/** * One embeddable `name@version` entry from the lockfile: a package that a * registry serves as a tarball, with the integrity hash recorded for it. */ export interface LockfileRegistryPackage { name: string; version: string; /** * SRI integrity of the registry tarball. Absent only for `yarn.lock` * entries: Yarn Berry checksums hash yarn's own cache archive, not the * registry tarball, so the tarball integrity is resolved from registry * metadata at materialization time instead. Entries without either hash * are excluded by the parsers, so `lockfileChecksum` is always present * when this is absent. */ integrity?: string; /** * The lockfile's own content pin when it is not an SRI tarball hash * (Yarn Berry's `checksum` value). Used in place of `integrity` where a * stable content identifier known at plan time is needed (the dependency * cache hash). */ lockfileChecksum?: string; /** * The full tarball URL when the lockfile records one (npm's `resolved`, * pnpm's `resolution.tarball`). When absent, the URL is derived from the * registry configuration. */ tarballUrl?: string; } /** * A lockfile entry that cannot be embedded as a registry tarball, kept so * that a configured spec matching only such entries gets a precise error * instead of a generic "not found in the lockfile". */ export interface ExcludedLockfilePackage { name: string; version?: string; reason: string; /** * Why the entry is excluded, machine-readable: 'workspace' entries are * part of the project itself (safe for a wildcard to skip silently), * while 'unfetchable' entries (git/file/URL dependencies, or entries * without an integrity hash) cannot be embedded but may still be needed * at install time. */ kind: 'workspace' | 'unfetchable'; } export interface LockfilePackages { registry: LockfileRegistryPackage[]; excluded: ExcludedLockfilePackage[]; } export declare class UnsupportedLockfileError extends Error { constructor(message: string); } /** * Whether a lockfile is pnpm's. Callers use this to decide which package * manager's credential conventions apply to the project. */ export declare function isPnpmLockfile(lockfilePath: string): boolean; /** * Enumerates every package entry in a lockfile, classified into embeddable * registry packages and excluded (git/file/link/integrity-less) entries. * Supports `pnpm-lock.yaml` (v6/v9), `package-lock.json` (v2/v3), * `bun.lock` (v1) and Yarn Berry's `yarn.lock`. */ export declare function loadLockfilePackages(lockfilePath: string): Promise; /** * Content-based variant of {@link loadLockfilePackages} for lockfiles that * exist only in memory (e.g. a pruned copy of the bundled lockfile). The * format is dispatched on the lockfile's filename. */ export declare function parseLockfilePackagesContent(content: string, lockfileName: string): LockfilePackages; export declare function parsePnpmLockfilePackages(content: string): LockfilePackages; export declare function parseBunLockfilePackages(content: string): LockfilePackages; export declare function parseYarnLockfilePackages(content: string): LockfilePackages; export declare function parseNpmLockfilePackages(content: string): LockfilePackages;