@pnpm/resolving.npm-resolver 1103.2.1 → 1104.0.0

package/CHANGELOG.md

@@ -1,5 +1,71 @@
 # @pnpm/npm-resolver
 
+## 1104.0.0
+
+### Major Changes
+
+- The three registry lookups are now named for what they are keyed by, so that none of them is called `registries` — a name the `registries` setting itself has taken:
+
+  | before | after |
+  |---|---|
+  | `Config.registries` | `Config.registriesByScope` |
+  | `Config.namedRegistries` | `Config.registriesByPrefix` |
+  | `Config.registryOptions` | `Config.registryOptionsByUrl` |
+
+  The same rename applies to the `RegistryContext` fields, the `Registries` and `NamedRegistries` types (now `RegistriesByScope` and `RegistriesByPrefix`), `normalizeRegistries` / `normalizeNamedRegistries` (now `normalizeRegistriesByScope` / `normalizeRegistriesByPrefix`), and the `BUILTIN_NAMED_REGISTRIES` constant (now `BUILTIN_REGISTRIES_BY_PREFIX`).
+
+  This is an internal rename: no setting, error code, lockfile field, or `.pnpmfile.cjs` hook field changes. A `preResolution` hook still reads `ctx.registries`, which is the name pacquet passes as well. The `registries` and `namedRegistries` settings are read under the names users write them.
+
+  The pnpr resolve request sends `registriesByPrefix` where it sent `namedRegistries`. A pnpr server and its clients must be on matching versions, which is already the case for an experimental server.
+
+### Minor Changes
+
+- A registry can now declare that its abbreviated metadata carries the `time` field, so `resolutionMode: time-based` reads the full metadata document only from the registries that need it:
+
+  ```yaml
+  resolutionMode: time-based
+  registries:
+    https://npm.internal.example/:
+      supportsTimeField: true
+  ```
+
+  `registry.npmjs.org` omits `time` from abbreviated metadata, so a time-based resolution has to fall back to the much larger full document. That fallback used to be all-or-nothing: `registrySupportsTimeField` answered for every registry at once, so a project resolving from both the public registry and a Verdaccio instance either paid for full metadata everywhere or claimed a `time` field npmjs does not serve. The answer is now per registry, and `registrySupportsTimeField` remains the answer for every registry that does not declare one.
+
+  The declaration is also sent to a pnpr server, which applies it to the resolution it runs on the client's behalf.
+
+### Patch Changes
+
+- Re-fetch full registry metadata when `minimumReleaseAge` is enabled and an abbreviated packument's `time` map omits timestamps for some versions. This prevents mature versions from being filtered out and resolution from falling back to the lowest matching version [pnpm/pnpm#13741](https://github.com/pnpm/pnpm/issues/13741).
+
+- Reduced registry metadata requests during dependency resolution by reusing cached metadata when lockfile preferences prove that no uncached version can win [pnpm/pnpm#13976](https://github.com/pnpm/pnpm/issues/13976).
+
+- Installs are faster in workspaces that declare inter-workspace dependencies with plain ranges (`"*"`, `"^1.2.3"`) rather than the `workspace:` protocol. With `preferWorkspacePackages` enabled, linking such a dependency no longer makes a registry request that cannot change the outcome — and workspace packages that were never published no longer cost a 404 on every install.
+
+- Added `fetchWarnTimeoutMs` and `fetchMinSpeedKiBps` to the Rust pnpm CLI and its N-API bindings. Slow registry metadata requests and tarball downloads now emit pnpm-compatible warnings without exposing URL credentials, query parameters, fragments, or control characters [pnpm/pnpm#12042](https://github.com/pnpm/pnpm/issues/12042).
+
+- `trustPolicy: no-downgrade` no longer aborts the install with `ERR_PNPM_MISSING_TIME` on registries that serve no per-version `time` field when `minimumReleaseAgeIgnoreMissingTime` is set. The trust check reads the same publish dates the `minimumReleaseAge` check does, so it now honors the same opt-in and skips the affected package with a warning [#12446](https://github.com/pnpm/pnpm/issues/12446).
+
+  `minimumReleaseAgeIgnoreMissingTime` no longer lets a lockfile entry the registry does not list pass the `minimumReleaseAge` check during lockfile verification. The opt-in covers a registry that cannot date its releases; a packument that does date every version it lists is saying it never published this one, which stays a hard failure.
+
+  The missing-`time` warning now names the check it is reporting on, so a package whose `minimumReleaseAge` and `trustPolicy` checks are both skipped warns about both instead of only the first.
+
+- Updated dependencies:
+  - @pnpm/config.normalize-registries@1101.0.0
+  - @pnpm/config.pick-registry-for-package@1101.0.0
+  - @pnpm/config.version-policy@1100.2.1
+  - @pnpm/constants@1102.0.0
+  - @pnpm/core-loggers@1100.3.3
+  - @pnpm/deps.path@1101.0.0
+  - @pnpm/error@1100.1.3
+  - @pnpm/pkg-manifest.utils@1100.4.1
+  - @pnpm/resolving.jsr-specifier-parser@1100.0.6
+  - @pnpm/resolving.registry.pkg-metadata-filter@1100.0.17
+  - @pnpm/resolving.registry.types@1100.1.10
+  - @pnpm/resolving.resolver-base@1101.1.1
+  - @pnpm/store.cafs@1100.2.0
+  - @pnpm/store.index@1100.2.5
+  - @pnpm/types@1102.0.0
+
 ## 1103.2.1
 
 ### Patch Changes

package/lib/createNpmResolutionVerifier.d.ts

@@ -1,6 +1,6 @@
 import type { GetAuthHeader } from '@pnpm/fetching.types';
 import { type ResolutionVerifier } from '@pnpm/resolving.resolver-base';
-import type { Registries, TrustPolicy } from '@pnpm/types';
+import type { RegistriesByScope, TrustPolicy } from '@pnpm/types';
 import type { FetchMetadataFromFromRegistryOptions } from './fetch.js';
 import { type FetchFullMetadataCachedOptions } from './fetchFullMetadataCached.js';
 import type { PackageMetaCache } from './pickPackage.js';
@@ -23,12 +23,15 @@ export interface CreateNpmResolutionVerifierOptions {
     /**
      * When the registry's metadata lacks the per-version `time` field
      * (some self-hosted registries strip it), the verifier can't apply
-     * the maturity cutoff. Set this to `true` to mirror the resolver's
-     * `pickMatchingVersionFinal` warn-and-skip behavior — the verifier
-     * passes the entry with a one-time `globalWarn`, instead of failing
-     * closed. Defaults to `false` so the verifier stays stricter than
-     * the resolver only when the user has explicitly opted in to the
-     * skip on the resolver side.
+     * the maturity cutoff, and the trust check has no publish order to
+     * walk. Set this to `true` to mirror the resolver's warn-and-skip
+     * behavior for both — the verifier passes the entry with a one-time
+     * `globalWarn`, instead of failing closed. Defaults to `false` so
+     * the verifier stays stricter than the resolver only when the user
+     * has explicitly opted in to the skip on the resolver side. Scoped
+     * to a packument with no usable `time` map: one that dates every
+     * version it lists is saying it never published this pin, which
+     * fails closed either way.
      */
     ignoreMissingTimeField?: boolean;
     /**
@@ -42,14 +45,14 @@ export interface CreateNpmResolutionVerifierOptions {
     trustPolicy?: TrustPolicy;
     trustPolicyExclude?: string[];
     trustPolicyIgnoreAfter?: number;
-    registries: Registries;
+    registriesByScope: RegistriesByScope;
     /**
-     * Registries reached via the named-registry resolver chain (e.g. `gh:` →
+     * RegistriesByScope reached via the named-registry resolver chain (e.g. `gh:` →
      * GitHub Packages). When a lockfile entry's tarball URL falls under one of
      * these registry base URLs, route the manifest fetch there instead of the
      * scope-derived default.
      */
-    namedRegistries?: Record<string, string>;
+    registriesByPrefix?: Record<string, string>;
     /**
      * Cache-aware full-metadata fetcher. Decoupled from the resolver pipeline
      * so abbreviated metadata and `peekManifestFromStore` fast paths cannot

package/lib/createNpmResolutionVerifier.js

@@ -1,5 +1,5 @@
 import { createHash } from 'node:crypto';
-import { normalizeNamedRegistries } from '@pnpm/config.normalize-registries';
+import { normalizeRegistriesByPrefix } from '@pnpm/config.normalize-registries';
 import { namedRegistryTarballPrefixes, pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
 import { createPackageVersionPolicy } from '@pnpm/config.version-policy';
 import { FULL_META_DIR } from '@pnpm/constants';
@@ -39,8 +39,8 @@ export function createNpmResolutionVerifier(opts) {
     const trustExcludePolicy = opts.trustPolicyExclude?.length
         ? createExcludePolicy(opts.trustPolicyExclude, 'trustPolicyExclude')
         : undefined;
-    const mergedNamedRegistries = normalizeNamedRegistries(opts.namedRegistries);
-    const namedRegistryPrefixes = namedRegistryTarballPrefixes(mergedNamedRegistries);
+    const mergedRegistriesByPrefix = normalizeRegistriesByPrefix(opts.registriesByPrefix);
+    const namedRegistryPrefixes = namedRegistryTarballPrefixes(mergedRegistriesByPrefix);
     // Per-install dedup of every network/disk fetch the verifier issues.
     // The maturity check uses the layered `fetchPublishedAt` lookup; the
     // trust check uses an attestation fast-path before falling back to
@@ -65,6 +65,7 @@ export function createNpmResolutionVerifier(opts) {
     const minimumReleaseAge = opts.minimumReleaseAge ?? 0;
     const trustPolicy = opts.trustPolicy;
     const trustPolicyIgnoreAfter = opts.trustPolicyIgnoreAfter;
+    const ignoreMissingTimeField = opts.ignoreMissingTimeField === true;
     const verify = async (resolution, { name, version, nonSemverVersion, registryName }) => {
         if (!isRegistryTarballResolution(resolution))
             return { ok: true };
@@ -105,20 +106,20 @@ export function createNpmResolutionVerifier(opts) {
             // Registry-qualified entries name their registry in the dep path, so
             // routing does not depend on a recorded tarball URL (canonical URLs
             // are omitted from the lockfile in the 12.0 format).
-            const namedRegistry = mergedNamedRegistries[registryName];
+            const namedRegistry = mergedRegistriesByPrefix[registryName];
             if (!namedRegistry) {
                 // Fail closed: without the registry URL, none of the metadata-backed
                 // checks below can vouch for this entry.
                 return {
                     ok: false,
                     code: MISSING_NAMED_REGISTRY_VIOLATION_CODE,
-                    reason: `was resolved from the named registry '${registryName}:', which is not present in the namedRegistries setting`,
+                    reason: `was resolved from the named registry '${registryName}:', which is not present in the registriesByPrefix setting`,
                 };
             }
             registry = namedRegistry;
         }
         else {
-            registry = pickRegistryForVersion(opts.registries, namedRegistryPrefixes, name, tarballUrl);
+            registry = pickRegistryForVersion(opts.registriesByScope, namedRegistryPrefixes, name, tarballUrl);
         }
         // A registry entry that pins an explicit tarball URL must point at the
         // artifact the registry's own metadata lists. Otherwise a trusted
@@ -138,7 +139,7 @@ export function createNpmResolutionVerifier(opts) {
         if (!ageApplies && !trustApplies)
             return { ok: true };
         if (ageApplies) {
-            const ageViolation = await runAgeCheck(lookupContext, registry, name, version, cutoff, opts.ignoreMissingTimeField === true);
+            const ageViolation = await runAgeCheck(lookupContext, registry, name, version, cutoff, ignoreMissingTimeField);
             if (ageViolation)
                 return ageViolation;
         }
@@ -146,6 +147,7 @@ export function createNpmResolutionVerifier(opts) {
             const trustViolation = await runTrustCheck(lookupContext, registry, name, version, {
                 trustPolicyExclude: trustExcludePolicy,
                 trustPolicyIgnoreAfter,
+                ignoreMissingTimeField,
             });
             if (trustViolation)
                 return trustViolation;
@@ -163,9 +165,9 @@ export function createNpmResolutionVerifier(opts) {
     // stays trusted after its exclude entry has been pulled.
     const sortedMinAgeExcludes = [...new Set(opts.minimumReleaseAgeExclude ?? [])].sort();
     const sortedTrustExcludes = [...new Set(opts.trustPolicyExclude ?? [])].sort();
-    const sortedNamedRegistries = Object.fromEntries(Object.entries(mergedNamedRegistries).sort(([aliasA], [aliasB]) => aliasA.localeCompare(aliasB)));
+    const sortedRegistriesByPrefix = Object.fromEntries(Object.entries(mergedRegistriesByPrefix).sort(([aliasA], [aliasB]) => aliasA.localeCompare(aliasB)));
     const namedRegistriesRouting = createHash('sha256')
-        .update(JSON.stringify(sortedNamedRegistries))
+        .update(JSON.stringify(sortedRegistriesByPrefix))
         .digest('hex');
     return {
         verify,
@@ -184,6 +186,7 @@ export function createNpmResolutionVerifier(opts) {
             trustPolicy: trustPolicy ?? null,
             trustPolicyExclude: sortedTrustExcludes,
             trustPolicyIgnoreAfter: trustPolicyIgnoreAfter ?? null,
+            minimumReleaseAgeIgnoreMissingTime: ignoreMissingTimeField,
         },
         canTrustPastCheck: (cached) => {
             // The tarball-URL binding is unconditional today; a cached run that
@@ -233,6 +236,14 @@ export function createNpmResolutionVerifier(opts) {
             const todayIgnoreAfter = trustPolicyIgnoreAfter ?? null;
             if (pastIgnoreAfter !== todayIgnoreAfter)
                 return false;
+            // Missing-time tolerance: a cached run that failed closed on an
+            // absent `time` field accepted a subset of what today's tolerant
+            // policy accepts, so it stays trustworthy. Turning the tolerance
+            // off invalidates it — entries the past run waved through are the
+            // ones today's policy exists to reject. Older records (no field)
+            // read as intolerant, which is the safe direction.
+            if (cached.minimumReleaseAgeIgnoreMissingTime === true && !ignoreMissingTimeField)
+                return false;
             return true;
         },
     };
@@ -245,15 +256,23 @@ async function runAgeCheck(context, registry, name, version, cutoff, ignoreMissi
     const published = await fetchPublishedAt(context, registry, name, version);
     if (!published) {
         // No source — attestation, local mirror, or full metadata —
-        // surfaced a publish timestamp for this version. The resolver's
-        // pickMatchingVersionFinal honors `minimumReleaseAgeIgnoreMissingTime`
-        // for the same shape (some self-hosted registries strip per-version
-        // `time`); the verifier mirrors that so it can't be stricter than
-        // fresh resolution. Without the flag we still fail closed — better
-        // a false reject than silent bypass when the user hasn't opted in.
+        // surfaced a publish timestamp for this version. What
+        // `minimumReleaseAgeIgnoreMissingTime` opts out of is a registry that
+        // cannot date its releases, so the skip is granted only when the
+        // packument carries no usable `time` map at all — the same shape the
+        // resolver's `pickMatchingVersionFinal` warns and skips on, so the
+        // verifier can't be stricter than fresh resolution. A packument that
+        // does date every version it lists is instead telling us this pin is
+        // not one of them (`dropIncompletePublishTimes` leaves no partial maps
+        // for that to be ambiguous), and an unpublished or never-published pin
+        // must fail closed however the flag is set.
         if (ignoreMissingTimeField) {
-            warnMissingTimeFieldOnce(name);
-            return undefined;
+            // Already awaited by the lookup above, so this is a cache hit.
+            const timeMap = await fetchFullMetaTime(context, registry, name);
+            if (timeMap == null) {
+                warnMissingTimeFieldOnce(name, 'minimumReleaseAge');
+                return undefined;
+            }
         }
         return {
             ok: false,
@@ -315,10 +334,9 @@ async function runTarballUrlCheck(context, registry, name, version, lockfileTarb
 function sameTarballUrl(a, b) {
     return canonicalTarballUrl(a) === canonicalTarballUrl(b);
 }
-// Mirror the tolerance toLockfileResolution applies when it decides whether
-// a tarball URL is "the expected one": ignore the protocol and `%2f` scope
-// encoding so a benign http/https or encoding difference isn't read as
-// tampering. The `%2f` match is case-insensitive because `normalizeRegistryUrl`
+// Both URLs come from the registry, so ignore the protocol and `%2f` scope
+// encoding: a benign http/https or encoding difference isn't tampering. The
+// `%2f` match is case-insensitive because `normalizeRegistryUrl`
 // (`new URL().toString()`) can upper-case percent-escapes to `%2F`.
 function canonicalTarballUrl(url) {
     const normalized = normalizeRegistryUrl(url).replace(/%2f/gi, '/');
@@ -657,7 +675,7 @@ function fetchFullMetaTime(context, registry, name) {
     }
     return cachedPromise;
 }
-function pickRegistryForVersion(registries, namedRegistryPrefixes, name, tarballUrl) {
+function pickRegistryForVersion(registriesByScope, namedRegistryPrefixes, name, tarballUrl) {
     // If the lockfile records where the tarball lives, prefer that — scope
     // routing (`@scope:registry`) only covers scoped packages, but named
     // registries (`gh:`, `jsr:` aliases, custom) ship un-scoped packages whose
@@ -674,7 +692,7 @@ function pickRegistryForVersion(registries, namedRegistryPrefixes, name, tarball
                 return prefix;
         }
     }
-    return pickRegistryForPackage(registries, name);
+    return pickRegistryForPackage(registriesByScope, name);
 }
 function tryParseUrl(url) {
     try {

package/lib/fetch.js

@@ -1,11 +1,12 @@
 import url from 'node:url';
 import util from 'node:util';
 import { requestRetryLogger } from '@pnpm/core-loggers';
-import { FetchError, PnpmError, redactUrlCredentials, } from '@pnpm/error';
+import { FetchError, PnpmError, redactUrlCredentials, redactUrlForDisplay, } from '@pnpm/error';
 import { globalWarn } from '@pnpm/logger';
 import * as retry from '@zkochan/retry';
 import semver from 'semver';
 import { clearMeta } from './clearMeta.js';
+import { dropIncompletePublishTimes } from './publishTimes.js';
 /**
  * Content type of an abbreviated (install-oriented) package metadata document.
  * A spec-compliant registry echoes this in the response `Content-Type` when it
@@ -147,10 +148,11 @@ export async function fetchMetadataFromFromRegistry(fetchOpts, pkgName, { authHe
             try {
                 const jsonText = await response.text();
                 const meta = JSON.parse(jsonText);
+                dropIncompletePublishTimes(meta);
                 // Check if request took longer than expected
                 const elapsedMs = Date.now() - startTime;
                 if (elapsedMs > fetchOpts.fetchWarnTimeoutMs) {
-                    globalWarn(`Request took ${elapsedMs}ms: ${uri}`);
+                    globalWarn(`Request took ${elapsedMs}ms: ${redactUrlForDisplay(uri)}`);
                 }
                 resolve({
                     ...normalizeAbbreviatedResponse({ fullMetadata, meta, jsonText, response }),
@@ -200,7 +202,7 @@ export function notModifiedWithoutCacheError(pkgName) {
  * carry the megabytes of install-irrelevant data (scripts, exports, readme,
  * custom fields) that a full document contains.
  *
- * Registries that honor the header (e.g. the npm registry) echo the abbreviated
+ * RegistriesByScope that honor the header (e.g. the npm registry) echo the abbreviated
  * `Content-Type`, so this is a no-op for them: no re-serialization, no field
  * stripping — the happy path pays nothing.
  */

package/lib/index.d.ts

@@ -2,9 +2,9 @@ import { PnpmError } from '@pnpm/error';
 import type { FetchFromRegistry, GetAuthHeader, RetryTimeoutOptions } from '@pnpm/fetching.types';
 import type { PackageMeta } from '@pnpm/resolving.registry.types';
 import type { DirectoryResolution, LatestInfo, LatestQuery, PkgResolutionId, PreferredVersions, ResolveOptions, ResolveResult, TarballResolution, WantedDependency, WorkspacePackages } from '@pnpm/resolving.resolver-base';
-import type { DependencyManifest, PackageVersionPolicy, RangeSpecStyle, Registries, TrustPolicy } from '@pnpm/types';
+import type { DependencyManifest, PackageVersionPolicy, RangeSpecStyle, RegistriesByScope, TrustPolicy } from '@pnpm/types';
 import { fetchMetadataFromFromRegistry, type FetchMetadataFromFromRegistryOptions, RegistryResponseError } from './fetch.js';
-import { BUILTIN_NAMED_REGISTRIES, parseBareSpecifier, type RegistryPackageSpec } from './parseBareSpecifier.js';
+import { BUILTIN_REGISTRIES_BY_PREFIX, parseBareSpecifier, type RegistryPackageSpec } from './parseBareSpecifier.js';
 import { type PackageMetaCache, pickPackage, type PickPackageOptions } from './pickPackage.js';
 import { pickPackageFromMeta, pickVersionByVersionRange } from './pickPackageFromMeta.js';
 import { workspacePrefToNpm } from './workspacePrefToNpm.js';
@@ -18,7 +18,7 @@ export declare class NoMatchingVersionError extends PnpmError {
     constructor(opts: NoMatchingVersionErrorOptions);
 }
 export declare function formatTimeAgo(date: Date): string | null;
-export { BUILTIN_NAMED_REGISTRIES, fetchMetadataFromFromRegistry, type FetchMetadataFromFromRegistryOptions, type PackageMeta, type PackageMetaCache, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, type RegistryPackageSpec, RegistryResponseError, workspacePrefToNpm, };
+export { BUILTIN_REGISTRIES_BY_PREFIX, fetchMetadataFromFromRegistry, type FetchMetadataFromFromRegistryOptions, type PackageMeta, type PackageMetaCache, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, type RegistryPackageSpec, RegistryResponseError, workspacePrefToNpm, };
 export { createNpmResolutionVerifier, type CreateNpmResolutionVerifierOptions } from './createNpmResolutionVerifier.js';
 export { MINIMUM_RELEASE_AGE_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
 export interface ResolverFactoryOptions {
@@ -26,13 +26,20 @@ export interface ResolverFactoryOptions {
     storeDir?: string;
     frozenStore?: boolean;
     fullMetadata?: boolean;
+    /**
+     * Asked instead of {@link ResolverFactoryOptions.fullMetadata} when the
+     * caller can answer per registry — a registry that declares
+     * `supportsTimeField` needs no full metadata for a time-based resolution
+     * even when the others do.
+     */
+    needsFullMetadataFor?: (registry: string) => boolean;
     filterMetadata?: boolean;
     offline?: boolean;
     preferOffline?: boolean;
     retry?: RetryTimeoutOptions;
     timeout?: number;
-    registries: Registries;
-    namedRegistries?: Record<string, string>;
+    registriesByScope: RegistriesByScope;
+    registriesByPrefix?: Record<string, string>;
     saveWorkspaceProtocol?: boolean | 'rolling';
     preserveAbsolutePaths?: boolean;
     ignoreMissingTimeField?: boolean;
@@ -83,10 +90,16 @@ export declare function createNpmResolver(fetchFromRegistry: FetchFromRegistry,
 export interface ResolveFromNpmContext {
     pickPackage: (spec: RegistryPackageSpec, opts: PickPackageOptions) => ReturnType<typeof pickPackage>;
     getAuthHeaderValueByURI: GetAuthHeader;
-    registries: Registries;
-    namedRegistries: Record<string, string>;
+    registriesByScope: RegistriesByScope;
+    registriesByPrefix: Record<string, string>;
     namedRegistryNames: ReadonlySet<string>;
     saveWorkspaceProtocol?: boolean | 'rolling';
+    /**
+     * The `minimumReleaseAgeIgnoreMissingTime` opt-in, reaching the trust
+     * check as well as the version pick: both read the same per-version
+     * `time`, so a registry that strips it takes both down together.
+     */
+    ignoreMissingTimeField?: boolean;
     peekManifestFromStore?: (opts: {
         id: PkgResolutionId;
         integrity: string;

package/lib/index.js

@@ -18,7 +18,7 @@ import { clearMeta, retainsFullMeta } from './clearMeta.js';
 import { fetchMetadataFromFromRegistry, RegistryResponseError } from './fetch.js';
 import { memoizeFetchMetadata } from './memoizeFetchMetadata.js';
 import { normalizeRegistryUrl } from './normalizeRegistryUrl.js';
-import { BUILTIN_NAMED_REGISTRIES, parseBareSpecifier, parseJsrSpecifierToRegistryPackageSpec, parseNamedRegistrySpecifierToRegistryPackageSpec, } from './parseBareSpecifier.js';
+import { BUILTIN_REGISTRIES_BY_PREFIX, parseBareSpecifier, parseJsrSpecifierToRegistryPackageSpec, parseNamedRegistrySpecifierToRegistryPackageSpec, } from './parseBareSpecifier.js';
 import { pickPackage, } from './pickPackage.js';
 import { applyPublishedByPolicy, pickPackageFromMeta, pickVersionByVersionRange } from './pickPackageFromMeta.js';
 import { failIfTrustDowngraded } from './trustChecks.js';
@@ -63,7 +63,7 @@ export function formatTimeAgo(date) {
         return `${diffMin} minute${diffMin === 1 ? '' : 's'} ago`;
     return 'a few seconds ago';
 }
-export { BUILTIN_NAMED_REGISTRIES, fetchMetadataFromFromRegistry, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, RegistryResponseError, workspacePrefToNpm, };
+export { BUILTIN_REGISTRIES_BY_PREFIX, fetchMetadataFromFromRegistry, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, RegistryResponseError, workspacePrefToNpm, };
 export { createNpmResolutionVerifier } from './createNpmResolutionVerifier.js';
 export { MINIMUM_RELEASE_AGE_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
 export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
@@ -88,6 +88,10 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
     // using.
     const ownsMetaCache = opts.metaCache == null;
     const metaCache = opts.metaCache ?? createDefaultPackageMetaCache();
+    // This marker is intentionally resolver-scoped rather than attached to
+    // `metaCache`: callers may reuse one metadata cache across installs, and a
+    // later install must retry a full-metadata upgrade that previously got 304.
+    const releaseAgeUpgradeCheckedPackuments = new WeakSet();
     // Create peek function if storeDir is provided
     const storeDir = opts.storeDir;
     const peekLockerForPeek = new Map();
@@ -114,31 +118,34 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
             return request;
         };
     }
-    const namedRegistries = mergeNamedRegistries(opts.namedRegistries);
-    const namedRegistryNames = new Set(Object.keys(namedRegistries));
+    const registriesByPrefix = mergeNamedRegistries(opts.registriesByPrefix);
+    const namedRegistryNames = new Set(Object.keys(registriesByPrefix));
     const ctx = {
         getAuthHeaderValueByURI: getAuthHeader,
         pickPackage: pickPackage.bind(null, {
             fetch,
             fullMetadata: opts.fullMetadata,
+            needsFullMetadataFor: opts.needsFullMetadataFor,
             filterMetadata: opts.filterMetadata,
             metaCache,
             offline: opts.offline,
             preferOffline: opts.preferOffline,
             cacheDir: opts.cacheDir,
             ignoreMissingTimeField: opts.ignoreMissingTimeField,
+            releaseAgeUpgradeCheckedPackuments,
         }),
-        registries: opts.registries,
-        namedRegistries,
+        registriesByScope: opts.registriesByScope,
+        registriesByPrefix,
         namedRegistryNames,
         saveWorkspaceProtocol: opts.saveWorkspaceProtocol,
+        ignoreMissingTimeField: opts.ignoreMissingTimeField,
         peekManifestFromStore,
         warnedHeldBackUpdates: new Set(),
     };
     const boundResolveFromNpm = resolveNpm.bind(null, ctx);
     const boundResolveFromJsr = resolveJsr.bind(null, ctx);
     const boundResolveFromNamedRegistry = resolveFromNamedRegistry.bind(null, ctx);
-    const defaultRegistry = opts.registries.default;
+    const defaultRegistry = opts.registriesByScope.default;
     return {
         resolveFromNpm: boundResolveFromNpm,
         resolveFromJsr: boundResolveFromJsr,
@@ -304,8 +311,8 @@ function createResolveLatest(resolve, matches) {
 async function resolveNpm(ctx, wantedDependency, opts) {
     const defaultTag = opts.defaultTag ?? 'latest';
     const registry = wantedDependency.alias
-        ? pickRegistryForPackage(ctx.registries, wantedDependency.alias, wantedDependency.bareSpecifier)
-        : ctx.registries.default;
+        ? pickRegistryForPackage(ctx.registriesByScope, wantedDependency.alias, wantedDependency.bareSpecifier)
+        : ctx.registriesByScope.default;
     if (wantedDependency.bareSpecifier?.startsWith('workspace:')) {
         if (wantedDependency.bareSpecifier.startsWith('workspace:.'))
             return null;
@@ -379,6 +386,34 @@ async function resolveNpm(ctx, wantedDependency, opts) {
             }
         }
     }
+    // This runs *after* the store peek because a tag-specified dep whose only local copy is a
+    // prerelease reaches here with `update: false` (`wantedDepIsLocallyAvailable` ignores
+    // prereleases for tags, `pickMatchingLocalVersionOrNull` does not), and the peek must keep
+    // winning there. `update` is deliberately absent from the guard: that same helper forces it
+    // on for exactly these deps, so excluding it would make this block unreachable.
+    if (opts.preferWorkspacePackages === true &&
+        workspacePackages != null &&
+        opts.projectDir &&
+        opts.trustPolicy !== 'no-downgrade' &&
+        !opts.updateChecksums &&
+        opts.injectWorkspacePackages !== true &&
+        !wantedDependency.injected) {
+        const workspacePkgsMatchingName = workspacePackages.get(spec.name);
+        if (workspacePkgsMatchingName?.size === 1) {
+            const localVersion = pickMatchingLocalVersionOrNull(workspacePkgsMatchingName, spec);
+            if (localVersion != null) {
+                return resolveFromLocalPackage(workspacePkgsMatchingName.get(localVersion), spec, {
+                    wantedDependency,
+                    projectDir: opts.projectDir,
+                    lockfileDir: opts.lockfileDir,
+                    hardLinkLocalPackages: false,
+                    saveWorkspaceProtocol: ctx.saveWorkspaceProtocol,
+                    calcSpecifier: opts.calcSpecifier,
+                    rangeSpecStyle: opts.rangeSpecStyle,
+                });
+            }
+        }
+    }
     const authHeaderValue = ctx.getAuthHeaderValueByURI(registry, { pkgName: spec.name });
     let pickResult;
     try {
@@ -393,6 +428,7 @@ async function resolveNpm(ctx, wantedDependency, opts) {
             includeLatestTag: opts.update === 'latest',
             updateChecksums: opts.updateChecksums,
             optional: wantedDependency.optional,
+            trustPolicy: opts.trustPolicy,
         });
     }
     catch (err) { // eslint-disable-line
@@ -448,7 +484,11 @@ async function resolveNpm(ctx, wantedDependency, opts) {
         throw new NoMatchingVersionError({ wantedDependency, packageMeta: meta, registry });
     }
     else if (opts.trustPolicy === 'no-downgrade') {
-        failIfTrustDowngraded(meta, pickedPackage.version, opts);
+        failIfTrustDowngraded(meta, pickedPackage.version, {
+            trustPolicyExclude: opts.trustPolicyExclude,
+            trustPolicyIgnoreAfter: opts.trustPolicyIgnoreAfter,
+            ignoreMissingTimeField: ctx.ignoreMissingTimeField,
+        });
     }
     const latest = latestAllowedByPolicy(meta, opts);
     const workspacePkgsMatchingName = workspacePackages?.get(pickedPackage.name);
@@ -524,7 +564,7 @@ async function resolveJsr(ctx, wantedDependency, opts) {
     const spec = parseJsrSpecifierToRegistryPackageSpec(wantedDependency.bareSpecifier, wantedDependency.alias, opts.defaultTag ?? 'latest');
     if (spec == null)
         return null;
-    const picked = await pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, ctx.registries['@jsr']); // '@jsr' is always defined
+    const picked = await pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, ctx.registriesByScope['@jsr']); // '@jsr' is always defined
     return {
         ...picked,
         normalizedBareSpecifier: opts.calcSpecifier
@@ -543,14 +583,14 @@ async function resolveJsr(ctx, wantedDependency, opts) {
 // another specifier scheme (e.g. `git`, `github`, `jsr`) is silently shadowed
 // by that scheme's dedicated resolver — no cross-resolver knowledge needed.
 function mergeNamedRegistries(userDefined) {
-    const merged = { ...BUILTIN_NAMED_REGISTRIES };
+    const merged = { ...BUILTIN_REGISTRIES_BY_PREFIX };
     if (!userDefined)
         return merged;
     for (const [alias, url] of Object.entries(userDefined)) {
         if (RESERVED_VERSION_PREFIXES.has(alias) || !isWellFormedRegistryName(alias)) {
             throw new PnpmError('RESERVED_NAMED_REGISTRY_NAME', RESERVED_VERSION_PREFIXES.has(alias)
                 ? `'${alias}' cannot be used as a named registry alias: it is a reserved dependency specifier prefix.`
-                : `'${alias}' cannot be used as a named registry alias: aliases must start with a letter and contain only letters, digits, ".", "_", and "-".`, { hint: 'Rename the entry in the namedRegistries setting.' });
+                : `'${alias}' cannot be used as a named registry alias: aliases must start with a letter and contain only letters, digits, ".", "_", and "-".`, { hint: 'Rename the entry in the registriesByPrefix setting.' });
         }
         if (typeof url !== 'string' || !isValidHttpUrl(url)) {
             throw new PnpmError('INVALID_NAMED_REGISTRY_URL', `The named registry alias '${alias}' is mapped to '${String(url)}', which is not a valid http(s) URL.`, { hint: 'Provide a URL that starts with http:// or https://, e.g. https://npm.pkg.example.com/' });
@@ -571,7 +611,7 @@ function isValidHttpUrl(url) {
 // Resolves a `<alias>:` specifier from one of the configured named registries.
 // The `gh:` alias ships as a built-in default pointing at the GitHub Packages
 // npm registry; additional aliases come from pnpm-workspace.yaml's
-// `namedRegistries` field. Auth tokens are looked up by the resolved registry
+// `registriesByPrefix` field. Auth tokens are looked up by the resolved registry
 // URL, so a `//npm.pkg.github.com/:_authToken=...` entry in `.npmrc` is
 // picked up automatically for `gh:` specifiers (and analogously for any user-
 // configured alias).
@@ -581,7 +621,7 @@ async function resolveFromNamedRegistry(ctx, wantedDependency, opts) {
     const spec = parseNamedRegistrySpecifierToRegistryPackageSpec(wantedDependency.bareSpecifier, ctx.namedRegistryNames, wantedDependency.alias, opts.defaultTag ?? 'latest');
     if (spec == null)
         return null;
-    const registry = ctx.namedRegistries[spec.registryName];
+    const registry = ctx.registriesByPrefix[spec.registryName];
     if (!registry)
         return null; // defensive: should never trigger because parse checks the alias set
     const picked = await pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, registry);
@@ -619,6 +659,7 @@ async function pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, registr
         includeLatestTag: opts.update === 'latest',
         updateChecksums: opts.updateChecksums,
         optional: wantedDependency.optional,
+        trustPolicy: opts.trustPolicy,
     });
     if (pickedPackage == null) {
         throw new NoMatchingVersionError({ wantedDependency, packageMeta: meta, registry });

package/lib/parseBareSpecifier.d.ts

@@ -9,7 +9,7 @@ export interface JsrRegistryPackageSpec extends RegistryPackageSpec {
     jsrPkgName: string;
 }
 export declare function parseJsrSpecifierToRegistryPackageSpec(rawSpecifier: string, alias: string | undefined, defaultTag: string): JsrRegistryPackageSpec | null;
-export { BUILTIN_NAMED_REGISTRIES } from '@pnpm/constants';
+export { BUILTIN_REGISTRIES_BY_PREFIX } from '@pnpm/constants';
 export interface NamedRegistryPackageSpec extends RegistryPackageSpec {
     registryName: string;
 }

package/lib/parseBareSpecifier.js

@@ -64,7 +64,7 @@ export function parseJsrSpecifierToRegistryPackageSpec(rawSpecifier, alias, defa
         jsrPkgName: spec.jsrPkgName,
     };
 }
-export { BUILTIN_NAMED_REGISTRIES } from '@pnpm/constants';
+export { BUILTIN_REGISTRIES_BY_PREFIX } from '@pnpm/constants';
 // Parses a named-registry specifier of the shape `<alias>:<body>` into a
 // RegistryPackageSpec. Returns `null` when the specifier does not use one of
 // the configured aliases, so the caller can fall through to other resolvers.

package/lib/pickPackage.d.ts

@@ -1,4 +1,5 @@
 import type { PackageInRegistry, PackageMeta } from '@pnpm/resolving.registry.types';
+import type { TrustPolicy } from '@pnpm/types';
 import { type FetchMetadataNotModifiedResult, type FetchMetadataResult } from './fetch.js';
 import type { RegistryPackageSpec } from './parseBareSpecifier.js';
 import { type PickPackageFromMetaOptions } from './pickPackageFromMeta.js';
@@ -22,6 +23,7 @@ export interface PickPackageOptions extends PickPackageFromMetaOptions {
     dryRun: boolean;
     includeLatestTag?: boolean;
     optional?: boolean;
+    trustPolicy?: TrustPolicy;
     /**
      * When true, force a conditional registry request so a stale on-disk
      * packument can't satisfy the call: the on-disk exact-version fast
@@ -44,12 +46,23 @@ export declare function pickPackage(ctx: {
         modified?: string;
     }) => Promise<FetchMetadataResult | FetchMetadataNotModifiedResult>;
     fullMetadata?: boolean;
+    /**
+     * Whether a time-based resolution has to read the full metadata of
+     * `registry`, because that registry's abbreviated form carries no `time`.
+     * Asked per registry: the answer differs between the public registry and a
+     * proxy that does carry it, and the mirror path and cache key below are
+     * already keyed by registry, so two registries may disagree within one
+     * install.
+     */
+    needsFullMetadataFor?: (registry: string) => boolean;
     metaCache: PackageMetaCache;
     cacheDir: string;
     offline?: boolean;
     preferOffline?: boolean;
     filterMetadata?: boolean;
     ignoreMissingTimeField?: boolean;
+    /** Packuments whose release-age upgrade fetch already answered 304 in this resolver. */
+    releaseAgeUpgradeCheckedPackuments?: WeakSet<PackageMeta>;
 }, spec: RegistryPackageSpec, opts: PickPackageOptions): Promise<{
     meta: PackageMeta;
     pickedPackage: PackageInRegistry | null;
@@ -91,7 +104,13 @@ export declare function getPkgMirrorPath(cacheDir: string, metaDir: string, regi
  * there), so a `meta` that carries one is serialized without it.
  */
 export declare function prepareJsonForDisk(meta: PackageMeta, etag: string | undefined, jsonText?: string): string;
-export declare function warnMissingTimeFieldOnce(pkgName: string): void;
+/**
+ * At most one warning per package per check. `minimumReleaseAge` and
+ * `trustPolicy` both go dark on the same missing field, so keying by package
+ * alone would let whichever check ran first silence the other and leave the
+ * user told about only one of the two skips.
+ */
+export declare function warnMissingTimeFieldOnce(pkgName: string, skippedCheck: 'minimumReleaseAge' | 'trustPolicy'): void;
 interface MetaHeaders {
     etag?: string;
     modified?: string;

package/lib/pickPackage.js

@@ -12,7 +12,8 @@ import { renameOverwrite } from 'rename-overwrite';
 import semver from 'semver';
 import { clearMeta, retainsFullMeta } from './clearMeta.js';
 import { notModifiedWithoutCacheError, } from './fetch.js';
-import { pickLowestVersionByVersionRange, pickPackageFromMeta, pickVersionByVersionRange, } from './pickPackageFromMeta.js';
+import { getDominantLockfileVersion, pickLowestVersionByVersionRange, pickPackageFromMeta, pickStableCachedRangeVersion, pickVersionByVersionRange, } from './pickPackageFromMeta.js';
+import { dropIncompletePublishTimes } from './publishTimes.js';
 import { toRaw } from './toRaw.js';
 /**
  * prevents simultaneous operations on the meta.json
@@ -39,6 +40,13 @@ async function runLimited(pkgMirror, fn) {
         }
     }
 }
+function canReuseStableCachedRange(spec, opts) {
+    return (spec.type === 'range' &&
+        !opts.includeLatestTag &&
+        !opts.updateChecksums &&
+        opts.publishedBy == null &&
+        opts.trustPolicy !== 'no-downgrade');
+}
 // When includeLatestTag is set, the "latest" dist-tag is added as a candidate
 // alongside the requested spec, and the higher-versioned pick wins.
 function runPicker(pickerOpts, spec, pickOne) {
@@ -97,7 +105,7 @@ function pickMatchingVersionFinal(pickerOpts, spec, meta) {
     }
     catch (err) {
         if (pickerOpts.ignoreMissingTimeField && isMissingTimeError(err)) {
-            warnMissingTimeFieldOnce(meta.name);
+            warnMissingTimeFieldOnce(meta.name, 'minimumReleaseAge');
             return pickMatchingVersionFast({
                 ...pickerOpts,
                 publishedBy: undefined,
@@ -152,7 +160,12 @@ export async function pickPackage(ctx, spec, opts) {
     validatePackageName(spec.name);
     // Use full metadata for optional dependencies to get libc field.
     // See: https://github.com/pnpm/pnpm/issues/9950
-    const fullMetadata = opts.optional === true || ctx.fullMetadata === true;
+    // The per-registry answer is authoritative when the caller can give one: it
+    // already folds in the reasons that hold for every registry, so a registry
+    // that carries `time` is free to stay on abbreviated metadata while the
+    // others do not.
+    const policyWantsFullMetadata = ctx.needsFullMetadataFor?.(opts.registry) ?? ctx.fullMetadata === true;
+    const fullMetadata = opts.optional === true || policyWantsFullMetadata;
     const metaDir = fullMetadata
         ? (ctx.filterMetadata ? FULL_FILTERED_META_DIR : FULL_META_DIR)
         : ABBREVIATED_META_DIR;
@@ -177,7 +190,19 @@ export async function pickPackage(ctx, spec, opts) {
             ctx.metaCache.set(cacheKey, metaForCache);
         }
         const pickedPackage = pickMatchingVersionFinal(pickerOpts, spec, metaForCache);
-        if (pickedPackage != null || ctx.offline === true || !unverifiedDiskPackuments.has(metaForCache)) {
+        const unverified = unverifiedDiskPackuments.has(metaForCache);
+        const stableCachedRangeVersion = unverified &&
+            canReuseStableCachedRange(spec, opts)
+            ? getDominantLockfileVersion(spec.fetchSpec, opts.preferredVersionSelectors)
+            : null;
+        const unverifiedPickIsSafe = ctx.preferOffline === true ||
+            opts.pickLowestVersion === true ||
+            spec.type === 'version' ||
+            (pickedPackage != null && pickedPackage.version === stableCachedRangeVersion);
+        const cacheResultCanReturn = ctx.offline === true ||
+            !unverified ||
+            (pickedPackage != null && unverifiedPickIsSafe);
+        if (cacheResultCanReturn) {
             return {
                 meta: metaForCache,
                 pickedPackage,
@@ -271,6 +296,35 @@ export async function pickPackage(ctx, spec, opts) {
                 }
             }
         }
+        const dominantLockfileVersion = canReuseStableCachedRange(spec, opts)
+            ? getDominantLockfileVersion(spec.fetchSpec, opts.preferredVersionSelectors)
+            : null;
+        if (dominantLockfileVersion != null) {
+            diskMeta = diskMeta ?? await limit(loadMetaCondensed);
+            if (diskMeta != null) {
+                try {
+                    const stableVersion = pickStableCachedRangeVersion({
+                        meta: diskMeta,
+                        preferredVersionSelectors: opts.preferredVersionSelectors,
+                        versionRange: spec.fetchSpec,
+                    });
+                    if (stableVersion != null) {
+                        // Strict dominance makes the preferred tier a singleton, so the
+                        // highest-version picker used by the proof and the normal picker
+                        // agree even if pickLowestVersion reaches this code in the future.
+                        const pickedPackage = pickMatchingVersionFast(pickerOpts, spec, diskMeta);
+                        if (pickedPackage?.version === stableVersion) {
+                            cacheDiskLoadedMeta(ctx.metaCache, cacheKey, diskMeta);
+                            return { meta: diskMeta, pickedPackage };
+                        }
+                    }
+                }
+                catch {
+                    // Any malformed cached metadata falls through to normal online
+                    // resolution, matching the neighboring disk fast paths.
+                }
+            }
+        }
         if (opts.publishedBy && opts.publishedByExclude?.(spec.name) !== true) {
             const mtime = await limit(async () => getFileMtime(pkgMirror));
             if (mtime != null && mtime >= opts.publishedBy) {
@@ -377,6 +431,7 @@ export async function pickPackage(ctx, spec, opts) {
             // and most packages won't have been modified recently enough to need the full
             // document. We only upgrade to full metadata when the package's modification
             // date is recent enough that some versions might not yet be "mature."
+            let attemptedReleaseAgeUpgrade = false;
             if (opts.publishedBy &&
                 !fullMetadata &&
                 meta.time == null &&
@@ -393,6 +448,7 @@ export async function pickPackage(ctx, spec, opts) {
                     if (!opts.dryRun) {
                         saveMetaBestEffort(pkgMirror, prepareJsonForDisk(resultToSave.meta, resultToSave.etag, resultToSave.jsonText));
                     }
+                    attemptedReleaseAgeUpgrade = true;
                     const fullFetchResult = await ctx.fetch(spec.name, {
                         authHeaderValue: opts.authHeaderValue,
                         fullMetadata: true,
@@ -405,6 +461,9 @@ export async function pickPackage(ctx, spec, opts) {
                 }
             }
             meta = condenseMetaForCache(ctx, meta);
+            if (attemptedReleaseAgeUpgrade) {
+                ctx.releaseAgeUpgradeCheckedPackuments?.add(meta);
+            }
             if (!opts.dryRun) {
                 // Mirror the raw registry body, unless the retained form is
                 // deliberately narrower: `filterMetadata` always mirrors the stripped
@@ -441,6 +500,7 @@ async function maybeUpgradeAbbreviatedMetaForReleaseAge(ctx, spec, opts, meta) {
     if (ctx.offline === true ||
         !opts.publishedBy ||
         meta.time != null ||
+        ctx.releaseAgeUpgradeCheckedPackuments?.has(meta) === true ||
         opts.publishedByExclude?.(spec.name) === true) {
         return { meta };
     }
@@ -468,8 +528,11 @@ async function maybeUpgradeAbbreviatedMetaForReleaseAge(ctx, spec, opts, meta) {
         registry: opts.registry,
     });
     if (fullFetchResult.notModified) {
-        // Upgrade fetch came back 304: keep the abbreviated meta. The downstream
-        // `pickMatchingVersionFinal` will fall through to its warn-and-skip path.
+        // Upgrade fetch came back 304: the registry has no fuller form of this
+        // document, so keep it and let `pickMatchingVersionFinal` fall through to
+        // its warn-and-skip path. Remember the outcome against the packument
+        // itself so no other pick in this resolver repeats the request.
+        ctx.releaseAgeUpgradeCheckedPackuments?.add(meta);
         return { meta };
     }
     return { meta: fullFetchResult.meta, upgradedFrom: fullFetchResult };
@@ -480,12 +543,26 @@ async function maybeUpgradeAbbreviatedMetaForReleaseAge(ctx, spec, opts, meta) {
  * pre-upgrade abbreviated form without `time`, and every future install
  * would re-trigger the upgrade fetch.
  */
+/**
+ * The document to serve and cache after an upgrade attempt, marked so no
+ * later pick in this resolver repeats the request.
+ *
+ * Marking belongs here rather than in
+ * {@link maybeUpgradeAbbreviatedMetaForReleaseAge} because persisting the
+ * response to the mirror can hand back a different object, and only the one
+ * that reaches the cache is worth remembering. A registry whose full form is
+ * no more complete than its abbreviated one answers `200` rather than `304`,
+ * so both outcomes have to be marked — otherwise every dependency edge
+ * re-asks for the same full document.
+ */
 function upgradeMetaForCache(ctx, upgrade, opts) {
     if (upgrade.upgradedFrom == null)
         return upgrade.meta;
-    if (opts.dryRun)
-        return condenseMetaForCache(ctx, upgrade.meta);
-    return persistUpgradedMeta(ctx, opts.pkgMirror, upgrade.upgradedFrom);
+    const meta = opts.dryRun
+        ? condenseMetaForCache(ctx, upgrade.meta)
+        : persistUpgradedMeta(ctx, opts.pkgMirror, upgrade.upgradedFrom);
+    ctx.releaseAgeUpgradeCheckedPackuments?.add(meta);
+    return meta;
 }
 // A condensing resolver keeps and mirrors the condensed form — the mirror
 // only has to carry `time` into the next install; otherwise the raw response
@@ -586,8 +663,17 @@ function isMissingTimeError(err) {
 // memory via this Set as they resolve ever more distinct packages.
 const MAX_WARNED_MISSING_TIME = 1024;
 const warnedMissingTimeFor = new Set();
-export function warnMissingTimeFieldOnce(pkgName) {
-    if (warnedMissingTimeFor.has(pkgName))
+/**
+ * At most one warning per package per check. `minimumReleaseAge` and
+ * `trustPolicy` both go dark on the same missing field, so keying by package
+ * alone would let whichever check ran first silence the other and leave the
+ * user told about only one of the two skips.
+ */
+export function warnMissingTimeFieldOnce(pkgName, skippedCheck) {
+    // A package name cannot contain ':', so the check name prefix cannot
+    // collide with a name that happens to embed it.
+    const key = `${skippedCheck}:${pkgName}`;
+    if (warnedMissingTimeFor.has(key))
         return;
     if (warnedMissingTimeFor.size >= MAX_WARNED_MISSING_TIME) {
         // Set preserves insertion order, so the first entry is the oldest.
@@ -595,8 +681,8 @@ export function warnMissingTimeFieldOnce(pkgName) {
         if (oldest != null)
             warnedMissingTimeFor.delete(oldest);
     }
-    warnedMissingTimeFor.add(pkgName);
-    globalWarn(`The metadata of ${pkgName} is missing the "time" field; skipping the minimumReleaseAge check for this package.`);
+    warnedMissingTimeFor.add(key);
+    globalWarn(`The metadata of ${pkgName} is missing the "time" field; skipping the ${skippedCheck} check for this package.`);
 }
 async function getFileMtime(filePath) {
     try {
@@ -648,6 +734,7 @@ export async function loadMeta(pkgMirror) {
             return null;
         const headers = JSON.parse(data.slice(0, newlineIdx));
         const meta = JSON.parse(data.slice(newlineIdx + 1));
+        dropIncompletePublishTimes(meta);
         meta.etag = headers.etag;
         return meta;
     }

package/lib/pickPackageFromMeta.d.ts

@@ -1,5 +1,5 @@
 import type { PackageInRegistry, PackageMeta, PackageMetaWithTime } from '@pnpm/resolving.registry.types';
-import type { VersionSelectors } from '@pnpm/resolving.resolver-base';
+import { type VersionSelectors } from '@pnpm/resolving.resolver-base';
 import type { PackageVersionPolicy } from '@pnpm/types';
 import type { RegistryPackageSpec } from './parseBareSpecifier.js';
 export interface PickVersionByVersionRangeOptions {
@@ -41,3 +41,9 @@ export declare function applyPublishedByPolicy(meta: PackageMeta, publishedBy: D
 export declare function assertMetaHasTime(meta: PackageMeta): asserts meta is PackageMetaWithTime;
 export declare function pickLowestVersionByVersionRange({ meta, versionRange, preferredVersionSelectors }: PickVersionByVersionRangeOptions): string | null;
 export declare function pickVersionByVersionRange({ meta, versionRange, preferredVersionSelectors }: PickVersionByVersionRangeOptions): string | null;
+/**
+ * Returns the cached version only when lockfile preferences prove that no
+ * version missing from the cached packument could tie or outrank it.
+ */
+export declare function pickStableCachedRangeVersion({ meta, preferredVersionSelectors, versionRange, }: PickVersionByVersionRangeOptions): string | null;
+export declare function getDominantLockfileVersion(versionRange: string, preferredVersionSelectors?: VersionSelectors): string | null;

package/lib/pickPackageFromMeta.js

@@ -1,6 +1,7 @@
 import util from 'node:util';
 import { PnpmError } from '@pnpm/error';
 import { filterPkgMetadataByPublishDate } from '@pnpm/resolving.registry.pkg-metadata-filter';
+import { EXISTING_VERSION_SELECTOR_WEIGHT, } from '@pnpm/resolving.resolver-base';
 import semver from 'semver';
 export function pickPackageFromMeta(pickVersionByVersionRangeFn, { preferredVersionSelectors, publishedBy, publishedByExclude, }, meta, spec) {
     if (publishedBy) {
@@ -152,6 +153,86 @@ export function pickVersionByVersionRange({ meta, versionRange, preferredVersion
     }
     return maxVersion;
 }
+/**
+ * Returns the cached version only when lockfile preferences prove that no
+ * version missing from the cached packument could tie or outrank it.
+ */
+export function pickStableCachedRangeVersion({ meta, preferredVersionSelectors, versionRange, }) {
+    const dominantLockfileVersion = getDominantLockfileVersion(versionRange, preferredVersionSelectors);
+    if (dominantLockfileVersion == null || meta.versions[dominantLockfileVersion] == null)
+        return null;
+    try {
+        const pickedVersion = pickVersionByVersionRange({ meta, preferredVersionSelectors, versionRange });
+        return pickedVersion === dominantLockfileVersion ? dominantLockfileVersion : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function getDominantLockfileVersion(versionRange, preferredVersionSelectors) {
+    if (preferredVersionSelectors == null)
+        return null;
+    let lockfileVersion;
+    for (const [selector, value] of Object.entries(preferredVersionSelectors)) {
+        if (selector === versionRange)
+            continue;
+        const { selectorType, weight } = preferredSelectorInfo(value);
+        if (!Number.isSafeInteger(weight) || weight <= 0)
+            return null;
+        if (selectorType === 'version' &&
+            weight >= EXISTING_VERSION_SELECTOR_WEIGHT &&
+            semverSatisfiesLoose(selector, versionRange)) {
+            if (lockfileVersion != null)
+                return null;
+            lockfileVersion = selector;
+        }
+    }
+    if (lockfileVersion == null)
+        return null;
+    let guaranteedLockfileWeight = 0;
+    let maximumOtherVersionWeight = 0;
+    for (const [selector, value] of Object.entries(preferredVersionSelectors)) {
+        if (selector === versionRange)
+            continue;
+        const { selectorType, weight } = preferredSelectorInfo(value);
+        switch (selectorType) {
+            case 'version':
+                if (selector === lockfileVersion) {
+                    guaranteedLockfileWeight += weight;
+                }
+                else if (weight < EXISTING_VERSION_SELECTOR_WEIGHT &&
+                    semverSatisfiesLoose(selector, versionRange)) {
+                    maximumOtherVersionWeight += weight;
+                }
+                break;
+            case 'range':
+                if (semverSatisfiesLoose(lockfileVersion, selector)) {
+                    guaranteedLockfileWeight += weight;
+                }
+                // Conservatively assume an unseen version can satisfy every preferred
+                // range, even when proving range intersection would be more precise.
+                maximumOtherVersionWeight += weight;
+                break;
+            case 'tag':
+                // A registry can move a tag between requests. Do not count its current
+                // target toward the lockfile version, and assume all tags could move to
+                // the same unseen version.
+                maximumOtherVersionWeight += weight;
+                break;
+        }
+        if (!Number.isSafeInteger(guaranteedLockfileWeight) ||
+            !Number.isSafeInteger(maximumOtherVersionWeight))
+            return null;
+    }
+    return guaranteedLockfileWeight > maximumOtherVersionWeight
+        ? lockfileVersion
+        : null;
+}
+function preferredSelectorInfo(value) {
+    return typeof value === 'string'
+        ? { selectorType: value, weight: 1 }
+        : value;
+}
 function prioritizePreferredVersions(meta, versionRange, preferredVerSelectors) {
     const preferredVerSelectorsArr = Object.entries(preferredVerSelectors ?? {});
     const versionsPrioritizer = new PreferredVersionsPrioritizer();
@@ -163,9 +244,7 @@ function prioritizePreferredVersions(meta, versionRange, preferredVerSelectors)
     }
     // Then apply weights from preferred selectors
     for (const [preferredSelector, preferredSelectorType] of preferredVerSelectorsArr) {
-        const { selectorType, weight } = typeof preferredSelectorType === 'string'
-            ? { selectorType: preferredSelectorType, weight: 1 }
-            : preferredSelectorType;
+        const { selectorType, weight } = preferredSelectorInfo(preferredSelectorType);
         if (preferredSelector === versionRange)
             continue;
         switch (selectorType) {

package/lib/publishTimes.d.ts

@@ -0,0 +1,24 @@
+import type { PackageMeta } from '@pnpm/resolving.registry.types';
+/**
+ * Drops `time` unless it carries a publish timestamp for every version the
+ * packument lists.
+ *
+ * Registries may answer with a partial map: npmmirror adds `time` to its
+ * abbreviated documents but fills it in only for the versions it has synced
+ * since it started recording publish times, leaving the rest out. A partial
+ * map is indistinguishable from a complete one at the point of use, so the
+ * `minimumReleaseAge` filter reads every absent timestamp as "not mature"
+ * and silently drops the version — resolution then falls back to the lowest
+ * match.
+ *
+ * A map that can't decide maturity is worth nothing to the resolver, so it
+ * is normalized away where the document is parsed. Every packument past that
+ * point then carries either a complete `time` or none at all — the shape the
+ * npm registry's own abbreviated documents have, and the one the rest of the
+ * resolver is written against.
+ *
+ * A packument with no versions keeps whatever `time` it has — there is
+ * nothing for the map to be incomplete about — and a version whose entry is
+ * an empty string counts as absent.
+ */
+export declare function dropIncompletePublishTimes(meta: PackageMeta): void;

package/lib/publishTimes.js

@@ -0,0 +1,35 @@
+/**
+ * Drops `time` unless it carries a publish timestamp for every version the
+ * packument lists.
+ *
+ * Registries may answer with a partial map: npmmirror adds `time` to its
+ * abbreviated documents but fills it in only for the versions it has synced
+ * since it started recording publish times, leaving the rest out. A partial
+ * map is indistinguishable from a complete one at the point of use, so the
+ * `minimumReleaseAge` filter reads every absent timestamp as "not mature"
+ * and silently drops the version — resolution then falls back to the lowest
+ * match.
+ *
+ * A map that can't decide maturity is worth nothing to the resolver, so it
+ * is normalized away where the document is parsed. Every packument past that
+ * point then carries either a complete `time` or none at all — the shape the
+ * npm registry's own abbreviated documents have, and the one the rest of the
+ * resolver is written against.
+ *
+ * A packument with no versions keeps whatever `time` it has — there is
+ * nothing for the map to be incomplete about — and a version whose entry is
+ * an empty string counts as absent.
+ */
+export function dropIncompletePublishTimes(meta) {
+    if (meta.time == null)
+        return;
+    for (const version in meta.versions) {
+        if (!Object.hasOwn(meta.versions, version))
+            continue;
+        if (!Object.hasOwn(meta.time, version) || !meta.time[version]) {
+            delete meta.time;
+            return;
+        }
+    }
+}
+//# sourceMappingURL=publishTimes.js.map

package/lib/trustChecks.d.ts

@@ -4,6 +4,20 @@ type TrustEvidence = 'provenance' | 'trustedPublisher' | 'stagedPublish';
 export declare function failIfTrustDowngraded(meta: PackageMeta, version: string, opts?: {
     trustPolicyExclude?: PackageVersionPolicy;
     trustPolicyIgnoreAfter?: number;
+    /**
+     * The `minimumReleaseAgeIgnoreMissingTime` opt-in, which declares that
+     * the registry cannot date its releases. The downgrade check orders
+     * history by publish date, so a packument with no `time` map leaves it
+     * nothing to order and the check is skipped with a warning rather than
+     * aborting the install.
+     *
+     * Scoped to the whole map being absent, which `dropIncompletePublishTimes`
+     * makes the only shape a registry that dates some of its versions can
+     * reach here in. A packument that dates every version it lists is instead
+     * saying it does not have this one, so that shape keeps failing closed
+     * however this flag is set.
+     */
+    ignoreMissingTimeField?: boolean;
 }): void;
 export declare function getTrustEvidence(manifest: PackageInRegistry): TrustEvidence | undefined;
 export {};

package/lib/trustChecks.js

@@ -1,5 +1,6 @@
 import { PnpmError } from '@pnpm/error';
 import semver from 'semver';
+import { warnMissingTimeFieldOnce } from './pickPackage.js';
 import { assertMetaHasTime } from './pickPackageFromMeta.js';
 const TRUST_RANK = {
     stagedPublish: 3,
@@ -16,6 +17,10 @@ export function failIfTrustDowngraded(meta, version, opts) {
             return;
         }
     }
+    if (meta.time == null && opts?.ignoreMissingTimeField) {
+        warnMissingTimeFieldOnce(meta.name, 'trustPolicy');
+        return;
+    }
     assertMetaHasTime(meta);
     const versionPublishedAt = meta.time[version];
     if (!versionPublishedAt) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.npm-resolver",
-  "version": "1103.2.1",
+  "version": "1104.0.0",
   "description": "Resolver for npm-hosted packages",
   "keywords": [
     "pnpm",
@@ -29,24 +29,24 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/config.normalize-registries": "1100.1.0",
-    "@pnpm/config.pick-registry-for-package": "1100.1.0",
-    "@pnpm/config.version-policy": "1100.2.0",
-    "@pnpm/constants": "1101.0.0",
-    "@pnpm/core-loggers": "1100.3.2",
+    "@pnpm/config.normalize-registries": "1101.0.0",
+    "@pnpm/config.pick-registry-for-package": "1101.0.0",
+    "@pnpm/config.version-policy": "1100.2.1",
+    "@pnpm/constants": "1102.0.0",
+    "@pnpm/core-loggers": "1100.3.3",
     "@pnpm/crypto.hash": "1100.0.2",
-    "@pnpm/deps.path": "1100.1.0",
-    "@pnpm/error": "1100.1.2",
+    "@pnpm/deps.path": "1101.0.0",
+    "@pnpm/error": "1100.1.3",
     "@pnpm/fetching.types": "1100.0.3",
     "@pnpm/fs.graceful-fs": "1100.1.1",
-    "@pnpm/pkg-manifest.utils": "1100.4.0",
-    "@pnpm/resolving.jsr-specifier-parser": "1100.0.5",
-    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.16",
-    "@pnpm/resolving.registry.types": "1100.1.9",
-    "@pnpm/resolving.resolver-base": "1101.1.0",
-    "@pnpm/store.cafs": "1100.1.19",
-    "@pnpm/store.index": "1100.2.4",
-    "@pnpm/types": "1101.9.0",
+    "@pnpm/pkg-manifest.utils": "1100.4.1",
+    "@pnpm/resolving.jsr-specifier-parser": "1100.0.6",
+    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.17",
+    "@pnpm/resolving.registry.types": "1100.1.10",
+    "@pnpm/resolving.resolver-base": "1101.1.1",
+    "@pnpm/store.cafs": "1100.2.0",
+    "@pnpm/store.index": "1100.2.5",
+    "@pnpm/types": "1102.0.0",
     "@pnpm/workspace.range-resolver": "1100.0.3",
     "@pnpm/workspace.spec-parser": "1100.0.1",
     "@zkochan/retry": "^0.2.0",
@@ -65,13 +65,13 @@
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0",
-    "@pnpm/worker": "^1100.2.11"
+    "@pnpm/worker": "^1100.3.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/network.fetch": "1100.1.12",
-    "@pnpm/resolving.npm-resolver": "1103.2.1",
+    "@pnpm/network.fetch": "1100.1.13",
+    "@pnpm/resolving.npm-resolver": "1104.0.0",
     "@pnpm/test-fixtures": "1100.0.1",
     "@pnpm/testing.mock-agent": "1101.0.7",
     "@types/normalize-path": "^3.0.2",