@pnpm/resolving.npm-resolver 1101.0.3 → 1101.1.1

package/lib/fetch.js

@@ -3,24 +3,71 @@ import { requestRetryLogger } from '@pnpm/core-loggers';
 import { FetchError, PnpmError, } from '@pnpm/error';
 import { globalWarn } from '@pnpm/logger';
 import * as retry from '@zkochan/retry';
-// https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string
-// eslint-disable-next-line regexp/no-super-linear-backtracking, regexp/use-ignore-case
-const semverRegex = /(.*)(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/;
+import semver from 'semver';
 export class RegistryResponseError extends FetchError {
     pkgName;
     constructor(request, response, pkgName) {
         let hint;
         if (response.status === 404) {
             hint = `${pkgName} is not in the npm registry, or you have no permission to fetch it.`;
-            const matched = pkgName.match(semverRegex);
-            if (matched != null) {
-                hint += ` Did you mean ${matched[1]}?`;
+            const nameWithoutVersion = stripTrailingSemverSuffix(pkgName);
+            if (nameWithoutVersion != null) {
+                hint += ` Did you mean ${nameWithoutVersion}?`;
             }
         }
         super(request, response, hint);
         this.pkgName = pkgName;
     }
 }
+/**
+ * Detect when a package name accidentally includes a `<version>` suffix
+ * (e.g. `lodash@4.17.21` or `lodash4.17.21`) and return the part before the
+ * version. Returns `undefined` when no semver suffix is present.
+ *
+ * Implemented as an O(n) scan to avoid polynomial backtracking on adversarial
+ * input (CodeQL: js/polynomial-redos).
+ */
+function stripTrailingSemverSuffix(pkgName) {
+    // Common case: "name@version" – split on the rightmost '@'.
+    // `atIdx > 0` rules out the leading '@' of scoped names like '@scope/foo'.
+    const atIdx = pkgName.lastIndexOf('@');
+    if (atIdx > 0 && semver.valid(pkgName.slice(atIdx + 1)) != null) {
+        return pkgName.slice(0, atIdx);
+    }
+    // Fallback: detect a trailing "<digits>.<digits>.<digits>" appended to a name
+    // with no separator (e.g. "foo1.0.0"). We walk backwards through three
+    // digit-blocks separated by dots; this is O(n) and free of regex backtracking.
+    let i = pkgName.length;
+    i = consumeTrailingDigits(pkgName, i);
+    if (i === pkgName.length || i === 0 || pkgName.charCodeAt(i - 1) !== 46 /* '.' */)
+        return undefined;
+    i--;
+    const beforePatch = i;
+    i = consumeTrailingDigits(pkgName, i);
+    if (i === beforePatch || i === 0 || pkgName.charCodeAt(i - 1) !== 46)
+        return undefined;
+    i--;
+    const beforeMinor = i;
+    i = consumeTrailingDigits(pkgName, i);
+    if (i === beforeMinor || i === 0)
+        return undefined;
+    if (semver.valid(pkgName.slice(i)) == null)
+        return undefined;
+    let prefix = pkgName.slice(0, i);
+    if (prefix.endsWith('@'))
+        prefix = prefix.slice(0, -1);
+    return prefix.length > 0 ? prefix : undefined;
+}
+function consumeTrailingDigits(s, end) {
+    let i = end;
+    while (i > 0) {
+        const c = s.charCodeAt(i - 1);
+        if (c < 48 || c > 57)
+            break;
+        i--;
+    }
+    return i;
+}
 export async function fetchMetadataFromFromRegistry(fetchOpts, pkgName, { authHeaderValue, etag: cachedEtag, fullMetadata, modified: cachedModified, registry, }) {
     const uri = toUri(pkgName, registry);
     const op = retry.operation(fetchOpts.retry);

package/lib/index.d.ts

@@ -4,7 +4,7 @@ import type { PackageMeta } from '@pnpm/resolving.registry.types';
 import type { DirectoryResolution, PkgResolutionId, PreferredVersions, ResolveResult, TarballResolution, WantedDependency, WorkspacePackages } from '@pnpm/resolving.resolver-base';
 import type { DependencyManifest, PackageVersionPolicy, PinnedVersion, Registries, TrustPolicy } from '@pnpm/types';
 import { fetchMetadataFromFromRegistry, type FetchMetadataFromFromRegistryOptions, RegistryResponseError } from './fetch.js';
-import { parseBareSpecifier, type RegistryPackageSpec } from './parseBareSpecifier.js';
+import { BUILTIN_NAMED_REGISTRIES, parseBareSpecifier, type RegistryPackageSpec } from './parseBareSpecifier.js';
 import { type PackageMetaCache, pickPackage, type PickPackageOptions } from './pickPackage.js';
 import { pickPackageFromMeta, pickVersionByVersionRange } from './pickPackageFromMeta.js';
 import { workspacePrefToNpm } from './workspacePrefToNpm.js';
@@ -20,7 +20,8 @@ export declare class NoMatchingVersionError extends PnpmError {
     readonly immatureVersion?: string;
     constructor(opts: NoMatchingVersionErrorOptions);
 }
-export { fetchMetadataFromFromRegistry, type FetchMetadataFromFromRegistryOptions, type PackageMeta, type PackageMetaCache, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, type RegistryPackageSpec, RegistryResponseError, workspacePrefToNpm, };
+export declare function formatTimeAgo(date: Date): string | null;
+export { BUILTIN_NAMED_REGISTRIES, fetchMetadataFromFromRegistry, type FetchMetadataFromFromRegistryOptions, type PackageMeta, type PackageMetaCache, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, type RegistryPackageSpec, RegistryResponseError, workspacePrefToNpm, };
 export { whichVersionIsPinned } from './whichVersionIsPinned.js';
 export interface ResolverFactoryOptions {
     cacheDir: string;
@@ -32,6 +33,7 @@ export interface ResolverFactoryOptions {
     retry?: RetryTimeoutOptions;
     timeout?: number;
     registries: Registries;
+    namedRegistries?: Record<string, string>;
     saveWorkspaceProtocol?: boolean | 'rolling';
     preserveAbsolutePaths?: boolean;
     strictPublishedByCheck?: boolean;
@@ -54,6 +56,14 @@ export interface JsrResolveResult extends ResolveResult {
     resolution: TarballResolution;
     resolvedVia: 'jsr-registry';
 }
+export interface NamedRegistryResolveResult extends ResolveResult {
+    alias: string;
+    /** The named-registry alias that was matched, e.g. `gh` or a user-defined name. */
+    registryName: string;
+    manifest: DependencyManifest;
+    resolution: TarballResolution;
+    resolvedVia: 'named-registry';
+}
 export interface WorkspaceResolveResult extends ResolveResult {
     manifest: DependencyManifest;
     resolution: DirectoryResolution;
@@ -61,16 +71,19 @@ export interface WorkspaceResolveResult extends ResolveResult {
 }
 export type NpmResolver = (wantedDependency: WantedDependency & {
     optional?: boolean;
-}, opts: ResolveFromNpmOptions) => Promise<NpmResolveResult | JsrResolveResult | WorkspaceResolveResult | null>;
+}, opts: ResolveFromNpmOptions) => Promise<NpmResolveResult | JsrResolveResult | NamedRegistryResolveResult | WorkspaceResolveResult | null>;
 export declare function createNpmResolver(fetchFromRegistry: FetchFromRegistry, getAuthHeader: GetAuthHeader, opts: ResolverFactoryOptions): {
     resolveFromNpm: NpmResolver;
     resolveFromJsr: NpmResolver;
+    resolveFromNamedRegistry: NpmResolver;
     clearCache: () => void;
 };
 export interface ResolveFromNpmContext {
     pickPackage: (spec: RegistryPackageSpec, opts: PickPackageOptions) => ReturnType<typeof pickPackage>;
     getAuthHeaderValueByURI: (registry: string) => string | undefined;
     registries: Registries;
+    namedRegistries: Record<string, string>;
+    namedRegistryNames: ReadonlySet<string>;
     saveWorkspaceProtocol?: boolean | 'rolling';
     peekManifestFromStore?: (opts: {
         id: PkgResolutionId;

package/lib/index.js

@@ -13,7 +13,7 @@ import ssri from 'ssri';
 import versionSelectorType from 'version-selector-type';
 import { fetchMetadataFromFromRegistry, RegistryResponseError } from './fetch.js';
 import { normalizeRegistryUrl } from './normalizeRegistryUrl.js';
-import { parseBareSpecifier, parseJsrSpecifierToRegistryPackageSpec, } from './parseBareSpecifier.js';
+import { BUILTIN_NAMED_REGISTRIES, parseBareSpecifier, parseJsrSpecifierToRegistryPackageSpec, parseNamedRegistrySpecifierToRegistryPackageSpec, } from './parseBareSpecifier.js';
 import { pickPackage, } from './pickPackage.js';
 import { pickPackageFromMeta, pickVersionByVersionRange } from './pickPackageFromMeta.js';
 import { failIfTrustDowngraded } from './trustChecks.js';
@@ -29,7 +29,7 @@ export class NoMatchingVersionError extends PnpmError {
         let errorMessage;
         if (opts.publishedBy && opts.immatureVersion && opts.packageMeta.time) {
             const time = new Date(opts.packageMeta.time[opts.immatureVersion]);
-            const releaseAgeText = formatTimeAgo(time);
+            const releaseAgeText = formatTimeAgo(time) ?? 'just now';
             const pkgName = opts.wantedDependency.alias ?? opts.packageMeta.name;
             errorMessage = `Version ${opts.immatureVersion} (released ${releaseAgeText}) of ${pkgName} does not meet the minimumReleaseAge constraint`;
         }
@@ -41,25 +41,36 @@ export class NoMatchingVersionError extends PnpmError {
         this.immatureVersion = opts.immatureVersion;
     }
 }
-function formatTimeAgo(date) {
-    const now = Date.now();
-    const diffMs = now - date.getTime();
-    // Handle clock skew (future dates) and very recent releases (< 1 minute)
-    if (diffMs < 60 * 1000) {
-        return 'just now';
-    }
-    const diffMinutes = Math.floor(diffMs / (60 * 1000));
-    const diffHours = Math.floor(diffMs / (60 * 60 * 1000));
-    const diffDays = Math.floor(diffMs / (24 * 60 * 60 * 1000));
-    if (diffHours >= 48) {
-        return `${diffDays} day${diffDays === 1 ? '' : 's'} ago`;
+export function formatTimeAgo(date) {
+    const ts = date.getTime();
+    if (isNaN(ts)) {
+        return null;
     }
-    if (diffMinutes >= 90) {
-        return `${diffHours} hour${diffHours === 1 ? '' : 's'} ago`;
+    const now = Date.now();
+    const diffMs = now - ts;
+    // Handle clock skew (future dates)
+    if (diffMs < 0) {
+        return null;
     }
-    return `${diffMinutes} minute${diffMinutes === 1 ? '' : 's'} ago`;
+    const diffSec = Math.floor(diffMs / 1000);
+    const diffMin = Math.floor(diffSec / 60);
+    const diffHour = Math.floor(diffMin / 60);
+    const diffDay = Math.floor(diffHour / 24);
+    const diffMonth = Math.floor(diffDay / 30);
+    const diffYear = Math.floor(diffDay / 365);
+    if (diffYear > 0)
+        return `${diffYear} year${diffYear === 1 ? '' : 's'} ago`;
+    if (diffMonth > 0)
+        return `${diffMonth} month${diffMonth === 1 ? '' : 's'} ago`;
+    if (diffDay > 0)
+        return `${diffDay} day${diffDay === 1 ? '' : 's'} ago`;
+    if (diffHour > 0)
+        return `${diffHour} hour${diffHour === 1 ? '' : 's'} ago`;
+    if (diffMin > 0)
+        return `${diffMin} minute${diffMin === 1 ? '' : 's'} ago`;
+    return 'a few seconds ago';
 }
-export { fetchMetadataFromFromRegistry, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, RegistryResponseError, workspacePrefToNpm, };
+export { BUILTIN_NAMED_REGISTRIES, fetchMetadataFromFromRegistry, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, RegistryResponseError, workspacePrefToNpm, };
 export { whichVersionIsPinned } from './whichVersionIsPinned.js';
 export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
     if (typeof opts.cacheDir !== 'string') {
@@ -103,6 +114,8 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
             return request;
         };
     }
+    const namedRegistries = mergeNamedRegistries(opts.namedRegistries);
+    const namedRegistryNames = new Set(Object.keys(namedRegistries));
     const ctx = {
         getAuthHeaderValueByURI: getAuthHeader,
         pickPackage: pickPackage.bind(null, {
@@ -117,12 +130,15 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
             ignoreMissingTimeField: opts.ignoreMissingTimeField,
         }),
         registries: opts.registries,
+        namedRegistries,
+        namedRegistryNames,
         saveWorkspaceProtocol: opts.saveWorkspaceProtocol,
         peekManifestFromStore,
     };
     return {
         resolveFromNpm: resolveNpm.bind(null, ctx),
         resolveFromJsr: resolveJsr.bind(null, ctx),
+        resolveFromNamedRegistry: resolveFromNamedRegistry.bind(null, ctx),
         clearCache: () => {
             if ('clear' in metaCache && typeof metaCache.clear === 'function') {
                 metaCache.clear();
@@ -164,7 +180,13 @@ async function resolveNpm(ctx, wantedDependency, opts) {
     // Fast path: if we have a current resolution with integrity, try to peek the manifest from the store.
     // This avoids the expensive metadata fetch from the registry.
     // We do this AFTER ensuring the spec is valid for this resolver to avoids hijacking other resolvers.
-    if (ctx.peekManifestFromStore && opts.currentPkg?.resolution && !opts.update) {
+    // If publishedBy is set (resolutionMode=time-based or minimumReleaseAge is configured), we only take
+    // the fast path when publishedAt is already known from the lockfile's `time:` block; otherwise we
+    // fall through to a registry fetch so the cutoff isn't computed from missing data.
+    if (ctx.peekManifestFromStore &&
+        opts.currentPkg?.resolution &&
+        !opts.update &&
+        (opts.publishedBy == null || opts.currentPkg.publishedAt != null)) {
         const currentResolution = opts.currentPkg.resolution;
         // Only use this optimization for tarball resolutions with integrity (npm packages)
         if ('tarball' in currentResolution && currentResolution.integrity) {
@@ -184,7 +206,7 @@ async function resolveNpm(ctx, wantedDependency, opts) {
                         manifest,
                         resolution: currentResolution,
                         resolvedVia: 'npm-registry',
-                        publishedAt: undefined, // Don't have this without metadata
+                        publishedAt: opts.currentPkg.publishedAt,
                     };
                 }
             }
@@ -326,52 +348,117 @@ async function resolveNpm(ctx, wantedDependency, opts) {
 async function resolveJsr(ctx, wantedDependency, opts) {
     if (!wantedDependency.bareSpecifier)
         return null;
-    const defaultTag = opts.defaultTag ?? 'latest';
-    const registry = ctx.registries['@jsr']; // '@jsr' is always defined
-    const spec = parseJsrSpecifierToRegistryPackageSpec(wantedDependency.bareSpecifier, wantedDependency.alias, defaultTag);
+    const spec = parseJsrSpecifierToRegistryPackageSpec(wantedDependency.bareSpecifier, wantedDependency.alias, opts.defaultTag ?? 'latest');
+    if (spec == null)
+        return null;
+    const picked = await pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, ctx.registries['@jsr']); // '@jsr' is always defined
+    return {
+        ...picked,
+        normalizedBareSpecifier: opts.calcSpecifier
+            ? calcPrefixedSpecifier('jsr:', spec.jsrPkgName, wantedDependency, picked.manifest.version, opts.pinnedVersion)
+            : undefined,
+        resolvedVia: 'jsr-registry',
+        alias: spec.jsrPkgName,
+    };
+}
+// Merges user-supplied named-registry aliases (from config) on top of pnpm's
+// built-in defaults (e.g. `gh` → GitHub Packages). User entries take precedence
+// so GHES users can point `gh` at their enterprise host. URLs are validated
+// here so typos like `npm.work.example.com` (no scheme) surface at startup
+// rather than as a confusing 404 during resolution. The named-registry
+// resolver runs last in the resolution chain, so an alias that collides with
+// another specifier scheme (e.g. `git`, `github`, `jsr`) is silently shadowed
+// by that scheme's dedicated resolver — no cross-resolver knowledge needed.
+function mergeNamedRegistries(userDefined) {
+    const merged = { ...BUILTIN_NAMED_REGISTRIES };
+    if (!userDefined)
+        return merged;
+    for (const [alias, url] of Object.entries(userDefined)) {
+        if (typeof url !== 'string' || !isValidHttpUrl(url)) {
+            throw new PnpmError('INVALID_NAMED_REGISTRY_URL', `The named registry alias '${alias}' is mapped to '${String(url)}', which is not a valid http(s) URL.`, { hint: 'Provide a URL that starts with http:// or https://, e.g. https://npm.pkg.example.com/' });
+        }
+        merged[alias] = url;
+    }
+    return merged;
+}
+function isValidHttpUrl(url) {
+    try {
+        const parsed = new URL(url);
+        return parsed.protocol === 'http:' || parsed.protocol === 'https:';
+    }
+    catch {
+        return false;
+    }
+}
+// Resolves a `<alias>:` specifier from one of the configured named registries.
+// The `gh:` alias ships as a built-in default pointing at the GitHub Packages
+// npm registry; additional aliases come from pnpm-workspace.yaml's
+// `namedRegistries` field. Auth tokens are looked up by the resolved registry
+// URL, so a `//npm.pkg.github.com/:_authToken=...` entry in `.npmrc` is
+// picked up automatically for `gh:` specifiers (and analogously for any user-
+// configured alias).
+async function resolveFromNamedRegistry(ctx, wantedDependency, opts) {
+    if (!wantedDependency.bareSpecifier)
+        return null;
+    const spec = parseNamedRegistrySpecifierToRegistryPackageSpec(wantedDependency.bareSpecifier, ctx.namedRegistryNames, wantedDependency.alias, opts.defaultTag ?? 'latest');
     if (spec == null)
         return null;
+    const registry = ctx.namedRegistries[spec.registryName];
+    if (!registry)
+        return null; // defensive: should never trigger because parse checks the alias set
+    const picked = await pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, registry);
+    return {
+        ...picked,
+        normalizedBareSpecifier: opts.calcSpecifier
+            ? calcPrefixedSpecifier(`${spec.registryName}:`, spec.name, wantedDependency, picked.manifest.version, opts.pinnedVersion)
+            : undefined,
+        resolvedVia: 'named-registry',
+        registryName: spec.registryName,
+        // Exposes the scoped package name so callers that omit an explicit alias
+        // (e.g. `pnpm add gh:@acme/foo`) record the dependency under `@acme/foo`.
+        alias: spec.name,
+    };
+}
+// Shared inner shell for resolvers that pull from a single registry URL with
+// an already-parsed RegistryPackageSpec (jsr, named-registry). Returns the
+// fields common to their result envelopes; each caller adds its own
+// resolvedVia, alias, and normalizedBareSpecifier.
+async function pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, registry) {
     const authHeaderValue = ctx.getAuthHeaderValueByURI(registry);
     const { meta, pickedPackage } = await ctx.pickPackage(spec, {
         pickLowestVersion: opts.pickLowestVersion,
         publishedBy: opts.publishedBy,
+        publishedByExclude: opts.publishedByExclude,
         authHeaderValue,
         dryRun: opts.dryRun === true,
         preferredVersionSelectors: opts.preferredVersions?.[spec.name],
         registry,
         includeLatestTag: opts.update === 'latest',
+        optional: wantedDependency.optional,
     });
     if (pickedPackage == null) {
         throw new NoMatchingVersionError({ wantedDependency, packageMeta: meta, registry });
     }
-    const id = `${pickedPackage.name}@${pickedPackage.version}`;
-    const resolution = {
-        integrity: getIntegrity(pickedPackage.dist),
-        tarball: normalizeRegistryUrl(pickedPackage.dist.tarball),
-    };
     return {
-        id,
+        id: `${pickedPackage.name}@${pickedPackage.version}`,
         latest: meta['dist-tags'].latest,
         manifest: pickedPackage,
-        normalizedBareSpecifier: opts.calcSpecifier
-            ? calcJsrSpecifier({
-                wantedDependency,
-                spec,
-                version: pickedPackage.version,
-                defaultPinnedVersion: opts.pinnedVersion,
-            })
-            : undefined,
-        resolution,
-        resolvedVia: 'jsr-registry',
+        resolution: {
+            integrity: getIntegrity(pickedPackage.dist),
+            tarball: normalizeRegistryUrl(pickedPackage.dist.tarball),
+        },
         publishedAt: meta.time?.[pickedPackage.version],
-        alias: spec.jsrPkgName,
     };
 }
-function calcJsrSpecifier({ wantedDependency, spec, version, defaultPinnedVersion, }) {
+// Builds a `<prefix><pkgName>@<range>` specifier (or a bare `<prefix><range>`
+// when the dependency alias matches the package name). Shared between the
+// jsr and named-registry resolvers since they only differ in `prefix` and
+// which spec field holds the package name.
+function calcPrefixedSpecifier(prefix, pkgName, wantedDependency, version, defaultPinnedVersion) {
     const range = calcRange(version, wantedDependency, defaultPinnedVersion);
-    if (!wantedDependency.alias || spec.jsrPkgName === wantedDependency.alias)
-        return `jsr:${range}`;
-    return `jsr:${spec.jsrPkgName}@${range}`;
+    if (!wantedDependency.alias || pkgName === wantedDependency.alias)
+        return `${prefix}${range}`;
+    return `${prefix}${pkgName}@${range}`;
 }
 function calcSpecifier({ wantedDependency, spec, version, defaultPinnedVersion, }) {
     if (wantedDependency.prevSpecifier === wantedDependency.bareSpecifier && wantedDependency.prevSpecifier && versionSelectorType(wantedDependency.prevSpecifier)?.type === 'tag') {

package/lib/parseBareSpecifier.d.ts

@@ -9,3 +9,8 @@ export interface JsrRegistryPackageSpec extends RegistryPackageSpec {
     jsrPkgName: string;
 }
 export declare function parseJsrSpecifierToRegistryPackageSpec(rawSpecifier: string, alias: string | undefined, defaultTag: string): JsrRegistryPackageSpec | null;
+export declare const BUILTIN_NAMED_REGISTRIES: Readonly<Record<string, string>>;
+export interface NamedRegistryPackageSpec extends RegistryPackageSpec {
+    registryName: string;
+}
+export declare function parseNamedRegistrySpecifierToRegistryPackageSpec(rawSpecifier: string, knownRegistryNames: ReadonlySet<string>, packageAlias: string | undefined, defaultTag: string): NamedRegistryPackageSpec | null;

package/lib/parseBareSpecifier.js

@@ -1,18 +1,29 @@
+import { PnpmError } from '@pnpm/error';
 import { parseJsrSpecifier } from '@pnpm/resolving.jsr-specifier-parser';
 import { parseNpmTarballUrl } from 'parse-npm-tarball-url';
+import semver from 'semver';
 import getVersionSelectorType from 'version-selector-type';
 export function parseBareSpecifier(bareSpecifier, alias, defaultTag, registry) {
     let name = alias;
     if (bareSpecifier.startsWith('npm:')) {
         bareSpecifier = bareSpecifier.slice(4);
-        const index = bareSpecifier.lastIndexOf('@');
-        if (index < 1) {
-            name = bareSpecifier;
-            bareSpecifier = defaultTag;
+        // `npm:<version_selector>` — fall back to the outer dependency alias as
+        // the package name, mirroring the named-registry shape (e.g. `gh:^1.0.0`).
+        // Restricted to semver ranges/versions so unscoped package names like
+        // `npm:is-positive` keep their npm package-aliasing meaning.
+        if (alias && semver.validRange(bareSpecifier) != null) {
+            name = alias;
         }
         else {
-            name = bareSpecifier.slice(0, index);
-            bareSpecifier = bareSpecifier.slice(index + 1);
+            const index = bareSpecifier.lastIndexOf('@');
+            if (index < 1) {
+                name = bareSpecifier;
+                bareSpecifier = defaultTag;
+            }
+            else {
+                name = bareSpecifier.slice(0, index);
+                bareSpecifier = bareSpecifier.slice(index + 1);
+            }
         }
     }
     if (name) {
@@ -52,4 +63,75 @@ export function parseJsrSpecifierToRegistryPackageSpec(rawSpecifier, alias, defa
         jsrPkgName: spec.jsrPkgName,
     };
 }
+export const BUILTIN_NAMED_REGISTRIES = Object.freeze({
+    gh: 'https://npm.pkg.github.com/',
+});
+// Parses a named-registry specifier of the shape `<alias>:<body>` into a
+// RegistryPackageSpec. Returns `null` when the specifier does not use one of
+// the configured aliases, so the caller can fall through to other resolvers.
+// Supported shapes:
+// - `<alias>:[@<owner>/]<name>[@<version_selector>]`
+// - `<alias>:<version_selector>` paired with a package alias
+export function parseNamedRegistrySpecifierToRegistryPackageSpec(rawSpecifier, knownRegistryNames, packageAlias, defaultTag) {
+    const colon = rawSpecifier.indexOf(':');
+    if (colon <= 0)
+        return null;
+    const registryName = rawSpecifier.substring(0, colon);
+    if (!knownRegistryNames.has(registryName))
+        return null;
+    const body = rawSpecifier.substring(colon + 1);
+    let pkgName;
+    let versionSelector;
+    if (semver.validRange(body) != null) {
+        // `<alias>:<version_selector>` — fall back to the dependency alias as
+        // the package name. Unresolvable without one.
+        if (!packageAlias)
+            return null;
+        pkgName = packageAlias;
+        versionSelector = body;
+    }
+    else if (body[0] === '@') {
+        // `<alias>:@<owner>/<name>[@<version_selector>]` — scoped package.
+        const index = body.lastIndexOf('@');
+        if (index === 0) {
+            pkgName = body;
+        }
+        else {
+            pkgName = body.substring(0, index);
+            versionSelector = body.substring(index + '@'.length);
+        }
+        if (pkgName.indexOf('/') === -1 || pkgName.endsWith('/')) {
+            throw new PnpmError('INVALID_NAMED_REGISTRY_PACKAGE_NAME', `The package name '${pkgName}' in named registry '${registryName}:' is invalid`);
+        }
+    }
+    else if (packageAlias?.startsWith('@')) {
+        // `<alias>:<tag>` paired with a scoped alias — body is a version
+        // selector (tag/dist-tag). Mirrors GitHub Packages, where the package
+        // is always scoped and a bare body is a tag.
+        pkgName = packageAlias;
+        versionSelector = body;
+    }
+    else {
+        // `<alias>:<name>[@<version_selector>]` — unscoped package in body.
+        const index = body.lastIndexOf('@');
+        if (index < 1) {
+            pkgName = body;
+        }
+        else {
+            pkgName = body.substring(0, index);
+            versionSelector = body.substring(index + '@'.length);
+        }
+        if (!pkgName)
+            return null;
+    }
+    const selector = getVersionSelectorType(versionSelector ?? defaultTag);
+    if (selector == null)
+        return null;
+    return {
+        fetchSpec: selector.normalized,
+        name: pkgName,
+        type: selector.type,
+        registryName,
+    };
+}
 //# sourceMappingURL=parseBareSpecifier.js.map

package/lib/pickPackage.js

@@ -123,15 +123,30 @@ export async function pickPackage(ctx, spec, opts) {
         : ABBREVIATED_META_DIR;
     // Cache key includes fullMetadata to avoid returning abbreviated metadata when full metadata is requested.
     const cacheKey = fullMetadata ? `${spec.name}:full` : spec.name;
+    const registryName = getRegistryName(opts.registry);
+    const pkgMirror = path.join(ctx.cacheDir, metaDir, registryName, `${encodePkgName(spec.name)}.jsonl`);
     const cachedMeta = ctx.metaCache.get(cacheKey);
     if (cachedMeta != null) {
+        // The in-memory cache may hold abbreviated metadata from an earlier call
+        // that didn't need `time` (no publishedBy then). If this call has
+        // publishedBy and the package was modified recently, upgrade to full
+        // metadata so the maturity check runs properly.
+        const upgrade = await maybeUpgradeAbbreviatedMetaForReleaseAge(ctx, spec, opts, cachedMeta);
+        let metaForCache = upgrade.meta;
+        if (upgrade.upgradedFrom != null) {
+            // Persist the upgraded meta to disk too: the on-disk mirror still holds
+            // the abbreviated form, so without this a fresh process would re-trigger
+            // the upgrade fetch on its next install.
+            metaForCache = opts.dryRun
+                ? upgrade.meta
+                : persistUpgradedMeta(ctx, pkgMirror, upgrade.upgradedFrom);
+            ctx.metaCache.set(cacheKey, metaForCache);
+        }
         return {
-            meta: cachedMeta,
-            pickedPackage: pickMatchingVersionFinal(pickerOpts, spec, cachedMeta),
+            meta: metaForCache,
+            pickedPackage: pickMatchingVersionFinal(pickerOpts, spec, metaForCache),
         };
     }
-    const registryName = getRegistryName(opts.registry);
-    const pkgMirror = path.join(ctx.cacheDir, metaDir, registryName, `${encodePkgName(spec.name)}.jsonl`);
     return runLimited(pkgMirror, async (limit) => {
         let metaCachedInStore;
         if (ctx.offline === true || ctx.preferOffline === true || opts.pickLowestVersion) {
@@ -145,6 +160,17 @@ export async function pickPackage(ctx, spec, opts) {
                 throw new PnpmError('NO_OFFLINE_META', `Failed to resolve ${toRaw(spec)} in package mirror ${pkgMirror}`);
             }
             if (metaCachedInStore != null) {
+                // Disk-cached meta may be abbreviated; upgrade for the maturity check
+                // before letting pickMatchingVersionFinal warn-and-skip on missing time.
+                const upgrade = await maybeUpgradeAbbreviatedMetaForReleaseAge(ctx, spec, opts, metaCachedInStore);
+                metaCachedInStore = upgrade.meta;
+                if (upgrade.upgradedFrom != null) {
+                    // Persist so the next install skips this upgrade fetch entirely.
+                    if (!opts.dryRun) {
+                        metaCachedInStore = persistUpgradedMeta(ctx, pkgMirror, upgrade.upgradedFrom);
+                    }
+                    ctx.metaCache.set(cacheKey, metaCachedInStore);
+                }
                 const pickedPackage = pickMatchingVersionFinal(pickerOpts, spec, metaCachedInStore);
                 if (pickedPackage) {
                     return {
@@ -169,7 +195,7 @@ export async function pickPackage(ctx, spec, opts) {
                     }
                 }
                 catch (err) {
-                    if (ctx.strictPublishedByCheck) {
+                    if (shouldRethrowFromFastPathCache(err, ctx.strictPublishedByCheck)) {
                         throw err;
                     }
                 }
@@ -190,10 +216,7 @@ export async function pickPackage(ctx, spec, opts) {
                         }
                     }
                     catch (err) {
-                        // Don't rethrow ERR_PNPM_MISSING_TIME from cached abbreviated metadata —
-                        // let the code fall through to the network fetch path which will get full metadata.
-                        if (ctx.strictPublishedByCheck &&
-                            !(isMissingTimeError(err))) {
+                        if (shouldRethrowFromFastPathCache(err, ctx.strictPublishedByCheck)) {
                             throw err;
                         }
                     }
@@ -219,6 +242,19 @@ export async function pickPackage(ctx, spec, opts) {
             if (fetchResult.notModified) {
                 metaCachedInStore = metaCachedInStore ?? await limit(async () => loadMeta(pkgMirror));
                 if (metaCachedInStore != null) {
+                    // The cached metadata may be abbreviated (no per-version `time`).
+                    // When minimumReleaseAge is active we need `time` for the maturity check,
+                    // so upgrade to full metadata via a follow-up fetch when warranted.
+                    // Without this, repeat installs of recently-modified packages would
+                    // silently bypass the maturity check via the warn-and-skip fallback.
+                    const upgrade = await maybeUpgradeAbbreviatedMetaForReleaseAge(ctx, spec, opts, metaCachedInStore);
+                    metaCachedInStore = upgrade.meta;
+                    if (upgrade.upgradedFrom != null && !opts.dryRun) {
+                        // Persist the upgraded full metadata to disk so subsequent installs
+                        // skip this upgrade fetch entirely (the cached meta will then have
+                        // `time` populated, so the upgrade condition won't trigger).
+                        metaCachedInStore = persistUpgradedMeta(ctx, pkgMirror, upgrade.upgradedFrom);
+                    }
                     ctx.metaCache.set(cacheKey, metaCachedInStore);
                     return {
                         meta: metaCachedInStore,
@@ -307,6 +343,77 @@ export async function pickPackage(ctx, spec, opts) {
         }
     });
 }
+// When `minimumReleaseAge` is active and we have abbreviated metadata (which
+// the npm registry serves by default and which omits per-version `time`),
+// the maturity check can't run on the data we have. If the package has been
+// modified since the maturity cutoff, re-fetch with `fullMetadata: true` so
+// `time` is populated and the check can proceed properly. Without this,
+// `pickMatchingVersionFinal` would fall back to its warn-and-skip path,
+// silently bypassing the minimumReleaseAge guarantee for affected packages.
+//
+// Returns the original meta when no upgrade is needed. When an upgrade
+// happens, returns both the upgraded meta and the underlying fetch result
+// so callers can persist it to disk and avoid re-fetching on next install.
+async function maybeUpgradeAbbreviatedMetaForReleaseAge(ctx, spec, opts, meta) {
+    if (ctx.offline === true ||
+        !opts.publishedBy ||
+        meta.time != null ||
+        opts.publishedByExclude?.(spec.name) === true) {
+        return { meta };
+    }
+    const modifiedDate = meta.modified ? new Date(meta.modified) : null;
+    const isModifiedValid = modifiedDate != null && !Number.isNaN(modifiedDate.getTime());
+    if (isModifiedValid && modifiedDate < opts.publishedBy) {
+        // The package was last modified before the maturity cutoff. No individual
+        // version can be newer than the cutoff, so the abbreviated form is fine.
+        return { meta };
+    }
+    // When `modified` is missing or malformed we fall through to the upgrade
+    // fetch: prefer correctness (run the maturity check on real `time` data)
+    // over saving a network call when our cached freshness signal is unusable.
+    // Forward etag/modified so the registry can answer 304 if the upgraded
+    // representation hasn't actually changed (rare on the npm registry where
+    // full and abbreviated have distinct etags, but cheap to support).
+    const fullFetchResult = await ctx.fetch(spec.name, {
+        authHeaderValue: opts.authHeaderValue,
+        fullMetadata: true,
+        etag: meta.etag,
+        modified: meta.modified,
+        registry: opts.registry,
+    });
+    if (fullFetchResult.notModified) {
+        // Upgrade fetch came back 304: keep the abbreviated meta. The downstream
+        // `pickMatchingVersionFinal` will fall through to its warn-and-skip path.
+        return { meta };
+    }
+    return { meta: fullFetchResult.meta, upgradedFrom: fullFetchResult };
+}
+// Returns true when a fast-path cache catch should rethrow under
+// strictPublishedByCheck. ERR_PNPM_MISSING_TIME is excluded so callers fall
+// through to the network fetch path, which can upgrade abbreviated cached
+// metadata to full and run the maturity check on real `time` data.
+function shouldRethrowFromFastPathCache(err, strictPublishedByCheck) {
+    return strictPublishedByCheck === true && !isMissingTimeError(err);
+}
+// Persists upgraded full metadata to the on-disk cache mirror and returns
+// the meta to store in the in-memory cache. When `filterMetadata` is on, the
+// in-memory and on-disk forms are both stripped via `clearMeta`; otherwise
+// the original raw response body is written and the unstripped meta is kept.
+function persistUpgradedMeta(ctx, pkgMirror, upgradedFrom) {
+    const metaForCache = ctx.filterMetadata ? clearMeta(upgradedFrom.meta) : upgradedFrom.meta;
+    const jsonForDisk = ctx.filterMetadata
+        ? prepareJsonForDisk(metaForCache, upgradedFrom.etag)
+        : prepareJsonForDisk(upgradedFrom.meta, upgradedFrom.etag, upgradedFrom.jsonText);
+    runLimited(pkgMirror, (l) => l(async () => {
+        try {
+            await saveMeta(pkgMirror, jsonForDisk);
+        }
+        catch (err) { // eslint-disable-line
+            // We don't care if this file was not written to the cache
+        }
+    }));
+    return metaForCache;
+}
 function clearMeta(pkg) {
     const versions = {};
     for (const [version, info] of Object.entries(pkg.versions)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.npm-resolver",
-  "version": "1101.0.3",
+  "version": "1101.1.1",
   "description": "Resolver for npm-hosted packages",
   "keywords": [
     "pnpm",
@@ -28,38 +28,38 @@
   "dependencies": {
     "@zkochan/retry": "^0.2.0",
     "encode-registry": "^3.0.1",
-    "lru-cache": "^11.3.6",
+    "lru-cache": "^11.2.7",
     "normalize-path": "^3.0.0",
-    "p-limit": "^7.3.0",
+    "p-limit": "^7.1.0",
     "p-memoize": "8.0.0",
     "parse-npm-tarball-url": "^5.0.0",
     "path-temp": "^3.0.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "rename-overwrite": "^7.0.1",
-    "semver": "^7.7.4",
+    "semver": "^7.7.2",
     "semver-utils": "^1.1.4",
     "ssri": "13.0.1",
     "version-selector-type": "^3.0.0",
-    "@pnpm/core-loggers": "1100.0.1",
-    "@pnpm/error": "1100.0.0",
-    "@pnpm/fetching.types": "1100.0.1",
+    "@pnpm/core-loggers": "1100.0.2",
+    "@pnpm/constants": "1100.0.0",
     "@pnpm/crypto.hash": "1100.0.1",
     "@pnpm/fs.graceful-fs": "1100.1.0",
-    "@pnpm/resolving.registry.types": "1100.0.2",
-    "@pnpm/resolving.jsr-specifier-parser": "1100.0.0",
-    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.2",
-    "@pnpm/resolving.resolver-base": "1100.1.2",
+    "@pnpm/error": "1100.0.0",
+    "@pnpm/fetching.types": "1100.0.1",
+    "@pnpm/resolving.registry.types": "1100.0.3",
+    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.3",
+    "@pnpm/resolving.resolver-base": "1100.1.3",
+    "@pnpm/types": "1101.1.0",
     "@pnpm/store.index": "1100.1.0",
-    "@pnpm/store.cafs": "1100.1.2",
-    "@pnpm/types": "1101.0.0",
+    "@pnpm/store.cafs": "1100.1.4",
     "@pnpm/workspace.spec-parser": "1100.0.0",
     "@pnpm/workspace.range-resolver": "1100.0.1",
-    "@pnpm/config.pick-registry-for-package": "1100.0.2",
-    "@pnpm/constants": "1100.0.0"
+    "@pnpm/resolving.jsr-specifier-parser": "1100.0.0",
+    "@pnpm/config.pick-registry-for-package": "1100.0.3"
   },
   "peerDependencies": {
-    "@pnpm/logger": "^1001.0.1",
-    "@pnpm/worker": "^1100.1.3"
+    "@pnpm/logger": ">=1001.0.0 <1002.0.0",
+    "@pnpm/worker": "^1100.1.5"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
@@ -69,12 +69,12 @@
     "@types/ssri": "^7.1.5",
     "load-json-file": "^7.0.1",
     "tempy": "3.0.0",
-    "@pnpm/config.version-policy": "1100.0.2",
+    "@pnpm/config.version-policy": "1100.0.3",
+    "@pnpm/network.fetch": "1100.0.4",
+    "@pnpm/resolving.npm-resolver": "1101.1.1",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/network.fetch": "1100.0.2",
-    "@pnpm/resolving.npm-resolver": "1101.0.3",
     "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/testing.mock-agent": "1100.0.2"
+    "@pnpm/testing.mock-agent": "1100.0.4"
   },
   "engines": {
     "node": ">=22.13"