@pnpm/resolving.npm-resolver 1101.1.0 → 1101.2.0

package/lib/fetchAttestationPublishedAt.js

@@ -0,0 +1,99 @@
+import * as retry from '@zkochan/retry';
+export async function fetchAttestationPublishedAt(fetchOpts, pkgName, version, opts) {
+    const url = `${opts.registry.replace(/\/$/, '')}/-/npm/v1/attestations/${pkgName}@${version}`;
+    const retryOperation = retry.operation(fetchOpts.retry);
+    return new Promise((resolve) => {
+        retryOperation.attempt(async () => {
+            let response;
+            try {
+                response = await fetchOpts.fetch(url, {
+                    authHeaderValue: opts.authHeaderValue,
+                    retry: fetchOpts.retry,
+                    timeout: fetchOpts.timeout,
+                });
+            }
+            catch {
+                // Network errors fall through to the full-metadata path; the
+                // caller's `fetchFullMetadataCached` has its own retry policy.
+                resolve(undefined);
+                return;
+            }
+            // 404 = package never published attestations. Other 4xx/5xx also
+            // mean "can't get an answer from this endpoint, fall back."
+            if (response.status >= 400) {
+                resolve(undefined);
+                return;
+            }
+            let body;
+            try {
+                body = await response.json();
+            }
+            catch {
+                resolve(undefined);
+                return;
+            }
+            resolve(extractPublishedAt(body));
+        });
+    });
+}
+/**
+ * Pull the earliest `integratedTime` across every attestation bundle in
+ * the response and convert it to an ISO timestamp. Earliest is the
+ * conservative choice: if two attestations disagree (e.g. publish
+ * v0.1 vs SLSA provenance v1), we attribute the publish to the older
+ * Rekor entry. The Rekor timestamp is what tells us when the artifact
+ * existed in a transparency log — that's the floor on publish time.
+ */
+function extractPublishedAt(body) {
+    if (!body || typeof body !== 'object')
+        return undefined;
+    const attestations = body.attestations;
+    if (!Array.isArray(attestations))
+        return undefined;
+    let earliestSeconds;
+    for (const attestation of attestations) {
+        const seconds = readEarliestIntegratedTime(attestation);
+        if (seconds == null)
+            continue;
+        if (earliestSeconds == null || seconds < earliestSeconds) {
+            earliestSeconds = seconds;
+        }
+    }
+    if (earliestSeconds == null)
+        return undefined;
+    return new Date(earliestSeconds * 1000).toISOString();
+}
+function readEarliestIntegratedTime(attestation) {
+    if (!attestation || typeof attestation !== 'object')
+        return undefined;
+    const bundle = attestation.bundle;
+    if (!bundle || typeof bundle !== 'object')
+        return undefined;
+    const verificationMaterial = bundle.verificationMaterial;
+    if (!verificationMaterial || typeof verificationMaterial !== 'object')
+        return undefined;
+    const tlogEntries = verificationMaterial.tlogEntries;
+    if (!Array.isArray(tlogEntries))
+        return undefined;
+    let earliest;
+    for (const entry of tlogEntries) {
+        if (!entry || typeof entry !== 'object')
+            continue;
+        const rawIntegratedTime = entry.integratedTime;
+        // npm serializes integratedTime as a string ("1778583836") to avoid
+        // JSON precision loss; accept either string or number defensively.
+        const seconds = parseIntegratedTimeSeconds(rawIntegratedTime);
+        if (seconds == null)
+            continue;
+        if (earliest == null || seconds < earliest)
+            earliest = seconds;
+    }
+    return earliest;
+}
+function parseIntegratedTimeSeconds(raw) {
+    const seconds = typeof raw === 'string' ? Number(raw) : typeof raw === 'number' ? raw : NaN;
+    if (!Number.isFinite(seconds) || seconds <= 0)
+        return undefined;
+    return seconds;
+}
+//# sourceMappingURL=fetchAttestationPublishedAt.js.map

package/lib/fetchFullMetadataCached.d.ts

@@ -0,0 +1,33 @@
+import type { PackageMeta } from '@pnpm/resolving.registry.types';
+import { type FetchMetadataFromFromRegistryOptions } from './fetch.js';
+export interface FetchMetadataCachedOptions {
+    registry: string;
+    authHeaderValue?: string;
+    /**
+     * pnpm's on-disk cache directory. When set, the call issues a conditional
+     * GET against the matching mirror the resolver populates: a 304 Not
+     * Modified response serves the body from disk, a 200 writes the new body
+     * back. Omit to disable caching — every call re-fetches.
+     */
+    cacheDir?: string;
+}
+export type FetchFullMetadataCachedOptions = FetchMetadataCachedOptions;
+/**
+ * Fetch a full registry metadata document for `pkgName`, reusing pnpm's
+ * shared on-disk metadata mirror when `cacheDir` is supplied. Built for the
+ * `minimumReleaseAge` lockfile revalidation gate, which needs the `time`
+ * field that abbreviated metadata omits; the cache reuse keeps repeat
+ * installs from re-downloading the same multi-megabyte document for every
+ * locked package.
+ */
+export declare function fetchFullMetadataCached(fetchOpts: FetchMetadataFromFromRegistryOptions, pkgName: string, opts: FetchFullMetadataCachedOptions): Promise<PackageMeta>;
+/**
+ * Sibling of {@link fetchFullMetadataCached} that hits the abbreviated
+ * metadata endpoint (`Accept: application/vnd.npm.install-v1+json`) and
+ * caches under `ABBREVIATED_META_DIR` — the same mirror the resolver
+ * populates by default. Used by the lockfile verification gate as a
+ * cheap upper-bound check: if the package's `modified` field is older
+ * than the policy cutoff, every version in it predates the cutoff and
+ * no per-version timestamp lookup is needed.
+ */
+export declare function fetchAbbreviatedMetadataCached(fetchOpts: FetchMetadataFromFromRegistryOptions, pkgName: string, opts: FetchMetadataCachedOptions): Promise<PackageMeta>;

package/lib/fetchFullMetadataCached.js

@@ -0,0 +1,63 @@
+import { ABBREVIATED_META_DIR, FULL_META_DIR } from '@pnpm/constants';
+import { PnpmError } from '@pnpm/error';
+import { fetchMetadataFromFromRegistry } from './fetch.js';
+import { getPkgMirrorPath, loadMeta, loadMetaHeaders, prepareJsonForDisk, saveMeta } from './pickPackage.js';
+/**
+ * Fetch a full registry metadata document for `pkgName`, reusing pnpm's
+ * shared on-disk metadata mirror when `cacheDir` is supplied. Built for the
+ * `minimumReleaseAge` lockfile revalidation gate, which needs the `time`
+ * field that abbreviated metadata omits; the cache reuse keeps repeat
+ * installs from re-downloading the same multi-megabyte document for every
+ * locked package.
+ */
+export async function fetchFullMetadataCached(fetchOpts, pkgName, opts) {
+    return fetchMetadataCached(fetchOpts, pkgName, { ...opts, fullMetadata: true, metaDir: FULL_META_DIR });
+}
+/**
+ * Sibling of {@link fetchFullMetadataCached} that hits the abbreviated
+ * metadata endpoint (`Accept: application/vnd.npm.install-v1+json`) and
+ * caches under `ABBREVIATED_META_DIR` — the same mirror the resolver
+ * populates by default. Used by the lockfile verification gate as a
+ * cheap upper-bound check: if the package's `modified` field is older
+ * than the policy cutoff, every version in it predates the cutoff and
+ * no per-version timestamp lookup is needed.
+ */
+export async function fetchAbbreviatedMetadataCached(fetchOpts, pkgName, opts) {
+    return fetchMetadataCached(fetchOpts, pkgName, { ...opts, fullMetadata: false, metaDir: ABBREVIATED_META_DIR });
+}
+async function fetchMetadataCached(fetchOpts, pkgName, opts) {
+    const pkgMirror = opts.cacheDir != null
+        ? getPkgMirrorPath(opts.cacheDir, opts.metaDir, opts.registry, pkgName)
+        : null;
+    const cacheHeaders = pkgMirror != null ? await loadMetaHeaders(pkgMirror) : null;
+    const result = await fetchMetadataFromFromRegistry(fetchOpts, pkgName, {
+        registry: opts.registry,
+        authHeaderValue: opts.authHeaderValue,
+        fullMetadata: opts.fullMetadata,
+        etag: cacheHeaders?.etag,
+        modified: cacheHeaders?.modified,
+    });
+    if ('notModified' in result && result.notModified) {
+        if (pkgMirror == null) {
+            // We didn't send conditional headers (no cacheDir), but the registry
+            // returned 304 anyway. There's no body to fall back on.
+            throw new PnpmError('META_NOT_MODIFIED_WITHOUT_CACHE', `Registry returned 304 for ${pkgName} without an existing cache to refresh.`);
+        }
+        const meta = await loadMeta(pkgMirror);
+        if (meta == null) {
+            // Cache file vanished between header-load and meta-load (concurrent
+            // store cleanup, antivirus, etc.).
+            throw new PnpmError('META_CACHE_MISSING_AFTER_304', `Metadata cache for ${pkgName} disappeared between headers read and full read.`);
+        }
+        return meta;
+    }
+    if (pkgMirror != null) {
+        // Persist so the next install can do a headers-only conditional GET.
+        // Fire-and-forget — a cache-write failure isn't a reason to fail the
+        // caller; the next install just won't get the speedup.
+        const json = prepareJsonForDisk(result.meta, result.etag, result.jsonText);
+        saveMeta(pkgMirror, json).catch(() => { });
+    }
+    return result.meta;
+}
+//# sourceMappingURL=fetchFullMetadataCached.js.map

package/lib/index.d.ts

@@ -12,16 +12,15 @@ export interface NoMatchingVersionErrorOptions {
     wantedDependency: WantedDependency;
     packageMeta: PackageMeta;
     registry: string;
-    immatureVersion?: string;
-    publishedBy?: Date;
 }
 export declare class NoMatchingVersionError extends PnpmError {
     readonly packageMeta: PackageMeta;
-    readonly immatureVersion?: string;
     constructor(opts: NoMatchingVersionErrorOptions);
 }
 export declare function formatTimeAgo(date: Date): string | null;
 export { BUILTIN_NAMED_REGISTRIES, fetchMetadataFromFromRegistry, type FetchMetadataFromFromRegistryOptions, type PackageMeta, type PackageMetaCache, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, type RegistryPackageSpec, RegistryResponseError, workspacePrefToNpm, };
+export { createNpmResolutionVerifier, type CreateNpmResolutionVerifierOptions } from './createNpmResolutionVerifier.js';
+export { MINIMUM_RELEASE_AGE_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
 export { whichVersionIsPinned } from './whichVersionIsPinned.js';
 export interface ResolverFactoryOptions {
     cacheDir: string;
@@ -36,7 +35,6 @@ export interface ResolverFactoryOptions {
     namedRegistries?: Record<string, string>;
     saveWorkspaceProtocol?: boolean | 'rolling';
     preserveAbsolutePaths?: boolean;
-    strictPublishedByCheck?: boolean;
     ignoreMissingTimeField?: boolean;
     fetchWarnTimeoutMs?: number;
     /** Pre-populated metadata cache. When provided, the resolver uses this

package/lib/index.js

@@ -17,28 +17,17 @@ import { BUILTIN_NAMED_REGISTRIES, parseBareSpecifier, parseJsrSpecifierToRegist
 import { pickPackage, } from './pickPackage.js';
 import { pickPackageFromMeta, pickVersionByVersionRange } from './pickPackageFromMeta.js';
 import { failIfTrustDowngraded } from './trustChecks.js';
+import { MINIMUM_RELEASE_AGE_VIOLATION_CODE } from './violationCodes.js';
 import { whichVersionIsPinned } from './whichVersionIsPinned.js';
 import { workspacePrefToNpm } from './workspacePrefToNpm.js';
 export class NoMatchingVersionError extends PnpmError {
     packageMeta;
-    immatureVersion;
     constructor(opts) {
         const dep = opts.wantedDependency.alias
             ? `${opts.wantedDependency.alias}@${opts.wantedDependency.bareSpecifier ?? ''}`
             : opts.wantedDependency.bareSpecifier;
-        let errorMessage;
-        if (opts.publishedBy && opts.immatureVersion && opts.packageMeta.time) {
-            const time = new Date(opts.packageMeta.time[opts.immatureVersion]);
-            const releaseAgeText = formatTimeAgo(time) ?? 'just now';
-            const pkgName = opts.wantedDependency.alias ?? opts.packageMeta.name;
-            errorMessage = `Version ${opts.immatureVersion} (released ${releaseAgeText}) of ${pkgName} does not meet the minimumReleaseAge constraint`;
-        }
-        else {
-            errorMessage = `No matching version found for ${dep} while fetching it from ${opts.registry}`;
-        }
-        super(opts.publishedBy ? 'NO_MATURE_MATCHING_VERSION' : 'NO_MATCHING_VERSION', errorMessage);
+        super('NO_MATCHING_VERSION', `No matching version found for ${dep} while fetching it from ${opts.registry}`);
         this.packageMeta = opts.packageMeta;
-        this.immatureVersion = opts.immatureVersion;
     }
 }
 export function formatTimeAgo(date) {
@@ -71,6 +60,8 @@ export function formatTimeAgo(date) {
     return 'a few seconds ago';
 }
 export { BUILTIN_NAMED_REGISTRIES, fetchMetadataFromFromRegistry, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, RegistryResponseError, workspacePrefToNpm, };
+export { createNpmResolutionVerifier } from './createNpmResolutionVerifier.js';
+export { MINIMUM_RELEASE_AGE_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
 export { whichVersionIsPinned } from './whichVersionIsPinned.js';
 export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
     if (typeof opts.cacheDir !== 'string') {
@@ -126,7 +117,6 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
             offline: opts.offline,
             preferOffline: opts.preferOffline,
             cacheDir: opts.cacheDir,
-            strictPublishedByCheck: opts.strictPublishedByCheck,
             ignoreMissingTimeField: opts.ignoreMissingTimeField,
         }),
         registries: opts.registries,
@@ -180,7 +170,13 @@ async function resolveNpm(ctx, wantedDependency, opts) {
     // Fast path: if we have a current resolution with integrity, try to peek the manifest from the store.
     // This avoids the expensive metadata fetch from the registry.
     // We do this AFTER ensuring the spec is valid for this resolver to avoids hijacking other resolvers.
-    if (ctx.peekManifestFromStore && opts.currentPkg?.resolution && !opts.update) {
+    // If publishedBy is set (resolutionMode=time-based or minimumReleaseAge is configured), we only take
+    // the fast path when publishedAt is already known from the lockfile's `time:` block; otherwise we
+    // fall through to a registry fetch so the cutoff isn't computed from missing data.
+    if (ctx.peekManifestFromStore &&
+        opts.currentPkg?.resolution &&
+        !opts.update &&
+        (opts.publishedBy == null || opts.currentPkg.publishedAt != null)) {
         const currentResolution = opts.currentPkg.resolution;
         // Only use this optimization for tarball resolutions with integrity (npm packages)
         if ('tarball' in currentResolution && currentResolution.integrity) {
@@ -200,7 +196,20 @@ async function resolveNpm(ctx, wantedDependency, opts) {
                         manifest,
                         resolution: currentResolution,
                         resolvedVia: 'npm-registry',
-                        publishedAt: undefined, // Don't have this without metadata
+                        publishedAt: opts.currentPkg.publishedAt,
+                        // Loose-mode bypass: a lockfile entry whose publishedAt sits
+                        // after the maturity cutoff would have been rejected at
+                        // resolver time, but the peek path skips the maturity check.
+                        // Report inline so the deps-resolver aggregator surfaces it
+                        // to the install command.
+                        policyViolation: detectMinReleaseAgeViolation({
+                            name: manifest.name,
+                            version: manifest.version,
+                            publishedAt: opts.currentPkg.publishedAt,
+                            resolution: currentResolution,
+                            publishedBy: opts.publishedBy,
+                            publishedByExclude: opts.publishedByExclude,
+                        }),
                     };
                 }
             }
@@ -261,22 +270,6 @@ async function resolveNpm(ctx, wantedDependency, opts) {
                 // ignore
             }
         }
-        if (opts.publishedBy) {
-            const immatureVersion = pickVersionByVersionRange({
-                meta,
-                versionRange: spec.fetchSpec,
-                preferredVersionSelectors: opts.preferredVersions?.[spec.name],
-            });
-            if (immatureVersion) {
-                throw new NoMatchingVersionError({
-                    wantedDependency,
-                    packageMeta: meta,
-                    registry,
-                    immatureVersion,
-                    publishedBy: opts.publishedBy,
-                });
-            }
-        }
         throw new NoMatchingVersionError({ wantedDependency, packageMeta: meta, registry });
     }
     else if (opts.trustPolicy === 'no-downgrade') {
@@ -329,14 +322,23 @@ async function resolveNpm(ctx, wantedDependency, opts) {
             defaultPinnedVersion: opts.pinnedVersion,
         });
     }
+    const publishedAt = meta.time?.[pickedPackage.version];
     return {
         id,
         latest: meta['dist-tags'].latest,
         manifest: pickedPackage,
         resolution,
         resolvedVia: 'npm-registry',
-        publishedAt: meta.time?.[pickedPackage.version],
+        publishedAt,
         normalizedBareSpecifier,
+        policyViolation: detectMinReleaseAgeViolation({
+            name: pickedPackage.name,
+            version: pickedPackage.version,
+            publishedAt,
+            resolution,
+            publishedBy: opts.publishedBy,
+            publishedByExclude: opts.publishedByExclude,
+        }),
     };
 }
 async function resolveJsr(ctx, wantedDependency, opts) {
@@ -433,15 +435,25 @@ async function pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, registr
     if (pickedPackage == null) {
         throw new NoMatchingVersionError({ wantedDependency, packageMeta: meta, registry });
     }
+    const resolution = {
+        integrity: getIntegrity(pickedPackage.dist),
+        tarball: normalizeRegistryUrl(pickedPackage.dist.tarball),
+    };
+    const publishedAt = meta.time?.[pickedPackage.version];
     return {
         id: `${pickedPackage.name}@${pickedPackage.version}`,
         latest: meta['dist-tags'].latest,
         manifest: pickedPackage,
-        resolution: {
-            integrity: getIntegrity(pickedPackage.dist),
-            tarball: normalizeRegistryUrl(pickedPackage.dist.tarball),
-        },
-        publishedAt: meta.time?.[pickedPackage.version],
+        resolution,
+        publishedAt,
+        policyViolation: detectMinReleaseAgeViolation({
+            name: pickedPackage.name,
+            version: pickedPackage.version,
+            publishedAt,
+            resolution,
+            publishedBy: opts.publishedBy,
+            publishedByExclude: opts.publishedByExclude,
+        }),
     };
 }
 // Builds a `<prefix><pkgName>@<range>` specifier (or a bare `<prefix><range>`
@@ -603,6 +615,40 @@ function defaultTagForAlias(alias, defaultTag) {
         type: 'tag',
     };
 }
+/**
+ * Inline minimumReleaseAge detection: returns a violation entry when the
+ * picked version's publish timestamp is past the policy cutoff (and
+ * isn't covered by `publishedByExclude`). The resolver already has the
+ * timestamp in hand, so reporting inline saves the install layer from
+ * re-walking the resolved tree and re-fetching the same metadata. The
+ * deps-resolver aggregates the per-resolve `policyViolation` fields into
+ * a single set the install command reacts to.
+ *
+ * Returns `undefined` for resolutions outside the policy — no policy
+ * active, version excluded by pattern, timestamp missing or malformed,
+ * or version mature. Specific-version exclusions (`pkg@1.0.0`) and
+ * full-name exclusions (`pkg`) are both honored so an entry already on
+ * the user's exclude list isn't re-announced every install.
+ */
+function detectMinReleaseAgeViolation(args) {
+    if (!args.publishedBy || !args.publishedAt)
+        return undefined;
+    const excludeResult = args.publishedByExclude?.(args.name);
+    if (excludeResult === true)
+        return undefined;
+    if (Array.isArray(excludeResult) && excludeResult.includes(args.version))
+        return undefined;
+    const ts = new Date(args.publishedAt).getTime();
+    if (Number.isNaN(ts) || ts <= args.publishedBy.getTime())
+        return undefined;
+    return {
+        name: args.name,
+        version: args.version,
+        resolution: args.resolution,
+        code: MINIMUM_RELEASE_AGE_VIOLATION_CODE,
+        reason: `was published at ${new Date(ts).toISOString()}, within the minimumReleaseAge cutoff (${args.publishedBy.toISOString()})`,
+    };
+}
 function getIntegrity(dist) {
     if (dist.integrity) {
         return dist.integrity;

package/lib/pickPackage.d.ts

@@ -29,9 +29,40 @@ export declare function pickPackage(ctx: {
     offline?: boolean;
     preferOffline?: boolean;
     filterMetadata?: boolean;
-    strictPublishedByCheck?: boolean;
     ignoreMissingTimeField?: boolean;
 }, spec: RegistryPackageSpec, opts: PickPackageOptions): Promise<{
     meta: PackageMeta;
     pickedPackage: PackageInRegistry | null;
 }>;
+export declare function encodePkgName(pkgName: string): string;
+/**
+ * Path of the on-disk JSONL document where pnpm mirrors a package's registry
+ * metadata. `metaDir` selects between abbreviated and full caches.
+ */
+export declare function getPkgMirrorPath(cacheDir: string, metaDir: string, registry: string, pkgName: string): string;
+/**
+ * Formats metadata for disk storage as two-line NDJSON:
+ *   Line 1: cache headers (etag, modified) — small, fast to read
+ *   Line 2: the full registry metadata JSON — unchanged from the registry response
+ */
+export declare function prepareJsonForDisk(meta: PackageMeta, etag: string | undefined, jsonText?: string): string;
+export declare function warnMissingTimeFieldOnce(pkgName: string): void;
+interface MetaHeaders {
+    etag?: string;
+    modified?: string;
+}
+/**
+ * Reads only the first line of the cached NDJSON metadata file to extract
+ * the cache headers (etag, modified). This avoids reading and
+ * parsing the full metadata (which can be megabytes for popular packages)
+ * when we only need conditional-request headers.
+ */
+export declare function loadMetaHeaders(pkgMirror: string): Promise<MetaHeaders | null>;
+/**
+ * Reads the full metadata from the cached NDJSON file.
+ * Line 1: cache headers (etag, modified)
+ * Line 2: registry metadata JSON
+ */
+export declare function loadMeta(pkgMirror: string): Promise<PackageMeta | null>;
+export declare function saveMeta(pkgMirror: string, json: string): Promise<void>;
+export {};