@pnpm/resolving.resolver-base - npm Package Compare versions

Comparing version 1100.4.2 to 1100.5.0

lib/index.d.ts

@@ -61,2 +61,14 @@ import type { DependencyManifest, PackageManifest, PackageVersionPolicy, PinnedVersion, PkgResolutionId, ProjectRootDir, SupportedArchitectures, TrustPolicy } from '@pnpm/types';
 /**
+ * A tarball URL is git-hosted when it points at a known git provider's immutable
+ * archive endpoint. The result gates integrity exemptions, so the match is
+ * limited to provider-specific path shapes whose ref is a full commit SHA.
+ */
+export declare function isGitHostedTarballUrl(url: string): boolean;
+export type ResolutionKind = 'localTarball' | 'gitHostedTarball' | 'remoteTarball' | 'directory' | 'git' | 'binary' | 'custom';
+/**
+ * Classifies a resolution for fetcher selection. Lockfile-provided flags are
+ * treated as hints; integrity exemptions depend on the resolved source shape.
+ */
+export declare function classifyResolution(resolution: Resolution): ResolutionKind;
+/**
  * Outcome of asking a `ResolutionVerifier` whether a (name, version,
@@ -63,0 +75,0 @@ * resolution) entry from a lockfile is acceptable under whatever policies

lib/index.js

 export {};
+const GIT_COMMIT_SHA = /^[0-9a-f]{40}$/i;
 /**
+ * A tarball URL is git-hosted when it points at a known git provider's immutable
+ * archive endpoint. The result gates integrity exemptions, so the match is
+ * limited to provider-specific path shapes whose ref is a full commit SHA.
+ */
+export function isGitHostedTarballUrl(url) {
+    if (typeof url !== 'string')
+        return false;
+    let parsedUrl;
+    try {
+        parsedUrl = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    if (parsedUrl.protocol !== 'https:')
+        return false;
+    switch (parsedUrl.hostname.toLowerCase()) {
+        case 'codeload.github.com':
+            return isGitHubCodeloadArchive(parsedUrl);
+        case 'bitbucket.org':
+            return isBitbucketArchive(parsedUrl);
+        case 'gitlab.com':
+            return isGitLabArchive(parsedUrl);
+        default:
+            return false;
+    }
+}
+function isGitHubCodeloadArchive(url) {
+    const segments = getPathSegments(url);
+    return segments.length === 4 && segments[2] === 'tar.gz' && GIT_COMMIT_SHA.test(segments[3]);
+}
+function isBitbucketArchive(url) {
+    const segments = getPathSegments(url);
+    if (segments.length !== 4 || segments[2] !== 'get' || !segments[3].endsWith('.tar.gz'))
+        return false;
+    return GIT_COMMIT_SHA.test(segments[3].slice(0, -'.tar.gz'.length));
+}
+function isGitLabArchive(url) {
+    const segments = getPathSegments(url);
+    if (segments.length === 6 &&
+        segments[0] === 'api' &&
+        segments[1] === 'v4' &&
+        segments[2] === 'projects' &&
+        segments[4] === 'repository' &&
+        segments[5] === 'archive.tar.gz') {
+        return GIT_COMMIT_SHA.test(url.searchParams.get('ref') ?? '');
+    }
+    const archiveMarkerIndex = segments.findIndex((segment, index) => segment === '-' && segments[index + 1] === 'archive');
+    if (archiveMarkerIndex < 2)
+        return false;
+    const ref = segments[archiveMarkerIndex + 2];
+    const archiveName = segments[archiveMarkerIndex + 3];
+    return segments.length === archiveMarkerIndex + 4 &&
+        archiveName?.endsWith('.tar.gz') === true &&
+        GIT_COMMIT_SHA.test(ref);
+}
+function getPathSegments(url) {
+    return url.pathname.split('/').filter(Boolean);
+}
+/**
+ * Classifies a resolution for fetcher selection. Lockfile-provided flags are
+ * treated as hints; integrity exemptions depend on the resolved source shape.
+ */
+export function classifyResolution(resolution) {
+    if (resolution.type == null) {
+        const tarball = typeof resolution.tarball === 'string'
+            ? resolution.tarball
+            : undefined;
+        if (tarball?.startsWith('file:'))
+            return 'localTarball';
+        if (tarball != null && isGitHostedTarballUrl(tarball)) {
+            return 'gitHostedTarball';
+        }
+        return 'remoteTarball';
+    }
+    switch (resolution.type) {
+        case 'directory':
+        case 'git':
+        case 'binary':
+            return resolution.type;
+        default:
+            return 'custom';
+    }
+}
+/**
  * Resolve a {@link PlatformSelector} from the user's supportedArchitectures config
@@ -4,0 +90,0 @@ * and the host's own platform/arch/libc. When `supportedArchitectures.xxx` is set

package.json

 {
   "name": "@pnpm/resolving.resolver-base",
-  "version": "1100.4.2",
+  "version": "1100.5.0",
   "description": "Types for pnpm-compatible resolvers",
@@ -14,5 +14,5 @@ "keywords": [
     "type": "git",
-    "url": "https://github.com/pnpm/pnpm/tree/main/resolving/resolver-base"
+    "url": "https://github.com/pnpm/pnpm/tree/main/pnpm11/resolving/resolver-base"
   },
-  "homepage": "https://github.com/pnpm/pnpm/tree/main/resolving/resolver-base#readme",
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/pnpm11/resolving/resolver-base#readme",
   "bugs": {
@@ -35,3 +35,4 @@ "url": "https://github.com/pnpm/pnpm/issues"
   "devDependencies": {
-    "@pnpm/resolving.resolver-base": "1100.4.2"
+    "@jest/globals": "30.4.1",
+    "@pnpm/resolving.resolver-base": "1100.5.0"
   },
@@ -46,6 +47,7 @@ "engines": {
     "start": "tsgo --watch",
-    "lint": "eslint \"src/**/*.ts\"",
-    "test": "pn compile",
+    "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",
+    "test": "pn compile && pn .test",
+    ".test": "cross-env NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest",
     "compile": "tsgo --build && pn lint --fix"
   }
 }

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

No website

Quality

Package does not have a website.

Improved metrics

Total package byte prevSize

20311

24.1%

Lines of code

426

29.88%

Number of low quality alerts

0

-100%

Worsened metrics

Dev dependency count

2

100%

Number of low supply chain risk alerts

1

Infinity%

No dependency changes