@pnpm/resolving.npm-resolver 1103.1.0 → 1103.2.1

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # @pnpm/npm-resolver
 
+## 1103.2.1
+
+### Patch Changes
+
+- `pnpm add` no longer re-resolves the dependency graph when `pnpm-lock.yaml` already holds a version satisfying the request — promoting a transitive dependency to a direct one, or adding to a second workspace package what a first one already depends on, now only saves the dependency in `package.json` and records its importer entry. A satisfying locked version is necessary but not sufficient: the install still falls back to a full resolution for a dist tag, an alias, a `workspace:`/`catalog:`/git/tarball specifier, `--save-peer`, an overridden package, a `catalogMode` other than `manual`, and — under `resolutionMode: time-based` or `lowest-direct`, which resolve a direct dependency to the low end of its range — a range several locked versions satisfy.
+
+- `resolutionMode` is no longer ignored when `minimumReleaseAge` is in effect. `lowest-direct` and `time-based` pick the lowest satisfying version of a direct dependency again; previously any active release-age cutoff — including the built-in default — silently forced the highest, so `resolutionMode` only worked when `minimumReleaseAge: 0` was set explicitly [#13752](https://github.com/pnpm/pnpm/issues/13752).
+
+- Updated dependencies:
+  - @pnpm/config.version-policy@1100.2.0
+  - @pnpm/error@1100.1.2
+  - @pnpm/pkg-manifest.utils@1100.4.0
+  - @pnpm/resolving.jsr-specifier-parser@1100.0.5
+  - @pnpm/store.cafs@1100.1.19
+  - @pnpm/store.index@1100.2.4
+
+## 1103.2.0
+
+### Minor Changes
+
+- Lockfile verification now honors offline mode by using cached registry metadata instead of reaching the registry. When the required metadata is not available locally, verification reports the same `ERR_PNPM_NO_OFFLINE_META` condition used by offline resolution.
+
+### Patch Changes
+
+- The held-back-update warning printed by `pnpm update` no longer fires when `minimumReleaseAge` is the actual reason a newer version was not picked. The warning's baseline now applies the same maturity cutoff as the pick itself, so it no longer wrongly attributes the hold-back to "your manifests and already installed dependencies" or recommends an override that would defeat the age gate. See pnpm/pnpm#13071.
+
+- Updated dependencies:
+  - @pnpm/resolving.registry.pkg-metadata-filter@1100.0.16
+
 ## 1103.1.0
 
 ### Minor Changes

package/lib/createNpmResolutionVerifier.d.ts

@@ -58,6 +58,11 @@ export interface CreateNpmResolutionVerifierOptions {
     fetchOpts: FetchMetadataFromFromRegistryOptions;
     getAuthHeaderValueByURI: GetAuthHeader;
     cacheDir?: FetchFullMetadataCachedOptions['cacheDir'];
+    /**
+     * When true, verifier metadata lookups must use the local mirror
+     * only and never reach the registry or attestation endpoint.
+     */
+    offline?: boolean;
     /**
      * Per-install LRU shared with the npm resolver's `pickPackage`
      * (`{ get, set }` over `PackageMeta`). When provided, the verifier

package/lib/createNpmResolutionVerifier.js

@@ -53,6 +53,7 @@ export function createNpmResolutionVerifier(opts) {
         fetchOpts: opts.fetchOpts,
         getAuthHeaderValueByURI: opts.getAuthHeaderValueByURI,
         cacheDir: opts.cacheDir,
+        offline: opts.offline === true,
         cutoffMs: cutoff,
         sharedMetaCache: opts.metaCache,
         abbreviatedMetaCache: new Map(),
@@ -391,6 +392,7 @@ function fetchFullMetaForTrust(context, registry, name) {
                 registry,
                 authHeaderValue: context.getAuthHeaderValueByURI(registry, { pkgName: name }),
                 cacheDir: context.cacheDir,
+                offline: context.offline,
             }).then(projectTrustMeta);
         }
         context.fullMetaForTrustCache.set(cacheKey, cachedPromise);
@@ -485,12 +487,14 @@ async function resolvePublishedAt(context, registry, name, version) {
     const localTime = await readLocalMetaTime(context, registry, name);
     if (localTime?.[version])
         return localTime[version];
-    const attestationTime = await fetchAttestationPublishedAt(context.fetchOpts, name, version, {
-        registry,
-        authHeaderValue: context.getAuthHeaderValueByURI(registry, { pkgName: name }),
-    });
-    if (attestationTime != null)
-        return attestationTime;
+    if (!context.offline) {
+        const attestationTime = await fetchAttestationPublishedAt(context.fetchOpts, name, version, {
+            registry,
+            authHeaderValue: context.getAuthHeaderValueByURI(registry, { pkgName: name }),
+        });
+        if (attestationTime != null)
+            return attestationTime;
+    }
     const fullMetaTime = await fetchFullMetaTime(context, registry, name);
     return fullMetaTime?.[version];
 }
@@ -555,6 +559,7 @@ function fetchAbbreviatedMeta(context, registry, name) {
                 registry,
                 authHeaderValue: context.getAuthHeaderValueByURI(registry, { pkgName: name }),
                 cacheDir: context.cacheDir,
+                offline: context.offline,
             }).then((meta) => ({ meta: projectAbbreviatedMeta(meta) }), (error) => ({ error }));
         }
         context.abbreviatedMetaCache.set(cacheKey, cachedPromise);
@@ -646,6 +651,7 @@ function fetchFullMetaTime(context, registry, name) {
             registry,
             authHeaderValue: context.getAuthHeaderValueByURI(registry, { pkgName: name }),
             cacheDir: context.cacheDir,
+            offline: context.offline,
         }).then((meta) => meta.time);
         context.fullMetaCache.set(cacheKey, cachedPromise);
     }

package/lib/fetchFullMetadataCached.d.ts

@@ -10,6 +10,10 @@ export interface FetchMetadataCachedOptions {
      * back. Omit to disable caching — every call re-fetches.
      */
     cacheDir?: string;
+    /**
+     * Use only pnpm's on-disk metadata mirror and never reach the registry.
+     */
+    offline?: boolean;
 }
 export type FetchFullMetadataCachedOptions = FetchMetadataCachedOptions;
 /**

package/lib/fetchFullMetadataCached.js

@@ -1,4 +1,5 @@
 import { ABBREVIATED_META_DIR, FULL_META_DIR } from '@pnpm/constants';
+import { PnpmError } from '@pnpm/error';
 import { fetchMetadataFromFromRegistry, } from './fetch.js';
 import { getPkgMirrorPath, loadMeta, loadMetaHeaders, prepareJsonForDisk, saveMeta } from './pickPackage.js';
 /**
@@ -28,6 +29,14 @@ async function fetchMetadataCached(fetchOpts, pkgName, opts) {
     const pkgMirror = opts.cacheDir != null
         ? getPkgMirrorPath(opts.cacheDir, opts.metaDir, opts.registry, pkgName)
         : null;
+    if (opts.offline === true) {
+        if (pkgMirror != null) {
+            const cached = await loadMeta(pkgMirror);
+            if (cached != null)
+                return cached;
+        }
+        throw new PnpmError('NO_OFFLINE_META', `Failed to resolve ${pkgName} in package mirror ${pkgMirror ?? ''}`);
+    }
     const cacheHeaders = pkgMirror != null ? await loadMetaHeaders(pkgMirror) : null;
     const conditional = await fetchMetadataFromFromRegistry(fetchOpts, pkgName, {
         registry: opts.registry,

package/lib/index.d.ts

@@ -20,7 +20,6 @@ export declare class NoMatchingVersionError extends PnpmError {
 export declare function formatTimeAgo(date: Date): string | null;
 export { BUILTIN_NAMED_REGISTRIES, fetchMetadataFromFromRegistry, type FetchMetadataFromFromRegistryOptions, type PackageMeta, type PackageMetaCache, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, type RegistryPackageSpec, RegistryResponseError, workspacePrefToNpm, };
 export { createNpmResolutionVerifier, type CreateNpmResolutionVerifierOptions } from './createNpmResolutionVerifier.js';
-export { inferRangeSpecStyle } from './inferRangeSpecStyle.js';
 export { MINIMUM_RELEASE_AGE_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
 export interface ResolverFactoryOptions {
     cacheDir: string;

package/lib/index.js

@@ -3,7 +3,7 @@ import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
 import { isWellFormedRegistryName, RESERVED_VERSION_PREFIXES } from '@pnpm/deps.path';
 import { PnpmError } from '@pnpm/error';
 import { globalWarn } from '@pnpm/logger';
-import { rangeSpecGranularity, versionWithRangeSpecStyle } from '@pnpm/pkg-manifest.utils';
+import { calcVersionRange, inferRangeSpecStyle, rangeSpecGranularity, versionWithRangeSpecStyle } from '@pnpm/pkg-manifest.utils';
 import { EXISTING_VERSION_SELECTOR_WEIGHT, } from '@pnpm/resolving.resolver-base';
 import { storeIndexKey } from '@pnpm/store.index';
 import { readPkgFromCafs, } from '@pnpm/worker';
@@ -16,12 +16,11 @@ import ssri from 'ssri';
 import versionSelectorType from 'version-selector-type';
 import { clearMeta, retainsFullMeta } from './clearMeta.js';
 import { fetchMetadataFromFromRegistry, RegistryResponseError } from './fetch.js';
-import { inferRangeSpecStyle } from './inferRangeSpecStyle.js';
 import { memoizeFetchMetadata } from './memoizeFetchMetadata.js';
 import { normalizeRegistryUrl } from './normalizeRegistryUrl.js';
 import { BUILTIN_NAMED_REGISTRIES, parseBareSpecifier, parseJsrSpecifierToRegistryPackageSpec, parseNamedRegistrySpecifierToRegistryPackageSpec, } from './parseBareSpecifier.js';
 import { pickPackage, } from './pickPackage.js';
-import { pickPackageFromMeta, pickVersionByVersionRange } from './pickPackageFromMeta.js';
+import { applyPublishedByPolicy, pickPackageFromMeta, pickVersionByVersionRange } from './pickPackageFromMeta.js';
 import { failIfTrustDowngraded } from './trustChecks.js';
 import { MINIMUM_RELEASE_AGE_VIOLATION_CODE } from './violationCodes.js';
 import { workspacePrefToNpm } from './workspacePrefToNpm.js';
@@ -66,7 +65,6 @@ export function formatTimeAgo(date) {
 }
 export { BUILTIN_NAMED_REGISTRIES, fetchMetadataFromFromRegistry, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, RegistryResponseError, workspacePrefToNpm, };
 export { createNpmResolutionVerifier } from './createNpmResolutionVerifier.js';
-export { inferRangeSpecStyle } from './inferRangeSpecStyle.js';
 export { MINIMUM_RELEASE_AGE_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
 export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
     if (typeof opts.cacheDir !== 'string') {
@@ -212,7 +210,10 @@ function stripLockfileVersionPins(selectors) {
  * The baseline for "held back" is the pick with only the non-pin selectors
  * applied — `range`/`tag` selectors such as the `pnpm audit --fix`
  * vulnerability penalties steer the baseline too, so the warning never
- * recommends a version those selectors avoid.
+ * recommends a version those selectors avoid. The baseline also honors the
+ * `publishedBy` maturity cutoff the actual pick applied: a version blocked
+ * by `minimumReleaseAge` is not an update the manifests held back, and
+ * recommending an override for it would defeat the age gate.
  *
  * The recommended override is scoped to the declared range being resolved
  * (`name@<range>`), so applying it can never violate any consumer's range:
@@ -233,8 +234,14 @@ function warnOnceOnHeldBackUpdate(ctx, opts, spec, meta, pickedVersion) {
         nonPinSelectors ??= Object.create(null);
         nonPinSelectors[selector] = value;
     }
+    // `needsFullMetadata` is not this caller's problem: the pick already
+    // succeeded on this metadata, which for an abbreviated packument means
+    // every version cleared the cutoff, so `meta` is the filtered view.
+    const baselineMeta = opts.publishedBy != null
+        ? applyPublishedByPolicy(meta, opts.publishedBy, opts.publishedByExclude).meta
+        : meta;
     const preferred = pickVersionByVersionRange({
-        meta,
+        meta: baselineMeta,
         versionRange: spec.fetchSpec,
         preferredVersionSelectors: nonPinSelectors,
     });
@@ -657,14 +664,13 @@ function calcSpecifier({ wantedDependency, spec, version, defaultRangeSpecStyle,
         return range;
     return `npm:${spec.name}@${range}`;
 }
+/** The manifest range `version` is saved as; see {@link calcVersionRange}. */
 function calcRange(version, wantedDependency, defaultRangeSpecStyle) {
-    if (semver.parse(version)?.prerelease.length) {
-        return version;
-    }
-    const rangeSpecStyle = (wantedDependency.prevSpecifier ? inferRangeSpecStyle(wantedDependency.prevSpecifier) : undefined) ??
-        (wantedDependency.bareSpecifier ? inferRangeSpecStyle(wantedDependency.bareSpecifier) : undefined) ??
-        defaultRangeSpecStyle;
-    return versionWithRangeSpecStyle(version, rangeSpecStyle ?? 'major');
+    return calcVersionRange(version, {
+        prevSpecifier: wantedDependency.prevSpecifier,
+        bareSpecifier: wantedDependency.bareSpecifier,
+        defaultRangeSpecStyle,
+    });
 }
 function tryResolveFromWorkspace(wantedDependency, opts) {
     if (!wantedDependency.bareSpecifier?.startsWith('workspace:')) {

package/lib/pickPackage.js

@@ -58,15 +58,17 @@ function pickMax(a, b) {
 }
 const pickHighest = pickPackageFromMeta.bind(null, pickVersionByVersionRange);
 const pickLowest = pickPackageFromMeta.bind(null, pickLowestVersionByVersionRange);
-// When minimumReleaseAge is active: try the highest mature version; if none
-// satisfies the range, fall back to the lowest version regardless of maturity
-// so the resolver can report the violation inline and let the install layer
-// (or other caller) decide what to do — never throw at this layer.
+// `minimumReleaseAge` narrows which versions are on offer; `pickLowestVersion`
+// decides which end of what is left to take. The fallback deliberately drops
+// the maturity filter so a range no mature version satisfies still yields a
+// pick, which the install layer reports as a violation rather than this layer
+// throwing.
 function pickRespectingMinReleaseAge(pickerOpts, spec, meta) {
     return runPicker(pickerOpts, spec, (targetSpec) => {
-        const highest = pickHighest(pickerOpts, meta, targetSpec);
-        if (highest)
-            return highest;
+        const pickMature = pickerOpts.pickLowestVersion ? pickLowest : pickHighest;
+        const mature = pickMature(pickerOpts, meta, targetSpec);
+        if (mature)
+            return mature;
         return pickLowest({
             preferredVersionSelectors: pickerOpts.preferredVersionSelectors,
         }, meta, targetSpec);

package/lib/pickPackageFromMeta.d.ts

@@ -15,6 +15,29 @@ export interface PickPackageFromMetaOptions {
     publishedByExclude?: PackageVersionPolicy;
 }
 export declare function pickPackageFromMeta(pickVersionByVersionRangeFn: PickVersionByVersionRange, { preferredVersionSelectors, publishedBy, publishedByExclude, }: PickPackageFromMetaOptions, meta: PackageMeta, spec: RegistryPackageSpec): PackageInRegistry | null;
+export interface PublishedByView {
+    /** The metadata the cutoff leaves visible. `meta` itself when nothing is filtered out. */
+    meta: PackageMeta;
+    /**
+     * The cutoff could not be applied: the metadata is abbreviated, so there
+     * are no per-version timestamps to filter on. Whether that is fatal is the
+     * caller's call — the pick needs full metadata to honor the cutoff, while a
+     * caller reasoning about a pick that already succeeded knows the versions
+     * cleared the cutoff some other way.
+     */
+    needsFullMetadata: boolean;
+}
+/**
+ * Narrows `meta` to the versions the `publishedBy` cutoff admits, honoring
+ * `publishedByExclude`: a package the policy excludes wholesale keeps its
+ * unfiltered metadata, and versions the policy names explicitly stay in
+ * regardless of their age.
+ *
+ * Every consumer of the cutoff goes through here so they agree on what the
+ * policy admits — a baseline that filters differently from the pick would
+ * misreport why a version was chosen.
+ */
+export declare function applyPublishedByPolicy(meta: PackageMeta, publishedBy: Date, publishedByExclude?: PackageVersionPolicy): PublishedByView;
 export declare function assertMetaHasTime(meta: PackageMeta): asserts meta is PackageMetaWithTime;
 export declare function pickLowestVersionByVersionRange({ meta, versionRange, preferredVersionSelectors }: PickVersionByVersionRangeOptions): string | null;
 export declare function pickVersionByVersionRange({ meta, versionRange, preferredVersionSelectors }: PickVersionByVersionRangeOptions): string | null;

package/lib/pickPackageFromMeta.js

@@ -4,28 +4,20 @@ import { filterPkgMetadataByPublishDate } from '@pnpm/resolving.registry.pkg-met
 import semver from 'semver';
 export function pickPackageFromMeta(pickVersionByVersionRangeFn, { preferredVersionSelectors, publishedBy, publishedByExclude, }, meta, spec) {
     if (publishedBy) {
-        const excludeResult = publishedByExclude?.(meta.name) ?? false;
-        if (excludeResult !== true) {
-            if (meta.time != null) {
-                // Full metadata with per-version timestamps: filter normally
+        const view = applyPublishedByPolicy(meta, publishedBy, publishedByExclude);
+        meta = view.meta;
+        if (view.needsFullMetadata) {
+            const modifiedDate = parseModifiedDate(meta.modified);
+            if (modifiedDate == null || modifiedDate > publishedBy) {
+                // The package was modified after the cutoff (or carries no usable
+                // `modified`), so which of its versions are mature is unknowable
+                // from abbreviated metadata. The error tells the caller to refetch.
                 assertMetaHasTime(meta);
-                const trustedVersions = Array.isArray(excludeResult) ? excludeResult : undefined;
-                meta = filterPkgMetadataByPublishDate(meta, publishedBy, trustedVersions);
-            }
-            else {
-                const modifiedDate = parseModifiedDate(meta.modified);
-                if (modifiedDate == null || modifiedDate > publishedBy) {
-                    // Abbreviated metadata without per-version timestamps, and the package
-                    // was recently modified (or has no/invalid modified field). We cannot determine
-                    // which individual versions are mature enough — need full metadata.
-                    assertMetaHasTime(meta);
-                }
-                // else: meta.modified <= publishedBy — every version was published at or
-                // before the cutoff (modified is an upper bound on per-version time), so
-                // they all pass the per-version `<=` maturity filter and no filtering is
-                // needed. Inclusive at the boundary on purpose so this branch matches the
-                // per-version filter in `filterPkgMetadataByPublishDate`.
             }
+            // else: `modified` is an upper bound on every per-version timestamp, so
+            // `modified <= publishedBy` means they all pass the maturity filter and
+            // nothing would be dropped. Inclusive at the boundary on purpose, to
+            // match the per-version `<=` in `filterPkgMetadataByPublishDate`.
         }
     }
     if ((!meta.versions || Object.keys(meta.versions).length === 0) && !publishedBy) {
@@ -77,6 +69,29 @@ export function pickPackageFromMeta(pickVersionByVersionRangeFn, { preferredVers
         throw new PnpmError('MALFORMED_METADATA', `Received malformed metadata for "${spec.name}"`, { hint: 'This might mean that the package was unpublished from the registry', cause: err });
     }
 }
+/**
+ * Narrows `meta` to the versions the `publishedBy` cutoff admits, honoring
+ * `publishedByExclude`: a package the policy excludes wholesale keeps its
+ * unfiltered metadata, and versions the policy names explicitly stay in
+ * regardless of their age.
+ *
+ * Every consumer of the cutoff goes through here so they agree on what the
+ * policy admits — a baseline that filters differently from the pick would
+ * misreport why a version was chosen.
+ */
+export function applyPublishedByPolicy(meta, publishedBy, publishedByExclude) {
+    const excludeResult = publishedByExclude?.(meta.name) ?? false;
+    if (excludeResult === true)
+        return { meta, needsFullMetadata: false };
+    if (meta.time == null)
+        return { meta, needsFullMetadata: true };
+    assertMetaHasTime(meta);
+    const trustedVersions = Array.isArray(excludeResult) ? excludeResult : undefined;
+    return {
+        meta: filterPkgMetadataByPublishDate(meta, publishedBy, trustedVersions),
+        needsFullMetadata: false,
+    };
+}
 export function assertMetaHasTime(meta) {
     if (meta.time == null) {
         throw new PnpmError('MISSING_TIME', `The metadata of ${meta.name} is missing the "time" field`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.npm-resolver",
-  "version": "1103.1.0",
+  "version": "1103.2.1",
   "description": "Resolver for npm-hosted packages",
   "keywords": [
     "pnpm",
@@ -31,21 +31,21 @@
   "dependencies": {
     "@pnpm/config.normalize-registries": "1100.1.0",
     "@pnpm/config.pick-registry-for-package": "1100.1.0",
-    "@pnpm/config.version-policy": "1100.1.12",
+    "@pnpm/config.version-policy": "1100.2.0",
     "@pnpm/constants": "1101.0.0",
     "@pnpm/core-loggers": "1100.3.2",
     "@pnpm/crypto.hash": "1100.0.2",
     "@pnpm/deps.path": "1100.1.0",
-    "@pnpm/error": "1100.1.1",
+    "@pnpm/error": "1100.1.2",
     "@pnpm/fetching.types": "1100.0.3",
     "@pnpm/fs.graceful-fs": "1100.1.1",
-    "@pnpm/pkg-manifest.utils": "1100.3.1",
-    "@pnpm/resolving.jsr-specifier-parser": "1100.0.4",
-    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.15",
+    "@pnpm/pkg-manifest.utils": "1100.4.0",
+    "@pnpm/resolving.jsr-specifier-parser": "1100.0.5",
+    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.16",
     "@pnpm/resolving.registry.types": "1100.1.9",
     "@pnpm/resolving.resolver-base": "1101.1.0",
-    "@pnpm/store.cafs": "1100.1.18",
-    "@pnpm/store.index": "1100.2.3",
+    "@pnpm/store.cafs": "1100.1.19",
+    "@pnpm/store.index": "1100.2.4",
     "@pnpm/types": "1101.9.0",
     "@pnpm/workspace.range-resolver": "1100.0.3",
     "@pnpm/workspace.spec-parser": "1100.0.1",
@@ -59,25 +59,24 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "rename-overwrite": "^7.0.1",
     "semver": "^7.8.5",
-    "semver-utils": "^1.1.4",
     "ssri": "13.0.1",
     "validate-npm-package-name": "7.0.2",
     "version-selector-type": "^3.0.0"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0",
-    "@pnpm/worker": "^1100.2.10"
+    "@pnpm/worker": "^1100.2.11"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/network.fetch": "1100.1.11",
-    "@pnpm/resolving.npm-resolver": "1103.1.0",
+    "@pnpm/network.fetch": "1100.1.12",
+    "@pnpm/resolving.npm-resolver": "1103.2.1",
     "@pnpm/test-fixtures": "1100.0.1",
     "@pnpm/testing.mock-agent": "1101.0.7",
     "@types/normalize-path": "^3.0.2",
     "@types/ramda": "0.32.0",
-    "@types/semver": "7.7.1",
+    "@types/semver": "7.8.0",
     "@types/ssri": "^7.1.5",
     "@types/validate-npm-package-name": "^4.0.2",
     "load-json-file": "^7.0.1",

package/lib/inferRangeSpecStyle.d.ts

@@ -1,2 +0,0 @@
-import type { RangeSpecStyle } from '@pnpm/types';
-export declare function inferRangeSpecStyle(spec: string): RangeSpecStyle | undefined;

package/lib/inferRangeSpecStyle.js

@@ -1,39 +0,0 @@
-import { parseRange } from 'semver-utils';
-export function inferRangeSpecStyle(spec) {
-    // A catalog reference carries no version pinning of its own; the pinning is
-    // defined by the catalog entry it points to. Bail out so a catalog name that
-    // happens to look like a version (e.g. "catalog:express4-21") isn't misread
-    // as a pinned version.
-    if (spec.startsWith('catalog:'))
-        return undefined;
-    const colonIndex = spec.indexOf(':');
-    if (colonIndex !== -1) {
-        spec = spec.substring(colonIndex + 1);
-    }
-    const index = spec.lastIndexOf('@');
-    if (index !== -1) {
-        spec = spec.slice(index + 1);
-    }
-    if (spec === '*')
-        return 'none';
-    const parsedRange = parseRange(spec);
-    if (parsedRange.length !== 1)
-        return undefined;
-    const versionObject = parsedRange[0];
-    switch (versionObject.operator) {
-        case '~': return 'minor';
-        case '^': return 'major';
-        // A bare '=' before a full version is an explicit exact pin; a partial
-        // '=' pins the same way the plain version it prefixes does.
-        case '=':
-        case undefined:
-            if (versionObject.patch)
-                return versionObject.operator === '=' ? 'exact' : 'patch';
-            if (versionObject.minor)
-                return 'minor';
-            if (versionObject.major)
-                return 'major';
-    }
-    return undefined;
-}
-//# sourceMappingURL=inferRangeSpecStyle.js.map