@pnpm/resolving.npm-resolver 1103.2.0 → 1104.0.0

package/lib/pickPackage.d.ts

@@ -1,4 +1,5 @@
 import type { PackageInRegistry, PackageMeta } from '@pnpm/resolving.registry.types';
+import type { TrustPolicy } from '@pnpm/types';
 import { type FetchMetadataNotModifiedResult, type FetchMetadataResult } from './fetch.js';
 import type { RegistryPackageSpec } from './parseBareSpecifier.js';
 import { type PickPackageFromMetaOptions } from './pickPackageFromMeta.js';
@@ -22,6 +23,7 @@ export interface PickPackageOptions extends PickPackageFromMetaOptions {
     dryRun: boolean;
     includeLatestTag?: boolean;
     optional?: boolean;
+    trustPolicy?: TrustPolicy;
     /**
      * When true, force a conditional registry request so a stale on-disk
      * packument can't satisfy the call: the on-disk exact-version fast
@@ -44,12 +46,23 @@ export declare function pickPackage(ctx: {
         modified?: string;
     }) => Promise<FetchMetadataResult | FetchMetadataNotModifiedResult>;
     fullMetadata?: boolean;
+    /**
+     * Whether a time-based resolution has to read the full metadata of
+     * `registry`, because that registry's abbreviated form carries no `time`.
+     * Asked per registry: the answer differs between the public registry and a
+     * proxy that does carry it, and the mirror path and cache key below are
+     * already keyed by registry, so two registries may disagree within one
+     * install.
+     */
+    needsFullMetadataFor?: (registry: string) => boolean;
     metaCache: PackageMetaCache;
     cacheDir: string;
     offline?: boolean;
     preferOffline?: boolean;
     filterMetadata?: boolean;
     ignoreMissingTimeField?: boolean;
+    /** Packuments whose release-age upgrade fetch already answered 304 in this resolver. */
+    releaseAgeUpgradeCheckedPackuments?: WeakSet<PackageMeta>;
 }, spec: RegistryPackageSpec, opts: PickPackageOptions): Promise<{
     meta: PackageMeta;
     pickedPackage: PackageInRegistry | null;
@@ -91,7 +104,13 @@ export declare function getPkgMirrorPath(cacheDir: string, metaDir: string, regi
  * there), so a `meta` that carries one is serialized without it.
  */
 export declare function prepareJsonForDisk(meta: PackageMeta, etag: string | undefined, jsonText?: string): string;
-export declare function warnMissingTimeFieldOnce(pkgName: string): void;
+/**
+ * At most one warning per package per check. `minimumReleaseAge` and
+ * `trustPolicy` both go dark on the same missing field, so keying by package
+ * alone would let whichever check ran first silence the other and leave the
+ * user told about only one of the two skips.
+ */
+export declare function warnMissingTimeFieldOnce(pkgName: string, skippedCheck: 'minimumReleaseAge' | 'trustPolicy'): void;
 interface MetaHeaders {
     etag?: string;
     modified?: string;

package/lib/pickPackage.js

@@ -12,7 +12,8 @@ import { renameOverwrite } from 'rename-overwrite';
 import semver from 'semver';
 import { clearMeta, retainsFullMeta } from './clearMeta.js';
 import { notModifiedWithoutCacheError, } from './fetch.js';
-import { pickLowestVersionByVersionRange, pickPackageFromMeta, pickVersionByVersionRange, } from './pickPackageFromMeta.js';
+import { getDominantLockfileVersion, pickLowestVersionByVersionRange, pickPackageFromMeta, pickStableCachedRangeVersion, pickVersionByVersionRange, } from './pickPackageFromMeta.js';
+import { dropIncompletePublishTimes } from './publishTimes.js';
 import { toRaw } from './toRaw.js';
 /**
  * prevents simultaneous operations on the meta.json
@@ -39,6 +40,13 @@ async function runLimited(pkgMirror, fn) {
         }
     }
 }
+function canReuseStableCachedRange(spec, opts) {
+    return (spec.type === 'range' &&
+        !opts.includeLatestTag &&
+        !opts.updateChecksums &&
+        opts.publishedBy == null &&
+        opts.trustPolicy !== 'no-downgrade');
+}
 // When includeLatestTag is set, the "latest" dist-tag is added as a candidate
 // alongside the requested spec, and the higher-versioned pick wins.
 function runPicker(pickerOpts, spec, pickOne) {
@@ -58,15 +66,17 @@ function pickMax(a, b) {
 }
 const pickHighest = pickPackageFromMeta.bind(null, pickVersionByVersionRange);
 const pickLowest = pickPackageFromMeta.bind(null, pickLowestVersionByVersionRange);
-// When minimumReleaseAge is active: try the highest mature version; if none
-// satisfies the range, fall back to the lowest version regardless of maturity
-// so the resolver can report the violation inline and let the install layer
-// (or other caller) decide what to do — never throw at this layer.
+// `minimumReleaseAge` narrows which versions are on offer; `pickLowestVersion`
+// decides which end of what is left to take. The fallback deliberately drops
+// the maturity filter so a range no mature version satisfies still yields a
+// pick, which the install layer reports as a violation rather than this layer
+// throwing.
 function pickRespectingMinReleaseAge(pickerOpts, spec, meta) {
     return runPicker(pickerOpts, spec, (targetSpec) => {
-        const highest = pickHighest(pickerOpts, meta, targetSpec);
-        if (highest)
-            return highest;
+        const pickMature = pickerOpts.pickLowestVersion ? pickLowest : pickHighest;
+        const mature = pickMature(pickerOpts, meta, targetSpec);
+        if (mature)
+            return mature;
         return pickLowest({
             preferredVersionSelectors: pickerOpts.preferredVersionSelectors,
         }, meta, targetSpec);
@@ -95,7 +105,7 @@ function pickMatchingVersionFinal(pickerOpts, spec, meta) {
     }
     catch (err) {
         if (pickerOpts.ignoreMissingTimeField && isMissingTimeError(err)) {
-            warnMissingTimeFieldOnce(meta.name);
+            warnMissingTimeFieldOnce(meta.name, 'minimumReleaseAge');
             return pickMatchingVersionFast({
                 ...pickerOpts,
                 publishedBy: undefined,
@@ -150,7 +160,12 @@ export async function pickPackage(ctx, spec, opts) {
     validatePackageName(spec.name);
     // Use full metadata for optional dependencies to get libc field.
     // See: https://github.com/pnpm/pnpm/issues/9950
-    const fullMetadata = opts.optional === true || ctx.fullMetadata === true;
+    // The per-registry answer is authoritative when the caller can give one: it
+    // already folds in the reasons that hold for every registry, so a registry
+    // that carries `time` is free to stay on abbreviated metadata while the
+    // others do not.
+    const policyWantsFullMetadata = ctx.needsFullMetadataFor?.(opts.registry) ?? ctx.fullMetadata === true;
+    const fullMetadata = opts.optional === true || policyWantsFullMetadata;
     const metaDir = fullMetadata
         ? (ctx.filterMetadata ? FULL_FILTERED_META_DIR : FULL_META_DIR)
         : ABBREVIATED_META_DIR;
@@ -175,7 +190,19 @@ export async function pickPackage(ctx, spec, opts) {
             ctx.metaCache.set(cacheKey, metaForCache);
         }
         const pickedPackage = pickMatchingVersionFinal(pickerOpts, spec, metaForCache);
-        if (pickedPackage != null || ctx.offline === true || !unverifiedDiskPackuments.has(metaForCache)) {
+        const unverified = unverifiedDiskPackuments.has(metaForCache);
+        const stableCachedRangeVersion = unverified &&
+            canReuseStableCachedRange(spec, opts)
+            ? getDominantLockfileVersion(spec.fetchSpec, opts.preferredVersionSelectors)
+            : null;
+        const unverifiedPickIsSafe = ctx.preferOffline === true ||
+            opts.pickLowestVersion === true ||
+            spec.type === 'version' ||
+            (pickedPackage != null && pickedPackage.version === stableCachedRangeVersion);
+        const cacheResultCanReturn = ctx.offline === true ||
+            !unverified ||
+            (pickedPackage != null && unverifiedPickIsSafe);
+        if (cacheResultCanReturn) {
             return {
                 meta: metaForCache,
                 pickedPackage,
@@ -269,6 +296,35 @@ export async function pickPackage(ctx, spec, opts) {
                 }
             }
         }
+        const dominantLockfileVersion = canReuseStableCachedRange(spec, opts)
+            ? getDominantLockfileVersion(spec.fetchSpec, opts.preferredVersionSelectors)
+            : null;
+        if (dominantLockfileVersion != null) {
+            diskMeta = diskMeta ?? await limit(loadMetaCondensed);
+            if (diskMeta != null) {
+                try {
+                    const stableVersion = pickStableCachedRangeVersion({
+                        meta: diskMeta,
+                        preferredVersionSelectors: opts.preferredVersionSelectors,
+                        versionRange: spec.fetchSpec,
+                    });
+                    if (stableVersion != null) {
+                        // Strict dominance makes the preferred tier a singleton, so the
+                        // highest-version picker used by the proof and the normal picker
+                        // agree even if pickLowestVersion reaches this code in the future.
+                        const pickedPackage = pickMatchingVersionFast(pickerOpts, spec, diskMeta);
+                        if (pickedPackage?.version === stableVersion) {
+                            cacheDiskLoadedMeta(ctx.metaCache, cacheKey, diskMeta);
+                            return { meta: diskMeta, pickedPackage };
+                        }
+                    }
+                }
+                catch {
+                    // Any malformed cached metadata falls through to normal online
+                    // resolution, matching the neighboring disk fast paths.
+                }
+            }
+        }
         if (opts.publishedBy && opts.publishedByExclude?.(spec.name) !== true) {
             const mtime = await limit(async () => getFileMtime(pkgMirror));
             if (mtime != null && mtime >= opts.publishedBy) {
@@ -375,6 +431,7 @@ export async function pickPackage(ctx, spec, opts) {
             // and most packages won't have been modified recently enough to need the full
             // document. We only upgrade to full metadata when the package's modification
             // date is recent enough that some versions might not yet be "mature."
+            let attemptedReleaseAgeUpgrade = false;
             if (opts.publishedBy &&
                 !fullMetadata &&
                 meta.time == null &&
@@ -391,6 +448,7 @@ export async function pickPackage(ctx, spec, opts) {
                     if (!opts.dryRun) {
                         saveMetaBestEffort(pkgMirror, prepareJsonForDisk(resultToSave.meta, resultToSave.etag, resultToSave.jsonText));
                     }
+                    attemptedReleaseAgeUpgrade = true;
                     const fullFetchResult = await ctx.fetch(spec.name, {
                         authHeaderValue: opts.authHeaderValue,
                         fullMetadata: true,
@@ -403,6 +461,9 @@ export async function pickPackage(ctx, spec, opts) {
                 }
             }
             meta = condenseMetaForCache(ctx, meta);
+            if (attemptedReleaseAgeUpgrade) {
+                ctx.releaseAgeUpgradeCheckedPackuments?.add(meta);
+            }
             if (!opts.dryRun) {
                 // Mirror the raw registry body, unless the retained form is
                 // deliberately narrower: `filterMetadata` always mirrors the stripped
@@ -439,6 +500,7 @@ async function maybeUpgradeAbbreviatedMetaForReleaseAge(ctx, spec, opts, meta) {
     if (ctx.offline === true ||
         !opts.publishedBy ||
         meta.time != null ||
+        ctx.releaseAgeUpgradeCheckedPackuments?.has(meta) === true ||
         opts.publishedByExclude?.(spec.name) === true) {
         return { meta };
     }
@@ -466,8 +528,11 @@ async function maybeUpgradeAbbreviatedMetaForReleaseAge(ctx, spec, opts, meta) {
         registry: opts.registry,
     });
     if (fullFetchResult.notModified) {
-        // Upgrade fetch came back 304: keep the abbreviated meta. The downstream
-        // `pickMatchingVersionFinal` will fall through to its warn-and-skip path.
+        // Upgrade fetch came back 304: the registry has no fuller form of this
+        // document, so keep it and let `pickMatchingVersionFinal` fall through to
+        // its warn-and-skip path. Remember the outcome against the packument
+        // itself so no other pick in this resolver repeats the request.
+        ctx.releaseAgeUpgradeCheckedPackuments?.add(meta);
         return { meta };
     }
     return { meta: fullFetchResult.meta, upgradedFrom: fullFetchResult };
@@ -478,12 +543,26 @@ async function maybeUpgradeAbbreviatedMetaForReleaseAge(ctx, spec, opts, meta) {
  * pre-upgrade abbreviated form without `time`, and every future install
  * would re-trigger the upgrade fetch.
  */
+/**
+ * The document to serve and cache after an upgrade attempt, marked so no
+ * later pick in this resolver repeats the request.
+ *
+ * Marking belongs here rather than in
+ * {@link maybeUpgradeAbbreviatedMetaForReleaseAge} because persisting the
+ * response to the mirror can hand back a different object, and only the one
+ * that reaches the cache is worth remembering. A registry whose full form is
+ * no more complete than its abbreviated one answers `200` rather than `304`,
+ * so both outcomes have to be marked — otherwise every dependency edge
+ * re-asks for the same full document.
+ */
 function upgradeMetaForCache(ctx, upgrade, opts) {
     if (upgrade.upgradedFrom == null)
         return upgrade.meta;
-    if (opts.dryRun)
-        return condenseMetaForCache(ctx, upgrade.meta);
-    return persistUpgradedMeta(ctx, opts.pkgMirror, upgrade.upgradedFrom);
+    const meta = opts.dryRun
+        ? condenseMetaForCache(ctx, upgrade.meta)
+        : persistUpgradedMeta(ctx, opts.pkgMirror, upgrade.upgradedFrom);
+    ctx.releaseAgeUpgradeCheckedPackuments?.add(meta);
+    return meta;
 }
 // A condensing resolver keeps and mirrors the condensed form — the mirror
 // only has to carry `time` into the next install; otherwise the raw response
@@ -584,8 +663,17 @@ function isMissingTimeError(err) {
 // memory via this Set as they resolve ever more distinct packages.
 const MAX_WARNED_MISSING_TIME = 1024;
 const warnedMissingTimeFor = new Set();
-export function warnMissingTimeFieldOnce(pkgName) {
-    if (warnedMissingTimeFor.has(pkgName))
+/**
+ * At most one warning per package per check. `minimumReleaseAge` and
+ * `trustPolicy` both go dark on the same missing field, so keying by package
+ * alone would let whichever check ran first silence the other and leave the
+ * user told about only one of the two skips.
+ */
+export function warnMissingTimeFieldOnce(pkgName, skippedCheck) {
+    // A package name cannot contain ':', so the check name prefix cannot
+    // collide with a name that happens to embed it.
+    const key = `${skippedCheck}:${pkgName}`;
+    if (warnedMissingTimeFor.has(key))
         return;
     if (warnedMissingTimeFor.size >= MAX_WARNED_MISSING_TIME) {
         // Set preserves insertion order, so the first entry is the oldest.
@@ -593,8 +681,8 @@ export function warnMissingTimeFieldOnce(pkgName) {
         if (oldest != null)
             warnedMissingTimeFor.delete(oldest);
     }
-    warnedMissingTimeFor.add(pkgName);
-    globalWarn(`The metadata of ${pkgName} is missing the "time" field; skipping the minimumReleaseAge check for this package.`);
+    warnedMissingTimeFor.add(key);
+    globalWarn(`The metadata of ${pkgName} is missing the "time" field; skipping the ${skippedCheck} check for this package.`);
 }
 async function getFileMtime(filePath) {
     try {
@@ -646,6 +734,7 @@ export async function loadMeta(pkgMirror) {
             return null;
         const headers = JSON.parse(data.slice(0, newlineIdx));
         const meta = JSON.parse(data.slice(newlineIdx + 1));
+        dropIncompletePublishTimes(meta);
         meta.etag = headers.etag;
         return meta;
     }

package/lib/pickPackageFromMeta.d.ts

@@ -1,5 +1,5 @@
 import type { PackageInRegistry, PackageMeta, PackageMetaWithTime } from '@pnpm/resolving.registry.types';
-import type { VersionSelectors } from '@pnpm/resolving.resolver-base';
+import { type VersionSelectors } from '@pnpm/resolving.resolver-base';
 import type { PackageVersionPolicy } from '@pnpm/types';
 import type { RegistryPackageSpec } from './parseBareSpecifier.js';
 export interface PickVersionByVersionRangeOptions {
@@ -41,3 +41,9 @@ export declare function applyPublishedByPolicy(meta: PackageMeta, publishedBy: D
 export declare function assertMetaHasTime(meta: PackageMeta): asserts meta is PackageMetaWithTime;
 export declare function pickLowestVersionByVersionRange({ meta, versionRange, preferredVersionSelectors }: PickVersionByVersionRangeOptions): string | null;
 export declare function pickVersionByVersionRange({ meta, versionRange, preferredVersionSelectors }: PickVersionByVersionRangeOptions): string | null;
+/**
+ * Returns the cached version only when lockfile preferences prove that no
+ * version missing from the cached packument could tie or outrank it.
+ */
+export declare function pickStableCachedRangeVersion({ meta, preferredVersionSelectors, versionRange, }: PickVersionByVersionRangeOptions): string | null;
+export declare function getDominantLockfileVersion(versionRange: string, preferredVersionSelectors?: VersionSelectors): string | null;

package/lib/pickPackageFromMeta.js

@@ -1,6 +1,7 @@
 import util from 'node:util';
 import { PnpmError } from '@pnpm/error';
 import { filterPkgMetadataByPublishDate } from '@pnpm/resolving.registry.pkg-metadata-filter';
+import { EXISTING_VERSION_SELECTOR_WEIGHT, } from '@pnpm/resolving.resolver-base';
 import semver from 'semver';
 export function pickPackageFromMeta(pickVersionByVersionRangeFn, { preferredVersionSelectors, publishedBy, publishedByExclude, }, meta, spec) {
     if (publishedBy) {
@@ -152,6 +153,86 @@ export function pickVersionByVersionRange({ meta, versionRange, preferredVersion
     }
     return maxVersion;
 }
+/**
+ * Returns the cached version only when lockfile preferences prove that no
+ * version missing from the cached packument could tie or outrank it.
+ */
+export function pickStableCachedRangeVersion({ meta, preferredVersionSelectors, versionRange, }) {
+    const dominantLockfileVersion = getDominantLockfileVersion(versionRange, preferredVersionSelectors);
+    if (dominantLockfileVersion == null || meta.versions[dominantLockfileVersion] == null)
+        return null;
+    try {
+        const pickedVersion = pickVersionByVersionRange({ meta, preferredVersionSelectors, versionRange });
+        return pickedVersion === dominantLockfileVersion ? dominantLockfileVersion : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function getDominantLockfileVersion(versionRange, preferredVersionSelectors) {
+    if (preferredVersionSelectors == null)
+        return null;
+    let lockfileVersion;
+    for (const [selector, value] of Object.entries(preferredVersionSelectors)) {
+        if (selector === versionRange)
+            continue;
+        const { selectorType, weight } = preferredSelectorInfo(value);
+        if (!Number.isSafeInteger(weight) || weight <= 0)
+            return null;
+        if (selectorType === 'version' &&
+            weight >= EXISTING_VERSION_SELECTOR_WEIGHT &&
+            semverSatisfiesLoose(selector, versionRange)) {
+            if (lockfileVersion != null)
+                return null;
+            lockfileVersion = selector;
+        }
+    }
+    if (lockfileVersion == null)
+        return null;
+    let guaranteedLockfileWeight = 0;
+    let maximumOtherVersionWeight = 0;
+    for (const [selector, value] of Object.entries(preferredVersionSelectors)) {
+        if (selector === versionRange)
+            continue;
+        const { selectorType, weight } = preferredSelectorInfo(value);
+        switch (selectorType) {
+            case 'version':
+                if (selector === lockfileVersion) {
+                    guaranteedLockfileWeight += weight;
+                }
+                else if (weight < EXISTING_VERSION_SELECTOR_WEIGHT &&
+                    semverSatisfiesLoose(selector, versionRange)) {
+                    maximumOtherVersionWeight += weight;
+                }
+                break;
+            case 'range':
+                if (semverSatisfiesLoose(lockfileVersion, selector)) {
+                    guaranteedLockfileWeight += weight;
+                }
+                // Conservatively assume an unseen version can satisfy every preferred
+                // range, even when proving range intersection would be more precise.
+                maximumOtherVersionWeight += weight;
+                break;
+            case 'tag':
+                // A registry can move a tag between requests. Do not count its current
+                // target toward the lockfile version, and assume all tags could move to
+                // the same unseen version.
+                maximumOtherVersionWeight += weight;
+                break;
+        }
+        if (!Number.isSafeInteger(guaranteedLockfileWeight) ||
+            !Number.isSafeInteger(maximumOtherVersionWeight))
+            return null;
+    }
+    return guaranteedLockfileWeight > maximumOtherVersionWeight
+        ? lockfileVersion
+        : null;
+}
+function preferredSelectorInfo(value) {
+    return typeof value === 'string'
+        ? { selectorType: value, weight: 1 }
+        : value;
+}
 function prioritizePreferredVersions(meta, versionRange, preferredVerSelectors) {
     const preferredVerSelectorsArr = Object.entries(preferredVerSelectors ?? {});
     const versionsPrioritizer = new PreferredVersionsPrioritizer();
@@ -163,9 +244,7 @@ function prioritizePreferredVersions(meta, versionRange, preferredVerSelectors)
     }
     // Then apply weights from preferred selectors
     for (const [preferredSelector, preferredSelectorType] of preferredVerSelectorsArr) {
-        const { selectorType, weight } = typeof preferredSelectorType === 'string'
-            ? { selectorType: preferredSelectorType, weight: 1 }
-            : preferredSelectorType;
+        const { selectorType, weight } = preferredSelectorInfo(preferredSelectorType);
         if (preferredSelector === versionRange)
             continue;
         switch (selectorType) {

package/lib/publishTimes.d.ts

@@ -0,0 +1,24 @@
+import type { PackageMeta } from '@pnpm/resolving.registry.types';
+/**
+ * Drops `time` unless it carries a publish timestamp for every version the
+ * packument lists.
+ *
+ * Registries may answer with a partial map: npmmirror adds `time` to its
+ * abbreviated documents but fills it in only for the versions it has synced
+ * since it started recording publish times, leaving the rest out. A partial
+ * map is indistinguishable from a complete one at the point of use, so the
+ * `minimumReleaseAge` filter reads every absent timestamp as "not mature"
+ * and silently drops the version — resolution then falls back to the lowest
+ * match.
+ *
+ * A map that can't decide maturity is worth nothing to the resolver, so it
+ * is normalized away where the document is parsed. Every packument past that
+ * point then carries either a complete `time` or none at all — the shape the
+ * npm registry's own abbreviated documents have, and the one the rest of the
+ * resolver is written against.
+ *
+ * A packument with no versions keeps whatever `time` it has — there is
+ * nothing for the map to be incomplete about — and a version whose entry is
+ * an empty string counts as absent.
+ */
+export declare function dropIncompletePublishTimes(meta: PackageMeta): void;

package/lib/publishTimes.js

@@ -0,0 +1,35 @@
+/**
+ * Drops `time` unless it carries a publish timestamp for every version the
+ * packument lists.
+ *
+ * Registries may answer with a partial map: npmmirror adds `time` to its
+ * abbreviated documents but fills it in only for the versions it has synced
+ * since it started recording publish times, leaving the rest out. A partial
+ * map is indistinguishable from a complete one at the point of use, so the
+ * `minimumReleaseAge` filter reads every absent timestamp as "not mature"
+ * and silently drops the version — resolution then falls back to the lowest
+ * match.
+ *
+ * A map that can't decide maturity is worth nothing to the resolver, so it
+ * is normalized away where the document is parsed. Every packument past that
+ * point then carries either a complete `time` or none at all — the shape the
+ * npm registry's own abbreviated documents have, and the one the rest of the
+ * resolver is written against.
+ *
+ * A packument with no versions keeps whatever `time` it has — there is
+ * nothing for the map to be incomplete about — and a version whose entry is
+ * an empty string counts as absent.
+ */
+export function dropIncompletePublishTimes(meta) {
+    if (meta.time == null)
+        return;
+    for (const version in meta.versions) {
+        if (!Object.hasOwn(meta.versions, version))
+            continue;
+        if (!Object.hasOwn(meta.time, version) || !meta.time[version]) {
+            delete meta.time;
+            return;
+        }
+    }
+}
+//# sourceMappingURL=publishTimes.js.map

package/lib/trustChecks.d.ts

@@ -4,6 +4,20 @@ type TrustEvidence = 'provenance' | 'trustedPublisher' | 'stagedPublish';
 export declare function failIfTrustDowngraded(meta: PackageMeta, version: string, opts?: {
     trustPolicyExclude?: PackageVersionPolicy;
     trustPolicyIgnoreAfter?: number;
+    /**
+     * The `minimumReleaseAgeIgnoreMissingTime` opt-in, which declares that
+     * the registry cannot date its releases. The downgrade check orders
+     * history by publish date, so a packument with no `time` map leaves it
+     * nothing to order and the check is skipped with a warning rather than
+     * aborting the install.
+     *
+     * Scoped to the whole map being absent, which `dropIncompletePublishTimes`
+     * makes the only shape a registry that dates some of its versions can
+     * reach here in. A packument that dates every version it lists is instead
+     * saying it does not have this one, so that shape keeps failing closed
+     * however this flag is set.
+     */
+    ignoreMissingTimeField?: boolean;
 }): void;
 export declare function getTrustEvidence(manifest: PackageInRegistry): TrustEvidence | undefined;
 export {};

package/lib/trustChecks.js

@@ -1,5 +1,6 @@
 import { PnpmError } from '@pnpm/error';
 import semver from 'semver';
+import { warnMissingTimeFieldOnce } from './pickPackage.js';
 import { assertMetaHasTime } from './pickPackageFromMeta.js';
 const TRUST_RANK = {
     stagedPublish: 3,
@@ -16,6 +17,10 @@ export function failIfTrustDowngraded(meta, version, opts) {
             return;
         }
     }
+    if (meta.time == null && opts?.ignoreMissingTimeField) {
+        warnMissingTimeFieldOnce(meta.name, 'trustPolicy');
+        return;
+    }
     assertMetaHasTime(meta);
     const versionPublishedAt = meta.time[version];
     if (!versionPublishedAt) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.npm-resolver",
-  "version": "1103.2.0",
+  "version": "1104.0.0",
   "description": "Resolver for npm-hosted packages",
   "keywords": [
     "pnpm",
@@ -29,24 +29,24 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/config.normalize-registries": "1100.1.0",
-    "@pnpm/config.pick-registry-for-package": "1100.1.0",
-    "@pnpm/config.version-policy": "1100.1.12",
-    "@pnpm/constants": "1101.0.0",
-    "@pnpm/core-loggers": "1100.3.2",
+    "@pnpm/config.normalize-registries": "1101.0.0",
+    "@pnpm/config.pick-registry-for-package": "1101.0.0",
+    "@pnpm/config.version-policy": "1100.2.1",
+    "@pnpm/constants": "1102.0.0",
+    "@pnpm/core-loggers": "1100.3.3",
     "@pnpm/crypto.hash": "1100.0.2",
-    "@pnpm/deps.path": "1100.1.0",
-    "@pnpm/error": "1100.1.1",
+    "@pnpm/deps.path": "1101.0.0",
+    "@pnpm/error": "1100.1.3",
     "@pnpm/fetching.types": "1100.0.3",
     "@pnpm/fs.graceful-fs": "1100.1.1",
-    "@pnpm/pkg-manifest.utils": "1100.3.1",
-    "@pnpm/resolving.jsr-specifier-parser": "1100.0.4",
-    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.16",
-    "@pnpm/resolving.registry.types": "1100.1.9",
-    "@pnpm/resolving.resolver-base": "1101.1.0",
-    "@pnpm/store.cafs": "1100.1.18",
-    "@pnpm/store.index": "1100.2.3",
-    "@pnpm/types": "1101.9.0",
+    "@pnpm/pkg-manifest.utils": "1100.4.1",
+    "@pnpm/resolving.jsr-specifier-parser": "1100.0.6",
+    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.17",
+    "@pnpm/resolving.registry.types": "1100.1.10",
+    "@pnpm/resolving.resolver-base": "1101.1.1",
+    "@pnpm/store.cafs": "1100.2.0",
+    "@pnpm/store.index": "1100.2.5",
+    "@pnpm/types": "1102.0.0",
     "@pnpm/workspace.range-resolver": "1100.0.3",
     "@pnpm/workspace.spec-parser": "1100.0.1",
     "@zkochan/retry": "^0.2.0",
@@ -59,20 +59,19 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "rename-overwrite": "^7.0.1",
     "semver": "^7.8.5",
-    "semver-utils": "^1.1.4",
     "ssri": "13.0.1",
     "validate-npm-package-name": "7.0.2",
     "version-selector-type": "^3.0.0"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0",
-    "@pnpm/worker": "^1100.2.10"
+    "@pnpm/worker": "^1100.3.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/network.fetch": "1100.1.11",
-    "@pnpm/resolving.npm-resolver": "1103.2.0",
+    "@pnpm/network.fetch": "1100.1.13",
+    "@pnpm/resolving.npm-resolver": "1104.0.0",
     "@pnpm/test-fixtures": "1100.0.1",
     "@pnpm/testing.mock-agent": "1101.0.7",
     "@types/normalize-path": "^3.0.2",

package/lib/inferRangeSpecStyle.d.ts

@@ -1,2 +0,0 @@
-import type { RangeSpecStyle } from '@pnpm/types';
-export declare function inferRangeSpecStyle(spec: string): RangeSpecStyle | undefined;

package/lib/inferRangeSpecStyle.js

@@ -1,39 +0,0 @@
-import { parseRange } from 'semver-utils';
-export function inferRangeSpecStyle(spec) {
-    // A catalog reference carries no version pinning of its own; the pinning is
-    // defined by the catalog entry it points to. Bail out so a catalog name that
-    // happens to look like a version (e.g. "catalog:express4-21") isn't misread
-    // as a pinned version.
-    if (spec.startsWith('catalog:'))
-        return undefined;
-    const colonIndex = spec.indexOf(':');
-    if (colonIndex !== -1) {
-        spec = spec.substring(colonIndex + 1);
-    }
-    const index = spec.lastIndexOf('@');
-    if (index !== -1) {
-        spec = spec.slice(index + 1);
-    }
-    if (spec === '*')
-        return 'none';
-    const parsedRange = parseRange(spec);
-    if (parsedRange.length !== 1)
-        return undefined;
-    const versionObject = parsedRange[0];
-    switch (versionObject.operator) {
-        case '~': return 'minor';
-        case '^': return 'major';
-        // A bare '=' before a full version is an explicit exact pin; a partial
-        // '=' pins the same way the plain version it prefixes does.
-        case '=':
-        case undefined:
-            if (versionObject.patch)
-                return versionObject.operator === '=' ? 'exact' : 'patch';
-            if (versionObject.minor)
-                return 'minor';
-            if (versionObject.major)
-                return 'major';
-    }
-    return undefined;
-}
-//# sourceMappingURL=inferRangeSpecStyle.js.map