@pnpm/resolving.npm-resolver 1103.2.1 → 1104.1.0

package/CHANGELOG.md

@@ -1,5 +1,98 @@
 # @pnpm/npm-resolver
 
+## 1104.1.0
+
+### Minor Changes
+
+- Added explicit registry revision selection with `<version>+rN` and `pnpm update --patches` for refreshing revision artifacts without changing package versions. Registry-backed lockfile policy checks recognize historical revisions, and pnpr now preserves safe revision histories from upstream registries.
+
+- Added support for registry replacement tarballs using standard integrity values, explicit revision fields, registry routing from the `registries` setting, non-redirecting integrity-addressed URLs, canonical safe-integer revision numbers, and pnpr proxying for immutable upstream revision artifacts.
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/config.normalize-registries@1101.0.1
+  - @pnpm/config.pick-registry-for-package@1101.0.1
+  - @pnpm/config.version-policy@1100.2.2
+  - @pnpm/core-loggers@1100.3.4
+  - @pnpm/crypto.hash@1100.0.3
+  - @pnpm/deps.path@1101.0.1
+  - @pnpm/fs.graceful-fs@1100.2.0
+  - @pnpm/pkg-manifest.utils@1100.4.2
+  - @pnpm/resolving.registry.pkg-metadata-filter@1100.0.18
+  - @pnpm/resolving.registry.types@1100.2.0
+  - @pnpm/resolving.resolver-base@1101.2.0
+  - @pnpm/resolving.tarball-url@1101.1.0
+  - @pnpm/store.cafs@1100.3.0
+  - @pnpm/store.index@1100.3.0
+  - @pnpm/types@1102.1.0
+
+## 1104.0.0
+
+### Major Changes
+
+- The three registry lookups are now named for what they are keyed by, so that none of them is called `registries` — a name the `registries` setting itself has taken:
+
+  | before | after |
+  |---|---|
+  | `Config.registries` | `Config.registriesByScope` |
+  | `Config.namedRegistries` | `Config.registriesByPrefix` |
+  | `Config.registryOptions` | `Config.registryOptionsByUrl` |
+
+  The same rename applies to the `RegistryContext` fields, the `Registries` and `NamedRegistries` types (now `RegistriesByScope` and `RegistriesByPrefix`), `normalizeRegistries` / `normalizeNamedRegistries` (now `normalizeRegistriesByScope` / `normalizeRegistriesByPrefix`), and the `BUILTIN_NAMED_REGISTRIES` constant (now `BUILTIN_REGISTRIES_BY_PREFIX`).
+
+  This is an internal rename: no setting, error code, lockfile field, or `.pnpmfile.cjs` hook field changes. A `preResolution` hook still reads `ctx.registries`, which is the name pacquet passes as well. The `registries` and `namedRegistries` settings are read under the names users write them.
+
+  The pnpr resolve request sends `registriesByPrefix` where it sent `namedRegistries`. A pnpr server and its clients must be on matching versions, which is already the case for an experimental server.
+
+### Minor Changes
+
+- A registry can now declare that its abbreviated metadata carries the `time` field, so `resolutionMode: time-based` reads the full metadata document only from the registries that need it:
+
+  ```yaml
+  resolutionMode: time-based
+  registries:
+    https://npm.internal.example/:
+      supportsTimeField: true
+  ```
+
+  `registry.npmjs.org` omits `time` from abbreviated metadata, so a time-based resolution has to fall back to the much larger full document. That fallback used to be all-or-nothing: `registrySupportsTimeField` answered for every registry at once, so a project resolving from both the public registry and a Verdaccio instance either paid for full metadata everywhere or claimed a `time` field npmjs does not serve. The answer is now per registry, and `registrySupportsTimeField` remains the answer for every registry that does not declare one.
+
+  The declaration is also sent to a pnpr server, which applies it to the resolution it runs on the client's behalf.
+
+### Patch Changes
+
+- Re-fetch full registry metadata when `minimumReleaseAge` is enabled and an abbreviated packument's `time` map omits timestamps for some versions. This prevents mature versions from being filtered out and resolution from falling back to the lowest matching version [pnpm/pnpm#13741](https://github.com/pnpm/pnpm/issues/13741).
+
+- Reduced registry metadata requests during dependency resolution by reusing cached metadata when lockfile preferences prove that no uncached version can win [pnpm/pnpm#13976](https://github.com/pnpm/pnpm/issues/13976).
+
+- Installs are faster in workspaces that declare inter-workspace dependencies with plain ranges (`"*"`, `"^1.2.3"`) rather than the `workspace:` protocol. With `preferWorkspacePackages` enabled, linking such a dependency no longer makes a registry request that cannot change the outcome — and workspace packages that were never published no longer cost a 404 on every install.
+
+- Added `fetchWarnTimeoutMs` and `fetchMinSpeedKiBps` to the Rust pnpm CLI and its N-API bindings. Slow registry metadata requests and tarball downloads now emit pnpm-compatible warnings without exposing URL credentials, query parameters, fragments, or control characters [pnpm/pnpm#12042](https://github.com/pnpm/pnpm/issues/12042).
+
+- `trustPolicy: no-downgrade` no longer aborts the install with `ERR_PNPM_MISSING_TIME` on registries that serve no per-version `time` field when `minimumReleaseAgeIgnoreMissingTime` is set. The trust check reads the same publish dates the `minimumReleaseAge` check does, so it now honors the same opt-in and skips the affected package with a warning [#12446](https://github.com/pnpm/pnpm/issues/12446).
+
+  `minimumReleaseAgeIgnoreMissingTime` no longer lets a lockfile entry the registry does not list pass the `minimumReleaseAge` check during lockfile verification. The opt-in covers a registry that cannot date its releases; a packument that does date every version it lists is saying it never published this one, which stays a hard failure.
+
+  The missing-`time` warning now names the check it is reporting on, so a package whose `minimumReleaseAge` and `trustPolicy` checks are both skipped warns about both instead of only the first.
+
+- Updated dependencies:
+  - @pnpm/config.normalize-registries@1101.0.0
+  - @pnpm/config.pick-registry-for-package@1101.0.0
+  - @pnpm/config.version-policy@1100.2.1
+  - @pnpm/constants@1102.0.0
+  - @pnpm/core-loggers@1100.3.3
+  - @pnpm/deps.path@1101.0.0
+  - @pnpm/error@1100.1.3
+  - @pnpm/pkg-manifest.utils@1100.4.1
+  - @pnpm/resolving.jsr-specifier-parser@1100.0.6
+  - @pnpm/resolving.registry.pkg-metadata-filter@1100.0.17
+  - @pnpm/resolving.registry.types@1100.1.10
+  - @pnpm/resolving.resolver-base@1101.1.1
+  - @pnpm/store.cafs@1100.2.0
+  - @pnpm/store.index@1100.2.5
+  - @pnpm/types@1102.0.0
+
 ## 1103.2.1
 
 ### Patch Changes

package/lib/createNpmResolutionVerifier.d.ts

@@ -1,6 +1,6 @@
 import type { GetAuthHeader } from '@pnpm/fetching.types';
 import { type ResolutionVerifier } from '@pnpm/resolving.resolver-base';
-import type { Registries, TrustPolicy } from '@pnpm/types';
+import type { RegistriesByScope, TrustPolicy } from '@pnpm/types';
 import type { FetchMetadataFromFromRegistryOptions } from './fetch.js';
 import { type FetchFullMetadataCachedOptions } from './fetchFullMetadataCached.js';
 import type { PackageMetaCache } from './pickPackage.js';
@@ -23,12 +23,15 @@ export interface CreateNpmResolutionVerifierOptions {
     /**
      * When the registry's metadata lacks the per-version `time` field
      * (some self-hosted registries strip it), the verifier can't apply
-     * the maturity cutoff. Set this to `true` to mirror the resolver's
-     * `pickMatchingVersionFinal` warn-and-skip behavior — the verifier
-     * passes the entry with a one-time `globalWarn`, instead of failing
-     * closed. Defaults to `false` so the verifier stays stricter than
-     * the resolver only when the user has explicitly opted in to the
-     * skip on the resolver side.
+     * the maturity cutoff, and the trust check has no publish order to
+     * walk. Set this to `true` to mirror the resolver's warn-and-skip
+     * behavior for both — the verifier passes the entry with a one-time
+     * `globalWarn`, instead of failing closed. Defaults to `false` so
+     * the verifier stays stricter than the resolver only when the user
+     * has explicitly opted in to the skip on the resolver side. Scoped
+     * to a packument with no usable `time` map: one that dates every
+     * version it lists is saying it never published this pin, which
+     * fails closed either way.
      */
     ignoreMissingTimeField?: boolean;
     /**
@@ -42,14 +45,14 @@ export interface CreateNpmResolutionVerifierOptions {
     trustPolicy?: TrustPolicy;
     trustPolicyExclude?: string[];
     trustPolicyIgnoreAfter?: number;
-    registries: Registries;
+    registriesByScope: RegistriesByScope;
     /**
-     * Registries reached via the named-registry resolver chain (e.g. `gh:` →
+     * RegistriesByScope reached via the named-registry resolver chain (e.g. `gh:` →
      * GitHub Packages). When a lockfile entry's tarball URL falls under one of
      * these registry base URLs, route the manifest fetch there instead of the
      * scope-derived default.
      */
-    namedRegistries?: Record<string, string>;
+    registriesByPrefix?: Record<string, string>;
     /**
      * Cache-aware full-metadata fetcher. Decoupled from the resolver pipeline
      * so abbreviated metadata and `peekManifestFromStore` fast paths cannot

package/lib/createNpmResolutionVerifier.js

@@ -1,17 +1,18 @@
 import { createHash } from 'node:crypto';
-import { normalizeNamedRegistries } from '@pnpm/config.normalize-registries';
+import { normalizeRegistriesByPrefix } from '@pnpm/config.normalize-registries';
 import { namedRegistryTarballPrefixes, pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
 import { createPackageVersionPolicy } from '@pnpm/config.version-policy';
 import { FULL_META_DIR } from '@pnpm/constants';
 import { PnpmError } from '@pnpm/error';
 import { isGitHostedTarballUrl, } from '@pnpm/resolving.resolver-base';
+import { isIntegrityAddressedRegistryTarballUrl, isValidTarballRevision, } from '@pnpm/resolving.tarball-url';
 import semver from 'semver';
 import { fetchAttestationPublishedAt } from './fetchAttestationPublishedAt.js';
 import { fetchAbbreviatedMetadataCached, fetchFullMetadataCached, } from './fetchFullMetadataCached.js';
 import { normalizeRegistryUrl } from './normalizeRegistryUrl.js';
 import { getPkgMetaCacheKey, getPkgMirrorPath, loadMeta, warnMissingTimeFieldOnce } from './pickPackage.js';
 import { failIfTrustDowngraded } from './trustChecks.js';
-import { MINIMUM_RELEASE_AGE_VIOLATION_CODE, MISSING_NAMED_REGISTRY_VIOLATION_CODE, MISSING_TARBALL_INTEGRITY_VIOLATION_CODE, TARBALL_URL_MISMATCH_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
+import { MINIMUM_RELEASE_AGE_VIOLATION_CODE, MISSING_NAMED_REGISTRY_VIOLATION_CODE, MISSING_TARBALL_INTEGRITY_VIOLATION_CODE, TARBALL_REVISION_MISMATCH_VIOLATION_CODE, TARBALL_URL_MISMATCH_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
 /**
  * Returns a `ResolutionVerifier` for npm-registry-resolved lockfile
  * entries. It always binds each entry's recorded tarball URL to the
@@ -39,8 +40,8 @@ export function createNpmResolutionVerifier(opts) {
     const trustExcludePolicy = opts.trustPolicyExclude?.length
         ? createExcludePolicy(opts.trustPolicyExclude, 'trustPolicyExclude')
         : undefined;
-    const mergedNamedRegistries = normalizeNamedRegistries(opts.namedRegistries);
-    const namedRegistryPrefixes = namedRegistryTarballPrefixes(mergedNamedRegistries);
+    const mergedRegistriesByPrefix = normalizeRegistriesByPrefix(opts.registriesByPrefix);
+    const namedRegistryPrefixes = namedRegistryTarballPrefixes(mergedRegistriesByPrefix);
     // Per-install dedup of every network/disk fetch the verifier issues.
     // The maturity check uses the layered `fetchPublishedAt` lookup; the
     // trust check uses an attestation fast-path before falling back to
@@ -65,6 +66,7 @@ export function createNpmResolutionVerifier(opts) {
     const minimumReleaseAge = opts.minimumReleaseAge ?? 0;
     const trustPolicy = opts.trustPolicy;
     const trustPolicyIgnoreAfter = opts.trustPolicyIgnoreAfter;
+    const ignoreMissingTimeField = opts.ignoreMissingTimeField === true;
     const verify = async (resolution, { name, version, nonSemverVersion, registryName }) => {
         if (!isRegistryTarballResolution(resolution))
             return { ok: true };
@@ -105,20 +107,20 @@ export function createNpmResolutionVerifier(opts) {
             // Registry-qualified entries name their registry in the dep path, so
             // routing does not depend on a recorded tarball URL (canonical URLs
             // are omitted from the lockfile in the 12.0 format).
-            const namedRegistry = mergedNamedRegistries[registryName];
+            const namedRegistry = mergedRegistriesByPrefix[registryName];
             if (!namedRegistry) {
                 // Fail closed: without the registry URL, none of the metadata-backed
                 // checks below can vouch for this entry.
                 return {
                     ok: false,
                     code: MISSING_NAMED_REGISTRY_VIOLATION_CODE,
-                    reason: `was resolved from the named registry '${registryName}:', which is not present in the namedRegistries setting`,
+                    reason: `has registry prefix '${registryName}:', which is not declared by the registries setting`,
                 };
             }
             registry = namedRegistry;
         }
         else {
-            registry = pickRegistryForVersion(opts.registries, namedRegistryPrefixes, name, tarballUrl);
+            registry = pickRegistryForVersion(opts.registriesByScope, namedRegistryPrefixes, name, tarballUrl);
         }
         // A registry entry that pins an explicit tarball URL must point at the
         // artifact the registry's own metadata lists. Otherwise a trusted
@@ -128,17 +130,18 @@ export function createNpmResolutionVerifier(opts) {
         // narrowed by their exclude lists, since it guards integrity rather
         // than maturity/trust. Registry entries with no tarball URL reconstruct
         // it from name+version+registry, so they're inherently bound.
-        if (typeof tarballUrl === 'string') {
-            const urlViolation = await runTarballUrlCheck(lookupContext, registry, name, version, tarballUrl);
-            if (urlViolation)
-                return urlViolation;
-        }
+        const rawRevision = resolution.revision;
         const ageApplies = ageCheckActive && !isExcluded(excludePolicy, name, version);
         const trustApplies = trustCheckActive && !isExcluded(trustExcludePolicy, name, version);
+        if (tarballUrl != null || (rawRevision != null && (ageApplies || trustApplies))) {
+            const artifactViolation = await runRegistryArtifactCheck(lookupContext, registry, name, version, integrity, rawRevision, tarballUrl);
+            if (artifactViolation)
+                return artifactViolation;
+        }
         if (!ageApplies && !trustApplies)
             return { ok: true };
         if (ageApplies) {
-            const ageViolation = await runAgeCheck(lookupContext, registry, name, version, cutoff, opts.ignoreMissingTimeField === true);
+            const ageViolation = await runAgeCheck(lookupContext, registry, name, version, cutoff, ignoreMissingTimeField);
             if (ageViolation)
                 return ageViolation;
         }
@@ -146,6 +149,7 @@ export function createNpmResolutionVerifier(opts) {
             const trustViolation = await runTrustCheck(lookupContext, registry, name, version, {
                 trustPolicyExclude: trustExcludePolicy,
                 trustPolicyIgnoreAfter,
+                ignoreMissingTimeField,
             });
             if (trustViolation)
                 return trustViolation;
@@ -163,9 +167,9 @@ export function createNpmResolutionVerifier(opts) {
     // stays trusted after its exclude entry has been pulled.
     const sortedMinAgeExcludes = [...new Set(opts.minimumReleaseAgeExclude ?? [])].sort();
     const sortedTrustExcludes = [...new Set(opts.trustPolicyExclude ?? [])].sort();
-    const sortedNamedRegistries = Object.fromEntries(Object.entries(mergedNamedRegistries).sort(([aliasA], [aliasB]) => aliasA.localeCompare(aliasB)));
+    const sortedRegistriesByPrefix = Object.fromEntries(Object.entries(mergedRegistriesByPrefix).sort(([aliasA], [aliasB]) => aliasA.localeCompare(aliasB)));
     const namedRegistriesRouting = createHash('sha256')
-        .update(JSON.stringify(sortedNamedRegistries))
+        .update(JSON.stringify(sortedRegistriesByPrefix))
         .digest('hex');
     return {
         verify,
@@ -176,6 +180,7 @@ export function createNpmResolutionVerifier(opts) {
             // applies the binding — otherwise an upgrade could keep trusting a
             // lockfile that was only ever age/trust-checked.
             tarballUrlBinding: true,
+            revisionHistoryBinding: true,
             // Same cache identity rule for the missing-integrity structural check.
             integrityRequired: true,
             namedRegistriesRouting,
@@ -184,12 +189,15 @@ export function createNpmResolutionVerifier(opts) {
             trustPolicy: trustPolicy ?? null,
             trustPolicyExclude: sortedTrustExcludes,
             trustPolicyIgnoreAfter: trustPolicyIgnoreAfter ?? null,
+            minimumReleaseAgeIgnoreMissingTime: ignoreMissingTimeField,
         },
         canTrustPastCheck: (cached) => {
             // The tarball-URL binding is unconditional today; a cached run that
             // didn't record it can't be trusted to have enforced it.
             if (cached.tarballUrlBinding !== true)
                 return false;
+            if (cached.revisionHistoryBinding !== true)
+                return false;
             // The missing-integrity check is also unconditional; older cache records
             // without the flag cannot prove they rejected unverifiable tarballs.
             if (cached.integrityRequired !== true)
@@ -233,6 +241,14 @@ export function createNpmResolutionVerifier(opts) {
             const todayIgnoreAfter = trustPolicyIgnoreAfter ?? null;
             if (pastIgnoreAfter !== todayIgnoreAfter)
                 return false;
+            // Missing-time tolerance: a cached run that failed closed on an
+            // absent `time` field accepted a subset of what today's tolerant
+            // policy accepts, so it stays trustworthy. Turning the tolerance
+            // off invalidates it — entries the past run waved through are the
+            // ones today's policy exists to reject. Older records (no field)
+            // read as intolerant, which is the safe direction.
+            if (cached.minimumReleaseAgeIgnoreMissingTime === true && !ignoreMissingTimeField)
+                return false;
             return true;
         },
     };
@@ -245,15 +261,23 @@ async function runAgeCheck(context, registry, name, version, cutoff, ignoreMissi
     const published = await fetchPublishedAt(context, registry, name, version);
     if (!published) {
         // No source — attestation, local mirror, or full metadata —
-        // surfaced a publish timestamp for this version. The resolver's
-        // pickMatchingVersionFinal honors `minimumReleaseAgeIgnoreMissingTime`
-        // for the same shape (some self-hosted registries strip per-version
-        // `time`); the verifier mirrors that so it can't be stricter than
-        // fresh resolution. Without the flag we still fail closed — better
-        // a false reject than silent bypass when the user hasn't opted in.
+        // surfaced a publish timestamp for this version. What
+        // `minimumReleaseAgeIgnoreMissingTime` opts out of is a registry that
+        // cannot date its releases, so the skip is granted only when the
+        // packument carries no usable `time` map at all — the same shape the
+        // resolver's `pickMatchingVersionFinal` warns and skips on, so the
+        // verifier can't be stricter than fresh resolution. A packument that
+        // does date every version it lists is instead telling us this pin is
+        // not one of them (`dropIncompletePublishTimes` leaves no partial maps
+        // for that to be ambiguous), and an unpublished or never-published pin
+        // must fail closed however the flag is set.
         if (ignoreMissingTimeField) {
-            warnMissingTimeFieldOnce(name);
-            return undefined;
+            // Already awaited by the lookup above, so this is a cache hit.
+            const timeMap = await fetchFullMetaTime(context, registry, name);
+            if (timeMap == null) {
+                warnMissingTimeFieldOnce(name, 'minimumReleaseAge');
+                return undefined;
+            }
         }
         return {
             ok: false,
@@ -290,7 +314,7 @@ async function runAgeCheck(context, registry, name, version, cutoff, ignoreMissi
  * a tampered lockfile could smuggle a malicious URL past the check by
  * pointing it at a `name@version` the registry can't vouch for.
  */
-async function runTarballUrlCheck(context, registry, name, version, lockfileTarball) {
+async function runRegistryArtifactCheck(context, registry, name, version, lockfileIntegrity, rawRevision, lockfileTarball) {
     const { meta, error } = await fetchAbbreviatedMeta(context, registry, name);
     if (error != null) {
         // Couldn't reach the registry to verify (auth/network/5xx). Propagate the
@@ -300,25 +324,114 @@ async function runTarballUrlCheck(context, registry, name, version, lockfileTarb
         // error — still fail-closed, the entry never reaches the filesystem.
         throw error;
     }
-    const registryTarball = meta?.versionTarballs?.get(version);
-    if (registryTarball != null && sameTarballUrl(lockfileTarball, registryTarball)) {
-        return undefined;
+    const artifact = meta?.versionArtifacts?.get(version);
+    if (artifact == null) {
+        if (lockfileTarball == null && rawRevision == null)
+            return undefined;
+        return {
+            ok: false,
+            code: lockfileTarball == null
+                ? TARBALL_REVISION_MISMATCH_VIOLATION_CODE
+                : TARBALL_URL_MISMATCH_VIOLATION_CODE,
+            reason: "could not be verified against the registry's published metadata",
+        };
     }
-    return {
-        ok: false,
-        code: TARBALL_URL_MISMATCH_VIOLATION_CODE,
-        reason: registryTarball == null
-            ? "could not be verified against the registry's published metadata"
-            : `has a tarball URL (${lockfileTarball}) that does not match the registry's published metadata (${registryTarball})`,
-    };
+    const metadataRevision = artifact.current.revision;
+    const revisionAware = rawRevision != null || metadataRevision !== undefined || artifact.revisions.length > 0;
+    if (!revisionAware) {
+        if (lockfileTarball == null)
+            return undefined;
+        if (typeof artifact.current.tarball === 'string' && sameTarballUrl(lockfileTarball, artifact.current.tarball)) {
+            return undefined;
+        }
+        return {
+            ok: false,
+            code: TARBALL_URL_MISMATCH_VIOLATION_CODE,
+            reason: typeof artifact.current.tarball !== 'string'
+                ? "could not be verified against the registry's published metadata"
+                : `has a tarball URL (${lockfileTarball}) that does not match the registry's published metadata (${artifact.current.tarball})`,
+        };
+    }
+    if (rawRevision != null && !isValidTarballRevision(rawRevision)) {
+        return {
+            ok: false,
+            code: TARBALL_REVISION_MISMATCH_VIOLATION_CODE,
+            reason: `has an invalid revision (${String(rawRevision)})`,
+        };
+    }
+    let currentRevision = 0;
+    if (metadataRevision !== undefined) {
+        if (!isValidTarballRevision(metadataRevision)) {
+            return {
+                ok: false,
+                code: TARBALL_REVISION_MISMATCH_VIOLATION_CODE,
+                reason: `registry metadata has an invalid current revision (${String(metadataRevision)})`,
+            };
+        }
+        currentRevision = metadataRevision;
+        const currentHistory = artifact.revisions.filter(candidate => candidate.revision === currentRevision);
+        if (currentHistory.length !== 1 ||
+            currentHistory[0].integrity !== artifact.current.integrity ||
+            typeof currentHistory[0].tarball !== 'string' ||
+            typeof artifact.current.tarball !== 'string' ||
+            typeof artifact.current.integrity !== 'string' ||
+            !isIntegrityAddressedRegistryTarballUrl(normalizeRegistryUrl(artifact.current.tarball), artifact.current.integrity, registry) ||
+            !sameTarballUrl(currentHistory[0].tarball, artifact.current.tarball)) {
+            return {
+                ok: false,
+                code: TARBALL_REVISION_MISMATCH_VIOLATION_CODE,
+                reason: `registry metadata revision ${currentRevision} does not have exactly one matching history entry`,
+            };
+        }
+    }
+    const revision = typeof rawRevision === 'number' ? rawRevision : 0;
+    const currentMatches = currentRevision === revision;
+    const historicalCandidates = artifact.revisions.filter(candidate => candidate.revision === revision);
+    if (historicalCandidates.length > 1) {
+        return {
+            ok: false,
+            code: TARBALL_REVISION_MISMATCH_VIOLATION_CODE,
+            reason: `revision ${revision} is advertised more than once in the registry's history`,
+        };
+    }
+    const historical = historicalCandidates[0];
+    const selected = currentMatches ? artifact.current : historical;
+    if (selected == null ||
+        selected.integrity !== lockfileIntegrity ||
+        (currentMatches && historical != null && historical.integrity !== lockfileIntegrity)) {
+        return {
+            ok: false,
+            code: TARBALL_REVISION_MISMATCH_VIOLATION_CODE,
+            reason: `has revision ${revision} with an integrity that does not match the registry's current or historical metadata`,
+        };
+    }
+    if (revision > 0 || !currentMatches) {
+        if (typeof selected.tarball !== 'string' ||
+            !isIntegrityAddressedRegistryTarballUrl(normalizeRegistryUrl(selected.tarball), lockfileIntegrity, registry)) {
+            return {
+                ok: false,
+                code: TARBALL_REVISION_MISMATCH_VIOLATION_CODE,
+                reason: `has revision ${revision} that is not addressed by its complete sha512 integrity`,
+            };
+        }
+    }
+    if (lockfileTarball != null && (typeof selected.tarball !== 'string' || !sameTarballUrl(lockfileTarball, selected.tarball))) {
+        return {
+            ok: false,
+            code: TARBALL_URL_MISMATCH_VIOLATION_CODE,
+            reason: typeof selected.tarball !== 'string'
+                ? "could not be verified against the registry's published metadata"
+                : `has a tarball URL (${lockfileTarball}) that does not match the registry's published metadata (${selected.tarball})`,
+        };
+    }
+    return undefined;
 }
 function sameTarballUrl(a, b) {
     return canonicalTarballUrl(a) === canonicalTarballUrl(b);
 }
-// Mirror the tolerance toLockfileResolution applies when it decides whether
-// a tarball URL is "the expected one": ignore the protocol and `%2f` scope
-// encoding so a benign http/https or encoding difference isn't read as
-// tampering. The `%2f` match is case-insensitive because `normalizeRegistryUrl`
+// Both URLs come from the registry, so ignore the protocol and `%2f` scope
+// encoding: a benign http/https or encoding difference isn't tampering. The
+// `%2f` match is case-insensitive because `normalizeRegistryUrl`
 // (`new URL().toString()`) can upper-case percent-escapes to `%2F`.
 function canonicalTarballUrl(url) {
     const normalized = normalizeRegistryUrl(url).replace(/%2f/gi, '/');
@@ -531,7 +644,7 @@ async function tryAbbreviatedModifiedShortcut(context, registry, name, version)
     // publish time — but only for versions the registry currently lists.
     // An unpublished or never-published pin would otherwise pass the gate
     // on a stale package-level timestamp.
-    if (!meta?.versionTarballs?.has(version))
+    if (!meta?.versionArtifacts?.has(version))
         return undefined;
     return modified;
 }
@@ -615,16 +728,29 @@ function validateSharedMeta(meta, name) {
 // lockfile (see #11860). The full document is GC-able as soon as this
 // closure returns; only the short tarball-URL strings are retained.
 function projectAbbreviatedMeta(meta) {
-    let versionTarballs;
+    let versionArtifacts;
     if (meta.versions) {
-        versionTarballs = new Map();
+        versionArtifacts = new Map();
         for (const [version, manifest] of Object.entries(meta.versions)) {
-            versionTarballs.set(version, manifest.dist?.tarball);
+            versionArtifacts.set(version, {
+                current: {
+                    revision: manifest.dist?.revision,
+                    integrity: manifest.dist?.integrity,
+                    tarball: manifest.dist?.tarball,
+                },
+                revisions: Array.isArray(manifest.dist?.revisions)
+                    ? manifest.dist.revisions.map(revision => ({
+                        revision: revision.revision,
+                        integrity: revision.integrity,
+                        tarball: revision.tarball,
+                    }))
+                    : [],
+            });
         }
     }
     return {
         modified: meta.modified,
-        versionTarballs,
+        versionArtifacts,
     };
 }
 function readLocalMetaTime(context, registry, name) {
@@ -657,7 +783,7 @@ function fetchFullMetaTime(context, registry, name) {
     }
     return cachedPromise;
 }
-function pickRegistryForVersion(registries, namedRegistryPrefixes, name, tarballUrl) {
+function pickRegistryForVersion(registriesByScope, namedRegistryPrefixes, name, tarballUrl) {
     // If the lockfile records where the tarball lives, prefer that — scope
     // routing (`@scope:registry`) only covers scoped packages, but named
     // registries (`gh:`, `jsr:` aliases, custom) ship un-scoped packages whose
@@ -674,7 +800,7 @@ function pickRegistryForVersion(registries, namedRegistryPrefixes, name, tarball
                 return prefix;
         }
     }
-    return pickRegistryForPackage(registries, name);
+    return pickRegistryForPackage(registriesByScope, name);
 }
 function tryParseUrl(url) {
     try {

package/lib/fetch.js

@@ -1,11 +1,12 @@
 import url from 'node:url';
 import util from 'node:util';
 import { requestRetryLogger } from '@pnpm/core-loggers';
-import { FetchError, PnpmError, redactUrlCredentials, } from '@pnpm/error';
+import { FetchError, PnpmError, redactUrlCredentials, redactUrlForDisplay, } from '@pnpm/error';
 import { globalWarn } from '@pnpm/logger';
 import * as retry from '@zkochan/retry';
 import semver from 'semver';
 import { clearMeta } from './clearMeta.js';
+import { dropIncompletePublishTimes } from './publishTimes.js';
 /**
  * Content type of an abbreviated (install-oriented) package metadata document.
  * A spec-compliant registry echoes this in the response `Content-Type` when it
@@ -147,10 +148,11 @@ export async function fetchMetadataFromFromRegistry(fetchOpts, pkgName, { authHe
             try {
                 const jsonText = await response.text();
                 const meta = JSON.parse(jsonText);
+                dropIncompletePublishTimes(meta);
                 // Check if request took longer than expected
                 const elapsedMs = Date.now() - startTime;
                 if (elapsedMs > fetchOpts.fetchWarnTimeoutMs) {
-                    globalWarn(`Request took ${elapsedMs}ms: ${uri}`);
+                    globalWarn(`Request took ${elapsedMs}ms: ${redactUrlForDisplay(uri)}`);
                 }
                 resolve({
                     ...normalizeAbbreviatedResponse({ fullMetadata, meta, jsonText, response }),
@@ -200,7 +202,7 @@ export function notModifiedWithoutCacheError(pkgName) {
  * carry the megabytes of install-irrelevant data (scripts, exports, readme,
  * custom fields) that a full document contains.
  *
- * Registries that honor the header (e.g. the npm registry) echo the abbreviated
+ * RegistriesByScope that honor the header (e.g. the npm registry) echo the abbreviated
  * `Content-Type`, so this is a no-op for them: no re-serialization, no field
  * stripping — the happy path pays nothing.
  */

package/lib/index.d.ts

@@ -2,9 +2,9 @@ import { PnpmError } from '@pnpm/error';
 import type { FetchFromRegistry, GetAuthHeader, RetryTimeoutOptions } from '@pnpm/fetching.types';
 import type { PackageMeta } from '@pnpm/resolving.registry.types';
 import type { DirectoryResolution, LatestInfo, LatestQuery, PkgResolutionId, PreferredVersions, ResolveOptions, ResolveResult, TarballResolution, WantedDependency, WorkspacePackages } from '@pnpm/resolving.resolver-base';
-import type { DependencyManifest, PackageVersionPolicy, RangeSpecStyle, Registries, TrustPolicy } from '@pnpm/types';
+import type { DependencyManifest, PackageVersionPolicy, RangeSpecStyle, RegistriesByScope, TrustPolicy } from '@pnpm/types';
 import { fetchMetadataFromFromRegistry, type FetchMetadataFromFromRegistryOptions, RegistryResponseError } from './fetch.js';
-import { BUILTIN_NAMED_REGISTRIES, parseBareSpecifier, type RegistryPackageSpec } from './parseBareSpecifier.js';
+import { BUILTIN_REGISTRIES_BY_PREFIX, parseBareSpecifier, type RegistryPackageSpec } from './parseBareSpecifier.js';
 import { type PackageMetaCache, pickPackage, type PickPackageOptions } from './pickPackage.js';
 import { pickPackageFromMeta, pickVersionByVersionRange } from './pickPackageFromMeta.js';
 import { workspacePrefToNpm } from './workspacePrefToNpm.js';
@@ -18,7 +18,7 @@ export declare class NoMatchingVersionError extends PnpmError {
     constructor(opts: NoMatchingVersionErrorOptions);
 }
 export declare function formatTimeAgo(date: Date): string | null;
-export { BUILTIN_NAMED_REGISTRIES, fetchMetadataFromFromRegistry, type FetchMetadataFromFromRegistryOptions, type PackageMeta, type PackageMetaCache, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, type RegistryPackageSpec, RegistryResponseError, workspacePrefToNpm, };
+export { BUILTIN_REGISTRIES_BY_PREFIX, fetchMetadataFromFromRegistry, type FetchMetadataFromFromRegistryOptions, type PackageMeta, type PackageMetaCache, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, type RegistryPackageSpec, RegistryResponseError, workspacePrefToNpm, };
 export { createNpmResolutionVerifier, type CreateNpmResolutionVerifierOptions } from './createNpmResolutionVerifier.js';
 export { MINIMUM_RELEASE_AGE_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
 export interface ResolverFactoryOptions {
@@ -26,13 +26,20 @@ export interface ResolverFactoryOptions {
     storeDir?: string;
     frozenStore?: boolean;
     fullMetadata?: boolean;
+    /**
+     * Asked instead of {@link ResolverFactoryOptions.fullMetadata} when the
+     * caller can answer per registry — a registry that declares
+     * `supportsTimeField` needs no full metadata for a time-based resolution
+     * even when the others do.
+     */
+    needsFullMetadataFor?: (registry: string) => boolean;
     filterMetadata?: boolean;
     offline?: boolean;
     preferOffline?: boolean;
     retry?: RetryTimeoutOptions;
     timeout?: number;
-    registries: Registries;
-    namedRegistries?: Record<string, string>;
+    registriesByScope: RegistriesByScope;
+    registriesByPrefix?: Record<string, string>;
     saveWorkspaceProtocol?: boolean | 'rolling';
     preserveAbsolutePaths?: boolean;
     ignoreMissingTimeField?: boolean;
@@ -83,10 +90,16 @@ export declare function createNpmResolver(fetchFromRegistry: FetchFromRegistry,
 export interface ResolveFromNpmContext {
     pickPackage: (spec: RegistryPackageSpec, opts: PickPackageOptions) => ReturnType<typeof pickPackage>;
     getAuthHeaderValueByURI: GetAuthHeader;
-    registries: Registries;
-    namedRegistries: Record<string, string>;
+    registriesByScope: RegistriesByScope;
+    registriesByPrefix: Record<string, string>;
     namedRegistryNames: ReadonlySet<string>;
     saveWorkspaceProtocol?: boolean | 'rolling';
+    /**
+     * The `minimumReleaseAgeIgnoreMissingTime` opt-in, reaching the trust
+     * check as well as the version pick: both read the same per-version
+     * `time`, so a registry that strips it takes both down together.
+     */
+    ignoreMissingTimeField?: boolean;
     peekManifestFromStore?: (opts: {
         id: PkgResolutionId;
         integrity: string;
@@ -110,6 +123,7 @@ export type ResolveFromNpmOptions = {
     preferredVersions?: PreferredVersions;
     preferWorkspacePackages?: boolean;
     update?: false | 'compatible' | 'latest';
+    updatePatches?: boolean;
     updateRequested?: boolean;
     updateChecksums?: boolean;
     injectWorkspacePackages?: boolean;