@pnpm/engine.runtime.node-resolver 1101.1.22 → 1101.2.1

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # @pnpm/node.resolver
 
+## 1101.2.1
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/config.reader@1102.0.0
+  - @pnpm/crypto.shasums-file@1100.2.1
+  - @pnpm/error@1100.1.3
+  - @pnpm/resolving.resolver-base@1101.1.1
+  - @pnpm/types@1102.0.0
+
+## 1101.2.0
+
+### Minor Changes
+
+- Resolving a Node.js runtime version (`devEngines.runtime` / `runtime:` specifiers) is now much faster: the per-version release metadata is cached in the pnpm cache directory after its signature is verified, and an exact stable version such as `runtime:22.23.2` no longer downloads the Node.js release index. A pinned runtime whose metadata was fetched once resolves without any network access, which removes the noticeable delay on the first `node` invocation in a project pinning an already-downloaded runtime [#13899](https://github.com/pnpm/pnpm/issues/13899).
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/config.reader@1101.17.0
+  - @pnpm/crypto.shasums-file@1100.2.0
+  - @pnpm/error@1100.1.2
+
 ## 1101.1.22
 
 ### Patch Changes

package/lib/index.d.ts

@@ -15,6 +15,7 @@ export declare function resolveNodeRuntime(ctx: {
     fetchFromRegistry: FetchFromRegistry;
     nodeDownloadMirrors?: Record<string, string>;
     offline?: boolean;
+    cacheDir?: string;
 }, wantedDependency: WantedDependency, opts?: Partial<ResolveOptions>): Promise<NodeRuntimeResolveResult | null>;
 export declare function resolveLatestNodeRuntime(ctx: {
     fetchFromRegistry: FetchFromRegistry;

package/lib/index.js

@@ -1,4 +1,4 @@
-import { fetchShasumsFile, fetchVerifiedNodeShasumsFile } from '@pnpm/crypto.shasums-file';
+import { fetchShasumsFileCached, fetchVerifiedNodeShasumsFileCached } from '@pnpm/crypto.shasums-file';
 import { PnpmError } from '@pnpm/error';
 import semver from 'semver';
 import versionSelectorType from 'version-selector-type';
@@ -28,11 +28,32 @@ export async function resolveNodeRuntime(ctx, wantedDependency, opts) {
     const versionSpec = normalizeRuntimeSpec(wantedDependency.bareSpecifier.substring('runtime:'.length));
     const { releaseChannel, versionSpecifier } = parseNodeSpecifier(versionSpec);
     const nodeMirrorBaseUrl = getNodeMirror(ctx.nodeDownloadMirrors, releaseChannel);
-    const version = await resolveNodeVersion(ctx.fetchFromRegistry, versionSpecifier, nodeMirrorBaseUrl);
-    if (!version) {
-        throw new PnpmError('NODEJS_VERSION_NOT_FOUND', `Could not find a Node.js version that satisfies ${versionSpec}`);
+    // An exact stable-release specifier is its own resolution, so the
+    // release-index fetch is skipped for it and existence is proven by the
+    // asset-list fetch below.
+    const exactVersion = exactReleaseVersion(releaseChannel, versionSpecifier);
+    let version = exactVersion;
+    if (version == null) {
+        version = await resolveNodeVersion(ctx.fetchFromRegistry, versionSpecifier, nodeMirrorBaseUrl) ?? undefined;
+        if (!version) {
+            throw new PnpmError('NODEJS_VERSION_NOT_FOUND', `Could not find a Node.js version that satisfies ${versionSpec}`);
+        }
+    }
+    let variants;
+    try {
+        variants = await readNodeAssets(ctx.fetchFromRegistry, { nodeMirrorBaseUrl, version, releaseChannel, cacheDir: ctx.cacheDir });
+    }
+    catch (err) {
+        // The exact-specifier pick skipped the release index, so a failed asset
+        // read is ambiguous: the version may simply not exist. Consult the index
+        // now, purely to raise the same NODEJS_VERSION_NOT_FOUND the index-first
+        // path raises for a nonexistent version; any other outcome re-raises the
+        // asset error unchanged.
+        if (exactVersion != null && await versionMissingFromIndex(ctx.fetchFromRegistry, exactVersion, nodeMirrorBaseUrl)) {
+            throw new PnpmError('NODEJS_VERSION_NOT_FOUND', `Could not find a Node.js version that satisfies ${versionSpec}`);
+        }
+        throw err;
     }
-    const variants = await readNodeAssets(ctx.fetchFromRegistry, nodeMirrorBaseUrl, version, releaseChannel);
     const range = createNodeRuntimeVersionSpec(versionSpec, version, wantedDependency);
     return {
         id: `node@runtime:${version}`,
@@ -75,20 +96,44 @@ function createNodeRuntimeVersionSpec(versionSpec, resolvedVersion, wantedDepend
         return `~${resolvedVersion}`;
     return resolvedVersion;
 }
-async function readNodeAssets(fetch, nodeMirrorBaseUrl, version, releaseChannel) {
+/**
+ * The concrete version an exact stable-release specifier names, when the
+ * specifier is already in canonical `X.Y.Z` form. Such a specifier needs no
+ * release-index lookup: the index would resolve it to itself. Prereleases are
+ * excluded — on the `release` channel they never exist, so routing them
+ * through the index keeps the canonical not-found error path.
+ */
+function exactReleaseVersion(releaseChannel, versionSpecifier) {
+    if (releaseChannel !== 'release')
+        return undefined;
+    const parsed = semver.parse(versionSpecifier);
+    if (parsed == null || parsed.prerelease.length > 0 || parsed.build.length > 0 || parsed.version !== versionSpecifier)
+        return undefined;
+    return parsed.version;
+}
+async function versionMissingFromIndex(fetch, version, nodeMirrorBaseUrl) {
+    try {
+        return (await resolveNodeVersion(fetch, version, nodeMirrorBaseUrl)) == null;
+    }
+    catch {
+        return false;
+    }
+}
+async function readNodeAssets(fetch, opts) {
+    const { nodeMirrorBaseUrl, version, releaseChannel, cacheDir } = opts;
     // The mirror is repository-configurable, so the SHASUMS file's hashes are only
     // trustworthy once its OpenPGP signature is verified against the Node.js
     // release keys embedded in pnpm. Only the `release` channel publishes a signed
     // SHASUMS256.txt; pre-release channels (rc, nightly, …) are unsigned by Node,
     // so they cannot be verified this way.
-    const assets = await readNodeAssetsFromMirror(fetch, { nodeMirrorBaseUrl, version, muslOnly: false, verifySignature: releaseChannel === 'release' });
+    const assets = await readNodeAssetsFromMirror(fetch, { nodeMirrorBaseUrl, version, muslOnly: false, verifySignature: releaseChannel === 'release', cacheDir });
     // When using the default mirror, also fetch musl variants from unofficial-builds.nodejs.org,
     // since musl builds are not available on the official mirror. That URL is hardcoded (not
     // repository-configurable) and signed by a different (unofficial-builds) key, so it is trusted
     // over TLS rather than verified against the official release keys.
     if (nodeMirrorBaseUrl === DEFAULT_NODE_MIRROR_BASE_URL) {
         try {
-            const muslAssets = await readNodeAssetsFromMirror(fetch, { nodeMirrorBaseUrl: UNOFFICIAL_NODE_MIRROR_BASE_URL, version, muslOnly: true, verifySignature: false });
+            const muslAssets = await readNodeAssetsFromMirror(fetch, { nodeMirrorBaseUrl: UNOFFICIAL_NODE_MIRROR_BASE_URL, version, muslOnly: true, verifySignature: false, cacheDir });
             assets.push(...muslAssets);
         }
         catch {
@@ -98,11 +143,13 @@ async function readNodeAssets(fetch, nodeMirrorBaseUrl, version, releaseChannel)
     return assets;
 }
 async function readNodeAssetsFromMirror(fetch, opts) {
-    const { nodeMirrorBaseUrl, version, muslOnly, verifySignature } = opts;
+    const { nodeMirrorBaseUrl, version, muslOnly, verifySignature, cacheDir } = opts;
+    // The URL is pinned to one released version, which is what makes it
+    // eligible for the SHASUMS disk cache.
     const integritiesFileUrl = `${nodeMirrorBaseUrl}v${version}/SHASUMS256.txt`;
     const shasumsFileItems = verifySignature
-        ? await fetchVerifiedNodeShasumsFile(fetch, integritiesFileUrl)
-        : await fetchShasumsFile(fetch, integritiesFileUrl);
+        ? await fetchVerifiedNodeShasumsFileCached(fetch, integritiesFileUrl, { cacheDir })
+        : await fetchShasumsFileCached(fetch, integritiesFileUrl, { cacheDir });
     const escaped = version.replace(/\\/g, '\\\\').replace(/\./g, '\\.');
     // The second capture group uses [^.-]+ to stop at a dash, so that the optional
     // third group can capture the '-musl' suffix separately (e.g. 'x64' + '-musl').

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/engine.runtime.node-resolver",
-  "version": "1101.1.22",
+  "version": "1101.2.1",
   "description": "Resolves a Node.js version specifier to an exact Node.js version",
   "keywords": [
     "pnpm",
@@ -29,19 +29,19 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/config.reader": "1101.16.1",
-    "@pnpm/crypto.shasums-file": "1100.1.5",
-    "@pnpm/error": "1100.1.1",
+    "@pnpm/config.reader": "1102.0.0",
+    "@pnpm/crypto.shasums-file": "1100.2.1",
+    "@pnpm/error": "1100.1.3",
     "@pnpm/fetching.types": "1100.0.3",
-    "@pnpm/resolving.resolver-base": "1101.1.0",
-    "@pnpm/types": "1101.9.0",
+    "@pnpm/resolving.resolver-base": "1101.1.1",
+    "@pnpm/types": "1102.0.0",
     "semver": "^7.8.5",
     "version-selector-type": "^3.0.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/engine.runtime.node-resolver": "1101.1.22",
-    "@pnpm/network.fetch": "1100.1.11",
+    "@pnpm/engine.runtime.node-resolver": "1101.2.1",
+    "@pnpm/network.fetch": "1100.1.13",
     "@types/semver": "7.8.0"
   },
   "engines": {