@pnpm/resolving.npm-resolver 1101.3.1 → 1101.3.2

package/lib/createNpmResolutionVerifier.d.ts

@@ -2,6 +2,7 @@ import type { ResolutionVerifier } from '@pnpm/resolving.resolver-base';
 import type { Registries, TrustPolicy } from '@pnpm/types';
 import type { FetchMetadataFromFromRegistryOptions } from './fetch.js';
 import { type FetchFullMetadataCachedOptions } from './fetchFullMetadataCached.js';
+import type { PackageMetaCache } from './pickPackage.js';
 export interface CreateNpmResolutionVerifierOptions {
     /**
      * Minimum age (in minutes) a published version must reach before it is
@@ -56,6 +57,16 @@ export interface CreateNpmResolutionVerifierOptions {
     fetchOpts: FetchMetadataFromFromRegistryOptions;
     getAuthHeaderValueByURI: (registry: string) => string | undefined;
     cacheDir?: FetchFullMetadataCachedOptions['cacheDir'];
+    /**
+     * Per-install LRU shared with the npm resolver's `pickPackage`
+     * (`{ get, set }` over `PackageMeta`). When provided, the verifier
+     * consults it before fetching: a name the resolver already pulled
+     * during the same install yields the cached packument instead of a
+     * fresh disk/network round-trip. Optional — frozen-install paths and
+     * unit tests don't have a resolver running alongside, in which case
+     * the verifier falls back to its own fetch chain.
+     */
+    metaCache?: PackageMetaCache;
     /** Overrides Date.now() for tests. */
     now?: number;
 }

package/lib/createNpmResolutionVerifier.js

@@ -74,6 +74,7 @@ export function createNpmResolutionVerifier(opts) {
         getAuthHeaderValueByURI: opts.getAuthHeaderValueByURI,
         cacheDir: opts.cacheDir,
         cutoffMs: cutoff,
+        sharedMetaCache: opts.metaCache,
         abbreviatedMetaCache: new Map(),
         publishedAtCache: new Map(),
         localMetaCache: new Map(),
@@ -268,21 +269,89 @@ function fetchFullMetaForTrust(context, registry, name) {
     const cacheKey = `${registry}\x00${name}`;
     let cachedPromise = context.fullMetaForTrustCache.get(cacheKey);
     if (cachedPromise == null) {
-        // Don't swallow the fetch rejection here — `runTrustCheck` catches it
-        // and surfaces the underlying message in the violation reason, which
-        // is more actionable than the generic "metadata is unavailable" the
-        // `!meta` fallback emits. The cache still holds the rejected promise
-        // so repeat verifier calls for the same (registry, name) within one
-        // install don't refetch a known-failing endpoint.
-        cachedPromise = fetchFullMetadataCached(context.fetchOpts, name, {
-            registry,
-            authHeaderValue: context.getAuthHeaderValueByURI(registry),
-            cacheDir: context.cacheDir,
-        });
+        // Fast path: if the resolver already upgraded to full meta for this
+        // name during the same install (e.g. minimumReleaseAge active),
+        // reuse that document. Abbreviated meta is rejected here — it lacks
+        // per-version `time` and per-version trust evidence, both required
+        // by failIfTrustDowngraded.
+        //
+        // Limitation: the resolver's `metaCache` keys by `${name}:full` —
+        // it doesn't include the registry (pickPackage.ts cacheKey shape).
+        // If two registries serve packages of the same name in one install
+        // the resolver itself silently keeps the first fetch; the verifier
+        // here inherits that scope. The name check below is a defensive
+        // guard against accidental cache mixups; tightening this to a
+        // registry-qualified read needs the resolver's `metaCache` key
+        // shape to change first.
+        const shared = readSharedMetaForTrust(context.sharedMetaCache, name);
+        if (shared != null) {
+            cachedPromise = Promise.resolve(projectTrustMeta(shared));
+        }
+        else {
+            // Don't swallow the fetch rejection here — `runTrustCheck` catches it
+            // and surfaces the underlying message in the violation reason, which
+            // is more actionable than the generic "metadata is unavailable" the
+            // `!meta` fallback emits. The cache still holds the rejected promise
+            // so repeat verifier calls for the same (registry, name) within one
+            // install don't refetch a known-failing endpoint.
+            //
+            // The fetched packument is projected down to just the trust-relevant
+            // fields (per-version `_npmUser.trustedPublisher` and
+            // `dist.attestations.provenance`, plus the package-level `time` map)
+            // before being stored. The full document — dependency maps, scripts,
+            // READMEs for every version — would otherwise stay resident in this
+            // map for the entire install, which on multi-thousand-entry
+            // workspaces OOMs CI runners with a 2GB heap (see #11860).
+            cachedPromise = fetchFullMetadataCached(context.fetchOpts, name, {
+                registry,
+                authHeaderValue: context.getAuthHeaderValueByURI(registry),
+                cacheDir: context.cacheDir,
+            }).then(projectTrustMeta);
+        }
         context.fullMetaForTrustCache.set(cacheKey, cachedPromise);
     }
     return cachedPromise;
 }
+// Project the full packument to a minimal `PackageMeta`-shaped view
+// that exposes only the fields `failIfTrustDowngraded` reads:
+//   • `name` and `modified` for error messages and cache keys
+//   • `time` for the per-version publish-date walk
+//   • `versions[v]._npmUser.trustedPublisher`
+//   • `versions[v].dist.attestations.provenance`
+// The shape is still a valid `PackageMeta` so the downstream consumer
+// doesn't have to special-case it — only the bulk fields (dependency
+// graph, scripts, README, etc.) are dropped.
+function projectTrustMeta(meta) {
+    const versions = {};
+    for (const [version, manifest] of Object.entries(meta.versions ?? {})) {
+        versions[version] = projectTrustManifest(manifest);
+    }
+    return {
+        name: meta.name,
+        'dist-tags': {},
+        versions,
+        time: meta.time,
+        modified: meta.modified,
+        etag: meta.etag,
+    };
+}
+function projectTrustManifest(manifest) {
+    // Drop everything except the trust-evidence fields. `PackageInRegistry.dist`
+    // is typed as requiring `shasum` and `tarball`, but the trust check never
+    // reads them; cast away the unsoundness so callers see the same nominal
+    // shape without the per-version dependency graph / scripts / README bulk
+    // carrying through. `_npmUser` is similarly narrowed to just
+    // `trustedPublisher` — the only sub-field the trust check inspects — so
+    // we don't keep maintainer name/email PII resident in the cache.
+    const trustedPublisher = manifest._npmUser?.trustedPublisher;
+    const provenance = manifest.dist?.attestations?.provenance;
+    return {
+        _npmUser: trustedPublisher != null ? { trustedPublisher } : undefined,
+        dist: provenance != null
+            ? { attestations: { provenance } }
+            : undefined,
+    };
+}
 /**
  * Per-(registry, name, version) lookup with a layered fallback:
  *
@@ -360,7 +429,7 @@ async function tryAbbreviatedModifiedShortcut(context, registry, name, version)
     // publish time — but only for versions the registry currently lists.
     // An unpublished or never-published pin would otherwise pass the gate
     // on a stale package-level timestamp.
-    if (!meta?.versions || !(version in meta.versions))
+    if (!meta?.versionNames?.has(version))
         return undefined;
     return modified;
 }
@@ -368,15 +437,75 @@ function fetchAbbreviatedMeta(context, registry, name) {
     const cacheKey = `${registry}\x00${name}`;
     let cachedPromise = context.abbreviatedMetaCache.get(cacheKey);
     if (cachedPromise == null) {
-        cachedPromise = fetchAbbreviatedMetadataCached(context.fetchOpts, name, {
-            registry,
-            authHeaderValue: context.getAuthHeaderValueByURI(registry),
-            cacheDir: context.cacheDir,
-        }).catch(() => undefined);
+        // Fast path: the resolver's per-install LRU already holds this
+        // packument from its own pickPackage pass — abbreviated or full.
+        // Project it for the shortcut and skip the disk/network round-trip.
+        // Mismatch on `name` is the same risk the resolver carries today
+        // (its cache key omits the registry), so reuse is no less correct
+        // than the resolver's own get.
+        const shared = readSharedMeta(context.sharedMetaCache, name);
+        if (shared != null) {
+            cachedPromise = Promise.resolve(projectAbbreviatedMeta(shared));
+        }
+        else {
+            cachedPromise = fetchAbbreviatedMetadataCached(context.fetchOpts, name, {
+                registry,
+                authHeaderValue: context.getAuthHeaderValueByURI(registry),
+                cacheDir: context.cacheDir,
+            }).then(projectAbbreviatedMeta, () => undefined);
+        }
         context.abbreviatedMetaCache.set(cacheKey, cachedPromise);
     }
     return cachedPromise;
 }
+function readSharedMeta(cache, name) {
+    if (cache == null)
+        return undefined;
+    // Prefer the full entry — a `name:full` hit subsumes the abbreviated
+    // hit (full meta carries every field the abbreviated form does, plus
+    // `time` and per-version trust evidence the trust check needs). The
+    // resolver only populates `name:full` when the install ran with
+    // `minimumReleaseAge` configured, otherwise the bare `name` key holds
+    // the abbreviated form.
+    return validateSharedMeta(cache.get(`${name}:full`), name) ??
+        validateSharedMeta(cache.get(name), name);
+}
+function readSharedMetaForTrust(cache, name) {
+    if (cache == null)
+        return undefined;
+    // Abbreviated meta is rejected for the trust check — it lacks
+    // per-version `time` and per-version trust evidence.
+    return validateSharedMeta(cache.get(`${name}:full`), name);
+}
+// Defensive guard against the resolver's `name`-only cache key
+// returning something unexpected. The known correctness gap (two
+// registries serving the same package name share one cache slot)
+// is inherited from the resolver itself — see the `pickPackage.ts`
+// cacheKey shape; the verifier can't be stricter than the resolver
+// without changing both. This name check at least catches accidental
+// returns of a different package (cache corruption, factory misuse)
+// rather than silently feeding wrong data to the trust / age check.
+function validateSharedMeta(meta, name) {
+    if (meta == null)
+        return undefined;
+    if (meta.name !== name)
+        return undefined;
+    return meta;
+}
+// Project the abbreviated packument down to the two fields the verifier
+// actually reads — package-level `modified` and the set of version names
+// for the existence check inside `tryAbbreviatedModifiedShortcut`. The
+// resolver populates the abbreviated mirror with every version's
+// dependency / engine / dist info, which can run to hundreds of KB per
+// package and accumulate to many GB across a multi-thousand-entry
+// lockfile (see #11860). The full document is GC-able as soon as this
+// closure returns.
+function projectAbbreviatedMeta(meta) {
+    return {
+        modified: meta.modified,
+        versionNames: meta.versions ? new Set(Object.keys(meta.versions)) : undefined,
+    };
+}
 function readLocalMetaTime(context, registry, name) {
     if (!context.cacheDir)
         return Promise.resolve(undefined);

package/lib/index.d.ts

@@ -118,3 +118,11 @@ export type ResolveFromNpmOptions = {
     projectDir: string;
     workspacePackages: WorkspacePackages;
 });
+/**
+ * Construct the LRU `PackageMetaCache` instance the resolver uses by
+ * default. Exported so the install layer can build one cache and hand
+ * the same reference to both the resolver and the verifier — the
+ * verifier's fast path reads from it when the resolver has already
+ * fetched a packument during the same install.
+ */
+export declare function createDefaultPackageMetaCache(): PackageMetaCache;

package/lib/index.js

@@ -76,10 +76,15 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
     const fetch = pMemoize(fetchMetadataFromFromRegistry.bind(null, fetchOpts), {
         cacheKey: (...args) => JSON.stringify(args),
     });
-    const metaCache = opts.metaCache ?? new LRUCache({
-        max: 10000,
-        ttl: 120 * 1000, // 2 minutes
-    });
+    // Track ownership so `clearCache()` below only wipes the in-memory
+    // cache when this factory created it. A caller-supplied
+    // `opts.metaCache` may be shared with another resolver instance (or
+    // outlive this resolver entirely — e.g. a long-lived agent process
+    // that keeps one cache across many install requests); clearing it
+    // here would silently evict entries that other consumers are still
+    // using.
+    const ownsMetaCache = opts.metaCache == null;
+    const metaCache = opts.metaCache ?? createDefaultPackageMetaCache();
     // Create peek function if storeDir is provided
     const storeDir = opts.storeDir;
     const peekLockerForPeek = new Map();
@@ -137,7 +142,7 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
         resolveLatestFromJsr: createResolveLatest(boundResolveFromJsr, isJsrSpec),
         resolveLatestFromNamedRegistry: createResolveLatest(boundResolveFromNamedRegistry, (query) => isNamedRegistrySpec(query, ctx.namedRegistryNames)),
         clearCache: () => {
-            if ('clear' in metaCache && typeof metaCache.clear === 'function') {
+            if (ownsMetaCache && 'clear' in metaCache && typeof metaCache.clear === 'function') {
                 metaCache.clear();
             }
             pMemoizeClear(fetch);
@@ -730,4 +735,17 @@ function createVersionSpec(version, pinnedVersion) {
             throw new PnpmError('BAD_PINNED_VERSION', `Cannot pin '${pinnedVersion ?? 'undefined'}'`);
     }
 }
+/**
+ * Construct the LRU `PackageMetaCache` instance the resolver uses by
+ * default. Exported so the install layer can build one cache and hand
+ * the same reference to both the resolver and the verifier — the
+ * verifier's fast path reads from it when the resolver has already
+ * fetched a packument during the same install.
+ */
+export function createDefaultPackageMetaCache() {
+    return new LRUCache({
+        max: 10000,
+        ttl: 120 * 1000, // 2 minutes
+    });
+}
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.npm-resolver",
-  "version": "1101.3.1",
+  "version": "1101.3.2",
   "description": "Resolver for npm-hosted packages",
   "keywords": [
     "pnpm",
@@ -41,22 +41,22 @@
     "ssri": "13.0.1",
     "version-selector-type": "^3.0.0",
     "@pnpm/config.version-policy": "1100.1.1",
-    "@pnpm/config.pick-registry-for-package": "1100.0.5",
-    "@pnpm/constants": "1100.0.0",
     "@pnpm/core-loggers": "1100.1.1",
     "@pnpm/crypto.hash": "1100.0.1",
-    "@pnpm/error": "1100.0.0",
     "@pnpm/fetching.types": "1100.0.1",
-    "@pnpm/resolving.jsr-specifier-parser": "1100.0.0",
+    "@pnpm/constants": "1100.0.0",
     "@pnpm/fs.graceful-fs": "1100.1.0",
-    "@pnpm/resolving.registry.types": "1100.0.4",
+    "@pnpm/error": "1100.0.0",
+    "@pnpm/config.pick-registry-for-package": "1100.0.5",
     "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.4",
+    "@pnpm/resolving.registry.types": "1100.0.4",
     "@pnpm/resolving.resolver-base": "1100.3.0",
-    "@pnpm/store.index": "1100.1.0",
-    "@pnpm/types": "1101.1.1",
-    "@pnpm/workspace.range-resolver": "1100.0.1",
+    "@pnpm/resolving.jsr-specifier-parser": "1100.0.0",
     "@pnpm/store.cafs": "1100.1.6",
-    "@pnpm/workspace.spec-parser": "1100.0.0"
+    "@pnpm/workspace.range-resolver": "1100.0.1",
+    "@pnpm/workspace.spec-parser": "1100.0.0",
+    "@pnpm/types": "1101.1.1",
+    "@pnpm/store.index": "1100.1.0"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0",
@@ -70,11 +70,11 @@
     "@types/ssri": "^7.1.5",
     "load-json-file": "^7.0.1",
     "tempy": "3.0.0",
-    "@pnpm/network.fetch": "1100.0.6",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/resolving.npm-resolver": "1101.3.1",
-    "@pnpm/testing.mock-agent": "1100.0.6",
-    "@pnpm/test-fixtures": "1100.0.0"
+    "@pnpm/network.fetch": "1100.0.6",
+    "@pnpm/resolving.npm-resolver": "1101.3.2",
+    "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/testing.mock-agent": "1100.0.6"
   },
   "engines": {
     "node": ">=22.13"