@pnpm/releasing.commands 1100.7.0 → 1100.8.0

package/lib/publish/pack.js

@@ -0,0 +1,425 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { createGzip } from 'node:zlib';
+import { getBinsFromPackageManifest } from '@pnpm/bins.resolver';
+import { FILTERING } from '@pnpm/cli.common-cli-options-help';
+import { readProjectManifest } from '@pnpm/cli.utils';
+import { getDefaultWorkspaceConcurrency, getWorkspaceConcurrency, types as allTypes } from '@pnpm/config.reader';
+import { PnpmError } from '@pnpm/error';
+import { packlist } from '@pnpm/fs.packlist';
+import { logger } from '@pnpm/logger';
+import { createExportableManifest, readReadmeFile } from '@pnpm/releasing.exportable-manifest';
+import { changelogStorage, readPendingChangelog, renderChangelog } from '@pnpm/releasing.versioning';
+import { sortFilteredProjects } from '@pnpm/workspace.projects-sorter';
+import chalk from 'chalk';
+import pLimit from 'p-limit';
+import { pick } from 'ramda';
+import { realpathMissing } from 'realpath-missing';
+import { renderHelp } from 'render-help';
+import tar from 'tar-stream';
+import { glob } from 'tinyglobby';
+import validateNpmPackageName from 'validate-npm-package-name';
+import { normalizePackageName } from '../tarball/safeTarballFilename.js';
+import { fetchPreviousChangelog } from './previousChangelog.js';
+import { runScriptsIfPresent } from './publish.js';
+const LICENSE_GLOB = 'LICEN{S,C}E{,.*}'; // cspell:disable-line
+export function rcOptionsTypes() {
+    return {
+        ...cliOptionsTypes(),
+        ...pick([
+            'npm-path',
+            'skip-manifest-obfuscation',
+        ], allTypes),
+    };
+}
+export function cliOptionsTypes() {
+    return {
+        out: String,
+        recursive: Boolean,
+        ...pick([
+            'dry-run',
+            'pack-destination',
+            'pack-gzip-level',
+            'json',
+            'skip-manifest-obfuscation',
+            'workspace-concurrency',
+        ], allTypes),
+    };
+}
+export const commandNames = ['pack'];
+export function help() {
+    return renderHelp({
+        description: 'Create a tarball from a package',
+        usages: ['pnpm pack'],
+        descriptionLists: [
+            {
+                title: 'Options',
+                list: [
+                    {
+                        description: 'Does everything `pnpm pack` would do except actually writing the tarball to disk.',
+                        name: '--dry-run',
+                    },
+                    {
+                        description: 'Directory in which `pnpm pack` will save tarballs. The default is the current working directory.',
+                        name: '--pack-destination <dir>',
+                    },
+                    {
+                        description: 'Prints the packed tarball and contents in the json format.',
+                        name: '--json',
+                    },
+                    {
+                        description: 'Customizes the output path for the tarball. Use `%s` and `%v` to include the package name and version, e.g., `%s.tgz` or `some-dir/%s-%v.tgz`. By default, the tarball is saved in the current working directory with the name `<package-name>-<version>.tgz`.',
+                        name: '--out <path>',
+                    },
+                    {
+                        description: 'Pack all packages from the workspace',
+                        name: '--recursive',
+                        shortAlias: '-r',
+                    },
+                    {
+                        description: 'Skip pnpm\'s manifest obfuscation: keep the original `packageManager` field and publish lifecycle scripts in the packed manifest instead of stripping them. The pnpm-specific `pnpm` field is still omitted.',
+                        name: '--skip-manifest-obfuscation',
+                    },
+                    {
+                        description: `Set the maximum number of concurrency. Default is ${getDefaultWorkspaceConcurrency()}. For unlimited concurrency use Infinity.`,
+                        name: '--workspace-concurrency <number>',
+                    },
+                ],
+            },
+            FILTERING,
+        ],
+    });
+}
+export async function handler(opts) {
+    const packedPackages = [];
+    if (opts.recursive) {
+        const selectedProjectsGraph = opts.selectedProjectsGraph;
+        const pkgsToPack = [];
+        for (const { package: pkg } of Object.values(selectedProjectsGraph)) {
+            if (pkg.manifest.name && pkg.manifest.version) {
+                pkgsToPack.push(pkg);
+            }
+        }
+        const packedPkgDirs = new Set(pkgsToPack.map(({ rootDir }) => rootDir));
+        if (packedPkgDirs.size === 0) {
+            logger.info({
+                message: 'There are no packages that should be packed',
+                prefix: opts.dir,
+            });
+        }
+        const chunks = sortFilteredProjects({
+            selectedProjectsGraph,
+            allProjectsGraph: opts.allProjectsGraph,
+            prodAllProjectsGraph: opts.prodAllProjectsGraph,
+            prodOnlySelectedProjectDirs: opts.prodOnlySelectedProjectDirs,
+        });
+        const limitPack = pLimit(getWorkspaceConcurrency(opts.workspaceConcurrency));
+        const resolvedOpts = { ...opts };
+        if (opts.out) {
+            resolvedOpts.out = path.resolve(opts.dir, opts.out);
+        }
+        else if (opts.packDestination) {
+            resolvedOpts.packDestination = path.resolve(opts.dir, opts.packDestination);
+        }
+        else {
+            resolvedOpts.packDestination = path.resolve(opts.dir);
+        }
+        for (const chunk of chunks) {
+            // eslint-disable-next-line no-await-in-loop
+            await Promise.all(chunk.map(pkgDir => limitPack(async () => {
+                if (!packedPkgDirs.has(pkgDir))
+                    return;
+                const pkg = selectedProjectsGraph[pkgDir].package;
+                const packResult = await api({
+                    ...resolvedOpts,
+                    dir: pkg.rootDir,
+                });
+                packedPackages.push(toPackResultJson(packResult));
+            })));
+        }
+    }
+    else {
+        const packResult = await api(opts);
+        packedPackages.push(toPackResultJson(packResult));
+    }
+    if (opts.json) {
+        return JSON.stringify(packedPackages.length > 1 ? packedPackages : packedPackages[0], null, 2);
+    }
+    return packedPackages.map(({ name, version, filename, files }) => `${opts.unicode ? '📦 ' : 'package:'} ${name}@${version}
+${chalk.blueBright('Tarball Contents')}
+${files.map(({ path }) => path).join('\n')}
+${chalk.blueBright('Tarball Details')}
+${filename}`).join('\n\n');
+}
+export async function api(opts) {
+    const { manifest: entryManifest, fileName: manifestFileName } = await readProjectManifest(opts.dir, opts);
+    preventBundledDependenciesWithoutHoistedNodeLinker(opts.nodeLinker, entryManifest);
+    const _runScriptsIfPresent = runScriptsIfPresent.bind(null, {
+        depPath: opts.dir,
+        extraBinPaths: opts.extraBinPaths,
+        extraEnv: opts.extraEnv,
+        pkgRoot: opts.dir,
+        rootModulesDir: await realpathMissing(path.join(opts.dir, 'node_modules')),
+        stdio: 'inherit',
+        unsafePerm: true, // when running scripts explicitly, assume that they're trusted.
+        userAgent: opts.userAgent,
+    });
+    if (!opts.ignoreScripts) {
+        await _runScriptsIfPresent([
+            'prepack',
+            'prepare',
+        ], entryManifest);
+    }
+    const dir = entryManifest.publishConfig?.directory
+        ? path.join(opts.dir, entryManifest.publishConfig.directory)
+        : opts.dir;
+    // always read the latest manifest, as "prepack" or "prepare" script may modify package manifest.
+    const { manifest } = await readProjectManifest(dir, opts);
+    preventBundledDependenciesWithoutHoistedNodeLinker(opts.nodeLinker, manifest);
+    if (!manifest.name) {
+        throw new PnpmError('PACKAGE_NAME_NOT_FOUND', `Package name is not defined in the ${manifestFileName}.`);
+    }
+    if (!validateNpmPackageName(manifest.name).validForOldPackages) {
+        throw new PnpmError('INVALID_PACKAGE_NAME', `Invalid package name "${manifest.name}".`);
+    }
+    if (!manifest.version) {
+        throw new PnpmError('PACKAGE_VERSION_NOT_FOUND', `Package version is not defined in the ${manifestFileName}.`);
+    }
+    const publishManifest = await createPublishManifest({
+        projectDir: dir,
+        modulesDir: path.join(opts.dir, 'node_modules'),
+        manifest,
+        embedReadme: opts.embedReadme,
+        catalogs: opts.catalogs ?? {},
+        hooks: opts.hooks,
+        skipManifestObfuscation: opts.skipManifestObfuscation,
+    });
+    // Strip semver build metadata (the `+<build>` segment) from the published version so that
+    // the tarball, the manifest packed inside it, and the metadata sent to the registry all agree.
+    // libnpmpublish runs `semver.clean()` on `manifest.version` before computing the provenance
+    // subject, which removes build metadata. Leaving it in here would mismatch the version embedded
+    // in the tarball's package.json and cause the registry to reject the publish with a 422 when
+    // verifying the sigstore provenance bundle. See https://github.com/pnpm/pnpm/issues/11518.
+    publishManifest.version = stripBuildMetadata(publishManifest.version);
+    let tarballName;
+    let packDestination;
+    // Read back off the publish manifest so a `publishConfig.name` rename reaches
+    // the filename too — the tarball name, the packed manifest, and the registry
+    // metadata all name one artifact. The rename never went through the check on
+    // `manifest.name` above, so it is validated here: it lands in the tarball
+    // filename, where a separator would smuggle path components into the join and
+    // write outside the pack destination.
+    const publishedName = publishManifest.name || manifest.name;
+    if (!validateNpmPackageName(publishedName).validForOldPackages) {
+        throw new PnpmError('INVALID_PACKAGE_NAME', `Invalid package name "${publishedName}".`);
+    }
+    const normalizedName = normalizePackageName(publishedName);
+    if (opts.out) {
+        if (opts.packDestination) {
+            throw new PnpmError('INVALID_OPTION', 'Cannot use --pack-destination and --out together');
+        }
+        const preparedOut = opts.out.replaceAll('%s', normalizedName).replaceAll('%v', publishManifest.version);
+        const parsedOut = path.parse(preparedOut);
+        packDestination = parsedOut.dir ? parsedOut.dir : opts.packDestination;
+        tarballName = parsedOut.base;
+    }
+    else {
+        tarballName = `${normalizedName}-${publishManifest.version}.tgz`;
+        packDestination = opts.packDestination;
+    }
+    const files = await packlist(dir, {
+        manifest: publishManifest,
+        workspaceDir: opts.workspaceDir,
+    });
+    const filesMap = Object.fromEntries(files.map((file) => [`package/${file}`, path.join(dir, file)]));
+    // cspell:disable-next-line
+    if (opts.workspaceDir != null && dir !== opts.workspaceDir && !files.some((file) => /LICEN[CS]E(?:\..+)?/i.test(file))) {
+        const { workspaceDir } = opts;
+        const licenses = await glob([LICENSE_GLOB], { cwd: workspaceDir, expandDirectories: false });
+        await Promise.all(licenses.map(async (license) => {
+            const licensePath = path.join(workspaceDir, license);
+            // Only inject a regular file. A symlink could point outside the workspace and leak its
+            // target's bytes into the published tarball, so `lstat()` (which does not follow symlinks)
+            // rejects it — matching pacquet's inject_workspace_license.
+            const stats = await fs.promises.lstat(licensePath);
+            if (stats.isFile()) {
+                filesMap[`package/${license}`] = licensePath;
+            }
+        }));
+    }
+    // In `registry` changelog storage the package carries no committed
+    // CHANGELOG.md; its section was parked at `pnpm version -r` time and is
+    // composed here on top of the previously published version's changelog and
+    // packed in. A composed entry supersedes any stale committed CHANGELOG.md.
+    const injectedEntries = {};
+    const composedChangelog = await composeRegistryChangelog(opts, manifest.name, publishedName, manifest.version);
+    if (composedChangelog != null) {
+        delete filesMap['package/CHANGELOG.md'];
+        injectedEntries['package/CHANGELOG.md'] = composedChangelog;
+    }
+    const destDir = packDestination
+        ? (path.isAbsolute(packDestination) ? packDestination : path.join(dir, packDestination ?? '.'))
+        : dir;
+    if (!opts.dryRun) {
+        await fs.promises.mkdir(destDir, { recursive: true });
+    }
+    // Derive `contents` and `unpackedSize` from `filesMap` (the full set of tar entries) rather than
+    // from `files` (the packlist subset) so that:
+    //   - workspace LICENSE files appended to `filesMap` after the packlist call are included; and
+    //   - `package.yaml` / `package.json5` entries are reported under the name they actually have in
+    //     the tar (`package.json`), since `packPkg()` rewrites them.
+    // The `stat()` pass must run before `postpack`, which may delete prepack-generated files that
+    // were packed. See https://github.com/pnpm/pnpm/issues/12775.
+    const sizes = await Promise.all(Object.entries(filesMap).map(async ([name, source]) => {
+        if (isManifestEntry(name)) {
+            return Buffer.byteLength(JSON.stringify(publishManifest, null, 2));
+        }
+        const stat = await fs.promises.stat(source);
+        return stat.size;
+    }));
+    const injectedSize = Object.values(injectedEntries).reduce((acc, content) => acc + Buffer.byteLength(content), 0);
+    const unpackedSize = sizes.reduce((acc, size) => acc + size, 0) + injectedSize;
+    const packedContents = Array.from(new Set([
+        ...Object.keys(filesMap).map((name) => isManifestEntry(name)
+            ? 'package.json'
+            : name.replace(/^package\//, '')),
+        ...Object.keys(injectedEntries).map((name) => name.replace(/^package\//, '')),
+    ])).sort((a, b) => a.localeCompare(b, 'en'));
+    if (!opts.dryRun) {
+        await packPkg({
+            destFile: path.join(destDir, tarballName),
+            filesMap,
+            injectedEntries,
+            modulesDir: path.join(opts.dir, 'node_modules'),
+            packGzipLevel: opts.packGzipLevel,
+            manifest: publishManifest,
+            bins: [
+                ...(await getBinsFromPackageManifest(publishManifest, dir)).map(({ path }) => path),
+                ...(manifest.publishConfig?.executableFiles ?? [])
+                    .map((executableFile) => path.join(dir, executableFile)),
+            ],
+        });
+        if (!opts.ignoreScripts) {
+            await _runScriptsIfPresent(['postpack'], entryManifest);
+        }
+    }
+    let packedTarballPath;
+    if (opts.dir !== destDir) {
+        packedTarballPath = path.join(destDir, tarballName);
+    }
+    else {
+        packedTarballPath = path.relative(opts.dir, path.join(dir, tarballName));
+    }
+    return {
+        publishedManifest: await withRegistryReadme(publishManifest, dir),
+        contents: packedContents,
+        tarballPath: packedTarballPath,
+        unpackedSize,
+    };
+}
+/**
+ * The readme is always sent to the registry as package metadata, matching the npm CLI, so that
+ * registries can render it on the package page. The `embed-readme` setting only controls whether
+ * the readme is additionally written into the `package.json` inside the tarball (via
+ * `createExportableManifest`), which is why it is added to the returned manifest here rather than
+ * to the packed one.
+ */
+async function withRegistryReadme(manifest, projectDir) {
+    if (manifest.readme != null)
+        return manifest;
+    const readme = await readReadmeFile(projectDir);
+    if (readme == null)
+        return manifest;
+    return { ...manifest, readme };
+}
+// True when a `package/<path>` tar key names the package manifest, which is
+// packed as a single serialized `package/package.json` entry and reported as
+// `package.json` in the contents listing regardless of the source file name.
+function isManifestEntry(name) {
+    return name === 'package/package.json' || name === 'package/package.json5' || name === 'package/package.yaml';
+}
+/**
+ * The CHANGELOG.md to pack for a `registry`-storage release: its parked
+ * section (written at `pnpm version -r` time) rendered on top of the
+ * previously published version's changelog. `undefined` when storage is
+ * `repository`, there is no workspace, or the release has no parked section
+ * (an ordinary `pnpm pack` of a package that is not mid-release).
+ */
+/**
+ * `pkgName` keys the parked section — the workspace, the ledger, and every
+ * intent address the project by its manifest name. `publishedName` is the only
+ * name the registry knows, so it selects the previous changelog to build on and
+ * titles the composed one.
+ */
+async function composeRegistryChangelog(opts, pkgName, publishedName, version) {
+    if (changelogStorage(opts.versioning) !== 'registry' || opts.workspaceDir == null)
+        return undefined;
+    const section = await readPendingChangelog(opts.workspaceDir, pkgName, version);
+    if (section == null)
+        return undefined;
+    const previous = opts.registries != null
+        ? await fetchPreviousChangelog(opts, publishedName, version)
+        : undefined;
+    return renderChangelog(previous ?? null, publishedName, section);
+}
+function stripBuildMetadata(version) {
+    const plusIndex = version.indexOf('+');
+    return plusIndex === -1 ? version : version.slice(0, plusIndex);
+}
+function preventBundledDependenciesWithoutHoistedNodeLinker(nodeLinker, manifest) {
+    if (nodeLinker === 'hoisted')
+        return;
+    for (const key of ['bundledDependencies', 'bundleDependencies']) {
+        const bundledDependencies = manifest[key];
+        if (bundledDependencies) {
+            throw new PnpmError('BUNDLED_DEPENDENCIES_WITHOUT_HOISTED', `${key} does not work with "nodeLinker: ${nodeLinker}"`, {
+                hint: `Add "nodeLinker: hoisted" to pnpm-workspace.yaml or delete ${key} from the root package.json to resolve this error`,
+            });
+        }
+    }
+}
+async function packPkg(opts) {
+    const { destFile, filesMap, injectedEntries, bins, manifest, } = opts;
+    const mtime = new Date('1985-10-26T08:15:00.000Z');
+    const pack = tar.pack();
+    await Promise.all(Object.entries(filesMap).map(async ([name, source]) => {
+        const isExecutable = bins.some((bin) => path.relative(bin, source) === '');
+        const mode = isExecutable ? 0o755 : 0o644;
+        if (isManifestEntry(name)) {
+            pack.entry({ mode, mtime, name: 'package/package.json' }, JSON.stringify(manifest, null, 2));
+            return;
+        }
+        pack.entry({ mode, mtime, name }, fs.readFileSync(source));
+    }));
+    for (const [name, content] of Object.entries(injectedEntries ?? {})) {
+        pack.entry({ mode: 0o644, mtime, name }, content);
+    }
+    const tarball = fs.createWriteStream(destFile);
+    pack.pipe(createGzip({ level: opts.packGzipLevel })).pipe(tarball);
+    pack.finalize();
+    return new Promise((resolve, reject) => {
+        tarball.on('close', () => {
+            resolve();
+        }).on('error', reject);
+    });
+}
+async function createPublishManifest(opts) {
+    const { projectDir, embedReadme, modulesDir, manifest, catalogs, hooks, skipManifestObfuscation } = opts;
+    return createExportableManifest(projectDir, manifest, {
+        catalogs,
+        hooks,
+        embedReadme,
+        modulesDir,
+        skipManifestObfuscation,
+    });
+}
+function toPackResultJson(packResult) {
+    const { publishedManifest, contents, tarballPath } = packResult;
+    return {
+        name: publishedManifest.name,
+        version: publishedManifest.version,
+        filename: tarballPath,
+        files: contents.map((file) => ({ path: file })),
+    };
+}
+//# sourceMappingURL=pack.js.map

package/lib/publish/previousChangelog.d.ts

@@ -0,0 +1,25 @@
+import type { Config } from '@pnpm/config.reader';
+import { type CreateFetchFromRegistryOptions } from '@pnpm/network.fetch';
+export type PreviousChangelogOptions = CreateFetchFromRegistryOptions & Pick<Config, 'registries' | 'fetchRetries' | 'fetchRetryFactor' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'fetchTimeout'>;
+/**
+ * The `CHANGELOG.md` packed into the highest published version of `pkgName`
+ * that is semver-lower than `version` — the changelog the section for
+ * `version` is prepended onto in `registry` storage. `undefined` when the
+ * package is new, has no earlier published version, or that version's tarball
+ * carried no changelog.
+ */
+export declare function fetchPreviousChangelog(opts: PreviousChangelogOptions, pkgName: string, version: string): Promise<string | undefined>;
+/**
+ * The `CHANGELOG.md` packed into the published `pkgName@version` exactly, or
+ * `undefined` when that version is not published (or carried no changelog).
+ * Used to confirm a release actually carries its composed section before the
+ * intents behind it are garbage-collected.
+ */
+export declare function fetchPublishedChangelog(opts: PreviousChangelogOptions, pkgName: string, version: string): Promise<string | undefined>;
+export declare function changelogHasSection(changelog: string, section: string): boolean;
+/**
+ * Whether `pkgName@version` is published, reusing one client across the batch.
+ * `fetchPackument` returning `undefined` always means the 404 (unpublished): the
+ * probe sends no cache validator, so it never yields a 304 not-modified.
+ */
+export declare function createVersionPublishedChecker(opts: PreviousChangelogOptions): (pkgName: string, version: string) => Promise<boolean>;

package/lib/publish/previousChangelog.js

@@ -0,0 +1,194 @@
+import { gunzipSync } from 'node:zlib';
+import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
+import { PnpmError } from '@pnpm/error';
+import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
+import { createFetchFromRegistry } from '@pnpm/network.fetch';
+import { fetchMetadataFromFromRegistry } from '@pnpm/resolving.npm-resolver';
+import { lt, rsort, valid } from 'semver';
+import tar from 'tar-stream';
+const CHANGELOG_ENTRY = 'package/CHANGELOG.md';
+/**
+ * Caps the previous tarball we buffer and decompress to compose the changelog.
+ * The bytes come from a registry/proxy, so an unbounded read or a highly
+ * compressible ("gzip bomb") tarball could OOM release automation. A composed
+ * changelog is best-effort — exceeding the cap just skips the history prepend —
+ * so this bound can be generous while still defeating the amplification attack.
+ */
+const MAX_TARBALL_BYTES = 256 * 1024 * 1024;
+function createRegistryClient(opts) {
+    return {
+        fetch: createFetchFromRegistry(opts),
+        getAuthHeader: createGetAuthHeaderByURI(opts.configByUri ?? {}),
+    };
+}
+/**
+ * The `CHANGELOG.md` packed into the highest published version of `pkgName`
+ * that is semver-lower than `version` — the changelog the section for
+ * `version` is prepended onto in `registry` storage. `undefined` when the
+ * package is new, has no earlier published version, or that version's tarball
+ * carried no changelog.
+ */
+export async function fetchPreviousChangelog(opts, pkgName, version) {
+    const client = createRegistryClient(opts);
+    const meta = await fetchPackument(client, opts, pkgName);
+    if (meta == null)
+        return undefined;
+    const previousVersion = pickPreviousVersion(meta, version);
+    if (previousVersion == null)
+        return undefined;
+    return downloadTarballChangelog(client, pkgName, meta, previousVersion);
+}
+/**
+ * The `CHANGELOG.md` packed into the published `pkgName@version` exactly, or
+ * `undefined` when that version is not published (or carried no changelog).
+ * Used to confirm a release actually carries its composed section before the
+ * intents behind it are garbage-collected.
+ */
+export async function fetchPublishedChangelog(opts, pkgName, version) {
+    const client = createRegistryClient(opts);
+    const meta = await fetchPackument(client, opts, pkgName);
+    if (meta?.versions[version] == null)
+        return undefined;
+    return downloadTarballChangelog(client, pkgName, meta, version);
+}
+export function changelogHasSection(changelog, section) {
+    return changelog.includes(section.trim());
+}
+/**
+ * Whether `pkgName@version` is published, reusing one client across the batch.
+ * `fetchPackument` returning `undefined` always means the 404 (unpublished): the
+ * probe sends no cache validator, so it never yields a 304 not-modified.
+ */
+export function createVersionPublishedChecker(opts) {
+    const client = createRegistryClient(opts);
+    return async (pkgName, version) => {
+        const meta = await fetchPackument(client, opts, pkgName);
+        return meta?.versions[version] != null;
+    };
+}
+async function fetchPackument(client, opts, pkgName) {
+    const registry = pickRegistryForPackage(opts.registries, pkgName);
+    let fetchResult;
+    try {
+        fetchResult = await fetchMetadataFromFromRegistry({
+            fetch: client.fetch,
+            retry: {
+                factor: opts.fetchRetryFactor,
+                maxTimeout: opts.fetchRetryMaxtimeout,
+                minTimeout: opts.fetchRetryMintimeout,
+                retries: opts.fetchRetries,
+            },
+            timeout: opts.fetchTimeout ?? 60000,
+            fetchWarnTimeoutMs: 10000,
+        }, pkgName, {
+            registry,
+            authHeaderValue: client.getAuthHeader(registry, { pkgName }),
+            fullMetadata: false,
+        });
+    }
+    catch (err) {
+        // A package with no published version yet has no changelog to build on.
+        if (err != null && typeof err === 'object' && 'code' in err && err.code === 'ERR_PNPM_FETCH_404') {
+            return undefined;
+        }
+        throw err;
+    }
+    return fetchResult.notModified ? undefined : fetchResult.meta;
+}
+/** Highest published version of the package that is semver-lower than `version`. */
+function pickPreviousVersion(meta, version) {
+    const candidates = Object.keys(meta.versions).filter((candidate) => valid(candidate) != null && lt(candidate, version));
+    return candidates.length > 0 ? rsort(candidates)[0] : undefined;
+}
+async function downloadTarballChangelog(client, pkgName, meta, version) {
+    const tarballUrl = meta.versions[version]?.dist?.tarball;
+    if (tarballUrl == null)
+        return undefined;
+    const response = await client.fetch(tarballUrl, { authHeaderValue: client.getAuthHeader(tarballUrl, { pkgName }) });
+    if (!response.ok) {
+        throw new PnpmError('CHANGELOG_TARBALL_FETCH_FAILED', `Failed to download ${pkgName}@${version} tarball (${response.status}) to compose the changelog: ${tarballUrl}`);
+    }
+    const tarballData = await readCapped(response, MAX_TARBALL_BYTES);
+    if (tarballData == null)
+        return undefined;
+    return extractTarballEntry(tarballData, CHANGELOG_ENTRY);
+}
+/**
+ * Reads a response body into a buffer, stopping (and returning `undefined`) as
+ * soon as it exceeds `maxBytes` — bounding the actual download rather than
+ * trusting a `content-length` header, which may be absent or lie.
+ */
+async function readCapped(response, maxBytes) {
+    const reader = response.body?.getReader();
+    if (reader == null) {
+        const buffer = Buffer.from(await response.arrayBuffer());
+        return buffer.byteLength > maxBytes ? undefined : buffer;
+    }
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        // Streaming a body is inherently sequential — each read must await the
+        // previous chunk — so the successive awaits here are intentional.
+        // eslint-disable-next-line no-await-in-loop
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > maxBytes) {
+            // Best-effort cleanup: a cancel failure must not turn the over-cap path
+            // into a hard error — the caller just gets no changelog either way.
+            // eslint-disable-next-line no-await-in-loop
+            await reader.cancel().catch(() => { });
+            return undefined;
+        }
+        chunks.push(Buffer.from(value));
+    }
+    return Buffer.concat(chunks);
+}
+/**
+ * Reads one entry's contents out of a (optionally gzipped) tarball buffer.
+ * Composing the changelog is best-effort, so any decode/parse failure —
+ * including a gzip bomb tripping the inflate cap — resolves to `undefined`
+ * (no history prepend) rather than throwing.
+ */
+async function extractTarballEntry(tarballData, entryName) {
+    const tarData = gunzipCapped(tarballData);
+    if (tarData == null)
+        return undefined;
+    const extract = tar.extract();
+    return new Promise((resolve) => {
+        let contents;
+        extract.on('entry', (header, stream, next) => {
+            if (header.name !== entryName) {
+                stream.resume();
+                stream.on('end', next);
+                stream.on('error', () => resolve(undefined));
+                return;
+            }
+            const chunks = [];
+            stream.on('data', (chunk) => chunks.push(Buffer.from(chunk)));
+            stream.on('error', () => resolve(undefined));
+            stream.on('end', () => {
+                contents = Buffer.concat(chunks).toString('utf8');
+                next();
+            });
+        });
+        extract.on('error', () => resolve(undefined));
+        extract.on('finish', () => resolve(contents));
+        extract.end(tarData);
+    });
+}
+/**
+ * Inflates a published `.tgz`, capped at `MAX_TARBALL_BYTES` of output so a
+ * gzip bomb throws rather than ballooning memory. Returns `undefined` on that
+ * cap or any other decode failure — the caller treats it as no changelog.
+ */
+function gunzipCapped(tarballData) {
+    try {
+        return gunzipSync(tarballData, { maxOutputLength: MAX_TARBALL_BYTES });
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=previousChangelog.js.map