@depup/nx 22.6.4-depup.2 → 23.1.0-depup.0

package/dist/src/utils/min-release-age/behavior/bun.js

@@ -0,0 +1,278 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readBunPolicy = readBunPolicy;
+exports.pickBunVersion = pickBunVersion;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const semver_1 = require("semver");
+const smol_toml_1 = require("smol-toml");
+const constants_1 = require("../constants");
+const errors_1 = require("../errors");
+const pick_1 = require("../pick");
+const SEVEN_DAYS_MS = 7 * constants_1.MS_PER_DAY;
+/**
+ * Reads bun's cooldown config from bunfig.toml. nx mirrors only the surfaces
+ * bun reads at resolution time in this context: the project `bunfig.toml` and
+ * the global bunfig, which lives at `$XDG_CONFIG_HOME/.bunfig.toml` when
+ * XDG_CONFIG_HOME is set and at `$HOME/.bunfig.toml` otherwise (verified
+ * against bun's getHomeConfigPath). Local overrides global per key. No env,
+ * no .npmrc, no CLI surface exists in this context.
+ */
+async function readBunPolicy(root, pmVersion) {
+    let global;
+    let local;
+    try {
+        global = readGlobalBunInstall();
+        local = readLocalBunInstall(root);
+    }
+    catch {
+        return {
+            outcome: 'ambiguous',
+            reason: 'Unable to read bunfig.toml.',
+        };
+    }
+    if (global === 'error' || local === 'error') {
+        // A non-number / negative value makes bun's config load fail (install
+        // dies); we can't reason about the effective window, so defer to install.
+        return {
+            outcome: 'ambiguous',
+            reason: 'Invalid minimumReleaseAge in bunfig.toml.',
+        };
+    }
+    // Local overrides global per key.
+    const ageRaw = local.minimumReleaseAge ?? global.minimumReleaseAge;
+    const excludesRaw = local.minimumReleaseAgeExcludes ?? global.minimumReleaseAgeExcludes;
+    if (ageRaw === undefined || ageRaw === null) {
+        return { outcome: 'inactive' };
+    }
+    if (typeof ageRaw !== 'number' || !Number.isFinite(ageRaw)) {
+        return {
+            outcome: 'ambiguous',
+            reason: `Invalid bun minimumReleaseAge value: ${String(ageRaw)}.`,
+        };
+    }
+    if (ageRaw < 0) {
+        // bun hard-errors on a negative window; install would die.
+        return {
+            outcome: 'ambiguous',
+            reason: 'bun minimumReleaseAge must be a positive number of seconds.',
+        };
+    }
+    if (ageRaw === 0) {
+        // 0 disables the gate.
+        return { outcome: 'inactive' };
+    }
+    const excludes = new Set(excludesRaw ?? []);
+    const windowMs = ageRaw * constants_1.MS_PER_SECOND;
+    const cutoffMs = Date.now() - windowMs;
+    return {
+        outcome: 'active',
+        policy: {
+            packageManagerVersion: pmVersion,
+            cutoffMs,
+            windowMs,
+            sourceDescription: `bun minimumReleaseAge (${ageRaw} second${ageRaw === 1 ? '' : 's'})`,
+            // Exact, case-sensitive byte equality on the package name only.
+            isExcluded: (packageName) => excludes.has(packageName),
+            behavior: { packageManager: 'bun' },
+        },
+    };
+}
+function readLocalBunInstall(root) {
+    return readBunInstall((0, path_1.join)(root, 'bunfig.toml'));
+}
+function readGlobalBunInstall() {
+    const xdg = process.env.XDG_CONFIG_HOME;
+    const base = xdg || process.env.HOME;
+    if (!base) {
+        return {};
+    }
+    return readBunInstall((0, path_1.join)(base, '.bunfig.toml'));
+}
+function readBunInstall(path) {
+    if (!(0, fs_1.existsSync)(path)) {
+        return {};
+    }
+    let parsed;
+    try {
+        parsed = (0, smol_toml_1.parse)((0, fs_1.readFileSync)(path, 'utf-8'));
+    }
+    catch {
+        // Unparseable bunfig makes bun's install die; treat as a hard error.
+        return 'error';
+    }
+    const install = parsed.install;
+    if (typeof install !== 'object' || install === null) {
+        return {};
+    }
+    const installObj = install;
+    const result = {};
+    if ('minimumReleaseAge' in installObj) {
+        const value = installObj.minimumReleaseAge;
+        // bun rejects a non-number value (config load fails); negative is rejected
+        // too but we surface that uniformly in the reader for a clearer reason.
+        if (typeof value !== 'number') {
+            return 'error';
+        }
+        result.minimumReleaseAge = value;
+    }
+    if ('minimumReleaseAgeExcludes' in installObj) {
+        const value = installObj.minimumReleaseAgeExcludes;
+        // bun's bunfig parser hard-errors on a non-array, or any non-string element
+        // (install dies); mirror that so the reader maps it to ambiguous.
+        if (!Array.isArray(value) || value.some((e) => typeof e !== 'string')) {
+            return 'error';
+        }
+        result.minimumReleaseAgeExcludes = value;
+    }
+    // The singular `minimumReleaseAgeExclude` key is never read by bun; ignore it.
+    return result;
+}
+/**
+ * bun resolution. Exact pins and ranges mirror bun's resolver
+ * (find_best_version_with_filter, byte-identical 1.3.0 -> 1.3.14); dist-tag
+ * degrade uses the shared cross-PM rule:
+ * - exact pin too new -> hard error (TooRecentVersion), no fallback.
+ * - range -> the `latest` dist-tag is checked first: in-range and age-passing ->
+ *   return it immediately. Otherwise walk newest to oldest skipping age-blocked;
+ *   the first age-passing candidate must also be stable (gap to the next-newer
+ *   version >= min(window, 7d), inclusive); unstable -> keep walking but remember
+ *   it; stop past `now - (window + 7d)`; no stable -> newest age-passing fallback.
+ *   No in-range version at all -> err.not_found (a plain, non-cooldown error).
+ * - dist-tag too new -> degrade via the shared channel-aware rule (see
+ *   `degradeTagToCompliant` for the ordering); none compliant ->
+ *   TooRecentVersion.
+ * Missing/unparseable publish times are treated as timestamp 0 (always pass);
+ * future timestamps are blocked.
+ */
+function pickBunVersion(spec, metadata, policy) {
+    const type = (0, pick_1.classifySpec)(spec);
+    if (type === 'exact') {
+        if (passesGate(metadata, policy, spec)) {
+            return { version: spec, unconstrained: spec };
+        }
+        throw tooRecent(metadata, policy, spec);
+    }
+    if (type === 'tag') {
+        const target = metadata.distTags[spec];
+        if (!target) {
+            throw tooRecent(metadata, policy, spec);
+        }
+        if (passesGate(metadata, policy, target)) {
+            return { version: target, unconstrained: target };
+        }
+        const degraded = (0, pick_1.degradeTagToCompliant)(target, metadata, (v) => passesGate(metadata, policy, v));
+        if (degraded) {
+            return { version: degraded, unconstrained: target };
+        }
+        throw tooRecent(metadata, policy, spec);
+    }
+    // bun splits its manifest into a stable `releases` list and a `prereleases`
+    // list and only consults prereleases when the range itself carries a
+    // prerelease comparator (npm.zig findBestVersionWithFilter, Group.Flags.pre).
+    // Default node-semver semantics replicate that: a prerelease version is only
+    // admitted when the range has a comparator with the same [major,minor,patch].
+    const inRange = metadata.versions
+        .filter((v) => (0, semver_1.satisfies)(v, spec))
+        .sort(semver_1.rcompare);
+    const unconstrained = inRange[0] ?? spec;
+    // No in-range version at all is bun's err.not_found (NOT a cooldown error); a
+    // plain Error lets the migrate install-fallback surface bun's NoMatchingVersion.
+    if (inRange.length === 0) {
+        throw new Error(`No matching version found for ${metadata.name}@${spec}.`);
+    }
+    // bun's findBestVersionWithFilter checks the `latest` dist-tag first: if it
+    // satisfies the range and passes the gate, it returns immediately, before the
+    // stability walk (npm.zig findBestVersionWithFilter, findByDistTag("latest")).
+    const latest = metadata.distTags['latest'];
+    if (latest &&
+        (0, semver_1.satisfies)(latest, spec) &&
+        passesGate(metadata, policy, latest)) {
+        return { version: latest, unconstrained };
+    }
+    const picked = walkStability(metadata, policy, inRange, null);
+    if (picked) {
+        return { version: picked, unconstrained };
+    }
+    throw tooRecent(metadata, policy, spec);
+}
+/**
+ * Walks `candidates` (already sorted newest-first) applying bun's stability
+ * heuristic. `tagTarget`, when set, seeds the prior age-blocked version so the
+ * gap is measured against the tag's resolved version. Returns the picked
+ * version, or null when every candidate is blocked.
+ */
+function walkStability(metadata, policy, candidates, tagTarget) {
+    const now = Date.now();
+    const stabilityWindowMs = Math.min(policy.windowMs, SEVEN_DAYS_MS);
+    const searchBoundMs = now - (policy.windowMs + SEVEN_DAYS_MS);
+    let prevBlocked = tagTarget;
+    let best = null;
+    for (const version of candidates) {
+        if (!passesGate(metadata, policy, version)) {
+            prevBlocked = version;
+            continue;
+        }
+        if (prevBlocked === null) {
+            // Newest age-passing candidate with nothing newer blocked: take it.
+            return version;
+        }
+        if (publishMs(metadata, version) < searchBoundMs) {
+            // Past the search bound: stop and use the best age-passing version found.
+            return best ?? version;
+        }
+        const stable = publishMs(metadata, prevBlocked) - publishMs(metadata, version) >=
+            stabilityWindowMs;
+        if (stable) {
+            return version;
+        }
+        best ??= version;
+        prevBlocked = version;
+    }
+    // No stable candidate: fall back to the newest age-passing version, if any.
+    return best;
+}
+// A version passes when its publish time is at or before the cutoff
+// (inclusive), or when it is excluded. Missing time -> timestamp 0 -> passes.
+function passesGate(metadata, policy, version) {
+    if (policy.isExcluded(metadata.name, version)) {
+        return true;
+    }
+    return publishMs(metadata, version) <= policy.cutoffMs;
+}
+// Publish time in epoch ms; missing/unparseable -> 0 (bun's timestamp default).
+function publishMs(metadata, version) {
+    const time = metadata.time?.[version];
+    if (!time) {
+        return 0;
+    }
+    const parsed = Date.parse(time);
+    return Number.isNaN(parsed) ? 0 : parsed;
+}
+function tooRecent(metadata, policy, spec) {
+    const blocked = blockedCandidates(metadata, spec);
+    return new errors_1.MinReleaseAgeViolationError({
+        packageManager: 'bun',
+        packageName: metadata.name,
+        spec,
+        pmShapedDetail: `${metadata.name}@${spec} was blocked by minimum-release-age (${policy.sourceDescription}).`,
+        blocked,
+        remediation: [
+            `Add "${metadata.name}" to install.minimumReleaseAgeExcludes in bunfig.toml, or lower ${policy.sourceDescription}.`,
+        ],
+    });
+}
+function blockedCandidates(metadata, spec) {
+    const matching = (0, semver_1.valid)(spec)
+        ? [spec]
+        : metadata.versions.filter((v) => {
+            try {
+                // Same release/prerelease split bun applies in its resolver.
+                return (0, semver_1.satisfies)(v, spec);
+            }
+            catch {
+                return false;
+            }
+        });
+    return (0, pick_1.blockedVersionsFrom)(metadata, matching);
+}

package/dist/src/utils/min-release-age/behavior/npm.d.ts

@@ -0,0 +1,21 @@
+import type { RegistryMetadata } from '../packument';
+import { type PickOutcome } from '../pick';
+import type { MinReleaseAgePolicy, MinReleaseAgePolicyReadResult } from '../policy';
+/**
+ * Reads npm's merged effective config (project + user + global + builtin npmrc
+ * plus npm_config_* env) by spawning `npm config list --json` once at the
+ * workspace root, then derives the cooldown cutoff from `min-release-age`
+ * (days) and `before` (absolute date).
+ */
+export declare function readNpmPolicy(root: string, pmVersion: string, env?: NodeJS.ProcessEnv): Promise<MinReleaseAgePolicyReadResult>;
+/**
+ * npm resolution under an active `before` filter. Exact pins and ranges mirror
+ * npm-pick-manifest@11.0.3; dist-tag degrade uses the shared cross-PM rule:
+ * - exact pin too new -> ETARGET (no fallback).
+ * - unknown dist-tag -> ETARGET (no version to resolve against).
+ * - dist-tag too new -> degrade via the shared channel-aware rule (see
+ *   `degradeTagToCompliant` for the ordering); none compliant -> ENOVERSIONS.
+ * - range -> filter every version by maturity FIRST; empty -> ENOVERSIONS;
+ *   else newest in-range survivor; survivors but none in range -> ETARGET.
+ */
+export declare function pickNpmVersion(spec: string, metadata: RegistryMetadata, policy: MinReleaseAgePolicy): PickOutcome;

package/dist/src/utils/min-release-age/behavior/npm.js

@@ -0,0 +1,293 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readNpmPolicy = readNpmPolicy;
+exports.pickNpmVersion = pickNpmVersion;
+const child_process_1 = require("child_process");
+const os_1 = require("os");
+const path_1 = require("path");
+const semver_1 = require("semver");
+const constants_1 = require("../constants");
+const errors_1 = require("../errors");
+const npmrc_1 = require("../npmrc");
+const pick_1 = require("../pick");
+const RANK_UNKNOWN = 0; // global/builtin/default - not detectable here
+const RANK_USER = 1;
+const RANK_PROJECT = 2;
+const RANK_ENV = 3;
+/**
+ * Reads npm's merged effective config (project + user + global + builtin npmrc
+ * plus npm_config_* env) by spawning `npm config list --json` once at the
+ * workspace root, then derives the cooldown cutoff from `min-release-age`
+ * (days) and `before` (absolute date).
+ */
+async function readNpmPolicy(root, pmVersion, env = process.env) {
+    let config;
+    try {
+        const raw = (0, child_process_1.execSync)('npm config list --json', {
+            cwd: root,
+            encoding: 'utf-8',
+            windowsHide: true,
+        });
+        config = JSON.parse(raw);
+    }
+    catch {
+        return {
+            outcome: 'ambiguous',
+            reason: 'Unable to read the effective npm configuration.',
+        };
+    }
+    const mraRaw = config['min-release-age'];
+    const beforeRaw = config['before'];
+    const hasMra = mraRaw !== undefined && mraRaw !== null;
+    const hasBefore = beforeRaw !== undefined && beforeRaw !== null;
+    if (hasMra && hasBefore) {
+        // 11.10-11.14 has no per-source guard and npm itself can TypeError when a
+        // git: dep is involved, so we don't try to mimic it.
+        if (!(0, semver_1.gte)(pmVersion, '11.15.0')) {
+            return {
+                outcome: 'ambiguous',
+                reason: 'Both min-release-age and before are set; npm 11.10-11.14 may error.',
+            };
+        }
+        // 11.15+ resolves the two keys by emulating npm's per-source flatten
+        // (before wins within a source; normal precedence wins across sources).
+        return resolveBothKeys(mraRaw, beforeRaw, pmVersion, root, env);
+    }
+    if (hasBefore) {
+        return buildPolicyFromBefore(beforeRaw, pmVersion);
+    }
+    if (hasMra) {
+        return buildPolicyFromMinReleaseAge(mraRaw, pmVersion);
+    }
+    return { outcome: 'inactive' };
+}
+/**
+ * Emulates npm 11.15+ config flatten for the case where both `min-release-age`
+ * and `before` resolve to a value. npm iterates config sources from lowest to
+ * highest precedence, each overwriting the flat `before`. Within one source,
+ * `before` wins (the `Object.hasOwn(obj, 'before')` guard skips the
+ * min-release-age flatten); across sources, the highest-precedence source's
+ * contribution wins.
+ */
+function resolveBothKeys(mraRaw, beforeRaw, pmVersion, root, env) {
+    const surfaces = detectSurfaces(root, env);
+    // Highest detected rank per key; the merged values already reflect npm's
+    // per-key precedence, so we only need to know which key's source wins.
+    const mraRank = surfaces.minReleaseAge ?? RANK_UNKNOWN;
+    const beforeRank = surfaces.before ?? RANK_UNKNOWN;
+    // Same source carries both keys -> before wins there (hasOwn guard). When the
+    // before source ranks at least as high as the min-release-age source, before
+    // is the last writer; otherwise min-release-age overwrites a lower-ranked
+    // before.
+    if (beforeRank >= mraRank) {
+        return buildPolicyFromBefore(beforeRaw, pmVersion);
+    }
+    return buildPolicyFromMinReleaseAge(mraRaw, pmVersion);
+}
+// Detects which config surface(s) set each cooldown key, ranked by npm's
+// precedence. Only env + project/user .npmrc are observable here; global,
+// builtin, and default sources fall into RANK_UNKNOWN.
+function detectSurfaces(root, env) {
+    const result = {};
+    const note = (key, rank) => {
+        const current = result[key];
+        if (current === undefined || rank > current) {
+            result[key] = rank;
+        }
+    };
+    const userNpmrc = readNpmrcKeys(env['npm_config_userconfig'] ?? env['NPM_CONFIG_USERCONFIG'], (0, path_1.join)((0, os_1.homedir)(), '.npmrc'));
+    if (userNpmrc.minReleaseAge)
+        note('minReleaseAge', RANK_USER);
+    if (userNpmrc.before)
+        note('before', RANK_USER);
+    const projectNpmrc = readNpmrcKeys(undefined, (0, path_1.join)(root, '.npmrc'));
+    if (projectNpmrc.minReleaseAge)
+        note('minReleaseAge', RANK_PROJECT);
+    if (projectNpmrc.before)
+        note('before', RANK_PROJECT);
+    // npm matches npm_config_* case-insensitively; replaces non-leading _ with -.
+    if (readEnvKey(env, 'min-release-age') !== undefined) {
+        note('minReleaseAge', RANK_ENV);
+    }
+    if (readEnvKey(env, 'before') !== undefined) {
+        note('before', RANK_ENV);
+    }
+    return result;
+}
+function readNpmrcKeys(override, fallback) {
+    const present = { minReleaseAge: false, before: false };
+    for (const { key } of (0, npmrc_1.readNpmrcEntries)(override ?? fallback) ?? []) {
+        if (key === 'min-release-age') {
+            present.minReleaseAge = true;
+        }
+        else if (key === 'before') {
+            present.before = true;
+        }
+    }
+    return present;
+}
+// npm's loadEnv strips the npm_config_ prefix (case-insensitive), then
+// normalizes the rest with `key.replace(/(?!^)_/g, '-').toLowerCase()`, so both
+// npm_config_min_release_age and npm_config_min-release-age map to the kebab key.
+function readEnvKey(env, kebabKey) {
+    for (const [name, value] of Object.entries(env)) {
+        if (value === undefined || value === '') {
+            continue;
+        }
+        if (!/^npm_config_/i.test(name)) {
+            continue;
+        }
+        const normalized = name
+            .slice('npm_config_'.length)
+            .replace(/(?!^)_/g, '-')
+            .toLowerCase();
+        if (normalized === kebabKey) {
+            return value;
+        }
+    }
+    return undefined;
+}
+function buildPolicyFromMinReleaseAge(mraRaw, pmVersion) {
+    const days = typeof mraRaw === 'number' ? mraRaw : Number(mraRaw);
+    if (!Number.isFinite(days)) {
+        return {
+            outcome: 'ambiguous',
+            reason: `Invalid npm min-release-age value: ${String(mraRaw)}.`,
+        };
+    }
+    // 0 disables (11.15+) or sets cutoff=now (11.10-11.14, everything published
+    // passes); negative pushes the cutoff into the future. Both are inert.
+    if (days <= 0) {
+        return { outcome: 'inactive' };
+    }
+    const windowMs = days * constants_1.MS_PER_DAY;
+    const cutoffMs = Date.now() - windowMs;
+    return {
+        outcome: 'active',
+        policy: createNpmPolicy({
+            pmVersion,
+            cutoffMs,
+            windowMs,
+            sourceDescription: `npm min-release-age (${days} day${days === 1 ? '' : 's'})`,
+        }),
+    };
+}
+function buildPolicyFromBefore(beforeRaw, pmVersion) {
+    const cutoffMs = Date.parse(String(beforeRaw));
+    if (Number.isNaN(cutoffMs)) {
+        return {
+            outcome: 'ambiguous',
+            reason: `Invalid npm before value: ${String(beforeRaw)}.`,
+        };
+    }
+    const windowMs = Date.now() - cutoffMs;
+    // before in the future -> every published version passes; nothing to gate.
+    if (windowMs <= 0) {
+        return { outcome: 'inactive' };
+    }
+    return {
+        outcome: 'active',
+        policy: createNpmPolicy({
+            pmVersion,
+            cutoffMs,
+            windowMs,
+            sourceDescription: `npm before (${new Date(cutoffMs).toISOString()})`,
+        }),
+    };
+}
+function createNpmPolicy(opts) {
+    return {
+        packageManagerVersion: opts.pmVersion,
+        cutoffMs: opts.cutoffMs,
+        windowMs: opts.windowMs,
+        sourceDescription: opts.sourceDescription,
+        // npm has no excludes surface.
+        isExcluded: () => false,
+        behavior: { packageManager: 'npm' },
+    };
+}
+/**
+ * npm resolution under an active `before` filter. Exact pins and ranges mirror
+ * npm-pick-manifest@11.0.3; dist-tag degrade uses the shared cross-PM rule:
+ * - exact pin too new -> ETARGET (no fallback).
+ * - unknown dist-tag -> ETARGET (no version to resolve against).
+ * - dist-tag too new -> degrade via the shared channel-aware rule (see
+ *   `degradeTagToCompliant` for the ordering); none compliant -> ENOVERSIONS.
+ * - range -> filter every version by maturity FIRST; empty -> ENOVERSIONS;
+ *   else newest in-range survivor; survivors but none in range -> ETARGET.
+ */
+function pickNpmVersion(spec, metadata, policy) {
+    const type = (0, pick_1.classifySpec)(spec);
+    if (type === 'exact') {
+        const unconstrained = spec;
+        // npm-pick-manifest resolves `mani = versions[ver]` -> undefined for an
+        // unpublished pin and throws ETARGET. `versions` is the sole source of
+        // truth: an unpublished version lingers in the `time` map but is gone from
+        // `versions`, so a `time` entry alone must not make it resolvable.
+        const exists = metadata.versions.includes(spec);
+        if (exists && (0, pick_1.isVersionMature)(metadata.name, spec, metadata, policy)) {
+            return { version: spec, unconstrained };
+        }
+        throw etarget(metadata, policy, spec, [spec]);
+    }
+    if (type === 'tag') {
+        const tagTarget = metadata.distTags[spec];
+        if (!tagTarget) {
+            // npm-pick-manifest returns undefined for an unknown tag (no dist-tag
+            // entry, no version), then throws ETARGET - not ENOVERSIONS.
+            throw etarget(metadata, policy, spec, []);
+        }
+        const unconstrained = tagTarget;
+        if ((0, pick_1.isVersionMature)(metadata.name, tagTarget, metadata, policy)) {
+            return { version: tagTarget, unconstrained };
+        }
+        const degraded = (0, pick_1.degradeTagToCompliant)(tagTarget, metadata, (v) => (0, pick_1.isVersionMature)(metadata.name, v, metadata, policy));
+        if (degraded) {
+            return { version: degraded, unconstrained };
+        }
+        throw enoVersions(metadata, policy, spec);
+    }
+    return pickRange(metadata, policy, spec, spec, (0, pick_1.newestInRange)(metadata, spec));
+}
+function pickRange(metadata, policy, range, reportedSpec, unconstrained) {
+    const mature = metadata.versions.filter((v) => (0, pick_1.isVersionMature)(metadata.name, v, metadata, policy));
+    // npm throws ENOVERSIONS when the date filter leaves nothing at all.
+    if (mature.length === 0) {
+        throw enoVersions(metadata, policy, reportedSpec);
+    }
+    const inRange = mature
+        .filter((v) => (0, semver_1.satisfies)(v, range, { includePrerelease: false }))
+        .sort(semver_1.rcompare);
+    if (inRange.length === 0) {
+        const blocked = metadata.versions
+            .filter((v) => (0, semver_1.satisfies)(v, range, { includePrerelease: false }))
+            .sort(semver_1.rcompare);
+        throw etarget(metadata, policy, reportedSpec, blocked);
+    }
+    return { version: inRange[0], unconstrained };
+}
+function etarget(metadata, policy, spec, blockedVersions) {
+    const beforeStr = new Date(policy.cutoffMs).toLocaleString();
+    return new errors_1.MinReleaseAgeViolationError({
+        packageManager: 'npm',
+        packageName: metadata.name,
+        spec,
+        pmShapedDetail: `No matching version found for ${metadata.name}@${spec} with a date before ${beforeStr}.`,
+        blocked: (0, pick_1.blockedVersionsFrom)(metadata, blockedVersions),
+        remediation: [
+            `Wait until a matching version is older than the configured window, or lower ${policy.sourceDescription}.`,
+        ],
+    });
+}
+function enoVersions(metadata, policy, spec) {
+    return new errors_1.MinReleaseAgeViolationError({
+        packageManager: 'npm',
+        packageName: metadata.name,
+        spec,
+        pmShapedDetail: `No versions available for ${metadata.name}`,
+        blocked: (0, pick_1.blockedVersionsFrom)(metadata, metadata.versions),
+        remediation: [
+            `Wait until a version is older than the configured window, or lower ${policy.sourceDescription}.`,
+        ],
+    });
+}

package/dist/src/utils/min-release-age/behavior/pnpm.d.ts

@@ -0,0 +1,23 @@
+import type { RegistryMetadata } from '../packument';
+import { type PickOutcome } from '../pick';
+import type { MinReleaseAgePolicy, MinReleaseAgePolicyReadResult } from '../policy';
+/**
+ * Reads pnpm's effective cooldown configuration once by asking pnpm itself
+ * (`pnpm config list --json`) instead of re-implementing how it layers config
+ * surfaces (a moving target across pnpm versions). The window and excludes come
+ * straight from pnpm; the strict default, exclude grammar, and loose-fallback
+ * semantics stay version-keyed because pnpm does not report those resolved
+ * values.
+ */
+export declare function readPnpmPolicy(root: string, pmVersion: string): Promise<MinReleaseAgePolicyReadResult>;
+/**
+ * pnpm resolution under an active cooldown. Exact pins and ranges mirror pnpm's
+ * resolver; dist-tag degrade uses the shared cross-PM rule:
+ * - exact pin too new -> strict/v10 violation; v11 loose installs it (immature).
+ * - range -> newest mature; none -> v10/strict violation, v11 loose lowest
+ *   (least-immature) version unfiltered (immature).
+ * - dist-tag too new -> degrade via the shared channel-aware rule (see
+ *   `degradeTagToCompliant` for the ordering); none compliant -> violation
+ *   (v11 loose installs the original target immature).
+ */
+export declare function pickPnpmVersion(spec: string, metadata: RegistryMetadata, policy: MinReleaseAgePolicy): PickOutcome;