@pnpm/resolving.npm-resolver 1101.3.3 → 1101.4.0

package/lib/createNpmResolutionVerifier.js

@@ -341,12 +341,23 @@ function projectTrustManifest(manifest) {
     // reads them; cast away the unsoundness so callers see the same nominal
     // shape without the per-version dependency graph / scripts / README bulk
     // carrying through. `_npmUser` is similarly narrowed to just
-    // `trustedPublisher` — the only sub-field the trust check inspects — so
-    // we don't keep maintainer name/email PII resident in the cache.
+    // `trustedPublisher` and `approver` — the only sub-fields the trust check
+    // inspects — so we don't keep maintainer name/email PII resident in the
+    // cache.
+    const approver = manifest._npmUser?.approver;
     const trustedPublisher = manifest._npmUser?.trustedPublisher;
     const provenance = manifest.dist?.attestations?.provenance;
+    let npmUser = undefined;
+    if (approver) {
+        npmUser ||= {};
+        npmUser.approver = {};
+    }
+    if (trustedPublisher) {
+        npmUser ||= {};
+        npmUser.trustedPublisher = trustedPublisher;
+    }
     return {
-        _npmUser: trustedPublisher != null ? { trustedPublisher } : undefined,
+        _npmUser: npmUser,
         dist: provenance != null
             ? { attestations: { provenance } }
             : undefined,

package/lib/pickPackage.js

@@ -201,7 +201,7 @@ export async function pickPackage(ctx, spec, opts) {
                 }
             }
         }
-        if (opts.publishedBy) {
+        if (opts.publishedBy && opts.publishedByExclude?.(spec.name) !== true) {
             const mtime = await limit(async () => getFileMtime(pkgMirror));
             if (mtime != null && mtime >= opts.publishedBy) {
                 metaCachedInStore = metaCachedInStore ?? await limit(async () => loadMeta(pkgMirror));

package/lib/trustChecks.d.ts

@@ -1,6 +1,6 @@
 import type { PackageInRegistry, PackageMeta } from '@pnpm/resolving.registry.types';
 import type { PackageVersionPolicy } from '@pnpm/types';
-type TrustEvidence = 'provenance' | 'trustedPublisher';
+type TrustEvidence = 'provenance' | 'trustedPublisher' | 'stagedPublish';
 export declare function failIfTrustDowngraded(meta: PackageMeta, version: string, opts?: {
     trustPolicyExclude?: PackageVersionPolicy;
     trustPolicyIgnoreAfter?: number;

package/lib/trustChecks.js

@@ -2,6 +2,7 @@ import { PnpmError } from '@pnpm/error';
 import semver from 'semver';
 import { assertMetaHasTime } from './pickPackageFromMeta.js';
 const TRUST_RANK = {
+    stagedPublish: 3,
     trustedPublisher: 2,
     provenance: 1,
 };
@@ -51,6 +52,7 @@ export function failIfTrustDowngraded(meta, version, opts) {
 }
 function prettyPrintTrustEvidence(trustEvidence) {
     switch (trustEvidence) {
+        case 'stagedPublish': return 'staged publish';
         case 'trustedPublisher': return 'trusted publisher';
         case 'provenance': return 'provenance attestation';
         default: return 'no trust evidence';
@@ -70,14 +72,19 @@ function detectStrongestTrustEvidenceBeforeDate(meta, beforeDate, options) {
         const trustEvidence = getTrustEvidence(manifest);
         if (!trustEvidence)
             continue;
-        if (trustEvidence === 'trustedPublisher') {
-            return 'trustedPublisher';
+        if (best === undefined || TRUST_RANK[trustEvidence] > TRUST_RANK[best]) {
+            best = trustEvidence;
+            if (best === 'stagedPublish') {
+                return best;
+            }
         }
-        best ||= 'provenance';
     }
     return best;
 }
 export function getTrustEvidence(manifest) {
+    if (manifest._npmUser?.approver) {
+        return 'stagedPublish';
+    }
     if (manifest._npmUser?.trustedPublisher && manifest.dist?.attestations?.provenance) {
         return 'trustedPublisher';
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.npm-resolver",
-  "version": "1101.3.3",
+  "version": "1101.4.0",
   "description": "Resolver for npm-hosted packages",
   "keywords": [
     "pnpm",
@@ -42,21 +42,21 @@
     "version-selector-type": "^3.0.0",
     "@pnpm/config.pick-registry-for-package": "1100.0.6",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/core-loggers": "1100.1.2",
-    "@pnpm/crypto.hash": "1100.0.1",
-    "@pnpm/config.version-policy": "1100.1.2",
     "@pnpm/error": "1100.0.0",
+    "@pnpm/crypto.hash": "1100.0.1",
     "@pnpm/fetching.types": "1100.0.1",
-    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.5",
-    "@pnpm/resolving.registry.types": "1100.0.5",
-    "@pnpm/resolving.resolver-base": "1100.3.1",
+    "@pnpm/fs.graceful-fs": "1100.1.0",
+    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.6",
+    "@pnpm/resolving.registry.types": "1100.1.0",
+    "@pnpm/resolving.jsr-specifier-parser": "1100.0.0",
     "@pnpm/store.cafs": "1100.1.7",
     "@pnpm/store.index": "1100.1.0",
-    "@pnpm/fs.graceful-fs": "1100.1.0",
     "@pnpm/types": "1101.2.0",
+    "@pnpm/workspace.spec-parser": "1100.0.0",
+    "@pnpm/resolving.resolver-base": "1100.3.1",
     "@pnpm/workspace.range-resolver": "1100.0.1",
-    "@pnpm/resolving.jsr-specifier-parser": "1100.0.0",
-    "@pnpm/workspace.spec-parser": "1100.0.0"
+    "@pnpm/config.version-policy": "1100.1.2",
+    "@pnpm/core-loggers": "1100.1.2"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1001.0.1",
@@ -71,10 +71,10 @@
     "load-json-file": "^7.0.1",
     "tempy": "3.0.0",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/testing.mock-agent": "1100.0.7",
-    "@pnpm/resolving.npm-resolver": "1101.3.3",
+    "@pnpm/network.fetch": "1100.0.8",
     "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/network.fetch": "1100.0.7"
+    "@pnpm/resolving.npm-resolver": "1101.4.0",
+    "@pnpm/testing.mock-agent": "1100.0.8"
   },
   "engines": {
     "node": ">=22.13"