@pnpm/resolving.npm-resolver 1102.1.3 → 1102.1.4

package/lib/pickPackageFromMeta.js

@@ -1,227 +0,0 @@
-import util from 'node:util';
-import { PnpmError } from '@pnpm/error';
-import { filterPkgMetadataByPublishDate } from '@pnpm/resolving.registry.pkg-metadata-filter';
-import semver from 'semver';
-export function pickPackageFromMeta(pickVersionByVersionRangeFn, { preferredVersionSelectors, publishedBy, publishedByExclude, }, meta, spec) {
-    if (publishedBy) {
-        const excludeResult = publishedByExclude?.(meta.name) ?? false;
-        if (excludeResult !== true) {
-            if (meta.time != null) {
-                // Full metadata with per-version timestamps: filter normally
-                assertMetaHasTime(meta);
-                const trustedVersions = Array.isArray(excludeResult) ? excludeResult : undefined;
-                meta = filterPkgMetadataByPublishDate(meta, publishedBy, trustedVersions);
-            }
-            else {
-                const modifiedDate = parseModifiedDate(meta.modified);
-                if (modifiedDate == null || modifiedDate > publishedBy) {
-                    // Abbreviated metadata without per-version timestamps, and the package
-                    // was recently modified (or has no/invalid modified field). We cannot determine
-                    // which individual versions are mature enough — need full metadata.
-                    assertMetaHasTime(meta);
-                }
-                // else: meta.modified <= publishedBy — every version was published at or
-                // before the cutoff (modified is an upper bound on per-version time), so
-                // they all pass the per-version `<=` maturity filter and no filtering is
-                // needed. Inclusive at the boundary on purpose so this branch matches the
-                // per-version filter in `filterPkgMetadataByPublishDate`.
-            }
-        }
-    }
-    if ((!meta.versions || Object.keys(meta.versions).length === 0) && !publishedBy) {
-        // Unfortunately, the npm registry doesn't return the time field in the abbreviated metadata.
-        // So we won't always know if the package was unpublished.
-        if (meta.time?.unpublished?.versions?.length) {
-            throw new PnpmError('UNPUBLISHED_PKG', `No versions available for ${spec.name} because it was unpublished`);
-        }
-        throw new PnpmError('NO_VERSIONS', `No versions available for ${spec.name}. The package may be unpublished.`);
-    }
-    try {
-        let version;
-        switch (spec.type) {
-            case 'version':
-                version = spec.fetchSpec;
-                break;
-            case 'tag':
-                version = meta['dist-tags'][spec.fetchSpec];
-                break;
-            case 'range':
-                version = pickVersionByVersionRangeFn({
-                    meta,
-                    versionRange: spec.fetchSpec,
-                    preferredVersionSelectors,
-                    publishedBy,
-                });
-                break;
-        }
-        if (!version)
-            return null;
-        const manifest = meta.versions[version];
-        if (manifest && meta['name']) {
-            // Packages that are published to the GitHub registry are always published with a scope.
-            // However, the name in the package.json for some reason may omit the scope.
-            // So the package published to the GitHub registry will be published under @foo/bar
-            // but the name in package.json will be just bar.
-            // In order to avoid issues, we consider that the real name of the package is the one with the scope.
-            manifest.name = meta['name'];
-        }
-        return manifest;
-    }
-    catch (err) {
-        if (util.types.isNativeError(err) &&
-            'code' in err &&
-            typeof err.code === 'string' &&
-            err.code.startsWith('ERR_PNPM_')) {
-            throw err;
-        }
-        throw new PnpmError('MALFORMED_METADATA', `Received malformed metadata for "${spec.name}"`, { hint: 'This might mean that the package was unpublished from the registry', cause: err });
-    }
-}
-export function assertMetaHasTime(meta) {
-    if (meta.time == null) {
-        throw new PnpmError('MISSING_TIME', `The metadata of ${meta.name} is missing the "time" field`);
-    }
-}
-function parseModifiedDate(modified) {
-    if (!modified)
-        return null;
-    const date = new Date(modified);
-    if (Number.isNaN(date.getTime()))
-        return null;
-    return date;
-}
-const semverRangeCache = new Map();
-// This is a performance optimization; working with string-ish semver
-// causes lots of allocations and repeated work, but caching the Range
-// and ensuring we give it a SemVer instance greatly speeds things up.
-function semverSatisfiesLoose(version, range) {
-    let semverRange = semverRangeCache.get(range);
-    if (semverRange === undefined) {
-        try {
-            semverRange = new semver.Range(range, true);
-        }
-        catch {
-            semverRange = null;
-        }
-        semverRangeCache.set(range, semverRange);
-    }
-    if (semverRange) {
-        try {
-            return semverRange.test(new semver.SemVer(version, true));
-        }
-        catch {
-            return false;
-        }
-    }
-    return false;
-}
-export function pickLowestVersionByVersionRange({ meta, versionRange, preferredVersionSelectors }) {
-    if (preferredVersionSelectors != null && Object.keys(preferredVersionSelectors).length > 0) {
-        const prioritizedPreferredVersions = prioritizePreferredVersions(meta, versionRange, preferredVersionSelectors);
-        for (const preferredVersions of prioritizedPreferredVersions) {
-            const preferredVersion = semver.minSatisfying(preferredVersions, versionRange, true);
-            if (preferredVersion) {
-                return preferredVersion;
-            }
-        }
-    }
-    if (versionRange === '*') {
-        return Object.keys(meta.versions).sort(semver.compare)[0];
-    }
-    return semver.minSatisfying(Object.keys(meta.versions), versionRange, true);
-}
-export function pickVersionByVersionRange({ meta, versionRange, preferredVersionSelectors }) {
-    const latest = meta['dist-tags'].latest;
-    if (preferredVersionSelectors != null && Object.keys(preferredVersionSelectors).length > 0) {
-        const prioritizedPreferredVersions = prioritizePreferredVersions(meta, versionRange, preferredVersionSelectors);
-        for (const preferredVersions of prioritizedPreferredVersions) {
-            if (preferredVersions.includes(latest) && semverSatisfiesLoose(latest, versionRange)) {
-                return latest;
-            }
-            const preferredVersion = semver.maxSatisfying(preferredVersions, versionRange, true);
-            if (preferredVersion) {
-                return preferredVersion;
-            }
-        }
-    }
-    const versions = Object.keys(meta.versions);
-    if (latest && (versionRange === '*' || semverSatisfiesLoose(latest, versionRange))) {
-        // Not using semver.satisfies in case of * because it does not select beta versions.
-        // E.g.: 1.0.0-beta.1. See issue: https://github.com/pnpm/pnpm/issues/865
-        return latest;
-    }
-    const maxVersion = semver.maxSatisfying(versions, versionRange, true);
-    // if the selected version is deprecated, try to find a non-deprecated one that satisfies the range
-    if (maxVersion && meta.versions[maxVersion].deprecated && versions.length > 1) {
-        const nonDeprecatedVersions = versions.map((version) => meta.versions[version])
-            .filter((versionMeta) => !versionMeta.deprecated)
-            .map((versionMeta) => versionMeta.version);
-        const maxNonDeprecatedVersion = semver.maxSatisfying(nonDeprecatedVersions, versionRange, true);
-        if (maxNonDeprecatedVersion)
-            return maxNonDeprecatedVersion;
-    }
-    return maxVersion;
-}
-function prioritizePreferredVersions(meta, versionRange, preferredVerSelectors) {
-    const preferredVerSelectorsArr = Object.entries(preferredVerSelectors ?? {});
-    const versionsPrioritizer = new PreferredVersionsPrioritizer();
-    // First, add all versions that satisfy versionRange with default weight 0
-    for (const version of Object.keys(meta.versions)) {
-        if (semverSatisfiesLoose(version, versionRange)) {
-            versionsPrioritizer.add(version, 0);
-        }
-    }
-    // Then apply weights from preferred selectors
-    for (const [preferredSelector, preferredSelectorType] of preferredVerSelectorsArr) {
-        const { selectorType, weight } = typeof preferredSelectorType === 'string'
-            ? { selectorType: preferredSelectorType, weight: 1 }
-            : preferredSelectorType;
-        if (preferredSelector === versionRange)
-            continue;
-        switch (selectorType) {
-            case 'tag': {
-                versionsPrioritizer.add(meta['dist-tags'][preferredSelector], weight);
-                break;
-            }
-            case 'range': {
-                const versions = Object.keys(meta.versions);
-                for (const version of versions) {
-                    if (semverSatisfiesLoose(version, preferredSelector)) {
-                        versionsPrioritizer.add(version, weight);
-                    }
-                }
-                break;
-            }
-            case 'version': {
-                if (meta.versions[preferredSelector]) {
-                    versionsPrioritizer.add(preferredSelector, weight);
-                }
-                break;
-            }
-        }
-    }
-    return versionsPrioritizer.versionsByPriority();
-}
-class PreferredVersionsPrioritizer {
-    preferredVersions = {};
-    add(version, weight) {
-        if (!this.preferredVersions[version]) {
-            this.preferredVersions[version] = weight;
-        }
-        else {
-            this.preferredVersions[version] += weight;
-        }
-    }
-    versionsByPriority() {
-        const versionsByWeight = Object.entries(this.preferredVersions)
-            .reduce((acc, [version, weight]) => {
-            acc[weight] = acc[weight] ?? [];
-            acc[weight].push(version);
-            return acc;
-        }, {});
-        return Object.keys(versionsByWeight)
-            .sort((a, b) => parseInt(b, 10) - parseInt(a, 10))
-            .map((weight) => versionsByWeight[parseInt(weight, 10)]);
-    }
-}
-//# sourceMappingURL=pickPackageFromMeta.js.map

package/lib/toRaw.d.ts

@@ -1,2 +0,0 @@
-import type { RegistryPackageSpec } from './parseBareSpecifier.js';
-export declare function toRaw(spec: RegistryPackageSpec): string;

package/lib/toRaw.js

@@ -1,4 +0,0 @@
-export function toRaw(spec) {
-    return `${spec.name}@${spec.fetchSpec}`;
-}
-//# sourceMappingURL=toRaw.js.map

package/lib/trustChecks.d.ts

@@ -1,9 +0,0 @@
-import type { PackageInRegistry, PackageMeta } from '@pnpm/resolving.registry.types';
-import type { PackageVersionPolicy } from '@pnpm/types';
-type TrustEvidence = 'provenance' | 'trustedPublisher' | 'stagedPublish';
-export declare function failIfTrustDowngraded(meta: PackageMeta, version: string, opts?: {
-    trustPolicyExclude?: PackageVersionPolicy;
-    trustPolicyIgnoreAfter?: number;
-}): void;
-export declare function getTrustEvidence(manifest: PackageInRegistry): TrustEvidence | undefined;
-export {};

package/lib/trustChecks.js

@@ -1,96 +0,0 @@
-import { PnpmError } from '@pnpm/error';
-import semver from 'semver';
-import { assertMetaHasTime } from './pickPackageFromMeta.js';
-const TRUST_RANK = {
-    stagedPublish: 3,
-    trustedPublisher: 2,
-    provenance: 1,
-};
-export function failIfTrustDowngraded(meta, version, opts) {
-    if (opts?.trustPolicyExclude) {
-        const excludeResult = opts.trustPolicyExclude(meta.name);
-        if (excludeResult === true) {
-            return;
-        }
-        if (Array.isArray(excludeResult) && excludeResult.includes(version)) {
-            return;
-        }
-    }
-    assertMetaHasTime(meta);
-    const versionPublishedAt = meta.time[version];
-    if (!versionPublishedAt) {
-        throw new PnpmError('TRUST_CHECK_FAIL', `Missing time for version ${version} of ${meta.name} in metadata`);
-    }
-    const versionDate = new Date(versionPublishedAt);
-    if (opts?.trustPolicyIgnoreAfter) {
-        const now = new Date();
-        const minutesSincePublish = (now.getTime() - versionDate.getTime()) / (1000 * 60);
-        if (minutesSincePublish > opts.trustPolicyIgnoreAfter) {
-            return;
-        }
-    }
-    const manifest = meta.versions[version];
-    if (!manifest) {
-        throw new PnpmError('TRUST_CHECK_FAIL', `Missing version object for version ${version} of ${meta.name} in metadata`);
-    }
-    const strongestEvidencePriorToRequestedVersion = detectStrongestTrustEvidenceBeforeDate(meta, versionDate, {
-        excludePrerelease: !semver.prerelease(version, true),
-    });
-    if (strongestEvidencePriorToRequestedVersion == null) {
-        return;
-    }
-    const currentTrustEvidence = getTrustEvidence(manifest);
-    if (currentTrustEvidence == null || TRUST_RANK[strongestEvidencePriorToRequestedVersion] > TRUST_RANK[currentTrustEvidence]) {
-        throw new PnpmError('TRUST_DOWNGRADE', `High-risk trust downgrade for "${meta.name}@${version}" (possible package takeover)`, {
-            hint: 'Trust checks are based solely on publish date, not semver. ' +
-                'A package cannot be installed if any earlier-published version had stronger trust evidence. ' +
-                `Earlier versions had ${prettyPrintTrustEvidence(strongestEvidencePriorToRequestedVersion)}, ` +
-                `but this version has ${prettyPrintTrustEvidence(currentTrustEvidence)}. ` +
-                'A trust downgrade may indicate a supply chain incident.',
-        });
-    }
-}
-function prettyPrintTrustEvidence(trustEvidence) {
-    switch (trustEvidence) {
-        case 'stagedPublish': return 'staged publish';
-        case 'trustedPublisher': return 'trusted publisher';
-        case 'provenance': return 'provenance attestation';
-        default: return 'no trust evidence';
-    }
-}
-function detectStrongestTrustEvidenceBeforeDate(meta, beforeDate, options) {
-    let best;
-    for (const [version, manifest] of Object.entries(meta.versions)) {
-        if (options.excludePrerelease && semver.prerelease(version, true))
-            continue;
-        const ts = meta.time[version];
-        if (!ts)
-            continue;
-        const publishedAt = new Date(ts);
-        if (!(publishedAt < beforeDate))
-            continue;
-        const trustEvidence = getTrustEvidence(manifest);
-        if (!trustEvidence)
-            continue;
-        if (best === undefined || TRUST_RANK[trustEvidence] > TRUST_RANK[best]) {
-            best = trustEvidence;
-            if (best === 'stagedPublish') {
-                return best;
-            }
-        }
-    }
-    return best;
-}
-export function getTrustEvidence(manifest) {
-    if (manifest._npmUser?.approver) {
-        return 'stagedPublish';
-    }
-    if (manifest._npmUser?.trustedPublisher && manifest.dist?.attestations?.provenance) {
-        return 'trustedPublisher';
-    }
-    if (manifest.dist?.attestations?.provenance) {
-        return 'provenance';
-    }
-    return undefined;
-}
-//# sourceMappingURL=trustChecks.js.map

package/lib/violationCodes.d.ts

@@ -1,14 +0,0 @@
-/**
- * Violation codes the npm resolver attaches to
- * `ResolutionPolicyViolation.code` when an inline policy check rejects
- * a pick. Exported so downstream code (the install command, the strict
- * resolver wrapper, tests) references one source of truth instead of
- * re-typing the string.
- *
- * Lives in its own module — both `index.ts` and `createNpmResolutionVerifier.ts`
- * import it, so keeping the constants here avoids a cycle.
- */
-export declare const MINIMUM_RELEASE_AGE_VIOLATION_CODE = "MINIMUM_RELEASE_AGE_VIOLATION";
-export declare const TRUST_DOWNGRADE_VIOLATION_CODE = "TRUST_DOWNGRADE";
-export declare const TARBALL_URL_MISMATCH_VIOLATION_CODE = "TARBALL_URL_MISMATCH";
-export declare const MISSING_TARBALL_INTEGRITY_VIOLATION_CODE = "MISSING_TARBALL_INTEGRITY";

package/lib/violationCodes.js

@@ -1,15 +0,0 @@
-/**
- * Violation codes the npm resolver attaches to
- * `ResolutionPolicyViolation.code` when an inline policy check rejects
- * a pick. Exported so downstream code (the install command, the strict
- * resolver wrapper, tests) references one source of truth instead of
- * re-typing the string.
- *
- * Lives in its own module — both `index.ts` and `createNpmResolutionVerifier.ts`
- * import it, so keeping the constants here avoids a cycle.
- */
-export const MINIMUM_RELEASE_AGE_VIOLATION_CODE = 'MINIMUM_RELEASE_AGE_VIOLATION';
-export const TRUST_DOWNGRADE_VIOLATION_CODE = 'TRUST_DOWNGRADE';
-export const TARBALL_URL_MISMATCH_VIOLATION_CODE = 'TARBALL_URL_MISMATCH';
-export const MISSING_TARBALL_INTEGRITY_VIOLATION_CODE = 'MISSING_TARBALL_INTEGRITY';
-//# sourceMappingURL=violationCodes.js.map

package/lib/whichVersionIsPinned.d.ts

@@ -1,2 +0,0 @@
-import type { PinnedVersion } from '@pnpm/types';
-export declare function whichVersionIsPinned(spec: string): PinnedVersion | undefined;

package/lib/whichVersionIsPinned.js

@@ -1,36 +0,0 @@
-import { parseRange } from 'semver-utils';
-export function whichVersionIsPinned(spec) {
-    // A catalog reference carries no version pinning of its own; the pinning is
-    // defined by the catalog entry it points to. Bail out so a catalog name that
-    // happens to look like a version (e.g. "catalog:express4-21") isn't misread
-    // as a pinned version.
-    if (spec.startsWith('catalog:'))
-        return undefined;
-    const colonIndex = spec.indexOf(':');
-    if (colonIndex !== -1) {
-        spec = spec.substring(colonIndex + 1);
-    }
-    const index = spec.lastIndexOf('@');
-    if (index !== -1) {
-        spec = spec.slice(index + 1);
-    }
-    if (spec === '*')
-        return 'none';
-    const parsedRange = parseRange(spec);
-    if (parsedRange.length !== 1)
-        return undefined;
-    const versionObject = parsedRange[0];
-    switch (versionObject.operator) {
-        case '~': return 'minor';
-        case '^': return 'major';
-        case undefined:
-            if (versionObject.patch)
-                return 'patch';
-            if (versionObject.minor)
-                return 'minor';
-            if (versionObject.major)
-                return 'major';
-    }
-    return undefined;
-}
-//# sourceMappingURL=whichVersionIsPinned.js.map

package/lib/workspacePrefToNpm.d.ts

@@ -1 +0,0 @@
-export declare function workspacePrefToNpm(workspaceBareSpecifier: string): string;

package/lib/workspacePrefToNpm.js

@@ -1,13 +0,0 @@
-import { WorkspaceSpec } from '@pnpm/workspace.spec-parser';
-export function workspacePrefToNpm(workspaceBareSpecifier) {
-    const parseResult = WorkspaceSpec.parse(workspaceBareSpecifier);
-    if (parseResult == null) {
-        throw new Error(`Invalid workspace spec: ${workspaceBareSpecifier}`);
-    }
-    const { alias, version } = parseResult;
-    const versionPart = version === '^' || version === '~' || version === '' ? '*' : version;
-    return alias
-        ? `npm:${alias}@${versionPart}`
-        : versionPart;
-}
-//# sourceMappingURL=workspacePrefToNpm.js.map