@pnpm/installing.client 1100.0.15 → 1100.2.0

package/lib/index.d.ts

@@ -3,10 +3,11 @@ import { type TarballFetchers } from '@pnpm/fetching.tarball-fetcher';
 import type { RetryTimeoutOptions } from '@pnpm/fetching.types';
 import type { CustomFetcher, CustomResolver } from '@pnpm/hooks.types';
 import { type DispatcherOptions } from '@pnpm/network.fetch';
-import { type ResolveFunction, type ResolverFactoryOptions } from '@pnpm/resolving.default-resolver';
+import { type ResolutionVerifierFactoryOptions, type ResolveFunction, type ResolveLatestDispatcher, type ResolverFactoryOptions } from '@pnpm/resolving.default-resolver';
+import type { LatestInfo, LatestQuery, ResolutionVerifier } from '@pnpm/resolving.resolver-base';
 import type { StoreIndex } from '@pnpm/store.index';
 import type { RegistryConfig } from '@pnpm/types';
-export type { ResolveFunction };
+export type { LatestInfo, LatestQuery, ResolutionVerifier, ResolveFunction, ResolveLatestDispatcher };
 export type ClientOptions = {
     configByUri: Record<string, RegistryConfig>;
     customResolvers?: CustomResolver[];
@@ -23,17 +24,39 @@ export type ClientOptions = {
     includeOnlyPackageFiles?: boolean;
     preserveAbsolutePaths?: boolean;
     fetchMinSpeedKiBps?: number;
-} & ResolverFactoryOptions & DispatcherOptions;
+} & ResolverFactoryOptions & DispatcherOptions & Pick<ResolutionVerifierFactoryOptions, 'minimumReleaseAge' | 'minimumReleaseAgeStrict' | 'minimumReleaseAgeExclude' | 'ignoreMissingTimeField' | 'trustPolicy' | 'trustPolicyExclude' | 'trustPolicyIgnoreAfter'>;
 export interface Client {
     fetchers: Fetchers;
     resolve: ResolveFunction;
     clearResolutionCache: () => void;
+    /**
+     * List of resolver-side verifiers — one entry per active policy
+     * (today: at most one, `npm.minimumReleaseAge`). Empty when no policy
+     * is active. The install layer fans out across the list to re-validate
+     * each lockfile entry; each verifier handles its own protocol
+     * short-circuit inside `verify`.
+     */
+    resolutionVerifiers: ResolutionVerifier[];
 }
 export declare function createClient(opts: ClientOptions): Client;
 export declare function createResolver(opts: Omit<ClientOptions, 'storeIndex'>): {
     resolve: ResolveFunction;
+    resolveLatest: ResolveLatestDispatcher;
     clearCache: () => void;
 };
+/**
+ * Wraps a `ResolveFunction` so any inline policy violation surfaced by
+ * the resolver is rethrown as a `PnpmError` instead of being returned on
+ * the result. Use this from one-shot callers (dlx, self-update) that
+ * have nowhere to defer a violation to — the install command leaves
+ * resolution unwrapped because it aggregates violations across the
+ * whole tree before deciding what to do.
+ *
+ * The error mapping is centralized here so future violation codes
+ * (today: `MINIMUM_RELEASE_AGE_VIOLATION`) get a consistent error code
+ * across every strict-mode caller without each call site re-translating.
+ */
+export declare function makeResolutionStrict(resolve: ResolveFunction): ResolveFunction;
 type Fetchers = {
     git: GitFetcher;
     directory: DirectoryFetcher;

package/lib/index.js

@@ -1,11 +1,13 @@
 import { NODE_EXTRAS_IGNORE_PATTERN } from '@pnpm/engine.runtime.node-resolver';
+import { PnpmError } from '@pnpm/error';
 import { createBinaryFetcher } from '@pnpm/fetching.binary-fetcher';
 import { createDirectoryFetcher } from '@pnpm/fetching.directory-fetcher';
 import { createGitFetcher } from '@pnpm/fetching.git-fetcher';
 import { createTarballFetcher } from '@pnpm/fetching.tarball-fetcher';
 import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
 import { createFetchFromRegistry } from '@pnpm/network.fetch';
-import { createResolver as _createResolver, } from '@pnpm/resolving.default-resolver';
+import { createResolutionVerifiers, createResolver as _createResolver, } from '@pnpm/resolving.default-resolver';
+import { MINIMUM_RELEASE_AGE_VIOLATION_CODE } from '@pnpm/resolving.npm-resolver';
 export function createClient(opts) {
     const fetchFromRegistry = createFetchFromRegistry(opts);
     const getAuthHeader = createGetAuthHeaderByURI(opts.configByUri, opts.registries?.default);
@@ -14,6 +16,7 @@ export function createClient(opts) {
         fetchers: createFetchers(fetchFromRegistry, getAuthHeader, opts),
         resolve,
         clearResolutionCache,
+        resolutionVerifiers: createResolutionVerifiers(fetchFromRegistry, opts),
     };
 }
 export function createResolver(opts) {
@@ -21,6 +24,38 @@ export function createResolver(opts) {
     const getAuthHeader = createGetAuthHeaderByURI(opts.configByUri, opts.registries?.default);
     return _createResolver(fetchFromRegistry, getAuthHeader, { ...opts, customResolvers: opts.customResolvers });
 }
+/**
+ * Wraps a `ResolveFunction` so any inline policy violation surfaced by
+ * the resolver is rethrown as a `PnpmError` instead of being returned on
+ * the result. Use this from one-shot callers (dlx, self-update) that
+ * have nowhere to defer a violation to — the install command leaves
+ * resolution unwrapped because it aggregates violations across the
+ * whole tree before deciding what to do.
+ *
+ * The error mapping is centralized here so future violation codes
+ * (today: `MINIMUM_RELEASE_AGE_VIOLATION`) get a consistent error code
+ * across every strict-mode caller without each call site re-translating.
+ */
+export function makeResolutionStrict(resolve) {
+    return (async (wantedDependency, opts) => {
+        const result = await resolve(wantedDependency, opts);
+        if (result?.policyViolation) {
+            throw policyViolationToError(result.policyViolation);
+        }
+        return result;
+    });
+}
+function policyViolationToError(violation) {
+    const message = `${violation.name}@${violation.version} ${violation.reason}`;
+    // Map the per-violation `code` to the user-facing PnpmError code that
+    // pre-refactor callers (and `default-reporter`) already recognize.
+    // Future violation codes get their mapping added here so call sites
+    // don't have to re-translate.
+    const errorCode = violation.code === MINIMUM_RELEASE_AGE_VIOLATION_CODE
+        ? 'NO_MATURE_MATCHING_VERSION'
+        : violation.code;
+    return new PnpmError(errorCode, message);
+}
 function createFetchers(fetchFromRegistry, getAuthHeader, opts) {
     const tarballFetchers = createTarballFetcher(fetchFromRegistry, getAuthHeader, opts);
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.client",
-  "version": "1100.0.15",
+  "version": "1100.2.0",
   "description": "Creates the package resolve and fetch functions",
   "keywords": [
     "pnpm",
@@ -27,25 +27,27 @@
   ],
   "dependencies": {
     "ramda": "npm:@pnpm/ramda@0.28.1",
-    "@pnpm/fetching.directory-fetcher": "1100.0.9",
-    "@pnpm/fetching.binary-fetcher": "1101.0.5",
-    "@pnpm/engine.runtime.node-resolver": "1101.0.8",
-    "@pnpm/fetching.git-fetcher": "1101.0.6",
-    "@pnpm/hooks.types": "1100.0.6",
-    "@pnpm/types": "1101.1.0",
-    "@pnpm/resolving.default-resolver": "1100.1.2",
-    "@pnpm/store.index": "1100.1.0",
+    "@pnpm/engine.runtime.node-resolver": "1101.1.0",
+    "@pnpm/error": "1100.0.0",
+    "@pnpm/fetching.binary-fetcher": "1101.0.7",
+    "@pnpm/fetching.git-fetcher": "1101.0.8",
+    "@pnpm/fetching.directory-fetcher": "1100.0.11",
+    "@pnpm/network.auth-header": "1100.0.3",
+    "@pnpm/fetching.tarball-fetcher": "1101.0.9",
     "@pnpm/fetching.types": "1100.0.1",
-    "@pnpm/network.auth-header": "1100.0.2",
-    "@pnpm/fetching.tarball-fetcher": "1101.0.7",
-    "@pnpm/network.fetch": "1100.0.4",
-    "@pnpm/resolving.resolver-base": "1100.1.3"
+    "@pnpm/hooks.types": "1100.0.8",
+    "@pnpm/network.fetch": "1100.0.6",
+    "@pnpm/resolving.default-resolver": "1100.3.0",
+    "@pnpm/resolving.npm-resolver": "1101.3.0",
+    "@pnpm/resolving.resolver-base": "1100.3.0",
+    "@pnpm/types": "1101.1.1",
+    "@pnpm/store.index": "1100.1.0"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
     "@types/ramda": "0.31.1",
-    "@pnpm/fetching.fetcher-base": "1100.1.3",
-    "@pnpm/installing.client": "1100.0.15"
+    "@pnpm/fetching.fetcher-base": "1100.1.5",
+    "@pnpm/installing.client": "1100.2.0"
   },
   "engines": {
     "node": ">=22.13"