@pnpm/resolving.npm-resolver 1101.1.0 → 1101.2.0

package/lib/pickPackage.js

@@ -58,12 +58,13 @@ function pickMax(a, b) {
 const pickHighest = pickPackageFromMeta.bind(null, pickVersionByVersionRange);
 const pickLowest = pickPackageFromMeta.bind(null, pickLowestVersionByVersionRange);
 // When minimumReleaseAge is active: try the highest mature version; if none
-// and strictPublishedByCheck is off, fall back to the lowest version in range
-// without applying the maturity filter.
+// satisfies the range, fall back to the lowest version regardless of maturity
+// so the resolver can report the violation inline and let the install layer
+// (or other caller) decide what to do — never throw at this layer.
 function pickRespectingMinReleaseAge(pickerOpts, spec, meta) {
     return runPicker(pickerOpts, spec, (targetSpec) => {
         const highest = pickHighest(pickerOpts, meta, targetSpec);
-        if (highest || pickerOpts.strictPublishedByCheck)
+        if (highest)
             return highest;
         return pickLowest({
             preferredVersionSelectors: pickerOpts.preferredVersionSelectors,
@@ -111,7 +112,6 @@ export async function pickPackage(ctx, spec, opts) {
         publishedByExclude: opts.publishedByExclude,
         pickLowestVersion: opts.pickLowestVersion,
         includeLatestTag: opts.includeLatestTag,
-        strictPublishedByCheck: ctx.strictPublishedByCheck,
         ignoreMissingTimeField: ctx.ignoreMissingTimeField,
     };
     validatePackageName(spec.name);
@@ -123,15 +123,29 @@ export async function pickPackage(ctx, spec, opts) {
         : ABBREVIATED_META_DIR;
     // Cache key includes fullMetadata to avoid returning abbreviated metadata when full metadata is requested.
     const cacheKey = fullMetadata ? `${spec.name}:full` : spec.name;
+    const pkgMirror = getPkgMirrorPath(ctx.cacheDir, metaDir, opts.registry, spec.name);
     const cachedMeta = ctx.metaCache.get(cacheKey);
     if (cachedMeta != null) {
+        // The in-memory cache may hold abbreviated metadata from an earlier call
+        // that didn't need `time` (no publishedBy then). If this call has
+        // publishedBy and the package was modified recently, upgrade to full
+        // metadata so the maturity check runs properly.
+        const upgrade = await maybeUpgradeAbbreviatedMetaForReleaseAge(ctx, spec, opts, cachedMeta);
+        let metaForCache = upgrade.meta;
+        if (upgrade.upgradedFrom != null) {
+            // Persist the upgraded meta to disk too: the on-disk mirror still holds
+            // the abbreviated form, so without this a fresh process would re-trigger
+            // the upgrade fetch on its next install.
+            metaForCache = opts.dryRun
+                ? upgrade.meta
+                : persistUpgradedMeta(ctx, pkgMirror, upgrade.upgradedFrom);
+            ctx.metaCache.set(cacheKey, metaForCache);
+        }
         return {
-            meta: cachedMeta,
-            pickedPackage: pickMatchingVersionFinal(pickerOpts, spec, cachedMeta),
+            meta: metaForCache,
+            pickedPackage: pickMatchingVersionFinal(pickerOpts, spec, metaForCache),
         };
     }
-    const registryName = getRegistryName(opts.registry);
-    const pkgMirror = path.join(ctx.cacheDir, metaDir, registryName, `${encodePkgName(spec.name)}.jsonl`);
     return runLimited(pkgMirror, async (limit) => {
         let metaCachedInStore;
         if (ctx.offline === true || ctx.preferOffline === true || opts.pickLowestVersion) {
@@ -145,6 +159,17 @@ export async function pickPackage(ctx, spec, opts) {
                 throw new PnpmError('NO_OFFLINE_META', `Failed to resolve ${toRaw(spec)} in package mirror ${pkgMirror}`);
             }
             if (metaCachedInStore != null) {
+                // Disk-cached meta may be abbreviated; upgrade for the maturity check
+                // before letting pickMatchingVersionFinal warn-and-skip on missing time.
+                const upgrade = await maybeUpgradeAbbreviatedMetaForReleaseAge(ctx, spec, opts, metaCachedInStore);
+                metaCachedInStore = upgrade.meta;
+                if (upgrade.upgradedFrom != null) {
+                    // Persist so the next install skips this upgrade fetch entirely.
+                    if (!opts.dryRun) {
+                        metaCachedInStore = persistUpgradedMeta(ctx, pkgMirror, upgrade.upgradedFrom);
+                    }
+                    ctx.metaCache.set(cacheKey, metaCachedInStore);
+                }
                 const pickedPackage = pickMatchingVersionFinal(pickerOpts, spec, metaCachedInStore);
                 if (pickedPackage) {
                     return {
@@ -168,10 +193,11 @@ export async function pickPackage(ctx, spec, opts) {
                         };
                     }
                 }
-                catch (err) {
-                    if (ctx.strictPublishedByCheck) {
-                        throw err;
-                    }
+                catch {
+                    // Swallow fast-path errors (e.g. ERR_PNPM_MISSING_TIME from
+                    // abbreviated meta) and fall through to the network fetch, which
+                    // can upgrade to full metadata and run the maturity check on
+                    // real `time` data.
                 }
             }
         }
@@ -189,13 +215,8 @@ export async function pickPackage(ctx, spec, opts) {
                             };
                         }
                     }
-                    catch (err) {
-                        // Don't rethrow ERR_PNPM_MISSING_TIME from cached abbreviated metadata —
-                        // let the code fall through to the network fetch path which will get full metadata.
-                        if (ctx.strictPublishedByCheck &&
-                            !(isMissingTimeError(err))) {
-                            throw err;
-                        }
+                    catch {
+                        // Same as above — fall through to the network fetch.
                     }
                 }
             }
@@ -219,6 +240,19 @@ export async function pickPackage(ctx, spec, opts) {
             if (fetchResult.notModified) {
                 metaCachedInStore = metaCachedInStore ?? await limit(async () => loadMeta(pkgMirror));
                 if (metaCachedInStore != null) {
+                    // The cached metadata may be abbreviated (no per-version `time`).
+                    // When minimumReleaseAge is active we need `time` for the maturity check,
+                    // so upgrade to full metadata via a follow-up fetch when warranted.
+                    // Without this, repeat installs of recently-modified packages would
+                    // silently bypass the maturity check via the warn-and-skip fallback.
+                    const upgrade = await maybeUpgradeAbbreviatedMetaForReleaseAge(ctx, spec, opts, metaCachedInStore);
+                    metaCachedInStore = upgrade.meta;
+                    if (upgrade.upgradedFrom != null && !opts.dryRun) {
+                        // Persist the upgraded full metadata to disk so subsequent installs
+                        // skip this upgrade fetch entirely (the cached meta will then have
+                        // `time` populated, so the upgrade condition won't trigger).
+                        metaCachedInStore = persistUpgradedMeta(ctx, pkgMirror, upgrade.upgradedFrom);
+                    }
                     ctx.metaCache.set(cacheKey, metaCachedInStore);
                     return {
                         meta: metaCachedInStore,
@@ -307,6 +341,70 @@ export async function pickPackage(ctx, spec, opts) {
         }
     });
 }
+// When `minimumReleaseAge` is active and we have abbreviated metadata (which
+// the npm registry serves by default and which omits per-version `time`),
+// the maturity check can't run on the data we have. If the package has been
+// modified since the maturity cutoff, re-fetch with `fullMetadata: true` so
+// `time` is populated and the check can proceed properly. Without this,
+// `pickMatchingVersionFinal` would fall back to its warn-and-skip path,
+// silently bypassing the minimumReleaseAge guarantee for affected packages.
+//
+// Returns the original meta when no upgrade is needed. When an upgrade
+// happens, returns both the upgraded meta and the underlying fetch result
+// so callers can persist it to disk and avoid re-fetching on next install.
+async function maybeUpgradeAbbreviatedMetaForReleaseAge(ctx, spec, opts, meta) {
+    if (ctx.offline === true ||
+        !opts.publishedBy ||
+        meta.time != null ||
+        opts.publishedByExclude?.(spec.name) === true) {
+        return { meta };
+    }
+    const modifiedDate = meta.modified ? new Date(meta.modified) : null;
+    const isModifiedValid = modifiedDate != null && !Number.isNaN(modifiedDate.getTime());
+    if (isModifiedValid && modifiedDate < opts.publishedBy) {
+        // The package was last modified before the maturity cutoff. No individual
+        // version can be newer than the cutoff, so the abbreviated form is fine.
+        return { meta };
+    }
+    // When `modified` is missing or malformed we fall through to the upgrade
+    // fetch: prefer correctness (run the maturity check on real `time` data)
+    // over saving a network call when our cached freshness signal is unusable.
+    // Forward etag/modified so the registry can answer 304 if the upgraded
+    // representation hasn't actually changed (rare on the npm registry where
+    // full and abbreviated have distinct etags, but cheap to support).
+    const fullFetchResult = await ctx.fetch(spec.name, {
+        authHeaderValue: opts.authHeaderValue,
+        fullMetadata: true,
+        etag: meta.etag,
+        modified: meta.modified,
+        registry: opts.registry,
+    });
+    if (fullFetchResult.notModified) {
+        // Upgrade fetch came back 304: keep the abbreviated meta. The downstream
+        // `pickMatchingVersionFinal` will fall through to its warn-and-skip path.
+        return { meta };
+    }
+    return { meta: fullFetchResult.meta, upgradedFrom: fullFetchResult };
+}
+// Persists upgraded full metadata to the on-disk cache mirror and returns
+// the meta to store in the in-memory cache. When `filterMetadata` is on, the
+// in-memory and on-disk forms are both stripped via `clearMeta`; otherwise
+// the original raw response body is written and the unstripped meta is kept.
+function persistUpgradedMeta(ctx, pkgMirror, upgradedFrom) {
+    const metaForCache = ctx.filterMetadata ? clearMeta(upgradedFrom.meta) : upgradedFrom.meta;
+    const jsonForDisk = ctx.filterMetadata
+        ? prepareJsonForDisk(metaForCache, upgradedFrom.etag)
+        : prepareJsonForDisk(upgradedFrom.meta, upgradedFrom.etag, upgradedFrom.jsonText);
+    runLimited(pkgMirror, (l) => l(async () => {
+        try {
+            await saveMeta(pkgMirror, jsonForDisk);
+        }
+        catch (err) { // eslint-disable-line
+            // We don't care if this file was not written to the cache
+        }
+    }));
+    return metaForCache;
+}
 function clearMeta(pkg) {
     const versions = {};
     for (const [version, info] of Object.entries(pkg.versions)) {
@@ -342,18 +440,25 @@ function clearMeta(pkg) {
         modified: pkg.modified,
     };
 }
-function encodePkgName(pkgName) {
+export function encodePkgName(pkgName) {
     if (pkgName !== pkgName.toLowerCase()) {
         return `${pkgName}_${createHexHash(pkgName)}`;
     }
     return pkgName;
 }
+/**
+ * Path of the on-disk JSONL document where pnpm mirrors a package's registry
+ * metadata. `metaDir` selects between abbreviated and full caches.
+ */
+export function getPkgMirrorPath(cacheDir, metaDir, registry, pkgName) {
+    return path.join(cacheDir, metaDir, getRegistryName(registry), `${encodePkgName(pkgName)}.jsonl`);
+}
 /**
  * Formats metadata for disk storage as two-line NDJSON:
  *   Line 1: cache headers (etag, modified) — small, fast to read
  *   Line 2: the full registry metadata JSON — unchanged from the registry response
  */
-function prepareJsonForDisk(meta, etag, jsonText) {
+export function prepareJsonForDisk(meta, etag, jsonText) {
     const modified = meta.modified ?? meta.time?.modified;
     const headers = JSON.stringify({ etag, modified });
     const body = jsonText ?? JSON.stringify(meta);
@@ -369,7 +474,7 @@ function isMissingTimeError(err) {
 // memory via this Set as they resolve ever more distinct packages.
 const MAX_WARNED_MISSING_TIME = 1024;
 const warnedMissingTimeFor = new Set();
-function warnMissingTimeFieldOnce(pkgName) {
+export function warnMissingTimeFieldOnce(pkgName) {
     if (warnedMissingTimeFor.has(pkgName))
         return;
     if (warnedMissingTimeFor.size >= MAX_WARNED_MISSING_TIME) {
@@ -396,7 +501,7 @@ async function getFileMtime(filePath) {
  * parsing the full metadata (which can be megabytes for popular packages)
  * when we only need conditional-request headers.
  */
-async function loadMetaHeaders(pkgMirror) {
+export async function loadMetaHeaders(pkgMirror) {
     let fh;
     try {
         fh = await fs.open(pkgMirror, 'r');
@@ -423,7 +528,7 @@ async function loadMetaHeaders(pkgMirror) {
  * Line 1: cache headers (etag, modified)
  * Line 2: registry metadata JSON
  */
-async function loadMeta(pkgMirror) {
+export async function loadMeta(pkgMirror) {
     try {
         const data = await gfs.readFile(pkgMirror, 'utf8');
         const newlineIdx = data.indexOf('\n');
@@ -439,7 +544,7 @@ async function loadMeta(pkgMirror) {
     }
 }
 const createdDirs = new Set();
-async function saveMeta(pkgMirror, json) {
+export async function saveMeta(pkgMirror, json) {
     const dir = path.dirname(pkgMirror);
     if (!createdDirs.has(dir)) {
         await fs.mkdir(dir, { recursive: true });

package/lib/violationCodes.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Violation codes the npm resolver attaches to
+ * `ResolutionPolicyViolation.code` when an inline policy check rejects
+ * a pick. Exported so downstream code (the install command, the strict
+ * resolver wrapper, tests) references one source of truth instead of
+ * re-typing the string.
+ *
+ * Lives in its own module — both `index.ts` and `createNpmResolutionVerifier.ts`
+ * import it, so keeping the constants here avoids a cycle.
+ */
+export declare const MINIMUM_RELEASE_AGE_VIOLATION_CODE = "MINIMUM_RELEASE_AGE_VIOLATION";
+export declare const TRUST_DOWNGRADE_VIOLATION_CODE = "TRUST_DOWNGRADE";

package/lib/violationCodes.js

@@ -0,0 +1,13 @@
+/**
+ * Violation codes the npm resolver attaches to
+ * `ResolutionPolicyViolation.code` when an inline policy check rejects
+ * a pick. Exported so downstream code (the install command, the strict
+ * resolver wrapper, tests) references one source of truth instead of
+ * re-typing the string.
+ *
+ * Lives in its own module — both `index.ts` and `createNpmResolutionVerifier.ts`
+ * import it, so keeping the constants here avoids a cycle.
+ */
+export const MINIMUM_RELEASE_AGE_VIOLATION_CODE = 'MINIMUM_RELEASE_AGE_VIOLATION';
+export const TRUST_DOWNGRADE_VIOLATION_CODE = 'TRUST_DOWNGRADE';
+//# sourceMappingURL=violationCodes.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.npm-resolver",
-  "version": "1101.1.0",
+  "version": "1101.2.0",
   "description": "Resolver for npm-hosted packages",
   "keywords": [
     "pnpm",
@@ -41,25 +41,26 @@
     "ssri": "13.0.1",
     "version-selector-type": "^3.0.0",
     "@pnpm/config.pick-registry-for-package": "1100.0.3",
+    "@pnpm/config.version-policy": "1100.1.0",
+    "@pnpm/constants": "1100.0.0",
+    "@pnpm/core-loggers": "1100.1.0",
     "@pnpm/crypto.hash": "1100.0.1",
     "@pnpm/error": "1100.0.0",
     "@pnpm/fetching.types": "1100.0.1",
-    "@pnpm/resolving.jsr-specifier-parser": "1100.0.0",
     "@pnpm/fs.graceful-fs": "1100.1.0",
+    "@pnpm/resolving.jsr-specifier-parser": "1100.0.0",
     "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.3",
-    "@pnpm/store.cafs": "1100.1.3",
-    "@pnpm/store.index": "1100.1.0",
     "@pnpm/resolving.registry.types": "1100.0.3",
+    "@pnpm/resolving.resolver-base": "1100.2.0",
+    "@pnpm/store.cafs": "1100.1.5",
+    "@pnpm/store.index": "1100.1.0",
     "@pnpm/types": "1101.1.0",
-    "@pnpm/resolving.resolver-base": "1100.1.3",
-    "@pnpm/constants": "1100.0.0",
     "@pnpm/workspace.range-resolver": "1100.0.1",
-    "@pnpm/workspace.spec-parser": "1100.0.0",
-    "@pnpm/core-loggers": "1100.0.2"
+    "@pnpm/workspace.spec-parser": "1100.0.0"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0",
-    "@pnpm/worker": "^1100.1.4"
+    "@pnpm/worker": "^1100.1.6"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
@@ -69,12 +70,11 @@
     "@types/ssri": "^7.1.5",
     "load-json-file": "^7.0.1",
     "tempy": "3.0.0",
-    "@pnpm/config.version-policy": "1100.0.3",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/resolving.npm-resolver": "1101.1.0",
-    "@pnpm/network.fetch": "1100.0.3",
+    "@pnpm/resolving.npm-resolver": "1101.2.0",
+    "@pnpm/network.fetch": "1100.0.5",
     "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/testing.mock-agent": "1100.0.3"
+    "@pnpm/testing.mock-agent": "1100.0.5"
   },
   "engines": {
     "node": ">=22.13"