@pnpm/resolving.npm-resolver 1101.1.1 → 1101.3.0

package/lib/fetchFullMetadataCached.d.ts

@@ -0,0 +1,33 @@
+import type { PackageMeta } from '@pnpm/resolving.registry.types';
+import { type FetchMetadataFromFromRegistryOptions } from './fetch.js';
+export interface FetchMetadataCachedOptions {
+    registry: string;
+    authHeaderValue?: string;
+    /**
+     * pnpm's on-disk cache directory. When set, the call issues a conditional
+     * GET against the matching mirror the resolver populates: a 304 Not
+     * Modified response serves the body from disk, a 200 writes the new body
+     * back. Omit to disable caching — every call re-fetches.
+     */
+    cacheDir?: string;
+}
+export type FetchFullMetadataCachedOptions = FetchMetadataCachedOptions;
+/**
+ * Fetch a full registry metadata document for `pkgName`, reusing pnpm's
+ * shared on-disk metadata mirror when `cacheDir` is supplied. Built for the
+ * `minimumReleaseAge` lockfile revalidation gate, which needs the `time`
+ * field that abbreviated metadata omits; the cache reuse keeps repeat
+ * installs from re-downloading the same multi-megabyte document for every
+ * locked package.
+ */
+export declare function fetchFullMetadataCached(fetchOpts: FetchMetadataFromFromRegistryOptions, pkgName: string, opts: FetchFullMetadataCachedOptions): Promise<PackageMeta>;
+/**
+ * Sibling of {@link fetchFullMetadataCached} that hits the abbreviated
+ * metadata endpoint (`Accept: application/vnd.npm.install-v1+json`) and
+ * caches under `ABBREVIATED_META_DIR` — the same mirror the resolver
+ * populates by default. Used by the lockfile verification gate as a
+ * cheap upper-bound check: if the package's `modified` field is older
+ * than the policy cutoff, every version in it predates the cutoff and
+ * no per-version timestamp lookup is needed.
+ */
+export declare function fetchAbbreviatedMetadataCached(fetchOpts: FetchMetadataFromFromRegistryOptions, pkgName: string, opts: FetchMetadataCachedOptions): Promise<PackageMeta>;

package/lib/fetchFullMetadataCached.js

@@ -0,0 +1,63 @@
+import { ABBREVIATED_META_DIR, FULL_META_DIR } from '@pnpm/constants';
+import { PnpmError } from '@pnpm/error';
+import { fetchMetadataFromFromRegistry } from './fetch.js';
+import { getPkgMirrorPath, loadMeta, loadMetaHeaders, prepareJsonForDisk, saveMeta } from './pickPackage.js';
+/**
+ * Fetch a full registry metadata document for `pkgName`, reusing pnpm's
+ * shared on-disk metadata mirror when `cacheDir` is supplied. Built for the
+ * `minimumReleaseAge` lockfile revalidation gate, which needs the `time`
+ * field that abbreviated metadata omits; the cache reuse keeps repeat
+ * installs from re-downloading the same multi-megabyte document for every
+ * locked package.
+ */
+export async function fetchFullMetadataCached(fetchOpts, pkgName, opts) {
+    return fetchMetadataCached(fetchOpts, pkgName, { ...opts, fullMetadata: true, metaDir: FULL_META_DIR });
+}
+/**
+ * Sibling of {@link fetchFullMetadataCached} that hits the abbreviated
+ * metadata endpoint (`Accept: application/vnd.npm.install-v1+json`) and
+ * caches under `ABBREVIATED_META_DIR` — the same mirror the resolver
+ * populates by default. Used by the lockfile verification gate as a
+ * cheap upper-bound check: if the package's `modified` field is older
+ * than the policy cutoff, every version in it predates the cutoff and
+ * no per-version timestamp lookup is needed.
+ */
+export async function fetchAbbreviatedMetadataCached(fetchOpts, pkgName, opts) {
+    return fetchMetadataCached(fetchOpts, pkgName, { ...opts, fullMetadata: false, metaDir: ABBREVIATED_META_DIR });
+}
+async function fetchMetadataCached(fetchOpts, pkgName, opts) {
+    const pkgMirror = opts.cacheDir != null
+        ? getPkgMirrorPath(opts.cacheDir, opts.metaDir, opts.registry, pkgName)
+        : null;
+    const cacheHeaders = pkgMirror != null ? await loadMetaHeaders(pkgMirror) : null;
+    const result = await fetchMetadataFromFromRegistry(fetchOpts, pkgName, {
+        registry: opts.registry,
+        authHeaderValue: opts.authHeaderValue,
+        fullMetadata: opts.fullMetadata,
+        etag: cacheHeaders?.etag,
+        modified: cacheHeaders?.modified,
+    });
+    if ('notModified' in result && result.notModified) {
+        if (pkgMirror == null) {
+            // We didn't send conditional headers (no cacheDir), but the registry
+            // returned 304 anyway. There's no body to fall back on.
+            throw new PnpmError('META_NOT_MODIFIED_WITHOUT_CACHE', `Registry returned 304 for ${pkgName} without an existing cache to refresh.`);
+        }
+        const meta = await loadMeta(pkgMirror);
+        if (meta == null) {
+            // Cache file vanished between header-load and meta-load (concurrent
+            // store cleanup, antivirus, etc.).
+            throw new PnpmError('META_CACHE_MISSING_AFTER_304', `Metadata cache for ${pkgName} disappeared between headers read and full read.`);
+        }
+        return meta;
+    }
+    if (pkgMirror != null) {
+        // Persist so the next install can do a headers-only conditional GET.
+        // Fire-and-forget — a cache-write failure isn't a reason to fail the
+        // caller; the next install just won't get the speedup.
+        const json = prepareJsonForDisk(result.meta, result.etag, result.jsonText);
+        saveMeta(pkgMirror, json).catch(() => { });
+    }
+    return result.meta;
+}
+//# sourceMappingURL=fetchFullMetadataCached.js.map

package/lib/index.d.ts

@@ -1,7 +1,7 @@
 import { PnpmError } from '@pnpm/error';
 import type { FetchFromRegistry, GetAuthHeader, RetryTimeoutOptions } from '@pnpm/fetching.types';
 import type { PackageMeta } from '@pnpm/resolving.registry.types';
-import type { DirectoryResolution, PkgResolutionId, PreferredVersions, ResolveResult, TarballResolution, WantedDependency, WorkspacePackages } from '@pnpm/resolving.resolver-base';
+import type { DirectoryResolution, LatestInfo, LatestQuery, PkgResolutionId, PreferredVersions, ResolveOptions, ResolveResult, TarballResolution, WantedDependency, WorkspacePackages } from '@pnpm/resolving.resolver-base';
 import type { DependencyManifest, PackageVersionPolicy, PinnedVersion, Registries, TrustPolicy } from '@pnpm/types';
 import { fetchMetadataFromFromRegistry, type FetchMetadataFromFromRegistryOptions, RegistryResponseError } from './fetch.js';
 import { BUILTIN_NAMED_REGISTRIES, parseBareSpecifier, type RegistryPackageSpec } from './parseBareSpecifier.js';
@@ -12,16 +12,15 @@ export interface NoMatchingVersionErrorOptions {
     wantedDependency: WantedDependency;
     packageMeta: PackageMeta;
     registry: string;
-    immatureVersion?: string;
-    publishedBy?: Date;
 }
 export declare class NoMatchingVersionError extends PnpmError {
     readonly packageMeta: PackageMeta;
-    readonly immatureVersion?: string;
     constructor(opts: NoMatchingVersionErrorOptions);
 }
 export declare function formatTimeAgo(date: Date): string | null;
 export { BUILTIN_NAMED_REGISTRIES, fetchMetadataFromFromRegistry, type FetchMetadataFromFromRegistryOptions, type PackageMeta, type PackageMetaCache, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, type RegistryPackageSpec, RegistryResponseError, workspacePrefToNpm, };
+export { createNpmResolutionVerifier, type CreateNpmResolutionVerifierOptions } from './createNpmResolutionVerifier.js';
+export { MINIMUM_RELEASE_AGE_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
 export { whichVersionIsPinned } from './whichVersionIsPinned.js';
 export interface ResolverFactoryOptions {
     cacheDir: string;
@@ -36,7 +35,6 @@ export interface ResolverFactoryOptions {
     namedRegistries?: Record<string, string>;
     saveWorkspaceProtocol?: boolean | 'rolling';
     preserveAbsolutePaths?: boolean;
-    strictPublishedByCheck?: boolean;
     ignoreMissingTimeField?: boolean;
     fetchWarnTimeoutMs?: number;
     /** Pre-populated metadata cache. When provided, the resolver uses this
@@ -72,10 +70,14 @@ export interface WorkspaceResolveResult extends ResolveResult {
 export type NpmResolver = (wantedDependency: WantedDependency & {
     optional?: boolean;
 }, opts: ResolveFromNpmOptions) => Promise<NpmResolveResult | JsrResolveResult | NamedRegistryResolveResult | WorkspaceResolveResult | null>;
+export type ResolveLatestFromNpmStyle = (query: LatestQuery, opts: ResolveOptions) => Promise<LatestInfo | undefined>;
 export declare function createNpmResolver(fetchFromRegistry: FetchFromRegistry, getAuthHeader: GetAuthHeader, opts: ResolverFactoryOptions): {
     resolveFromNpm: NpmResolver;
     resolveFromJsr: NpmResolver;
     resolveFromNamedRegistry: NpmResolver;
+    resolveLatestFromNpm: ResolveLatestFromNpmStyle;
+    resolveLatestFromJsr: ResolveLatestFromNpmStyle;
+    resolveLatestFromNamedRegistry: ResolveLatestFromNpmStyle;
     clearCache: () => void;
 };
 export interface ResolveFromNpmContext {

package/lib/index.js

@@ -17,28 +17,17 @@ import { BUILTIN_NAMED_REGISTRIES, parseBareSpecifier, parseJsrSpecifierToRegist
 import { pickPackage, } from './pickPackage.js';
 import { pickPackageFromMeta, pickVersionByVersionRange } from './pickPackageFromMeta.js';
 import { failIfTrustDowngraded } from './trustChecks.js';
+import { MINIMUM_RELEASE_AGE_VIOLATION_CODE } from './violationCodes.js';
 import { whichVersionIsPinned } from './whichVersionIsPinned.js';
 import { workspacePrefToNpm } from './workspacePrefToNpm.js';
 export class NoMatchingVersionError extends PnpmError {
     packageMeta;
-    immatureVersion;
     constructor(opts) {
         const dep = opts.wantedDependency.alias
             ? `${opts.wantedDependency.alias}@${opts.wantedDependency.bareSpecifier ?? ''}`
             : opts.wantedDependency.bareSpecifier;
-        let errorMessage;
-        if (opts.publishedBy && opts.immatureVersion && opts.packageMeta.time) {
-            const time = new Date(opts.packageMeta.time[opts.immatureVersion]);
-            const releaseAgeText = formatTimeAgo(time) ?? 'just now';
-            const pkgName = opts.wantedDependency.alias ?? opts.packageMeta.name;
-            errorMessage = `Version ${opts.immatureVersion} (released ${releaseAgeText}) of ${pkgName} does not meet the minimumReleaseAge constraint`;
-        }
-        else {
-            errorMessage = `No matching version found for ${dep} while fetching it from ${opts.registry}`;
-        }
-        super(opts.publishedBy ? 'NO_MATURE_MATCHING_VERSION' : 'NO_MATCHING_VERSION', errorMessage);
+        super('NO_MATCHING_VERSION', `No matching version found for ${dep} while fetching it from ${opts.registry}`);
         this.packageMeta = opts.packageMeta;
-        this.immatureVersion = opts.immatureVersion;
     }
 }
 export function formatTimeAgo(date) {
@@ -71,6 +60,8 @@ export function formatTimeAgo(date) {
     return 'a few seconds ago';
 }
 export { BUILTIN_NAMED_REGISTRIES, fetchMetadataFromFromRegistry, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, RegistryResponseError, workspacePrefToNpm, };
+export { createNpmResolutionVerifier } from './createNpmResolutionVerifier.js';
+export { MINIMUM_RELEASE_AGE_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
 export { whichVersionIsPinned } from './whichVersionIsPinned.js';
 export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
     if (typeof opts.cacheDir !== 'string') {
@@ -126,7 +117,6 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
             offline: opts.offline,
             preferOffline: opts.preferOffline,
             cacheDir: opts.cacheDir,
-            strictPublishedByCheck: opts.strictPublishedByCheck,
             ignoreMissingTimeField: opts.ignoreMissingTimeField,
         }),
         registries: opts.registries,
@@ -135,10 +125,17 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
         saveWorkspaceProtocol: opts.saveWorkspaceProtocol,
         peekManifestFromStore,
     };
+    const boundResolveFromNpm = resolveNpm.bind(null, ctx);
+    const boundResolveFromJsr = resolveJsr.bind(null, ctx);
+    const boundResolveFromNamedRegistry = resolveFromNamedRegistry.bind(null, ctx);
+    const defaultRegistry = opts.registries.default;
     return {
-        resolveFromNpm: resolveNpm.bind(null, ctx),
-        resolveFromJsr: resolveJsr.bind(null, ctx),
-        resolveFromNamedRegistry: resolveFromNamedRegistry.bind(null, ctx),
+        resolveFromNpm: boundResolveFromNpm,
+        resolveFromJsr: boundResolveFromJsr,
+        resolveFromNamedRegistry: boundResolveFromNamedRegistry,
+        resolveLatestFromNpm: createResolveLatest(boundResolveFromNpm, (query) => isNpmSpec(query, defaultRegistry)),
+        resolveLatestFromJsr: createResolveLatest(boundResolveFromJsr, isJsrSpec),
+        resolveLatestFromNamedRegistry: createResolveLatest(boundResolveFromNamedRegistry, (query) => isNamedRegistrySpec(query, ctx.namedRegistryNames)),
         clearCache: () => {
             if ('clear' in metaCache && typeof metaCache.clear === 'function') {
                 metaCache.clear();
@@ -147,6 +144,54 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
         },
     };
 }
+function isNpmSpec(query, defaultRegistry) {
+    const { alias, bareSpecifier } = query.wantedDependency;
+    if (!bareSpecifier)
+        return alias != null;
+    return parseBareSpecifier(bareSpecifier, alias, 'latest', defaultRegistry) != null;
+}
+function isJsrSpec(query) {
+    if (!query.wantedDependency.bareSpecifier?.startsWith('jsr:'))
+        return false;
+    return parseJsrSpecifierToRegistryPackageSpec(query.wantedDependency.bareSpecifier, query.wantedDependency.alias, 'latest') != null;
+}
+function isNamedRegistrySpec(query, knownRegistryNames) {
+    if (!query.wantedDependency.bareSpecifier)
+        return false;
+    try {
+        return parseNamedRegistrySpecifierToRegistryPackageSpec(query.wantedDependency.bareSpecifier, knownRegistryNames, query.wantedDependency.alias, 'latest') != null;
+    }
+    catch {
+        return false;
+    }
+}
+function createResolveLatest(resolve, matches) {
+    return async (query, opts) => {
+        if (!matches(query))
+            return undefined;
+        // Always pass the manifest's bareSpecifier so protocol-prefixed specs
+        // (`jsr:@scope/pkg@^1.0.0`, `gh:owner/repo@^1.0.0`) still match their
+        // resolver. In --compatible mode that range drives the pick; otherwise
+        // `update: 'latest'` tells the resolver to ignore the range and take
+        // the absolute newest.
+        const bareSpecifier = query.wantedDependency.bareSpecifier ?? 'latest';
+        const resolveOpts = query.compatible ? opts : { ...opts, update: 'latest' };
+        try {
+            const result = await resolve({ alias: query.wantedDependency.alias, bareSpecifier }, resolveOpts);
+            // Policy-blocked: handled but no latest to surface.
+            if (result?.policyViolation?.code === MINIMUM_RELEASE_AGE_VIOLATION_CODE) {
+                return {};
+            }
+            return { latestManifest: result?.manifest };
+        }
+        catch (err) {
+            if (opts.publishedBy && err.code === 'ERR_PNPM_NO_MATCHING_VERSION') {
+                return {};
+            }
+            throw err;
+        }
+    };
+}
 async function resolveNpm(ctx, wantedDependency, opts) {
     const defaultTag = opts.defaultTag ?? 'latest';
     const registry = wantedDependency.alias
@@ -207,6 +252,19 @@ async function resolveNpm(ctx, wantedDependency, opts) {
                         resolution: currentResolution,
                         resolvedVia: 'npm-registry',
                         publishedAt: opts.currentPkg.publishedAt,
+                        // Loose-mode bypass: a lockfile entry whose publishedAt sits
+                        // after the maturity cutoff would have been rejected at
+                        // resolver time, but the peek path skips the maturity check.
+                        // Report inline so the deps-resolver aggregator surfaces it
+                        // to the install command.
+                        policyViolation: detectMinReleaseAgeViolation({
+                            name: manifest.name,
+                            version: manifest.version,
+                            publishedAt: opts.currentPkg.publishedAt,
+                            resolution: currentResolution,
+                            publishedBy: opts.publishedBy,
+                            publishedByExclude: opts.publishedByExclude,
+                        }),
                     };
                 }
             }
@@ -267,22 +325,6 @@ async function resolveNpm(ctx, wantedDependency, opts) {
                 // ignore
             }
         }
-        if (opts.publishedBy) {
-            const immatureVersion = pickVersionByVersionRange({
-                meta,
-                versionRange: spec.fetchSpec,
-                preferredVersionSelectors: opts.preferredVersions?.[spec.name],
-            });
-            if (immatureVersion) {
-                throw new NoMatchingVersionError({
-                    wantedDependency,
-                    packageMeta: meta,
-                    registry,
-                    immatureVersion,
-                    publishedBy: opts.publishedBy,
-                });
-            }
-        }
         throw new NoMatchingVersionError({ wantedDependency, packageMeta: meta, registry });
     }
     else if (opts.trustPolicy === 'no-downgrade') {
@@ -335,14 +377,23 @@ async function resolveNpm(ctx, wantedDependency, opts) {
             defaultPinnedVersion: opts.pinnedVersion,
         });
     }
+    const publishedAt = meta.time?.[pickedPackage.version];
     return {
         id,
         latest: meta['dist-tags'].latest,
         manifest: pickedPackage,
         resolution,
         resolvedVia: 'npm-registry',
-        publishedAt: meta.time?.[pickedPackage.version],
+        publishedAt,
         normalizedBareSpecifier,
+        policyViolation: detectMinReleaseAgeViolation({
+            name: pickedPackage.name,
+            version: pickedPackage.version,
+            publishedAt,
+            resolution,
+            publishedBy: opts.publishedBy,
+            publishedByExclude: opts.publishedByExclude,
+        }),
     };
 }
 async function resolveJsr(ctx, wantedDependency, opts) {
@@ -439,15 +490,25 @@ async function pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, registr
     if (pickedPackage == null) {
         throw new NoMatchingVersionError({ wantedDependency, packageMeta: meta, registry });
     }
+    const resolution = {
+        integrity: getIntegrity(pickedPackage.dist),
+        tarball: normalizeRegistryUrl(pickedPackage.dist.tarball),
+    };
+    const publishedAt = meta.time?.[pickedPackage.version];
     return {
         id: `${pickedPackage.name}@${pickedPackage.version}`,
         latest: meta['dist-tags'].latest,
         manifest: pickedPackage,
-        resolution: {
-            integrity: getIntegrity(pickedPackage.dist),
-            tarball: normalizeRegistryUrl(pickedPackage.dist.tarball),
-        },
-        publishedAt: meta.time?.[pickedPackage.version],
+        resolution,
+        publishedAt,
+        policyViolation: detectMinReleaseAgeViolation({
+            name: pickedPackage.name,
+            version: pickedPackage.version,
+            publishedAt,
+            resolution,
+            publishedBy: opts.publishedBy,
+            publishedByExclude: opts.publishedByExclude,
+        }),
     };
 }
 // Builds a `<prefix><pkgName>@<range>` specifier (or a bare `<prefix><range>`
@@ -609,6 +670,40 @@ function defaultTagForAlias(alias, defaultTag) {
         type: 'tag',
     };
 }
+/**
+ * Inline minimumReleaseAge detection: returns a violation entry when the
+ * picked version's publish timestamp is past the policy cutoff (and
+ * isn't covered by `publishedByExclude`). The resolver already has the
+ * timestamp in hand, so reporting inline saves the install layer from
+ * re-walking the resolved tree and re-fetching the same metadata. The
+ * deps-resolver aggregates the per-resolve `policyViolation` fields into
+ * a single set the install command reacts to.
+ *
+ * Returns `undefined` for resolutions outside the policy — no policy
+ * active, version excluded by pattern, timestamp missing or malformed,
+ * or version mature. Specific-version exclusions (`pkg@1.0.0`) and
+ * full-name exclusions (`pkg`) are both honored so an entry already on
+ * the user's exclude list isn't re-announced every install.
+ */
+function detectMinReleaseAgeViolation(args) {
+    if (!args.publishedBy || !args.publishedAt)
+        return undefined;
+    const excludeResult = args.publishedByExclude?.(args.name);
+    if (excludeResult === true)
+        return undefined;
+    if (Array.isArray(excludeResult) && excludeResult.includes(args.version))
+        return undefined;
+    const ts = new Date(args.publishedAt).getTime();
+    if (Number.isNaN(ts) || ts <= args.publishedBy.getTime())
+        return undefined;
+    return {
+        name: args.name,
+        version: args.version,
+        resolution: args.resolution,
+        code: MINIMUM_RELEASE_AGE_VIOLATION_CODE,
+        reason: `was published at ${new Date(ts).toISOString()}, within the minimumReleaseAge cutoff (${args.publishedBy.toISOString()})`,
+    };
+}
 function getIntegrity(dist) {
     if (dist.integrity) {
         return dist.integrity;

package/lib/pickPackage.d.ts

@@ -29,9 +29,40 @@ export declare function pickPackage(ctx: {
     offline?: boolean;
     preferOffline?: boolean;
     filterMetadata?: boolean;
-    strictPublishedByCheck?: boolean;
     ignoreMissingTimeField?: boolean;
 }, spec: RegistryPackageSpec, opts: PickPackageOptions): Promise<{
     meta: PackageMeta;
     pickedPackage: PackageInRegistry | null;
 }>;
+export declare function encodePkgName(pkgName: string): string;
+/**
+ * Path of the on-disk JSONL document where pnpm mirrors a package's registry
+ * metadata. `metaDir` selects between abbreviated and full caches.
+ */
+export declare function getPkgMirrorPath(cacheDir: string, metaDir: string, registry: string, pkgName: string): string;
+/**
+ * Formats metadata for disk storage as two-line NDJSON:
+ *   Line 1: cache headers (etag, modified) — small, fast to read
+ *   Line 2: the full registry metadata JSON — unchanged from the registry response
+ */
+export declare function prepareJsonForDisk(meta: PackageMeta, etag: string | undefined, jsonText?: string): string;
+export declare function warnMissingTimeFieldOnce(pkgName: string): void;
+interface MetaHeaders {
+    etag?: string;
+    modified?: string;
+}
+/**
+ * Reads only the first line of the cached NDJSON metadata file to extract
+ * the cache headers (etag, modified). This avoids reading and
+ * parsing the full metadata (which can be megabytes for popular packages)
+ * when we only need conditional-request headers.
+ */
+export declare function loadMetaHeaders(pkgMirror: string): Promise<MetaHeaders | null>;
+/**
+ * Reads the full metadata from the cached NDJSON file.
+ * Line 1: cache headers (etag, modified)
+ * Line 2: registry metadata JSON
+ */
+export declare function loadMeta(pkgMirror: string): Promise<PackageMeta | null>;
+export declare function saveMeta(pkgMirror: string, json: string): Promise<void>;
+export {};

package/lib/pickPackage.js

@@ -58,12 +58,13 @@ function pickMax(a, b) {
 const pickHighest = pickPackageFromMeta.bind(null, pickVersionByVersionRange);
 const pickLowest = pickPackageFromMeta.bind(null, pickLowestVersionByVersionRange);
 // When minimumReleaseAge is active: try the highest mature version; if none
-// and strictPublishedByCheck is off, fall back to the lowest version in range
-// without applying the maturity filter.
+// satisfies the range, fall back to the lowest version regardless of maturity
+// so the resolver can report the violation inline and let the install layer
+// (or other caller) decide what to do — never throw at this layer.
 function pickRespectingMinReleaseAge(pickerOpts, spec, meta) {
     return runPicker(pickerOpts, spec, (targetSpec) => {
         const highest = pickHighest(pickerOpts, meta, targetSpec);
-        if (highest || pickerOpts.strictPublishedByCheck)
+        if (highest)
             return highest;
         return pickLowest({
             preferredVersionSelectors: pickerOpts.preferredVersionSelectors,
@@ -111,7 +112,6 @@ export async function pickPackage(ctx, spec, opts) {
         publishedByExclude: opts.publishedByExclude,
         pickLowestVersion: opts.pickLowestVersion,
         includeLatestTag: opts.includeLatestTag,
-        strictPublishedByCheck: ctx.strictPublishedByCheck,
         ignoreMissingTimeField: ctx.ignoreMissingTimeField,
     };
     validatePackageName(spec.name);
@@ -123,8 +123,7 @@ export async function pickPackage(ctx, spec, opts) {
         : ABBREVIATED_META_DIR;
     // Cache key includes fullMetadata to avoid returning abbreviated metadata when full metadata is requested.
     const cacheKey = fullMetadata ? `${spec.name}:full` : spec.name;
-    const registryName = getRegistryName(opts.registry);
-    const pkgMirror = path.join(ctx.cacheDir, metaDir, registryName, `${encodePkgName(spec.name)}.jsonl`);
+    const pkgMirror = getPkgMirrorPath(ctx.cacheDir, metaDir, opts.registry, spec.name);
     const cachedMeta = ctx.metaCache.get(cacheKey);
     if (cachedMeta != null) {
         // The in-memory cache may hold abbreviated metadata from an earlier call
@@ -194,10 +193,11 @@ export async function pickPackage(ctx, spec, opts) {
                         };
                     }
                 }
-                catch (err) {
-                    if (shouldRethrowFromFastPathCache(err, ctx.strictPublishedByCheck)) {
-                        throw err;
-                    }
+                catch {
+                    // Swallow fast-path errors (e.g. ERR_PNPM_MISSING_TIME from
+                    // abbreviated meta) and fall through to the network fetch, which
+                    // can upgrade to full metadata and run the maturity check on
+                    // real `time` data.
                 }
             }
         }
@@ -215,10 +215,8 @@ export async function pickPackage(ctx, spec, opts) {
                             };
                         }
                     }
-                    catch (err) {
-                        if (shouldRethrowFromFastPathCache(err, ctx.strictPublishedByCheck)) {
-                            throw err;
-                        }
+                    catch {
+                        // Same as above — fall through to the network fetch.
                     }
                 }
             }
@@ -279,7 +277,12 @@ export async function pickPackage(ctx, spec, opts) {
                 opts.publishedByExclude?.(spec.name) !== true) {
                 const modifiedDate = meta.modified ? new Date(meta.modified) : null;
                 const isModifiedValid = modifiedDate != null && !Number.isNaN(modifiedDate.getTime());
-                if (!isModifiedValid || modifiedDate >= opts.publishedBy) {
+                // Strict `>` (not `>=`) so the boundary case `modified == publishedBy`
+                // takes the abbreviated fast path: `modified` is an upper bound on
+                // every version's publish time, so when it equals the cutoff every
+                // version passes the per-version `<=` filter in
+                // `filterPkgMetadataByPublishDate` and a full re-fetch isn't needed.
+                if (!isModifiedValid || modifiedDate > opts.publishedBy) {
                     // Save the abbreviated metadata to the abbreviated cache before re-fetching full.
                     if (!opts.dryRun) {
                         const abbreviatedJson = prepareJsonForDisk(fetchResult.meta, fetchResult.etag, fetchResult.jsonText);
@@ -363,9 +366,12 @@ async function maybeUpgradeAbbreviatedMetaForReleaseAge(ctx, spec, opts, meta) {
     }
     const modifiedDate = meta.modified ? new Date(meta.modified) : null;
     const isModifiedValid = modifiedDate != null && !Number.isNaN(modifiedDate.getTime());
-    if (isModifiedValid && modifiedDate < opts.publishedBy) {
-        // The package was last modified before the maturity cutoff. No individual
-        // version can be newer than the cutoff, so the abbreviated form is fine.
+    if (isModifiedValid && modifiedDate <= opts.publishedBy) {
+        // The package was last modified at or before the maturity cutoff. Since
+        // `modified` is an upper bound on every version's publish time, no version
+        // can be newer than the cutoff, so the abbreviated form is fine.
+        // Inclusive at the boundary on purpose: matches the per-version `<=` filter
+        // in `filterPkgMetadataByPublishDate`.
         return { meta };
     }
     // When `modified` is missing or malformed we fall through to the upgrade
@@ -388,13 +394,6 @@ async function maybeUpgradeAbbreviatedMetaForReleaseAge(ctx, spec, opts, meta) {
     }
     return { meta: fullFetchResult.meta, upgradedFrom: fullFetchResult };
 }
-// Returns true when a fast-path cache catch should rethrow under
-// strictPublishedByCheck. ERR_PNPM_MISSING_TIME is excluded so callers fall
-// through to the network fetch path, which can upgrade abbreviated cached
-// metadata to full and run the maturity check on real `time` data.
-function shouldRethrowFromFastPathCache(err, strictPublishedByCheck) {
-    return strictPublishedByCheck === true && !isMissingTimeError(err);
-}
 // Persists upgraded full metadata to the on-disk cache mirror and returns
 // the meta to store in the in-memory cache. When `filterMetadata` is on, the
 // in-memory and on-disk forms are both stripped via `clearMeta`; otherwise
@@ -449,18 +448,25 @@ function clearMeta(pkg) {
         modified: pkg.modified,
     };
 }
-function encodePkgName(pkgName) {
+export function encodePkgName(pkgName) {
     if (pkgName !== pkgName.toLowerCase()) {
         return `${pkgName}_${createHexHash(pkgName)}`;
     }
     return pkgName;
 }
+/**
+ * Path of the on-disk JSONL document where pnpm mirrors a package's registry
+ * metadata. `metaDir` selects between abbreviated and full caches.
+ */
+export function getPkgMirrorPath(cacheDir, metaDir, registry, pkgName) {
+    return path.join(cacheDir, metaDir, getRegistryName(registry), `${encodePkgName(pkgName)}.jsonl`);
+}
 /**
  * Formats metadata for disk storage as two-line NDJSON:
  *   Line 1: cache headers (etag, modified) — small, fast to read
  *   Line 2: the full registry metadata JSON — unchanged from the registry response
  */
-function prepareJsonForDisk(meta, etag, jsonText) {
+export function prepareJsonForDisk(meta, etag, jsonText) {
     const modified = meta.modified ?? meta.time?.modified;
     const headers = JSON.stringify({ etag, modified });
     const body = jsonText ?? JSON.stringify(meta);
@@ -476,7 +482,7 @@ function isMissingTimeError(err) {
 // memory via this Set as they resolve ever more distinct packages.
 const MAX_WARNED_MISSING_TIME = 1024;
 const warnedMissingTimeFor = new Set();
-function warnMissingTimeFieldOnce(pkgName) {
+export function warnMissingTimeFieldOnce(pkgName) {
     if (warnedMissingTimeFor.has(pkgName))
         return;
     if (warnedMissingTimeFor.size >= MAX_WARNED_MISSING_TIME) {
@@ -503,7 +509,7 @@ async function getFileMtime(filePath) {
  * parsing the full metadata (which can be megabytes for popular packages)
  * when we only need conditional-request headers.
  */
-async function loadMetaHeaders(pkgMirror) {
+export async function loadMetaHeaders(pkgMirror) {
     let fh;
     try {
         fh = await fs.open(pkgMirror, 'r');
@@ -530,7 +536,7 @@ async function loadMetaHeaders(pkgMirror) {
  * Line 1: cache headers (etag, modified)
  * Line 2: registry metadata JSON
  */
-async function loadMeta(pkgMirror) {
+export async function loadMeta(pkgMirror) {
     try {
         const data = await gfs.readFile(pkgMirror, 'utf8');
         const newlineIdx = data.indexOf('\n');
@@ -546,7 +552,7 @@ async function loadMeta(pkgMirror) {
     }
 }
 const createdDirs = new Set();
-async function saveMeta(pkgMirror, json) {
+export async function saveMeta(pkgMirror, json) {
     const dir = path.dirname(pkgMirror);
     if (!createdDirs.has(dir)) {
         await fs.mkdir(dir, { recursive: true });

package/lib/pickPackageFromMeta.js

@@ -14,13 +14,17 @@ export function pickPackageFromMeta(pickVersionByVersionRangeFn, { preferredVers
             }
             else {
                 const modifiedDate = parseModifiedDate(meta.modified);
-                if (modifiedDate == null || modifiedDate >= publishedBy) {
+                if (modifiedDate == null || modifiedDate > publishedBy) {
                     // Abbreviated metadata without per-version timestamps, and the package
                     // was recently modified (or has no/invalid modified field). We cannot determine
                     // which individual versions are mature enough — need full metadata.
                     assertMetaHasTime(meta);
                 }
-                // else: meta.modified < publishedBy — all versions are old enough, no filtering needed
+                // else: meta.modified <= publishedBy — every version was published at or
+                // before the cutoff (modified is an upper bound on per-version time), so
+                // they all pass the per-version `<=` maturity filter and no filtering is
+                // needed. Inclusive at the boundary on purpose so this branch matches the
+                // per-version filter in `filterPkgMetadataByPublishDate`.
             }
         }
     }

package/lib/violationCodes.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Violation codes the npm resolver attaches to
+ * `ResolutionPolicyViolation.code` when an inline policy check rejects
+ * a pick. Exported so downstream code (the install command, the strict
+ * resolver wrapper, tests) references one source of truth instead of
+ * re-typing the string.
+ *
+ * Lives in its own module — both `index.ts` and `createNpmResolutionVerifier.ts`
+ * import it, so keeping the constants here avoids a cycle.
+ */
+export declare const MINIMUM_RELEASE_AGE_VIOLATION_CODE = "MINIMUM_RELEASE_AGE_VIOLATION";
+export declare const TRUST_DOWNGRADE_VIOLATION_CODE = "TRUST_DOWNGRADE";