
+}
+export class AuthTokenMalformedJsonError extends AuthTokenError {
+    malformedJsonResponse;
+    packageName;
+    registry;
+    constructor(malformedJsonResponse, packageName, registry) {
+        const redactedRegistry = redactUrlCredentials(registry);
+        super('AUTH_TOKEN_MALFORMED_JSON', `Failed to fetch authToken for package ${packageName} from registry ${redactedRegistry} due to malformed JSON response`);
+        this.malformedJsonResponse = malformedJsonResponse;
+        this.packageName = packageName;
+        this.registry = redactedRegistry;
+    }
+}
+//# sourceMappingURL=authToken.js.map

package/lib/publish/oidc/idToken.d.ts

@@ -0,0 +1,76 @@
+import { PnpmError } from '@pnpm/error';
+import type { PublishPackedPkgOptions } from '../publishPackedPkg.js';
+export interface IdTokenDate {
+    now: (this: this) => number;
+}
+export interface IdTokenCIInfo {
+    GITHUB_ACTIONS?: boolean;
+    GITLAB?: boolean;
+}
+export interface IdTokenEnv extends NodeJS.ProcessEnv {
+    ACTIONS_ID_TOKEN_REQUEST_TOKEN?: string;
+    ACTIONS_ID_TOKEN_REQUEST_URL?: string;
+    NPM_ID_TOKEN?: string;
+}
+export interface IdTokenFetchOptions {
+    body?: null;
+    headers: {
+        Accept: 'application/json';
+        Authorization: `Bearer ${string}`;
+    };
+    method?: 'GET';
+    retry?: {
+        factor?: number;
+        maxTimeout?: number;
+        minTimeout?: number;
+        randomize?: boolean;
+        retries?: number;
+    };
+    timeout?: number;
+}
+export interface IdTokenFetchResponse {
+    readonly json: (this: this) => Promise<unknown>;
+    readonly ok: boolean;
+    readonly status: number;
+}
+export interface IdTokenContext {
+    Date: IdTokenDate;
+    ciInfo: IdTokenCIInfo;
+    fetch: (url: string, options: IdTokenFetchOptions) => Promise<IdTokenFetchResponse>;
+    globalInfo: (message: string) => void;
+    process: {
+        env?: IdTokenEnv;
+    };
+}
+export type IdTokenOptions = Pick<PublishPackedPkgOptions, 'fetchRetries' | 'fetchRetryFactor' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'fetchTimeout'>;
+export interface IdTokenParams {
+    context?: IdTokenContext;
+    options?: IdTokenOptions;
+    registry: string;
+}
+/**
+ * Retrieve an `idToken` from the CI environment.
+ *
+ * @throws instances of subclasses of {@link IdTokenError} which can be converted into warnings and skipped.
+ *
+ * @see https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect for GitHub Actions OIDC.
+ * @see https://github.com/npm/cli/blob/7d900c46/lib/utils/oidc.js#L37-L110 for npm's implementation
+ * @see https://github.com/yarnpkg/berry/blob/bafbef55/packages/plugin-npm/sources/npmHttpUtils.ts#L594-L624 for yarn's implementation
+ */
+export declare function getIdToken({ context: { Date, ciInfo: { GITHUB_ACTIONS }, fetch, globalInfo, process: { env }, }, options, registry, }: IdTokenParams): Promise<string | undefined>;
+export declare abstract class IdTokenError extends PnpmError {
+}
+export declare class IdTokenGitHubWorkflowIncorrectPermissionsError extends IdTokenError {
+    constructor();
+}
+export declare class IdTokenGitHubInvalidResponseError extends IdTokenError {
+    constructor();
+}
+export declare class IdTokenGitHubJsonInterruptedError extends IdTokenError {
+    readonly errorSource: unknown;
+    constructor(error: unknown);
+}
+export declare class IdTokenGitHubJsonInvalidValueError extends IdTokenError {
+    readonly jsonResponse: unknown;
+    constructor(jsonResponse: unknown);
+}