@pnpm/resolving.npm-resolver 1103.2.0 → 1104.0.0

package/CHANGELOG.md

@@ -1,5 +1,87 @@
 # @pnpm/npm-resolver
 
+## 1104.0.0
+
+### Major Changes
+
+- The three registry lookups are now named for what they are keyed by, so that none of them is called `registries` — a name the `registries` setting itself has taken:
+
+  | before | after |
+  |---|---|
+  | `Config.registries` | `Config.registriesByScope` |
+  | `Config.namedRegistries` | `Config.registriesByPrefix` |
+  | `Config.registryOptions` | `Config.registryOptionsByUrl` |
+
+  The same rename applies to the `RegistryContext` fields, the `Registries` and `NamedRegistries` types (now `RegistriesByScope` and `RegistriesByPrefix`), `normalizeRegistries` / `normalizeNamedRegistries` (now `normalizeRegistriesByScope` / `normalizeRegistriesByPrefix`), and the `BUILTIN_NAMED_REGISTRIES` constant (now `BUILTIN_REGISTRIES_BY_PREFIX`).
+
+  This is an internal rename: no setting, error code, lockfile field, or `.pnpmfile.cjs` hook field changes. A `preResolution` hook still reads `ctx.registries`, which is the name pacquet passes as well. The `registries` and `namedRegistries` settings are read under the names users write them.
+
+  The pnpr resolve request sends `registriesByPrefix` where it sent `namedRegistries`. A pnpr server and its clients must be on matching versions, which is already the case for an experimental server.
+
+### Minor Changes
+
+- A registry can now declare that its abbreviated metadata carries the `time` field, so `resolutionMode: time-based` reads the full metadata document only from the registries that need it:
+
+  ```yaml
+  resolutionMode: time-based
+  registries:
+    https://npm.internal.example/:
+      supportsTimeField: true
+  ```
+
+  `registry.npmjs.org` omits `time` from abbreviated metadata, so a time-based resolution has to fall back to the much larger full document. That fallback used to be all-or-nothing: `registrySupportsTimeField` answered for every registry at once, so a project resolving from both the public registry and a Verdaccio instance either paid for full metadata everywhere or claimed a `time` field npmjs does not serve. The answer is now per registry, and `registrySupportsTimeField` remains the answer for every registry that does not declare one.
+
+  The declaration is also sent to a pnpr server, which applies it to the resolution it runs on the client's behalf.
+
+### Patch Changes
+
+- Re-fetch full registry metadata when `minimumReleaseAge` is enabled and an abbreviated packument's `time` map omits timestamps for some versions. This prevents mature versions from being filtered out and resolution from falling back to the lowest matching version [pnpm/pnpm#13741](https://github.com/pnpm/pnpm/issues/13741).
+
+- Reduced registry metadata requests during dependency resolution by reusing cached metadata when lockfile preferences prove that no uncached version can win [pnpm/pnpm#13976](https://github.com/pnpm/pnpm/issues/13976).
+
+- Installs are faster in workspaces that declare inter-workspace dependencies with plain ranges (`"*"`, `"^1.2.3"`) rather than the `workspace:` protocol. With `preferWorkspacePackages` enabled, linking such a dependency no longer makes a registry request that cannot change the outcome — and workspace packages that were never published no longer cost a 404 on every install.
+
+- Added `fetchWarnTimeoutMs` and `fetchMinSpeedKiBps` to the Rust pnpm CLI and its N-API bindings. Slow registry metadata requests and tarball downloads now emit pnpm-compatible warnings without exposing URL credentials, query parameters, fragments, or control characters [pnpm/pnpm#12042](https://github.com/pnpm/pnpm/issues/12042).
+
+- `trustPolicy: no-downgrade` no longer aborts the install with `ERR_PNPM_MISSING_TIME` on registries that serve no per-version `time` field when `minimumReleaseAgeIgnoreMissingTime` is set. The trust check reads the same publish dates the `minimumReleaseAge` check does, so it now honors the same opt-in and skips the affected package with a warning [#12446](https://github.com/pnpm/pnpm/issues/12446).
+
+  `minimumReleaseAgeIgnoreMissingTime` no longer lets a lockfile entry the registry does not list pass the `minimumReleaseAge` check during lockfile verification. The opt-in covers a registry that cannot date its releases; a packument that does date every version it lists is saying it never published this one, which stays a hard failure.
+
+  The missing-`time` warning now names the check it is reporting on, so a package whose `minimumReleaseAge` and `trustPolicy` checks are both skipped warns about both instead of only the first.
+
+- Updated dependencies:
+  - @pnpm/config.normalize-registries@1101.0.0
+  - @pnpm/config.pick-registry-for-package@1101.0.0
+  - @pnpm/config.version-policy@1100.2.1
+  - @pnpm/constants@1102.0.0
+  - @pnpm/core-loggers@1100.3.3
+  - @pnpm/deps.path@1101.0.0
+  - @pnpm/error@1100.1.3
+  - @pnpm/pkg-manifest.utils@1100.4.1
+  - @pnpm/resolving.jsr-specifier-parser@1100.0.6
+  - @pnpm/resolving.registry.pkg-metadata-filter@1100.0.17
+  - @pnpm/resolving.registry.types@1100.1.10
+  - @pnpm/resolving.resolver-base@1101.1.1
+  - @pnpm/store.cafs@1100.2.0
+  - @pnpm/store.index@1100.2.5
+  - @pnpm/types@1102.0.0
+
+## 1103.2.1
+
+### Patch Changes
+
+- `pnpm add` no longer re-resolves the dependency graph when `pnpm-lock.yaml` already holds a version satisfying the request — promoting a transitive dependency to a direct one, or adding to a second workspace package what a first one already depends on, now only saves the dependency in `package.json` and records its importer entry. A satisfying locked version is necessary but not sufficient: the install still falls back to a full resolution for a dist tag, an alias, a `workspace:`/`catalog:`/git/tarball specifier, `--save-peer`, an overridden package, a `catalogMode` other than `manual`, and — under `resolutionMode: time-based` or `lowest-direct`, which resolve a direct dependency to the low end of its range — a range several locked versions satisfy.
+
+- `resolutionMode` is no longer ignored when `minimumReleaseAge` is in effect. `lowest-direct` and `time-based` pick the lowest satisfying version of a direct dependency again; previously any active release-age cutoff — including the built-in default — silently forced the highest, so `resolutionMode` only worked when `minimumReleaseAge: 0` was set explicitly [#13752](https://github.com/pnpm/pnpm/issues/13752).
+
+- Updated dependencies:
+  - @pnpm/config.version-policy@1100.2.0
+  - @pnpm/error@1100.1.2
+  - @pnpm/pkg-manifest.utils@1100.4.0
+  - @pnpm/resolving.jsr-specifier-parser@1100.0.5
+  - @pnpm/store.cafs@1100.1.19
+  - @pnpm/store.index@1100.2.4
+
 ## 1103.2.0
 
 ### Minor Changes

package/lib/createNpmResolutionVerifier.d.ts

@@ -1,6 +1,6 @@
 import type { GetAuthHeader } from '@pnpm/fetching.types';
 import { type ResolutionVerifier } from '@pnpm/resolving.resolver-base';
-import type { Registries, TrustPolicy } from '@pnpm/types';
+import type { RegistriesByScope, TrustPolicy } from '@pnpm/types';
 import type { FetchMetadataFromFromRegistryOptions } from './fetch.js';
 import { type FetchFullMetadataCachedOptions } from './fetchFullMetadataCached.js';
 import type { PackageMetaCache } from './pickPackage.js';
@@ -23,12 +23,15 @@ export interface CreateNpmResolutionVerifierOptions {
     /**
      * When the registry's metadata lacks the per-version `time` field
      * (some self-hosted registries strip it), the verifier can't apply
-     * the maturity cutoff. Set this to `true` to mirror the resolver's
-     * `pickMatchingVersionFinal` warn-and-skip behavior — the verifier
-     * passes the entry with a one-time `globalWarn`, instead of failing
-     * closed. Defaults to `false` so the verifier stays stricter than
-     * the resolver only when the user has explicitly opted in to the
-     * skip on the resolver side.
+     * the maturity cutoff, and the trust check has no publish order to
+     * walk. Set this to `true` to mirror the resolver's warn-and-skip
+     * behavior for both — the verifier passes the entry with a one-time
+     * `globalWarn`, instead of failing closed. Defaults to `false` so
+     * the verifier stays stricter than the resolver only when the user
+     * has explicitly opted in to the skip on the resolver side. Scoped
+     * to a packument with no usable `time` map: one that dates every
+     * version it lists is saying it never published this pin, which
+     * fails closed either way.
      */
     ignoreMissingTimeField?: boolean;
     /**
@@ -42,14 +45,14 @@ export interface CreateNpmResolutionVerifierOptions {
     trustPolicy?: TrustPolicy;
     trustPolicyExclude?: string[];
     trustPolicyIgnoreAfter?: number;
-    registries: Registries;
+    registriesByScope: RegistriesByScope;
     /**
-     * Registries reached via the named-registry resolver chain (e.g. `gh:` →
+     * RegistriesByScope reached via the named-registry resolver chain (e.g. `gh:` →
      * GitHub Packages). When a lockfile entry's tarball URL falls under one of
      * these registry base URLs, route the manifest fetch there instead of the
      * scope-derived default.
      */
-    namedRegistries?: Record<string, string>;
+    registriesByPrefix?: Record<string, string>;
     /**
      * Cache-aware full-metadata fetcher. Decoupled from the resolver pipeline
      * so abbreviated metadata and `peekManifestFromStore` fast paths cannot

package/lib/createNpmResolutionVerifier.js

@@ -1,5 +1,5 @@
 import { createHash } from 'node:crypto';
-import { normalizeNamedRegistries } from '@pnpm/config.normalize-registries';
+import { normalizeRegistriesByPrefix } from '@pnpm/config.normalize-registries';
 import { namedRegistryTarballPrefixes, pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
 import { createPackageVersionPolicy } from '@pnpm/config.version-policy';
 import { FULL_META_DIR } from '@pnpm/constants';
@@ -39,8 +39,8 @@ export function createNpmResolutionVerifier(opts) {
     const trustExcludePolicy = opts.trustPolicyExclude?.length
         ? createExcludePolicy(opts.trustPolicyExclude, 'trustPolicyExclude')
         : undefined;
-    const mergedNamedRegistries = normalizeNamedRegistries(opts.namedRegistries);
-    const namedRegistryPrefixes = namedRegistryTarballPrefixes(mergedNamedRegistries);
+    const mergedRegistriesByPrefix = normalizeRegistriesByPrefix(opts.registriesByPrefix);
+    const namedRegistryPrefixes = namedRegistryTarballPrefixes(mergedRegistriesByPrefix);
     // Per-install dedup of every network/disk fetch the verifier issues.
     // The maturity check uses the layered `fetchPublishedAt` lookup; the
     // trust check uses an attestation fast-path before falling back to
@@ -65,6 +65,7 @@ export function createNpmResolutionVerifier(opts) {
     const minimumReleaseAge = opts.minimumReleaseAge ?? 0;
     const trustPolicy = opts.trustPolicy;
     const trustPolicyIgnoreAfter = opts.trustPolicyIgnoreAfter;
+    const ignoreMissingTimeField = opts.ignoreMissingTimeField === true;
     const verify = async (resolution, { name, version, nonSemverVersion, registryName }) => {
         if (!isRegistryTarballResolution(resolution))
             return { ok: true };
@@ -105,20 +106,20 @@ export function createNpmResolutionVerifier(opts) {
             // Registry-qualified entries name their registry in the dep path, so
             // routing does not depend on a recorded tarball URL (canonical URLs
             // are omitted from the lockfile in the 12.0 format).
-            const namedRegistry = mergedNamedRegistries[registryName];
+            const namedRegistry = mergedRegistriesByPrefix[registryName];
             if (!namedRegistry) {
                 // Fail closed: without the registry URL, none of the metadata-backed
                 // checks below can vouch for this entry.
                 return {
                     ok: false,
                     code: MISSING_NAMED_REGISTRY_VIOLATION_CODE,
-                    reason: `was resolved from the named registry '${registryName}:', which is not present in the namedRegistries setting`,
+                    reason: `was resolved from the named registry '${registryName}:', which is not present in the registriesByPrefix setting`,
                 };
             }
             registry = namedRegistry;
         }
         else {
-            registry = pickRegistryForVersion(opts.registries, namedRegistryPrefixes, name, tarballUrl);
+            registry = pickRegistryForVersion(opts.registriesByScope, namedRegistryPrefixes, name, tarballUrl);
         }
         // A registry entry that pins an explicit tarball URL must point at the
         // artifact the registry's own metadata lists. Otherwise a trusted
@@ -138,7 +139,7 @@ export function createNpmResolutionVerifier(opts) {
         if (!ageApplies && !trustApplies)
             return { ok: true };
         if (ageApplies) {
-            const ageViolation = await runAgeCheck(lookupContext, registry, name, version, cutoff, opts.ignoreMissingTimeField === true);
+            const ageViolation = await runAgeCheck(lookupContext, registry, name, version, cutoff, ignoreMissingTimeField);
             if (ageViolation)
                 return ageViolation;
         }
@@ -146,6 +147,7 @@ export function createNpmResolutionVerifier(opts) {
             const trustViolation = await runTrustCheck(lookupContext, registry, name, version, {
                 trustPolicyExclude: trustExcludePolicy,
                 trustPolicyIgnoreAfter,
+                ignoreMissingTimeField,
             });
             if (trustViolation)
                 return trustViolation;
@@ -163,9 +165,9 @@ export function createNpmResolutionVerifier(opts) {
     // stays trusted after its exclude entry has been pulled.
     const sortedMinAgeExcludes = [...new Set(opts.minimumReleaseAgeExclude ?? [])].sort();
     const sortedTrustExcludes = [...new Set(opts.trustPolicyExclude ?? [])].sort();
-    const sortedNamedRegistries = Object.fromEntries(Object.entries(mergedNamedRegistries).sort(([aliasA], [aliasB]) => aliasA.localeCompare(aliasB)));
+    const sortedRegistriesByPrefix = Object.fromEntries(Object.entries(mergedRegistriesByPrefix).sort(([aliasA], [aliasB]) => aliasA.localeCompare(aliasB)));
     const namedRegistriesRouting = createHash('sha256')
-        .update(JSON.stringify(sortedNamedRegistries))
+        .update(JSON.stringify(sortedRegistriesByPrefix))
         .digest('hex');
     return {
         verify,
@@ -184,6 +186,7 @@ export function createNpmResolutionVerifier(opts) {
             trustPolicy: trustPolicy ?? null,
             trustPolicyExclude: sortedTrustExcludes,
             trustPolicyIgnoreAfter: trustPolicyIgnoreAfter ?? null,
+            minimumReleaseAgeIgnoreMissingTime: ignoreMissingTimeField,
         },
         canTrustPastCheck: (cached) => {
             // The tarball-URL binding is unconditional today; a cached run that
@@ -233,6 +236,14 @@ export function createNpmResolutionVerifier(opts) {
             const todayIgnoreAfter = trustPolicyIgnoreAfter ?? null;
             if (pastIgnoreAfter !== todayIgnoreAfter)
                 return false;
+            // Missing-time tolerance: a cached run that failed closed on an
+            // absent `time` field accepted a subset of what today's tolerant
+            // policy accepts, so it stays trustworthy. Turning the tolerance
+            // off invalidates it — entries the past run waved through are the
+            // ones today's policy exists to reject. Older records (no field)
+            // read as intolerant, which is the safe direction.
+            if (cached.minimumReleaseAgeIgnoreMissingTime === true && !ignoreMissingTimeField)
+                return false;
             return true;
         },
     };
@@ -245,15 +256,23 @@ async function runAgeCheck(context, registry, name, version, cutoff, ignoreMissi
     const published = await fetchPublishedAt(context, registry, name, version);
     if (!published) {
         // No source — attestation, local mirror, or full metadata —
-        // surfaced a publish timestamp for this version. The resolver's
-        // pickMatchingVersionFinal honors `minimumReleaseAgeIgnoreMissingTime`
-        // for the same shape (some self-hosted registries strip per-version
-        // `time`); the verifier mirrors that so it can't be stricter than
-        // fresh resolution. Without the flag we still fail closed — better
-        // a false reject than silent bypass when the user hasn't opted in.
+        // surfaced a publish timestamp for this version. What
+        // `minimumReleaseAgeIgnoreMissingTime` opts out of is a registry that
+        // cannot date its releases, so the skip is granted only when the
+        // packument carries no usable `time` map at all — the same shape the
+        // resolver's `pickMatchingVersionFinal` warns and skips on, so the
+        // verifier can't be stricter than fresh resolution. A packument that
+        // does date every version it lists is instead telling us this pin is
+        // not one of them (`dropIncompletePublishTimes` leaves no partial maps
+        // for that to be ambiguous), and an unpublished or never-published pin
+        // must fail closed however the flag is set.
         if (ignoreMissingTimeField) {
-            warnMissingTimeFieldOnce(name);
-            return undefined;
+            // Already awaited by the lookup above, so this is a cache hit.
+            const timeMap = await fetchFullMetaTime(context, registry, name);
+            if (timeMap == null) {
+                warnMissingTimeFieldOnce(name, 'minimumReleaseAge');
+                return undefined;
+            }
         }
         return {
             ok: false,
@@ -315,10 +334,9 @@ async function runTarballUrlCheck(context, registry, name, version, lockfileTarb
 function sameTarballUrl(a, b) {
     return canonicalTarballUrl(a) === canonicalTarballUrl(b);
 }
-// Mirror the tolerance toLockfileResolution applies when it decides whether
-// a tarball URL is "the expected one": ignore the protocol and `%2f` scope
-// encoding so a benign http/https or encoding difference isn't read as
-// tampering. The `%2f` match is case-insensitive because `normalizeRegistryUrl`
+// Both URLs come from the registry, so ignore the protocol and `%2f` scope
+// encoding: a benign http/https or encoding difference isn't tampering. The
+// `%2f` match is case-insensitive because `normalizeRegistryUrl`
 // (`new URL().toString()`) can upper-case percent-escapes to `%2F`.
 function canonicalTarballUrl(url) {
     const normalized = normalizeRegistryUrl(url).replace(/%2f/gi, '/');
@@ -657,7 +675,7 @@ function fetchFullMetaTime(context, registry, name) {
     }
     return cachedPromise;
 }
-function pickRegistryForVersion(registries, namedRegistryPrefixes, name, tarballUrl) {
+function pickRegistryForVersion(registriesByScope, namedRegistryPrefixes, name, tarballUrl) {
     // If the lockfile records where the tarball lives, prefer that — scope
     // routing (`@scope:registry`) only covers scoped packages, but named
     // registries (`gh:`, `jsr:` aliases, custom) ship un-scoped packages whose
@@ -674,7 +692,7 @@ function pickRegistryForVersion(registries, namedRegistryPrefixes, name, tarball
                 return prefix;
         }
     }
-    return pickRegistryForPackage(registries, name);
+    return pickRegistryForPackage(registriesByScope, name);
 }
 function tryParseUrl(url) {
     try {

package/lib/fetch.js

@@ -1,11 +1,12 @@
 import url from 'node:url';
 import util from 'node:util';
 import { requestRetryLogger } from '@pnpm/core-loggers';
-import { FetchError, PnpmError, redactUrlCredentials, } from '@pnpm/error';
+import { FetchError, PnpmError, redactUrlCredentials, redactUrlForDisplay, } from '@pnpm/error';
 import { globalWarn } from '@pnpm/logger';
 import * as retry from '@zkochan/retry';
 import semver from 'semver';
 import { clearMeta } from './clearMeta.js';
+import { dropIncompletePublishTimes } from './publishTimes.js';
 /**
  * Content type of an abbreviated (install-oriented) package metadata document.
  * A spec-compliant registry echoes this in the response `Content-Type` when it
@@ -147,10 +148,11 @@ export async function fetchMetadataFromFromRegistry(fetchOpts, pkgName, { authHe
             try {
                 const jsonText = await response.text();
                 const meta = JSON.parse(jsonText);
+                dropIncompletePublishTimes(meta);
                 // Check if request took longer than expected
                 const elapsedMs = Date.now() - startTime;
                 if (elapsedMs > fetchOpts.fetchWarnTimeoutMs) {
-                    globalWarn(`Request took ${elapsedMs}ms: ${uri}`);
+                    globalWarn(`Request took ${elapsedMs}ms: ${redactUrlForDisplay(uri)}`);
                 }
                 resolve({
                     ...normalizeAbbreviatedResponse({ fullMetadata, meta, jsonText, response }),
@@ -200,7 +202,7 @@ export function notModifiedWithoutCacheError(pkgName) {
  * carry the megabytes of install-irrelevant data (scripts, exports, readme,
  * custom fields) that a full document contains.
  *
- * Registries that honor the header (e.g. the npm registry) echo the abbreviated
+ * RegistriesByScope that honor the header (e.g. the npm registry) echo the abbreviated
  * `Content-Type`, so this is a no-op for them: no re-serialization, no field
  * stripping — the happy path pays nothing.
  */

package/lib/index.d.ts

@@ -2,9 +2,9 @@ import { PnpmError } from '@pnpm/error';
 import type { FetchFromRegistry, GetAuthHeader, RetryTimeoutOptions } from '@pnpm/fetching.types';
 import type { PackageMeta } from '@pnpm/resolving.registry.types';
 import type { DirectoryResolution, LatestInfo, LatestQuery, PkgResolutionId, PreferredVersions, ResolveOptions, ResolveResult, TarballResolution, WantedDependency, WorkspacePackages } from '@pnpm/resolving.resolver-base';
-import type { DependencyManifest, PackageVersionPolicy, RangeSpecStyle, Registries, TrustPolicy } from '@pnpm/types';
+import type { DependencyManifest, PackageVersionPolicy, RangeSpecStyle, RegistriesByScope, TrustPolicy } from '@pnpm/types';
 import { fetchMetadataFromFromRegistry, type FetchMetadataFromFromRegistryOptions, RegistryResponseError } from './fetch.js';
-import { BUILTIN_NAMED_REGISTRIES, parseBareSpecifier, type RegistryPackageSpec } from './parseBareSpecifier.js';
+import { BUILTIN_REGISTRIES_BY_PREFIX, parseBareSpecifier, type RegistryPackageSpec } from './parseBareSpecifier.js';
 import { type PackageMetaCache, pickPackage, type PickPackageOptions } from './pickPackage.js';
 import { pickPackageFromMeta, pickVersionByVersionRange } from './pickPackageFromMeta.js';
 import { workspacePrefToNpm } from './workspacePrefToNpm.js';
@@ -18,22 +18,28 @@ export declare class NoMatchingVersionError extends PnpmError {
     constructor(opts: NoMatchingVersionErrorOptions);
 }
 export declare function formatTimeAgo(date: Date): string | null;
-export { BUILTIN_NAMED_REGISTRIES, fetchMetadataFromFromRegistry, type FetchMetadataFromFromRegistryOptions, type PackageMeta, type PackageMetaCache, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, type RegistryPackageSpec, RegistryResponseError, workspacePrefToNpm, };
+export { BUILTIN_REGISTRIES_BY_PREFIX, fetchMetadataFromFromRegistry, type FetchMetadataFromFromRegistryOptions, type PackageMeta, type PackageMetaCache, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, type RegistryPackageSpec, RegistryResponseError, workspacePrefToNpm, };
 export { createNpmResolutionVerifier, type CreateNpmResolutionVerifierOptions } from './createNpmResolutionVerifier.js';
-export { inferRangeSpecStyle } from './inferRangeSpecStyle.js';
 export { MINIMUM_RELEASE_AGE_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
 export interface ResolverFactoryOptions {
     cacheDir: string;
     storeDir?: string;
     frozenStore?: boolean;
     fullMetadata?: boolean;
+    /**
+     * Asked instead of {@link ResolverFactoryOptions.fullMetadata} when the
+     * caller can answer per registry — a registry that declares
+     * `supportsTimeField` needs no full metadata for a time-based resolution
+     * even when the others do.
+     */
+    needsFullMetadataFor?: (registry: string) => boolean;
     filterMetadata?: boolean;
     offline?: boolean;
     preferOffline?: boolean;
     retry?: RetryTimeoutOptions;
     timeout?: number;
-    registries: Registries;
-    namedRegistries?: Record<string, string>;
+    registriesByScope: RegistriesByScope;
+    registriesByPrefix?: Record<string, string>;
     saveWorkspaceProtocol?: boolean | 'rolling';
     preserveAbsolutePaths?: boolean;
     ignoreMissingTimeField?: boolean;
@@ -84,10 +90,16 @@ export declare function createNpmResolver(fetchFromRegistry: FetchFromRegistry,
 export interface ResolveFromNpmContext {
     pickPackage: (spec: RegistryPackageSpec, opts: PickPackageOptions) => ReturnType<typeof pickPackage>;
     getAuthHeaderValueByURI: GetAuthHeader;
-    registries: Registries;
-    namedRegistries: Record<string, string>;
+    registriesByScope: RegistriesByScope;
+    registriesByPrefix: Record<string, string>;
     namedRegistryNames: ReadonlySet<string>;
     saveWorkspaceProtocol?: boolean | 'rolling';
+    /**
+     * The `minimumReleaseAgeIgnoreMissingTime` opt-in, reaching the trust
+     * check as well as the version pick: both read the same per-version
+     * `time`, so a registry that strips it takes both down together.
+     */
+    ignoreMissingTimeField?: boolean;
     peekManifestFromStore?: (opts: {
         id: PkgResolutionId;
         integrity: string;

package/lib/index.js

@@ -3,7 +3,7 @@ import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
 import { isWellFormedRegistryName, RESERVED_VERSION_PREFIXES } from '@pnpm/deps.path';
 import { PnpmError } from '@pnpm/error';
 import { globalWarn } from '@pnpm/logger';
-import { rangeSpecGranularity, versionWithRangeSpecStyle } from '@pnpm/pkg-manifest.utils';
+import { calcVersionRange, inferRangeSpecStyle, rangeSpecGranularity, versionWithRangeSpecStyle } from '@pnpm/pkg-manifest.utils';
 import { EXISTING_VERSION_SELECTOR_WEIGHT, } from '@pnpm/resolving.resolver-base';
 import { storeIndexKey } from '@pnpm/store.index';
 import { readPkgFromCafs, } from '@pnpm/worker';
@@ -16,10 +16,9 @@ import ssri from 'ssri';
 import versionSelectorType from 'version-selector-type';
 import { clearMeta, retainsFullMeta } from './clearMeta.js';
 import { fetchMetadataFromFromRegistry, RegistryResponseError } from './fetch.js';
-import { inferRangeSpecStyle } from './inferRangeSpecStyle.js';
 import { memoizeFetchMetadata } from './memoizeFetchMetadata.js';
 import { normalizeRegistryUrl } from './normalizeRegistryUrl.js';
-import { BUILTIN_NAMED_REGISTRIES, parseBareSpecifier, parseJsrSpecifierToRegistryPackageSpec, parseNamedRegistrySpecifierToRegistryPackageSpec, } from './parseBareSpecifier.js';
+import { BUILTIN_REGISTRIES_BY_PREFIX, parseBareSpecifier, parseJsrSpecifierToRegistryPackageSpec, parseNamedRegistrySpecifierToRegistryPackageSpec, } from './parseBareSpecifier.js';
 import { pickPackage, } from './pickPackage.js';
 import { applyPublishedByPolicy, pickPackageFromMeta, pickVersionByVersionRange } from './pickPackageFromMeta.js';
 import { failIfTrustDowngraded } from './trustChecks.js';
@@ -64,9 +63,8 @@ export function formatTimeAgo(date) {
         return `${diffMin} minute${diffMin === 1 ? '' : 's'} ago`;
     return 'a few seconds ago';
 }
-export { BUILTIN_NAMED_REGISTRIES, fetchMetadataFromFromRegistry, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, RegistryResponseError, workspacePrefToNpm, };
+export { BUILTIN_REGISTRIES_BY_PREFIX, fetchMetadataFromFromRegistry, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, RegistryResponseError, workspacePrefToNpm, };
 export { createNpmResolutionVerifier } from './createNpmResolutionVerifier.js';
-export { inferRangeSpecStyle } from './inferRangeSpecStyle.js';
 export { MINIMUM_RELEASE_AGE_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
 export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
     if (typeof opts.cacheDir !== 'string') {
@@ -90,6 +88,10 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
     // using.
     const ownsMetaCache = opts.metaCache == null;
     const metaCache = opts.metaCache ?? createDefaultPackageMetaCache();
+    // This marker is intentionally resolver-scoped rather than attached to
+    // `metaCache`: callers may reuse one metadata cache across installs, and a
+    // later install must retry a full-metadata upgrade that previously got 304.
+    const releaseAgeUpgradeCheckedPackuments = new WeakSet();
     // Create peek function if storeDir is provided
     const storeDir = opts.storeDir;
     const peekLockerForPeek = new Map();
@@ -116,31 +118,34 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
             return request;
         };
     }
-    const namedRegistries = mergeNamedRegistries(opts.namedRegistries);
-    const namedRegistryNames = new Set(Object.keys(namedRegistries));
+    const registriesByPrefix = mergeNamedRegistries(opts.registriesByPrefix);
+    const namedRegistryNames = new Set(Object.keys(registriesByPrefix));
     const ctx = {
         getAuthHeaderValueByURI: getAuthHeader,
         pickPackage: pickPackage.bind(null, {
             fetch,
             fullMetadata: opts.fullMetadata,
+            needsFullMetadataFor: opts.needsFullMetadataFor,
             filterMetadata: opts.filterMetadata,
             metaCache,
             offline: opts.offline,
             preferOffline: opts.preferOffline,
             cacheDir: opts.cacheDir,
             ignoreMissingTimeField: opts.ignoreMissingTimeField,
+            releaseAgeUpgradeCheckedPackuments,
         }),
-        registries: opts.registries,
-        namedRegistries,
+        registriesByScope: opts.registriesByScope,
+        registriesByPrefix,
         namedRegistryNames,
         saveWorkspaceProtocol: opts.saveWorkspaceProtocol,
+        ignoreMissingTimeField: opts.ignoreMissingTimeField,
         peekManifestFromStore,
         warnedHeldBackUpdates: new Set(),
     };
     const boundResolveFromNpm = resolveNpm.bind(null, ctx);
     const boundResolveFromJsr = resolveJsr.bind(null, ctx);
     const boundResolveFromNamedRegistry = resolveFromNamedRegistry.bind(null, ctx);
-    const defaultRegistry = opts.registries.default;
+    const defaultRegistry = opts.registriesByScope.default;
     return {
         resolveFromNpm: boundResolveFromNpm,
         resolveFromJsr: boundResolveFromJsr,
@@ -306,8 +311,8 @@ function createResolveLatest(resolve, matches) {
 async function resolveNpm(ctx, wantedDependency, opts) {
     const defaultTag = opts.defaultTag ?? 'latest';
     const registry = wantedDependency.alias
-        ? pickRegistryForPackage(ctx.registries, wantedDependency.alias, wantedDependency.bareSpecifier)
-        : ctx.registries.default;
+        ? pickRegistryForPackage(ctx.registriesByScope, wantedDependency.alias, wantedDependency.bareSpecifier)
+        : ctx.registriesByScope.default;
     if (wantedDependency.bareSpecifier?.startsWith('workspace:')) {
         if (wantedDependency.bareSpecifier.startsWith('workspace:.'))
             return null;
@@ -381,6 +386,34 @@ async function resolveNpm(ctx, wantedDependency, opts) {
             }
         }
     }
+    // This runs *after* the store peek because a tag-specified dep whose only local copy is a
+    // prerelease reaches here with `update: false` (`wantedDepIsLocallyAvailable` ignores
+    // prereleases for tags, `pickMatchingLocalVersionOrNull` does not), and the peek must keep
+    // winning there. `update` is deliberately absent from the guard: that same helper forces it
+    // on for exactly these deps, so excluding it would make this block unreachable.
+    if (opts.preferWorkspacePackages === true &&
+        workspacePackages != null &&
+        opts.projectDir &&
+        opts.trustPolicy !== 'no-downgrade' &&
+        !opts.updateChecksums &&
+        opts.injectWorkspacePackages !== true &&
+        !wantedDependency.injected) {
+        const workspacePkgsMatchingName = workspacePackages.get(spec.name);
+        if (workspacePkgsMatchingName?.size === 1) {
+            const localVersion = pickMatchingLocalVersionOrNull(workspacePkgsMatchingName, spec);
+            if (localVersion != null) {
+                return resolveFromLocalPackage(workspacePkgsMatchingName.get(localVersion), spec, {
+                    wantedDependency,
+                    projectDir: opts.projectDir,
+                    lockfileDir: opts.lockfileDir,
+                    hardLinkLocalPackages: false,
+                    saveWorkspaceProtocol: ctx.saveWorkspaceProtocol,
+                    calcSpecifier: opts.calcSpecifier,
+                    rangeSpecStyle: opts.rangeSpecStyle,
+                });
+            }
+        }
+    }
     const authHeaderValue = ctx.getAuthHeaderValueByURI(registry, { pkgName: spec.name });
     let pickResult;
     try {
@@ -395,6 +428,7 @@ async function resolveNpm(ctx, wantedDependency, opts) {
             includeLatestTag: opts.update === 'latest',
             updateChecksums: opts.updateChecksums,
             optional: wantedDependency.optional,
+            trustPolicy: opts.trustPolicy,
         });
     }
     catch (err) { // eslint-disable-line
@@ -450,7 +484,11 @@ async function resolveNpm(ctx, wantedDependency, opts) {
         throw new NoMatchingVersionError({ wantedDependency, packageMeta: meta, registry });
     }
     else if (opts.trustPolicy === 'no-downgrade') {
-        failIfTrustDowngraded(meta, pickedPackage.version, opts);
+        failIfTrustDowngraded(meta, pickedPackage.version, {
+            trustPolicyExclude: opts.trustPolicyExclude,
+            trustPolicyIgnoreAfter: opts.trustPolicyIgnoreAfter,
+            ignoreMissingTimeField: ctx.ignoreMissingTimeField,
+        });
     }
     const latest = latestAllowedByPolicy(meta, opts);
     const workspacePkgsMatchingName = workspacePackages?.get(pickedPackage.name);
@@ -526,7 +564,7 @@ async function resolveJsr(ctx, wantedDependency, opts) {
     const spec = parseJsrSpecifierToRegistryPackageSpec(wantedDependency.bareSpecifier, wantedDependency.alias, opts.defaultTag ?? 'latest');
     if (spec == null)
         return null;
-    const picked = await pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, ctx.registries['@jsr']); // '@jsr' is always defined
+    const picked = await pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, ctx.registriesByScope['@jsr']); // '@jsr' is always defined
     return {
         ...picked,
         normalizedBareSpecifier: opts.calcSpecifier
@@ -545,14 +583,14 @@ async function resolveJsr(ctx, wantedDependency, opts) {
 // another specifier scheme (e.g. `git`, `github`, `jsr`) is silently shadowed
 // by that scheme's dedicated resolver — no cross-resolver knowledge needed.
 function mergeNamedRegistries(userDefined) {
-    const merged = { ...BUILTIN_NAMED_REGISTRIES };
+    const merged = { ...BUILTIN_REGISTRIES_BY_PREFIX };
     if (!userDefined)
         return merged;
     for (const [alias, url] of Object.entries(userDefined)) {
         if (RESERVED_VERSION_PREFIXES.has(alias) || !isWellFormedRegistryName(alias)) {
             throw new PnpmError('RESERVED_NAMED_REGISTRY_NAME', RESERVED_VERSION_PREFIXES.has(alias)
                 ? `'${alias}' cannot be used as a named registry alias: it is a reserved dependency specifier prefix.`
-                : `'${alias}' cannot be used as a named registry alias: aliases must start with a letter and contain only letters, digits, ".", "_", and "-".`, { hint: 'Rename the entry in the namedRegistries setting.' });
+                : `'${alias}' cannot be used as a named registry alias: aliases must start with a letter and contain only letters, digits, ".", "_", and "-".`, { hint: 'Rename the entry in the registriesByPrefix setting.' });
         }
         if (typeof url !== 'string' || !isValidHttpUrl(url)) {
             throw new PnpmError('INVALID_NAMED_REGISTRY_URL', `The named registry alias '${alias}' is mapped to '${String(url)}', which is not a valid http(s) URL.`, { hint: 'Provide a URL that starts with http:// or https://, e.g. https://npm.pkg.example.com/' });
@@ -573,7 +611,7 @@ function isValidHttpUrl(url) {
 // Resolves a `<alias>:` specifier from one of the configured named registries.
 // The `gh:` alias ships as a built-in default pointing at the GitHub Packages
 // npm registry; additional aliases come from pnpm-workspace.yaml's
-// `namedRegistries` field. Auth tokens are looked up by the resolved registry
+// `registriesByPrefix` field. Auth tokens are looked up by the resolved registry
 // URL, so a `//npm.pkg.github.com/:_authToken=...` entry in `.npmrc` is
 // picked up automatically for `gh:` specifiers (and analogously for any user-
 // configured alias).
@@ -583,7 +621,7 @@ async function resolveFromNamedRegistry(ctx, wantedDependency, opts) {
     const spec = parseNamedRegistrySpecifierToRegistryPackageSpec(wantedDependency.bareSpecifier, ctx.namedRegistryNames, wantedDependency.alias, opts.defaultTag ?? 'latest');
     if (spec == null)
         return null;
-    const registry = ctx.namedRegistries[spec.registryName];
+    const registry = ctx.registriesByPrefix[spec.registryName];
     if (!registry)
         return null; // defensive: should never trigger because parse checks the alias set
     const picked = await pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, registry);
@@ -621,6 +659,7 @@ async function pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, registr
         includeLatestTag: opts.update === 'latest',
         updateChecksums: opts.updateChecksums,
         optional: wantedDependency.optional,
+        trustPolicy: opts.trustPolicy,
     });
     if (pickedPackage == null) {
         throw new NoMatchingVersionError({ wantedDependency, packageMeta: meta, registry });
@@ -666,14 +705,13 @@ function calcSpecifier({ wantedDependency, spec, version, defaultRangeSpecStyle,
         return range;
     return `npm:${spec.name}@${range}`;
 }
+/** The manifest range `version` is saved as; see {@link calcVersionRange}. */
 function calcRange(version, wantedDependency, defaultRangeSpecStyle) {
-    if (semver.parse(version)?.prerelease.length) {
-        return version;
-    }
-    const rangeSpecStyle = (wantedDependency.prevSpecifier ? inferRangeSpecStyle(wantedDependency.prevSpecifier) : undefined) ??
-        (wantedDependency.bareSpecifier ? inferRangeSpecStyle(wantedDependency.bareSpecifier) : undefined) ??
-        defaultRangeSpecStyle;
-    return versionWithRangeSpecStyle(version, rangeSpecStyle ?? 'major');
+    return calcVersionRange(version, {
+        prevSpecifier: wantedDependency.prevSpecifier,
+        bareSpecifier: wantedDependency.bareSpecifier,
+        defaultRangeSpecStyle,
+    });
 }
 function tryResolveFromWorkspace(wantedDependency, opts) {
     if (!wantedDependency.bareSpecifier?.startsWith('workspace:')) {

package/lib/parseBareSpecifier.d.ts

@@ -9,7 +9,7 @@ export interface JsrRegistryPackageSpec extends RegistryPackageSpec {
     jsrPkgName: string;
 }
 export declare function parseJsrSpecifierToRegistryPackageSpec(rawSpecifier: string, alias: string | undefined, defaultTag: string): JsrRegistryPackageSpec | null;
-export { BUILTIN_NAMED_REGISTRIES } from '@pnpm/constants';
+export { BUILTIN_REGISTRIES_BY_PREFIX } from '@pnpm/constants';
 export interface NamedRegistryPackageSpec extends RegistryPackageSpec {
     registryName: string;
 }

package/lib/parseBareSpecifier.js

@@ -64,7 +64,7 @@ export function parseJsrSpecifierToRegistryPackageSpec(rawSpecifier, alias, defa
         jsrPkgName: spec.jsrPkgName,
     };
 }
-export { BUILTIN_NAMED_REGISTRIES } from '@pnpm/constants';
+export { BUILTIN_REGISTRIES_BY_PREFIX } from '@pnpm/constants';
 // Parses a named-registry specifier of the shape `<alias>:<body>` into a
 // RegistryPackageSpec. Returns `null` when the specifier does not use one of
 // the configured aliases, so the caller can fall through to other resolvers.