@pnpm/resolving.git-resolver 1001.1.5

package/LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2015-2016 Rico Sta. Cruz and other contributors
+Copyright (c) 2016-2026 Zoltan Kochan and other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,41 @@
+# @pnpm/git-resolver
+
+> Resolver for git-hosted packages
+
+<!--@shields('npm')-->
+[![npm version](https://img.shields.io/npm/v/@pnpm/git-resolver.svg)](https://www.npmjs.com/package/@pnpm/git-resolver)
+<!--/@-->
+
+## Installation
+
+```
+pnpm add @pnpm/git-resolver
+```
+
+## Usage
+
+<!--@example('./example.js')-->
+```js
+'use strict'
+const createResolveFromNpm = require('@pnpm/git-resolver').default
+
+const resolveFromNpm = createResolveFromNpm({})
+
+resolveFromNpm({
+  bareSpecifier: 'kevva/is-negative#16fd36fe96106175d02d066171c44e2ff83bc055'
+})
+.then(resolveResult => console.log(JSON.stringify(resolveResult, null, 2)))
+//> {
+//    "id": "github.com/kevva/is-negative/16fd36fe96106175d02d066171c44e2ff83bc055",
+//    "normalizedBareSpecifier": "github:kevva/is-negative#16fd36fe96106175d02d066171c44e2ff83bc055",
+//    "resolution": {
+//      "tarball": "https://codeload.github.com/kevva/is-negative/tar.gz/16fd36fe96106175d02d066171c44e2ff83bc055"
+//    },
+//    "resolvedVia": "git-repository"
+//  }
+```
+<!--/@-->
+
+## License
+
+MIT

package/lib/createGitHostedPkgId.d.ts

@@ -0,0 +1,6 @@
+import type { PkgResolutionId } from '@pnpm/resolving.resolver-base';
+export declare function createGitHostedPkgId({ repo, commit, path }: {
+    repo: string;
+    commit: string;
+    path?: string;
+}): PkgResolutionId;

package/lib/createGitHostedPkgId.js

@@ -0,0 +1,10 @@
+export function createGitHostedPkgId({ repo, commit, path }) {
+    let id = `${repo.includes('://') ? '' : 'https://'}${repo}#${commit}`;
+    if (!id.startsWith('git+'))
+        id = `git+${id}`;
+    if (path) {
+        id += `&path:${path}`;
+    }
+    return id;
+}
+//# sourceMappingURL=createGitHostedPkgId.js.map

package/lib/index.d.ts

@@ -0,0 +1,15 @@
+import type { AgentOptions } from '@pnpm/network.agent';
+import type { GitResolution, ResolveOptions, ResolveResult, TarballResolution } from '@pnpm/resolving.resolver-base';
+import { createGitHostedPkgId } from './createGitHostedPkgId.js';
+import { type HostedPackageSpec } from './parseBareSpecifier.js';
+export { createGitHostedPkgId };
+export type { HostedPackageSpec };
+export interface GitResolveResult extends ResolveResult {
+    normalizedBareSpecifier?: string;
+    resolution: GitResolution | TarballResolution;
+    resolvedVia: 'git-repository';
+}
+export type GitResolver = (wantedDependency: {
+    bareSpecifier: string;
+}, opts?: Pick<ResolveOptions, 'currentPkg' | 'update'>) => Promise<GitResolveResult | null>;
+export declare function createGitResolver(opts: AgentOptions): GitResolver;

package/lib/index.js

@@ -0,0 +1,152 @@
+import { PnpmError } from '@pnpm/error';
+import { gracefulGit as git } from 'graceful-git';
+import semver from 'semver';
+import { createGitHostedPkgId } from './createGitHostedPkgId.js';
+import { parseBareSpecifier } from './parseBareSpecifier.js';
+export { createGitHostedPkgId };
+export function createGitResolver(opts) {
+    return async function resolveGit(wantedDependency, resolveOpts) {
+        const parsedSpecFunc = parseBareSpecifier(wantedDependency.bareSpecifier, opts);
+        if (parsedSpecFunc == null)
+            return null;
+        // Skip resolution if we have currentPkg and not updating
+        if (resolveOpts?.currentPkg && !resolveOpts.update) {
+            const currentResolution = resolveOpts.currentPkg.resolution;
+            // Return existing resolution for git packages
+            if ('type' in currentResolution && currentResolution.type === 'git') {
+                return {
+                    id: resolveOpts.currentPkg.id,
+                    resolution: currentResolution,
+                    resolvedVia: 'git-repository',
+                };
+            }
+            // Also handle tarballs from git (e.g., GitHub hosted)
+            if ('tarball' in currentResolution && currentResolution.tarball) {
+                return {
+                    id: resolveOpts.currentPkg.id,
+                    resolution: currentResolution,
+                    resolvedVia: 'git-repository',
+                };
+            }
+        }
+        const parsedSpec = await parsedSpecFunc();
+        const bareSpecifier = parsedSpec.gitCommittish == null || parsedSpec.gitCommittish === ''
+            ? 'HEAD'
+            : parsedSpec.gitCommittish;
+        const commit = await resolveRef(parsedSpec.fetchSpec, bareSpecifier, parsedSpec.gitRange);
+        let resolution;
+        if ((parsedSpec.hosted != null) && !isSsh(parsedSpec.fetchSpec)) {
+            // don't use tarball for ssh url, they are likely private repo
+            const hosted = parsedSpec.hosted;
+            // use resolved committish
+            hosted.committish = commit;
+            const tarball = hosted.tarball?.();
+            if (tarball) {
+                resolution = { tarball };
+            }
+        }
+        if (resolution == null) {
+            resolution = {
+                commit,
+                repo: parsedSpec.fetchSpec,
+                type: 'git',
+            };
+        }
+        if (parsedSpec.path) {
+            resolution.path = parsedSpec.path;
+        }
+        let id;
+        if ('tarball' in resolution) {
+            id = resolution.tarball;
+            if (resolution.path) {
+                id = `${id}#path:${resolution.path}`;
+            }
+        }
+        else {
+            id = createGitHostedPkgId(resolution);
+        }
+        return {
+            id,
+            normalizedBareSpecifier: parsedSpec.normalizedBareSpecifier,
+            resolution,
+            resolvedVia: 'git-repository',
+        };
+    };
+}
+function resolveVTags(vTags, range) {
+    return semver.maxSatisfying(vTags, range, true);
+}
+async function getRepoRefs(repo, ref) {
+    const gitArgs = [repo];
+    if (ref) {
+        gitArgs.push(ref);
+        // Also request the peeled ref for annotated tags (e.g., refs/tags/v1.0.0^{})
+        // This is needed because annotated tags have their own SHA, and we need the commit SHA they point to
+        gitArgs.push(`${ref}^{}`);
+    }
+    // graceful-git by default retries 10 times, reduce to single retry
+    const result = await git(['ls-remote', ...gitArgs], { retries: 1 });
+    const refs = {};
+    for (const line of result.stdout.split('\n')) {
+        const [commit, refName] = line.split('\t');
+        refs[refName] = commit;
+    }
+    return refs;
+}
+async function resolveRef(repo, ref, range) {
+    const committish = ref.match(/^[0-9a-f]{7,40}$/) !== null;
+    if (committish && ref.length === 40) {
+        return ref;
+    }
+    const refs = await getRepoRefs(repo, (range ?? committish) ? null : ref);
+    const result = resolveRefFromRefs(refs, repo, ref, committish, range);
+    if (committish && !result.startsWith(ref)) {
+        throw new PnpmError('GIT_AMBIGUOUS_REF', `resolved commit ${result} from commit-ish reference ${ref}`);
+    }
+    return result;
+}
+function resolveRefFromRefs(refs, repo, ref, committish, range) {
+    if (!range) {
+        let commitId = refs[ref] ||
+            refs[`refs/${ref}`] ||
+            refs[`refs/tags/${ref}^{}`] || // prefer annotated tags
+            refs[`refs/tags/${ref}`] ||
+            refs[`refs/heads/${ref}`];
+        if (!commitId) {
+            // check for a partial commit
+            // Use Set to deduplicate since multiple refs can point to the same commit
+            const commits = committish ? [...new Set(Object.values(refs).filter((value) => value.startsWith(ref)))] : [];
+            if (commits.length === 1) {
+                commitId = commits[0];
+            }
+            else {
+                throw new Error(`Could not resolve ${ref} to a commit of ${repo}.`);
+            }
+        }
+        return commitId;
+    }
+    else {
+        const vTags = [...new Set(Object.keys(refs)
+                // using the same semantics of version tags as https://github.com/zkat/pacote
+                .filter((key) => /^refs\/tags\/v?\d+\.\d+\.\d+(?:[-+].+)?(?:\^\{\})?$/.test(key))
+                .map((key) => {
+                return key
+                    .replace(/^refs\/tags\//, '')
+                    .replace(/\^\{\}$/, ''); // accept annotated tags
+            })
+                .filter((key) => semver.valid(key, true)))];
+        const refVTag = resolveVTags(vTags, range);
+        const commitId = refVTag &&
+            (refs[`refs/tags/${refVTag}^{}`] || // prefer annotated tags
+                refs[`refs/tags/${refVTag}`]);
+        if (!commitId) {
+            throw new Error(`Could not resolve ${range} to a commit of ${repo}. Available versions are: ${vTags.join(', ')}`);
+        }
+        return commitId;
+    }
+}
+function isSsh(gitSpec) {
+    return gitSpec.slice(0, 10) === 'git+ssh://' ||
+        gitSpec.slice(0, 4) === 'git@';
+}
+//# sourceMappingURL=index.js.map

package/lib/parseBareSpecifier.d.ts

@@ -0,0 +1,16 @@
+import type { AgentOptions } from '@pnpm/network.agent';
+export interface HostedPackageSpec {
+    fetchSpec: string;
+    hosted?: {
+        type: string;
+        user: string;
+        project: string;
+        committish: string;
+        tarball: () => string | undefined;
+    };
+    normalizedBareSpecifier: string;
+    gitCommittish: string | null;
+    gitRange?: string;
+    path?: string;
+}
+export declare function parseBareSpecifier(bareSpecifier: string, opts: AgentOptions): null | (() => Promise<HostedPackageSpec>);

package/lib/parseBareSpecifier.js

@@ -0,0 +1,169 @@
+// cspell:ignore sshurl
+import urlLib, { URL } from 'node:url';
+import { fetchWithAgent } from '@pnpm/network.fetch';
+import { gracefulGit as git } from 'graceful-git';
+import HostedGit from 'hosted-git-info';
+const gitProtocols = new Set([
+    'git',
+    'git+http',
+    'git+https',
+    'git+rsync',
+    'git+ftp',
+    'git+file',
+    'git+ssh',
+    'ssh',
+]);
+export function parseBareSpecifier(bareSpecifier, opts) {
+    const hosted = HostedGit.fromUrl(bareSpecifier);
+    if (hosted != null) {
+        return () => fromHostedGit(hosted, opts);
+    }
+    const colonsPos = bareSpecifier.indexOf(':');
+    if (colonsPos === -1)
+        return null;
+    const protocol = bareSpecifier.slice(0, colonsPos);
+    // Also detect http/https URLs ending in .git as git repositories
+    const isGitUrl = gitProtocols.has(protocol.toLocaleLowerCase()) ||
+        ((protocol === 'http' || protocol === 'https') && /\.git(?:#|$)/.test(bareSpecifier));
+    if (protocol && isGitUrl) {
+        const correctBareSpecifier = correctUrl(bareSpecifier);
+        const url = new URL(correctBareSpecifier);
+        if (!url?.protocol)
+            return null;
+        const hash = (url.hash?.length > 1) ? decodeURIComponent(url.hash.slice(1)) : null;
+        return async () => ({
+            fetchSpec: urlToFetchSpec(url),
+            normalizedBareSpecifier: bareSpecifier,
+            ...parseGitParams(hash),
+        });
+    }
+    return null;
+}
+function urlToFetchSpec(url) {
+    url.hash = '';
+    const fetchSpec = urlLib.format(url);
+    if (fetchSpec.startsWith('git+')) {
+        return fetchSpec.slice(4);
+    }
+    return fetchSpec;
+}
+async function fromHostedGit(hosted, agentOptions) {
+    let fetchSpec = null;
+    // try git/https url before fallback to ssh url
+    const gitHttpsUrl = hosted.https({ noCommittish: true, noGitPlus: true });
+    if (gitHttpsUrl && await isRepoPublic(gitHttpsUrl, agentOptions) && await accessRepository(gitHttpsUrl)) {
+        fetchSpec = gitHttpsUrl;
+    }
+    else {
+        const gitSshUrl = hosted.ssh({ noCommittish: true });
+        if (gitSshUrl && await accessRepository(gitSshUrl)) {
+            fetchSpec = gitSshUrl;
+        }
+    }
+    if (!fetchSpec) {
+        const httpsUrl = hosted.https({ noGitPlus: true, noCommittish: true });
+        if (httpsUrl) {
+            if ((hosted.auth || !await isRepoPublic(httpsUrl, agentOptions)) && await accessRepository(httpsUrl)) {
+                return {
+                    fetchSpec: httpsUrl,
+                    hosted: {
+                        ...hosted,
+                        _fill: hosted._fill,
+                        tarball: undefined,
+                    },
+                    normalizedBareSpecifier: `git+${httpsUrl}`,
+                    ...parseGitParams(hosted.committish),
+                };
+            }
+            else {
+                try {
+                    // when git ls-remote private repo, it asks for login credentials.
+                    // use HTTP HEAD request to test whether this is a private repo, to avoid login prompt.
+                    // this is very similar to yarn classic's behavior.
+                    // npm instead tries git ls-remote directly which prompts user for login credentials.
+                    // HTTP HEAD on https://domain/user/repo, strip out ".git"
+                    const response = await fetchWithAgent(httpsUrl.replace(/\.git$/, ''), { method: 'HEAD', follow: 0, retry: { retries: 0 }, agentOptions });
+                    if (response.ok) {
+                        fetchSpec = httpsUrl;
+                    }
+                }
+                catch {
+                    // ignore
+                }
+            }
+        }
+    }
+    if (!fetchSpec) {
+        // use ssh url for likely private repo
+        fetchSpec = hosted.sshurl({ noCommittish: true });
+    }
+    return {
+        fetchSpec: fetchSpec,
+        hosted: {
+            ...hosted,
+            _fill: hosted._fill,
+            tarball: hosted.tarball,
+        },
+        normalizedBareSpecifier: hosted.shortcut(),
+        ...parseGitParams(hosted.committish),
+    };
+}
+async function isRepoPublic(httpsUrl, agentOptions) {
+    try {
+        const response = await fetchWithAgent(httpsUrl.replace(/\.git$/, ''), { method: 'HEAD', follow: 0, retry: { retries: 0 }, agentOptions });
+        return response.ok;
+    }
+    catch {
+        return false;
+    }
+}
+async function accessRepository(repository) {
+    try {
+        await git(['ls-remote', '--exit-code', repository, 'HEAD'], { retries: 0 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function parseGitParams(committish) {
+    const result = { gitCommittish: null };
+    if (!committish) {
+        return result;
+    }
+    const params = committish.split('&');
+    for (const param of params) {
+        if (param.length >= 7 && param.slice(0, 7) === 'semver:') {
+            result.gitRange = param.slice(7);
+        }
+        else if (param.slice(0, 5) === 'path:') {
+            result.path = param.slice(5);
+        }
+        else {
+            result.gitCommittish = param;
+        }
+    }
+    return result;
+}
+// handle SCP-like URLs
+// see https://github.com/yarnpkg/yarn/blob/5682d55/src/util/git.js#L103
+function correctUrl(gitUrl) {
+    let _gitUrl = gitUrl.replace(/^git\+/, '');
+    if (_gitUrl.startsWith('ssh://')) {
+        const hashIndex = _gitUrl.indexOf('#');
+        let hash = '';
+        if (hashIndex !== -1) {
+            hash = _gitUrl.slice(hashIndex);
+            _gitUrl = _gitUrl.slice(0, hashIndex);
+        }
+        const [auth, ...pathname] = _gitUrl.slice(6).split('/');
+        const [, host] = auth.split('@');
+        if (host.includes(':') && !/:\d+$/.test(host)) {
+            const authArr = auth.split(':');
+            const protocol = gitUrl.split('://')[0];
+            gitUrl = `${protocol}://${authArr.slice(0, -1).join(':') + '/' + authArr[authArr.length - 1]}${pathname.length ? '/' + pathname.join('/') : ''}${hash}`;
+        }
+    }
+    return gitUrl;
+}
+//# sourceMappingURL=parseBareSpecifier.js.map

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "@pnpm/resolving.git-resolver",
+  "version": "1001.1.5",
+  "description": "Resolver for git-hosted packages",
+  "keywords": [
+    "pnpm",
+    "pnpm11",
+    "npm",
+    "resolver"
+  ],
+  "license": "MIT",
+  "funding": "https://opencollective.com/pnpm",
+  "repository": "https://github.com/pnpm/pnpm/tree/main/resolving/git-resolver",
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/resolving/git-resolver#readme",
+  "bugs": {
+    "url": "https://github.com/pnpm/pnpm/issues"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": "./lib/index.js"
+  },
+  "files": [
+    "lib",
+    "!*.map"
+  ],
+  "dependencies": {
+    "graceful-git": "^5.0.0",
+    "hosted-git-info": "npm:@pnpm/hosted-git-info@1.0.0",
+    "semver": "^7.7.2",
+    "@pnpm/error": "1000.0.5",
+    "@pnpm/resolving.resolver-base": "1005.1.0",
+    "@pnpm/network.fetch": "1000.2.6"
+  },
+  "devDependencies": {
+    "@jest/globals": "30.0.5",
+    "@pnpm/network.agent": "^2.0.3",
+    "@types/hosted-git-info": "^3.0.5",
+    "@types/is-windows": "^1.0.2",
+    "@types/semver": "7.7.1",
+    "is-windows": "^1.0.2",
+    "@pnpm/resolving.git-resolver": "1001.1.5"
+  },
+  "engines": {
+    "node": ">=22.13"
+  },
+  "jest": {
+    "preset": "@pnpm/jest-config"
+  },
+  "scripts": {
+    "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",
+    "_test": "cross-env NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest",
+    "test": "pnpm run compile && pnpm run _test",
+    "fix": "tslint -c tslint.json src/**/*.ts test/**/*.ts --fix",
+    "compile": "tsgo --build && pnpm run lint --fix"
+  }
+}