@pnpm/resolving.npm-resolver 1103.2.1 → 1104.1.0

package/lib/index.js

@@ -1,10 +1,11 @@
 import path from 'node:path';
 import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
 import { isWellFormedRegistryName, RESERVED_VERSION_PREFIXES } from '@pnpm/deps.path';
-import { PnpmError } from '@pnpm/error';
+import { PnpmError, redactUrlForDisplay } from '@pnpm/error';
 import { globalWarn } from '@pnpm/logger';
 import { calcVersionRange, inferRangeSpecStyle, rangeSpecGranularity, versionWithRangeSpecStyle } from '@pnpm/pkg-manifest.utils';
 import { EXISTING_VERSION_SELECTOR_WEIGHT, } from '@pnpm/resolving.resolver-base';
+import { isIntegrityAddressedRegistryTarballUrl, isValidTarballRevision, } from '@pnpm/resolving.tarball-url';
 import { storeIndexKey } from '@pnpm/store.index';
 import { readPkgFromCafs, } from '@pnpm/worker';
 import { resolveWorkspaceRange } from '@pnpm/workspace.range-resolver';
@@ -18,7 +19,7 @@ import { clearMeta, retainsFullMeta } from './clearMeta.js';
 import { fetchMetadataFromFromRegistry, RegistryResponseError } from './fetch.js';
 import { memoizeFetchMetadata } from './memoizeFetchMetadata.js';
 import { normalizeRegistryUrl } from './normalizeRegistryUrl.js';
-import { BUILTIN_NAMED_REGISTRIES, parseBareSpecifier, parseJsrSpecifierToRegistryPackageSpec, parseNamedRegistrySpecifierToRegistryPackageSpec, } from './parseBareSpecifier.js';
+import { BUILTIN_REGISTRIES_BY_PREFIX, parseBareSpecifier, parseJsrSpecifierToRegistryPackageSpec, parseNamedRegistrySpecifierToRegistryPackageSpec, } from './parseBareSpecifier.js';
 import { pickPackage, } from './pickPackage.js';
 import { applyPublishedByPolicy, pickPackageFromMeta, pickVersionByVersionRange } from './pickPackageFromMeta.js';
 import { failIfTrustDowngraded } from './trustChecks.js';
@@ -63,7 +64,7 @@ export function formatTimeAgo(date) {
         return `${diffMin} minute${diffMin === 1 ? '' : 's'} ago`;
     return 'a few seconds ago';
 }
-export { BUILTIN_NAMED_REGISTRIES, fetchMetadataFromFromRegistry, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, RegistryResponseError, workspacePrefToNpm, };
+export { BUILTIN_REGISTRIES_BY_PREFIX, fetchMetadataFromFromRegistry, parseBareSpecifier, pickPackageFromMeta, pickVersionByVersionRange, RegistryResponseError, workspacePrefToNpm, };
 export { createNpmResolutionVerifier } from './createNpmResolutionVerifier.js';
 export { MINIMUM_RELEASE_AGE_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
 export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
@@ -88,6 +89,10 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
     // using.
     const ownsMetaCache = opts.metaCache == null;
     const metaCache = opts.metaCache ?? createDefaultPackageMetaCache();
+    // This marker is intentionally resolver-scoped rather than attached to
+    // `metaCache`: callers may reuse one metadata cache across installs, and a
+    // later install must retry a full-metadata upgrade that previously got 304.
+    const releaseAgeUpgradeCheckedPackuments = new WeakSet();
     // Create peek function if storeDir is provided
     const storeDir = opts.storeDir;
     const peekLockerForPeek = new Map();
@@ -114,31 +119,34 @@ export function createNpmResolver(fetchFromRegistry, getAuthHeader, opts) {
             return request;
         };
     }
-    const namedRegistries = mergeNamedRegistries(opts.namedRegistries);
-    const namedRegistryNames = new Set(Object.keys(namedRegistries));
+    const registriesByPrefix = mergeNamedRegistries(opts.registriesByPrefix);
+    const namedRegistryNames = new Set(Object.keys(registriesByPrefix));
     const ctx = {
         getAuthHeaderValueByURI: getAuthHeader,
         pickPackage: pickPackage.bind(null, {
             fetch,
             fullMetadata: opts.fullMetadata,
+            needsFullMetadataFor: opts.needsFullMetadataFor,
             filterMetadata: opts.filterMetadata,
             metaCache,
             offline: opts.offline,
             preferOffline: opts.preferOffline,
             cacheDir: opts.cacheDir,
             ignoreMissingTimeField: opts.ignoreMissingTimeField,
+            releaseAgeUpgradeCheckedPackuments,
         }),
-        registries: opts.registries,
-        namedRegistries,
+        registriesByScope: opts.registriesByScope,
+        registriesByPrefix,
         namedRegistryNames,
         saveWorkspaceProtocol: opts.saveWorkspaceProtocol,
+        ignoreMissingTimeField: opts.ignoreMissingTimeField,
         peekManifestFromStore,
         warnedHeldBackUpdates: new Set(),
     };
     const boundResolveFromNpm = resolveNpm.bind(null, ctx);
     const boundResolveFromJsr = resolveJsr.bind(null, ctx);
     const boundResolveFromNamedRegistry = resolveFromNamedRegistry.bind(null, ctx);
-    const defaultRegistry = opts.registries.default;
+    const defaultRegistry = opts.registriesByScope.default;
     return {
         resolveFromNpm: boundResolveFromNpm,
         resolveFromJsr: boundResolveFromJsr,
@@ -304,8 +312,8 @@ function createResolveLatest(resolve, matches) {
 async function resolveNpm(ctx, wantedDependency, opts) {
     const defaultTag = opts.defaultTag ?? 'latest';
     const registry = wantedDependency.alias
-        ? pickRegistryForPackage(ctx.registries, wantedDependency.alias, wantedDependency.bareSpecifier)
-        : ctx.registries.default;
+        ? pickRegistryForPackage(ctx.registriesByScope, wantedDependency.alias, wantedDependency.bareSpecifier)
+        : ctx.registriesByScope.default;
     if (wantedDependency.bareSpecifier?.startsWith('workspace:')) {
         if (wantedDependency.bareSpecifier.startsWith('workspace:.'))
             return null;
@@ -325,12 +333,15 @@ async function resolveNpm(ctx, wantedDependency, opts) {
             return resolvedFromWorkspace;
         }
     }
-    const workspacePackages = opts.alwaysTryWorkspacePackages !== false ? opts.workspacePackages : undefined;
+    const canKeepWorkspaceResolution = opts.currentPkg == null || opts.currentPkg.resolution.type === 'directory';
     const spec = wantedDependency.bareSpecifier
         ? parseBareSpecifier(wantedDependency.bareSpecifier, wantedDependency.alias, defaultTag, registry)
         : defaultTagForAlias(wantedDependency.alias, defaultTag);
     if (spec == null)
         return null;
+    const workspacePackages = spec.revision == null && (!opts.updatePatches || canKeepWorkspaceResolution) && opts.alwaysTryWorkspacePackages !== false
+        ? opts.workspacePackages
+        : undefined;
     // Fast path: if we have a current resolution with integrity, try to peek the manifest from the store.
     // This avoids the expensive metadata fetch from the registry.
     // We do this AFTER ensuring the spec is valid for this resolver to avoids hijacking other resolvers.
@@ -340,10 +351,12 @@ async function resolveNpm(ctx, wantedDependency, opts) {
     if (ctx.peekManifestFromStore &&
         opts.currentPkg?.resolution &&
         !opts.update &&
+        !opts.updatePatches &&
+        spec.revision == null &&
         (opts.publishedBy == null || opts.currentPkg.publishedAt != null)) {
         const currentResolution = opts.currentPkg.resolution;
         // Only use this optimization for tarball resolutions with integrity (npm packages)
-        if ('tarball' in currentResolution && currentResolution.integrity) {
+        if ('tarball' in currentResolution && typeof currentResolution.integrity === 'string') {
             const manifest = await ctx.peekManifestFromStore({
                 id: opts.currentPkg.id,
                 integrity: currentResolution.integrity,
@@ -379,6 +392,34 @@ async function resolveNpm(ctx, wantedDependency, opts) {
             }
         }
     }
+    // This runs *after* the store peek because a tag-specified dep whose only local copy is a
+    // prerelease reaches here with `update: false` (`wantedDepIsLocallyAvailable` ignores
+    // prereleases for tags, `pickMatchingLocalVersionOrNull` does not), and the peek must keep
+    // winning there. `update` is deliberately absent from the guard: that same helper forces it
+    // on for exactly these deps, so excluding it would make this block unreachable.
+    if (opts.preferWorkspacePackages === true &&
+        workspacePackages != null &&
+        opts.projectDir &&
+        opts.trustPolicy !== 'no-downgrade' &&
+        !opts.updateChecksums &&
+        opts.injectWorkspacePackages !== true &&
+        !wantedDependency.injected) {
+        const workspacePkgsMatchingName = spec.revision == null ? workspacePackages.get(spec.name) : undefined;
+        if (workspacePkgsMatchingName?.size === 1) {
+            const localVersion = pickMatchingLocalVersionOrNull(workspacePkgsMatchingName, spec);
+            if (localVersion != null) {
+                return resolveFromLocalPackage(workspacePkgsMatchingName.get(localVersion), spec, {
+                    wantedDependency,
+                    projectDir: opts.projectDir,
+                    lockfileDir: opts.lockfileDir,
+                    hardLinkLocalPackages: false,
+                    saveWorkspaceProtocol: ctx.saveWorkspaceProtocol,
+                    calcSpecifier: opts.calcSpecifier,
+                    rangeSpecStyle: opts.rangeSpecStyle,
+                });
+            }
+        }
+    }
     const authHeaderValue = ctx.getAuthHeaderValueByURI(registry, { pkgName: spec.name });
     let pickResult;
     try {
@@ -391,8 +432,9 @@ async function resolveNpm(ctx, wantedDependency, opts) {
             preferredVersionSelectors: preferredVersionSelectorsFor(opts, spec.name),
             registry,
             includeLatestTag: opts.update === 'latest',
-            updateChecksums: opts.updateChecksums,
+            updateChecksums: opts.updateChecksums || opts.updatePatches,
             optional: wantedDependency.optional,
+            trustPolicy: opts.trustPolicy,
         });
     }
     catch (err) { // eslint-disable-line
@@ -448,10 +490,14 @@ async function resolveNpm(ctx, wantedDependency, opts) {
         throw new NoMatchingVersionError({ wantedDependency, packageMeta: meta, registry });
     }
     else if (opts.trustPolicy === 'no-downgrade') {
-        failIfTrustDowngraded(meta, pickedPackage.version, opts);
+        failIfTrustDowngraded(meta, pickedPackage.version, {
+            trustPolicyExclude: opts.trustPolicyExclude,
+            trustPolicyIgnoreAfter: opts.trustPolicyIgnoreAfter,
+            ignoreMissingTimeField: ctx.ignoreMissingTimeField,
+        });
     }
     const latest = latestAllowedByPolicy(meta, opts);
-    const workspacePkgsMatchingName = workspacePackages?.get(pickedPackage.name);
+    const workspacePkgsMatchingName = spec.revision == null ? workspacePackages?.get(pickedPackage.name) : undefined;
     if (workspacePkgsMatchingName && opts.projectDir) {
         const matchedPkg = workspacePkgsMatchingName.get(pickedPackage.version);
         if (matchedPkg) {
@@ -485,11 +531,9 @@ async function resolveNpm(ctx, wantedDependency, opts) {
         }
     }
     warnOnceOnHeldBackUpdate(ctx, opts, spec, meta, pickedPackage.version);
+    const selectedPackage = selectPackageRevision(pickedPackage, spec, registry);
     const id = `${pickedPackage.name}@${pickedPackage.version}`;
-    const resolution = {
-        integrity: getIntegrity(pickedPackage.dist),
-        tarball: normalizeRegistryUrl(pickedPackage.dist.tarball),
-    };
+    const resolution = createRegistryTarballResolution(selectedPackage.dist, registry);
     let normalizedBareSpecifier;
     if (opts.calcSpecifier) {
         normalizedBareSpecifier = spec.normalizedBareSpecifier ?? calcSpecifier({
@@ -503,7 +547,7 @@ async function resolveNpm(ctx, wantedDependency, opts) {
     return {
         id,
         latest,
-        manifest: pickedPackage,
+        manifest: selectedPackage,
         resolution,
         resolvedVia: 'npm-registry',
         publishedAt,
@@ -524,11 +568,18 @@ async function resolveJsr(ctx, wantedDependency, opts) {
     const spec = parseJsrSpecifierToRegistryPackageSpec(wantedDependency.bareSpecifier, wantedDependency.alias, opts.defaultTag ?? 'latest');
     if (spec == null)
         return null;
-    const picked = await pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, ctx.registries['@jsr']); // '@jsr' is always defined
+    const picked = await pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, ctx.registriesByScope['@jsr']); // '@jsr' is always defined
     return {
         ...picked,
         normalizedBareSpecifier: opts.calcSpecifier
-            ? calcPrefixedSpecifier('jsr:', spec.jsrPkgName, wantedDependency, picked.manifest.version, opts.rangeSpecStyle)
+            ? calcPrefixedSpecifier({
+                prefix: 'jsr:',
+                pkgName: spec.jsrPkgName,
+                wantedDependency,
+                version: picked.manifest.version,
+                revision: spec.revision,
+                defaultRangeSpecStyle: opts.rangeSpecStyle,
+            })
             : undefined,
         resolvedVia: 'jsr-registry',
         alias: spec.jsrPkgName,
@@ -543,14 +594,14 @@ async function resolveJsr(ctx, wantedDependency, opts) {
 // another specifier scheme (e.g. `git`, `github`, `jsr`) is silently shadowed
 // by that scheme's dedicated resolver — no cross-resolver knowledge needed.
 function mergeNamedRegistries(userDefined) {
-    const merged = { ...BUILTIN_NAMED_REGISTRIES };
+    const merged = { ...BUILTIN_REGISTRIES_BY_PREFIX };
     if (!userDefined)
         return merged;
     for (const [alias, url] of Object.entries(userDefined)) {
         if (RESERVED_VERSION_PREFIXES.has(alias) || !isWellFormedRegistryName(alias)) {
             throw new PnpmError('RESERVED_NAMED_REGISTRY_NAME', RESERVED_VERSION_PREFIXES.has(alias)
                 ? `'${alias}' cannot be used as a named registry alias: it is a reserved dependency specifier prefix.`
-                : `'${alias}' cannot be used as a named registry alias: aliases must start with a letter and contain only letters, digits, ".", "_", and "-".`, { hint: 'Rename the entry in the namedRegistries setting.' });
+                : `'${alias}' cannot be used as a named registry alias: aliases must start with a letter and contain only letters, digits, ".", "_", and "-".`, { hint: 'Change the prefix on the corresponding registries entry.' });
         }
         if (typeof url !== 'string' || !isValidHttpUrl(url)) {
             throw new PnpmError('INVALID_NAMED_REGISTRY_URL', `The named registry alias '${alias}' is mapped to '${String(url)}', which is not a valid http(s) URL.`, { hint: 'Provide a URL that starts with http:// or https://, e.g. https://npm.pkg.example.com/' });
@@ -571,7 +622,7 @@ function isValidHttpUrl(url) {
 // Resolves a `<alias>:` specifier from one of the configured named registries.
 // The `gh:` alias ships as a built-in default pointing at the GitHub Packages
 // npm registry; additional aliases come from pnpm-workspace.yaml's
-// `namedRegistries` field. Auth tokens are looked up by the resolved registry
+// `registriesByPrefix` field. Auth tokens are looked up by the resolved registry
 // URL, so a `//npm.pkg.github.com/:_authToken=...` entry in `.npmrc` is
 // picked up automatically for `gh:` specifiers (and analogously for any user-
 // configured alias).
@@ -581,7 +632,7 @@ async function resolveFromNamedRegistry(ctx, wantedDependency, opts) {
     const spec = parseNamedRegistrySpecifierToRegistryPackageSpec(wantedDependency.bareSpecifier, ctx.namedRegistryNames, wantedDependency.alias, opts.defaultTag ?? 'latest');
     if (spec == null)
         return null;
-    const registry = ctx.namedRegistries[spec.registryName];
+    const registry = ctx.registriesByPrefix[spec.registryName];
     if (!registry)
         return null; // defensive: should never trigger because parse checks the alias set
     const picked = await pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, registry);
@@ -593,7 +644,14 @@ async function resolveFromNamedRegistry(ctx, wantedDependency, opts) {
         // decides the tarball both consumers get.
         id: `${picked.manifest.name}@${spec.registryName}:${picked.manifest.version}`,
         normalizedBareSpecifier: opts.calcSpecifier
-            ? calcPrefixedSpecifier(`${spec.registryName}:`, spec.name, wantedDependency, picked.manifest.version, opts.rangeSpecStyle)
+            ? calcPrefixedSpecifier({
+                prefix: `${spec.registryName}:`,
+                pkgName: spec.name,
+                wantedDependency,
+                version: picked.manifest.version,
+                revision: spec.revision,
+                defaultRangeSpecStyle: opts.rangeSpecStyle,
+            })
             : undefined,
         resolvedVia: 'named-registry',
         registryName: spec.registryName,
@@ -617,22 +675,21 @@ async function pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, registr
         preferredVersionSelectors: preferredVersionSelectorsFor(opts, spec.name),
         registry,
         includeLatestTag: opts.update === 'latest',
-        updateChecksums: opts.updateChecksums,
+        updateChecksums: opts.updateChecksums || opts.updatePatches,
         optional: wantedDependency.optional,
+        trustPolicy: opts.trustPolicy,
     });
     if (pickedPackage == null) {
         throw new NoMatchingVersionError({ wantedDependency, packageMeta: meta, registry });
     }
     warnOnceOnHeldBackUpdate(ctx, opts, spec, meta, pickedPackage.version);
-    const resolution = {
-        integrity: getIntegrity(pickedPackage.dist),
-        tarball: normalizeRegistryUrl(pickedPackage.dist.tarball),
-    };
+    const selectedPackage = selectPackageRevision(pickedPackage, spec, registry);
+    const resolution = createRegistryTarballResolution(selectedPackage.dist, registry);
     const publishedAt = meta.time?.[pickedPackage.version];
     return {
         id: `${pickedPackage.name}@${pickedPackage.version}`,
         latest: latestAllowedByPolicy(meta, opts),
-        manifest: pickedPackage,
+        manifest: selectedPackage,
         resolution,
         publishedAt,
         policyViolation: detectMinReleaseAgeViolation({
@@ -649,13 +706,25 @@ async function pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, registr
 // when the dependency alias matches the package name). Shared between the
 // jsr and named-registry resolvers since they only differ in `prefix` and
 // which spec field holds the package name.
-function calcPrefixedSpecifier(prefix, pkgName, wantedDependency, version, defaultRangeSpecStyle) {
-    const range = calcRange(version, wantedDependency, defaultRangeSpecStyle);
-    if (!wantedDependency.alias || pkgName === wantedDependency.alias)
-        return `${prefix}${range}`;
-    return `${prefix}${pkgName}@${range}`;
+function calcPrefixedSpecifier(opts) {
+    if (opts.revision != null) {
+        const target = `${opts.version}+r${opts.revision}`;
+        if (!opts.wantedDependency.alias || opts.pkgName === opts.wantedDependency.alias)
+            return `${opts.prefix}${target}`;
+        return `${opts.prefix}${opts.pkgName}@${target}`;
+    }
+    const range = calcRange(opts.version, opts.wantedDependency, opts.defaultRangeSpecStyle);
+    if (!opts.wantedDependency.alias || opts.pkgName === opts.wantedDependency.alias)
+        return `${opts.prefix}${range}`;
+    return `${opts.prefix}${opts.pkgName}@${range}`;
 }
 function calcSpecifier({ wantedDependency, spec, version, defaultRangeSpecStyle, }) {
+    if (spec.revision != null) {
+        const target = `${version}+r${spec.revision}`;
+        if (!wantedDependency.alias || spec.name === wantedDependency.alias)
+            return target;
+        return `npm:${spec.name}@${target}`;
+    }
     if (wantedDependency.prevSpecifier === wantedDependency.bareSpecifier && wantedDependency.prevSpecifier && versionSelectorType(wantedDependency.prevSpecifier)?.type === 'tag') {
         return wantedDependency.prevSpecifier;
     }
@@ -875,6 +944,123 @@ function getIntegrity(dist) {
     }
     return integrity.toString();
 }
+function createRegistryTarballResolution(dist, registry) {
+    const integrity = getIntegrity(dist);
+    const tarball = normalizeRegistryUrl(dist.tarball);
+    if (dist.revision == null) {
+        return { integrity, tarball };
+    }
+    if (!isValidTarballRevision(dist.revision)) {
+        throw new PnpmError('MALFORMED_METADATA', `Tarball "${redactUrlForDisplay(dist.tarball)}" has an invalid revision in its metadata: ${String(dist.revision)}`);
+    }
+    if (integrity == null ||
+        !isIntegrityAddressedRegistryTarballUrl(tarball, integrity, registry)) {
+        throw new PnpmError('MALFORMED_METADATA', `Tarball "${redactUrlForDisplay(dist.tarball)}" has revision ${dist.revision} but is not addressed by its complete integrity.`);
+    }
+    return {
+        integrity,
+        revision: dist.revision,
+        tarball,
+    };
+}
+const REVISION_MANIFEST_FIELDS = [
+    'bin',
+    'bundleDependencies',
+    'bundledDependencies',
+    'cpu',
+    'dependencies',
+    'engines',
+    'hasInstallScript',
+    'libc',
+    'optionalDependencies',
+    'os',
+    'peerDependencies',
+    'peerDependenciesMeta',
+];
+function selectPackageRevision(pickedPackage, spec, registry) {
+    validateCurrentPackageRevision(pickedPackage, registry);
+    if (spec.revision == null)
+        return pickedPackage;
+    const revisions = pickedPackage.dist.revisions;
+    if (revisions == null) {
+        if (spec.revision === 0 && pickedPackage.dist.revision == null)
+            return pickedPackage;
+        throw new PnpmError('NO_MATCHING_REVISION', `No revision ${spec.revision} is advertised for ${pickedPackage.name}@${pickedPackage.version}`);
+    }
+    if (!Array.isArray(revisions)) {
+        throw malformedRevisionHistory(pickedPackage, 'the revisions field is not an array');
+    }
+    const matches = revisions.filter((entry) => isRevisionNumber(entry?.revision) && entry.revision === spec.revision);
+    if (matches.length === 0) {
+        throw new PnpmError('NO_MATCHING_REVISION', `No revision ${spec.revision} is advertised for ${pickedPackage.name}@${pickedPackage.version}`);
+    }
+    if (matches.length !== 1) {
+        throw malformedRevisionHistory(pickedPackage, `revision ${spec.revision} is advertised more than once`);
+    }
+    const selectedRevision = matches[0];
+    validatePackageRevision(pickedPackage, selectedRevision, registry);
+    const selectedPackage = { ...pickedPackage };
+    for (const field of REVISION_MANIFEST_FIELDS) {
+        delete selectedPackage[field];
+        const value = selectedRevision.manifest[field];
+        if (value !== undefined) {
+            selectedPackage[field] = value;
+        }
+    }
+    selectedPackage.dist = {
+        ...pickedPackage.dist,
+        integrity: selectedRevision.integrity,
+        tarball: selectedRevision.tarball,
+    };
+    if (spec.revision === 0) {
+        delete selectedPackage.dist.revision;
+    }
+    else {
+        selectedPackage.dist.revision = spec.revision;
+    }
+    return selectedPackage;
+}
+function validateCurrentPackageRevision(pickedPackage, registry) {
+    const revision = pickedPackage.dist.revision;
+    if (revision == null)
+        return;
+    if (!isValidTarballRevision(revision)) {
+        throw malformedRevisionHistory(pickedPackage, `current revision ${String(revision)} is not a canonical positive safe integer`);
+    }
+    const revisions = pickedPackage.dist.revisions;
+    if (!Array.isArray(revisions)) {
+        throw malformedRevisionHistory(pickedPackage, 'the current revision has no revision history');
+    }
+    const matches = revisions.filter(entry => entry?.revision === revision);
+    if (matches.length !== 1) {
+        throw malformedRevisionHistory(pickedPackage, `current revision ${revision} does not have exactly one history entry`);
+    }
+    const current = matches[0];
+    validatePackageRevision(pickedPackage, current, registry);
+    if (pickedPackage.dist.integrity !== current.integrity ||
+        normalizeRegistryUrl(pickedPackage.dist.tarball) !== normalizeRegistryUrl(current.tarball)) {
+        throw malformedRevisionHistory(pickedPackage, `revision ${revision} does not match the current artifact`);
+    }
+}
+function validatePackageRevision(pickedPackage, revision, registry) {
+    if (!isRevisionNumber(revision.revision)) {
+        throw malformedRevisionHistory(pickedPackage, `revision ${String(revision.revision)} is not a canonical safe integer`);
+    }
+    if (typeof revision.integrity !== 'string' ||
+        typeof revision.tarball !== 'string' ||
+        !isIntegrityAddressedRegistryTarballUrl(normalizeRegistryUrl(revision.tarball), revision.integrity, registry)) {
+        throw malformedRevisionHistory(pickedPackage, `revision ${revision.revision} is not addressed by its complete sha512 integrity`);
+    }
+    if (revision.manifest == null || typeof revision.manifest !== 'object' || Array.isArray(revision.manifest)) {
+        throw malformedRevisionHistory(pickedPackage, `revision ${revision.revision} has an invalid manifest`);
+    }
+}
+function isRevisionNumber(revision) {
+    return revision === 0 || isValidTarballRevision(revision);
+}
+function malformedRevisionHistory(pickedPackage, reason) {
+    return new PnpmError('MALFORMED_METADATA', `The revision history for ${pickedPackage.name}@${pickedPackage.version} is invalid: ${reason}.`);
+}
 /**
  * Construct the LRU `PackageMetaCache` instance the resolver uses by
  * default. Exported so the install layer can build one cache and hand

package/lib/parseBareSpecifier.d.ts

@@ -2,6 +2,7 @@ export interface RegistryPackageSpec {
     type: 'tag' | 'version' | 'range';
     name: string;
     fetchSpec: string;
+    revision?: number;
     normalizedBareSpecifier?: string;
 }
 export declare function parseBareSpecifier(bareSpecifier: string, alias: string | undefined, defaultTag: string, registry: string): RegistryPackageSpec | null;
@@ -9,7 +10,7 @@ export interface JsrRegistryPackageSpec extends RegistryPackageSpec {
     jsrPkgName: string;
 }
 export declare function parseJsrSpecifierToRegistryPackageSpec(rawSpecifier: string, alias: string | undefined, defaultTag: string): JsrRegistryPackageSpec | null;
-export { BUILTIN_NAMED_REGISTRIES } from '@pnpm/constants';
+export { BUILTIN_REGISTRIES_BY_PREFIX } from '@pnpm/constants';
 export interface NamedRegistryPackageSpec extends RegistryPackageSpec {
     registryName: string;
 }

package/lib/parseBareSpecifier.js

@@ -31,9 +31,8 @@ export function parseBareSpecifier(bareSpecifier, alias, defaultTag, registry) {
         const selector = getVersionSelectorType(bareSpecifier);
         if (selector != null) {
             return {
-                fetchSpec: selector.normalized,
+                ...parseRevisionSelector(selector, bareSpecifier),
                 name,
-                type: selector.type,
             };
         }
     }
@@ -58,13 +57,12 @@ export function parseJsrSpecifierToRegistryPackageSpec(rawSpecifier, alias, defa
     if (selector == null)
         return null;
     return {
-        fetchSpec: selector.normalized,
+        ...parseRevisionSelector(selector, spec.versionSelector ?? defaultTag),
         name: spec.npmPkgName,
-        type: selector.type,
         jsrPkgName: spec.jsrPkgName,
     };
 }
-export { BUILTIN_NAMED_REGISTRIES } from '@pnpm/constants';
+export { BUILTIN_REGISTRIES_BY_PREFIX } from '@pnpm/constants';
 // Parses a named-registry specifier of the shape `<alias>:<body>` into a
 // RegistryPackageSpec. Returns `null` when the specifier does not use one of
 // the configured aliases, so the caller can fall through to other resolvers.
@@ -132,10 +130,36 @@ export function parseNamedRegistrySpecifierToRegistryPackageSpec(rawSpecifier, k
     if (selector == null)
         return null;
     return {
-        fetchSpec: selector.normalized,
+        ...parseRevisionSelector(selector, versionSelector ?? defaultTag),
         name: pkgName,
-        type: selector.type,
         registryName,
     };
 }
+function parseRevisionSelector(selector, rawSelector) {
+    if (selector.type !== 'version') {
+        return { fetchSpec: selector.normalized, type: selector.type };
+    }
+    const normalizedInput = rawSelector.trim();
+    const buildIndex = normalizedInput.indexOf('+');
+    if (buildIndex === -1) {
+        return { fetchSpec: selector.normalized, type: selector.type };
+    }
+    const build = normalizedInput.slice(buildIndex + 1);
+    if (build.length < 2 || build[0] !== 'r' || build.includes('.')) {
+        return { fetchSpec: selector.normalized, type: selector.type };
+    }
+    const digits = build.slice(1);
+    if (![...digits].every((char) => char >= '0' && char <= '9')) {
+        return { fetchSpec: selector.normalized, type: selector.type };
+    }
+    const revision = Number(digits);
+    if ((digits.length > 1 && digits[0] === '0') || !Number.isSafeInteger(revision)) {
+        throw new PnpmError('INVALID_REVISION_SPEC', `Invalid registry revision in version specifier "${rawSelector}"`);
+    }
+    return {
+        fetchSpec: selector.normalized,
+        revision,
+        type: selector.type,
+    };
+}
 //# sourceMappingURL=parseBareSpecifier.js.map

package/lib/pickPackage.d.ts

@@ -1,4 +1,5 @@
 import type { PackageInRegistry, PackageMeta } from '@pnpm/resolving.registry.types';
+import type { TrustPolicy } from '@pnpm/types';
 import { type FetchMetadataNotModifiedResult, type FetchMetadataResult } from './fetch.js';
 import type { RegistryPackageSpec } from './parseBareSpecifier.js';
 import { type PickPackageFromMetaOptions } from './pickPackageFromMeta.js';
@@ -22,6 +23,7 @@ export interface PickPackageOptions extends PickPackageFromMetaOptions {
     dryRun: boolean;
     includeLatestTag?: boolean;
     optional?: boolean;
+    trustPolicy?: TrustPolicy;
     /**
      * When true, force a conditional registry request so a stale on-disk
      * packument can't satisfy the call: the on-disk exact-version fast
@@ -44,12 +46,23 @@ export declare function pickPackage(ctx: {
         modified?: string;
     }) => Promise<FetchMetadataResult | FetchMetadataNotModifiedResult>;
     fullMetadata?: boolean;
+    /**
+     * Whether a time-based resolution has to read the full metadata of
+     * `registry`, because that registry's abbreviated form carries no `time`.
+     * Asked per registry: the answer differs between the public registry and a
+     * proxy that does carry it, and the mirror path and cache key below are
+     * already keyed by registry, so two registries may disagree within one
+     * install.
+     */
+    needsFullMetadataFor?: (registry: string) => boolean;
     metaCache: PackageMetaCache;
     cacheDir: string;
     offline?: boolean;
     preferOffline?: boolean;
     filterMetadata?: boolean;
     ignoreMissingTimeField?: boolean;
+    /** Packuments whose release-age upgrade fetch already answered 304 in this resolver. */
+    releaseAgeUpgradeCheckedPackuments?: WeakSet<PackageMeta>;
 }, spec: RegistryPackageSpec, opts: PickPackageOptions): Promise<{
     meta: PackageMeta;
     pickedPackage: PackageInRegistry | null;
@@ -91,7 +104,13 @@ export declare function getPkgMirrorPath(cacheDir: string, metaDir: string, regi
  * there), so a `meta` that carries one is serialized without it.
  */
 export declare function prepareJsonForDisk(meta: PackageMeta, etag: string | undefined, jsonText?: string): string;
-export declare function warnMissingTimeFieldOnce(pkgName: string): void;
+/**
+ * At most one warning per package per check. `minimumReleaseAge` and
+ * `trustPolicy` both go dark on the same missing field, so keying by package
+ * alone would let whichever check ran first silence the other and leave the
+ * user told about only one of the two skips.
+ */
+export declare function warnMissingTimeFieldOnce(pkgName: string, skippedCheck: 'minimumReleaseAge' | 'trustPolicy'): void;
 interface MetaHeaders {
     etag?: string;
     modified?: string;