@pnpm/resolving.npm-resolver 1101.2.0 → 1101.3.0

package/lib/index.d.ts

@@ -1,7 +1,7 @@
 import { PnpmError } from '@pnpm/error';
 import type { FetchFromRegistry, GetAuthHeader, RetryTimeoutOptions } from '@pnpm/fetching.types';
 import type { PackageMeta } from '@pnpm/resolving.registry.types';
-import type { DirectoryResolution, PkgResolutionId, PreferredVersions, ResolveResult, TarballResolution, WantedDependency, WorkspacePackages } from '@pnpm/resolving.resolver-base';
+import type { DirectoryResolution, LatestInfo, LatestQuery, PkgResolutionId, PreferredVersions, ResolveOptions, ResolveResult, TarballResolution, WantedDependency, WorkspacePackages } from '@pnpm/resolving.resolver-base';
 import type { DependencyManifest, PackageVersionPolicy, PinnedVersion, Registries, TrustPolicy } from '@pnpm/types';
 import { fetchMetadataFromFromRegistry, type FetchMetadataFromFromRegistryOptions, RegistryResponseError } from './fetch.js';
 import { BUILTIN_NAMED_REGISTRIES, parseBareSpecifier, type RegistryPackageSpec } from './parseBareSpecifier.js';
@@ -70,10 +70,14 @@ export interface WorkspaceResolveResult extends ResolveResult {
 export type NpmResolver = (wantedDependency: WantedDependency & {
     optional?: boolean;
 }, opts: ResolveFromNpmOptions) => Promise<NpmResolveResult | JsrResolveResult | NamedRegistryResolveResult | WorkspaceResolveResult | null>;
+export type ResolveLatestFromNpmStyle = (query: LatestQuery, opts: ResolveOptions) => Promise<LatestInfo | undefined>;
 export declare function createNpmResolver(fetchFromRegistry: FetchFromRegistry, getAuthHeader: GetAuthHeader, opts: ResolverFactoryOptions): {
     resolveFromNpm: NpmResolver;
     resolveFromJsr: NpmResolver;
     resolveFromNamedRegistry: NpmResolver;
+    resolveLatestFromNpm: ResolveLatestFromNpmStyle;
+    resolveLatestFromJsr: ResolveLatestFromNpmStyle;
+    resolveLatestFromNamedRegistry: ResolveLatestFromNpmStyle;
     clearCache: () => void;
 };
 export interface ResolveFromNpmContext {

package/lib/index.js

@@ -125,10 +125,17 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
         saveWorkspaceProtocol: opts.saveWorkspaceProtocol,
         peekManifestFromStore,
     };
+    const boundResolveFromNpm = resolveNpm.bind(null, ctx);
+    const boundResolveFromJsr = resolveJsr.bind(null, ctx);
+    const boundResolveFromNamedRegistry = resolveFromNamedRegistry.bind(null, ctx);
+    const defaultRegistry = opts.registries.default;
     return {
-        resolveFromNpm: resolveNpm.bind(null, ctx),
-        resolveFromJsr: resolveJsr.bind(null, ctx),
-        resolveFromNamedRegistry: resolveFromNamedRegistry.bind(null, ctx),
+        resolveFromNpm: boundResolveFromNpm,
+        resolveFromJsr: boundResolveFromJsr,
+        resolveFromNamedRegistry: boundResolveFromNamedRegistry,
+        resolveLatestFromNpm: createResolveLatest(boundResolveFromNpm, (query) => isNpmSpec(query, defaultRegistry)),
+        resolveLatestFromJsr: createResolveLatest(boundResolveFromJsr, isJsrSpec),
+        resolveLatestFromNamedRegistry: createResolveLatest(boundResolveFromNamedRegistry, (query) => isNamedRegistrySpec(query, ctx.namedRegistryNames)),
         clearCache: () => {
             if ('clear' in metaCache && typeof metaCache.clear === 'function') {
                 metaCache.clear();
@@ -137,6 +144,54 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
         },
     };
 }
+function isNpmSpec(query, defaultRegistry) {
+    const { alias, bareSpecifier } = query.wantedDependency;
+    if (!bareSpecifier)
+        return alias != null;
+    return parseBareSpecifier(bareSpecifier, alias, 'latest', defaultRegistry) != null;
+}
+function isJsrSpec(query) {
+    if (!query.wantedDependency.bareSpecifier?.startsWith('jsr:'))
+        return false;
+    return parseJsrSpecifierToRegistryPackageSpec(query.wantedDependency.bareSpecifier, query.wantedDependency.alias, 'latest') != null;
+}
+function isNamedRegistrySpec(query, knownRegistryNames) {
+    if (!query.wantedDependency.bareSpecifier)
+        return false;
+    try {
+        return parseNamedRegistrySpecifierToRegistryPackageSpec(query.wantedDependency.bareSpecifier, knownRegistryNames, query.wantedDependency.alias, 'latest') != null;
+    }
+    catch {
+        return false;
+    }
+}
+function createResolveLatest(resolve, matches) {
+    return async (query, opts) => {
+        if (!matches(query))
+            return undefined;
+        // Always pass the manifest's bareSpecifier so protocol-prefixed specs
+        // (`jsr:@scope/pkg@^1.0.0`, `gh:owner/repo@^1.0.0`) still match their
+        // resolver. In --compatible mode that range drives the pick; otherwise
+        // `update: 'latest'` tells the resolver to ignore the range and take
+        // the absolute newest.
+        const bareSpecifier = query.wantedDependency.bareSpecifier ?? 'latest';
+        const resolveOpts = query.compatible ? opts : { ...opts, update: 'latest' };
+        try {
+            const result = await resolve({ alias: query.wantedDependency.alias, bareSpecifier }, resolveOpts);
+            // Policy-blocked: handled but no latest to surface.
+            if (result?.policyViolation?.code === MINIMUM_RELEASE_AGE_VIOLATION_CODE) {
+                return {};
+            }
+            return { latestManifest: result?.manifest };
+        }
+        catch (err) {
+            if (opts.publishedBy && err.code === 'ERR_PNPM_NO_MATCHING_VERSION') {
+                return {};
+            }
+            throw err;
+        }
+    };
+}
 async function resolveNpm(ctx, wantedDependency, opts) {
     const defaultTag = opts.defaultTag ?? 'latest';
     const registry = wantedDependency.alias

package/lib/pickPackage.js

@@ -277,7 +277,12 @@ export async function pickPackage(ctx, spec, opts) {
                 opts.publishedByExclude?.(spec.name) !== true) {
                 const modifiedDate = meta.modified ? new Date(meta.modified) : null;
                 const isModifiedValid = modifiedDate != null && !Number.isNaN(modifiedDate.getTime());
-                if (!isModifiedValid || modifiedDate >= opts.publishedBy) {
+                // Strict `>` (not `>=`) so the boundary case `modified == publishedBy`
+                // takes the abbreviated fast path: `modified` is an upper bound on
+                // every version's publish time, so when it equals the cutoff every
+                // version passes the per-version `<=` filter in
+                // `filterPkgMetadataByPublishDate` and a full re-fetch isn't needed.
+                if (!isModifiedValid || modifiedDate > opts.publishedBy) {
                     // Save the abbreviated metadata to the abbreviated cache before re-fetching full.
                     if (!opts.dryRun) {
                         const abbreviatedJson = prepareJsonForDisk(fetchResult.meta, fetchResult.etag, fetchResult.jsonText);
@@ -361,9 +366,12 @@ async function maybeUpgradeAbbreviatedMetaForReleaseAge(ctx, spec, opts, meta) {
     }
     const modifiedDate = meta.modified ? new Date(meta.modified) : null;
     const isModifiedValid = modifiedDate != null && !Number.isNaN(modifiedDate.getTime());
-    if (isModifiedValid && modifiedDate < opts.publishedBy) {
-        // The package was last modified before the maturity cutoff. No individual
-        // version can be newer than the cutoff, so the abbreviated form is fine.
+    if (isModifiedValid && modifiedDate <= opts.publishedBy) {
+        // The package was last modified at or before the maturity cutoff. Since
+        // `modified` is an upper bound on every version's publish time, no version
+        // can be newer than the cutoff, so the abbreviated form is fine.
+        // Inclusive at the boundary on purpose: matches the per-version `<=` filter
+        // in `filterPkgMetadataByPublishDate`.
         return { meta };
     }
     // When `modified` is missing or malformed we fall through to the upgrade

package/lib/pickPackageFromMeta.js

@@ -14,13 +14,17 @@ export function pickPackageFromMeta(pickVersionByVersionRangeFn, { preferredVers
             }
             else {
                 const modifiedDate = parseModifiedDate(meta.modified);
-                if (modifiedDate == null || modifiedDate >= publishedBy) {
+                if (modifiedDate == null || modifiedDate > publishedBy) {
                     // Abbreviated metadata without per-version timestamps, and the package
                     // was recently modified (or has no/invalid modified field). We cannot determine
                     // which individual versions are mature enough — need full metadata.
                     assertMetaHasTime(meta);
                 }
-                // else: meta.modified < publishedBy — all versions are old enough, no filtering needed
+                // else: meta.modified <= publishedBy — every version was published at or
+                // before the cutoff (modified is an upper bound on per-version time), so
+                // they all pass the per-version `<=` maturity filter and no filtering is
+                // needed. Inclusive at the boundary on purpose so this branch matches the
+                // per-version filter in `filterPkgMetadataByPublishDate`.
             }
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.npm-resolver",
-  "version": "1101.2.0",
+  "version": "1101.3.0",
   "description": "Resolver for npm-hosted packages",
   "keywords": [
     "pnpm",
@@ -40,27 +40,27 @@
     "semver-utils": "^1.1.4",
     "ssri": "13.0.1",
     "version-selector-type": "^3.0.0",
-    "@pnpm/config.pick-registry-for-package": "1100.0.3",
-    "@pnpm/config.version-policy": "1100.1.0",
+    "@pnpm/config.pick-registry-for-package": "1100.0.4",
+    "@pnpm/core-loggers": "1100.1.1",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/core-loggers": "1100.1.0",
+    "@pnpm/config.version-policy": "1100.1.1",
     "@pnpm/crypto.hash": "1100.0.1",
     "@pnpm/error": "1100.0.0",
     "@pnpm/fetching.types": "1100.0.1",
     "@pnpm/fs.graceful-fs": "1100.1.0",
+    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.4",
+    "@pnpm/resolving.registry.types": "1100.0.4",
+    "@pnpm/resolving.resolver-base": "1100.3.0",
     "@pnpm/resolving.jsr-specifier-parser": "1100.0.0",
-    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.3",
-    "@pnpm/resolving.registry.types": "1100.0.3",
-    "@pnpm/resolving.resolver-base": "1100.2.0",
-    "@pnpm/store.cafs": "1100.1.5",
+    "@pnpm/store.cafs": "1100.1.6",
     "@pnpm/store.index": "1100.1.0",
-    "@pnpm/types": "1101.1.0",
+    "@pnpm/types": "1101.1.1",
     "@pnpm/workspace.range-resolver": "1100.0.1",
     "@pnpm/workspace.spec-parser": "1100.0.0"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0",
-    "@pnpm/worker": "^1100.1.6"
+    "@pnpm/worker": "^1100.1.7"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
@@ -71,10 +71,10 @@
     "load-json-file": "^7.0.1",
     "tempy": "3.0.0",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/resolving.npm-resolver": "1101.2.0",
-    "@pnpm/network.fetch": "1100.0.5",
+    "@pnpm/network.fetch": "1100.0.6",
     "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/testing.mock-agent": "1100.0.5"
+    "@pnpm/resolving.npm-resolver": "1101.3.0",
+    "@pnpm/testing.mock-agent": "1100.0.6"
   },
   "engines": {
     "node": ">=22.13"