@pnpm/releasing.commands 1100.7.0 → 1100.8.0

package/lib/publish/oidc/idToken.js

@@ -0,0 +1,90 @@
+import { PnpmError } from '@pnpm/error';
+import { displayError } from '../displayError.js';
+import { SHARED_CONTEXT } from '../utils/shared-context.js';
+/**
+ * Retrieve an `idToken` from the CI environment.
+ *
+ * @throws instances of subclasses of {@link IdTokenError} which can be converted into warnings and skipped.
+ *
+ * @see https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect for GitHub Actions OIDC.
+ * @see https://github.com/npm/cli/blob/7d900c46/lib/utils/oidc.js#L37-L110 for npm's implementation
+ * @see https://github.com/yarnpkg/berry/blob/bafbef55/packages/plugin-npm/sources/npmHttpUtils.ts#L594-L624 for yarn's implementation
+ */
+export async function getIdToken({ context: { Date, ciInfo: { GITHUB_ACTIONS }, fetch, globalInfo, process: { env }, } = SHARED_CONTEXT, options, registry, }) {
+    // `NPM_ID_TOKEN` is the canonical CI-agnostic injection point for an OIDC ID token.
+    // Any CI provider with its own OIDC mechanism (GitLab natively, CircleCI's
+    // `CIRCLE_OIDC_TOKEN_V2`, Buildkite, etc.) can forward its token here and trusted
+    // publishing will work — we don't need to recognize the provider ourselves.
+    if (env?.NPM_ID_TOKEN)
+        return env.NPM_ID_TOKEN;
+    // Without an explicit token, the only flow we can drive ourselves is GitHub Actions'
+    // request-token endpoint. Anywhere else (other CIs without `NPM_ID_TOKEN`, local dev)
+    // falls through silently and the publish caller falls back to a static `_authToken`.
+    if (!GITHUB_ACTIONS)
+        return undefined;
+    if (!env?.ACTIONS_ID_TOKEN_REQUEST_TOKEN || !env?.ACTIONS_ID_TOKEN_REQUEST_URL) {
+        throw new IdTokenGitHubWorkflowIncorrectPermissionsError();
+    }
+    const parsedRegistry = new URL(registry);
+    const audience = `npm:${parsedRegistry.hostname}`;
+    const url = new URL(env.ACTIONS_ID_TOKEN_REQUEST_URL);
+    url.searchParams.append('audience', audience);
+    const startTime = Date.now();
+    const response = await fetch(url.href, {
+        headers: {
+            Accept: 'application/json',
+            Authorization: `Bearer ${env.ACTIONS_ID_TOKEN_REQUEST_TOKEN}`,
+        },
+        method: 'GET',
+        retry: {
+            factor: options?.fetchRetryFactor,
+            maxTimeout: options?.fetchRetryMaxtimeout,
+            minTimeout: options?.fetchRetryMintimeout,
+            retries: options?.fetchRetries,
+        },
+        timeout: options?.fetchTimeout,
+    });
+    const elapsedTime = Date.now() - startTime;
+    globalInfo(`GET ${url.href} ${response.status} ${elapsedTime}ms`);
+    if (!response.ok) {
+        throw new IdTokenGitHubInvalidResponseError();
+    }
+    let json;
+    try {
+        json = await response.json();
+    }
+    catch (error) {
+        throw new IdTokenGitHubJsonInterruptedError(error);
+    }
+    if (!json || typeof json !== 'object' || !('value' in json) || typeof json.value !== 'string') {
+        throw new IdTokenGitHubJsonInvalidValueError(json);
+    }
+    return json.value;
+}
+export class IdTokenError extends PnpmError {
+}
+export class IdTokenGitHubWorkflowIncorrectPermissionsError extends IdTokenError {
+    constructor() {
+        super('ID_TOKEN_GITHUB_WORKFLOW_INCORRECT_PERMISSIONS', 'Incorrect permissions for idToken within GitHub Workflows');
+    }
+}
+export class IdTokenGitHubInvalidResponseError extends IdTokenError {
+    constructor() {
+        super('ID_TOKEN_GITHUB_INVALID_RESPONSE', 'Failed to fetch idToken from GitHub: received an invalid response');
+    }
+}
+export class IdTokenGitHubJsonInterruptedError extends IdTokenError {
+    errorSource;
+    constructor(error) {
+        super('ID_TOKEN_GITHUB_JSON_INTERRUPTED_ERROR', `Fetching of idToken JSON interrupted: ${displayError(error)}`);
+        this.errorSource = error;
+    }
+}
+export class IdTokenGitHubJsonInvalidValueError extends IdTokenError {
+    jsonResponse;
+    constructor(jsonResponse) {
+        super('ID_TOKEN_GITHUB_JSON_INVALID_VALUE', 'Failed to fetch idToken from GitHub: missing or invalid value');
+        this.jsonResponse = jsonResponse;
+    }
+}
+//# sourceMappingURL=idToken.js.map

package/lib/publish/oidc/provenance.d.ts

@@ -0,0 +1,73 @@
+import { PnpmError } from '@pnpm/error';
+import type { PublishPackedPkgOptions } from '../publishPackedPkg.js';
+export interface ProvenanceCIInfo {
+    GITHUB_ACTIONS?: boolean;
+    GITLAB?: boolean;
+}
+export interface ProvenanceEnv extends NodeJS.ProcessEnv {
+    SIGSTORE_ID_TOKEN?: string;
+}
+export interface ProvenanceFetchOptions {
+    headers: {
+        Accept: 'application/json';
+        Authorization: `Bearer ${string}`;
+    };
+    method: 'GET';
+    retry?: {
+        factor?: number;
+        maxTimeout?: number;
+        minTimeout?: number;
+        randomize?: boolean;
+        retries?: number;
+    };
+    timeout?: number;
+}
+export interface ProvenanceFetchResponse {
+    readonly json: (this: this) => Promise<unknown>;
+    readonly ok: boolean;
+    readonly status: number;
+}
+export interface ProvenanceContext {
+    ciInfo: ProvenanceCIInfo;
+    fetch: (url: URL, options: ProvenanceFetchOptions) => Promise<ProvenanceFetchResponse>;
+    process: {
+        env?: ProvenanceEnv;
+    };
+}
+export type ProvenanceOptions = Pick<PublishPackedPkgOptions, 'fetchRetries' | 'fetchRetryFactor' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'fetchTimeout'>;
+export interface ProvenanceParams {
+    authToken: string;
+    context?: ProvenanceContext;
+    idToken: string;
+    options?: ProvenanceOptions;
+    packageName: string;
+    registry: string;
+}
+/**
+ * Determine `provenance` for a package from the CI context and the visibility of the package.
+ *
+ * @throws instances of subclasses of {@link ProvenanceError} which can be converted into warnings and skipped.
+ *
+ * @see https://github.com/npm/cli/blob/7d900c46/lib/utils/oidc.js#L145-L164 for npm's implementation.
+ */
+export declare function determineProvenance({ authToken, idToken, options, packageName, registry, context: { ciInfo: { GITHUB_ACTIONS, GITLAB }, fetch, process: { env }, }, }: ProvenanceParams): Promise<boolean | undefined>;
+export declare abstract class ProvenanceError extends PnpmError {
+}
+export declare class ProvenanceMalformedIdTokenError extends ProvenanceError {
+    readonly idToken: string;
+    constructor(idToken: string);
+}
+export declare class ProvenanceInsufficientInformationError extends ProvenanceError {
+    constructor();
+}
+export declare class ProvenanceFailedToFetchVisibilityError extends ProvenanceError {
+    readonly errorResponse?: {
+        code?: string;
+        message?: string;
+    };
+    readonly packageName: string;
+    readonly registry: string;
+    readonly status: number;
+    constructor(errorResponse: ProvenanceFailedToFetchVisibilityError['errorResponse'], status: number, packageName: string, registry: string);
+    static createErrorFromFetchResponse(response: ProvenanceFetchResponse, packageName: string, registry: string): Promise<ProvenanceFailedToFetchVisibilityError>;
+}

package/lib/publish/oidc/provenance.js

@@ -0,0 +1,91 @@
+import { PnpmError, redactUrlCredentials } from '@pnpm/error';
+import npa from '@pnpm/npm-package-arg';
+import { SHARED_CONTEXT } from '../utils/shared-context.js';
+/**
+ * Determine `provenance` for a package from the CI context and the visibility of the package.
+ *
+ * @throws instances of subclasses of {@link ProvenanceError} which can be converted into warnings and skipped.
+ *
+ * @see https://github.com/npm/cli/blob/7d900c46/lib/utils/oidc.js#L145-L164 for npm's implementation.
+ */
+export async function determineProvenance({ authToken, idToken, options, packageName, registry, context: { ciInfo: { GITHUB_ACTIONS, GITLAB }, fetch, process: { env }, } = SHARED_CONTEXT, }) {
+    const [headerB64, payloadB64] = idToken.split('.');
+    if (!headerB64 || !payloadB64) {
+        throw new ProvenanceMalformedIdTokenError(idToken);
+    }
+    const payloadJson = Buffer.from(payloadB64, 'base64url').toString('utf8');
+    const payload = JSON.parse(payloadJson);
+    if ((!GITHUB_ACTIONS || payload.repository_visibility !== 'public') &&
+        (!GITLAB || payload.project_visibility !== 'public' || !env?.SIGSTORE_ID_TOKEN)) {
+        throw new ProvenanceInsufficientInformationError();
+    }
+    const visibilityUrl = new URL(`/-/package/${npa(packageName).escapedName}/visibility`, registry);
+    const response = await fetch(visibilityUrl, {
+        headers: {
+            Accept: 'application/json',
+            Authorization: `Bearer ${authToken}`,
+        },
+        method: 'GET',
+        retry: {
+            factor: options?.fetchRetryFactor,
+            maxTimeout: options?.fetchRetryMaxtimeout,
+            minTimeout: options?.fetchRetryMintimeout,
+            retries: options?.fetchRetries,
+        },
+        timeout: options?.fetchTimeout,
+    });
+    if (!response.ok) {
+        throw await ProvenanceFailedToFetchVisibilityError.createErrorFromFetchResponse(response, packageName, registry);
+    }
+    const visibility = await response.json();
+    if (visibility?.public)
+        return true;
+    return undefined;
+}
+export class ProvenanceError extends PnpmError {
+}
+export class ProvenanceMalformedIdTokenError extends ProvenanceError {
+    idToken;
+    constructor(idToken) {
+        super('PROVENANCE_MALFORMED_ID_TOKEN', 'The received idToken is not a valid JWT');
+        this.idToken = idToken;
+    }
+}
+export class ProvenanceInsufficientInformationError extends ProvenanceError {
+    constructor() {
+        super('PROVENANCE_INSUFFICIENT_INFORMATION', 'The environment does not provide enough information to determine visibility');
+    }
+}
+export class ProvenanceFailedToFetchVisibilityError extends ProvenanceError {
+    errorResponse;
+    packageName;
+    registry;
+    status;
+    constructor(errorResponse, status, packageName, registry) {
+        let message = 'an unknown error';
+        if (errorResponse?.code && errorResponse?.message) {
+            message = `${errorResponse.code}: ${errorResponse.message}`;
+        }
+        else if (errorResponse?.code) {
+            message = errorResponse.code;
+        }
+        else if (errorResponse?.message) {
+            message = errorResponse.message;
+        }
+        const redactedRegistry = redactUrlCredentials(registry);
+        super('PROVENANCE_FAILED_TO_FETCH_VISIBILITY', `Failed to fetch visibility for package ${packageName} from registry ${redactedRegistry} due to ${message} (status code ${status})`);
+        this.errorResponse = errorResponse;
+        this.status = status;
+        this.packageName = packageName;
+        this.registry = redactedRegistry;
+    }
+    static async createErrorFromFetchResponse(response, packageName, registry) {
+        let errorResponse;
+        try {
+            errorResponse = await response.json();
+        }
+        catch { }
+        return new ProvenanceFailedToFetchVisibilityError(errorResponse, response.status, packageName, registry);
+    }
+}
+//# sourceMappingURL=provenance.js.map

package/lib/publish/otp.d.ts

@@ -0,0 +1,38 @@
+import { type OtpContext as BaseOtpContext } from '@pnpm/network.web-auth';
+import type { ExportedManifest } from '@pnpm/releasing.exportable-manifest';
+import type { PublishOptions } from 'libnpmpublish';
+export type PublishOptionsWithDefaultAccess = Omit<PublishOptions, 'access'> & {
+    access?: PublishOptions['access'] | null;
+};
+export interface OtpPublishResponse {
+    readonly ok: boolean;
+    readonly status: number;
+    readonly statusText: string;
+    readonly text: () => Promise<string>;
+    /** Set by the registry only when the publish was staged (i.e. `stage: true` was sent). */
+    readonly stageId?: string;
+}
+export type OtpPublishFn = (manifest: ExportedManifest, tarballData: Buffer, options: PublishOptionsWithDefaultAccess) => Promise<OtpPublishResponse>;
+export interface OtpContext extends BaseOtpContext {
+    publish: OtpPublishFn;
+}
+export interface OtpParams {
+    context?: OtpContext;
+    manifest: ExportedManifest;
+    publishOptions: PublishOptionsWithDefaultAccess;
+    tarballData: Buffer;
+}
+/**
+ * Publish a package, handling OTP challenges:
+ * - Web based authentication flow (authUrl/doneUrl in error body with doneUrl polling)
+ * - Classic OTP prompt (manual code entry)
+ *
+ * The caller is responsible for supplying a {@link OtpContext.fetch} that
+ * honors the desired network configuration (proxy, TLS, etc.); see
+ * https://github.com/pnpm/pnpm/issues/11561 for why this matters during the
+ * web-based authentication flow.
+ *
+ * @see https://github.com/npm/cli/blob/7d900c46/lib/utils/otplease.js for npm's implementation.
+ * @see https://github.com/npm/npm-profile/blob/main/lib/index.js for the webauth polling flow.
+ */
+export declare function publishWithOtpHandling({ context, manifest, publishOptions, tarballData, }: OtpParams): Promise<OtpPublishResponse>;

package/lib/publish/otp.js

@@ -0,0 +1,41 @@
+import { withOtpHandling, } from '@pnpm/network.web-auth';
+import { SHARED_CONTEXT } from './utils/shared-context.js';
+/**
+ * Publish a package, handling OTP challenges:
+ * - Web based authentication flow (authUrl/doneUrl in error body with doneUrl polling)
+ * - Classic OTP prompt (manual code entry)
+ *
+ * The caller is responsible for supplying a {@link OtpContext.fetch} that
+ * honors the desired network configuration (proxy, TLS, etc.); see
+ * https://github.com/pnpm/pnpm/issues/11561 for why this matters during the
+ * web-based authentication flow.
+ *
+ * @see https://github.com/npm/cli/blob/7d900c46/lib/utils/otplease.js for npm's implementation.
+ * @see https://github.com/npm/npm-profile/blob/main/lib/index.js for the webauth polling flow.
+ */
+export async function publishWithOtpHandling({ context = SHARED_CONTEXT, manifest, publishOptions, tarballData, }) {
+    const { publish } = context;
+    const fetchOptions = {
+        method: 'GET',
+        retry: {
+            factor: publishOptions.fetchRetryFactor,
+            maxTimeout: publishOptions.fetchRetryMaxtimeout,
+            minTimeout: publishOptions.fetchRetryMintimeout,
+            retries: publishOptions.fetchRetries,
+        },
+        timeout: publishOptions.timeout,
+    };
+    return withOtpHandling({
+        context,
+        fetchOptions,
+        // withOtpHandling first calls this with no otp, then retries with the otp
+        // it obtained from an OTP challenge. On the first attempt we fall back to
+        // the configured --otp (publishOptions.otp) so it is actually sent; a retry
+        // otp takes precedence over it. When both are undefined, passing
+        // otp: undefined is safe because libnpmpublish treats undefined the same as
+        // absent (unlike HTTP headers, where undefined gets coerced to the string
+        // "undefined").
+        operation: otp => publish(manifest, tarballData, { ...publishOptions, otp: otp ?? publishOptions.otp }),
+    });
+}
+//# sourceMappingURL=otp.js.map

package/lib/publish/otpEnv.d.ts

@@ -0,0 +1,7 @@
+declare const ENV_KEY = "PNPM_CONFIG_OTP";
+type EnvBase = Partial<Readonly<Record<string, string>>> & Partial<Readonly<Record<typeof ENV_KEY, string>>>;
+interface OptionsBase {
+    readonly otp?: string;
+}
+export declare const optionsWithOtpEnv: <Options extends OptionsBase>(opts: Options, { [ENV_KEY]: otp }: EnvBase) => Options;
+export {};

package/lib/publish/otpEnv.js

@@ -0,0 +1,5 @@
+const ENV_KEY = 'PNPM_CONFIG_OTP';
+export const optionsWithOtpEnv = (opts, { [ENV_KEY]: otp }) => Boolean(opts.otp) || !otp // empty string is considered "not defined" here
+    ? opts
+    : { ...opts, otp };
+//# sourceMappingURL=otpEnv.js.map

package/lib/publish/pack.d.ts

@@ -0,0 +1,34 @@
+import { type Config, type ConfigContext, type UniversalOptions } from '@pnpm/config.reader';
+import { type ExportedManifest } from '@pnpm/releasing.exportable-manifest';
+export declare function rcOptionsTypes(): Record<string, unknown>;
+export declare function cliOptionsTypes(): Record<string, unknown>;
+export declare const commandNames: string[];
+export declare function help(): string;
+export type PackOptions = Pick<UniversalOptions, 'dir'> & Pick<Config, 'catalogs' | 'ignoreScripts' | 'embedReadme' | 'packGzipLevel' | 'nodeLinker' | 'skipManifestObfuscation' | 'userAgent'> & Partial<Pick<Config, 'extraBinPaths' | 'extraEnv' | 'recursive' | 'workspaceConcurrency' | 'workspaceDir' | 'versioning' | 'registries' | 'configByUri' | 'fetchRetries' | 'fetchRetryFactor' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'fetchTimeout' | 'ca' | 'cert' | 'key' | 'strictSsl' | 'httpProxy' | 'httpsProxy' | 'noProxy' | 'localAddress'>> & Partial<Pick<ConfigContext, 'hooks' | 'selectedProjectsGraph' | 'allProjectsGraph' | 'prodAllProjectsGraph' | 'prodOnlySelectedProjectDirs'>> & {
+    argv: {
+        original: string[];
+    };
+    dryRun?: boolean;
+    engineStrict?: boolean;
+    packDestination?: string;
+    out?: string;
+    json?: boolean;
+    unicode?: boolean;
+};
+export interface PackResultJson {
+    name: string;
+    version: string;
+    filename: string;
+    files: Array<{
+        path: string;
+    }>;
+}
+export declare function handler(opts: PackOptions): Promise<string>;
+export declare function api(opts: PackOptions): Promise<PackResult>;
+export interface PackResult {
+    publishedManifest: ExportedManifest;
+    contents: string[];
+    tarballPath: string;
+    /** Total uncompressed size of all files in the tarball, in bytes. */
+    unpackedSize: number;
+}