@pnpm/releasing.commands 1100.7.0 → 1100.7.1

package/lib/publish/publish.js

@@ -0,0 +1,256 @@
+import path from 'node:path';
+import { confirm } from '@inquirer/prompts';
+import { FILTERING } from '@pnpm/cli.common-cli-options-help';
+import { docsUrl, readProjectManifest } from '@pnpm/cli.utils';
+import { types as allTypes } from '@pnpm/config.reader';
+import { PnpmError } from '@pnpm/error';
+import { runLifecycleHook } from '@pnpm/exec.lifecycle';
+import { getCurrentBranch, isGitRepo, isRemoteHistoryClean, isWorkingTreeClean } from '@pnpm/network.git-utils';
+import { rimraf } from '@zkochan/rimraf';
+import { pick } from 'ramda';
+import { realpathMissing } from 'realpath-missing';
+import { renderHelp } from 'render-help';
+import { temporaryDirectory } from 'tempy';
+import { extractPublishManifestFromPacked, isTarballPath } from './extractManifestFromPacked.js';
+import { optionsWithOtpEnv } from './otpEnv.js';
+import * as pack from './pack.js';
+import { publishPackedPkg } from './publishPackedPkg.js';
+import { recursivePublish } from './recursivePublish.js';
+export function rcOptionsTypes() {
+    return pick([
+        'access',
+        'git-checks',
+        'ignore-scripts',
+        'skip-manifest-obfuscation',
+        'provenance',
+        'npm-path',
+        'otp',
+        'publish-branch',
+        'registry',
+        'tag',
+        'unsafe-perm',
+        'embed-readme',
+    ], allTypes);
+}
+export function cliOptionsTypes() {
+    return {
+        ...rcOptionsTypes(),
+        batch: Boolean,
+        'dry-run': Boolean,
+        force: Boolean,
+        json: Boolean,
+        otp: String,
+        recursive: Boolean,
+        'report-summary': Boolean,
+    };
+}
+export const commandNames = ['publish'];
+export function help() {
+    return renderHelp({
+        description: 'Publishes a package to the npm registry.',
+        descriptionLists: [
+            {
+                title: 'Options',
+                list: [
+                    {
+                        description: "Don't check if current branch is your publish branch, clean, and up to date",
+                        name: '--no-git-checks',
+                    },
+                    {
+                        description: 'Sets branch name to publish. Default is master',
+                        name: '--publish-branch',
+                    },
+                    {
+                        description: 'Does everything a publish would do except actually publishing to the registry',
+                        name: '--dry-run',
+                    },
+                    {
+                        description: 'Show information in JSON format',
+                        name: '--json',
+                    },
+                    {
+                        description: 'Registers the published package with the given tag. By default, the "latest" tag is used.',
+                        name: '--tag <tag>',
+                    },
+                    {
+                        description: 'Tells the registry whether this package should be published as public or restricted',
+                        name: '--access <public|restricted>',
+                    },
+                    {
+                        description: 'Ignores any publish related lifecycle scripts (prepublishOnly, postpublish, and the like)',
+                        name: '--ignore-scripts',
+                    },
+                    {
+                        description: 'Skip pnpm\'s manifest obfuscation: keep the original `packageManager` field and publish lifecycle scripts in the published manifest instead of stripping them. The pnpm-specific `pnpm` field is still omitted.',
+                        name: '--skip-manifest-obfuscation',
+                    },
+                    {
+                        description: 'Packages are proceeded to be published even if their current version is already in the registry. This is useful when a "prepublishOnly" script bumps the version of the package before it is published',
+                        name: '--force',
+                    },
+                    {
+                        description: 'Save the list of the newly published packages to "pnpm-publish-summary.json". Useful when some other tooling is used to report the list of published packages.',
+                        name: '--report-summary',
+                    },
+                    {
+                        description: 'When publishing packages that require two-factor authentication, this option can specify a one-time password',
+                        name: '--otp',
+                    },
+                    {
+                        description: 'Publish all packages from the workspace',
+                        name: '--recursive',
+                        shortAlias: '-r',
+                    },
+                    {
+                        description: 'Send all packages to the registry in a single request instead of one request per package. Requires --recursive and a registry that implements the "/-/pnpm/v1/publish" endpoint (for example, pnpr)',
+                        name: '--batch',
+                    },
+                ],
+            },
+            FILTERING,
+        ],
+        url: docsUrl('publish'),
+        usages: ['pnpm publish [<tarball>|<dir>] [--tag <tag>] [--access <public|restricted>] [options]'],
+    });
+}
+const GIT_CHECKS_HINT = 'If you want to disable Git checks on publish, set the "git-checks" setting to "false", or run again with "--no-git-checks".';
+export async function handler(opts, params) {
+    const result = await publish(opts, params);
+    // Emit per-package summaries on stdout when --json is set: single object for a single-package
+    // publish, array for recursive publish. Mirrors `pnpm pack --json`'s shape choice.
+    if (opts.json) {
+        if (result?.publishSummary) {
+            return { output: JSON.stringify(result.publishSummary, null, 2), exitCode: 0 };
+        }
+        if (result?.publishedPackages) {
+            return { output: JSON.stringify(result.publishedPackages, null, 2), exitCode: result.exitCode ?? 0 };
+        }
+    }
+    if (result?.manifest)
+        return;
+    return result;
+}
+export async function publish(opts, params) {
+    if (opts.batch && !opts.recursive) {
+        throw new PnpmError('BATCH_PUBLISH_REQUIRES_RECURSIVE', '--batch can only be used together with --recursive', {
+            hint: 'Run "pnpm publish -r --batch" to publish all workspace packages in a single request.',
+        });
+    }
+    if (opts.gitChecks !== false && await isGitRepo()) {
+        if (!(await isWorkingTreeClean())) {
+            throw new PnpmError('GIT_UNCLEAN', 'Unclean working tree. Commit or stash changes first.', {
+                hint: GIT_CHECKS_HINT,
+            });
+        }
+        const branches = opts.publishBranch ? [opts.publishBranch] : ['master', 'main'];
+        const currentBranch = await getCurrentBranch();
+        if (currentBranch === null) {
+            throw new PnpmError('GIT_UNKNOWN_BRANCH', `The Git HEAD may not attached to any branch, but your "publish-branch" is set to "${branches.join('|')}".`, {
+                hint: GIT_CHECKS_HINT,
+            });
+        }
+        if (!branches.includes(currentBranch)) {
+            let isConfirmed;
+            try {
+                isConfirmed = await confirm({
+                    message: `You're on branch "${currentBranch}" but your "publish-branch" is set to "${branches.join('|')}". Do you want to continue?`,
+                });
+            }
+            catch (err) {
+                if (err instanceof Error && err.name === 'ExitPromptError') {
+                    isConfirmed = false;
+                }
+                else {
+                    throw err;
+                }
+            }
+            if (!isConfirmed) {
+                throw new PnpmError('GIT_NOT_CORRECT_BRANCH', `Branch is not on '${branches.join('|')}'.`, {
+                    hint: GIT_CHECKS_HINT,
+                });
+            }
+        }
+        if (!(await isRemoteHistoryClean())) {
+            throw new PnpmError('GIT_NOT_LATEST', 'Remote history differs. Please pull changes.', {
+                hint: GIT_CHECKS_HINT,
+            });
+        }
+    }
+    if (opts.recursive && (opts.selectedProjectsGraph != null)) {
+        const { exitCode, publishedPackages } = await recursivePublish({
+            ...opts,
+            selectedProjectsGraph: opts.selectedProjectsGraph,
+            workspaceDir: opts.workspaceDir ?? process.cwd(),
+        });
+        return { exitCode, publishedPackages };
+    }
+    opts = optionsWithOtpEnv(opts, process.env);
+    const dirInParams = (params.length > 0) ? params[0] : undefined;
+    if (dirInParams != null && isTarballPath(dirInParams)) {
+        const tarballPath = dirInParams;
+        const publishedManifest = await extractPublishManifestFromPacked(tarballPath);
+        // Publishing a pre-built tarball bypasses `pack.api()`, so we don't have the file listing
+        // or unpacked size — those summary fields are reported as empty/zero.
+        const publishSummary = await publishPackedPkg({
+            tarballPath,
+            publishedManifest,
+            contents: [],
+            unpackedSize: 0,
+        }, opts);
+        return { exitCode: 0, publishSummary };
+    }
+    const dir = dirInParams ?? opts.dir ?? process.cwd();
+    const _runScriptsIfPresent = runScriptsIfPresent.bind(null, {
+        depPath: dir,
+        extraBinPaths: opts.extraBinPaths,
+        extraEnv: opts.extraEnv,
+        pkgRoot: dir,
+        rootModulesDir: await realpathMissing(path.join(dir, 'node_modules')),
+        stdio: 'inherit',
+        unsafePerm: true, // when running scripts explicitly, assume that they're trusted.
+        userAgent: opts.userAgent,
+    });
+    const { manifest } = await readProjectManifest(dir, opts);
+    // Unfortunately, we cannot support postpack at the moment
+    if (!opts.ignoreScripts) {
+        await _runScriptsIfPresent([
+            'prepublishOnly',
+            'prepublish',
+        ], manifest);
+    }
+    // We have to publish the tarball from another location.
+    // Otherwise, npm would publish the package with the package.json file
+    // from the current working directory, ignoring the package.json file
+    // that was generated and packed to the tarball.
+    const packDestination = temporaryDirectory();
+    let publishedManifest;
+    let publishSummary;
+    try {
+        const packResult = await pack.api({
+            ...opts,
+            dir,
+            packDestination,
+            dryRun: false,
+        });
+        publishSummary = await publishPackedPkg(packResult, opts);
+        publishedManifest = packResult.publishedManifest;
+    }
+    finally {
+        await rimraf(packDestination);
+    }
+    if (!opts.ignoreScripts) {
+        await _runScriptsIfPresent([
+            'publish',
+            'postpublish',
+        ], manifest);
+    }
+    return { manifest, publishedManifest, publishSummary };
+}
+export async function runScriptsIfPresent(opts, scriptNames, manifest) {
+    for (const scriptName of scriptNames) {
+        if (!manifest.scripts?.[scriptName])
+            continue;
+        await runLifecycleHook(scriptName, manifest, opts); // eslint-disable-line no-await-in-loop
+    }
+}
+//# sourceMappingURL=publish.js.map

package/lib/publish/publishPackedPkg.d.ts

@@ -0,0 +1,79 @@
+import type { Config } from '@pnpm/config.reader';
+import { PnpmError } from '@pnpm/error';
+import type { ExportedManifest } from '@pnpm/releasing.exportable-manifest';
+import { type RegistryConfig } from '@pnpm/types';
+import { type PublishSummary } from '../tarball/publishSummary.js';
+import { type OtpContext, type PublishOptionsWithDefaultAccess } from './otp.js';
+import type { PackResult } from './pack.js';
+import { type NormalizedRegistryUrl } from './registryConfigKeys.js';
+export type { PublishSummary };
+export type PublishPackedPkgOptions = Pick<Config, 'configByUri' | 'dryRun' | 'fetchRetries' | 'fetchRetryFactor' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'fetchTimeout' | 'registries' | 'tag' | 'userAgent'> & Partial<Pick<Config, 'ca' | 'cert' | 'httpProxy' | 'httpsProxy' | 'key' | 'localAddress' | 'noProxy' | 'strictSsl'>> & {
+    access?: 'public' | 'restricted';
+    ci?: boolean;
+    otp?: string;
+    provenance?: boolean;
+    provenanceFile?: string;
+    stage?: boolean;
+};
+export declare function publishPackedPkg(packResult: Pick<PackResult, 'publishedManifest' | 'tarballPath' | 'contents' | 'unpackedSize'>, opts: PublishPackedPkgOptions): Promise<PublishSummary>;
+/**
+ * Builds the {@link OtpContext} used to drive the publish. The default fetch
+ * is replaced by one that respects proxy / TLS / local-address settings, so
+ * the `doneUrl` polling in the web-based authentication flow goes through
+ * the same network configuration as the initial publish request (see
+ * https://github.com/pnpm/pnpm/issues/11561).
+ */
+export declare function createPublishContext(opts: PublishPackedPkgOptions): OtpContext;
+type StagePublishOptions = PublishOptionsWithDefaultAccess & {
+    command?: string;
+    stage?: boolean;
+};
+/**
+ * Build the libnpmpublish / npm-registry-fetch options (registry, auth, headers) for publishing
+ * {@link manifest}. When `oidc` is `false`, the per-package OIDC token exchange is skipped and only
+ * statically configured credentials are used — batch publish sends many packages in one request,
+ * which a package-scoped OIDC token cannot authorize.
+ *
+ * @internal Exported for unit testing of the access / registry / auth fallback rules and for batch
+ *   publish. Not part of the package's public API.
+ */
+export declare function createPublishOptions(manifest: ExportedManifest, options: PublishPackedPkgOptions, { oidc }?: {
+    oidc?: boolean;
+}): Promise<StagePublishOptions>;
+export declare function isPublishAccess(access: unknown): access is 'public' | 'restricted';
+interface RegistryInfo {
+    registry: NormalizedRegistryUrl;
+    config: RegistryConfig;
+}
+/**
+ * Find credentials and SSL info for a package's registry.
+ * Follows {@link https://docs.npmjs.com/cli/v10/configuring-npm/npmrc#auth-related-configuration}.
+ *
+ * The manifest's `publishConfig.registry`, when set, takes precedence over `registries`.
+ *
+ * @internal Exported for batch publish, which groups packages by their target registry.
+ */
+export declare function findRegistryInfo({ name }: ExportedManifest, { configByUri, registries }: Pick<Config, 'configByUri' | 'registries'>, publishConfigRegistry?: string): Partial<RegistryInfo>;
+export declare class PublishUnsupportedRegistryProtocolError extends PnpmError {
+    readonly registryUrl: string;
+    constructor(registryUrl: string);
+}
+interface OidcTokenProvenanceResult {
+    authToken: string;
+    provenance?: boolean;
+}
+/**
+ * Try fetching an authentication token and provenance by OpenID Connect.
+ *
+ * The result, when defined, is intended to take precedence over any statically configured
+ * authentication. This mirrors the npm CLI's OIDC flow, which always attempts the exchange
+ * in supported CI environments and overwrites a configured `_authToken` on success.
+ *
+ * @returns the OIDC-derived authToken (and provenance flag) on success, or `undefined` when
+ *   OIDC is not applicable / not configured on the registry — in which case callers should
+ *   fall back to whatever static authentication they already have.
+ *
+ * @internal Exported for unit testing of the precedence rules. Not part of the package's
+ *   public API.
+ */
+export declare function fetchTokenAndProvenanceByOidc(packageName: string, registry: string, options: PublishPackedPkgOptions): Promise<OidcTokenProvenanceResult | undefined>;

package/lib/publish/publishPackedPkg.js

@@ -0,0 +1,298 @@
+import fs from 'node:fs/promises';
+import { PnpmError, redactUrlCredentials } from '@pnpm/error';
+import { globalInfo, globalWarn } from '@pnpm/logger';
+import { createDispatchedFetch } from '@pnpm/network.fetch';
+import { DEFAULT_REGISTRY_SCOPE } from '@pnpm/types';
+import { createPublishSummary } from '../tarball/publishSummary.js';
+import { displayError } from './displayError.js';
+import { executeTokenHelper } from './executeTokenHelper.js';
+import { createFailedToPublishError } from './FailedToPublishError.js';
+import { AuthTokenError, fetchAuthToken } from './oidc/authToken.js';
+import { getIdToken, IdTokenError } from './oidc/idToken.js';
+import { determineProvenance, ProvenanceError } from './oidc/provenance.js';
+import { publishWithOtpHandling } from './otp.js';
+import { allRegistryConfigKeys, parseSupportedRegistryUrl } from './registryConfigKeys.js';
+import { SHARED_CONTEXT } from './utils/shared-context.js';
+export async function publishPackedPkg(packResult, opts) {
+    const { publishedManifest, tarballPath, contents, unpackedSize } = packResult;
+    const tarballData = await fs.readFile(tarballPath);
+    const publishOptions = await createPublishOptions(publishedManifest, opts);
+    const { name, version } = publishedManifest;
+    const { registry } = publishOptions;
+    const isStage = opts.stage === true;
+    // Redact any `user:pass@` credentials a registry= URL may carry so they don't leak into logs.
+    globalInfo(`📦 ${name}@${version} → ${registry != null ? redactUrlCredentials(registry) : 'the default registry'}`);
+    const summary = createPublishSummary({ publishedManifest, tarballPath, contents, unpackedSize }, tarballData);
+    if (opts.dryRun) {
+        globalWarn(`Skip ${isStage ? 'staging' : 'publishing'} ${name}@${version} (dry run)`);
+        return summary;
+    }
+    const context = createPublishContext(opts);
+    const response = await publishWithOtpHandling({
+        context,
+        manifest: publishedManifest,
+        publishOptions,
+        tarballData,
+    });
+    if (response.ok) {
+        if (isStage && response.stageId) {
+            summary.stageId = response.stageId;
+        }
+        globalInfo(`✅ ${isStage ? 'Staged' : 'Published'} package ${name}@${version}`);
+        return summary;
+    }
+    throw await createFailedToPublishError(packResult, response);
+}
+/**
+ * Builds the {@link OtpContext} used to drive the publish. The default fetch
+ * is replaced by one that respects proxy / TLS / local-address settings, so
+ * the `doneUrl` polling in the web-based authentication flow goes through
+ * the same network configuration as the initial publish request (see
+ * https://github.com/pnpm/pnpm/issues/11561).
+ */
+export function createPublishContext(opts) {
+    return {
+        ...SHARED_CONTEXT,
+        fetch: createDispatchedFetch({ ...opts, timeout: opts.fetchTimeout }),
+    };
+}
+/**
+ * Build the libnpmpublish / npm-registry-fetch options (registry, auth, headers) for publishing
+ * {@link manifest}. When `oidc` is `false`, the per-package OIDC token exchange is skipped and only
+ * statically configured credentials are used — batch publish sends many packages in one request,
+ * which a package-scoped OIDC token cannot authorize.
+ *
+ * @internal Exported for unit testing of the access / registry / auth fallback rules and for batch
+ *   publish. Not part of the package's public API.
+ */
+export async function createPublishOptions(manifest, options, { oidc = true } = {}) {
+    const publishConfigRegistry = typeof manifest.publishConfig?.registry === 'string'
+        ? manifest.publishConfig.registry
+        : undefined;
+    const { registry, config } = findRegistryInfo(manifest, options, publishConfigRegistry);
+    const tls = config?.tls;
+    const creds = config?.[DEFAULT_REGISTRY_SCOPE];
+    const publishConfigAccess = manifest.publishConfig?.access;
+    const access = options.access ?? (isPublishAccess(publishConfigAccess) ? publishConfigAccess : null);
+    const { ci: isFromCI, fetchRetries, fetchRetryFactor, fetchRetryMaxtimeout, fetchRetryMintimeout, fetchTimeout: timeout, otp, provenance, provenanceFile, tag: defaultTag, userAgent, } = options;
+    const npmCommand = options.stage === true ? 'stage' : 'publish';
+    const headers = {
+        'npm-auth-type': 'web',
+        'npm-command': npmCommand,
+    };
+    const publishOptions = {
+        access,
+        defaultTag,
+        fetchRetries,
+        fetchRetryFactor,
+        fetchRetryMaxtimeout,
+        fetchRetryMintimeout,
+        headers,
+        isFromCI,
+        otp,
+        timeout,
+        provenance,
+        provenanceFile,
+        registry,
+        strictSSL: options.strictSsl, // npm-registry-fetch defaults to true; must be set explicitly to honour strictSsl: false
+        userAgent,
+        // Signal to the registry that the client supports web-based authentication.
+        // Without this, the registry would never offer the web auth flow and would
+        // always fall back to prompting the user for an OTP code, even when the user
+        // has no OTP set up.
+        authType: 'web',
+        ca: tls?.ca,
+        cert: tls?.cert,
+        key: tls?.key,
+        npmCommand,
+        token: creds && extractToken(creds),
+        username: creds?.basicAuth?.username,
+        password: creds?.basicAuth?.password,
+    };
+    if (options.stage === true) {
+        publishOptions.command = 'stage';
+        publishOptions.stage = true;
+    }
+    if (registry) {
+        if (oidc) {
+            // OIDC takes precedence over a configured static `_authToken`, mirroring the npm CLI's
+            // behavior (see https://github.com/npm/cli/blob/7d900c46/lib/utils/oidc.js). Trusted
+            // publishing wins whenever the registry has it configured for the package; the static
+            // token is used only as a fallback when OIDC is not applicable.
+            const oidcTokenProvenance = await fetchTokenAndProvenanceByOidc(manifest.name, registry, options);
+            if (oidcTokenProvenance?.authToken) {
+                publishOptions.token = oidcTokenProvenance.authToken;
+            }
+            publishOptions.provenance ??= oidcTokenProvenance?.provenance;
+        }
+        appendAuthOptionsForRegistry(publishOptions, registry);
+    }
+    pruneUndefined(publishOptions);
+    return publishOptions;
+}
+export function isPublishAccess(access) {
+    return access === 'public' || access === 'restricted';
+}
+/**
+ * Find credentials and SSL info for a package's registry.
+ * Follows {@link https://docs.npmjs.com/cli/v10/configuring-npm/npmrc#auth-related-configuration}.
+ *
+ * The manifest's `publishConfig.registry`, when set, takes precedence over `registries`.
+ *
+ * @internal Exported for batch publish, which groups packages by their target registry.
+ */
+export function findRegistryInfo({ name }, { configByUri, registries }, publishConfigRegistry) {
+    // eslint-disable-next-line regexp/no-unused-capturing-group
+    const scopedMatches = /@(?<scope>[^/]+)\/(?<slug>[^/]+)/.exec(name);
+    const registryName = scopedMatches?.groups ? `@${scopedMatches.groups.scope}` : 'default';
+    const nonNormalizedRegistry = publishConfigRegistry ?? registries[registryName] ?? registries.default;
+    const supportedRegistryInfo = parseSupportedRegistryUrl(nonNormalizedRegistry);
+    if (!supportedRegistryInfo) {
+        throw new PublishUnsupportedRegistryProtocolError(nonNormalizedRegistry);
+    }
+    const { normalizedUrl: registry, longestConfigKey: initialRegistryConfigKey, } = supportedRegistryInfo;
+    const credsScope = registryName === 'default' ? DEFAULT_REGISTRY_SCOPE : registryName;
+    let creds;
+    let tls = {};
+    for (const registryConfigKey of allRegistryConfigKeys(initialRegistryConfigKey)) {
+        const entry = configByUri[registryConfigKey];
+        if (!entry)
+            continue;
+        // Auth from longer path collectively overrides shorter path
+        creds ??= entry[credsScope] ?? entry[DEFAULT_REGISTRY_SCOPE];
+        // TLS from longer path individually overrides shorter path
+        tls = { ...entry.tls, ...tls };
+    }
+    const config = { tls };
+    if (creds) {
+        config[DEFAULT_REGISTRY_SCOPE] = creds;
+    }
+    return {
+        registry,
+        config,
+    };
+}
+function extractToken({ authToken, tokenHelper, }) {
+    if (authToken)
+        return authToken;
+    if (tokenHelper) {
+        return executeTokenHelper(tokenHelper, { globalWarn });
+    }
+    return undefined;
+}
+export class PublishUnsupportedRegistryProtocolError extends PnpmError {
+    registryUrl;
+    constructor(registryUrl) {
+        super('PUBLISH_UNSUPPORTED_REGISTRY_PROTOCOL', `Registry ${registryUrl} has an unsupported protocol`, {
+            hint: '`pnpm publish` only supports HTTP and HTTPS registries',
+        });
+        this.registryUrl = registryUrl;
+    }
+}
+/**
+ * Try fetching an authentication token and provenance by OpenID Connect.
+ *
+ * The result, when defined, is intended to take precedence over any statically configured
+ * authentication. This mirrors the npm CLI's OIDC flow, which always attempts the exchange
+ * in supported CI environments and overwrites a configured `_authToken` on success.
+ *
+ * @returns the OIDC-derived authToken (and provenance flag) on success, or `undefined` when
+ *   OIDC is not applicable / not configured on the registry — in which case callers should
+ *   fall back to whatever static authentication they already have.
+ *
+ * @internal Exported for unit testing of the precedence rules. Not part of the package's
+ *   public API.
+ */
+export async function fetchTokenAndProvenanceByOidc(packageName, registry, options) {
+    let idToken;
+    try {
+        idToken = await getIdToken({
+            options,
+            registry,
+        });
+    }
+    catch (error) {
+        if (error instanceof IdTokenError) {
+            globalWarn(`Skipped OIDC: ${displayError(error)}`);
+            return undefined;
+        }
+        throw error;
+    }
+    if (!idToken) {
+        // OIDC is simply not applicable here — either we're outside of CI, or we're in a CI
+        // that doesn't natively drive OIDC and the user hasn't forwarded a token via
+        // `NPM_ID_TOKEN`. This is the common case for local publishes, so it must stay
+        // silent — only configuration *errors* in a supported CI environment surface as
+        // warnings, and those come back as `IdTokenError` and are handled above.
+        return undefined;
+    }
+    let authToken;
+    try {
+        authToken = await fetchAuthToken({
+            idToken,
+            options,
+            packageName,
+            registry,
+        });
+    }
+    catch (error) {
+        if (error instanceof AuthTokenError) {
+            globalWarn(`Skipped OIDC: ${displayError(error)}`);
+            return undefined;
+        }
+        throw error;
+    }
+    if (options.provenance != null) {
+        return {
+            authToken,
+            provenance: options.provenance,
+        };
+    }
+    let provenance;
+    try {
+        provenance = await determineProvenance({
+            authToken,
+            idToken,
+            options,
+            packageName,
+            registry,
+        });
+    }
+    catch (error) {
+        if (error instanceof ProvenanceError) {
+            // Don't lose the OIDC-derived authToken just because we couldn't determine the
+            // provenance flag — the publish itself can still go through, and that's what
+            // the npm CLI does too.
+            globalWarn(`Skipped setting provenance: ${displayError(error)}`);
+            return { authToken };
+        }
+        throw error;
+    }
+    return { authToken, provenance };
+}
+/**
+ * Appends authentication information to {@link targetPublishOptions} to explicitly target {@link registry}.
+ *
+ * `libnpmpublish` has a quirk in which it only read the authentication information from `//<registry>:_authToken`
+ * instead of `token`.
+ * This function fixes that by making sure the registry specific authentication information exists.
+ */
+function appendAuthOptionsForRegistry(targetPublishOptions, registry) {
+    const registryInfo = parseSupportedRegistryUrl(registry);
+    if (!registryInfo) {
+        globalWarn(`The registry ${registry} cannot be converted into a config key. Supplement is skipped. Subsequent libnpmpublish call may fail.`);
+        return;
+    }
+    const registryConfigKey = registryInfo.longestConfigKey;
+    targetPublishOptions[`${registryConfigKey}:_authToken`] ??= targetPublishOptions.token;
+    targetPublishOptions[`${registryConfigKey}:username`] ??= targetPublishOptions.username;
+    targetPublishOptions[`${registryConfigKey}:_password`] ??= targetPublishOptions.password && btoa(targetPublishOptions.password);
+}
+function pruneUndefined(object) {
+    for (const key in object) {
+        if (object[key] === undefined) {
+            delete object[key];
+        }
+    }
+}
+//# sourceMappingURL=publishPackedPkg.js.map

package/lib/publish/recursivePublish.d.ts

@@ -0,0 +1,18 @@
+import type { Config, ConfigContext } from '@pnpm/config.reader';
+import type { PublishPackedPkgOptions, PublishSummary } from './publishPackedPkg.js';
+export type PublishRecursiveOpts = Required<Pick<Config, 'bin' | 'cacheDir' | 'dir' | 'pnpmHomeDir' | 'configByUri' | 'registries' | 'workspaceDir'>> & Required<Pick<ConfigContext, 'cliOptions'>> & Partial<Pick<Config, 'tag' | 'ca' | 'catalogs' | 'cert' | 'fetchTimeout' | 'force' | 'dryRun' | 'extraBinPaths' | 'extraEnv' | 'fetchRetries' | 'fetchRetryFactor' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'key' | 'httpProxy' | 'httpsProxy' | 'localAddress' | 'lockfileDir' | 'noProxy' | 'npmPath' | 'offline' | 'strictSsl' | 'unsafePerm' | 'userAgent' | 'verifyStoreIntegrity' | 'versioning'>> & Partial<Pick<ConfigContext, 'selectedProjectsGraph' | 'allProjectsGraph' | 'prodAllProjectsGraph' | 'prodOnlySelectedProjectDirs'>> & {
+    access?: 'public' | 'restricted';
+    argv: {
+        original: string[];
+    };
+    batch?: boolean;
+    reportSummary?: boolean;
+} & PublishPackedPkgOptions;
+export type RecursivePublishedPackage = PublishSummary | {
+    name?: string;
+    version?: string;
+};
+export declare function recursivePublish(opts: PublishRecursiveOpts & Required<Pick<ConfigContext, 'selectedProjectsGraph'>>): Promise<{
+    exitCode: number;
+    publishedPackages: RecursivePublishedPackage[];
+}>;