@pnpm/resolving.tarball-url 1100.0.0

package/LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2015-2016 Rico Sta. Cruz and other contributors
+Copyright (c) 2016-2026 Zoltan Kochan and other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,38 @@
+# @pnpm/resolving.tarball-url
+
+> Build and recognize the canonical tarball URL of an npm package
+
+<!--@shields('npm')-->
+[![npm version](https://img.shields.io/npm/v/@pnpm/resolving.tarball-url.svg)](https://npmx.dev/package/@pnpm/resolving.tarball-url)
+<!--/@-->
+
+## Installation
+
+```sh
+pnpm add @pnpm/resolving.tarball-url
+```
+
+## Usage
+
+```ts
+import {
+  getNpmTarballUrl,
+  isCanonicalRegistryTarballUrl,
+} from '@pnpm/resolving.tarball-url'
+
+const registry = 'https://registry.npmjs.org/'
+
+getNpmTarballUrl('foo', '1.0.0', { registry })
+//=> 'https://registry.npmjs.org/foo/-/foo-1.0.0.tgz'
+
+isCanonicalRegistryTarballUrl(
+  'https://registry.npmjs.org/foo/-/foo-1.0.0.tgz',
+  { name: 'foo', version: '1.0.0' },
+  registry
+)
+//=> true
+```
+
+## License
+
+MIT

package/lib/index.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Build the canonical tarball URL of an npm package — i.e. the URL pnpm derives
+ * from a package's name, version, and registry. Vendored from the
+ * `get-npm-tarball-url` package so the logic and its inverse
+ * ({@link isCanonicalRegistryTarballUrl}) live together in the monorepo.
+ */
+export declare function getNpmTarballUrl(pkgName: string, pkgVersion: string, opts?: {
+    registry?: string;
+}): string;
+/**
+ * Whether `tarball` is the canonical npm registry URL derived from the package
+ * name, version, and registry — i.e. it can be dropped from the lockfile and
+ * rebuilt on demand by {@link getNpmTarballUrl}.
+ *
+ * The lockfile writer uses this to decide whether to persist a tarball URL.
+ * It is exported so custom resolvers (pnpmfile `resolvers`) can emit a URL the
+ * writer will treat as canonical, instead of re-deriving pnpm's URL shape by
+ * hand. A resolver fronting a proxy that serves tarballs on a non-canonical
+ * path (e.g. an ephemeral `localhost:<port>`) can rewrite the resolved tarball
+ * to `getNpmTarballUrl(name, version, { registry })` so nothing host-specific
+ * is persisted to `pnpm-lock.yaml`.
+ *
+ * Percent-encoding is case-insensitive, so the `%2f` unescape matches both
+ * `%2f` and `%2F` in the URLs npm produces for scoped packages.
+ */
+export declare function isCanonicalRegistryTarballUrl(tarball: string, pkg: {
+    name: string;
+    version: string;
+}, registry: string): boolean;

package/lib/index.js

@@ -0,0 +1,55 @@
+/**
+ * Build the canonical tarball URL of an npm package — i.e. the URL pnpm derives
+ * from a package's name, version, and registry. Vendored from the
+ * `get-npm-tarball-url` package so the logic and its inverse
+ * ({@link isCanonicalRegistryTarballUrl}) live together in the monorepo.
+ */
+export function getNpmTarballUrl(pkgName, pkgVersion, opts) {
+    const registry = normalizeRegistry(opts?.registry);
+    const scopelessName = getScopelessName(pkgName);
+    return `${registry}${pkgName}/-/${scopelessName}-${removeBuildMetadataFromVersion(pkgVersion)}.tgz`;
+}
+/**
+ * Whether `tarball` is the canonical npm registry URL derived from the package
+ * name, version, and registry — i.e. it can be dropped from the lockfile and
+ * rebuilt on demand by {@link getNpmTarballUrl}.
+ *
+ * The lockfile writer uses this to decide whether to persist a tarball URL.
+ * It is exported so custom resolvers (pnpmfile `resolvers`) can emit a URL the
+ * writer will treat as canonical, instead of re-deriving pnpm's URL shape by
+ * hand. A resolver fronting a proxy that serves tarballs on a non-canonical
+ * path (e.g. an ephemeral `localhost:<port>`) can rewrite the resolved tarball
+ * to `getNpmTarballUrl(name, version, { registry })` so nothing host-specific
+ * is persisted to `pnpm-lock.yaml`.
+ *
+ * Percent-encoding is case-insensitive, so the `%2f` unescape matches both
+ * `%2f` and `%2F` in the URLs npm produces for scoped packages.
+ */
+export function isCanonicalRegistryTarballUrl(tarball, pkg, registry) {
+    const expectedTarball = getNpmTarballUrl(pkg.name, pkg.version, { registry });
+    const actualTarball = tarball.replace(/%2f/gi, '/');
+    return removeProtocol(expectedTarball) === removeProtocol(actualTarball);
+}
+function normalizeRegistry(registry) {
+    if (!registry)
+        return 'https://registry.npmjs.org/';
+    return registry.endsWith('/') ? registry : `${registry}/`;
+}
+function removeBuildMetadataFromVersion(version) {
+    const plusPos = version.indexOf('+');
+    if (plusPos === -1)
+        return version;
+    return version.substring(0, plusPos);
+}
+function getScopelessName(name) {
+    if (name[0] !== '@') {
+        return name;
+    }
+    return name.split('/')[1];
+}
+// Strips only a leading http(s) scheme so URLs are compared protocol-insensitively
+// without truncating on a later `://` in the path or query.
+function removeProtocol(url) {
+    return url.replace(/^https?:\/\//i, '');
+}
+//# sourceMappingURL=index.js.map

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@pnpm/resolving.tarball-url",
+  "version": "1100.0.0",
+  "description": "Build and recognize the canonical tarball URL of an npm package",
+  "keywords": [
+    "pnpm",
+    "pnpm11",
+    "npm",
+    "tarball"
+  ],
+  "license": "MIT",
+  "funding": "https://opencollective.com/pnpm",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/pnpm/pnpm/tree/main/pnpm11/resolving/tarball-url"
+  },
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/pnpm11/resolving/tarball-url#readme",
+  "bugs": {
+    "url": "https://github.com/pnpm/pnpm/issues"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": "./lib/index.js"
+  },
+  "files": [
+    "lib",
+    "!*.map"
+  ],
+  "devDependencies": {
+    "@jest/globals": "30.4.1",
+    "@pnpm/resolving.tarball-url": "1100.0.0"
+  },
+  "engines": {
+    "node": ">=22.13"
+  },
+  "jest": {
+    "preset": "@pnpm/jest-config"
+  },
+  "scripts": {
+    "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",
+    "test": "pn compile && pn .test",
+    "compile": "tsgo --build && pn lint --fix",
+    ".test": "cross-env NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest"
+  }
+}