@pnpm/resolving.default-resolver 1100.1.2 → 1100.2.0

package/lib/index.d.ts

@@ -5,9 +5,10 @@ import type { FetchFromRegistry, GetAuthHeader } from '@pnpm/fetching.types';
 import { type CustomResolver } from '@pnpm/hooks.types';
 import { type GitResolveResult } from '@pnpm/resolving.git-resolver';
 import { type LocalResolveResult } from '@pnpm/resolving.local-resolver';
-import { type JsrResolveResult, type NamedRegistryResolveResult, type NpmResolveResult, type PackageMeta, type PackageMetaCache, type ResolverFactoryOptions, type WorkspaceResolveResult } from '@pnpm/resolving.npm-resolver';
-import type { ResolveFunction, ResolveOptions, ResolveResult, WantedDependency } from '@pnpm/resolving.resolver-base';
+import { type CreateNpmResolutionVerifierOptions, type JsrResolveResult, type NamedRegistryResolveResult, type NpmResolveResult, type PackageMeta, type PackageMetaCache, type ResolverFactoryOptions, type WorkspaceResolveResult } from '@pnpm/resolving.npm-resolver';
+import type { ResolutionVerifier, ResolveFunction, ResolveOptions, ResolveResult, WantedDependency } from '@pnpm/resolving.resolver-base';
 import { type TarballResolveResult } from '@pnpm/resolving.tarball-resolver';
+import type { RegistryConfig } from '@pnpm/types';
 export type { PackageMeta, PackageMetaCache, ResolveFunction, ResolverFactoryOptions, };
 export interface CustomResolverResolveResult extends ResolveResult {
     resolvedVia: 'custom-resolver';
@@ -21,3 +22,19 @@ export declare function createResolver(fetchFromRegistry: FetchFromRegistry, get
     resolve: DefaultResolver;
     clearCache: () => void;
 };
+export type ResolutionVerifierFactoryOptions = Pick<ResolverFactoryOptions, 'cacheDir' | 'registries' | 'namedRegistries' | 'retry' | 'timeout' | 'fetchWarnTimeoutMs'> & Pick<CreateNpmResolutionVerifierOptions, 'minimumReleaseAge' | 'minimumReleaseAgeStrict' | 'minimumReleaseAgeExclude' | 'ignoreMissingTimeField' | 'trustPolicy' | 'trustPolicyExclude' | 'trustPolicyIgnoreAfter' | 'now'> & {
+    configByUri?: Record<string, RegistryConfig>;
+};
+/**
+ * Companion to {@link createResolver}. Collects the resolver-specific
+ * verifier factories (today: npm) into a list. Returns an empty array
+ * when no policy is active — callers can cheaply decide whether to
+ * iterate at all by checking `verifiers.length`.
+ *
+ * Future protocols (jsr, git, attestation, etc.) plug in here by pushing
+ * their own `ResolutionVerifier` onto the list. Each verifier handles
+ * its own protocol short-circuit inside `verify` (returns `{ ok: true }`
+ * for resolutions outside its scope), so dispatch happens naturally at
+ * the install side — no combinator needed.
+ */
+export declare function createResolutionVerifiers(fetchFromRegistry: FetchFromRegistry, opts: ResolutionVerifierFactoryOptions): ResolutionVerifier[];

package/lib/index.js

@@ -3,9 +3,10 @@ import { resolveDenoRuntime } from '@pnpm/engine.runtime.deno-resolver';
 import { resolveNodeRuntime } from '@pnpm/engine.runtime.node-resolver';
 import { PnpmError } from '@pnpm/error';
 import { checkCustomResolverCanResolve } from '@pnpm/hooks.types';
+import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
 import { createGitResolver } from '@pnpm/resolving.git-resolver';
 import { resolveFromLocalPath, resolveFromLocalScheme } from '@pnpm/resolving.local-resolver';
-import { createNpmResolver, } from '@pnpm/resolving.npm-resolver';
+import { createNpmResolutionVerifier, createNpmResolver, } from '@pnpm/resolving.npm-resolver';
 import { resolveFromTarball } from '@pnpm/resolving.tarball-resolver';
 async function resolveFromCustomResolvers(customResolvers, wantedDependency, opts) {
     if (!customResolvers || customResolvers.length === 0) {
@@ -76,4 +77,44 @@ export function createResolver(fetchFromRegistry, getAuthHeader, pnpmOpts) {
         clearCache,
     };
 }
+/**
+ * Companion to {@link createResolver}. Collects the resolver-specific
+ * verifier factories (today: npm) into a list. Returns an empty array
+ * when no policy is active — callers can cheaply decide whether to
+ * iterate at all by checking `verifiers.length`.
+ *
+ * Future protocols (jsr, git, attestation, etc.) plug in here by pushing
+ * their own `ResolutionVerifier` onto the list. Each verifier handles
+ * its own protocol short-circuit inside `verify` (returns `{ ok: true }`
+ * for resolutions outside its scope), so dispatch happens naturally at
+ * the install side — no combinator needed.
+ */
+export function createResolutionVerifiers(fetchFromRegistry, opts) {
+    const fetchOpts = {
+        fetch: fetchFromRegistry,
+        retry: opts.retry ?? {},
+        timeout: opts.timeout ?? 60_000,
+        fetchWarnTimeoutMs: opts.fetchWarnTimeoutMs ?? 10_000,
+    };
+    const getAuthHeaderValueByURI = createGetAuthHeaderByURI(opts.configByUri ?? {}, opts.registries.default);
+    const verifiers = [];
+    const npmVerifier = createNpmResolutionVerifier({
+        minimumReleaseAge: opts.minimumReleaseAge,
+        minimumReleaseAgeStrict: opts.minimumReleaseAgeStrict,
+        minimumReleaseAgeExclude: opts.minimumReleaseAgeExclude,
+        ignoreMissingTimeField: opts.ignoreMissingTimeField,
+        trustPolicy: opts.trustPolicy,
+        trustPolicyExclude: opts.trustPolicyExclude,
+        trustPolicyIgnoreAfter: opts.trustPolicyIgnoreAfter,
+        registries: opts.registries,
+        namedRegistries: opts.namedRegistries,
+        fetchOpts,
+        getAuthHeaderValueByURI,
+        cacheDir: opts.cacheDir,
+        now: opts.now,
+    });
+    if (npmVerifier)
+        verifiers.push(npmVerifier);
+    return verifiers;
+}
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.default-resolver",
-  "version": "1100.1.2",
+  "version": "1100.2.0",
   "description": "pnpm's default package resolver",
   "keywords": [
     "pnpm",
@@ -26,29 +26,30 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/engine.runtime.deno-resolver": "1101.0.6",
-    "@pnpm/fetching.types": "1100.0.1",
+    "@pnpm/engine.runtime.bun-resolver": "1101.0.7",
+    "@pnpm/engine.runtime.node-resolver": "1101.0.9",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/engine.runtime.node-resolver": "1101.0.8",
-    "@pnpm/resolving.git-resolver": "1100.0.7",
-    "@pnpm/hooks.types": "1100.0.6",
-    "@pnpm/resolving.local-resolver": "1101.0.1",
-    "@pnpm/resolving.npm-resolver": "1101.1.1",
-    "@pnpm/resolving.resolver-base": "1100.1.3",
+    "@pnpm/fetching.types": "1100.0.1",
+    "@pnpm/engine.runtime.deno-resolver": "1101.0.7",
+    "@pnpm/hooks.types": "1100.0.7",
+    "@pnpm/network.auth-header": "1100.0.2",
+    "@pnpm/resolving.git-resolver": "1100.0.8",
+    "@pnpm/resolving.local-resolver": "1101.0.2",
+    "@pnpm/resolving.resolver-base": "1100.2.0",
+    "@pnpm/resolving.npm-resolver": "1101.2.0",
     "@pnpm/types": "1101.1.0",
-    "@pnpm/resolving.tarball-resolver": "1100.0.5",
-    "@pnpm/engine.runtime.bun-resolver": "1101.0.6"
+    "@pnpm/resolving.tarball-resolver": "1100.0.6"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
     "load-json-file": "^7.0.1",
     "tempy": "3.0.0",
-    "@pnpm/fetching.fetcher-base": "1100.1.3",
-    "@pnpm/resolving.default-resolver": "1100.1.2",
-    "@pnpm/network.fetch": "1100.0.4",
-    "@pnpm/testing.mock-agent": "1100.0.4",
-    "@pnpm/fetching.tarball-fetcher": "1101.0.7",
-    "@pnpm/store.cafs-types": "1100.0.1"
+    "@pnpm/fetching.fetcher-base": "1100.1.4",
+    "@pnpm/fetching.tarball-fetcher": "1101.0.8",
+    "@pnpm/network.fetch": "1100.0.5",
+    "@pnpm/resolving.default-resolver": "1100.2.0",
+    "@pnpm/store.cafs-types": "1100.0.1",
+    "@pnpm/testing.mock-agent": "1100.0.5"
   },
   "engines": {
     "node": ">=22.13"