@pnpm/installing.deps-resolver 1100.0.9 → 1100.1.0

package/lib/index.d.ts

@@ -1,5 +1,6 @@
 import type { Catalogs } from '@pnpm/catalogs.types';
 import type { LockfileObject } from '@pnpm/lockfile.types';
+import type { ResolutionPolicyViolation } from '@pnpm/resolving.resolver-base';
 import { type DependenciesField, type PeerDependencyIssuesByProjects, type PinnedVersion, type ProjectManifest } from '@pnpm/types';
 import { getWantedDependencies, type WantedDependency } from './getWantedDependencies.js';
 import { type UpdateMatchingFunction } from './resolveDependencies.js';
@@ -37,6 +38,17 @@ export interface ResolveDependenciesResult {
     peerDependencyIssuesByProjects: PeerDependencyIssuesByProjects;
     waitTillAllFetchingsFinish: () => Promise<void>;
     wantedToBeSkippedPackageIds: Set<string>;
+    /**
+     * Policy violations collected inline during resolution — each
+     * resolver pushes to the list whenever it picks a version that
+     * trips one of its own checks (today: `minimumReleaseAge`). The
+     * install command reacts via `handleResolutionPolicyViolations`
+     * (prompt / abort) and `mutateModules` forwards the array out so
+     * the auto-persist path at the install's tail can drain it into
+     * the workspace manifest. Empty when no policy is active or no
+     * pick violates.
+     */
+    resolutionPolicyViolations: ResolutionPolicyViolation[];
 }
 export declare function resolveDependencies(importers: ImporterToResolve[], opts: ResolveDependenciesOptions & {
     defaultUpdateDepth: number;
@@ -51,4 +63,15 @@ export declare function resolveDependencies(importers: ImporterToResolve[], opts
     allowUnusedPatches?: boolean;
     enableGlobalVirtualStore?: boolean;
     allProjectIds: string[];
+    /**
+     * Generic checkpoint invoked between `resolveDependencyTree` and
+     * `resolvePeers` once any inline-collected policy violations have
+     * been gathered. Callers can prompt, persist, or throw based on
+     * the violations. Throwing unwinds before any peer-dep work,
+     * lockfile write, package.json update, or modules-dir change.
+     * Intentionally policy-neutral: each resolver owns its violation
+     * codes and the hook implementer (install command) decides what
+     * to do with them.
+     */
+    handleResolutionPolicyViolations?: (violations: readonly ResolutionPolicyViolation[]) => Promise<void>;
 }): Promise<ResolveDependenciesResult>;

package/lib/index.js

@@ -1,7 +1,8 @@
 import path from 'node:path';
 import { packageManifestLogger, } from '@pnpm/core-loggers';
-import { iterateHashedGraphNodes } from '@pnpm/deps.graph-hasher';
+import { findRuntimeNodeVersion, iterateHashedGraphNodes } from '@pnpm/deps.graph-hasher';
 import { isRuntimeDepPath } from '@pnpm/deps.path';
+import { PnpmError } from '@pnpm/error';
 import { verifyPatches } from '@pnpm/patching.config';
 import { safeReadPackageJsonFromDir } from '@pnpm/pkg-manifest.reader';
 import { getAllDependenciesFromManifest, getSpecFromPackageManifest, } from '@pnpm/pkg-manifest.utils';
@@ -29,7 +30,29 @@ export async function resolveDependencies(importers, opts) {
         noDependencySelectors: importers.every(({ wantedDependencies }) => wantedDependencies.length === 0),
     });
     const projectsToResolve = await Promise.all(importers.map(async (project) => _toResolveImporter(project)));
-    const { dependenciesTree, outdatedDependencies, resolvedImporters, resolvedPkgsById, wantedToBeSkippedPackageIds, appliedPatches, time, allPeerDepNames, } = await resolveDependencyTree(projectsToResolve, opts);
+    const { dependenciesTree, outdatedDependencies, resolvedImporters, resolvedPkgsById, wantedToBeSkippedPackageIds, appliedPatches, time, allPeerDepNames, resolutionPolicyViolations, } = await resolveDependencyTree(projectsToResolve, opts);
+    // Resolver-policy gate between main resolution and peer-dep
+    // resolution: every resolver records its own policy violations
+    // inline as it picks each version, and we hand the accumulated
+    // list to the install command's hook. The hook throws to abort
+    // cleanly — nothing on disk has changed yet, and we haven't paid
+    // the cost of peer resolution. Dispatch stays policy-neutral: each
+    // resolver owns its violation codes, and the hook implementer
+    // decides what to do with them.
+    //
+    // If violations fired but no hook was wired, throw rather than
+    // silently dropping them — the resolver-policy contract is "every
+    // pick that trips a check produces a violation that gets handled";
+    // a missing handler means the caller forgot to opt in and would
+    // otherwise see policy-rejected versions land in the lockfile.
+    if (resolutionPolicyViolations.length > 0) {
+        if (!opts.handleResolutionPolicyViolations) {
+            throw new PnpmError('RESOLUTION_POLICY_VIOLATIONS_UNHANDLED', `${resolutionPolicyViolations.length} resolution-policy ${resolutionPolicyViolations.length === 1 ? 'violation was' : 'violations were'} produced but no handleResolutionPolicyViolations callback was wired to react to them.`, {
+                hint: 'Internal: resolveDependencies needs a handleResolutionPolicyViolations callback whenever a policy that can produce violations (today: minimumReleaseAge) is active. Wire setupPolicyHandlers (in @pnpm/installing.commands) or supply a callback directly.',
+            });
+        }
+        await opts.handleResolutionPolicyViolations(resolutionPolicyViolations);
+    }
     opts.storeController.clearResolutionCache();
     // We only check whether patches were applied in cases when the whole lockfile was reanalyzed.
     if (opts.patchedDependencies &&
@@ -211,6 +234,7 @@ export async function resolveDependencies(importers, opts) {
         peerDependencyIssuesByProjects,
         waitTillAllFetchingsFinish,
         wantedToBeSkippedPackageIds,
+        resolutionPolicyViolations,
     };
 }
 function addDirectDependenciesToLockfile(newManifest, projectSnapshot, linkedPackages, directDependencies, excludeLinksFromLockfile) {
@@ -323,7 +347,15 @@ function extendGraph(graph, opts) {
     const pkgMetaIter = iterateGraphPkgMetaEntries(graph, !opts.enableGlobalVirtualStore);
     // Only use allowBuild for engine-agnostic hash optimization when GVS is on
     const allowBuild = opts.enableGlobalVirtualStore ? opts.allowBuild : undefined;
-    for (const { pkgMeta: { depPath }, hash } of iterateHashedGraphNodes(graph, pkgMetaIter, allowBuild, opts.supportedArchitectures)) {
+    // Anchor every snapshot's engine hash to the project-pinned Node
+    // version (from `engines.runtime` / `devEngines.runtime`) when the
+    // resolver produced one — the graph carries it as a
+    // `node@runtime:<version>` key. Without this, GVS slots for
+    // approved-build packages would hash under the runner's
+    // `process.version` instead of the script-runner Node, splitting
+    // the cache between pinned and non-pinned installs on the same host.
+    const nodeVersion = findRuntimeNodeVersion(Object.keys(graph));
+    for (const { pkgMeta: { depPath }, hash } of iterateHashedGraphNodes(graph, pkgMetaIter, allowBuild, opts.supportedArchitectures, nodeVersion)) {
         const modules = path.join(opts.globalVirtualStoreDir, hash, 'node_modules');
         const node = graph[depPath];
         Object.assign(node, {

package/lib/resolveDependencies.d.ts

@@ -2,7 +2,7 @@ import { type CatalogResolver } from '@pnpm/catalogs.resolver';
 import type { LockfileObject, PackageSnapshot, ResolvedDependencies } from '@pnpm/lockfile.types';
 import { type PatchGroupRecord } from '@pnpm/patching.config';
 import type { PatchInfo } from '@pnpm/patching.types';
-import { type DirectoryResolution, type PkgResolutionId, type PreferredVersions, type Resolution, type WorkspacePackages } from '@pnpm/resolving.resolver-base';
+import { type DirectoryResolution, type PkgResolutionId, type PreferredVersions, type Resolution, type ResolutionPolicyViolation, type WorkspacePackages } from '@pnpm/resolving.resolver-base';
 import type { PackageResponse, PkgRequestFetchResult, StoreController } from '@pnpm/store.controller-types';
 import type { AllowBuild, AllowedDeprecatedVersions, PackageManifest, PackageVersionPolicy, PinnedVersion, PkgIdWithPatchHash, ReadPackageHook, Registries, SupportedArchitectures, TrustPolicy } from '@pnpm/types';
 import { type WantedDependency } from './getNonDevWantedDependencies.js';
@@ -111,6 +111,16 @@ export interface ResolutionContext {
     hoistPeers?: boolean;
     maximumPublishedBy?: Date;
     publishedByExclude?: PackageVersionPolicy;
+    /**
+     * Shared accumulator the resolver pushes into when an inline policy
+     * check (today: minimumReleaseAge in `npm-resolver`) flags a pick.
+     * resolveDependencyTree hands the populated array back to the install
+     * command via its return so the post-tree gate can prompt / abort /
+     * persist without re-walking the resolved tree. Each verifier code
+     * (`MINIMUM_RELEASE_AGE_VIOLATION`, `TRUST_DOWNGRADE`, …) is the
+     * contract surface for downstream UX.
+     */
+    resolutionPolicyViolations: ResolutionPolicyViolation[];
     trustPolicy?: TrustPolicy;
     trustPolicyExclude?: PackageVersionPolicy;
     trustPolicyIgnoreAfter?: number;

package/lib/resolveDependencies.js

@@ -759,6 +759,7 @@ async function resolveDependency(wantedDependency, ctx, options) {
                     name: currentPkg.name,
                     resolution: currentPkg.resolution,
                     version: currentPkg.version,
+                    publishedAt: currentPkg.pkgId ? ctx.wantedLockfile.time?.[currentPkg.pkgId] : undefined,
                 }
                 : undefined,
             expectedPkg: currentPkg,
@@ -798,7 +799,7 @@ async function resolveDependency(wantedDependency, ctx, options) {
             bareSpecifier: wantedDependency.bareSpecifier,
             version: wantedDependency.alias ? wantedDependency.bareSpecifier : undefined,
         };
-        if (wantedDependency.optional && err.code !== 'ERR_PNPM_TRUST_DOWNGRADE' && err.code !== 'ERR_PNPM_NO_MATURE_MATCHING_VERSION') {
+        if (wantedDependency.optional && err.code !== 'ERR_PNPM_TRUST_DOWNGRADE') {
             skippedOptionalDependencyLogger.debug({
                 details: err.toString(),
                 package: wantedDependencyDetails,
@@ -821,6 +822,13 @@ async function resolveDependency(wantedDependency, ctx, options) {
             rawSpec: wantedDependency.bareSpecifier,
         },
     });
+    // Resolver-inline policy violations (e.g. minimumReleaseAge) flow up
+    // here; collect them onto the shared context so resolveDependencyTree
+    // can hand the full set to the install command between
+    // resolveDependencyTree and resolvePeers.
+    if (pkgResponse.body.policyViolation) {
+        ctx.resolutionPolicyViolations.push(pkgResponse.body.policyViolation);
+    }
     // Check if exotic dependencies are disallowed in subdependencies
     if (ctx.blockExoticSubdeps &&
         options.currentDepth > 0 &&

package/lib/resolveDependencyTree.d.ts

@@ -1,7 +1,7 @@
 import type { Catalogs } from '@pnpm/catalogs.types';
 import type { LockfileObject } from '@pnpm/lockfile.types';
 import type { PatchGroupRecord } from '@pnpm/patching.config';
-import type { PreferredVersions, Resolution, WorkspacePackages } from '@pnpm/resolving.resolver-base';
+import type { PreferredVersions, Resolution, ResolutionPolicyViolation, WorkspacePackages } from '@pnpm/resolving.resolver-base';
 import type { StoreController } from '@pnpm/store.controller-types';
 import type { AllowBuild, AllowedDeprecatedVersions, PinnedVersion, PkgResolutionId, ProjectId, ProjectManifest, ProjectRootDir, ReadPackageHook, Registries, SupportedArchitectures, TrustPolicy } from '@pnpm/types';
 import type { WantedDependency } from './getNonDevWantedDependencies.js';
@@ -119,5 +119,13 @@ export interface ResolveDependencyTreeResult {
     wantedToBeSkippedPackageIds: Set<string>;
     appliedPatches: Set<string>;
     time?: Record<string, string>;
+    /**
+     * Policy violations collected inline during resolution — the
+     * resolver pushes to this list whenever it picks a package that
+     * trips one of its own checks (today: `minimumReleaseAge`). The
+     * shape mirrors `ResolutionPolicyViolation`; downstream callers
+     * filter by `code` to decide what to do.
+     */
+    resolutionPolicyViolations: ResolutionPolicyViolation[];
 }
 export declare function resolveDependencyTree<T>(importers: Array<ImporterToResolveGeneric<T>>, opts: ResolveDependenciesOptions): Promise<ResolveDependencyTreeResult>;

package/lib/resolveDependencyTree.js

@@ -1,6 +1,5 @@
 import { resolveFromCatalog } from '@pnpm/catalogs.resolver';
-import { createPackageVersionPolicy } from '@pnpm/config.version-policy';
-import { PnpmError } from '@pnpm/error';
+import { createPackageVersionPolicyOrThrow, getPublishedByPolicy } from '@pnpm/config.version-policy';
 import { globalWarn } from '@pnpm/logger';
 import { BUILTIN_NAMED_REGISTRIES } from '@pnpm/resolving.npm-resolver';
 import { partition } from 'ramda';
@@ -10,6 +9,7 @@ import { resolveRootDependencies, } from './resolveDependencies.js';
 export async function resolveDependencyTree(importers, opts) {
     const wantedToBeSkippedPackageIds = new Set();
     const autoInstallPeers = opts.autoInstallPeers === true;
+    const { publishedBy, publishedByExclude } = getPublishedByPolicy(opts);
     const ctx = {
         allowBuild: opts.allowBuild,
         autoInstallPeers,
@@ -54,23 +54,14 @@ export async function resolveDependencyTree(importers, opts) {
         missingPeersOfChildrenByPkgId: {},
         hoistPeers: autoInstallPeers || opts.dedupePeerDependents,
         allPeerDepNames: new Set(),
-        maximumPublishedBy: opts.minimumReleaseAge ? new Date(Date.now() - opts.minimumReleaseAge * 60 * 1000) : undefined,
-        publishedByExclude: opts.minimumReleaseAgeExclude ? createPackageVersionPolicyByExclude(opts.minimumReleaseAgeExclude, 'minimumReleaseAgeExclude') : undefined,
+        maximumPublishedBy: publishedBy,
+        publishedByExclude,
         trustPolicy: opts.trustPolicy,
-        trustPolicyExclude: opts.trustPolicyExclude ? createPackageVersionPolicyByExclude(opts.trustPolicyExclude, 'trustPolicyExclude') : undefined,
+        trustPolicyExclude: opts.trustPolicyExclude ? createPackageVersionPolicyOrThrow(opts.trustPolicyExclude, 'trustPolicyExclude') : undefined,
         trustPolicyIgnoreAfter: opts.trustPolicyIgnoreAfter,
         blockExoticSubdeps: opts.blockExoticSubdeps,
+        resolutionPolicyViolations: [],
     };
-    function createPackageVersionPolicyByExclude(patterns, key) {
-        try {
-            return createPackageVersionPolicy(patterns);
-        }
-        catch (err) {
-            if (!err || typeof err !== 'object' || !('message' in err))
-                throw err;
-            throw new PnpmError(`INVALID_${key.replace(/([A-Z])/g, '_$1').toUpperCase()}`, `Invalid value in ${key}: ${err.message}`);
-        }
-    }
     const resolveArgs = importers.map((importer) => {
         const projectSnapshot = opts.wantedLockfile.importers[importer.id];
         // This may be optimized.
@@ -179,6 +170,7 @@ export async function resolveDependencyTree(importers, opts) {
         appliedPatches: ctx.appliedPatches,
         time,
         allPeerDepNames: ctx.allPeerDepNames,
+        resolutionPolicyViolations: ctx.resolutionPolicyViolations,
     };
 }
 function buildTree(ctx, parentId, parentIds, children, depth, installable) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-resolver",
-  "version": "1100.0.9",
+  "version": "1100.1.0",
   "description": "Resolves dependency graph of a package",
   "keywords": [
     "pnpm",
@@ -39,30 +39,30 @@
     "semver": "^7.7.2",
     "semver-range-intersect": "^0.3.1",
     "version-selector-type": "^3.0.0",
+    "@pnpm/catalogs.resolver": "1100.0.0",
+    "@pnpm/catalogs.types": "1100.0.0",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/config.version-policy": "1100.0.3",
-    "@pnpm/core-loggers": "1100.0.2",
-    "@pnpm/deps.graph-hasher": "1100.1.5",
+    "@pnpm/config.version-policy": "1100.1.0",
     "@pnpm/deps.path": "1100.0.3",
-    "@pnpm/catalogs.types": "1100.0.0",
+    "@pnpm/deps.graph-hasher": "1100.2.0",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/fetching.pick-fetcher": "1100.0.6",
-    "@pnpm/catalogs.resolver": "1100.0.0",
-    "@pnpm/lockfile.pruner": "1100.0.5",
-    "@pnpm/lockfile.types": "1100.0.5",
-    "@pnpm/lockfile.preferred-versions": "1100.0.8",
-    "@pnpm/lockfile.utils": "1100.0.7",
-    "@pnpm/patching.config": "1100.0.3",
-    "@pnpm/hooks.types": "1100.0.6",
-    "@pnpm/patching.types": "1100.0.0",
+    "@pnpm/fetching.pick-fetcher": "1100.0.7",
+    "@pnpm/hooks.types": "1100.0.7",
+    "@pnpm/lockfile.preferred-versions": "1100.0.10",
+    "@pnpm/lockfile.pruner": "1100.0.6",
+    "@pnpm/lockfile.utils": "1100.0.8",
     "@pnpm/deps.peer-range": "1100.0.1",
-    "@pnpm/pkg-manifest.utils": "1100.1.2",
-    "@pnpm/resolving.npm-resolver": "1101.1.0",
+    "@pnpm/patching.config": "1100.0.3",
     "@pnpm/pkg-manifest.reader": "1100.0.3",
-    "@pnpm/types": "1101.1.0",
+    "@pnpm/lockfile.types": "1100.0.6",
+    "@pnpm/patching.types": "1100.0.0",
+    "@pnpm/resolving.resolver-base": "1100.2.0",
+    "@pnpm/pkg-manifest.utils": "1100.1.4",
+    "@pnpm/resolving.npm-resolver": "1101.2.0",
+    "@pnpm/store.controller-types": "1100.1.0",
     "@pnpm/workspace.spec-parser": "1100.0.0",
-    "@pnpm/store.controller-types": "1100.0.6",
-    "@pnpm/resolving.resolver-base": "1100.1.3"
+    "@pnpm/types": "1101.1.0",
+    "@pnpm/core-loggers": "1100.1.0"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0"
@@ -72,7 +72,7 @@
     "@types/normalize-path": "^3.0.2",
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
-    "@pnpm/installing.deps-resolver": "1100.0.9",
+    "@pnpm/installing.deps-resolver": "1100.1.0",
     "@pnpm/logger": "1100.0.0"
   },
   "engines": {