@pnpm/store.pkg-finder 1100.0.19 → 1100.0.21

package/CHANGELOG.md

@@ -0,0 +1,221 @@
+# @pnpm/store.pkg-finder
+
+## 1100.0.21
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/fetching.directory-fetcher@1100.0.21
+
+## 1100.0.20
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/fetching.directory-fetcher@1100.0.20
+  - @pnpm/resolving.resolver-base@1100.5.2
+  - @pnpm/store.cafs@1100.1.13
+
+## 1100.0.19
+
+### Patch Changes
+
+- Updated dependencies [dcabb78]
+  - @pnpm/resolving.resolver-base@1100.5.1
+  - @pnpm/fetching.directory-fetcher@1100.0.19
+  - @pnpm/store.cafs@1100.1.12
+
+## 1100.0.18
+
+### Patch Changes
+
+- Updated dependencies [bae694f]
+  - @pnpm/resolving.resolver-base@1100.5.0
+  - @pnpm/fetching.directory-fetcher@1100.0.18
+  - @pnpm/store.cafs@1100.1.11
+  - @pnpm/store.index@1100.2.1
+
+## 1100.0.17
+
+### Patch Changes
+
+- Updated dependencies [61810aa]
+- Updated dependencies [a31faa7]
+  - @pnpm/store.index@1100.2.0
+  - @pnpm/fetching.directory-fetcher@1100.0.17
+  - @pnpm/store.cafs@1100.1.10
+  - @pnpm/resolving.resolver-base@1100.4.2
+
+## 1100.0.16
+
+### Patch Changes
+
+- @pnpm/fetching.directory-fetcher@1100.0.16
+
+## 1100.0.15
+
+### Patch Changes
+
+- @pnpm/fetching.directory-fetcher@1100.0.15
+- @pnpm/resolving.resolver-base@1100.4.1
+- @pnpm/store.cafs@1100.1.9
+
+## 1100.0.14
+
+### Patch Changes
+
+- Updated dependencies [6d17b66]
+  - @pnpm/resolving.resolver-base@1100.4.0
+  - @pnpm/fetching.directory-fetcher@1100.0.14
+  - @pnpm/store.cafs@1100.1.8
+
+## 1100.0.13
+
+### Patch Changes
+
+- @pnpm/fetching.directory-fetcher@1100.0.13
+- @pnpm/resolving.resolver-base@1100.3.1
+- @pnpm/store.cafs@1100.1.7
+
+## 1100.0.12
+
+### Patch Changes
+
+- @pnpm/fetching.directory-fetcher@1100.0.12
+
+## 1100.0.11
+
+### Patch Changes
+
+- Updated dependencies [1627943]
+  - @pnpm/resolving.resolver-base@1100.3.0
+  - @pnpm/fetching.directory-fetcher@1100.0.11
+  - @pnpm/store.cafs@1100.1.6
+
+## 1100.0.10
+
+### Patch Changes
+
+- Updated dependencies [4195766]
+- Updated dependencies [31538bf]
+  - @pnpm/resolving.resolver-base@1100.2.0
+  - @pnpm/fetching.directory-fetcher@1100.0.10
+  - @pnpm/store.cafs@1100.1.5
+
+## 1100.0.9
+
+### Patch Changes
+
+- @pnpm/store.cafs@1100.1.4
+- @pnpm/fetching.directory-fetcher@1100.0.9
+
+## 1100.0.8
+
+### Patch Changes
+
+- @pnpm/fetching.directory-fetcher@1100.0.8
+- @pnpm/resolving.resolver-base@1100.1.3
+- @pnpm/store.cafs@1100.1.3
+
+## 1100.0.7
+
+### Patch Changes
+
+- Updated dependencies [0c67cb5]
+  - @pnpm/store.index@1100.1.0
+  - @pnpm/fetching.directory-fetcher@1100.0.7
+
+## 1100.0.6
+
+### Patch Changes
+
+- 27425d7: Pin the integrity of git-hosted tarballs (codeload.github.com, gitlab.com, bitbucket.org) in the lockfile so that subsequent installs detect a tampered or substituted tarball and refuse to install it. Previously the lockfile only stored the tarball URL for git dependencies, so a compromised git host or a man-in-the-middle could serve arbitrary code on later installs without lockfile changes.
+
+  A new `gitHosted: true` field is recorded on git-hosted tarball resolutions in the lockfile, letting every reader/writer route them by a single typed check instead of pattern-matching the tarball URL in each call site. Lockfiles written by older pnpm versions are enriched on load (URL fallback) so the field can be relied on uniformly across the codebase.
+
+- Updated dependencies [27425d7]
+  - @pnpm/resolving.resolver-base@1100.1.2
+  - @pnpm/fetching.directory-fetcher@1100.0.6
+  - @pnpm/store.cafs@1100.1.2
+
+## 1100.0.5
+
+### Patch Changes
+
+- Updated dependencies [184ce26]
+  - @pnpm/fetching.directory-fetcher@1100.0.5
+  - @pnpm/resolving.resolver-base@1100.1.1
+  - @pnpm/deps.path@1100.0.2
+  - @pnpm/store.cafs@1100.1.1
+
+## 1100.0.4
+
+### Patch Changes
+
+- Updated dependencies [421317c]
+  - @pnpm/store.cafs@1100.1.0
+  - @pnpm/fetching.directory-fetcher@1100.0.4
+
+## 1100.0.3
+
+### Patch Changes
+
+- bcc88a1: Fixed `pnpm sbom` and `pnpm licenses` failing to resolve license information for git-sourced dependencies (`git+https://`, `git+ssh://`, `github:` shorthand). These commands now correctly read the package manifest from the content-addressable store for `type: 'git'` resolutions [#11260](https://github.com/pnpm/pnpm/issues/11260).
+- Updated dependencies [e03e8f4]
+- Updated dependencies [72c1e05]
+  - @pnpm/fetching.directory-fetcher@1100.0.3
+  - @pnpm/resolving.resolver-base@1100.1.0
+  - @pnpm/store.cafs@1100.0.2
+
+## 1100.0.2
+
+### Patch Changes
+
+- @pnpm/fetching.directory-fetcher@1100.0.2
+
+## 1100.0.1
+
+### Patch Changes
+
+- @pnpm/deps.path@1100.0.1
+- @pnpm/fetching.directory-fetcher@1100.0.1
+- @pnpm/resolving.resolver-base@1100.0.1
+- @pnpm/store.cafs@1100.0.1
+
+## 1000.0.0
+
+### Major Changes
+
+- f92ac24: Initial release.
+
+### Minor Changes
+
+- b7f0f21: Use SQLite for storing package index in the content-addressable store. Instead of individual `.mpk` files under `$STORE/index/`, package metadata is now stored in a single SQLite database at `$STORE/index.db`. This reduces filesystem syscall overhead, improves space efficiency for small metadata entries, and enables concurrent access via SQLite's WAL mode. Packages missing from the new index are re-fetched on demand [#10826](https://github.com/pnpm/pnpm/issues/10826).
+
+### Patch Changes
+
+- Updated dependencies [5f73b0f]
+- Updated dependencies [facdd71]
+- Updated dependencies [e2e0a32]
+- Updated dependencies [9b0a460]
+- Updated dependencies [3bf5e21]
+- Updated dependencies [491a84f]
+- Updated dependencies [6656baa]
+- Updated dependencies [2ea6463]
+- Updated dependencies [50fbeca]
+- Updated dependencies [caabba4]
+- Updated dependencies [878a773]
+- Updated dependencies [f8e6774]
+- Updated dependencies [7d2fd48]
+- Updated dependencies [56a59df]
+- Updated dependencies [50fbeca]
+- Updated dependencies [10bc391]
+- Updated dependencies [38b8e35]
+- Updated dependencies [b7f0f21]
+- Updated dependencies [1e6de25]
+- Updated dependencies [9d3f00b]
+  - @pnpm/deps.path@1002.0.0
+  - @pnpm/resolving.resolver-base@1006.0.0
+  - @pnpm/store.cafs@1001.0.0
+  - @pnpm/fetching.directory-fetcher@1001.0.0
+  - @pnpm/store.index@1000.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/store.pkg-finder",
-  "version": "1100.0.19",
+  "version": "1100.0.21",
   "description": "Read a package's file map from the content-addressable store",
   "keywords": [
     "pnpm",
@@ -27,14 +27,14 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/resolving.resolver-base": "1100.5.1",
-    "@pnpm/store.cafs": "1100.1.12",
-    "@pnpm/store.index": "1100.2.1",
-    "@pnpm/fetching.directory-fetcher": "1100.0.19"
+    "@pnpm/fetching.directory-fetcher": "1100.0.21",
+    "@pnpm/resolving.resolver-base": "1100.5.2",
+    "@pnpm/store.cafs": "1100.1.13",
+    "@pnpm/store.index": "1100.2.1"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/store.pkg-finder": "1100.0.19"
+    "@pnpm/store.pkg-finder": "1100.0.21"
   },
   "engines": {
     "node": ">=22.13"

package/lib/index.d.ts

@@ -1,35 +0,0 @@
-import type { Resolution } from '@pnpm/resolving.resolver-base';
-import { type StoreIndex } from '@pnpm/store.index';
-export interface ReadPackageFileMapOptions {
-    storeDir: string;
-    storeIndex: StoreIndex;
-    lockfileDir: string;
-    virtualStoreDirMaxLength: number;
-}
-/**
- * Reads the file index for a package and returns a `Map<string, string>`
- * mapping filenames to absolute paths on disk.
- *
- * Picks the store key by resolution shape:
- * - Directory packages: fetches the file list from the local directory.
- * - Git-hosted tarballs (codeload.github.com / gitlab.com / bitbucket.org):
- *   keyed by `gitHostedStoreIndexKey(packageId, { built: true })`. The
- *   lockfile pins their integrity for security, but the cached payload
- *   depends on whether build scripts ran during fetch (preparePackage), so
- *   the `built` dimension is part of the key. Folding them under the
- *   integrity-only key would collapse that distinction.
- * - npm-registry tarballs with integrity: keyed by
- *   `storeIndexKey(integrity, packageId)`.
- * - Other tarball / git resolutions without integrity: keyed by
- *   `gitHostedStoreIndexKey(packageId, { built: true })`.
- *
- * For CAFS packages, the content-addressed digests are resolved to file
- * paths upfront, so callers get a uniform map regardless of resolution type.
- *
- * Note: this function does not include files from side effects (post-install
- * scripts). Use the raw `PackageFilesIndex` if you need side-effect files.
- *
- * Returns `undefined` if the resolution type is unsupported, letting callers
- * decide how to handle this case. Throws if the index file cannot be read.
- */
-export declare function readPackageFileMap(packageResolution: Resolution, packageId: string, opts: ReadPackageFileMapOptions): Promise<Map<string, string> | undefined>;