@pnpm/resolving.npm-resolver 1102.0.1 → 1102.1.0

package/lib/createNpmResolutionVerifier.d.ts

@@ -1,5 +1,5 @@
 import type { GetAuthHeader } from '@pnpm/fetching.types';
-import type { ResolutionVerifier } from '@pnpm/resolving.resolver-base';
+import { type ResolutionVerifier } from '@pnpm/resolving.resolver-base';
 import type { Registries, TrustPolicy } from '@pnpm/types';
 import type { FetchMetadataFromFromRegistryOptions } from './fetch.js';
 import { type FetchFullMetadataCachedOptions } from './fetchFullMetadataCached.js';

package/lib/createNpmResolutionVerifier.js

@@ -2,14 +2,15 @@ import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
 import { createPackageVersionPolicy } from '@pnpm/config.version-policy';
 import { FULL_META_DIR } from '@pnpm/constants';
 import { PnpmError } from '@pnpm/error';
+import { isGitHostedTarballUrl, } from '@pnpm/resolving.resolver-base';
 import semver from 'semver';
 import { fetchAttestationPublishedAt } from './fetchAttestationPublishedAt.js';
 import { fetchAbbreviatedMetadataCached, fetchFullMetadataCached, } from './fetchFullMetadataCached.js';
 import { normalizeRegistryUrl } from './normalizeRegistryUrl.js';
 import { BUILTIN_NAMED_REGISTRIES } from './parseBareSpecifier.js';
-import { getPkgMirrorPath, loadMeta, warnMissingTimeFieldOnce } from './pickPackage.js';
+import { getPkgMetaCacheKey, getPkgMirrorPath, loadMeta, warnMissingTimeFieldOnce } from './pickPackage.js';
 import { failIfTrustDowngraded } from './trustChecks.js';
-import { MINIMUM_RELEASE_AGE_VIOLATION_CODE, TARBALL_URL_MISMATCH_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
+import { MINIMUM_RELEASE_AGE_VIOLATION_CODE, MISSING_TARBALL_INTEGRITY_VIOLATION_CODE, TARBALL_URL_MISMATCH_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
 /**
  * Returns a `ResolutionVerifier` for npm-registry-resolved lockfile
  * entries. It always binds each entry's recorded tarball URL to the
@@ -85,8 +86,17 @@ export function createNpmResolutionVerifier(opts) {
     const trustPolicy = opts.trustPolicy;
     const trustPolicyIgnoreAfter = opts.trustPolicyIgnoreAfter;
     const verify = async (resolution, { name, version, nonSemverVersion }) => {
-        if (!isNpmRegistryResolution(resolution))
+        if (!isRegistryTarballResolution(resolution))
             return { ok: true };
+        // Network-free structural checks must run before registry metadata shortcuts.
+        const integrity = resolution.integrity;
+        if (typeof integrity !== 'string' || integrity.length === 0) {
+            return {
+                ok: false,
+                code: MISSING_TARBALL_INTEGRITY_VIOLATION_CODE,
+                reason: 'has no "integrity" field, so its downloaded tarball cannot be verified',
+            };
+        }
         // URL/git-keyed entries are deliberate non-registry deps. They can still
         // carry a semver `version` copied from the resolved manifest, so the
         // semver guard below isn't enough on its own — the registry policies and
@@ -94,9 +104,22 @@ export function createNpmResolutionVerifier(opts) {
         // would 404.
         if (nonSemverVersion != null)
             return { ok: true };
-        if (!semver.valid(version))
-            return { ok: true };
-        const tarballUrl = resolution.tarball;
+        if (!semver.valid(version)) {
+            return {
+                ok: false,
+                code: TARBALL_URL_MISMATCH_VIOLATION_CODE,
+                reason: `has a non-semver version ("${version}") and so cannot be verified against the registry's published metadata`,
+            };
+        }
+        const rawTarball = resolution.tarball;
+        if (rawTarball != null && typeof rawTarball !== 'string') {
+            return {
+                ok: false,
+                code: TARBALL_URL_MISMATCH_VIOLATION_CODE,
+                reason: 'has a non-string "tarball" field, so its URL cannot be verified',
+            };
+        }
+        const tarballUrl = typeof rawTarball === 'string' ? rawTarball : undefined;
         const registry = pickRegistryForVersion(opts.registries, namedRegistryPrefixes, name, tarballUrl);
         // A registry entry that pins an explicit tarball URL must point at the
         // artifact the registry's own metadata lists. Otherwise a trusted
@@ -150,6 +173,8 @@ export function createNpmResolutionVerifier(opts) {
             // applies the binding — otherwise an upgrade could keep trusting a
             // lockfile that was only ever age/trust-checked.
             tarballUrlBinding: true,
+            // Same cache identity rule for the missing-integrity structural check.
+            integrityRequired: true,
             minimumReleaseAge,
             minimumReleaseAgeExclude: sortedMinAgeExcludes,
             trustPolicy: trustPolicy ?? null,
@@ -161,6 +186,10 @@ export function createNpmResolutionVerifier(opts) {
             // didn't record it can't be trusted to have enforced it.
             if (cached.tarballUrlBinding !== true)
                 return false;
+            // The missing-integrity check is also unconditional; older cache records
+            // without the flag cannot prove they rejected unverifiable tarballs.
+            if (cached.integrityRequired !== true)
+                return false;
             // Maturity: a previously cached run under a larger cutoff
             // (stricter window) is trustworthy under a smaller current one —
             // its set of accepted versions is a subset of today's. The
@@ -203,17 +232,11 @@ export function createNpmResolutionVerifier(opts) {
     };
 }
 async function runAgeCheck(context, registry, name, version, cutoff, ignoreMissingTimeField) {
-    let published;
-    try {
-        published = await fetchPublishedAt(context, registry, name, version);
-    }
-    catch (err) {
-        return {
-            ok: false,
-            code: MINIMUM_RELEASE_AGE_VIOLATION_CODE,
-            reason: uncheckable('minimumReleaseAge', err instanceof Error ? err.message : String(err)),
-        };
-    }
+    // A transport failure (auth/network/5xx) propagates the registry's own fetch
+    // error (e.g. ERR_PNPM_FETCH_403); the gate aborts the install with it rather
+    // than folding it into a policy violation. A successful fetch that simply
+    // lacks a publish timestamp for this version is handled below.
+    const published = await fetchPublishedAt(context, registry, name, version);
     if (!published) {
         // No source — attestation, local mirror, or full metadata —
         // surfaced a publish timestamp for this version. The resolver's
@@ -262,7 +285,15 @@ async function runAgeCheck(context, registry, name, version, cutoff, ignoreMissi
  * pointing it at a `name@version` the registry can't vouch for.
  */
 async function runTarballUrlCheck(context, registry, name, version, lockfileTarball) {
-    const meta = await fetchAbbreviatedMeta(context, registry, name);
+    const { meta, error } = await fetchAbbreviatedMeta(context, registry, name);
+    if (error != null) {
+        // Couldn't reach the registry to verify (auth/network/5xx). Propagate the
+        // registry's own fetch error (e.g. ERR_PNPM_FETCH_403, which already
+        // explains the auth situation) instead of mislabeling a transport failure
+        // as a tampering-style URL mismatch. The gate aborts the install with that
+        // error — still fail-closed, the entry never reaches the filesystem.
+        throw error;
+    }
     const registryTarball = meta?.versionTarballs?.get(version);
     if (registryTarball != null && sameTarballUrl(lockfileTarball, registryTarball)) {
         return undefined;
@@ -304,20 +335,11 @@ function canonicalTarballUrl(url) {
  * attestation → pass" shortcut would silently miss it.
  */
 async function runTrustCheck(context, registry, name, version, opts) {
-    let meta;
-    try {
-        meta = await fetchFullMetaForTrust(context, registry, name);
-    }
-    catch (err) {
-        // `fetchFullMetadataCached` rejects (network error, 404, etc.); the
-        // verifier fails closed so a missing manifest can't be mistaken
-        // for a passing trust check.
-        return {
-            ok: false,
-            code: TRUST_DOWNGRADE_VIOLATION_CODE,
-            reason: uncheckable('trustPolicy', err instanceof Error ? err.message : String(err)),
-        };
-    }
+    // A transport failure (auth/network/5xx) propagates the registry's own fetch
+    // error; the gate aborts the install with it rather than folding it into a
+    // policy violation. Still fail-closed: a missing manifest can't be mistaken
+    // for a passing trust check because the install never proceeds.
+    const meta = await fetchFullMetaForTrust(context, registry, name);
     try {
         failIfTrustDowngraded(meta, version, opts);
     }
@@ -335,20 +357,13 @@ function fetchFullMetaForTrust(context, registry, name) {
     let cachedPromise = context.fullMetaForTrustCache.get(cacheKey);
     if (cachedPromise == null) {
         // Fast path: if the resolver already upgraded to full meta for this
-        // name during the same install (e.g. minimumReleaseAge active),
-        // reuse that document. Abbreviated meta is rejected here — it lacks
-        // per-version `time` and per-version trust evidence, both required
-        // by failIfTrustDowngraded.
-        //
-        // Limitation: the resolver's `metaCache` keys by `${name}:full` —
-        // it doesn't include the registry (pickPackage.ts cacheKey shape).
-        // If two registries serve packages of the same name in one install
-        // the resolver itself silently keeps the first fetch; the verifier
-        // here inherits that scope. The name check below is a defensive
-        // guard against accidental cache mixups; tightening this to a
-        // registry-qualified read needs the resolver's `metaCache` key
-        // shape to change first.
-        const shared = readSharedMetaForTrust(context.sharedMetaCache, name);
+        // (registry, name) during the same install (e.g. minimumReleaseAge
+        // active), reuse that document. Abbreviated meta is rejected here —
+        // it lacks per-version `time` and per-version trust evidence, both
+        // required by failIfTrustDowngraded. The read is registry-qualified
+        // (see `getPkgMetaCacheKey`), so a package of the same name served by
+        // a different registry can't be returned here.
+        const shared = readSharedMetaForTrust(context.sharedMetaCache, registry, name);
         if (shared != null) {
             cachedPromise = Promise.resolve(projectTrustMeta(shared));
         }
@@ -492,7 +507,9 @@ async function resolvePublishedAt(context, registry, name, version) {
  * lookups.
  */
 async function tryAbbreviatedModifiedShortcut(context, registry, name, version) {
-    const meta = await fetchAbbreviatedMeta(context, registry, name);
+    // A fetch failure here is fine: ignore `error` and fall back to per-version
+    // lookups, the same as a successful-but-uninformative metadata response.
+    const { meta } = await fetchAbbreviatedMeta(context, registry, name);
     const modified = meta?.modified;
     if (typeof modified !== 'string')
         return undefined;
@@ -516,49 +533,59 @@ function fetchAbbreviatedMeta(context, registry, name) {
         // Fast path: the resolver's per-install LRU already holds this
         // packument from its own pickPackage pass — abbreviated or full.
         // Project it for the shortcut and skip the disk/network round-trip.
-        // Mismatch on `name` is the same risk the resolver carries today
-        // (its cache key omits the registry), so reuse is no less correct
-        // than the resolver's own get.
-        const shared = readSharedMeta(context.sharedMetaCache, name);
+        // The read is registry-qualified (see `getPkgMetaCacheKey`), so it
+        // can only return this registry's own packument.
+        const shared = readSharedMeta(context.sharedMetaCache, registry, name);
         if (shared != null) {
-            cachedPromise = Promise.resolve(projectAbbreviatedMeta(shared));
+            cachedPromise = Promise.resolve({ meta: projectAbbreviatedMeta(shared) });
         }
         else {
+            // Carry a fetch failure (auth/network/5xx) as `error` instead of
+            // collapsing it to `undefined`: the tarball-URL check rethrows it (so the
+            // registry's own error surfaces, not a tampering-style mismatch) while
+            // the age shortcut ignores it and falls back to per-version lookups.
+            // Keeping it a resolved value — not a rejected promise — lets the two
+            // callers share one cached promise without an unhandled rejection.
             cachedPromise = fetchAbbreviatedMetadataCached(context.fetchOpts, name, {
                 registry,
                 authHeaderValue: context.getAuthHeaderValueByURI(registry, { pkgName: name }),
                 cacheDir: context.cacheDir,
-            }).then(projectAbbreviatedMeta, () => undefined);
+            }).then((meta) => ({ meta: projectAbbreviatedMeta(meta) }), (error) => ({ error }));
         }
         context.abbreviatedMetaCache.set(cacheKey, cachedPromise);
     }
     return cachedPromise;
 }
-function readSharedMeta(cache, name) {
+function readSharedMeta(cache, registry, name) {
     if (cache == null)
         return undefined;
-    // Prefer the full entry — a `name:full` hit subsumes the abbreviated
-    // hit (full meta carries every field the abbreviated form does, plus
-    // `time` and per-version trust evidence the trust check needs). The
-    // resolver only populates `name:full` when the install ran with
-    // `minimumReleaseAge` configured, otherwise the bare `name` key holds
+    // Prefer a full entry — it carries every field the abbreviated form
+    // does, plus `time` and per-version trust evidence the trust check
+    // needs. The resolver only populates a full key when the install ran
+    // with `minimumReleaseAge` configured, otherwise the bare key holds
     // the abbreviated form.
-    return validateSharedMeta(cache.get(`${name}:full`), name) ??
-        validateSharedMeta(cache.get(name), name);
+    return readSharedFullMeta(cache, registry, name) ??
+        validateSharedMeta(cache.get(getPkgMetaCacheKey(registry, name, false, false)), name);
 }
-function readSharedMetaForTrust(cache, name) {
+function readSharedMetaForTrust(cache, registry, name) {
     if (cache == null)
         return undefined;
     // Abbreviated meta is rejected for the trust check — it lacks
     // per-version `time` and per-version trust evidence.
-    return validateSharedMeta(cache.get(`${name}:full`), name);
+    return readSharedFullMeta(cache, registry, name);
 }
-// Defensive guard against the resolver's `name`-only cache key
-// returning something unexpected. The known correctness gap (two
-// registries serving the same package name share one cache slot)
-// is inherited from the resolver itself — see the `pickPackage.ts`
-// cacheKey shape; the verifier can't be stricter than the resolver
-// without changing both. This name check at least catches accidental
+// The resolver keys full metadata as either filtered or unfiltered
+// depending on its own `filterMetadata` setting; the verifier doesn't
+// know which, and a filtered full packument keeps everything the
+// verifier reads (`time`, per-version `_npmUser`, `dist`), so try both.
+function readSharedFullMeta(cache, registry, name) {
+    return validateSharedMeta(cache.get(getPkgMetaCacheKey(registry, name, true, false)), name) ??
+        validateSharedMeta(cache.get(getPkgMetaCacheKey(registry, name, true, true)), name);
+}
+// Defensive guard against the resolver's `metaCache` returning an
+// unexpected entry. The cache key is registry-qualified (see
+// `getPkgMetaCacheKey`), so a package of the same name from another
+// registry can't be returned; this name check catches accidental
 // returns of a different package (cache corruption, factory misuse)
 // rather than silently feeding wrong data to the trust / age check.
 function validateSharedMeta(meta, name) {
@@ -672,25 +699,26 @@ function isExcluded(policy, name, version) {
         return true;
     return false;
 }
-function isNpmRegistryResolution(resolution) {
+function isRegistryTarballResolution(resolution) {
     if (resolution == null || typeof resolution !== 'object')
         return false;
     // Only plain tarball resolutions (npm registry / named registries) have no
     // `type` field. Git / directory / binary / custom resolutions all carry one.
     if ('type' in resolution && resolution.type != null)
         return false;
-    // Git-hosted tarballs (codeload/gitlab/bitbucket) are special-cased in
-    // the resolver and aren't subject to release-age policy.
-    if ('gitHosted' in resolution && resolution.gitHosted)
-        return false;
     const tarball = resolution.tarball;
     if (typeof tarball === 'string') {
+        // Git-hosted tarballs (codeload/gitlab/bitbucket) are special-cased in
+        // the resolver and aren't subject to registry policy.
+        if (isGitHostedTarballUrl(tarball))
+            return false;
         // Local/non-registry tarballs (for example `file:`) have no packument
         // metadata, so minimumReleaseAge/trustPolicy verification cannot apply.
         const protocol = tryParseUrl(tarball)?.protocol;
         if (protocol != null && protocol !== 'http:' && protocol !== 'https:')
             return false;
     }
-    return 'tarball' in resolution || 'integrity' in resolution;
+    // Canonical registry entries may omit both `tarball` and `integrity`.
+    return true;
 }
 //# sourceMappingURL=createNpmResolutionVerifier.js.map

package/lib/fetch.js

@@ -1,6 +1,7 @@
 import url from 'node:url';
+import util from 'node:util';
 import { requestRetryLogger } from '@pnpm/core-loggers';
-import { FetchError, PnpmError, } from '@pnpm/error';
+import { FetchError, PnpmError, redactUrlCredentials, } from '@pnpm/error';
 import { globalWarn } from '@pnpm/logger';
 import * as retry from '@zkochan/retry';
 import semver from 'semver';
@@ -87,7 +88,18 @@ export async function fetchMetadataFromFromRegistry(fetchOpts, pkgName, { authHe
                 });
             }
             catch (error) { // eslint-disable-line
-                reject(new PnpmError('META_FETCH_FAIL', `GET ${uri}: ${error.message}`, { attempts: attempt, cause: error }));
+                // Redact credentials embedded in the URL from the cause as well, not
+                // just the top-level message: a reporter or debugger that renders
+                // `error.cause` would otherwise print the raw URL-bearing message. The
+                // `stack` string embeds the original (pre-mutation) message, so redact
+                // it too — mutating `message` alone leaves the credentials in `stack`.
+                if (util.types.isNativeError(error)) {
+                    if (typeof error.message === 'string')
+                        error.message = redactUrlCredentials(error.message);
+                    if (typeof error.stack === 'string')
+                        error.stack = redactUrlCredentials(error.stack);
+                }
+                reject(new PnpmError('META_FETCH_FAIL', redactUrlCredentials(`GET ${uri}: ${error.message}`), { attempts: attempt, cause: error }));
                 return;
             }
             if (response.status === 304) {

package/lib/pickPackage.d.ts

@@ -15,12 +15,14 @@ export interface PickPackageOptions extends PickPackageFromMetaOptions {
     includeLatestTag?: boolean;
     optional?: boolean;
     /**
-     * When true, skip the on-disk exact-version cache fast path so a
-     * stale on-disk packument can't satisfy the call without a
-     * conditional registry request. The in-memory cache is left alone:
-     * its entries can only be populated by this install's own fresh
-     * network fetches, so they're authoritative for second-and-onward
-     * lookups within the same install.
+     * When true, force a conditional registry request so a stale on-disk
+     * packument can't satisfy the call: the on-disk exact-version fast
+     * path is skipped, and the in-memory cache is bypassed too. The fast
+     * path now promotes disk-loaded packuments into the in-memory cache,
+     * so an entry there can no longer be assumed to come from this
+     * install's own fresh network fetch — on a shared or long-lived
+     * resolver it might be disk-sourced, which would short-circuit the
+     * revalidation updateChecksums exists to force.
      */
     updateChecksums?: boolean;
 }
@@ -44,6 +46,28 @@ export declare function pickPackage(ctx: {
     pickedPackage: PackageInRegistry | null;
 }>;
 export declare function encodePkgName(pkgName: string): string;
+/**
+ * Key for the in-memory `metaCache` holding a package's registry metadata. The
+ * registry is part of the key so that a package of the same name served by two
+ * registries in one install can't collide on a single slot (which would resolve
+ * the wrong tarball/integrity). `fullMetadata` and `filterMetadata` keep the
+ * abbreviated, full, and filtered-full documents in distinct slots, mirroring
+ * the on-disk `metaDir` split: a `filterMetadata` resolver stores a `clearMeta`-
+ * stripped packument, so it must not share a slot with an unfiltered full one
+ * (reachable only when a `metaCache` is shared across resolvers with different
+ * settings). `filterMetadata` only narrows the full slot — abbreviated metadata
+ * shares one on-disk mirror regardless, so its key carries no filtered variant.
+ * `\x00` can't appear in a registry URL or a package name, so it's an
+ * unambiguous separator. The verifier reads this same cache and must build the
+ * key with this function.
+ *
+ * The registry is canonicalized to its origin plus a trailing-slashed path, so
+ * the resolver (which may pass a configured named-registry URL verbatim) and
+ * the verifier (which routes through trailing-slashed prefixes) converge on one
+ * key for the same logical registry instead of creating duplicate slots. Origin
+ * and path are preserved, so two registries that genuinely differ never collapse.
+ */
+export declare function getPkgMetaCacheKey(registry: string, pkgName: string, fullMetadata: boolean, filterMetadata: boolean): string;
 /**
  * Path of the on-disk JSONL document where pnpm mirrors a package's registry
  * metadata. `metaDir` selects between abbreviated and full caches.

package/lib/pickPackage.js

@@ -121,10 +121,16 @@ export async function pickPackage(ctx, spec, opts) {
     const metaDir = fullMetadata
         ? (ctx.filterMetadata ? FULL_FILTERED_META_DIR : FULL_META_DIR)
         : ABBREVIATED_META_DIR;
-    // Cache key includes fullMetadata to avoid returning abbreviated metadata when full metadata is requested.
-    const cacheKey = fullMetadata ? `${spec.name}:full` : spec.name;
+    // Cache key includes the registry so a package of the same name served by two
+    // registries in one install can't share a slot (which would resolve the wrong
+    // tarball/integrity), plus fullMetadata/filterMetadata so a request is never
+    // served a less-detailed or differently-stripped document than it asked for.
+    const cacheKey = getPkgMetaCacheKey(opts.registry, spec.name, fullMetadata, ctx.filterMetadata === true);
     const pkgMirror = getPkgMirrorPath(ctx.cacheDir, metaDir, opts.registry, spec.name);
-    const cachedMeta = ctx.metaCache.get(cacheKey);
+    // updateChecksums must reach the conditional registry request below, so it
+    // can't be served from the in-memory cache — which may hold a disk-promoted
+    // entry rather than a fresh network fetch (see the updateChecksums doc).
+    const cachedMeta = opts.updateChecksums ? undefined : ctx.metaCache.get(cacheKey);
     if (cachedMeta != null) {
         // The in-memory cache may hold abbreviated metadata from an earlier call
         // that didn't need `time` (no publishedBy then). If this call has
@@ -187,6 +193,7 @@ export async function pickPackage(ctx, spec, opts) {
                 try {
                     const pickedPackage = pickMatchingVersionFast(pickerOpts, spec, metaCachedInStore);
                     if (pickedPackage) {
+                        ctx.metaCache.set(cacheKey, metaCachedInStore);
                         return {
                             meta: metaCachedInStore,
                             pickedPackage,
@@ -465,6 +472,43 @@ export function encodePkgName(pkgName) {
     }
     return pkgName;
 }
+/**
+ * Key for the in-memory `metaCache` holding a package's registry metadata. The
+ * registry is part of the key so that a package of the same name served by two
+ * registries in one install can't collide on a single slot (which would resolve
+ * the wrong tarball/integrity). `fullMetadata` and `filterMetadata` keep the
+ * abbreviated, full, and filtered-full documents in distinct slots, mirroring
+ * the on-disk `metaDir` split: a `filterMetadata` resolver stores a `clearMeta`-
+ * stripped packument, so it must not share a slot with an unfiltered full one
+ * (reachable only when a `metaCache` is shared across resolvers with different
+ * settings). `filterMetadata` only narrows the full slot — abbreviated metadata
+ * shares one on-disk mirror regardless, so its key carries no filtered variant.
+ * `\x00` can't appear in a registry URL or a package name, so it's an
+ * unambiguous separator. The verifier reads this same cache and must build the
+ * key with this function.
+ *
+ * The registry is canonicalized to its origin plus a trailing-slashed path, so
+ * the resolver (which may pass a configured named-registry URL verbatim) and
+ * the verifier (which routes through trailing-slashed prefixes) converge on one
+ * key for the same logical registry instead of creating duplicate slots. Origin
+ * and path are preserved, so two registries that genuinely differ never collapse.
+ */
+export function getPkgMetaCacheKey(registry, pkgName, fullMetadata, filterMetadata) {
+    const key = `${canonicalizeRegistry(registry)}\x00${pkgName}`;
+    if (!fullMetadata)
+        return key;
+    return filterMetadata ? `${key}:full:filtered` : `${key}:full`;
+}
+function canonicalizeRegistry(registry) {
+    try {
+        const parsed = new URL(registry);
+        const pathname = parsed.pathname.endsWith('/') ? parsed.pathname : `${parsed.pathname}/`;
+        return `${parsed.origin}${pathname}`;
+    }
+    catch {
+        return registry;
+    }
+}
 /**
  * Path of the on-disk JSONL document where pnpm mirrors a package's registry
  * metadata. `metaDir` selects between abbreviated and full caches.

package/lib/violationCodes.d.ts

@@ -11,3 +11,4 @@
 export declare const MINIMUM_RELEASE_AGE_VIOLATION_CODE = "MINIMUM_RELEASE_AGE_VIOLATION";
 export declare const TRUST_DOWNGRADE_VIOLATION_CODE = "TRUST_DOWNGRADE";
 export declare const TARBALL_URL_MISMATCH_VIOLATION_CODE = "TARBALL_URL_MISMATCH";
+export declare const MISSING_TARBALL_INTEGRITY_VIOLATION_CODE = "MISSING_TARBALL_INTEGRITY";

package/lib/violationCodes.js

@@ -11,4 +11,5 @@
 export const MINIMUM_RELEASE_AGE_VIOLATION_CODE = 'MINIMUM_RELEASE_AGE_VIOLATION';
 export const TRUST_DOWNGRADE_VIOLATION_CODE = 'TRUST_DOWNGRADE';
 export const TARBALL_URL_MISMATCH_VIOLATION_CODE = 'TARBALL_URL_MISMATCH';
+export const MISSING_TARBALL_INTEGRITY_VIOLATION_CODE = 'MISSING_TARBALL_INTEGRITY';
 //# sourceMappingURL=violationCodes.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.npm-resolver",
-  "version": "1102.0.1",
+  "version": "1102.1.0",
   "description": "Resolver for npm-hosted packages",
   "keywords": [
     "pnpm",
@@ -12,9 +12,9 @@
   "funding": "https://opencollective.com/pnpm",
   "repository": {
     "type": "git",
-    "url": "https://github.com/pnpm/pnpm/tree/main/resolving/npm-resolver"
+    "url": "https://github.com/pnpm/pnpm/tree/main/pnpm11/resolving/npm-resolver"
   },
-  "homepage": "https://github.com/pnpm/pnpm/tree/main/resolving/npm-resolver#readme",
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/pnpm11/resolving/npm-resolver#readme",
   "bugs": {
     "url": "https://github.com/pnpm/pnpm/issues"
   },
@@ -43,27 +43,27 @@
     "semver-utils": "^1.1.4",
     "ssri": "13.0.1",
     "version-selector-type": "^3.0.0",
-    "@pnpm/core-loggers": "1100.2.1",
+    "@pnpm/config.pick-registry-for-package": "1100.0.9",
     "@pnpm/constants": "1100.0.0",
+    "@pnpm/config.version-policy": "1100.1.6",
+    "@pnpm/core-loggers": "1100.2.1",
     "@pnpm/crypto.hash": "1100.0.1",
-    "@pnpm/error": "1100.0.0",
+    "@pnpm/fetching.types": "1100.0.2",
+    "@pnpm/resolving.jsr-specifier-parser": "1100.0.1",
     "@pnpm/fs.graceful-fs": "1100.1.0",
-    "@pnpm/resolving.resolver-base": "1100.4.2",
-    "@pnpm/resolving.jsr-specifier-parser": "1100.0.0",
     "@pnpm/resolving.registry.types": "1100.1.3",
-    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.9",
-    "@pnpm/fetching.types": "1100.0.2",
-    "@pnpm/store.cafs": "1100.1.10",
-    "@pnpm/store.index": "1100.2.0",
+    "@pnpm/resolving.resolver-base": "1100.5.0",
+    "@pnpm/store.index": "1100.2.1",
+    "@pnpm/store.cafs": "1100.1.11",
     "@pnpm/types": "1101.3.2",
-    "@pnpm/workspace.spec-parser": "1100.0.0",
-    "@pnpm/config.pick-registry-for-package": "1100.0.9",
-    "@pnpm/config.version-policy": "1100.1.5",
-    "@pnpm/workspace.range-resolver": "1100.0.2"
+    "@pnpm/workspace.range-resolver": "1100.0.2",
+    "@pnpm/error": "1100.0.1",
+    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.9",
+    "@pnpm/workspace.spec-parser": "1100.0.0"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0",
-    "@pnpm/worker": "^1100.2.1"
+    "@pnpm/worker": "^1100.2.2"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
@@ -73,11 +73,11 @@
     "@types/ssri": "^7.1.5",
     "load-json-file": "^7.0.1",
     "tempy": "3.0.0",
-    "@pnpm/logger": "1100.0.0",
-    "@pnpm/network.fetch": "1100.1.3",
-    "@pnpm/resolving.npm-resolver": "1102.0.1",
-    "@pnpm/testing.mock-agent": "1101.0.3",
-    "@pnpm/test-fixtures": "1100.0.0"
+    "@pnpm/network.fetch": "1100.1.4",
+    "@pnpm/resolving.npm-resolver": "1102.1.0",
+    "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/testing.mock-agent": "1101.0.4",
+    "@pnpm/logger": "1100.0.0"
   },
   "engines": {
     "node": ">=22.13"