@pnpm/resolving.tarball-url 1101.0.0 → 1101.1.1

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @pnpm/resolving.tarball-url
 
+## 1101.1.1
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/crypto.integrity@1100.0.6
+
+## 1101.1.0
+
+### Minor Changes
+
+- Added support for registry replacement tarballs using standard integrity values, explicit revision fields, registry routing from the `registries` setting, non-redirecting integrity-addressed URLs, canonical safe-integer revision numbers, and pnpr proxying for immutable upstream revision artifacts.
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/types@1102.1.0
+
 ## 1101.0.0
 
 ### Major Changes

package/lib/index.d.ts

@@ -1,3 +1,4 @@
+import { Buffer } from 'node:buffer';
 import type { RegistryServerType } from '@pnpm/types';
 export interface TarballUrlOptions {
     registry?: string;
@@ -7,6 +8,14 @@ export interface TarballUrlOptions {
      */
     serverType?: RegistryServerType;
 }
+export interface IntegrityAddress {
+    algorithm: 'sha512';
+    digest: Buffer;
+}
+export declare function isIntegrityAddressedRegistryTarballUrl(tarball: string, integrity: string, registry: string): boolean;
+export declare function getIntegrityAddressedTarballUrl(integrity: unknown, registry: string): string | undefined;
+export declare function parseIntegrityAddress(integrity: unknown): IntegrityAddress | undefined;
+export declare function isValidTarballRevision(revision: unknown): revision is number;
 /**
  * Build the canonical tarball URL of an npm package — i.e. the URL pnpm derives
  * from a package's name, version, and registry. Vendored from the

package/lib/index.js

@@ -1,4 +1,8 @@
+import { Buffer } from 'node:buffer';
+import util from 'node:util';
+import { formatIntegrity, parseIntegrity } from '@pnpm/crypto.integrity';
 const PUBLIC_NPM_REGISTRY = 'https://registry.npmjs.org/';
+const SHA512_INTEGRITY_LENGTH = 'sha512-'.length + 88;
 /**
  * registry.npmjs.org is the one registry whose layout pnpm knows without being
  * told, so it is a row of data rather than a hostname comparison. A declared
@@ -7,6 +11,50 @@ const PUBLIC_NPM_REGISTRY = 'https://registry.npmjs.org/';
 const DEFAULT_REGISTRY_SERVER_TYPES = {
     [PUBLIC_NPM_REGISTRY]: 'npm',
 };
+export function isIntegrityAddressedRegistryTarballUrl(tarball, integrity, registry) {
+    const expected = getIntegrityAddressedTarballUrl(integrity, registry);
+    if (expected == null)
+        return false;
+    try {
+        return new URL(tarball).toString() === expected;
+    }
+    catch {
+        return false;
+    }
+}
+export function getIntegrityAddressedTarballUrl(integrity, registry) {
+    const parsed = parseIntegrityAddress(integrity);
+    if (parsed == null)
+        return undefined;
+    return new URL(`-/tarballs/${parsed.algorithm}/${parsed.digest.toString('base64url')}`, normalizeRegistry(registry)).toString();
+}
+export function parseIntegrityAddress(integrity) {
+    if (typeof integrity !== 'string' || integrity.length !== SHA512_INTEGRITY_LENGTH)
+        return undefined;
+    let parsed;
+    try {
+        parsed = parseIntegrity(integrity);
+    }
+    catch (err) {
+        if (util.types.isNativeError(err) && 'code' in err && err.code === 'ERR_PNPM_INVALID_INTEGRITY') {
+            return undefined;
+        }
+        throw err;
+    }
+    if (parsed.algorithm !== 'sha512' ||
+        parsed.hexDigest.length !== 128 ||
+        formatIntegrity(parsed.algorithm, parsed.hexDigest) !== integrity)
+        return undefined;
+    return {
+        algorithm: parsed.algorithm,
+        digest: Buffer.from(parsed.hexDigest, 'hex'),
+    };
+}
+export function isValidTarballRevision(revision) {
+    return typeof revision === 'number' &&
+        Number.isSafeInteger(revision) &&
+        revision > 0;
+}
 /**
  * Build the canonical tarball URL of an npm package — i.e. the URL pnpm derives
  * from a package's name, version, and registry. Vendored from the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.tarball-url",
-  "version": "1101.0.0",
+  "version": "1101.1.1",
   "description": "Build and recognize the canonical tarball URL of an npm package",
   "keywords": [
     "pnpm",
@@ -29,11 +29,12 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/types": "1102.0.0"
+    "@pnpm/crypto.integrity": "1100.0.6",
+    "@pnpm/types": "1102.1.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/resolving.tarball-url": "1101.0.0"
+    "@pnpm/resolving.tarball-url": "1101.1.1"
   },
   "engines": {
     "node": ">=22.13"