@pnpm/lockfile.fs 1100.1.13 → 1100.1.15

package/lib/read.js

@@ -0,0 +1,203 @@
+import fs, { promises as fsp } from 'node:fs';
+import path from 'node:path';
+import util from 'node:util';
+import { LOCKFILE_VERSION, WANTED_LOCKFILE, } from '@pnpm/constants';
+import { PnpmError } from '@pnpm/error';
+import { mergeLockfileChanges } from '@pnpm/lockfile.merger';
+import { comverToSemver } from 'comver-to-semver';
+import yaml from 'js-yaml';
+import semver from 'semver';
+import stripBom from 'strip-bom';
+import { LockfileBreakingChangeError } from './errors/index.js';
+import { getGitBranchLockfileNames } from './gitBranchLockfile.js';
+import { autofixMergeConflicts, isDiff } from './gitMergeFile.js';
+import { convertToLockfileFile, convertToLockfileObject } from './lockfileFormatConverters.js';
+import { getWantedLockfileName } from './lockfileName.js';
+import { lockfileLogger as logger } from './logger.js';
+import { extractMainDocument } from './yamlDocuments.js';
+export async function readCurrentLockfile(pnpmInternalDir, opts) {
+    const lockfilePath = path.join(pnpmInternalDir, 'lock.yaml');
+    return (await _read(lockfilePath, pnpmInternalDir, opts)).lockfile;
+}
+export async function readWantedLockfileAndAutofixConflicts(pkgPath, opts) {
+    return _readWantedLockfile(pkgPath, {
+        ...opts,
+        autofixMergeConflicts: true,
+    });
+}
+export async function readWantedLockfile(pkgPath, opts) {
+    return (await _readWantedLockfile(pkgPath, opts)).lockfile;
+}
+/**
+ * Read the wanted lockfile in its on-disk shape ({@link LockfileFile}),
+ * skipping the conversion to the in-memory {@link LockfileObject}.
+ *
+ * Use this when the caller needs the exact serialized form — e.g. to
+ * forward the lockfile to a server that speaks the on-disk format —
+ * rather than the in-process representation.
+ */
+export async function readWantedLockfileFile(pkgPath, opts) {
+    return (await _readWantedLockfile(pkgPath, opts)).lockfileFile;
+}
+export function wantedLockfileHasMergeConflictsSync(pkgPath, lockfileName = WANTED_LOCKFILE) {
+    try {
+        const lockfileRawContent = stripBom(fs.readFileSync(path.join(pkgPath, lockfileName), 'utf8'));
+        return isDiff(extractMainDocument(lockfileRawContent));
+    }
+    catch (err) {
+        if (util.types.isNativeError(err) && 'code' in err && err.code === 'ENOENT') {
+            return false;
+        }
+        throw err;
+    }
+}
+async function _read(lockfilePath, prefix, // only for logging
+opts) {
+    let lockfileRawContent;
+    try {
+        lockfileRawContent = stripBom(await fsp.readFile(lockfilePath, 'utf8'));
+    }
+    catch (err) {
+        if (!(util.types.isNativeError(err) && 'code' in err && err.code === 'ENOENT')) {
+            throw err;
+        }
+        return {
+            lockfile: null,
+            lockfileFile: null,
+            hadConflicts: false,
+        };
+    }
+    // Skip the env lockfile document if present (first document in combined format)
+    lockfileRawContent = extractMainDocument(lockfileRawContent);
+    if (!lockfileRawContent.trim()) {
+        return {
+            lockfile: null,
+            lockfileFile: null,
+            hadConflicts: false,
+        };
+    }
+    let lockfile;
+    let lockfileFile;
+    let hadConflicts;
+    try {
+        lockfileFile = yaml.load(lockfileRawContent);
+        lockfile = convertToLockfileObject(lockfileFile);
+        hadConflicts = false;
+    }
+    catch (err) {
+        if (!opts.autofixMergeConflicts || !isDiff(lockfileRawContent)) {
+            throw new PnpmError('BROKEN_LOCKFILE', `The lockfile at "${lockfilePath}" is broken: ${formatLockfileError(err)}`);
+        }
+        hadConflicts = true;
+        lockfile = autofixMergeConflicts(lockfileRawContent);
+        lockfileFile = convertToLockfileFile(lockfile);
+        logger.info({
+            message: `Merge conflict detected in ${WANTED_LOCKFILE} and successfully merged`,
+            prefix,
+        });
+    }
+    if (lockfile) {
+        const lockfileSemver = comverToSemver((lockfile.lockfileVersion ?? 0).toString());
+        if (!opts.wantedVersions ||
+            opts.wantedVersions.length === 0 ||
+            opts.wantedVersions.some((wantedVersion) => {
+                if (semver.major(lockfileSemver) !== semver.major(comverToSemver(wantedVersion)))
+                    return false;
+                if (lockfile.lockfileVersion !== '6.1' && semver.gt(lockfileSemver, comverToSemver(wantedVersion))) {
+                    logger.warn({
+                        message: `Your ${WANTED_LOCKFILE} was generated by a newer version of pnpm. ` +
+                            `It is a compatible version but it might get downgraded to version ${wantedVersion}`,
+                        prefix,
+                    });
+                }
+                return true;
+            })) {
+            return { lockfile, lockfileFile, hadConflicts };
+        }
+    }
+    if (opts.ignoreIncompatible) {
+        logger.warn({
+            message: `Ignoring not compatible lockfile at ${lockfilePath}`,
+            prefix,
+        });
+        return { lockfile: null, lockfileFile: null, hadConflicts: false };
+    }
+    throw new LockfileBreakingChangeError(lockfilePath);
+}
+function formatLockfileError(err) {
+    if (isYamlException(err)) {
+        const reason = typeof err.reason === 'string' ? err.reason : 'Unable to parse YAML';
+        const line = err.mark?.line;
+        const column = err.mark?.column;
+        const position = typeof line === 'number' && Number.isFinite(line) &&
+            typeof column === 'number' && Number.isFinite(column)
+            ? ` (${line + 1}:${column + 1})`
+            : '';
+        return `${reason}${position}`;
+    }
+    return util.types.isNativeError(err) ? err.message : String(err);
+}
+function isYamlException(err) {
+    return typeof err === 'object' && err !== null &&
+        'name' in err && err.name === 'YAMLException';
+}
+export function createLockfileObject(importerIds, opts) {
+    const importers = {};
+    for (const importerId of importerIds) {
+        importers[importerId] = {
+            dependencies: {},
+            specifiers: {},
+        };
+    }
+    return {
+        importers,
+        lockfileVersion: opts.lockfileVersion || LOCKFILE_VERSION,
+        settings: {
+            autoInstallPeers: opts.autoInstallPeers,
+            excludeLinksFromLockfile: opts.excludeLinksFromLockfile,
+            peersSuffixMaxLength: opts.peersSuffixMaxLength,
+        },
+    };
+}
+async function _readWantedLockfile(pkgPath, opts) {
+    const lockfileNames = [WANTED_LOCKFILE];
+    if (opts.useGitBranchLockfile) {
+        const gitBranchLockfileName = await getWantedLockfileName(opts);
+        if (gitBranchLockfileName !== WANTED_LOCKFILE) {
+            lockfileNames.unshift(gitBranchLockfileName);
+        }
+    }
+    let result = { lockfile: null, lockfileFile: null, hadConflicts: false };
+    /* eslint-disable no-await-in-loop */
+    for (const lockfileName of lockfileNames) {
+        result = await _read(path.join(pkgPath, lockfileName), pkgPath, { ...opts, autofixMergeConflicts: true });
+        if (result.lockfile) {
+            if (opts.mergeGitBranchLockfiles) {
+                result.lockfile = await _mergeGitBranchLockfiles(result.lockfile, pkgPath, pkgPath, opts);
+                result.lockfileFile = result.lockfile ? convertToLockfileFile(result.lockfile) : null;
+            }
+            break;
+        }
+    }
+    /* eslint-enable no-await-in-loop */
+    return result;
+}
+async function _mergeGitBranchLockfiles(lockfile, lockfileDir, prefix, opts) {
+    if (!lockfile) {
+        return lockfile;
+    }
+    const gitBranchLockfiles = (await _readGitBranchLockfiles(lockfileDir, prefix, opts)).map(({ lockfile }) => lockfile);
+    let mergedLockfile = lockfile;
+    for (const gitBranchLockfile of gitBranchLockfiles) {
+        if (!gitBranchLockfile) {
+            continue;
+        }
+        mergedLockfile = mergeLockfileChanges(mergedLockfile, gitBranchLockfile);
+    }
+    return mergedLockfile;
+}
+async function _readGitBranchLockfiles(lockfileDir, prefix, opts) {
+    const files = await getGitBranchLockfileNames(lockfileDir);
+    return Promise.all(files.map((file) => _read(path.join(lockfileDir, file), prefix, opts)));
+}
+//# sourceMappingURL=read.js.map

package/lib/sortLockfileKeys.d.ts

@@ -0,0 +1,3 @@
+import type { EnvLockfile, LockfileFile } from '@pnpm/lockfile.types';
+export declare function sortLockfileKeys(lockfile: LockfileFile): LockfileFile;
+export declare function sortLockfileKeys(lockfile: EnvLockfile): EnvLockfile;

package/lib/sortLockfileKeys.js

@@ -0,0 +1,78 @@
+import { sortDeepKeys, sortDirectKeys, sortKeysByPriority } from '@pnpm/object.key-sorting';
+const ORDERED_KEYS = {
+    resolution: 1,
+    id: 2,
+    name: 3,
+    version: 4,
+    engines: 5,
+    cpu: 6,
+    os: 7,
+    libc: 8,
+    deprecated: 9,
+    hasBin: 10,
+    prepare: 11,
+    requiresBuild: 12,
+    bundleDependencies: 13,
+    peerDependencies: 14,
+    peerDependenciesMeta: 15,
+    dependencies: 16,
+    optionalDependencies: 17,
+    transitivePeerDependencies: 18,
+    dev: 19,
+    optional: 20,
+};
+const ROOT_KEYS = [
+    'lockfileVersion',
+    'settings',
+    'catalogs',
+    'overrides',
+    'packageExtensionsChecksum',
+    'pnpmfileChecksum',
+    'patchedDependencies',
+    'importers',
+    'packages',
+];
+const ROOT_KEYS_ORDER = Object.fromEntries(ROOT_KEYS.map((key, index) => [key, index]));
+export function sortLockfileKeys(lockfile) {
+    if (lockfile.importers != null) {
+        lockfile.importers = sortDirectKeys(lockfile.importers);
+        for (const [importerId, importer] of Object.entries(lockfile.importers)) {
+            lockfile.importers[importerId] = sortKeysByPriority({
+                priority: ROOT_KEYS_ORDER,
+                deep: true,
+            }, importer);
+        }
+    }
+    if (lockfile.packages != null) {
+        lockfile.packages = sortDirectKeys(lockfile.packages);
+        for (const [pkgId, pkg] of Object.entries(lockfile.packages)) {
+            lockfile.packages[pkgId] = sortKeysByPriority({
+                priority: ORDERED_KEYS,
+                deep: true,
+            }, pkg);
+        }
+    }
+    if (lockfile.snapshots != null) {
+        lockfile.snapshots = sortDirectKeys(lockfile.snapshots);
+        for (const [pkgId, pkg] of Object.entries(lockfile.snapshots)) {
+            lockfile.snapshots[pkgId] = sortKeysByPriority({
+                priority: ORDERED_KEYS,
+                deep: true,
+            }, pkg);
+        }
+    }
+    if ('catalogs' in lockfile && lockfile.catalogs != null) {
+        lockfile.catalogs = sortDirectKeys(lockfile.catalogs);
+        for (const [catalogName, catalog] of Object.entries(lockfile.catalogs)) {
+            lockfile.catalogs[catalogName] = sortDeepKeys(catalog);
+        }
+    }
+    if ('time' in lockfile && lockfile.time != null) {
+        lockfile.time = sortDirectKeys(lockfile.time);
+    }
+    if ('patchedDependencies' in lockfile && lockfile.patchedDependencies != null) {
+        lockfile.patchedDependencies = sortDirectKeys(lockfile.patchedDependencies);
+    }
+    return sortKeysByPriority({ priority: ROOT_KEYS_ORDER }, lockfile);
+}
+//# sourceMappingURL=sortLockfileKeys.js.map

package/lib/write.d.ts

@@ -0,0 +1,39 @@
+import type { LockfileFile, LockfileObject } from '@pnpm/lockfile.types';
+export declare function lockfileYamlDump(obj: object): string;
+/**
+ * Returns the canonical post-write lockfile — structurally identical
+ * to what `readWantedLockfile` would parse back. Lets callers like
+ * the verification cache hash the as-saved form without re-reading.
+ */
+export declare function writeWantedLockfile(pkgPath: string, wantedLockfile: LockfileObject, opts?: {
+    useGitBranchLockfile?: boolean;
+    mergeGitBranchLockfiles?: boolean;
+    /** Pre-resolved filename; skips the `getWantedLockfileName` (and
+     *  its `getCurrentBranch`) call when supplied. */
+    lockfileName?: string;
+}): Promise<LockfileObject>;
+export declare function writeCurrentLockfile(virtualStoreDir: string, currentLockfile: LockfileObject): Promise<LockfileObject | undefined>;
+export declare function writeLockfileFile(lockfilePath: string, wantedLockfile: LockfileFile): Promise<void>;
+export declare function isEmptyLockfile(lockfile: LockfileObject): boolean;
+export interface WriteLockfilesResult {
+    /**
+     * The canonical "as-saved" wanted lockfile — the inverse converter
+     * applied to the same object that was serialized to YAML. Hashing
+     * this is equivalent to hashing the lockfile the next install will
+     * load from disk (modulo undefined values that YAML drops, which any
+     * sensible canonicalization-then-hash routine should strip).
+     */
+    wantedLockfile: LockfileObject;
+    /** Same as above for the current lockfile, or undefined when it was skipped because empty. */
+    currentLockfile: LockfileObject | undefined;
+}
+export declare function writeLockfiles(opts: {
+    wantedLockfile: LockfileObject;
+    wantedLockfileDir: string;
+    currentLockfile: LockfileObject;
+    currentLockfileDir: string;
+    useGitBranchLockfile?: boolean;
+    mergeGitBranchLockfiles?: boolean;
+    /** See {@link writeWantedLockfile}'s `lockfileName` option. */
+    wantedLockfileName?: string;
+}): Promise<WriteLockfilesResult>;

package/lib/write.js

@@ -0,0 +1,203 @@
+import { randomUUID } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { WANTED_LOCKFILE } from '@pnpm/constants';
+import { rimraf } from '@zkochan/rimraf';
+import yaml from 'js-yaml';
+import { isEmpty } from 'ramda';
+import writeFileAtomic from 'write-file-atomic';
+import { convertToLockfileFile, convertToLockfileObject } from './lockfileFormatConverters.js';
+import { getWantedLockfileName } from './lockfileName.js';
+import { lockfileLogger as logger } from './logger.js';
+import { sortLockfileKeys } from './sortLockfileKeys.js';
+import { ensureLockfileIsNotSymlink, extractEnvDocument, readLockfileToString, YAML_DOCUMENT_SEPARATOR, YAML_DOCUMENT_START } from './yamlDocuments.js';
+const LOCKFILE_YAML_FORMAT = {
+    blankLines: true,
+    lineWidth: -1,
+    noCompatMode: true,
+    noRefs: true,
+    sortKeys: false,
+};
+export function lockfileYamlDump(obj) {
+    return yaml.dump(obj, LOCKFILE_YAML_FORMAT);
+}
+/**
+ * Returns the canonical post-write lockfile — structurally identical
+ * to what `readWantedLockfile` would parse back. Lets callers like
+ * the verification cache hash the as-saved form without re-reading.
+ */
+export async function writeWantedLockfile(pkgPath, wantedLockfile, opts) {
+    const wantedLockfileName = opts?.lockfileName ?? await getWantedLockfileName(opts);
+    return writeLockfile(wantedLockfileName, pkgPath, wantedLockfile);
+}
+export async function writeCurrentLockfile(virtualStoreDir, currentLockfile) {
+    // empty lockfile is not saved
+    if (isEmptyLockfile(currentLockfile)) {
+        await rimraf(path.join(virtualStoreDir, 'lock.yaml'));
+        return undefined;
+    }
+    await fs.mkdir(virtualStoreDir, { recursive: true });
+    return writeLockfile('lock.yaml', virtualStoreDir, currentLockfile);
+}
+async function writeLockfile(lockfileFilename, pkgPath, wantedLockfile) {
+    const lockfilePath = path.join(pkgPath, lockfileFilename);
+    const lockfileToStringify = convertToLockfileFile(wantedLockfile);
+    const yamlDoc = yamlStringify(lockfileToStringify);
+    await writeLockfileDoc(lockfilePath, lockfileFilename, yamlDoc);
+    // YAML drops undefined on serialize, so the in-memory LockfileFile
+    // can carry fields (like an unset settings.dedupePeers) that won't
+    // survive a round-trip; strip them to mirror what the next reader
+    // will parse back.
+    return convertToLockfileObject(stripUndefinedDeep(lockfileToStringify));
+}
+/**
+ * Writes a serialized lockfile, re-reading the env document that leads
+ * `pnpm-lock.yaml` to preserve it. Ideally it would be captured during the
+ * initial lockfile read and passed through, but that would require threading it
+ * through 25+ call sites; re-reading is cheap since the file is likely still in
+ * the OS page cache.
+ */
+async function writeLockfileDoc(lockfilePath, lockfileName, mainDoc) {
+    if (lockfileName !== WANTED_LOCKFILE) {
+        await writeFileAtomic(lockfilePath, mainDoc);
+        return;
+    }
+    const existing = await readLockfileToString(lockfilePath);
+    const envDoc = existing == null ? null : extractEnvDocument(existing);
+    const content = envDoc == null
+        ? mainDoc
+        : `${YAML_DOCUMENT_START}${envDoc}${YAML_DOCUMENT_SEPARATOR}${mainDoc}`;
+    if (existing === content)
+        return;
+    await writeWantedLockfileAtomic(lockfilePath, content);
+}
+/**
+ * Publishes with `rename`, not the `write-file-atomic` used elsewhere here:
+ * `rename` never resolves the final path component, so a symlink swapped in
+ * after {@link ensureLockfileIsNotSymlink} cannot redirect the write.
+ */
+async function writeWantedLockfileAtomic(lockfilePath, content) {
+    await ensureLockfileIsNotSymlink(lockfilePath);
+    const targetStat = await fs.lstat(lockfilePath).catch((error) => {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    });
+    const tempPath = path.join(path.dirname(lockfilePath), `.${path.basename(lockfilePath)}.${process.pid}.${randomUUID()}.tmp`);
+    let tempFile;
+    try {
+        tempFile = await fs.open(tempPath, 'wx', targetStat?.mode);
+        await tempFile.writeFile(content);
+        if (targetStat != null) {
+            // An install running as root, in a container over a bind-mounted repo,
+            // would otherwise leave the owner a lockfile they cannot write.
+            await tempFile.chown(targetStat.uid, targetStat.gid).catch(ignoreUnprivilegedChown);
+            await tempFile.chmod(targetStat.mode);
+        }
+        await tempFile.sync();
+        await tempFile.close();
+        tempFile = undefined;
+        // Check again at publication time. rename() replaces the final path entry
+        // itself and never resolves it, so a swap after this check cannot redirect
+        // the write through a symlink.
+        await ensureLockfileIsNotSymlink(lockfilePath);
+        await fs.rename(tempPath, lockfilePath);
+    }
+    finally {
+        await tempFile?.close().catch(() => { });
+        await fs.rm(tempPath, { force: true }).catch(() => { });
+    }
+}
+/**
+ * `chown` is refused for an unprivileged process that doesn't own the target,
+ * and unimplemented on some filesystems. Neither is a reason to fail the write.
+ */
+function ignoreUnprivilegedChown(error) {
+    const tolerated = error.code === 'ENOSYS' ||
+        ((process.getuid == null || process.getuid() !== 0) && (error.code === 'EINVAL' || error.code === 'EPERM'));
+    if (!tolerated)
+        throw error;
+}
+function stripUndefinedDeep(value) {
+    if (value === null || typeof value !== 'object')
+        return value;
+    if (Array.isArray(value))
+        return value.map(stripUndefinedDeep);
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+        if (v === undefined)
+            continue;
+        out[k] = stripUndefinedDeep(v);
+    }
+    return out;
+}
+export function writeLockfileFile(lockfilePath, wantedLockfile) {
+    const yamlDoc = yamlStringify(wantedLockfile);
+    return writeFileAtomic(lockfilePath, yamlDoc);
+}
+function yamlStringify(lockfile) {
+    const sortedLockfile = sortLockfileKeys(lockfile);
+    return lockfileYamlDump(sortedLockfile);
+}
+export function isEmptyLockfile(lockfile) {
+    return Object.values(lockfile.importers).every((importer) => isEmpty(importer.specifiers ?? {}) && isEmpty(importer.dependencies ?? {}));
+}
+export async function writeLockfiles(opts) {
+    const wantedLockfileName = opts.wantedLockfileName ?? await getWantedLockfileName(opts);
+    const wantedLockfilePath = path.join(opts.wantedLockfileDir, wantedLockfileName);
+    const currentLockfilePath = path.join(opts.currentLockfileDir, 'lock.yaml');
+    const wantedLockfileToStringify = convertToLockfileFile(opts.wantedLockfile);
+    const yamlDoc = yamlStringify(wantedLockfileToStringify);
+    // in most cases the `pnpm-lock.yaml` and `node_modules/.pnpm-lock.yaml` are equal
+    // in those cases the YAML document can be stringified only once for both files
+    // which is more efficient
+    if (opts.wantedLockfile === opts.currentLockfile) {
+        await Promise.all([
+            writeLockfileDoc(wantedLockfilePath, wantedLockfileName, yamlDoc),
+            (async () => {
+                if (isEmptyLockfile(opts.wantedLockfile)) {
+                    await rimraf(currentLockfilePath);
+                }
+                else {
+                    await fs.mkdir(path.dirname(currentLockfilePath), { recursive: true });
+                    // Current lockfile (node_modules/.pnpm/lock.yaml) does not include the env document
+                    await writeFileAtomic(currentLockfilePath, yamlDoc);
+                }
+            })(),
+        ]);
+        // Both files share the same source object; strip once and reuse.
+        const normalized = convertToLockfileObject(stripUndefinedDeep(wantedLockfileToStringify));
+        return {
+            wantedLockfile: normalized,
+            currentLockfile: isEmptyLockfile(opts.wantedLockfile) ? undefined : normalized,
+        };
+    }
+    logger.debug({
+        message: `\`${WANTED_LOCKFILE}\` differs from \`${path.relative(opts.wantedLockfileDir, currentLockfilePath)}\``,
+        prefix: opts.wantedLockfileDir,
+    });
+    const currentLockfileToStringify = convertToLockfileFile(opts.currentLockfile);
+    const currentYamlDoc = yamlStringify(currentLockfileToStringify);
+    // Filtered-current callers (deps-restorer) can pass an empty
+    // current against a non-empty wanted; key off the current.
+    const currentIsEmpty = isEmptyLockfile(opts.currentLockfile);
+    await Promise.all([
+        writeLockfileDoc(wantedLockfilePath, wantedLockfileName, yamlDoc),
+        (async () => {
+            if (currentIsEmpty) {
+                await rimraf(currentLockfilePath);
+            }
+            else {
+                await fs.mkdir(path.dirname(currentLockfilePath), { recursive: true });
+                await writeFileAtomic(currentLockfilePath, currentYamlDoc);
+            }
+        })(),
+    ]);
+    return {
+        wantedLockfile: convertToLockfileObject(stripUndefinedDeep(wantedLockfileToStringify)),
+        currentLockfile: currentIsEmpty
+            ? undefined
+            : convertToLockfileObject(stripUndefinedDeep(currentLockfileToStringify)),
+    };
+}
+//# sourceMappingURL=write.js.map

package/lib/yamlDocuments.d.ts

@@ -0,0 +1,27 @@
+export declare const YAML_DOCUMENT_SEPARATOR = "\n---\n";
+export declare const YAML_DOCUMENT_START = "---\n";
+/**
+ * Reads the first YAML document from a multi-document YAML file using streaming.
+ * The file must start with "---\n" to indicate it contains an env lockfile document.
+ * Stops reading as soon as the second document separator is found.
+ * Returns null if the file doesn't exist or doesn't start with "---\n".
+ */
+export declare function streamReadFirstYamlDocument(filePath: string, readBufferSize?: number): Promise<string | null>;
+export declare function readLockfileToString(filePath: string): Promise<string | null>;
+export declare function readLockfileToStringNoFollow(filePath: string): Promise<string | null>;
+/**
+ * Refuses a symlinked lockfile before a write, which would land on the link's
+ * target — any file the user can write. Reads may follow it: sandboxes stage
+ * `pnpm-lock.yaml` as a symlink, and lockfile content is untrusted either way
+ * (https://github.com/pnpm/pnpm/issues/13073).
+ */
+export declare function ensureLockfileIsNotSymlink(filePath: string): Promise<void>;
+/** The in-memory counterpart of {@link streamReadFirstYamlDocument}. */
+export declare function extractEnvDocument(content: string): string | null;
+/**
+ * Extracts the main lockfile content (second YAML document) from a combined string.
+ * If the file starts with "---\n", returns the content after the separator.
+ * If there is no separator, returns empty string (file is env-only).
+ * Otherwise returns the entire content (no env document present).
+ */
+export declare function extractMainDocument(content: string): string;