@mui/internal-code-infra 0.0.4-canary.100 → 0.0.4-canary.101

package/build/utils/pnpm.d.mts

@@ -263,18 +263,65 @@ export declare function writeOverridesToWorkspace(workspaceDir: string, override
  */
 export declare function renameWorkspaceScope(packages: (PublicPackage | PrivatePackage)[], fromScope: string, toScope: string): Promise<Map<string, string>>;
 /**
- * Resolve a package@version specifier to an exact version
+ * Pick the version to pin for a specifier whose newest match is too recent to
+ * satisfy a `minimumReleaseAge` cooldown.
+ *
+ * Only the three specifier shapes this tool is given are handled. An exact
+ * version is not a choice, so it stands and the install reports it. A range
+ * resolves within itself. A dist-tag repoints to the highest aged-in version
+ * sharing the major and prerelease-ness — except `latest`, which pnpm allows to
+ * cross majors. Unlike pnpm, a deprecated version is not passed over: `pnpm info`
+ * lists bare version strings, so that flag would cost a request per candidate.
+ *
+ * @param {string} requested - The specifier as given: a dist-tag, range or exact version
+ * @param {string} resolvedVersion - Version the specifier resolves to today
+ * @param {string[]} versions - Every published version, from `pnpm info <pkg> versions`
+ * @param {Record<string, string>} publishTimes - Version to ISO publish date, from `pnpm info <pkg> time`
+ * @param {number} cutoff - Epoch ms; versions published after this are too recent
+ * @param {string[]} [exemptVersions] - Versions `minimumReleaseAgeExclude` installs regardless of age
+ * @returns {string | null} Version to pin, or null when nothing qualifies
+ * @internal exported for unit tests
+ */
+export declare function selectAgedVersion(requested: string, resolvedVersion: string, versions: string[], publishTimes: Record<string, string>, cutoff: number, exemptVersions?: string[]): string | null;
+/**
+ * Read the effective pnpm configuration, including everything resolved from
+ * pnpm-workspace.yaml. `config list` types the values and omits unset keys,
+ * where `config get` stringifies everything and prints `undefined`.
+ *
+ * @returns {Promise<Record<string, any>>} Parsed configuration
+ */
+export declare function readPnpmConfig(): Promise<Record<string, any>>;
+/**
+ * Read the registry cooldown from pnpm config, so resolution stays in step with
+ * what the subsequent install will enforce.
+ *
+ * @returns {Promise<import('@pnpm/config.version-policy').PublishedByPolicy>} Cutoff date and exemption policy, both undefined when no cooldown is configured
+ */
+export declare function getMinimumReleaseAgePolicy(): Promise<import('@pnpm/config.version-policy').PublishedByPolicy>;
+/**
+ * Resolve a package@version specifier to an exact version.
+ *
+ * Given a cooldown policy, the result is the newest version the install will
+ * actually accept — a dist-tag on a daily channel always points at a build too
+ * recent to install under one. See {@link selectAgedVersion}.
+ *
  * @param {string} packageSpec - Package specifier in format "package@version"
+ * @param {import('@pnpm/config.version-policy').PublishedByPolicy} policy - Cooldown from {@link getMinimumReleaseAgePolicy}
  * @returns {Promise<string>} Exact version string
  */
-export declare function resolveVersion(packageSpec: string): Promise<string>;
+export declare function resolveVersion(packageSpec: string, policy: import('@pnpm/config.version-policy').PublishedByPolicy): Promise<string>;
 /**
  * Find the version of a dependency for a specific package@version
+ *
+ * The parent's spec is often a range, so the cooldown applies here too. Stepping
+ * back stays within that range and so never contradicts the parent.
+ *
  * @param {string} packageSpec - Package specifier in format "package@version"
  * @param {string} dependency - Dependency name to look up
+ * @param {import('@pnpm/config.version-policy').PublishedByPolicy} policy - Registry cooldown to resolve within
  * @returns {Promise<string>} Exact version string of the dependency
  */
-export declare function findDependencyVersionFromSpec(packageSpec: string, dependency: string): Promise<string>;
+export declare function findDependencyVersionFromSpec(packageSpec: string, dependency: string, policy: import('@pnpm/config.version-policy').PublishedByPolicy): Promise<string>;
 /**
  * Get the maximum semver version between two versions
  * @param {string} a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mui/internal-code-infra",
-  "version": "0.0.4-canary.100",
+  "version": "0.0.4-canary.101",
   "author": "MUI Team",
   "description": "Infra scripts and configs to be used across MUI repos.",
   "license": "MIT",
@@ -71,7 +71,9 @@
     "@octokit/auth-action": "^6.0.2",
     "@octokit/oauth-methods": "^6.0.2",
     "@octokit/rest": "^22.0.1",
+    "@pnpm/config.version-policy": "^1100.1.9",
     "@pnpm/find-workspace-dir": "^1000.1.5",
+    "@pnpm/parse-wanted-dependency": "^1001.0.0",
     "@typescript-eslint/types": "^8.64.0",
     "@typescript-eslint/utils": "^8.64.0",
     "@vitest/eslint-plugin": "^1.6.23",
@@ -188,7 +190,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitSha": "6542022a25f84984a49b5a8beafdff2df0e0966b",
+  "gitSha": "cbb48ed31d032fb3e0f5b02d9eaf72fcd5828376",
   "scripts": {
     "build": "tsgo -p tsconfig.build.json",
     "typescript": "tsgo -noEmit",

package/src/cli/cmdBuild.mjs

@@ -1,6 +1,5 @@
 /* eslint-disable no-console */
 import { findWorkspaceDir } from '@pnpm/find-workspace-dir';
-import { $ } from 'execa';
 import { globby } from 'globby';
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
@@ -15,6 +14,7 @@ import {
   mapConcurrently,
   validatePkgJson,
 } from '../utils/build.mjs';
+import { readPnpmConfig } from '../utils/pnpm.mjs';
 
 /**
  * @typedef {Object} Args
@@ -279,8 +279,7 @@ export default /** @type {import('yargs').CommandModule<{}, Args>} */ ({
     if (babelRuntimeVersion === 'catalog:') {
       // resolve the version from the given package
       // outputs the pnpm-workspace.yaml config as json
-      const { stdout: configStdout } = await $`pnpm config list --json`;
-      const pnpmWorkspaceConfig = JSON.parse(configStdout);
+      const pnpmWorkspaceConfig = await readPnpmConfig();
       babelRuntimeVersion = pnpmWorkspaceConfig.catalog['@babel/runtime'];
     }
 

package/src/cli/cmdSetVersionOverrides.mjs

@@ -3,7 +3,9 @@
 import * as semver from 'semver';
 import { $ } from 'execa';
 import { findWorkspaceDir } from '@pnpm/find-workspace-dir';
+import { parseWantedDependency } from '@pnpm/parse-wanted-dependency';
 import {
+  getMinimumReleaseAgePolicy,
   resolveVersion,
   findDependencyVersionFromSpec,
   writeOverridesToWorkspace,
@@ -17,61 +19,62 @@ import {
 /**
  * Process a single package override
  * @param {string} packageSpec - Package specifier in format "package@version"
+ * @param {import('@pnpm/config.version-policy').PublishedByPolicy} policy - Registry cooldown to resolve within
  * @returns {Promise<Record<string, string>>} Overrides object for this package
  */
-async function processPackageOverride(packageSpec) {
+async function processPackageOverride(packageSpec, policy) {
   /** @type {Record<string, string>} */
   const overrides = {};
 
-  // Extract package name to check for special cases
-  const lastAtIndex = packageSpec.lastIndexOf('@');
-  if (lastAtIndex === -1) {
+  const { alias: packageName, bareSpecifier: version } = parseWantedDependency(packageSpec);
+  if (!packageName || version === undefined) {
     throw new Error(`Invalid package specifier: ${packageSpec}`);
   }
 
-  const packageName = packageSpec.slice(0, lastAtIndex);
-  const version = packageSpec.slice(lastAtIndex + 1);
-
-  if (!packageName || !version || version === 'stable') {
+  // An empty version is distinct from a missing one: CI interpolates a matrix
+  // value into `--pkg pkg@<version>`, and the leg that leaves it unset must skip
+  // the override rather than fail the job.
+  if (!version || version === 'stable') {
     return overrides;
   }
 
   // eslint-disable-next-line no-console
   console.log(`Resolving overrides for ${packageName} version: ${version}`);
 
+  /** @param {string} spec */
+  const resolve = (spec) => resolveVersion(spec, policy);
+
   if (packageName === 'react') {
     // Special case for React - also override related packages
-    overrides.react = await resolveVersion(packageSpec);
-    overrides['react-dom'] = await resolveVersion(`react-dom@${version}`);
-    overrides['react-is'] = await resolveVersion(`react-is@${version}`);
+    overrides.react = await resolve(packageSpec);
+    overrides['react-dom'] = await resolve(`react-dom@${version}`);
+    overrides['react-is'] = await resolve(`react-is@${version}`);
     overrides.scheduler = await findDependencyVersionFromSpec(
       `react-dom@${overrides['react-dom']}`,
       'scheduler',
+      policy,
     );
 
     const reactMajor = semver.major(overrides.react);
     if (reactMajor === 17) {
-      overrides['@testing-library/react'] = await resolveVersion('@testing-library/react@^12.1.0');
+      overrides['@testing-library/react'] = await resolve('@testing-library/react@^12.1.0');
     }
   } else if (packageName === '@mui/material') {
     // Special case for MUI - also override related packages
-    overrides['@mui/material'] = await resolveVersion(`@mui/material@${version}`);
-    overrides['@mui/system'] = await resolveVersion(`@mui/system@${version}`);
-    overrides['@mui/icons-material'] = await resolveVersion(`@mui/icons-material@${version}`);
-    overrides['@mui/utils'] = await resolveVersion(`@mui/utils@${version}`);
-    overrides['@mui/material-nextjs'] = await resolveVersion(`@mui/material-nextjs@${version}`);
+    overrides['@mui/material'] = await resolve(`@mui/material@${version}`);
+    overrides['@mui/system'] = await resolve(`@mui/system@${version}`);
+    overrides['@mui/icons-material'] = await resolve(`@mui/icons-material@${version}`);
+    overrides['@mui/utils'] = await resolve(`@mui/utils@${version}`);
+    overrides['@mui/material-nextjs'] = await resolve(`@mui/material-nextjs@${version}`);
 
-    const latest = await resolveVersion(`@mui/material@latest`);
+    const latest = await resolve(`@mui/material@latest`);
     const latestMajor = semver.major(latest);
     const muiMajor = semver.major(overrides['@mui/material']);
-    if (muiMajor < latestMajor) {
-      overrides['@mui/lab'] = await resolveVersion(`@mui/lab@latest-v${muiMajor}`);
-    } else {
-      overrides['@mui/lab'] = await resolveVersion(`@mui/lab@latest`);
-    }
+    const labTag = muiMajor < latestMajor ? `latest-v${muiMajor}` : 'latest';
+    overrides['@mui/lab'] = await resolve(`@mui/lab@${labTag}`);
   } else {
     // Generic case for other packages
-    overrides[packageName] = await resolveVersion(packageSpec);
+    overrides[packageName] = await resolve(packageSpec);
   }
 
   return overrides;
@@ -89,8 +92,12 @@ async function handler(args) {
     return;
   }
 
+  // Read once and thread through: every override must land on a version that
+  // clears the same cooldown the following `pnpm dedupe` enforces.
+  const policy = await getMinimumReleaseAgePolicy();
+
   const packageOverridePromises = args.pkg.map((packageSpec) =>
-    processPackageOverride(packageSpec),
+    processPackageOverride(packageSpec, policy),
   );
   const packageOverrideResults = await Promise.all(packageOverridePromises);
 

package/src/utils/pnpm.mjs

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
 
+import { getPublishedByPolicy } from '@pnpm/config.version-policy';
+import { parseWantedDependency } from '@pnpm/parse-wanted-dependency';
 import { findWorkspaceDir } from '@pnpm/find-workspace-dir';
 import { $ } from 'execa';
 import * as fs from 'node:fs/promises';
@@ -328,10 +330,10 @@ function aliasTarget(spec) {
   if (!spec.startsWith('workspace:')) {
     return null;
   }
-  const range = spec.slice('workspace:'.length);
-  // Search from 1 so a scoped name's own leading `@` isn't read as the separator.
-  const separator = range.indexOf('@', 1);
-  return separator === -1 ? null : range.slice(0, separator);
+  const { alias, bareSpecifier } = parseWantedDependency(spec.slice('workspace:'.length));
+  // A plain range parses as one half or the other (`*` as an alias, `^1.0.0` as a
+  // specifier); only an aliased spec carries both.
+  return bareSpecifier === undefined ? null : (alias ?? null);
 }
 
 /**
@@ -720,26 +722,209 @@ export async function renameWorkspaceScope(packages, fromScope, toScope) {
 }
 
 /**
- * Resolve a package@version specifier to an exact version
+ * The versions a `minimumReleaseAgeExclude` policy exempts from the cooldown. A
+ * policy answers `true` for a package that is exempt at any version, or the list
+ * of versions exempted individually.
+ *
+ * @param {import('@pnpm/config.version-policy').PublishedByPolicy} policy - Policy from {@link getMinimumReleaseAgePolicy}
+ * @param {string} name - Package name
+ * @returns {true | string[]} `true` when every version is exempt, otherwise the exempt versions
+ */
+function cooldownExemptions(policy, name) {
+  const exemption = policy.publishedByExclude?.(name);
+  if (exemption === true) {
+    return true;
+  }
+  return Array.isArray(exemption) ? exemption : [];
+}
+
+/**
+ * Pick the version to pin for a specifier whose newest match is too recent to
+ * satisfy a `minimumReleaseAge` cooldown.
+ *
+ * Only the three specifier shapes this tool is given are handled. An exact
+ * version is not a choice, so it stands and the install reports it. A range
+ * resolves within itself. A dist-tag repoints to the highest aged-in version
+ * sharing the major and prerelease-ness — except `latest`, which pnpm allows to
+ * cross majors. Unlike pnpm, a deprecated version is not passed over: `pnpm info`
+ * lists bare version strings, so that flag would cost a request per candidate.
+ *
+ * @param {string} requested - The specifier as given: a dist-tag, range or exact version
+ * @param {string} resolvedVersion - Version the specifier resolves to today
+ * @param {string[]} versions - Every published version, from `pnpm info <pkg> versions`
+ * @param {Record<string, string>} publishTimes - Version to ISO publish date, from `pnpm info <pkg> time`
+ * @param {number} cutoff - Epoch ms; versions published after this are too recent
+ * @param {string[]} [exemptVersions] - Versions `minimumReleaseAgeExclude` installs regardless of age
+ * @returns {string | null} Version to pin, or null when nothing qualifies
+ * @internal exported for unit tests
+ */
+export function selectAgedVersion(
+  requested,
+  resolvedVersion,
+  versions,
+  publishTimes,
+  cutoff,
+  exemptVersions = [],
+) {
+  const exempt = new Set(exemptVersions);
+
+  /**
+   * Whether the install would accept this version: old enough, or excluded from
+   * the cooldown altogether.
+   *
+   * @param {string} version
+   * @returns {boolean}
+   */
+  const isInstallable = (version) => {
+    if (exempt.has(version)) {
+      return true;
+    }
+    const published = Date.parse(publishTimes[version]);
+    return Number.isFinite(published) && published <= cutoff;
+  };
+
+  // An unknown publish date leaves nothing to compare against, so the
+  // resolution stands rather than being swapped for another build.
+  if (!Object.hasOwn(publishTimes, resolvedVersion) || isInstallable(resolvedVersion)) {
+    return resolvedVersion;
+  }
+
+  if (semver.valid(requested)) {
+    return resolvedVersion;
+  }
+
+  // `time` keeps an entry for a version after it is unpublished, so candidates
+  // come from the version list rather than from the dates.
+  const candidates = versions.filter(isInstallable);
+
+  if (semver.validRange(requested)) {
+    return semver.maxSatisfying(candidates, requested, true);
+  }
+
+  const resolved = semver.parse(resolvedVersion, true);
+  if (!resolved) {
+    return resolvedVersion;
+  }
+  const resolvedIsPrerelease = resolved.prerelease.length > 0;
+
+  let best = null;
+  for (const version of candidates) {
+    const parsed = semver.parse(version, true);
+    if (
+      !parsed ||
+      (requested !== 'latest' && parsed.major !== resolved.major) ||
+      parsed.prerelease.length > 0 !== resolvedIsPrerelease
+    ) {
+      continue;
+    }
+    if (!best || semver.gt(version, best, true)) {
+      best = version;
+    }
+  }
+  return best;
+}
+
+/**
+ * Read the effective pnpm configuration, including everything resolved from
+ * pnpm-workspace.yaml. `config list` types the values and omits unset keys,
+ * where `config get` stringifies everything and prints `undefined`.
+ *
+ * @returns {Promise<Record<string, any>>} Parsed configuration
+ */
+export async function readPnpmConfig() {
+  const result = await $`pnpm config list --json`;
+  return JSON.parse(result.stdout);
+}
+
+/**
+ * Read the registry cooldown from pnpm config, so resolution stays in step with
+ * what the subsequent install will enforce.
+ *
+ * @returns {Promise<import('@pnpm/config.version-policy').PublishedByPolicy>} Cutoff date and exemption policy, both undefined when no cooldown is configured
+ */
+export async function getMinimumReleaseAgePolicy() {
+  const config = await readPnpmConfig();
+  // pnpm's own parser, so exclude entries keep their full grammar — wildcards,
+  // version unions (`pkg@1.0.0 || 2.0.0`) and `!` negation.
+  return getPublishedByPolicy({
+    minimumReleaseAge: config.minimumReleaseAge,
+    minimumReleaseAgeExclude: config.minimumReleaseAgeExclude,
+  });
+}
+
+/**
+ * Resolve a package@version specifier to an exact version.
+ *
+ * Given a cooldown policy, the result is the newest version the install will
+ * actually accept — a dist-tag on a daily channel always points at a build too
+ * recent to install under one. See {@link selectAgedVersion}.
+ *
  * @param {string} packageSpec - Package specifier in format "package@version"
+ * @param {import('@pnpm/config.version-policy').PublishedByPolicy} policy - Cooldown from {@link getMinimumReleaseAgePolicy}
  * @returns {Promise<string>} Exact version string
  */
-export async function resolveVersion(packageSpec) {
-  const result = await $`pnpm info ${packageSpec} version --json`;
-  const versions = JSON.parse(result.stdout);
-  return typeof versions === 'string' ? versions : versions[versions.length - 1];
+export async function resolveVersion(packageSpec, policy) {
+  // The unprojected document carries both the resolved version and every
+  // publish date, so honouring the cooldown costs no extra round-trip.
+  const info = JSON.parse((await $`pnpm info ${packageSpec} --json`).stdout);
+  const manifest = Array.isArray(info) ? info[info.length - 1] : info;
+  const { name, version: exactVersion, time: publishTimes = {}, versions = [] } = manifest;
+
+  if (!policy.publishedBy) {
+    return exactVersion;
+  }
+
+  const exemptVersions = cooldownExemptions(policy, name);
+  if (exemptVersions === true || exemptVersions.includes(exactVersion)) {
+    return exactVersion;
+  }
+
+  const cutoff = policy.publishedBy.toISOString();
+  const { bareSpecifier: requested } = parseWantedDependency(packageSpec);
+  const agedVersion = selectAgedVersion(
+    requested ?? '',
+    exactVersion,
+    versions,
+    publishTimes,
+    policy.publishedBy.getTime(),
+    exemptVersions,
+  );
+
+  if (!agedVersion) {
+    throw new Error(
+      `No version matching ${packageSpec} was published before the minimumReleaseAge cutoff ` +
+        `(${cutoff}). The newest match, ${exactVersion}, was published at ` +
+        `${publishTimes[exactVersion]}, and no earlier match qualifies. Lower ` +
+        `minimumReleaseAge, add ${name} to minimumReleaseAgeExclude, or wait for ${exactVersion} ` +
+        `to age in.`,
+    );
+  }
+
+  if (agedVersion !== exactVersion) {
+    // eslint-disable-next-line no-console
+    console.log(
+      `Resolved ${packageSpec} to ${agedVersion} rather than ${exactVersion}, which was published after the minimumReleaseAge cutoff (${cutoff}).`,
+    );
+  }
+
+  return agedVersion;
 }
 
 /**
  * Find the version of a dependency for a specific package@version
+ *
+ * The parent's spec is often a range, so the cooldown applies here too. Stepping
+ * back stays within that range and so never contradicts the parent.
+ *
  * @param {string} packageSpec - Package specifier in format "package@version"
  * @param {string} dependency - Dependency name to look up
+ * @param {import('@pnpm/config.version-policy').PublishedByPolicy} policy - Registry cooldown to resolve within
  * @returns {Promise<string>} Exact version string of the dependency
  */
-export async function findDependencyVersionFromSpec(packageSpec, dependency) {
+export async function findDependencyVersionFromSpec(packageSpec, dependency, policy) {
   const result = await $`pnpm info ${packageSpec} dependencies.${dependency}`;
   const spec = result.stdout.trim();
-  return resolveVersion(`${dependency}@${spec}`);
+  return resolveVersion(`${dependency}@${spec}`, policy);
 }
 
 /**