@pnpm/resolving.npm-resolver 1101.1.1 → 1101.2.0

package/lib/createNpmResolutionVerifier.d.ts

@@ -0,0 +1,74 @@
+import type { ResolutionVerifier } from '@pnpm/resolving.resolver-base';
+import type { Registries, TrustPolicy } from '@pnpm/types';
+import type { FetchMetadataFromFromRegistryOptions } from './fetch.js';
+import { type FetchFullMetadataCachedOptions } from './fetchFullMetadataCached.js';
+export interface CreateNpmResolutionVerifierOptions {
+    /**
+     * Minimum age (in minutes) a published version must reach before it is
+     * accepted. When unset, the verifier is a no-op for the age check.
+     */
+    minimumReleaseAge?: number;
+    /**
+     * Retained on the options bag because the resolver path branches on it
+     * (the lowest-version fallback) and tests forward both fields together.
+     * The verifier itself no longer gates on this flag — once the loose-mode
+     * auto-collect makes every accepted-immature pin explicit in
+     * `minimumReleaseAgeExclude`, running the verifier in loose mode is the
+     * thing that proves the manifest stays in sync with the lockfile.
+     */
+    minimumReleaseAgeStrict?: boolean;
+    minimumReleaseAgeExclude?: string[];
+    /**
+     * When the registry's metadata lacks the per-version `time` field
+     * (some self-hosted registries strip it), the verifier can't apply
+     * the maturity cutoff. Set this to `true` to mirror the resolver's
+     * `pickMatchingVersionFinal` warn-and-skip behavior — the verifier
+     * passes the entry with a one-time `globalWarn`, instead of failing
+     * closed. Defaults to `false` so the verifier stays stricter than
+     * the resolver only when the user has explicitly opted in to the
+     * skip on the resolver side.
+     */
+    ignoreMissingTimeField?: boolean;
+    /**
+     * `'no-downgrade'` rejects a lockfile entry whose version has weaker
+     * trust evidence (no attestations) than an earlier-published version
+     * had. This mirrors the resolver-time `failIfTrustDowngraded` check
+     * applied during fresh resolution — the verifier catches the same
+     * supply-chain signal on entries that bypassed resolution (peek-path,
+     * frozen lockfile, etc.).
+     */
+    trustPolicy?: TrustPolicy;
+    trustPolicyExclude?: string[];
+    trustPolicyIgnoreAfter?: number;
+    registries: Registries;
+    /**
+     * Registries reached via the named-registry resolver chain (e.g. `gh:` →
+     * GitHub Packages). When a lockfile entry's tarball URL falls under one of
+     * these registry base URLs, route the manifest fetch there instead of the
+     * scope-derived default.
+     */
+    namedRegistries?: Record<string, string>;
+    /**
+     * Cache-aware full-metadata fetcher. Decoupled from the resolver pipeline
+     * so abbreviated metadata and `peekManifestFromStore` fast paths cannot
+     * hide the publish timestamp.
+     */
+    fetchOpts: FetchMetadataFromFromRegistryOptions;
+    getAuthHeaderValueByURI: (registry: string) => string | undefined;
+    cacheDir?: FetchFullMetadataCachedOptions['cacheDir'];
+    /** Overrides Date.now() for tests. */
+    now?: number;
+}
+/**
+ * Returns a `ResolutionVerifier` that re-applies the `minimumReleaseAge`
+ * and/or `trustPolicy='no-downgrade'` policies to npm-registry-resolved
+ * lockfile entries, or `undefined` when no policy is active. Pairs with
+ * `createNpmResolver`: each resolver factory may export a sibling
+ * verifier factory that the default-resolver combines.
+ *
+ * Designed for fail-closed semantics: if the manifest can't be loaded or
+ * the pinned version is missing from it, the verifier reports a violation
+ * rather than silently passing. Mirrors the post-resolution gate bun added
+ * for the same shape of bug in oven-sh/bun#30526.
+ */
+export declare function createNpmResolutionVerifier(opts: CreateNpmResolutionVerifierOptions): ResolutionVerifier | undefined;

package/lib/createNpmResolutionVerifier.js

@@ -0,0 +1,473 @@
+import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
+import { createPackageVersionPolicy } from '@pnpm/config.version-policy';
+import { FULL_META_DIR } from '@pnpm/constants';
+import { PnpmError } from '@pnpm/error';
+import semver from 'semver';
+import { fetchAttestationPublishedAt } from './fetchAttestationPublishedAt.js';
+import { fetchAbbreviatedMetadataCached, fetchFullMetadataCached, } from './fetchFullMetadataCached.js';
+import { BUILTIN_NAMED_REGISTRIES } from './parseBareSpecifier.js';
+import { getPkgMirrorPath, loadMeta, warnMissingTimeFieldOnce } from './pickPackage.js';
+import { failIfTrustDowngraded } from './trustChecks.js';
+import { MINIMUM_RELEASE_AGE_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
+/**
+ * Returns a `ResolutionVerifier` that re-applies the `minimumReleaseAge`
+ * and/or `trustPolicy='no-downgrade'` policies to npm-registry-resolved
+ * lockfile entries, or `undefined` when no policy is active. Pairs with
+ * `createNpmResolver`: each resolver factory may export a sibling
+ * verifier factory that the default-resolver combines.
+ *
+ * Designed for fail-closed semantics: if the manifest can't be loaded or
+ * the pinned version is missing from it, the verifier reports a violation
+ * rather than silently passing. Mirrors the post-resolution gate bun added
+ * for the same shape of bug in oven-sh/bun#30526.
+ */
+export function createNpmResolutionVerifier(opts) {
+    const ageCheckActive = Boolean(opts.minimumReleaseAge);
+    const trustCheckActive = opts.trustPolicy === 'no-downgrade';
+    // No policy → no verifier. Skipping early keeps the install-side fan-out
+    // empty when nothing is configured.
+    if (!ageCheckActive && !trustCheckActive)
+        return undefined;
+    const cutoff = ageCheckActive
+        ? (opts.now ?? Date.now()) - opts.minimumReleaseAge * 60 * 1000
+        : 0;
+    const excludePolicy = opts.minimumReleaseAgeExclude?.length
+        ? createExcludePolicy(opts.minimumReleaseAgeExclude, 'minimumReleaseAgeExclude')
+        : undefined;
+    const trustExcludePolicy = opts.trustPolicyExclude?.length
+        ? createExcludePolicy(opts.trustPolicyExclude, 'trustPolicyExclude')
+        : undefined;
+    // Pre-normalize named-registry URLs and sort by length so two registries
+    // that share a hostname but differ by path (e.g. `https://npm/team-a/` vs
+    // `https://npm/team-b/`) route to the longest matching prefix — matching
+    // only `origin` would silently send lookups to the wrong one. Built-in
+    // aliases (`gh:` → npm.pkg.github.com, etc.) are merged in alongside the
+    // user-defined ones so the verifier recognizes the same set of named
+    // registries the resolver does; otherwise a package resolved via `gh:`
+    // would land in the lockfile with a tarball URL the verifier can't route.
+    const namedRegistryPrefixes = Object.values({
+        ...BUILTIN_NAMED_REGISTRIES,
+        ...(opts.namedRegistries ?? {}),
+    })
+        .map((url) => {
+        const parsed = tryParseUrl(url);
+        if (!parsed)
+            return null;
+        // Ensure trailing slash so prefix matching against tarball URLs (which
+        // always include the package path under the registry root) does not
+        // accidentally match a sibling registry whose URL shares a prefix string.
+        const pathname = parsed.pathname.endsWith('/') ? parsed.pathname : `${parsed.pathname}/`;
+        return `${parsed.origin}${pathname}`;
+    })
+        .filter((value) => value != null)
+        .sort((a, b) => b.length - a.length);
+    // Per-install dedup of every network/disk fetch the verifier issues.
+    // The maturity check uses the layered `fetchPublishedAt` lookup; the
+    // trust check uses an attestation fast-path before falling back to
+    // the same full-metadata mirror. All maps live here so verifying
+    // many versions of the same package only pays the disk/network costs
+    // once. The on-disk conditional-GET cache is handled inside
+    // fetch{Abbreviated,Full}MetadataCached via the resolver's shared
+    // mirrors at opts.cacheDir.
+    const lookupContext = {
+        fetchOpts: opts.fetchOpts,
+        getAuthHeaderValueByURI: opts.getAuthHeaderValueByURI,
+        cacheDir: opts.cacheDir,
+        cutoffMs: cutoff,
+        abbreviatedMetaCache: new Map(),
+        publishedAtCache: new Map(),
+        localMetaCache: new Map(),
+        fullMetaCache: new Map(),
+        fullMetaForTrustCache: new Map(),
+    };
+    const minimumReleaseAge = opts.minimumReleaseAge ?? 0;
+    const trustPolicy = opts.trustPolicy;
+    const trustPolicyIgnoreAfter = opts.trustPolicyIgnoreAfter;
+    const verify = async (resolution, { name, version }) => {
+        if (!isNpmRegistryResolution(resolution))
+            return { ok: true };
+        // Non-semver versions identify URL tarballs, file: refs, git refs, etc.
+        // Neither the age nor the trust policy applies, and a registry lookup
+        // would 404.
+        if (!semver.valid(version))
+            return { ok: true };
+        const ageApplies = ageCheckActive && !isExcluded(excludePolicy, name, version);
+        const trustApplies = trustCheckActive && !isExcluded(trustExcludePolicy, name, version);
+        if (!ageApplies && !trustApplies)
+            return { ok: true };
+        const tarballUrl = resolution.tarball;
+        const registry = pickRegistryForVersion(opts.registries, namedRegistryPrefixes, name, tarballUrl);
+        if (ageApplies) {
+            const ageViolation = await runAgeCheck(lookupContext, registry, name, version, cutoff, opts.ignoreMissingTimeField === true);
+            if (ageViolation)
+                return ageViolation;
+        }
+        if (trustApplies) {
+            const trustViolation = await runTrustCheck(lookupContext, registry, name, version, {
+                trustPolicyExclude: trustExcludePolicy,
+                trustPolicyIgnoreAfter,
+            });
+            if (trustViolation)
+                return trustViolation;
+        }
+        return { ok: true };
+    };
+    // Snapshot the exclude lists (sorted, deduped) and require an exact
+    // match in `canTrustPastCheck`: cache identity == policy identity.
+    // Any change to either exclude list — adding, removing, or
+    // substituting an entry — invalidates the cached run. This is
+    // stricter than a pure correctness check would require (adding to
+    // either list is more permissive and the cached pass would still
+    // hold), but it makes the cache contract trivial to reason about and
+    // removes a class of bypasses where a previously-approved version
+    // stays trusted after its exclude entry has been pulled.
+    const sortedMinAgeExcludes = [...new Set(opts.minimumReleaseAgeExclude ?? [])].sort();
+    const sortedTrustExcludes = [...new Set(opts.trustPolicyExclude ?? [])].sort();
+    return {
+        verify,
+        policy: {
+            minimumReleaseAge,
+            minimumReleaseAgeExclude: sortedMinAgeExcludes,
+            trustPolicy: trustPolicy ?? null,
+            trustPolicyExclude: sortedTrustExcludes,
+            trustPolicyIgnoreAfter: trustPolicyIgnoreAfter ?? null,
+        },
+        canTrustPastCheck: (cached) => {
+            // Maturity: a previously cached run under a larger cutoff
+            // (stricter window) is trustworthy under a smaller current one —
+            // its set of accepted versions is a subset of today's. The
+            // reverse — tightening the cutoff — invalidates the cached run:
+            // versions that passed before may now be in-window. Non-number
+            // cached values come from an older record shape and aren't trusted.
+            const past = cached.minimumReleaseAge;
+            const pastNumber = typeof past === 'number' ? past : 0;
+            if (pastNumber < minimumReleaseAge)
+                return false;
+            // Excludes: today's sorted-deduped lists must match the cached
+            // ones byte for byte. Older records (no field) fall back to an
+            // empty array, so they only trust today's empty policy.
+            const pastMinAgeExcludes = Array.isArray(cached.minimumReleaseAgeExclude)
+                ? cached.minimumReleaseAgeExclude
+                : [];
+            if (JSON.stringify(pastMinAgeExcludes) !== JSON.stringify(sortedMinAgeExcludes))
+                return false;
+            // Trust policy: any change to `trustPolicy`, the exclude list, or
+            // the ignore-after cutoff invalidates the cached run. Older
+            // records (no trust field at all) treat the trust policy as
+            // absent and are only trusted under an unset-today policy.
+            const pastTrustPolicy = cached.trustPolicy ?? null;
+            const todayTrustPolicy = trustPolicy ?? null;
+            if (pastTrustPolicy !== todayTrustPolicy)
+                return false;
+            const pastTrustExcludes = Array.isArray(cached.trustPolicyExclude)
+                ? cached.trustPolicyExclude
+                : [];
+            if (JSON.stringify(pastTrustExcludes) !== JSON.stringify(sortedTrustExcludes))
+                return false;
+            const pastIgnoreAfter = typeof cached.trustPolicyIgnoreAfter === 'number'
+                ? cached.trustPolicyIgnoreAfter
+                : null;
+            const todayIgnoreAfter = trustPolicyIgnoreAfter ?? null;
+            if (pastIgnoreAfter !== todayIgnoreAfter)
+                return false;
+            return true;
+        },
+    };
+}
+async function runAgeCheck(context, registry, name, version, cutoff, ignoreMissingTimeField) {
+    let published;
+    try {
+        published = await fetchPublishedAt(context, registry, name, version);
+    }
+    catch (err) {
+        return {
+            ok: false,
+            code: MINIMUM_RELEASE_AGE_VIOLATION_CODE,
+            reason: uncheckable('minimumReleaseAge', err instanceof Error ? err.message : String(err)),
+        };
+    }
+    if (!published) {
+        // No source — attestation, local mirror, or full metadata —
+        // surfaced a publish timestamp for this version. The resolver's
+        // pickMatchingVersionFinal honors `minimumReleaseAgeIgnoreMissingTime`
+        // for the same shape (some self-hosted registries strip per-version
+        // `time`); the verifier mirrors that so it can't be stricter than
+        // fresh resolution. Without the flag we still fail closed — better
+        // a false reject than silent bypass when the user hasn't opted in.
+        if (ignoreMissingTimeField) {
+            warnMissingTimeFieldOnce(name);
+            return undefined;
+        }
+        return {
+            ok: false,
+            code: MINIMUM_RELEASE_AGE_VIOLATION_CODE,
+            reason: uncheckable('minimumReleaseAge', 'version not present in registry manifest'),
+        };
+    }
+    const publishedAt = new Date(published);
+    const ts = publishedAt.getTime();
+    if (Number.isNaN(ts)) {
+        return {
+            ok: false,
+            code: MINIMUM_RELEASE_AGE_VIOLATION_CODE,
+            reason: 'publish timestamp is not a valid date',
+        };
+    }
+    if (ts > cutoff) {
+        return {
+            ok: false,
+            code: MINIMUM_RELEASE_AGE_VIOLATION_CODE,
+            reason: `was published at ${publishedAt.toISOString()}, within the minimumReleaseAge cutoff (${new Date(cutoff).toISOString()})`,
+        };
+    }
+    return undefined;
+}
+/**
+ * Run the resolver-time `failIfTrustDowngraded` check against the
+ * pinned lockfile version. The packument is fetched through a
+ * per-install cache so multiple versions of the same package share
+ * one fetch.
+ *
+ * No attestation fast-path here even though the per-version
+ * attestation endpoint is cheaper than the packument: presence of
+ * provenance on the current version is not sufficient to clear a
+ * downgrade. A package could have shipped earlier versions under a
+ * `trustedPublisher` (the higher-rank evidence) and then dropped
+ * back to plain provenance for the version we're verifying —
+ * `failIfTrustDowngraded` correctly flags that, and a "has any
+ * attestation → pass" shortcut would silently miss it.
+ */
+async function runTrustCheck(context, registry, name, version, opts) {
+    let meta;
+    try {
+        meta = await fetchFullMetaForTrust(context, registry, name);
+    }
+    catch (err) {
+        // `fetchFullMetadataCached` rejects (network error, 404, etc.); the
+        // verifier fails closed so a missing manifest can't be mistaken
+        // for a passing trust check.
+        return {
+            ok: false,
+            code: TRUST_DOWNGRADE_VIOLATION_CODE,
+            reason: uncheckable('trustPolicy', err instanceof Error ? err.message : String(err)),
+        };
+    }
+    try {
+        failIfTrustDowngraded(meta, version, opts);
+    }
+    catch (err) {
+        return {
+            ok: false,
+            code: TRUST_DOWNGRADE_VIOLATION_CODE,
+            reason: err instanceof Error ? err.message : String(err),
+        };
+    }
+    return undefined;
+}
+function fetchFullMetaForTrust(context, registry, name) {
+    const cacheKey = `${registry}\x00${name}`;
+    let cachedPromise = context.fullMetaForTrustCache.get(cacheKey);
+    if (cachedPromise == null) {
+        // Don't swallow the fetch rejection here — `runTrustCheck` catches it
+        // and surfaces the underlying message in the violation reason, which
+        // is more actionable than the generic "metadata is unavailable" the
+        // `!meta` fallback emits. The cache still holds the rejected promise
+        // so repeat verifier calls for the same (registry, name) within one
+        // install don't refetch a known-failing endpoint.
+        cachedPromise = fetchFullMetadataCached(context.fetchOpts, name, {
+            registry,
+            authHeaderValue: context.getAuthHeaderValueByURI(registry),
+            cacheDir: context.cacheDir,
+        });
+        context.fullMetaForTrustCache.set(cacheKey, cachedPromise);
+    }
+    return cachedPromise;
+}
+/**
+ * Per-(registry, name, version) lookup with a layered fallback:
+ *
+ * 1. **Abbreviated metadata `modified` shortcut.** This is what the
+ *    resolver already fetches by default; it's a small document with
+ *    a package-level last-modified time but no per-version timestamps.
+ *    If `modified` is older than the policy cutoff, every version in
+ *    this package was published at least that long ago — return the
+ *    `modified` timestamp as a conservative upper bound and skip the
+ *    rest of the chain. Costs one conditional GET that the resolver
+ *    has usually already paid for.
+ * 2. **On-disk full-metadata mirror.** If a previous verification
+ *    populated `FULL_META_DIR`, take the per-version timestamp from
+ *    there.
+ * 3. **npm attestation endpoint.** Small payload, just this version's
+ *    Sigstore-anchored timestamp. Wins on cold cache when the package
+ *    was published with provenance.
+ * 4. **Full metadata fetch.** Last resort — only paid when the
+ *    abbreviated shortcut can't decide, the local full mirror is
+ *    cold, and there's no attestation.
+ */
+async function fetchPublishedAt(context, registry, name, version) {
+    const cacheKey = `${registry}\x00${name}\x00${version}`;
+    let cachedPromise = context.publishedAtCache.get(cacheKey);
+    if (cachedPromise == null) {
+        cachedPromise = resolvePublishedAt(context, registry, name, version);
+        context.publishedAtCache.set(cacheKey, cachedPromise);
+    }
+    return cachedPromise;
+}
+async function resolvePublishedAt(context, registry, name, version) {
+    const abbreviatedShortcut = await tryAbbreviatedModifiedShortcut(context, registry, name, version);
+    if (abbreviatedShortcut != null)
+        return abbreviatedShortcut;
+    const localTime = await readLocalMetaTime(context, registry, name);
+    if (localTime?.[version])
+        return localTime[version];
+    const attestationTime = await fetchAttestationPublishedAt(context.fetchOpts, name, version, {
+        registry,
+        authHeaderValue: context.getAuthHeaderValueByURI(registry),
+    });
+    if (attestationTime != null)
+        return attestationTime;
+    const fullMetaTime = await fetchFullMetaTime(context, registry, name);
+    return fullMetaTime?.[version];
+}
+/**
+ * Returns the abbreviated metadata's `modified` timestamp **iff** it
+ * proves the gate would pass — i.e. modified is strictly older than
+ * the policy cutoff *and* the pinned version still exists in the
+ * package's current versions map.
+ *
+ * The version check is the fail-closed contract: an unpublished or
+ * never-published version must not slip through on the package-level
+ * `modified` timestamp. When the version is missing here we fall
+ * through to the later layers so the caller eventually surfaces the
+ * "version not present in registry manifest" violation.
+ *
+ * Returns `undefined` otherwise (modified is too recent, the metadata
+ * lacks a parseable modified field, the version isn't in the abbreviated
+ * form, or the fetch failed) and the caller proceeds with per-version
+ * lookups.
+ */
+async function tryAbbreviatedModifiedShortcut(context, registry, name, version) {
+    const meta = await fetchAbbreviatedMeta(context, registry, name);
+    const modified = meta?.modified;
+    if (typeof modified !== 'string')
+        return undefined;
+    const modifiedMs = Date.parse(modified);
+    if (Number.isNaN(modifiedMs))
+        return undefined;
+    if (modifiedMs >= context.cutoffMs)
+        return undefined;
+    // The shortcut treats `modified` as an upper bound on every version's
+    // publish time — but only for versions the registry currently lists.
+    // An unpublished or never-published pin would otherwise pass the gate
+    // on a stale package-level timestamp.
+    if (!meta?.versions || !(version in meta.versions))
+        return undefined;
+    return modified;
+}
+function fetchAbbreviatedMeta(context, registry, name) {
+    const cacheKey = `${registry}\x00${name}`;
+    let cachedPromise = context.abbreviatedMetaCache.get(cacheKey);
+    if (cachedPromise == null) {
+        cachedPromise = fetchAbbreviatedMetadataCached(context.fetchOpts, name, {
+            registry,
+            authHeaderValue: context.getAuthHeaderValueByURI(registry),
+            cacheDir: context.cacheDir,
+        }).catch(() => undefined);
+        context.abbreviatedMetaCache.set(cacheKey, cachedPromise);
+    }
+    return cachedPromise;
+}
+function readLocalMetaTime(context, registry, name) {
+    if (!context.cacheDir)
+        return Promise.resolve(undefined);
+    const cacheKey = `${registry}\x00${name}`;
+    let cachedPromise = context.localMetaCache.get(cacheKey);
+    if (cachedPromise == null) {
+        cachedPromise = loadLocalMetaTime(context.cacheDir, registry, name);
+        context.localMetaCache.set(cacheKey, cachedPromise);
+    }
+    return cachedPromise;
+}
+async function loadLocalMetaTime(cacheDir, registry, name) {
+    const pkgMirror = getPkgMirrorPath(cacheDir, FULL_META_DIR, registry, name);
+    const cached = await loadMeta(pkgMirror);
+    return cached?.time;
+}
+function fetchFullMetaTime(context, registry, name) {
+    const cacheKey = `${registry}\x00${name}`;
+    let cachedPromise = context.fullMetaCache.get(cacheKey);
+    if (cachedPromise == null) {
+        cachedPromise = fetchFullMetadataCached(context.fetchOpts, name, {
+            registry,
+            authHeaderValue: context.getAuthHeaderValueByURI(registry),
+            cacheDir: context.cacheDir,
+        }).then((meta) => meta.time);
+        context.fullMetaCache.set(cacheKey, cachedPromise);
+    }
+    return cachedPromise;
+}
+function pickRegistryForVersion(registries, namedRegistryPrefixes, name, tarballUrl) {
+    // If the lockfile records where the tarball lives, prefer that — scope
+    // routing (`@scope:registry`) only covers scoped packages, but named
+    // registries (`gh:`, `jsr:` aliases, custom) ship un-scoped packages whose
+    // origin we'd otherwise miss. Match the longest prefix so that two named
+    // registries sharing a host but differing by path don't collide.
+    if (tarballUrl) {
+        const normalized = tryParseUrl(tarballUrl)?.toString();
+        if (normalized) {
+            for (const prefix of namedRegistryPrefixes) {
+                if (normalized.startsWith(prefix))
+                    return prefix;
+            }
+        }
+    }
+    return pickRegistryForPackage(registries, name);
+}
+function tryParseUrl(url) {
+    try {
+        return new URL(url);
+    }
+    catch {
+        return null;
+    }
+}
+function uncheckable(policy, why) {
+    return `could not be checked against ${policy} (${why})`;
+}
+function createExcludePolicy(patterns, key) {
+    // Mirror the wrapping done by the full-resolution path
+    // (installing/deps-resolver/src/resolveDependencyTree.ts) so the error
+    // code is identical regardless of which path surfaced the invalid pattern.
+    try {
+        return createPackageVersionPolicy(patterns);
+    }
+    catch (err) {
+        if (!err || typeof err !== 'object' || !('message' in err))
+            throw err;
+        throw new PnpmError(`INVALID_${key.replace(/([A-Z])/g, '_$1').toUpperCase()}`, `Invalid value in ${key}: ${err.message}`);
+    }
+}
+function isExcluded(policy, name, version) {
+    if (!policy)
+        return false;
+    const result = policy(name);
+    if (result === true)
+        return true;
+    if (Array.isArray(result) && result.includes(version))
+        return true;
+    return false;
+}
+function isNpmRegistryResolution(resolution) {
+    if (resolution == null || typeof resolution !== 'object')
+        return false;
+    // Only plain tarball resolutions (npm registry / named registries) have no
+    // `type` field. Git / directory / binary / custom resolutions all carry one.
+    if ('type' in resolution && resolution.type != null)
+        return false;
+    // Git-hosted tarballs (codeload/gitlab/bitbucket) are special-cased in
+    // the resolver and aren't subject to release-age policy.
+    if ('gitHosted' in resolution && resolution.gitHosted)
+        return false;
+    return 'tarball' in resolution || 'integrity' in resolution;
+}
+//# sourceMappingURL=createNpmResolutionVerifier.js.map

package/lib/fetchAttestationPublishedAt.d.ts

@@ -0,0 +1,31 @@
+import type { FetchMetadataFromFromRegistryOptions } from './fetch.js';
+/**
+ * Per-version publish timestamp from npm's attestation endpoint —
+ * `/-/npm/v1/attestations/<name>@<version>`.
+ *
+ * The response is a small JSON document containing one or more Sigstore
+ * bundles. We read `bundle.verificationMaterial.tlogEntries[].integratedTime`
+ * (the Rekor inclusion time) and surface it as an ISO date. This is a
+ * couple of seconds after the actual publish — close enough for a
+ * release-age policy that operates in minutes/hours/days.
+ *
+ * We deliberately do **not** verify the Sigstore signature here: the
+ * trust model is identical to reading the registry's `time` field on
+ * the full metadata document. The win is bandwidth — the attestation
+ * payload is tens of KB versus the multi-MB full metadata document, so
+ * cold-cache + `--frozen-lockfile` installs against a fleet of
+ * provenance-published packages pay far less to verify timestamps.
+ *
+ * Returns `undefined` when:
+ *
+ * - The package has no published attestations (`404`).
+ * - The response is malformed or missing the timestamp.
+ * - The request itself fails (network error, registry 5xx).
+ *
+ * In all of those cases the caller falls back to fetching full metadata.
+ */
+export interface FetchAttestationOptions {
+    registry: string;
+    authHeaderValue?: string;
+}
+export declare function fetchAttestationPublishedAt(fetchOpts: FetchMetadataFromFromRegistryOptions, pkgName: string, version: string, opts: FetchAttestationOptions): Promise<string | undefined>;

package/lib/fetchAttestationPublishedAt.js

@@ -0,0 +1,99 @@
+import * as retry from '@zkochan/retry';
+export async function fetchAttestationPublishedAt(fetchOpts, pkgName, version, opts) {
+    const url = `${opts.registry.replace(/\/$/, '')}/-/npm/v1/attestations/${pkgName}@${version}`;
+    const retryOperation = retry.operation(fetchOpts.retry);
+    return new Promise((resolve) => {
+        retryOperation.attempt(async () => {
+            let response;
+            try {
+                response = await fetchOpts.fetch(url, {
+                    authHeaderValue: opts.authHeaderValue,
+                    retry: fetchOpts.retry,
+                    timeout: fetchOpts.timeout,
+                });
+            }
+            catch {
+                // Network errors fall through to the full-metadata path; the
+                // caller's `fetchFullMetadataCached` has its own retry policy.
+                resolve(undefined);
+                return;
+            }
+            // 404 = package never published attestations. Other 4xx/5xx also
+            // mean "can't get an answer from this endpoint, fall back."
+            if (response.status >= 400) {
+                resolve(undefined);
+                return;
+            }
+            let body;
+            try {
+                body = await response.json();
+            }
+            catch {
+                resolve(undefined);
+                return;
+            }
+            resolve(extractPublishedAt(body));
+        });
+    });
+}
+/**
+ * Pull the earliest `integratedTime` across every attestation bundle in
+ * the response and convert it to an ISO timestamp. Earliest is the
+ * conservative choice: if two attestations disagree (e.g. publish
+ * v0.1 vs SLSA provenance v1), we attribute the publish to the older
+ * Rekor entry. The Rekor timestamp is what tells us when the artifact
+ * existed in a transparency log — that's the floor on publish time.
+ */
+function extractPublishedAt(body) {
+    if (!body || typeof body !== 'object')
+        return undefined;
+    const attestations = body.attestations;
+    if (!Array.isArray(attestations))
+        return undefined;
+    let earliestSeconds;
+    for (const attestation of attestations) {
+        const seconds = readEarliestIntegratedTime(attestation);
+        if (seconds == null)
+            continue;
+        if (earliestSeconds == null || seconds < earliestSeconds) {
+            earliestSeconds = seconds;
+        }
+    }
+    if (earliestSeconds == null)
+        return undefined;
+    return new Date(earliestSeconds * 1000).toISOString();
+}
+function readEarliestIntegratedTime(attestation) {
+    if (!attestation || typeof attestation !== 'object')
+        return undefined;
+    const bundle = attestation.bundle;
+    if (!bundle || typeof bundle !== 'object')
+        return undefined;
+    const verificationMaterial = bundle.verificationMaterial;
+    if (!verificationMaterial || typeof verificationMaterial !== 'object')
+        return undefined;
+    const tlogEntries = verificationMaterial.tlogEntries;
+    if (!Array.isArray(tlogEntries))
+        return undefined;
+    let earliest;
+    for (const entry of tlogEntries) {
+        if (!entry || typeof entry !== 'object')
+            continue;
+        const rawIntegratedTime = entry.integratedTime;
+        // npm serializes integratedTime as a string ("1778583836") to avoid
+        // JSON precision loss; accept either string or number defensively.
+        const seconds = parseIntegratedTimeSeconds(rawIntegratedTime);
+        if (seconds == null)
+            continue;
+        if (earliest == null || seconds < earliest)
+            earliest = seconds;
+    }
+    return earliest;
+}
+function parseIntegratedTimeSeconds(raw) {
+    const seconds = typeof raw === 'string' ? Number(raw) : typeof raw === 'number' ? raw : NaN;
+    if (!Number.isFinite(seconds) || seconds <= 0)
+        return undefined;
+    return seconds;
+}
+//# sourceMappingURL=fetchAttestationPublishedAt.js.map

package/lib/fetchFullMetadataCached.d.ts

@@ -0,0 +1,33 @@
+import type { PackageMeta } from '@pnpm/resolving.registry.types';
+import { type FetchMetadataFromFromRegistryOptions } from './fetch.js';
+export interface FetchMetadataCachedOptions {
+    registry: string;
+    authHeaderValue?: string;
+    /**
+     * pnpm's on-disk cache directory. When set, the call issues a conditional
+     * GET against the matching mirror the resolver populates: a 304 Not
+     * Modified response serves the body from disk, a 200 writes the new body
+     * back. Omit to disable caching — every call re-fetches.
+     */
+    cacheDir?: string;
+}
+export type FetchFullMetadataCachedOptions = FetchMetadataCachedOptions;
+/**
+ * Fetch a full registry metadata document for `pkgName`, reusing pnpm's
+ * shared on-disk metadata mirror when `cacheDir` is supplied. Built for the
+ * `minimumReleaseAge` lockfile revalidation gate, which needs the `time`
+ * field that abbreviated metadata omits; the cache reuse keeps repeat
+ * installs from re-downloading the same multi-megabyte document for every
+ * locked package.
+ */
+export declare function fetchFullMetadataCached(fetchOpts: FetchMetadataFromFromRegistryOptions, pkgName: string, opts: FetchFullMetadataCachedOptions): Promise<PackageMeta>;
+/**
+ * Sibling of {@link fetchFullMetadataCached} that hits the abbreviated
+ * metadata endpoint (`Accept: application/vnd.npm.install-v1+json`) and
+ * caches under `ABBREVIATED_META_DIR` — the same mirror the resolver
+ * populates by default. Used by the lockfile verification gate as a
+ * cheap upper-bound check: if the package's `modified` field is older
+ * than the policy cutoff, every version in it predates the cutoff and
+ * no per-version timestamp lookup is needed.
+ */
+export declare function fetchAbbreviatedMetadataCached(fetchOpts: FetchMetadataFromFromRegistryOptions, pkgName: string, opts: FetchMetadataCachedOptions): Promise<PackageMeta>;

package/lib/fetchFullMetadataCached.js

@@ -0,0 +1,63 @@
+import { ABBREVIATED_META_DIR, FULL_META_DIR } from '@pnpm/constants';
+import { PnpmError } from '@pnpm/error';
+import { fetchMetadataFromFromRegistry } from './fetch.js';
+import { getPkgMirrorPath, loadMeta, loadMetaHeaders, prepareJsonForDisk, saveMeta } from './pickPackage.js';
+/**
+ * Fetch a full registry metadata document for `pkgName`, reusing pnpm's
+ * shared on-disk metadata mirror when `cacheDir` is supplied. Built for the
+ * `minimumReleaseAge` lockfile revalidation gate, which needs the `time`
+ * field that abbreviated metadata omits; the cache reuse keeps repeat
+ * installs from re-downloading the same multi-megabyte document for every
+ * locked package.
+ */
+export async function fetchFullMetadataCached(fetchOpts, pkgName, opts) {
+    return fetchMetadataCached(fetchOpts, pkgName, { ...opts, fullMetadata: true, metaDir: FULL_META_DIR });
+}
+/**
+ * Sibling of {@link fetchFullMetadataCached} that hits the abbreviated
+ * metadata endpoint (`Accept: application/vnd.npm.install-v1+json`) and
+ * caches under `ABBREVIATED_META_DIR` — the same mirror the resolver
+ * populates by default. Used by the lockfile verification gate as a
+ * cheap upper-bound check: if the package's `modified` field is older
+ * than the policy cutoff, every version in it predates the cutoff and
+ * no per-version timestamp lookup is needed.
+ */
+export async function fetchAbbreviatedMetadataCached(fetchOpts, pkgName, opts) {
+    return fetchMetadataCached(fetchOpts, pkgName, { ...opts, fullMetadata: false, metaDir: ABBREVIATED_META_DIR });
+}
+async function fetchMetadataCached(fetchOpts, pkgName, opts) {
+    const pkgMirror = opts.cacheDir != null
+        ? getPkgMirrorPath(opts.cacheDir, opts.metaDir, opts.registry, pkgName)
+        : null;
+    const cacheHeaders = pkgMirror != null ? await loadMetaHeaders(pkgMirror) : null;
+    const result = await fetchMetadataFromFromRegistry(fetchOpts, pkgName, {
+        registry: opts.registry,
+        authHeaderValue: opts.authHeaderValue,
+        fullMetadata: opts.fullMetadata,
+        etag: cacheHeaders?.etag,
+        modified: cacheHeaders?.modified,
+    });
+    if ('notModified' in result && result.notModified) {
+        if (pkgMirror == null) {
+            // We didn't send conditional headers (no cacheDir), but the registry
+            // returned 304 anyway. There's no body to fall back on.
+            throw new PnpmError('META_NOT_MODIFIED_WITHOUT_CACHE', `Registry returned 304 for ${pkgName} without an existing cache to refresh.`);
+        }
+        const meta = await loadMeta(pkgMirror);
+        if (meta == null) {
+            // Cache file vanished between header-load and meta-load (concurrent
+            // store cleanup, antivirus, etc.).
+            throw new PnpmError('META_CACHE_MISSING_AFTER_304', `Metadata cache for ${pkgName} disappeared between headers read and full read.`);
+        }
+        return meta;
+    }
+    if (pkgMirror != null) {
+        // Persist so the next install can do a headers-only conditional GET.
+        // Fire-and-forget — a cache-write failure isn't a reason to fail the
+        // caller; the next install just won't get the speedup.
+        const json = prepareJsonForDisk(result.meta, result.etag, result.jsonText);
+        saveMeta(pkgMirror, json).catch(() => { });
+    }
+    return result.meta;
+}
+//# sourceMappingURL=fetchFullMetadataCached.js.map

package/lib/index.d.ts

@@ -12,16 +12,15 @@ export interface NoMatchingVersionErrorOptions {
     wantedDependency: WantedDependency;
     packageMeta: PackageMeta;
     registry: string;
-    immatureVersion?: string;
-    publishedBy?: Date;
 }
 export declare class NoMatchingVersionError extends PnpmError {
     readonly packageMeta: PackageMeta;
-    readonly immatureVersion?: string;
     constructor(opts: NoMatchingVersionErrorOptions);
 }
 export declare function formatTimeAgo(date: Date): string | null;
 export { BUILTIN_NAMED_REGISTRIES, fetchMetadataFromFromRegistry, type FetchMetadataFromFromRegistryOptions, type PackageMeta, type PackageMetaCache, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, type RegistryPackageSpec, RegistryResponseError, workspacePrefToNpm, };
+export { createNpmResolutionVerifier, type CreateNpmResolutionVerifierOptions } from './createNpmResolutionVerifier.js';
+export { MINIMUM_RELEASE_AGE_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
 export { whichVersionIsPinned } from './whichVersionIsPinned.js';
 export interface ResolverFactoryOptions {
     cacheDir: string;
@@ -36,7 +35,6 @@ export interface ResolverFactoryOptions {
     namedRegistries?: Record<string, string>;
     saveWorkspaceProtocol?: boolean | 'rolling';
     preserveAbsolutePaths?: boolean;
-    strictPublishedByCheck?: boolean;
     ignoreMissingTimeField?: boolean;
     fetchWarnTimeoutMs?: number;
     /** Pre-populated metadata cache. When provided, the resolver uses this

package/lib/index.js

@@ -17,28 +17,17 @@ import { BUILTIN_NAMED_REGISTRIES, parseBareSpecifier, parseJsrSpecifierToRegist
 import { pickPackage, } from './pickPackage.js';
 import { pickPackageFromMeta, pickVersionByVersionRange } from './pickPackageFromMeta.js';
 import { failIfTrustDowngraded } from './trustChecks.js';
+import { MINIMUM_RELEASE_AGE_VIOLATION_CODE } from './violationCodes.js';
 import { whichVersionIsPinned } from './whichVersionIsPinned.js';
 import { workspacePrefToNpm } from './workspacePrefToNpm.js';
 export class NoMatchingVersionError extends PnpmError {
     packageMeta;
-    immatureVersion;
     constructor(opts) {
         const dep = opts.wantedDependency.alias
             ? `${opts.wantedDependency.alias}@${opts.wantedDependency.bareSpecifier ?? ''}`
             : opts.wantedDependency.bareSpecifier;
-        let errorMessage;
-        if (opts.publishedBy && opts.immatureVersion && opts.packageMeta.time) {
-            const time = new Date(opts.packageMeta.time[opts.immatureVersion]);
-            const releaseAgeText = formatTimeAgo(time) ?? 'just now';
-            const pkgName = opts.wantedDependency.alias ?? opts.packageMeta.name;
-            errorMessage = `Version ${opts.immatureVersion} (released ${releaseAgeText}) of ${pkgName} does not meet the minimumReleaseAge constraint`;
-        }
-        else {
-            errorMessage = `No matching version found for ${dep} while fetching it from ${opts.registry}`;
-        }
-        super(opts.publishedBy ? 'NO_MATURE_MATCHING_VERSION' : 'NO_MATCHING_VERSION', errorMessage);
+        super('NO_MATCHING_VERSION', `No matching version found for ${dep} while fetching it from ${opts.registry}`);
         this.packageMeta = opts.packageMeta;
-        this.immatureVersion = opts.immatureVersion;
     }
 }
 export function formatTimeAgo(date) {
@@ -71,6 +60,8 @@ export function formatTimeAgo(date) {
     return 'a few seconds ago';
 }
 export { BUILTIN_NAMED_REGISTRIES, fetchMetadataFromFromRegistry, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, RegistryResponseError, workspacePrefToNpm, };
+export { createNpmResolutionVerifier } from './createNpmResolutionVerifier.js';
+export { MINIMUM_RELEASE_AGE_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
 export { whichVersionIsPinned } from './whichVersionIsPinned.js';
 export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
     if (typeof opts.cacheDir !== 'string') {
@@ -126,7 +117,6 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
             offline: opts.offline,
             preferOffline: opts.preferOffline,
             cacheDir: opts.cacheDir,
-            strictPublishedByCheck: opts.strictPublishedByCheck,
             ignoreMissingTimeField: opts.ignoreMissingTimeField,
         }),
         registries: opts.registries,
@@ -207,6 +197,19 @@ async function resolveNpm(ctx, wantedDependency, opts) {
                         resolution: currentResolution,
                         resolvedVia: 'npm-registry',
                         publishedAt: opts.currentPkg.publishedAt,
+                        // Loose-mode bypass: a lockfile entry whose publishedAt sits
+                        // after the maturity cutoff would have been rejected at
+                        // resolver time, but the peek path skips the maturity check.
+                        // Report inline so the deps-resolver aggregator surfaces it
+                        // to the install command.
+                        policyViolation: detectMinReleaseAgeViolation({
+                            name: manifest.name,
+                            version: manifest.version,
+                            publishedAt: opts.currentPkg.publishedAt,
+                            resolution: currentResolution,
+                            publishedBy: opts.publishedBy,
+                            publishedByExclude: opts.publishedByExclude,
+                        }),
                     };
                 }
             }
@@ -267,22 +270,6 @@ async function resolveNpm(ctx, wantedDependency, opts) {
                 // ignore
             }
         }
-        if (opts.publishedBy) {
-            const immatureVersion = pickVersionByVersionRange({
-                meta,
-                versionRange: spec.fetchSpec,
-                preferredVersionSelectors: opts.preferredVersions?.[spec.name],
-            });
-            if (immatureVersion) {
-                throw new NoMatchingVersionError({
-                    wantedDependency,
-                    packageMeta: meta,
-                    registry,
-                    immatureVersion,
-                    publishedBy: opts.publishedBy,
-                });
-            }
-        }
         throw new NoMatchingVersionError({ wantedDependency, packageMeta: meta, registry });
     }
     else if (opts.trustPolicy === 'no-downgrade') {
@@ -335,14 +322,23 @@ async function resolveNpm(ctx, wantedDependency, opts) {
             defaultPinnedVersion: opts.pinnedVersion,
         });
     }
+    const publishedAt = meta.time?.[pickedPackage.version];
     return {
         id,
         latest: meta['dist-tags'].latest,
         manifest: pickedPackage,
         resolution,
         resolvedVia: 'npm-registry',
-        publishedAt: meta.time?.[pickedPackage.version],
+        publishedAt,
         normalizedBareSpecifier,
+        policyViolation: detectMinReleaseAgeViolation({
+            name: pickedPackage.name,
+            version: pickedPackage.version,
+            publishedAt,
+            resolution,
+            publishedBy: opts.publishedBy,
+            publishedByExclude: opts.publishedByExclude,
+        }),
     };
 }
 async function resolveJsr(ctx, wantedDependency, opts) {
@@ -439,15 +435,25 @@ async function pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, registr
     if (pickedPackage == null) {
         throw new NoMatchingVersionError({ wantedDependency, packageMeta: meta, registry });
     }
+    const resolution = {
+        integrity: getIntegrity(pickedPackage.dist),
+        tarball: normalizeRegistryUrl(pickedPackage.dist.tarball),
+    };
+    const publishedAt = meta.time?.[pickedPackage.version];
     return {
         id: `${pickedPackage.name}@${pickedPackage.version}`,
         latest: meta['dist-tags'].latest,
         manifest: pickedPackage,
-        resolution: {
-            integrity: getIntegrity(pickedPackage.dist),
-            tarball: normalizeRegistryUrl(pickedPackage.dist.tarball),
-        },
-        publishedAt: meta.time?.[pickedPackage.version],
+        resolution,
+        publishedAt,
+        policyViolation: detectMinReleaseAgeViolation({
+            name: pickedPackage.name,
+            version: pickedPackage.version,
+            publishedAt,
+            resolution,
+            publishedBy: opts.publishedBy,
+            publishedByExclude: opts.publishedByExclude,
+        }),
     };
 }
 // Builds a `<prefix><pkgName>@<range>` specifier (or a bare `<prefix><range>`
@@ -609,6 +615,40 @@ function defaultTagForAlias(alias, defaultTag) {
         type: 'tag',
     };
 }
+/**
+ * Inline minimumReleaseAge detection: returns a violation entry when the
+ * picked version's publish timestamp is past the policy cutoff (and
+ * isn't covered by `publishedByExclude`). The resolver already has the
+ * timestamp in hand, so reporting inline saves the install layer from
+ * re-walking the resolved tree and re-fetching the same metadata. The
+ * deps-resolver aggregates the per-resolve `policyViolation` fields into
+ * a single set the install command reacts to.
+ *
+ * Returns `undefined` for resolutions outside the policy — no policy
+ * active, version excluded by pattern, timestamp missing or malformed,
+ * or version mature. Specific-version exclusions (`pkg@1.0.0`) and
+ * full-name exclusions (`pkg`) are both honored so an entry already on
+ * the user's exclude list isn't re-announced every install.
+ */
+function detectMinReleaseAgeViolation(args) {
+    if (!args.publishedBy || !args.publishedAt)
+        return undefined;
+    const excludeResult = args.publishedByExclude?.(args.name);
+    if (excludeResult === true)
+        return undefined;
+    if (Array.isArray(excludeResult) && excludeResult.includes(args.version))
+        return undefined;
+    const ts = new Date(args.publishedAt).getTime();
+    if (Number.isNaN(ts) || ts <= args.publishedBy.getTime())
+        return undefined;
+    return {
+        name: args.name,
+        version: args.version,
+        resolution: args.resolution,
+        code: MINIMUM_RELEASE_AGE_VIOLATION_CODE,
+        reason: `was published at ${new Date(ts).toISOString()}, within the minimumReleaseAge cutoff (${args.publishedBy.toISOString()})`,
+    };
+}
 function getIntegrity(dist) {
     if (dist.integrity) {
         return dist.integrity;

package/lib/pickPackage.d.ts

@@ -29,9 +29,40 @@ export declare function pickPackage(ctx: {
     offline?: boolean;
     preferOffline?: boolean;
     filterMetadata?: boolean;
-    strictPublishedByCheck?: boolean;
     ignoreMissingTimeField?: boolean;
 }, spec: RegistryPackageSpec, opts: PickPackageOptions): Promise<{
     meta: PackageMeta;
     pickedPackage: PackageInRegistry | null;
 }>;
+export declare function encodePkgName(pkgName: string): string;
+/**
+ * Path of the on-disk JSONL document where pnpm mirrors a package's registry
+ * metadata. `metaDir` selects between abbreviated and full caches.
+ */
+export declare function getPkgMirrorPath(cacheDir: string, metaDir: string, registry: string, pkgName: string): string;
+/**
+ * Formats metadata for disk storage as two-line NDJSON:
+ *   Line 1: cache headers (etag, modified) — small, fast to read
+ *   Line 2: the full registry metadata JSON — unchanged from the registry response
+ */
+export declare function prepareJsonForDisk(meta: PackageMeta, etag: string | undefined, jsonText?: string): string;
+export declare function warnMissingTimeFieldOnce(pkgName: string): void;
+interface MetaHeaders {
+    etag?: string;
+    modified?: string;
+}
+/**
+ * Reads only the first line of the cached NDJSON metadata file to extract
+ * the cache headers (etag, modified). This avoids reading and
+ * parsing the full metadata (which can be megabytes for popular packages)
+ * when we only need conditional-request headers.
+ */
+export declare function loadMetaHeaders(pkgMirror: string): Promise<MetaHeaders | null>;
+/**
+ * Reads the full metadata from the cached NDJSON file.
+ * Line 1: cache headers (etag, modified)
+ * Line 2: registry metadata JSON
+ */
+export declare function loadMeta(pkgMirror: string): Promise<PackageMeta | null>;
+export declare function saveMeta(pkgMirror: string, json: string): Promise<void>;
+export {};

package/lib/pickPackage.js

@@ -58,12 +58,13 @@ function pickMax(a, b) {
 const pickHighest = pickPackageFromMeta.bind(null, pickVersionByVersionRange);
 const pickLowest = pickPackageFromMeta.bind(null, pickLowestVersionByVersionRange);
 // When minimumReleaseAge is active: try the highest mature version; if none
-// and strictPublishedByCheck is off, fall back to the lowest version in range
-// without applying the maturity filter.
+// satisfies the range, fall back to the lowest version regardless of maturity
+// so the resolver can report the violation inline and let the install layer
+// (or other caller) decide what to do — never throw at this layer.
 function pickRespectingMinReleaseAge(pickerOpts, spec, meta) {
     return runPicker(pickerOpts, spec, (targetSpec) => {
         const highest = pickHighest(pickerOpts, meta, targetSpec);
-        if (highest || pickerOpts.strictPublishedByCheck)
+        if (highest)
             return highest;
         return pickLowest({
             preferredVersionSelectors: pickerOpts.preferredVersionSelectors,
@@ -111,7 +112,6 @@ export async function pickPackage(ctx, spec, opts) {
         publishedByExclude: opts.publishedByExclude,
         pickLowestVersion: opts.pickLowestVersion,
         includeLatestTag: opts.includeLatestTag,
-        strictPublishedByCheck: ctx.strictPublishedByCheck,
         ignoreMissingTimeField: ctx.ignoreMissingTimeField,
     };
     validatePackageName(spec.name);
@@ -123,8 +123,7 @@ export async function pickPackage(ctx, spec, opts) {
         : ABBREVIATED_META_DIR;
     // Cache key includes fullMetadata to avoid returning abbreviated metadata when full metadata is requested.
     const cacheKey = fullMetadata ? `${spec.name}:full` : spec.name;
-    const registryName = getRegistryName(opts.registry);
-    const pkgMirror = path.join(ctx.cacheDir, metaDir, registryName, `${encodePkgName(spec.name)}.jsonl`);
+    const pkgMirror = getPkgMirrorPath(ctx.cacheDir, metaDir, opts.registry, spec.name);
     const cachedMeta = ctx.metaCache.get(cacheKey);
     if (cachedMeta != null) {
         // The in-memory cache may hold abbreviated metadata from an earlier call
@@ -194,10 +193,11 @@ export async function pickPackage(ctx, spec, opts) {
                         };
                     }
                 }
-                catch (err) {
-                    if (shouldRethrowFromFastPathCache(err, ctx.strictPublishedByCheck)) {
-                        throw err;
-                    }
+                catch {
+                    // Swallow fast-path errors (e.g. ERR_PNPM_MISSING_TIME from
+                    // abbreviated meta) and fall through to the network fetch, which
+                    // can upgrade to full metadata and run the maturity check on
+                    // real `time` data.
                 }
             }
         }
@@ -215,10 +215,8 @@ export async function pickPackage(ctx, spec, opts) {
                             };
                         }
                     }
-                    catch (err) {
-                        if (shouldRethrowFromFastPathCache(err, ctx.strictPublishedByCheck)) {
-                            throw err;
-                        }
+                    catch {
+                        // Same as above — fall through to the network fetch.
                     }
                 }
             }
@@ -388,13 +386,6 @@ async function maybeUpgradeAbbreviatedMetaForReleaseAge(ctx, spec, opts, meta) {
     }
     return { meta: fullFetchResult.meta, upgradedFrom: fullFetchResult };
 }
-// Returns true when a fast-path cache catch should rethrow under
-// strictPublishedByCheck. ERR_PNPM_MISSING_TIME is excluded so callers fall
-// through to the network fetch path, which can upgrade abbreviated cached
-// metadata to full and run the maturity check on real `time` data.
-function shouldRethrowFromFastPathCache(err, strictPublishedByCheck) {
-    return strictPublishedByCheck === true && !isMissingTimeError(err);
-}
 // Persists upgraded full metadata to the on-disk cache mirror and returns
 // the meta to store in the in-memory cache. When `filterMetadata` is on, the
 // in-memory and on-disk forms are both stripped via `clearMeta`; otherwise
@@ -449,18 +440,25 @@ function clearMeta(pkg) {
         modified: pkg.modified,
     };
 }
-function encodePkgName(pkgName) {
+export function encodePkgName(pkgName) {
     if (pkgName !== pkgName.toLowerCase()) {
         return `${pkgName}_${createHexHash(pkgName)}`;
     }
     return pkgName;
 }
+/**
+ * Path of the on-disk JSONL document where pnpm mirrors a package's registry
+ * metadata. `metaDir` selects between abbreviated and full caches.
+ */
+export function getPkgMirrorPath(cacheDir, metaDir, registry, pkgName) {
+    return path.join(cacheDir, metaDir, getRegistryName(registry), `${encodePkgName(pkgName)}.jsonl`);
+}
 /**
  * Formats metadata for disk storage as two-line NDJSON:
  *   Line 1: cache headers (etag, modified) — small, fast to read
  *   Line 2: the full registry metadata JSON — unchanged from the registry response
  */
-function prepareJsonForDisk(meta, etag, jsonText) {
+export function prepareJsonForDisk(meta, etag, jsonText) {
     const modified = meta.modified ?? meta.time?.modified;
     const headers = JSON.stringify({ etag, modified });
     const body = jsonText ?? JSON.stringify(meta);
@@ -476,7 +474,7 @@ function isMissingTimeError(err) {
 // memory via this Set as they resolve ever more distinct packages.
 const MAX_WARNED_MISSING_TIME = 1024;
 const warnedMissingTimeFor = new Set();
-function warnMissingTimeFieldOnce(pkgName) {
+export function warnMissingTimeFieldOnce(pkgName) {
     if (warnedMissingTimeFor.has(pkgName))
         return;
     if (warnedMissingTimeFor.size >= MAX_WARNED_MISSING_TIME) {
@@ -503,7 +501,7 @@ async function getFileMtime(filePath) {
  * parsing the full metadata (which can be megabytes for popular packages)
  * when we only need conditional-request headers.
  */
-async function loadMetaHeaders(pkgMirror) {
+export async function loadMetaHeaders(pkgMirror) {
     let fh;
     try {
         fh = await fs.open(pkgMirror, 'r');
@@ -530,7 +528,7 @@ async function loadMetaHeaders(pkgMirror) {
  * Line 1: cache headers (etag, modified)
  * Line 2: registry metadata JSON
  */
-async function loadMeta(pkgMirror) {
+export async function loadMeta(pkgMirror) {
     try {
         const data = await gfs.readFile(pkgMirror, 'utf8');
         const newlineIdx = data.indexOf('\n');
@@ -546,7 +544,7 @@ async function loadMeta(pkgMirror) {
     }
 }
 const createdDirs = new Set();
-async function saveMeta(pkgMirror, json) {
+export async function saveMeta(pkgMirror, json) {
     const dir = path.dirname(pkgMirror);
     if (!createdDirs.has(dir)) {
         await fs.mkdir(dir, { recursive: true });

package/lib/violationCodes.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Violation codes the npm resolver attaches to
+ * `ResolutionPolicyViolation.code` when an inline policy check rejects
+ * a pick. Exported so downstream code (the install command, the strict
+ * resolver wrapper, tests) references one source of truth instead of
+ * re-typing the string.
+ *
+ * Lives in its own module — both `index.ts` and `createNpmResolutionVerifier.ts`
+ * import it, so keeping the constants here avoids a cycle.
+ */
+export declare const MINIMUM_RELEASE_AGE_VIOLATION_CODE = "MINIMUM_RELEASE_AGE_VIOLATION";
+export declare const TRUST_DOWNGRADE_VIOLATION_CODE = "TRUST_DOWNGRADE";

package/lib/violationCodes.js

@@ -0,0 +1,13 @@
+/**
+ * Violation codes the npm resolver attaches to
+ * `ResolutionPolicyViolation.code` when an inline policy check rejects
+ * a pick. Exported so downstream code (the install command, the strict
+ * resolver wrapper, tests) references one source of truth instead of
+ * re-typing the string.
+ *
+ * Lives in its own module — both `index.ts` and `createNpmResolutionVerifier.ts`
+ * import it, so keeping the constants here avoids a cycle.
+ */
+export const MINIMUM_RELEASE_AGE_VIOLATION_CODE = 'MINIMUM_RELEASE_AGE_VIOLATION';
+export const TRUST_DOWNGRADE_VIOLATION_CODE = 'TRUST_DOWNGRADE';
+//# sourceMappingURL=violationCodes.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.npm-resolver",
-  "version": "1101.1.1",
+  "version": "1101.2.0",
   "description": "Resolver for npm-hosted packages",
   "keywords": [
     "pnpm",
@@ -40,26 +40,27 @@
     "semver-utils": "^1.1.4",
     "ssri": "13.0.1",
     "version-selector-type": "^3.0.0",
-    "@pnpm/core-loggers": "1100.0.2",
+    "@pnpm/config.pick-registry-for-package": "1100.0.3",
+    "@pnpm/config.version-policy": "1100.1.0",
     "@pnpm/constants": "1100.0.0",
+    "@pnpm/core-loggers": "1100.1.0",
     "@pnpm/crypto.hash": "1100.0.1",
-    "@pnpm/fs.graceful-fs": "1100.1.0",
     "@pnpm/error": "1100.0.0",
     "@pnpm/fetching.types": "1100.0.1",
-    "@pnpm/resolving.registry.types": "1100.0.3",
+    "@pnpm/fs.graceful-fs": "1100.1.0",
+    "@pnpm/resolving.jsr-specifier-parser": "1100.0.0",
     "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.3",
-    "@pnpm/resolving.resolver-base": "1100.1.3",
-    "@pnpm/types": "1101.1.0",
+    "@pnpm/resolving.registry.types": "1100.0.3",
+    "@pnpm/resolving.resolver-base": "1100.2.0",
+    "@pnpm/store.cafs": "1100.1.5",
     "@pnpm/store.index": "1100.1.0",
-    "@pnpm/store.cafs": "1100.1.4",
-    "@pnpm/workspace.spec-parser": "1100.0.0",
+    "@pnpm/types": "1101.1.0",
     "@pnpm/workspace.range-resolver": "1100.0.1",
-    "@pnpm/resolving.jsr-specifier-parser": "1100.0.0",
-    "@pnpm/config.pick-registry-for-package": "1100.0.3"
+    "@pnpm/workspace.spec-parser": "1100.0.0"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0",
-    "@pnpm/worker": "^1100.1.5"
+    "@pnpm/worker": "^1100.1.6"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
@@ -69,12 +70,11 @@
     "@types/ssri": "^7.1.5",
     "load-json-file": "^7.0.1",
     "tempy": "3.0.0",
-    "@pnpm/config.version-policy": "1100.0.3",
-    "@pnpm/network.fetch": "1100.0.4",
-    "@pnpm/resolving.npm-resolver": "1101.1.1",
     "@pnpm/logger": "1100.0.0",
+    "@pnpm/resolving.npm-resolver": "1101.2.0",
+    "@pnpm/network.fetch": "1100.0.5",
     "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/testing.mock-agent": "1100.0.4"
+    "@pnpm/testing.mock-agent": "1100.0.5"
   },
   "engines": {
     "node": ">=22.13"