Zoltan Kochan
c9b8632ea6
Registries do not all lay out tarball URLs the way the npm registry does. JFrog Artifactory repeats the scope in a scoped package's tarball filename (`@acme/widget/-/@acme/widget-1.0.0.tgz`) where npm strips it. pnpm cannot rebuild such a URL, so it writes it out for every scoped package instead of omitting it, and the lockfile carries a host-specific URL per dependency. pnpm had no place to record such a fact, because it had no place to describe a registry at all — only three ways to name one. `registries` mapped a scope to a URL, `namedRegistries` mapped a bare-specifier prefix to a URL, and neither could carry anything else. `registries` now declares a registry once, keyed by its URL, with every fact about it in the entry: a `serverType`, the `scopes` routed to it, and the `prefix` it answers to. `serverType` has three states: undeclared strict; only the exact canonical URL is reconstructible npm also serves the percent-encoded scoped path artifactory repeats the scope in the tarball filename registry.npmjs.org resolves to `npm` as a built-in, so its behavior is unchanged and the old hostname check becomes that one default rather than a special case in the predicate. `npm` cannot be the default: asserting npmjs-compatibility is a claim only the operator can make. The URL is the key because every fact in an entry is a fact about that server. Keying the layout by scope would bind it to whoever the scope currently points at, so two developers whose scope resolves differently would write lockfiles that disagree about which URLs may be omitted. `scopes` and `prefix` are routes to the registry and are inverted at config-read time into the two lookups the rest of pnpm already queries, leaving the resolver, installer, and lockfile layers untouched and the precedence chain (builtin < .npmrc < yaml < `_auth` < CLI) unchanged. The layout is declared, never inferred. Sniffing the registry URL cannot work: a virtual repository serves both layouts at once, depending on whether each package was synced from upstream or published locally, so no registry-level signal — route, response header, or probe — decides it. Declaring it also keeps a wrong guess a fixable misconfiguration instead of a silent breakage. `serverType` feeds a single URL builder that both sides of the lockfile use: the writer omits a tarball URL only when the builder reproduces it, and the reader rebuilds it with the same call. They therefore agree by construction, so pnpm never has to assume a registry serves some second URL as well. The setting lives in pnpm-workspace.yaml rather than .npmrc because the lockfile depends on it: one developer omitting URLs that another reconstructs differently would break a frozen install. A `serverType` in the global config.yaml is ignored for the same reason, while the routes declared alongside it are kept. Credentials are rejected there — the file is committed — and still belong in .npmrc. The registry URL is the map key, so the request-destination env gate applies to keys as well as values. Credentials and unknown fields are refused after parsing, since a parse error renders the offending source line verbatim. A map whose values are all strings is the older `<scope>: <url>` shape and is still read as one. Mixing the two shapes in one map is refused, and so is a URL-keyed entry written as a string. `namedRegistries` is deprecated in favor of `prefix` and is read only for prefixes `registries` does not declare; a prefix stays singular because it is the registry's identity in a lockfile dep path. An entry that routes nothing to itself and matches no configured registry is reported as a warning rather than silently ignored; it is a warning and not an error because a shared config dependency can legitimately describe registries a given project does not use. Config dependencies and pnpr-server-mode resolution pass no server type; in both, the writer and the reader share that default, so they stay consistent. Closes pnpm/get-npm-tarball-url#16. Supersedes pnpm/pnpm#13920.
63 lines
2.2 KiB
TypeScript
63 lines
2.2 KiB
TypeScript
import { expect, test } from '@jest/globals'
|
|
import { createShortHash } from '@pnpm/crypto.hash'
|
|
|
|
import { createCacheKey } from '../src/dlx.js'
|
|
|
|
test('creates a hash', () => {
|
|
const received = createCacheKey({
|
|
packages: ['shx', '@foo/bar'],
|
|
registriesByScope: {
|
|
default: 'https://registry.npmjs.com/',
|
|
'@foo': 'https://example.com/npm-registry/foo/',
|
|
},
|
|
})
|
|
const expected = createShortHash(JSON.stringify([['@foo/bar', 'shx'], [
|
|
['@foo', 'https://example.com/npm-registry/foo/'],
|
|
['default', 'https://registry.npmjs.com/'],
|
|
]]))
|
|
expect(received).toBe(expected)
|
|
})
|
|
|
|
test('is agnostic to package order', () => {
|
|
const registriesByScope = { default: 'https://registry.npmjs.com/' }
|
|
const makeOpts = (packages: string[]) => ({ packages, registriesByScope })
|
|
expect(createCacheKey(makeOpts(['a', 'c', 'b']))).toBe(createCacheKey(makeOpts(['a', 'b', 'c'])))
|
|
expect(createCacheKey(makeOpts(['b', 'a', 'c']))).toBe(createCacheKey(makeOpts(['a', 'b', 'c'])))
|
|
expect(createCacheKey(makeOpts(['b', 'c', 'a']))).toBe(createCacheKey(makeOpts(['a', 'b', 'c'])))
|
|
expect(createCacheKey(makeOpts(['c', 'a', 'b']))).toBe(createCacheKey(makeOpts(['a', 'b', 'c'])))
|
|
expect(createCacheKey(makeOpts(['c', 'b', 'a']))).toBe(createCacheKey(makeOpts(['a', 'b', 'c'])))
|
|
})
|
|
|
|
test('is agnostic to registry key order', () => {
|
|
const packages = ['a', 'b', 'c']
|
|
const foo = 'https://example.com/foo/'
|
|
const bar = 'https://example.com/bar/'
|
|
expect(createCacheKey({
|
|
packages,
|
|
registriesByScope: { '@foo': foo, '@bar': bar },
|
|
})).toBe(createCacheKey({
|
|
packages,
|
|
registriesByScope: { '@bar': bar, '@foo': foo },
|
|
}))
|
|
})
|
|
|
|
test('is agnostic to supportedArchitectures values order', () => {
|
|
const packages = ['a', 'b', 'c']
|
|
const registriesByScope = { default: 'https://registry.npmjs.com/' }
|
|
expect(createCacheKey({
|
|
packages,
|
|
registriesByScope,
|
|
supportedArchitectures: {
|
|
os: ['win32', 'linux', 'darwin'],
|
|
cpu: ['x86_64', 'armv7', 'i686'],
|
|
},
|
|
})).toBe(createCacheKey({
|
|
packages,
|
|
registriesByScope,
|
|
supportedArchitectures: {
|
|
cpu: ['armv7', 'i686', 'x86_64'],
|
|
os: ['darwin', 'linux', 'win32'],
|
|
},
|
|
}))
|
|
})
|