@pnpm/resolving.npm-resolver 1102.1.7 → 1102.1.9

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # @pnpm/npm-resolver
 
+## 1102.1.9
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/config.pick-registry-for-package@1100.0.13
+  - @pnpm/config.version-policy@1100.1.10
+  - @pnpm/core-loggers@1100.3.0
+  - @pnpm/resolving.registry.pkg-metadata-filter@1100.0.13
+  - @pnpm/resolving.registry.types@1100.1.7
+  - @pnpm/resolving.resolver-base@1100.5.5
+  - @pnpm/store.cafs@1100.1.16
+  - @pnpm/types@1101.7.0
+
+## 1102.1.8
+
+### Patch Changes
+
+- Republished every package: the tarballs published by the v11.13.1 through v11.16.0 releases were missing most of their compiled files due to a packing bug [#13164](https://github.com/pnpm/pnpm/issues/13164).
+
+- Updated dependencies:
+  - @pnpm/config.pick-registry-for-package@1100.0.12
+  - @pnpm/config.version-policy@1100.1.9
+  - @pnpm/constants@1100.0.1
+  - @pnpm/core-loggers@1100.2.5
+  - @pnpm/crypto.hash@1100.0.2
+  - @pnpm/error@1100.1.0
+  - @pnpm/fetching.types@1100.0.3
+  - @pnpm/fs.graceful-fs@1100.1.1
+  - @pnpm/resolving.jsr-specifier-parser@1100.0.3
+  - @pnpm/resolving.registry.pkg-metadata-filter@1100.0.12
+  - @pnpm/resolving.registry.types@1100.1.6
+  - @pnpm/resolving.resolver-base@1100.5.4
+  - @pnpm/store.cafs@1100.1.15
+  - @pnpm/store.index@1100.2.2
+  - @pnpm/types@1101.6.0
+  - @pnpm/workspace.range-resolver@1100.0.3
+  - @pnpm/workspace.spec-parser@1100.0.1
+
 ## 1102.1.7
 
 ### Patch Changes

package/lib/clearMeta.d.ts

@@ -0,0 +1,24 @@
+import type { PackageMeta } from '@pnpm/resolving.registry.types';
+/**
+ * Reduces a package metadata document to the abbreviated field set that the
+ * resolver actually reads, dropping install-irrelevant fields (scripts,
+ * exports, readme, custom `_`-prefixed fields, etc.). Retaining unstripped
+ * full documents — tens of MB parsed for a popular package — is what drove
+ * large installs out of memory (https://github.com/pnpm/pnpm/issues/8441).
+ * `etag` is carried over so a condensed document can still answer
+ * conditional-request headers.
+ *
+ * Null-safe on `versions` so it can be called on an unpublished package (no
+ * versions), which the abbreviated path can reach.
+ */
+export declare function clearMeta(pkg: PackageMeta): PackageMeta;
+/**
+ * Whether a resolver keeps full packuments rather than condensing them with
+ * {@link clearMeta}: only `fullMetadata` without `filterMetadata`, whose
+ * consumers read fields outside the abbreviated set (`pnpm outdated --long`
+ * shows description/homepage).
+ */
+export declare function retainsFullMeta(opts: {
+    fullMetadata?: boolean;
+    filterMetadata?: boolean;
+}): boolean;

package/lib/clearMeta.js

@@ -0,0 +1,76 @@
+import { pick } from 'ramda';
+// The list taken from https://github.com/npm/registry/blob/master/docs/responses/package-metadata.md#abbreviated-version-object
+// with the addition of 'libc'
+const ABBREVIATED_VERSION_FIELDS = [
+    'name',
+    'version',
+    'bin',
+    'directories',
+    'devDependencies',
+    'optionalDependencies',
+    'dependencies',
+    'peerDependencies',
+    'dist',
+    'engines',
+    'peerDependenciesMeta',
+    'cpu',
+    'os',
+    'libc',
+    'deprecated',
+    'bundleDependencies',
+    'bundledDependencies',
+    'hasInstallScript',
+    '_npmUser',
+];
+// Memoized by input identity: several layers condense the same parsed
+// document, and the WeakMap makes them share one condensed copy instead of
+// pinning one each. Outputs map to themselves so re-condensing is the
+// identity.
+const condensedPackuments = new WeakMap();
+/**
+ * Reduces a package metadata document to the abbreviated field set that the
+ * resolver actually reads, dropping install-irrelevant fields (scripts,
+ * exports, readme, custom `_`-prefixed fields, etc.). Retaining unstripped
+ * full documents — tens of MB parsed for a popular package — is what drove
+ * large installs out of memory (https://github.com/pnpm/pnpm/issues/8441).
+ * `etag` is carried over so a condensed document can still answer
+ * conditional-request headers.
+ *
+ * Null-safe on `versions` so it can be called on an unpublished package (no
+ * versions), which the abbreviated path can reach.
+ */
+export function clearMeta(pkg) {
+    const memoized = condensedPackuments.get(pkg);
+    if (memoized != null)
+        return memoized;
+    // A null prototype so that a registry-controlled version key named
+    // `__proto__` becomes a regular own property instead of mutating the
+    // prototype of the map (js/prototype-polluting-assignment).
+    const versions = Object.create(null);
+    for (const [version, info] of Object.entries(pkg.versions ?? {})) {
+        versions[version] = pick(ABBREVIATED_VERSION_FIELDS, info);
+    }
+    const condensed = {
+        name: pkg.name,
+        'dist-tags': pkg['dist-tags'],
+        versions,
+        time: pkg.time,
+        modified: pkg.modified,
+    };
+    if (pkg.etag != null) {
+        condensed.etag = pkg.etag;
+    }
+    condensedPackuments.set(pkg, condensed);
+    condensedPackuments.set(condensed, condensed);
+    return condensed;
+}
+/**
+ * Whether a resolver keeps full packuments rather than condensing them with
+ * {@link clearMeta}: only `fullMetadata` without `filterMetadata`, whose
+ * consumers read fields outside the abbreviated set (`pnpm outdated --long`
+ * shows description/homepage).
+ */
+export function retainsFullMeta(opts) {
+    return opts.fullMetadata === true && opts.filterMetadata !== true;
+}
+//# sourceMappingURL=clearMeta.js.map

package/lib/createNpmResolutionVerifier.d.ts

@@ -0,0 +1,89 @@
+import type { GetAuthHeader } from '@pnpm/fetching.types';
+import { type ResolutionVerifier } from '@pnpm/resolving.resolver-base';
+import type { Registries, TrustPolicy } from '@pnpm/types';
+import type { FetchMetadataFromFromRegistryOptions } from './fetch.js';
+import { type FetchFullMetadataCachedOptions } from './fetchFullMetadataCached.js';
+import type { PackageMetaCache } from './pickPackage.js';
+export interface CreateNpmResolutionVerifierOptions {
+    /**
+     * Minimum age (in minutes) a published version must reach before it is
+     * accepted. When unset, the verifier is a no-op for the age check.
+     */
+    minimumReleaseAge?: number;
+    /**
+     * Retained on the options bag because the resolver path branches on it
+     * (the lowest-version fallback) and tests forward both fields together.
+     * The verifier itself no longer gates on this flag — once the loose-mode
+     * auto-collect makes every accepted-immature pin explicit in
+     * `minimumReleaseAgeExclude`, running the verifier in loose mode is the
+     * thing that proves the manifest stays in sync with the lockfile.
+     */
+    minimumReleaseAgeStrict?: boolean;
+    minimumReleaseAgeExclude?: string[];
+    /**
+     * When the registry's metadata lacks the per-version `time` field
+     * (some self-hosted registries strip it), the verifier can't apply
+     * the maturity cutoff. Set this to `true` to mirror the resolver's
+     * `pickMatchingVersionFinal` warn-and-skip behavior — the verifier
+     * passes the entry with a one-time `globalWarn`, instead of failing
+     * closed. Defaults to `false` so the verifier stays stricter than
+     * the resolver only when the user has explicitly opted in to the
+     * skip on the resolver side.
+     */
+    ignoreMissingTimeField?: boolean;
+    /**
+     * `'no-downgrade'` rejects a lockfile entry whose version has weaker
+     * trust evidence (no attestations) than an earlier-published version
+     * had. This mirrors the resolver-time `failIfTrustDowngraded` check
+     * applied during fresh resolution — the verifier catches the same
+     * supply-chain signal on entries that bypassed resolution (peek-path,
+     * frozen lockfile, etc.).
+     */
+    trustPolicy?: TrustPolicy;
+    trustPolicyExclude?: string[];
+    trustPolicyIgnoreAfter?: number;
+    registries: Registries;
+    /**
+     * Registries reached via the named-registry resolver chain (e.g. `gh:` →
+     * GitHub Packages). When a lockfile entry's tarball URL falls under one of
+     * these registry base URLs, route the manifest fetch there instead of the
+     * scope-derived default.
+     */
+    namedRegistries?: Record<string, string>;
+    /**
+     * Cache-aware full-metadata fetcher. Decoupled from the resolver pipeline
+     * so abbreviated metadata and `peekManifestFromStore` fast paths cannot
+     * hide the publish timestamp.
+     */
+    fetchOpts: FetchMetadataFromFromRegistryOptions;
+    getAuthHeaderValueByURI: GetAuthHeader;
+    cacheDir?: FetchFullMetadataCachedOptions['cacheDir'];
+    /**
+     * Per-install LRU shared with the npm resolver's `pickPackage`
+     * (`{ get, set }` over `PackageMeta`). When provided, the verifier
+     * consults it before fetching: a name the resolver already pulled
+     * during the same install yields the cached packument instead of a
+     * fresh disk/network round-trip. Optional — frozen-install paths and
+     * unit tests don't have a resolver running alongside, in which case
+     * the verifier falls back to its own fetch chain.
+     */
+    metaCache?: PackageMetaCache;
+    /** Overrides Date.now() for tests. */
+    now?: number;
+}
+/**
+ * Returns a `ResolutionVerifier` for npm-registry-resolved lockfile
+ * entries. It always binds each entry's recorded tarball URL to the
+ * artifact the registry's metadata lists (an anti-tamper check that does
+ * not depend on any policy), and additionally re-applies the
+ * `minimumReleaseAge` and/or `trustPolicy='no-downgrade'` policies when
+ * those are configured. Pairs with `createNpmResolver`: each resolver
+ * factory may export a sibling verifier factory that the default-resolver
+ * combines.
+ *
+ * Designed for fail-closed semantics: if the manifest can't be loaded or
+ * the pinned version is missing from it, the verifier reports a violation
+ * rather than silently passing. Mirrors the post-resolution gate bun added
+ * for the same shape of bug in oven-sh/bun#30526.
+ */
+export declare function createNpmResolutionVerifier(opts: CreateNpmResolutionVerifierOptions): ResolutionVerifier;