@pnpm/resolving.npm-resolver 1004.4.1

package/lib/pickPackage.js

@@ -0,0 +1,278 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { ABBREVIATED_META_DIR, FULL_FILTERED_META_DIR, FULL_META_DIR } from '@pnpm/constants';
+import { createHexHash } from '@pnpm/crypto.hash';
+import { PnpmError } from '@pnpm/error';
+import gfs from '@pnpm/fs.graceful-fs';
+import { logger } from '@pnpm/logger';
+import getRegistryName from 'encode-registry';
+import pLimit, {} from 'p-limit';
+import { fastPathTemp as pathTemp } from 'path-temp';
+import { pick } from 'ramda';
+import { renameOverwrite } from 'rename-overwrite';
+import semver from 'semver';
+import { pickLowestVersionByVersionRange, pickPackageFromMeta, pickVersionByVersionRange, } from './pickPackageFromMeta.js';
+import { toRaw } from './toRaw.js';
+/**
+ * prevents simultaneous operations on the meta.json
+ * otherwise it would cause EPERM exceptions
+ */
+const metafileOperationLimits = {};
+/**
+ * To prevent metafileOperationLimits from holding onto objects in memory on
+ * the order of the number of packages, refcount the limiters and drop them
+ * once they are no longer needed. Callers of this function should ensure
+ * that the limiter is no longer referenced once fn's Promise has resolved.
+ */
+async function runLimited(pkgMirror, fn) {
+    let entry;
+    try {
+        entry = metafileOperationLimits[pkgMirror] ??= { count: 0, limit: pLimit(1) };
+        entry.count++;
+        return await fn(entry.limit);
+    }
+    finally {
+        entry.count--;
+        if (entry.count === 0) {
+            metafileOperationLimits[pkgMirror] = undefined;
+        }
+    }
+}
+const pickPackageFromMetaUsingTimeStrict = pickPackageFromMeta.bind(null, pickVersionByVersionRange);
+function pickPackageFromMetaUsingTime(opts, spec, meta) {
+    const pickedPackage = pickPackageFromMeta(pickVersionByVersionRange, opts, spec, meta);
+    if (pickedPackage)
+        return pickedPackage;
+    return pickPackageFromMeta(pickLowestVersionByVersionRange, {
+        preferredVersionSelectors: opts.preferredVersionSelectors,
+    }, spec, meta);
+}
+export async function pickPackage(ctx, spec, opts) {
+    opts = opts || {};
+    const pickPackageFromMetaBySpec = (opts.publishedBy
+        ? (ctx.strictPublishedByCheck ? pickPackageFromMetaUsingTimeStrict : pickPackageFromMetaUsingTime)
+        : (pickPackageFromMeta.bind(null, opts.pickLowestVersion ? pickLowestVersionByVersionRange : pickVersionByVersionRange))).bind(null, {
+        preferredVersionSelectors: opts.preferredVersionSelectors,
+        publishedBy: opts.publishedBy,
+        publishedByExclude: opts.publishedByExclude,
+    });
+    let _pickPackageFromMeta;
+    if (opts.updateToLatest) {
+        _pickPackageFromMeta = (meta) => {
+            const latestStableSpec = { ...spec, type: 'tag', fetchSpec: 'latest' };
+            const latestStable = pickPackageFromMetaBySpec(latestStableSpec, meta);
+            const current = pickPackageFromMetaBySpec(spec, meta);
+            if (!latestStable)
+                return current;
+            if (!current)
+                return latestStable;
+            if (semver.lt(latestStable.version, current.version))
+                return current;
+            return latestStable;
+        };
+    }
+    else {
+        _pickPackageFromMeta = pickPackageFromMetaBySpec.bind(null, spec);
+    }
+    validatePackageName(spec.name);
+    // Use full metadata for optional dependencies to get libc field.
+    // See: https://github.com/pnpm/pnpm/issues/9950
+    const fullMetadata = opts.optional === true || ctx.fullMetadata === true;
+    const metaDir = fullMetadata
+        ? (ctx.filterMetadata ? FULL_FILTERED_META_DIR : FULL_META_DIR)
+        : ABBREVIATED_META_DIR;
+    // Cache key includes fullMetadata to avoid returning abbreviated metadata when full metadata is requested.
+    const cacheKey = fullMetadata ? `${spec.name}:full` : spec.name;
+    const cachedMeta = ctx.metaCache.get(cacheKey);
+    if (cachedMeta != null) {
+        return {
+            meta: cachedMeta,
+            pickedPackage: _pickPackageFromMeta(cachedMeta),
+        };
+    }
+    const registryName = getRegistryName(opts.registry);
+    const pkgMirror = path.join(ctx.cacheDir, metaDir, registryName, `${encodePkgName(spec.name)}.json`);
+    return runLimited(pkgMirror, async (limit) => {
+        let metaCachedInStore;
+        if (ctx.offline === true || ctx.preferOffline === true || opts.pickLowestVersion) {
+            metaCachedInStore = await limit(async () => loadMeta(pkgMirror));
+            if (ctx.offline) {
+                if (metaCachedInStore != null)
+                    return {
+                        meta: metaCachedInStore,
+                        pickedPackage: _pickPackageFromMeta(metaCachedInStore),
+                    };
+                throw new PnpmError('NO_OFFLINE_META', `Failed to resolve ${toRaw(spec)} in package mirror ${pkgMirror}`);
+            }
+            if (metaCachedInStore != null) {
+                const pickedPackage = _pickPackageFromMeta(metaCachedInStore);
+                if (pickedPackage) {
+                    return {
+                        meta: metaCachedInStore,
+                        pickedPackage,
+                    };
+                }
+            }
+        }
+        if (!opts.updateToLatest && spec.type === 'version') {
+            metaCachedInStore = metaCachedInStore ?? await limit(async () => loadMeta(pkgMirror));
+            // use the cached meta only if it has the required package version
+            // otherwise it is probably out of date
+            if ((metaCachedInStore?.versions?.[spec.fetchSpec]) != null) {
+                try {
+                    const pickedPackage = _pickPackageFromMeta(metaCachedInStore);
+                    if (pickedPackage) {
+                        return {
+                            meta: metaCachedInStore,
+                            pickedPackage,
+                        };
+                    }
+                }
+                catch (err) {
+                    if (ctx.strictPublishedByCheck) {
+                        throw err;
+                    }
+                }
+            }
+        }
+        if (opts.publishedBy) {
+            metaCachedInStore = metaCachedInStore ?? await limit(async () => loadMeta(pkgMirror));
+            if (metaCachedInStore?.cachedAt && new Date(metaCachedInStore.cachedAt) >= opts.publishedBy) {
+                try {
+                    const pickedPackage = _pickPackageFromMeta(metaCachedInStore);
+                    if (pickedPackage) {
+                        return {
+                            meta: metaCachedInStore,
+                            pickedPackage,
+                        };
+                    }
+                }
+                catch (err) {
+                    if (ctx.strictPublishedByCheck) {
+                        throw err;
+                    }
+                }
+            }
+        }
+        try {
+            const fetchResult = await ctx.fetch(spec.name, {
+                authHeaderValue: opts.authHeaderValue,
+                fullMetadata,
+                registry: opts.registry,
+            });
+            const cachedAt = Date.now();
+            let meta = fetchResult.meta;
+            let jsonToSave;
+            if (ctx.filterMetadata) {
+                meta = clearMeta(meta);
+            }
+            else if (typeof fetchResult.jsonText === 'string') {
+                // Reuse the raw JSON text from the registry response to avoid re-stringifying.
+                // Inject cachedAt at the start of the JSON object. To be robust against BOMs or
+                // leading whitespace/newlines, locate the first '{' and splice after it.
+                const jsonText = fetchResult.jsonText;
+                const firstBraceIndex = jsonText.indexOf('{');
+                if (firstBraceIndex !== -1) {
+                    jsonToSave = `{"cachedAt":${cachedAt},${jsonText.slice(firstBraceIndex + 1)}`;
+                }
+            }
+            meta.cachedAt = cachedAt;
+            // only save meta to cache, when it is fresh
+            ctx.metaCache.set(cacheKey, meta);
+            if (!opts.dryRun) {
+                const jsonForDisk = jsonToSave ?? JSON.stringify(meta);
+                runLimited(pkgMirror, (limit) => limit(async () => {
+                    try {
+                        await saveMeta(pkgMirror, jsonForDisk);
+                    }
+                    catch (err) { // eslint-disable-line
+                        // We don't care if this file was not written to the cache
+                    }
+                }));
+            }
+            return {
+                meta,
+                pickedPackage: _pickPackageFromMeta(meta),
+            };
+        }
+        catch (err) { // eslint-disable-line
+            err.spec = spec;
+            const meta = await loadMeta(pkgMirror); // TODO: add test for this usecase
+            if (meta == null)
+                throw err;
+            logger.error(err, err);
+            logger.debug({ message: `Using cached meta from ${pkgMirror}` });
+            return {
+                meta,
+                pickedPackage: _pickPackageFromMeta(meta),
+            };
+        }
+    });
+}
+function clearMeta(pkg) {
+    const versions = {};
+    for (const [version, info] of Object.entries(pkg.versions)) {
+        // The list taken from https://github.com/npm/registry/blob/master/docs/responses/package-metadata.md#abbreviated-version-object
+        // with the addition of 'libc'
+        versions[version] = pick([
+            'name',
+            'version',
+            'bin',
+            'directories',
+            'devDependencies',
+            'optionalDependencies',
+            'dependencies',
+            'peerDependencies',
+            'dist',
+            'engines',
+            'peerDependenciesMeta',
+            'cpu',
+            'os',
+            'libc',
+            'deprecated',
+            'bundleDependencies',
+            'bundledDependencies',
+            'hasInstallScript',
+            '_npmUser',
+        ], info);
+    }
+    return {
+        name: pkg.name,
+        'dist-tags': pkg['dist-tags'],
+        versions,
+        time: pkg.time,
+        cachedAt: pkg.cachedAt,
+    };
+}
+function encodePkgName(pkgName) {
+    if (pkgName !== pkgName.toLowerCase()) {
+        return `${pkgName}_${createHexHash(pkgName)}`;
+    }
+    return pkgName;
+}
+async function loadMeta(pkgMirror) {
+    try {
+        const data = await gfs.readFile(pkgMirror, 'utf8');
+        return JSON.parse(data);
+    }
+    catch {
+        return null;
+    }
+}
+const createdDirs = new Set();
+async function saveMeta(pkgMirror, json) {
+    const dir = path.dirname(pkgMirror);
+    if (!createdDirs.has(dir)) {
+        await fs.mkdir(dir, { recursive: true });
+        createdDirs.add(dir);
+    }
+    const temp = pathTemp(pkgMirror);
+    await gfs.writeFile(temp, json, 'utf8');
+    await renameOverwrite(temp, pkgMirror);
+}
+function validatePackageName(pkgName) {
+    if (pkgName.includes('/') && pkgName[0] !== '@') {
+        throw new PnpmError('INVALID_PACKAGE_NAME', `Package name ${pkgName} is invalid, it should have a @scope`);
+    }
+}
+//# sourceMappingURL=pickPackage.js.map

package/lib/pickPackageFromMeta.d.ts

@@ -0,0 +1,20 @@
+import type { PackageInRegistry, PackageMeta, PackageMetaWithTime } from '@pnpm/resolving.registry.types';
+import type { VersionSelectors } from '@pnpm/resolving.resolver-base';
+import type { PackageVersionPolicy } from '@pnpm/types';
+import type { RegistryPackageSpec } from './parseBareSpecifier.js';
+export interface PickVersionByVersionRangeOptions {
+    meta: PackageMeta;
+    versionRange: string;
+    preferredVersionSelectors?: VersionSelectors;
+    publishedBy?: Date;
+}
+export type PickVersionByVersionRange = (options: PickVersionByVersionRangeOptions) => string | null;
+export interface PickPackageFromMetaOptions {
+    preferredVersionSelectors: VersionSelectors | undefined;
+    publishedBy?: Date;
+    publishedByExclude?: PackageVersionPolicy;
+}
+export declare function pickPackageFromMeta(pickVersionByVersionRangeFn: PickVersionByVersionRange, { preferredVersionSelectors, publishedBy, publishedByExclude }: PickPackageFromMetaOptions, spec: RegistryPackageSpec, meta: PackageMeta): PackageInRegistry | null;
+export declare function assertMetaHasTime(meta: PackageMeta): asserts meta is PackageMetaWithTime;
+export declare function pickLowestVersionByVersionRange({ meta, versionRange, preferredVersionSelectors }: PickVersionByVersionRangeOptions): string | null;
+export declare function pickVersionByVersionRange({ meta, versionRange, preferredVersionSelectors }: PickVersionByVersionRangeOptions): string | null;

package/lib/pickPackageFromMeta.js

@@ -0,0 +1,202 @@
+import util from 'node:util';
+import { PnpmError } from '@pnpm/error';
+import { filterPkgMetadataByPublishDate } from '@pnpm/resolving.registry.pkg-metadata-filter';
+import semver from 'semver';
+export function pickPackageFromMeta(pickVersionByVersionRangeFn, { preferredVersionSelectors, publishedBy, publishedByExclude, }, spec, meta) {
+    if (publishedBy) {
+        const excludeResult = publishedByExclude?.(meta.name) ?? false;
+        if (excludeResult !== true) {
+            assertMetaHasTime(meta);
+            const trustedVersions = Array.isArray(excludeResult) ? excludeResult : undefined;
+            meta = filterPkgMetadataByPublishDate(meta, publishedBy, trustedVersions);
+        }
+    }
+    if ((!meta.versions || Object.keys(meta.versions).length === 0) && !publishedBy) {
+        // Unfortunately, the npm registry doesn't return the time field in the abbreviated metadata.
+        // So we won't always know if the package was unpublished.
+        if (meta.time?.unpublished?.versions?.length) {
+            throw new PnpmError('UNPUBLISHED_PKG', `No versions available for ${spec.name} because it was unpublished`);
+        }
+        throw new PnpmError('NO_VERSIONS', `No versions available for ${spec.name}. The package may be unpublished.`);
+    }
+    try {
+        let version;
+        switch (spec.type) {
+            case 'version':
+                version = spec.fetchSpec;
+                break;
+            case 'tag':
+                version = meta['dist-tags'][spec.fetchSpec];
+                break;
+            case 'range':
+                version = pickVersionByVersionRangeFn({
+                    meta,
+                    versionRange: spec.fetchSpec,
+                    preferredVersionSelectors,
+                    publishedBy,
+                });
+                break;
+        }
+        if (!version)
+            return null;
+        const manifest = meta.versions[version];
+        if (manifest && meta['name']) {
+            // Packages that are published to the GitHub registry are always published with a scope.
+            // However, the name in the package.json for some reason may omit the scope.
+            // So the package published to the GitHub registry will be published under @foo/bar
+            // but the name in package.json will be just bar.
+            // In order to avoid issues, we consider that the real name of the package is the one with the scope.
+            manifest.name = meta['name'];
+        }
+        return manifest;
+    }
+    catch (err) {
+        if (util.types.isNativeError(err) &&
+            'code' in err &&
+            typeof err.code === 'string' &&
+            err.code.startsWith('ERR_PNPM_')) {
+            throw err;
+        }
+        throw new PnpmError('MALFORMED_METADATA', `Received malformed metadata for "${spec.name}"`, { hint: 'This might mean that the package was unpublished from the registry' });
+    }
+}
+export function assertMetaHasTime(meta) {
+    if (meta.time == null) {
+        throw new PnpmError('MISSING_TIME', `The metadata of ${meta.name} is missing the "time" field`);
+    }
+}
+const semverRangeCache = new Map();
+// This is a performance optimization; working with string-ish semver
+// causes lots of allocations and repeated work, but caching the Range
+// and ensuring we give it a SemVer instance greatly speeds things up.
+function semverSatisfiesLoose(version, range) {
+    let semverRange = semverRangeCache.get(range);
+    if (semverRange === undefined) {
+        try {
+            semverRange = new semver.Range(range, true);
+        }
+        catch {
+            semverRange = null;
+        }
+        semverRangeCache.set(range, semverRange);
+    }
+    if (semverRange) {
+        try {
+            return semverRange.test(new semver.SemVer(version, true));
+        }
+        catch {
+            return false;
+        }
+    }
+    return false;
+}
+export function pickLowestVersionByVersionRange({ meta, versionRange, preferredVersionSelectors }) {
+    if (preferredVersionSelectors != null && Object.keys(preferredVersionSelectors).length > 0) {
+        const prioritizedPreferredVersions = prioritizePreferredVersions(meta, versionRange, preferredVersionSelectors);
+        for (const preferredVersions of prioritizedPreferredVersions) {
+            const preferredVersion = semver.minSatisfying(preferredVersions, versionRange, true);
+            if (preferredVersion) {
+                return preferredVersion;
+            }
+        }
+    }
+    if (versionRange === '*') {
+        return Object.keys(meta.versions).sort(semver.compare)[0];
+    }
+    return semver.minSatisfying(Object.keys(meta.versions), versionRange, true);
+}
+export function pickVersionByVersionRange({ meta, versionRange, preferredVersionSelectors }) {
+    const latest = meta['dist-tags'].latest;
+    if (preferredVersionSelectors != null && Object.keys(preferredVersionSelectors).length > 0) {
+        const prioritizedPreferredVersions = prioritizePreferredVersions(meta, versionRange, preferredVersionSelectors);
+        for (const preferredVersions of prioritizedPreferredVersions) {
+            if (preferredVersions.includes(latest) && semverSatisfiesLoose(latest, versionRange)) {
+                return latest;
+            }
+            const preferredVersion = semver.maxSatisfying(preferredVersions, versionRange, true);
+            if (preferredVersion) {
+                return preferredVersion;
+            }
+        }
+    }
+    const versions = Object.keys(meta.versions);
+    if (latest && (versionRange === '*' || semverSatisfiesLoose(latest, versionRange))) {
+        // Not using semver.satisfies in case of * because it does not select beta versions.
+        // E.g.: 1.0.0-beta.1. See issue: https://github.com/pnpm/pnpm/issues/865
+        return latest;
+    }
+    const maxVersion = semver.maxSatisfying(versions, versionRange, true);
+    // if the selected version is deprecated, try to find a non-deprecated one that satisfies the range
+    if (maxVersion && meta.versions[maxVersion].deprecated && versions.length > 1) {
+        const nonDeprecatedVersions = versions.map((version) => meta.versions[version])
+            .filter((versionMeta) => !versionMeta.deprecated)
+            .map((versionMeta) => versionMeta.version);
+        const maxNonDeprecatedVersion = semver.maxSatisfying(nonDeprecatedVersions, versionRange, true);
+        if (maxNonDeprecatedVersion)
+            return maxNonDeprecatedVersion;
+    }
+    return maxVersion;
+}
+function prioritizePreferredVersions(meta, versionRange, preferredVerSelectors) {
+    const preferredVerSelectorsArr = Object.entries(preferredVerSelectors ?? {});
+    const versionsPrioritizer = new PreferredVersionsPrioritizer();
+    // First, add all versions that satisfy versionRange with default weight 0
+    for (const version of Object.keys(meta.versions)) {
+        if (semverSatisfiesLoose(version, versionRange)) {
+            versionsPrioritizer.add(version, 0);
+        }
+    }
+    // Then apply weights from preferred selectors
+    for (const [preferredSelector, preferredSelectorType] of preferredVerSelectorsArr) {
+        const { selectorType, weight } = typeof preferredSelectorType === 'string'
+            ? { selectorType: preferredSelectorType, weight: 1 }
+            : preferredSelectorType;
+        if (preferredSelector === versionRange)
+            continue;
+        switch (selectorType) {
+            case 'tag': {
+                versionsPrioritizer.add(meta['dist-tags'][preferredSelector], weight);
+                break;
+            }
+            case 'range': {
+                const versions = Object.keys(meta.versions);
+                for (const version of versions) {
+                    if (semverSatisfiesLoose(version, preferredSelector)) {
+                        versionsPrioritizer.add(version, weight);
+                    }
+                }
+                break;
+            }
+            case 'version': {
+                if (meta.versions[preferredSelector]) {
+                    versionsPrioritizer.add(preferredSelector, weight);
+                }
+                break;
+            }
+        }
+    }
+    return versionsPrioritizer.versionsByPriority();
+}
+class PreferredVersionsPrioritizer {
+    preferredVersions = {};
+    add(version, weight) {
+        if (!this.preferredVersions[version]) {
+            this.preferredVersions[version] = weight;
+        }
+        else {
+            this.preferredVersions[version] += weight;
+        }
+    }
+    versionsByPriority() {
+        const versionsByWeight = Object.entries(this.preferredVersions)
+            .reduce((acc, [version, weight]) => {
+            acc[weight] = acc[weight] ?? [];
+            acc[weight].push(version);
+            return acc;
+        }, {});
+        return Object.keys(versionsByWeight)
+            .sort((a, b) => parseInt(b, 10) - parseInt(a, 10))
+            .map((weight) => versionsByWeight[parseInt(weight, 10)]);
+    }
+}
+//# sourceMappingURL=pickPackageFromMeta.js.map

package/lib/toRaw.d.ts

@@ -0,0 +1,2 @@
+import type { RegistryPackageSpec } from './parseBareSpecifier.js';
+export declare function toRaw(spec: RegistryPackageSpec): string;

package/lib/toRaw.js

@@ -0,0 +1,4 @@
+export function toRaw(spec) {
+    return `${spec.name}@${spec.fetchSpec}`;
+}
+//# sourceMappingURL=toRaw.js.map

package/lib/trustChecks.d.ts

@@ -0,0 +1,9 @@
+import type { PackageInRegistry, PackageMeta } from '@pnpm/resolving.registry.types';
+import type { PackageVersionPolicy } from '@pnpm/types';
+type TrustEvidence = 'provenance' | 'trustedPublisher';
+export declare function failIfTrustDowngraded(meta: PackageMeta, version: string, opts?: {
+    trustPolicyExclude?: PackageVersionPolicy;
+    trustPolicyIgnoreAfter?: number;
+}): void;
+export declare function getTrustEvidence(manifest: PackageInRegistry): TrustEvidence | undefined;
+export {};

package/lib/trustChecks.js

@@ -0,0 +1,89 @@
+import { PnpmError } from '@pnpm/error';
+import semver from 'semver';
+import { assertMetaHasTime } from './pickPackageFromMeta.js';
+const TRUST_RANK = {
+    trustedPublisher: 2,
+    provenance: 1,
+};
+export function failIfTrustDowngraded(meta, version, opts) {
+    if (opts?.trustPolicyExclude) {
+        const excludeResult = opts.trustPolicyExclude(meta.name);
+        if (excludeResult === true) {
+            return;
+        }
+        if (Array.isArray(excludeResult) && excludeResult.includes(version)) {
+            return;
+        }
+    }
+    assertMetaHasTime(meta);
+    const versionPublishedAt = meta.time[version];
+    if (!versionPublishedAt) {
+        throw new PnpmError('TRUST_CHECK_FAIL', `Missing time for version ${version} of ${meta.name} in metadata`);
+    }
+    const versionDate = new Date(versionPublishedAt);
+    if (opts?.trustPolicyIgnoreAfter) {
+        const now = new Date();
+        const minutesSincePublish = (now.getTime() - versionDate.getTime()) / (1000 * 60);
+        if (minutesSincePublish > opts.trustPolicyIgnoreAfter) {
+            return;
+        }
+    }
+    const manifest = meta.versions[version];
+    if (!manifest) {
+        throw new PnpmError('TRUST_CHECK_FAIL', `Missing version object for version ${version} of ${meta.name} in metadata`);
+    }
+    const strongestEvidencePriorToRequestedVersion = detectStrongestTrustEvidenceBeforeDate(meta, versionDate, {
+        excludePrerelease: !semver.prerelease(version, true),
+    });
+    if (strongestEvidencePriorToRequestedVersion == null) {
+        return;
+    }
+    const currentTrustEvidence = getTrustEvidence(manifest);
+    if (currentTrustEvidence == null || TRUST_RANK[strongestEvidencePriorToRequestedVersion] > TRUST_RANK[currentTrustEvidence]) {
+        throw new PnpmError('TRUST_DOWNGRADE', `High-risk trust downgrade for "${meta.name}@${version}" (possible package takeover)`, {
+            hint: 'Trust checks are based solely on publish date, not semver. ' +
+                'A package cannot be installed if any earlier-published version had stronger trust evidence. ' +
+                `Earlier versions had ${prettyPrintTrustEvidence(strongestEvidencePriorToRequestedVersion)}, ` +
+                `but this version has ${prettyPrintTrustEvidence(currentTrustEvidence)}. ` +
+                'A trust downgrade may indicate a supply chain incident.',
+        });
+    }
+}
+function prettyPrintTrustEvidence(trustEvidence) {
+    switch (trustEvidence) {
+        case 'trustedPublisher': return 'trusted publisher';
+        case 'provenance': return 'provenance attestation';
+        default: return 'no trust evidence';
+    }
+}
+function detectStrongestTrustEvidenceBeforeDate(meta, beforeDate, options) {
+    let best;
+    for (const [version, manifest] of Object.entries(meta.versions)) {
+        if (options.excludePrerelease && semver.prerelease(version, true))
+            continue;
+        const ts = meta.time[version];
+        if (!ts)
+            continue;
+        const publishedAt = new Date(ts);
+        if (!(publishedAt < beforeDate))
+            continue;
+        const trustEvidence = getTrustEvidence(manifest);
+        if (!trustEvidence)
+            continue;
+        if (trustEvidence === 'trustedPublisher') {
+            return 'trustedPublisher';
+        }
+        best ||= 'provenance';
+    }
+    return best;
+}
+export function getTrustEvidence(manifest) {
+    if (manifest._npmUser?.trustedPublisher) {
+        return 'trustedPublisher';
+    }
+    if (manifest.dist?.attestations?.provenance) {
+        return 'provenance';
+    }
+    return undefined;
+}
+//# sourceMappingURL=trustChecks.js.map

package/lib/whichVersionIsPinned.d.ts

@@ -0,0 +1,2 @@
+import type { PinnedVersion } from '@pnpm/types';
+export declare function whichVersionIsPinned(spec: string): PinnedVersion | undefined;

package/lib/whichVersionIsPinned.js

@@ -0,0 +1,30 @@
+import { parseRange } from 'semver-utils';
+export function whichVersionIsPinned(spec) {
+    const colonIndex = spec.indexOf(':');
+    if (colonIndex !== -1) {
+        spec = spec.substring(colonIndex + 1);
+    }
+    const index = spec.lastIndexOf('@');
+    if (index !== -1) {
+        spec = spec.slice(index + 1);
+    }
+    if (spec === '*')
+        return 'none';
+    const parsedRange = parseRange(spec);
+    if (parsedRange.length !== 1)
+        return undefined;
+    const versionObject = parsedRange[0];
+    switch (versionObject.operator) {
+        case '~': return 'minor';
+        case '^': return 'major';
+        case undefined:
+            if (versionObject.patch)
+                return 'patch';
+            if (versionObject.minor)
+                return 'minor';
+            if (versionObject.major)
+                return 'major';
+    }
+    return undefined;
+}
+//# sourceMappingURL=whichVersionIsPinned.js.map

package/lib/workspacePrefToNpm.d.ts

@@ -0,0 +1 @@
+export declare function workspacePrefToNpm(workspaceBareSpecifier: string): string;

package/lib/workspacePrefToNpm.js

@@ -0,0 +1,13 @@
+import { WorkspaceSpec } from '@pnpm/workspace.spec-parser';
+export function workspacePrefToNpm(workspaceBareSpecifier) {
+    const parseResult = WorkspaceSpec.parse(workspaceBareSpecifier);
+    if (parseResult == null) {
+        throw new Error(`Invalid workspace spec: ${workspaceBareSpecifier}`);
+    }
+    const { alias, version } = parseResult;
+    const versionPart = version === '^' || version === '~' || version === '' ? '*' : version;
+    return alias
+        ? `npm:${alias}@${versionPart}`
+        : versionPart;
+}
+//# sourceMappingURL=workspacePrefToNpm.js.map