@pnpm/resolving.npm-resolver 1104.0.0 → 1104.1.0

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @pnpm/npm-resolver
 
+## 1104.1.0
+
+### Minor Changes
+
+- Added explicit registry revision selection with `<version>+rN` and `pnpm update --patches` for refreshing revision artifacts without changing package versions. Registry-backed lockfile policy checks recognize historical revisions, and pnpr now preserves safe revision histories from upstream registries.
+
+- Added support for registry replacement tarballs using standard integrity values, explicit revision fields, registry routing from the `registries` setting, non-redirecting integrity-addressed URLs, canonical safe-integer revision numbers, and pnpr proxying for immutable upstream revision artifacts.
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/config.normalize-registries@1101.0.1
+  - @pnpm/config.pick-registry-for-package@1101.0.1
+  - @pnpm/config.version-policy@1100.2.2
+  - @pnpm/core-loggers@1100.3.4
+  - @pnpm/crypto.hash@1100.0.3
+  - @pnpm/deps.path@1101.0.1
+  - @pnpm/fs.graceful-fs@1100.2.0
+  - @pnpm/pkg-manifest.utils@1100.4.2
+  - @pnpm/resolving.registry.pkg-metadata-filter@1100.0.18
+  - @pnpm/resolving.registry.types@1100.2.0
+  - @pnpm/resolving.resolver-base@1101.2.0
+  - @pnpm/resolving.tarball-url@1101.1.0
+  - @pnpm/store.cafs@1100.3.0
+  - @pnpm/store.index@1100.3.0
+  - @pnpm/types@1102.1.0
+
 ## 1104.0.0
 
 ### Major Changes

package/lib/createNpmResolutionVerifier.js

@@ -5,13 +5,14 @@ import { createPackageVersionPolicy } from '@pnpm/config.version-policy';
 import { FULL_META_DIR } from '@pnpm/constants';
 import { PnpmError } from '@pnpm/error';
 import { isGitHostedTarballUrl, } from '@pnpm/resolving.resolver-base';
+import { isIntegrityAddressedRegistryTarballUrl, isValidTarballRevision, } from '@pnpm/resolving.tarball-url';
 import semver from 'semver';
 import { fetchAttestationPublishedAt } from './fetchAttestationPublishedAt.js';
 import { fetchAbbreviatedMetadataCached, fetchFullMetadataCached, } from './fetchFullMetadataCached.js';
 import { normalizeRegistryUrl } from './normalizeRegistryUrl.js';
 import { getPkgMetaCacheKey, getPkgMirrorPath, loadMeta, warnMissingTimeFieldOnce } from './pickPackage.js';
 import { failIfTrustDowngraded } from './trustChecks.js';
-import { MINIMUM_RELEASE_AGE_VIOLATION_CODE, MISSING_NAMED_REGISTRY_VIOLATION_CODE, MISSING_TARBALL_INTEGRITY_VIOLATION_CODE, TARBALL_URL_MISMATCH_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
+import { MINIMUM_RELEASE_AGE_VIOLATION_CODE, MISSING_NAMED_REGISTRY_VIOLATION_CODE, MISSING_TARBALL_INTEGRITY_VIOLATION_CODE, TARBALL_REVISION_MISMATCH_VIOLATION_CODE, TARBALL_URL_MISMATCH_VIOLATION_CODE, TRUST_DOWNGRADE_VIOLATION_CODE, } from './violationCodes.js';
 /**
  * Returns a `ResolutionVerifier` for npm-registry-resolved lockfile
  * entries. It always binds each entry's recorded tarball URL to the
@@ -113,7 +114,7 @@ export function createNpmResolutionVerifier(opts) {
                 return {
                     ok: false,
                     code: MISSING_NAMED_REGISTRY_VIOLATION_CODE,
-                    reason: `was resolved from the named registry '${registryName}:', which is not present in the registriesByPrefix setting`,
+                    reason: `has registry prefix '${registryName}:', which is not declared by the registries setting`,
                 };
             }
             registry = namedRegistry;
@@ -129,13 +130,14 @@ export function createNpmResolutionVerifier(opts) {
         // narrowed by their exclude lists, since it guards integrity rather
         // than maturity/trust. Registry entries with no tarball URL reconstruct
         // it from name+version+registry, so they're inherently bound.
-        if (typeof tarballUrl === 'string') {
-            const urlViolation = await runTarballUrlCheck(lookupContext, registry, name, version, tarballUrl);
-            if (urlViolation)
-                return urlViolation;
-        }
+        const rawRevision = resolution.revision;
         const ageApplies = ageCheckActive && !isExcluded(excludePolicy, name, version);
         const trustApplies = trustCheckActive && !isExcluded(trustExcludePolicy, name, version);
+        if (tarballUrl != null || (rawRevision != null && (ageApplies || trustApplies))) {
+            const artifactViolation = await runRegistryArtifactCheck(lookupContext, registry, name, version, integrity, rawRevision, tarballUrl);
+            if (artifactViolation)
+                return artifactViolation;
+        }
         if (!ageApplies && !trustApplies)
             return { ok: true };
         if (ageApplies) {
@@ -178,6 +180,7 @@ export function createNpmResolutionVerifier(opts) {
             // applies the binding — otherwise an upgrade could keep trusting a
             // lockfile that was only ever age/trust-checked.
             tarballUrlBinding: true,
+            revisionHistoryBinding: true,
             // Same cache identity rule for the missing-integrity structural check.
             integrityRequired: true,
             namedRegistriesRouting,
@@ -193,6 +196,8 @@ export function createNpmResolutionVerifier(opts) {
             // didn't record it can't be trusted to have enforced it.
             if (cached.tarballUrlBinding !== true)
                 return false;
+            if (cached.revisionHistoryBinding !== true)
+                return false;
             // The missing-integrity check is also unconditional; older cache records
             // without the flag cannot prove they rejected unverifiable tarballs.
             if (cached.integrityRequired !== true)
@@ -309,7 +314,7 @@ async function runAgeCheck(context, registry, name, version, cutoff, ignoreMissi
  * a tampered lockfile could smuggle a malicious URL past the check by
  * pointing it at a `name@version` the registry can't vouch for.
  */
-async function runTarballUrlCheck(context, registry, name, version, lockfileTarball) {
+async function runRegistryArtifactCheck(context, registry, name, version, lockfileIntegrity, rawRevision, lockfileTarball) {
     const { meta, error } = await fetchAbbreviatedMeta(context, registry, name);
     if (error != null) {
         // Couldn't reach the registry to verify (auth/network/5xx). Propagate the
@@ -319,17 +324,107 @@ async function runTarballUrlCheck(context, registry, name, version, lockfileTarb
         // error — still fail-closed, the entry never reaches the filesystem.
         throw error;
     }
-    const registryTarball = meta?.versionTarballs?.get(version);
-    if (registryTarball != null && sameTarballUrl(lockfileTarball, registryTarball)) {
-        return undefined;
+    const artifact = meta?.versionArtifacts?.get(version);
+    if (artifact == null) {
+        if (lockfileTarball == null && rawRevision == null)
+            return undefined;
+        return {
+            ok: false,
+            code: lockfileTarball == null
+                ? TARBALL_REVISION_MISMATCH_VIOLATION_CODE
+                : TARBALL_URL_MISMATCH_VIOLATION_CODE,
+            reason: "could not be verified against the registry's published metadata",
+        };
     }
-    return {
-        ok: false,
-        code: TARBALL_URL_MISMATCH_VIOLATION_CODE,
-        reason: registryTarball == null
-            ? "could not be verified against the registry's published metadata"
-            : `has a tarball URL (${lockfileTarball}) that does not match the registry's published metadata (${registryTarball})`,
-    };
+    const metadataRevision = artifact.current.revision;
+    const revisionAware = rawRevision != null || metadataRevision !== undefined || artifact.revisions.length > 0;
+    if (!revisionAware) {
+        if (lockfileTarball == null)
+            return undefined;
+        if (typeof artifact.current.tarball === 'string' && sameTarballUrl(lockfileTarball, artifact.current.tarball)) {
+            return undefined;
+        }
+        return {
+            ok: false,
+            code: TARBALL_URL_MISMATCH_VIOLATION_CODE,
+            reason: typeof artifact.current.tarball !== 'string'
+                ? "could not be verified against the registry's published metadata"
+                : `has a tarball URL (${lockfileTarball}) that does not match the registry's published metadata (${artifact.current.tarball})`,
+        };
+    }
+    if (rawRevision != null && !isValidTarballRevision(rawRevision)) {
+        return {
+            ok: false,
+            code: TARBALL_REVISION_MISMATCH_VIOLATION_CODE,
+            reason: `has an invalid revision (${String(rawRevision)})`,
+        };
+    }
+    let currentRevision = 0;
+    if (metadataRevision !== undefined) {
+        if (!isValidTarballRevision(metadataRevision)) {
+            return {
+                ok: false,
+                code: TARBALL_REVISION_MISMATCH_VIOLATION_CODE,
+                reason: `registry metadata has an invalid current revision (${String(metadataRevision)})`,
+            };
+        }
+        currentRevision = metadataRevision;
+        const currentHistory = artifact.revisions.filter(candidate => candidate.revision === currentRevision);
+        if (currentHistory.length !== 1 ||
+            currentHistory[0].integrity !== artifact.current.integrity ||
+            typeof currentHistory[0].tarball !== 'string' ||
+            typeof artifact.current.tarball !== 'string' ||
+            typeof artifact.current.integrity !== 'string' ||
+            !isIntegrityAddressedRegistryTarballUrl(normalizeRegistryUrl(artifact.current.tarball), artifact.current.integrity, registry) ||
+            !sameTarballUrl(currentHistory[0].tarball, artifact.current.tarball)) {
+            return {
+                ok: false,
+                code: TARBALL_REVISION_MISMATCH_VIOLATION_CODE,
+                reason: `registry metadata revision ${currentRevision} does not have exactly one matching history entry`,
+            };
+        }
+    }
+    const revision = typeof rawRevision === 'number' ? rawRevision : 0;
+    const currentMatches = currentRevision === revision;
+    const historicalCandidates = artifact.revisions.filter(candidate => candidate.revision === revision);
+    if (historicalCandidates.length > 1) {
+        return {
+            ok: false,
+            code: TARBALL_REVISION_MISMATCH_VIOLATION_CODE,
+            reason: `revision ${revision} is advertised more than once in the registry's history`,
+        };
+    }
+    const historical = historicalCandidates[0];
+    const selected = currentMatches ? artifact.current : historical;
+    if (selected == null ||
+        selected.integrity !== lockfileIntegrity ||
+        (currentMatches && historical != null && historical.integrity !== lockfileIntegrity)) {
+        return {
+            ok: false,
+            code: TARBALL_REVISION_MISMATCH_VIOLATION_CODE,
+            reason: `has revision ${revision} with an integrity that does not match the registry's current or historical metadata`,
+        };
+    }
+    if (revision > 0 || !currentMatches) {
+        if (typeof selected.tarball !== 'string' ||
+            !isIntegrityAddressedRegistryTarballUrl(normalizeRegistryUrl(selected.tarball), lockfileIntegrity, registry)) {
+            return {
+                ok: false,
+                code: TARBALL_REVISION_MISMATCH_VIOLATION_CODE,
+                reason: `has revision ${revision} that is not addressed by its complete sha512 integrity`,
+            };
+        }
+    }
+    if (lockfileTarball != null && (typeof selected.tarball !== 'string' || !sameTarballUrl(lockfileTarball, selected.tarball))) {
+        return {
+            ok: false,
+            code: TARBALL_URL_MISMATCH_VIOLATION_CODE,
+            reason: typeof selected.tarball !== 'string'
+                ? "could not be verified against the registry's published metadata"
+                : `has a tarball URL (${lockfileTarball}) that does not match the registry's published metadata (${selected.tarball})`,
+        };
+    }
+    return undefined;
 }
 function sameTarballUrl(a, b) {
     return canonicalTarballUrl(a) === canonicalTarballUrl(b);
@@ -549,7 +644,7 @@ async function tryAbbreviatedModifiedShortcut(context, registry, name, version)
     // publish time — but only for versions the registry currently lists.
     // An unpublished or never-published pin would otherwise pass the gate
     // on a stale package-level timestamp.
-    if (!meta?.versionTarballs?.has(version))
+    if (!meta?.versionArtifacts?.has(version))
         return undefined;
     return modified;
 }
@@ -633,16 +728,29 @@ function validateSharedMeta(meta, name) {
 // lockfile (see #11860). The full document is GC-able as soon as this
 // closure returns; only the short tarball-URL strings are retained.
 function projectAbbreviatedMeta(meta) {
-    let versionTarballs;
+    let versionArtifacts;
     if (meta.versions) {
-        versionTarballs = new Map();
+        versionArtifacts = new Map();
         for (const [version, manifest] of Object.entries(meta.versions)) {
-            versionTarballs.set(version, manifest.dist?.tarball);
+            versionArtifacts.set(version, {
+                current: {
+                    revision: manifest.dist?.revision,
+                    integrity: manifest.dist?.integrity,
+                    tarball: manifest.dist?.tarball,
+                },
+                revisions: Array.isArray(manifest.dist?.revisions)
+                    ? manifest.dist.revisions.map(revision => ({
+                        revision: revision.revision,
+                        integrity: revision.integrity,
+                        tarball: revision.tarball,
+                    }))
+                    : [],
+            });
         }
     }
     return {
         modified: meta.modified,
-        versionTarballs,
+        versionArtifacts,
     };
 }
 function readLocalMetaTime(context, registry, name) {

package/lib/index.d.ts

@@ -123,6 +123,7 @@ export type ResolveFromNpmOptions = {
     preferredVersions?: PreferredVersions;
     preferWorkspacePackages?: boolean;
     update?: false | 'compatible' | 'latest';
+    updatePatches?: boolean;
     updateRequested?: boolean;
     updateChecksums?: boolean;
     injectWorkspacePackages?: boolean;

package/lib/index.js

@@ -1,10 +1,11 @@
 import path from 'node:path';
 import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
 import { isWellFormedRegistryName, RESERVED_VERSION_PREFIXES } from '@pnpm/deps.path';
-import { PnpmError } from '@pnpm/error';
+import { PnpmError, redactUrlForDisplay } from '@pnpm/error';
 import { globalWarn } from '@pnpm/logger';
 import { calcVersionRange, inferRangeSpecStyle, rangeSpecGranularity, versionWithRangeSpecStyle } from '@pnpm/pkg-manifest.utils';
 import { EXISTING_VERSION_SELECTOR_WEIGHT, } from '@pnpm/resolving.resolver-base';
+import { isIntegrityAddressedRegistryTarballUrl, isValidTarballRevision, } from '@pnpm/resolving.tarball-url';
 import { storeIndexKey } from '@pnpm/store.index';
 import { readPkgFromCafs, } from '@pnpm/worker';
 import { resolveWorkspaceRange } from '@pnpm/workspace.range-resolver';
@@ -332,12 +333,15 @@ async function resolveNpm(ctx, wantedDependency, opts) {
             return resolvedFromWorkspace;
         }
     }
-    const workspacePackages = opts.alwaysTryWorkspacePackages !== false ? opts.workspacePackages : undefined;
+    const canKeepWorkspaceResolution = opts.currentPkg == null || opts.currentPkg.resolution.type === 'directory';
     const spec = wantedDependency.bareSpecifier
         ? parseBareSpecifier(wantedDependency.bareSpecifier, wantedDependency.alias, defaultTag, registry)
         : defaultTagForAlias(wantedDependency.alias, defaultTag);
     if (spec == null)
         return null;
+    const workspacePackages = spec.revision == null && (!opts.updatePatches || canKeepWorkspaceResolution) && opts.alwaysTryWorkspacePackages !== false
+        ? opts.workspacePackages
+        : undefined;
     // Fast path: if we have a current resolution with integrity, try to peek the manifest from the store.
     // This avoids the expensive metadata fetch from the registry.
     // We do this AFTER ensuring the spec is valid for this resolver to avoids hijacking other resolvers.
@@ -347,10 +351,12 @@ async function resolveNpm(ctx, wantedDependency, opts) {
     if (ctx.peekManifestFromStore &&
         opts.currentPkg?.resolution &&
         !opts.update &&
+        !opts.updatePatches &&
+        spec.revision == null &&
         (opts.publishedBy == null || opts.currentPkg.publishedAt != null)) {
         const currentResolution = opts.currentPkg.resolution;
         // Only use this optimization for tarball resolutions with integrity (npm packages)
-        if ('tarball' in currentResolution && currentResolution.integrity) {
+        if ('tarball' in currentResolution && typeof currentResolution.integrity === 'string') {
             const manifest = await ctx.peekManifestFromStore({
                 id: opts.currentPkg.id,
                 integrity: currentResolution.integrity,
@@ -398,7 +404,7 @@ async function resolveNpm(ctx, wantedDependency, opts) {
         !opts.updateChecksums &&
         opts.injectWorkspacePackages !== true &&
         !wantedDependency.injected) {
-        const workspacePkgsMatchingName = workspacePackages.get(spec.name);
+        const workspacePkgsMatchingName = spec.revision == null ? workspacePackages.get(spec.name) : undefined;
         if (workspacePkgsMatchingName?.size === 1) {
             const localVersion = pickMatchingLocalVersionOrNull(workspacePkgsMatchingName, spec);
             if (localVersion != null) {
@@ -426,7 +432,7 @@ async function resolveNpm(ctx, wantedDependency, opts) {
             preferredVersionSelectors: preferredVersionSelectorsFor(opts, spec.name),
             registry,
             includeLatestTag: opts.update === 'latest',
-            updateChecksums: opts.updateChecksums,
+            updateChecksums: opts.updateChecksums || opts.updatePatches,
             optional: wantedDependency.optional,
             trustPolicy: opts.trustPolicy,
         });
@@ -491,7 +497,7 @@ async function resolveNpm(ctx, wantedDependency, opts) {
         });
     }
     const latest = latestAllowedByPolicy(meta, opts);
-    const workspacePkgsMatchingName = workspacePackages?.get(pickedPackage.name);
+    const workspacePkgsMatchingName = spec.revision == null ? workspacePackages?.get(pickedPackage.name) : undefined;
     if (workspacePkgsMatchingName && opts.projectDir) {
         const matchedPkg = workspacePkgsMatchingName.get(pickedPackage.version);
         if (matchedPkg) {
@@ -525,11 +531,9 @@ async function resolveNpm(ctx, wantedDependency, opts) {
         }
     }
     warnOnceOnHeldBackUpdate(ctx, opts, spec, meta, pickedPackage.version);
+    const selectedPackage = selectPackageRevision(pickedPackage, spec, registry);
     const id = `${pickedPackage.name}@${pickedPackage.version}`;
-    const resolution = {
-        integrity: getIntegrity(pickedPackage.dist),
-        tarball: normalizeRegistryUrl(pickedPackage.dist.tarball),
-    };
+    const resolution = createRegistryTarballResolution(selectedPackage.dist, registry);
     let normalizedBareSpecifier;
     if (opts.calcSpecifier) {
         normalizedBareSpecifier = spec.normalizedBareSpecifier ?? calcSpecifier({
@@ -543,7 +547,7 @@ async function resolveNpm(ctx, wantedDependency, opts) {
     return {
         id,
         latest,
-        manifest: pickedPackage,
+        manifest: selectedPackage,
         resolution,
         resolvedVia: 'npm-registry',
         publishedAt,
@@ -568,7 +572,14 @@ async function resolveJsr(ctx, wantedDependency, opts) {
     return {
         ...picked,
         normalizedBareSpecifier: opts.calcSpecifier
-            ? calcPrefixedSpecifier('jsr:', spec.jsrPkgName, wantedDependency, picked.manifest.version, opts.rangeSpecStyle)
+            ? calcPrefixedSpecifier({
+                prefix: 'jsr:',
+                pkgName: spec.jsrPkgName,
+                wantedDependency,
+                version: picked.manifest.version,
+                revision: spec.revision,
+                defaultRangeSpecStyle: opts.rangeSpecStyle,
+            })
             : undefined,
         resolvedVia: 'jsr-registry',
         alias: spec.jsrPkgName,
@@ -590,7 +601,7 @@ function mergeNamedRegistries(userDefined) {
         if (RESERVED_VERSION_PREFIXES.has(alias) || !isWellFormedRegistryName(alias)) {
             throw new PnpmError('RESERVED_NAMED_REGISTRY_NAME', RESERVED_VERSION_PREFIXES.has(alias)
                 ? `'${alias}' cannot be used as a named registry alias: it is a reserved dependency specifier prefix.`
-                : `'${alias}' cannot be used as a named registry alias: aliases must start with a letter and contain only letters, digits, ".", "_", and "-".`, { hint: 'Rename the entry in the registriesByPrefix setting.' });
+                : `'${alias}' cannot be used as a named registry alias: aliases must start with a letter and contain only letters, digits, ".", "_", and "-".`, { hint: 'Change the prefix on the corresponding registries entry.' });
         }
         if (typeof url !== 'string' || !isValidHttpUrl(url)) {
             throw new PnpmError('INVALID_NAMED_REGISTRY_URL', `The named registry alias '${alias}' is mapped to '${String(url)}', which is not a valid http(s) URL.`, { hint: 'Provide a URL that starts with http:// or https://, e.g. https://npm.pkg.example.com/' });
@@ -633,7 +644,14 @@ async function resolveFromNamedRegistry(ctx, wantedDependency, opts) {
         // decides the tarball both consumers get.
         id: `${picked.manifest.name}@${spec.registryName}:${picked.manifest.version}`,
         normalizedBareSpecifier: opts.calcSpecifier
-            ? calcPrefixedSpecifier(`${spec.registryName}:`, spec.name, wantedDependency, picked.manifest.version, opts.rangeSpecStyle)
+            ? calcPrefixedSpecifier({
+                prefix: `${spec.registryName}:`,
+                pkgName: spec.name,
+                wantedDependency,
+                version: picked.manifest.version,
+                revision: spec.revision,
+                defaultRangeSpecStyle: opts.rangeSpecStyle,
+            })
             : undefined,
         resolvedVia: 'named-registry',
         registryName: spec.registryName,
@@ -657,7 +675,7 @@ async function pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, registr
         preferredVersionSelectors: preferredVersionSelectorsFor(opts, spec.name),
         registry,
         includeLatestTag: opts.update === 'latest',
-        updateChecksums: opts.updateChecksums,
+        updateChecksums: opts.updateChecksums || opts.updatePatches,
         optional: wantedDependency.optional,
         trustPolicy: opts.trustPolicy,
     });
@@ -665,15 +683,13 @@ async function pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, registr
         throw new NoMatchingVersionError({ wantedDependency, packageMeta: meta, registry });
     }
     warnOnceOnHeldBackUpdate(ctx, opts, spec, meta, pickedPackage.version);
-    const resolution = {
-        integrity: getIntegrity(pickedPackage.dist),
-        tarball: normalizeRegistryUrl(pickedPackage.dist.tarball),
-    };
+    const selectedPackage = selectPackageRevision(pickedPackage, spec, registry);
+    const resolution = createRegistryTarballResolution(selectedPackage.dist, registry);
     const publishedAt = meta.time?.[pickedPackage.version];
     return {
         id: `${pickedPackage.name}@${pickedPackage.version}`,
         latest: latestAllowedByPolicy(meta, opts),
-        manifest: pickedPackage,
+        manifest: selectedPackage,
         resolution,
         publishedAt,
         policyViolation: detectMinReleaseAgeViolation({
@@ -690,13 +706,25 @@ async function pickFromSimpleRegistry(ctx, wantedDependency, opts, spec, registr
 // when the dependency alias matches the package name). Shared between the
 // jsr and named-registry resolvers since they only differ in `prefix` and
 // which spec field holds the package name.
-function calcPrefixedSpecifier(prefix, pkgName, wantedDependency, version, defaultRangeSpecStyle) {
-    const range = calcRange(version, wantedDependency, defaultRangeSpecStyle);
-    if (!wantedDependency.alias || pkgName === wantedDependency.alias)
-        return `${prefix}${range}`;
-    return `${prefix}${pkgName}@${range}`;
+function calcPrefixedSpecifier(opts) {
+    if (opts.revision != null) {
+        const target = `${opts.version}+r${opts.revision}`;
+        if (!opts.wantedDependency.alias || opts.pkgName === opts.wantedDependency.alias)
+            return `${opts.prefix}${target}`;
+        return `${opts.prefix}${opts.pkgName}@${target}`;
+    }
+    const range = calcRange(opts.version, opts.wantedDependency, opts.defaultRangeSpecStyle);
+    if (!opts.wantedDependency.alias || opts.pkgName === opts.wantedDependency.alias)
+        return `${opts.prefix}${range}`;
+    return `${opts.prefix}${opts.pkgName}@${range}`;
 }
 function calcSpecifier({ wantedDependency, spec, version, defaultRangeSpecStyle, }) {
+    if (spec.revision != null) {
+        const target = `${version}+r${spec.revision}`;
+        if (!wantedDependency.alias || spec.name === wantedDependency.alias)
+            return target;
+        return `npm:${spec.name}@${target}`;
+    }
     if (wantedDependency.prevSpecifier === wantedDependency.bareSpecifier && wantedDependency.prevSpecifier && versionSelectorType(wantedDependency.prevSpecifier)?.type === 'tag') {
         return wantedDependency.prevSpecifier;
     }
@@ -916,6 +944,123 @@ function getIntegrity(dist) {
     }
     return integrity.toString();
 }
+function createRegistryTarballResolution(dist, registry) {
+    const integrity = getIntegrity(dist);
+    const tarball = normalizeRegistryUrl(dist.tarball);
+    if (dist.revision == null) {
+        return { integrity, tarball };
+    }
+    if (!isValidTarballRevision(dist.revision)) {
+        throw new PnpmError('MALFORMED_METADATA', `Tarball "${redactUrlForDisplay(dist.tarball)}" has an invalid revision in its metadata: ${String(dist.revision)}`);
+    }
+    if (integrity == null ||
+        !isIntegrityAddressedRegistryTarballUrl(tarball, integrity, registry)) {
+        throw new PnpmError('MALFORMED_METADATA', `Tarball "${redactUrlForDisplay(dist.tarball)}" has revision ${dist.revision} but is not addressed by its complete integrity.`);
+    }
+    return {
+        integrity,
+        revision: dist.revision,
+        tarball,
+    };
+}
+const REVISION_MANIFEST_FIELDS = [
+    'bin',
+    'bundleDependencies',
+    'bundledDependencies',
+    'cpu',
+    'dependencies',
+    'engines',
+    'hasInstallScript',
+    'libc',
+    'optionalDependencies',
+    'os',
+    'peerDependencies',
+    'peerDependenciesMeta',
+];
+function selectPackageRevision(pickedPackage, spec, registry) {
+    validateCurrentPackageRevision(pickedPackage, registry);
+    if (spec.revision == null)
+        return pickedPackage;
+    const revisions = pickedPackage.dist.revisions;
+    if (revisions == null) {
+        if (spec.revision === 0 && pickedPackage.dist.revision == null)
+            return pickedPackage;
+        throw new PnpmError('NO_MATCHING_REVISION', `No revision ${spec.revision} is advertised for ${pickedPackage.name}@${pickedPackage.version}`);
+    }
+    if (!Array.isArray(revisions)) {
+        throw malformedRevisionHistory(pickedPackage, 'the revisions field is not an array');
+    }
+    const matches = revisions.filter((entry) => isRevisionNumber(entry?.revision) && entry.revision === spec.revision);
+    if (matches.length === 0) {
+        throw new PnpmError('NO_MATCHING_REVISION', `No revision ${spec.revision} is advertised for ${pickedPackage.name}@${pickedPackage.version}`);
+    }
+    if (matches.length !== 1) {
+        throw malformedRevisionHistory(pickedPackage, `revision ${spec.revision} is advertised more than once`);
+    }
+    const selectedRevision = matches[0];
+    validatePackageRevision(pickedPackage, selectedRevision, registry);
+    const selectedPackage = { ...pickedPackage };
+    for (const field of REVISION_MANIFEST_FIELDS) {
+        delete selectedPackage[field];
+        const value = selectedRevision.manifest[field];
+        if (value !== undefined) {
+            selectedPackage[field] = value;
+        }
+    }
+    selectedPackage.dist = {
+        ...pickedPackage.dist,
+        integrity: selectedRevision.integrity,
+        tarball: selectedRevision.tarball,
+    };
+    if (spec.revision === 0) {
+        delete selectedPackage.dist.revision;
+    }
+    else {
+        selectedPackage.dist.revision = spec.revision;
+    }
+    return selectedPackage;
+}
+function validateCurrentPackageRevision(pickedPackage, registry) {
+    const revision = pickedPackage.dist.revision;
+    if (revision == null)
+        return;
+    if (!isValidTarballRevision(revision)) {
+        throw malformedRevisionHistory(pickedPackage, `current revision ${String(revision)} is not a canonical positive safe integer`);
+    }
+    const revisions = pickedPackage.dist.revisions;
+    if (!Array.isArray(revisions)) {
+        throw malformedRevisionHistory(pickedPackage, 'the current revision has no revision history');
+    }
+    const matches = revisions.filter(entry => entry?.revision === revision);
+    if (matches.length !== 1) {
+        throw malformedRevisionHistory(pickedPackage, `current revision ${revision} does not have exactly one history entry`);
+    }
+    const current = matches[0];
+    validatePackageRevision(pickedPackage, current, registry);
+    if (pickedPackage.dist.integrity !== current.integrity ||
+        normalizeRegistryUrl(pickedPackage.dist.tarball) !== normalizeRegistryUrl(current.tarball)) {
+        throw malformedRevisionHistory(pickedPackage, `revision ${revision} does not match the current artifact`);
+    }
+}
+function validatePackageRevision(pickedPackage, revision, registry) {
+    if (!isRevisionNumber(revision.revision)) {
+        throw malformedRevisionHistory(pickedPackage, `revision ${String(revision.revision)} is not a canonical safe integer`);
+    }
+    if (typeof revision.integrity !== 'string' ||
+        typeof revision.tarball !== 'string' ||
+        !isIntegrityAddressedRegistryTarballUrl(normalizeRegistryUrl(revision.tarball), revision.integrity, registry)) {
+        throw malformedRevisionHistory(pickedPackage, `revision ${revision.revision} is not addressed by its complete sha512 integrity`);
+    }
+    if (revision.manifest == null || typeof revision.manifest !== 'object' || Array.isArray(revision.manifest)) {
+        throw malformedRevisionHistory(pickedPackage, `revision ${revision.revision} has an invalid manifest`);
+    }
+}
+function isRevisionNumber(revision) {
+    return revision === 0 || isValidTarballRevision(revision);
+}
+function malformedRevisionHistory(pickedPackage, reason) {
+    return new PnpmError('MALFORMED_METADATA', `The revision history for ${pickedPackage.name}@${pickedPackage.version} is invalid: ${reason}.`);
+}
 /**
  * Construct the LRU `PackageMetaCache` instance the resolver uses by
  * default. Exported so the install layer can build one cache and hand

package/lib/parseBareSpecifier.d.ts

@@ -2,6 +2,7 @@ export interface RegistryPackageSpec {
     type: 'tag' | 'version' | 'range';
     name: string;
     fetchSpec: string;
+    revision?: number;
     normalizedBareSpecifier?: string;
 }
 export declare function parseBareSpecifier(bareSpecifier: string, alias: string | undefined, defaultTag: string, registry: string): RegistryPackageSpec | null;

package/lib/parseBareSpecifier.js

@@ -31,9 +31,8 @@ export function parseBareSpecifier(bareSpecifier, alias, defaultTag, registry) {
         const selector = getVersionSelectorType(bareSpecifier);
         if (selector != null) {
             return {
-                fetchSpec: selector.normalized,
+                ...parseRevisionSelector(selector, bareSpecifier),
                 name,
-                type: selector.type,
             };
         }
     }
@@ -58,9 +57,8 @@ export function parseJsrSpecifierToRegistryPackageSpec(rawSpecifier, alias, defa
     if (selector == null)
         return null;
     return {
-        fetchSpec: selector.normalized,
+        ...parseRevisionSelector(selector, spec.versionSelector ?? defaultTag),
         name: spec.npmPkgName,
-        type: selector.type,
         jsrPkgName: spec.jsrPkgName,
     };
 }
@@ -132,10 +130,36 @@ export function parseNamedRegistrySpecifierToRegistryPackageSpec(rawSpecifier, k
     if (selector == null)
         return null;
     return {
-        fetchSpec: selector.normalized,
+        ...parseRevisionSelector(selector, versionSelector ?? defaultTag),
         name: pkgName,
-        type: selector.type,
         registryName,
     };
 }
+function parseRevisionSelector(selector, rawSelector) {
+    if (selector.type !== 'version') {
+        return { fetchSpec: selector.normalized, type: selector.type };
+    }
+    const normalizedInput = rawSelector.trim();
+    const buildIndex = normalizedInput.indexOf('+');
+    if (buildIndex === -1) {
+        return { fetchSpec: selector.normalized, type: selector.type };
+    }
+    const build = normalizedInput.slice(buildIndex + 1);
+    if (build.length < 2 || build[0] !== 'r' || build.includes('.')) {
+        return { fetchSpec: selector.normalized, type: selector.type };
+    }
+    const digits = build.slice(1);
+    if (![...digits].every((char) => char >= '0' && char <= '9')) {
+        return { fetchSpec: selector.normalized, type: selector.type };
+    }
+    const revision = Number(digits);
+    if ((digits.length > 1 && digits[0] === '0') || !Number.isSafeInteger(revision)) {
+        throw new PnpmError('INVALID_REVISION_SPEC', `Invalid registry revision in version specifier "${rawSelector}"`);
+    }
+    return {
+        fetchSpec: selector.normalized,
+        revision,
+        type: selector.type,
+    };
+}
 //# sourceMappingURL=parseBareSpecifier.js.map

package/lib/violationCodes.d.ts

@@ -11,5 +11,6 @@
 export declare const MINIMUM_RELEASE_AGE_VIOLATION_CODE = "MINIMUM_RELEASE_AGE_VIOLATION";
 export declare const TRUST_DOWNGRADE_VIOLATION_CODE = "TRUST_DOWNGRADE";
 export declare const TARBALL_URL_MISMATCH_VIOLATION_CODE = "TARBALL_URL_MISMATCH";
+export declare const TARBALL_REVISION_MISMATCH_VIOLATION_CODE = "TARBALL_REVISION_MISMATCH";
 export declare const MISSING_TARBALL_INTEGRITY_VIOLATION_CODE = "MISSING_TARBALL_INTEGRITY";
 export declare const MISSING_NAMED_REGISTRY_VIOLATION_CODE = "MISSING_NAMED_REGISTRY";

package/lib/violationCodes.js

@@ -11,6 +11,7 @@
 export const MINIMUM_RELEASE_AGE_VIOLATION_CODE = 'MINIMUM_RELEASE_AGE_VIOLATION';
 export const TRUST_DOWNGRADE_VIOLATION_CODE = 'TRUST_DOWNGRADE';
 export const TARBALL_URL_MISMATCH_VIOLATION_CODE = 'TARBALL_URL_MISMATCH';
+export const TARBALL_REVISION_MISMATCH_VIOLATION_CODE = 'TARBALL_REVISION_MISMATCH';
 export const MISSING_TARBALL_INTEGRITY_VIOLATION_CODE = 'MISSING_TARBALL_INTEGRITY';
 export const MISSING_NAMED_REGISTRY_VIOLATION_CODE = 'MISSING_NAMED_REGISTRY';
 //# sourceMappingURL=violationCodes.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.npm-resolver",
-  "version": "1104.0.0",
+  "version": "1104.1.0",
   "description": "Resolver for npm-hosted packages",
   "keywords": [
     "pnpm",
@@ -29,24 +29,25 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/config.normalize-registries": "1101.0.0",
-    "@pnpm/config.pick-registry-for-package": "1101.0.0",
-    "@pnpm/config.version-policy": "1100.2.1",
+    "@pnpm/config.normalize-registries": "1101.0.1",
+    "@pnpm/config.pick-registry-for-package": "1101.0.1",
+    "@pnpm/config.version-policy": "1100.2.2",
     "@pnpm/constants": "1102.0.0",
-    "@pnpm/core-loggers": "1100.3.3",
-    "@pnpm/crypto.hash": "1100.0.2",
-    "@pnpm/deps.path": "1101.0.0",
+    "@pnpm/core-loggers": "1100.3.4",
+    "@pnpm/crypto.hash": "1100.0.3",
+    "@pnpm/deps.path": "1101.0.1",
     "@pnpm/error": "1100.1.3",
     "@pnpm/fetching.types": "1100.0.3",
-    "@pnpm/fs.graceful-fs": "1100.1.1",
-    "@pnpm/pkg-manifest.utils": "1100.4.1",
+    "@pnpm/fs.graceful-fs": "1100.2.0",
+    "@pnpm/pkg-manifest.utils": "1100.4.2",
     "@pnpm/resolving.jsr-specifier-parser": "1100.0.6",
-    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.17",
-    "@pnpm/resolving.registry.types": "1100.1.10",
-    "@pnpm/resolving.resolver-base": "1101.1.1",
-    "@pnpm/store.cafs": "1100.2.0",
-    "@pnpm/store.index": "1100.2.5",
-    "@pnpm/types": "1102.0.0",
+    "@pnpm/resolving.registry.pkg-metadata-filter": "1100.0.18",
+    "@pnpm/resolving.registry.types": "1100.2.0",
+    "@pnpm/resolving.resolver-base": "1101.2.0",
+    "@pnpm/resolving.tarball-url": "1101.1.0",
+    "@pnpm/store.cafs": "1100.3.0",
+    "@pnpm/store.index": "1100.3.0",
+    "@pnpm/types": "1102.1.0",
     "@pnpm/workspace.range-resolver": "1100.0.3",
     "@pnpm/workspace.spec-parser": "1100.0.1",
     "@zkochan/retry": "^0.2.0",
@@ -65,13 +66,13 @@
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0",
-    "@pnpm/worker": "^1100.3.0"
+    "@pnpm/worker": "^1100.4.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/network.fetch": "1100.1.13",
-    "@pnpm/resolving.npm-resolver": "1104.0.0",
+    "@pnpm/network.fetch": "1100.1.14",
+    "@pnpm/resolving.npm-resolver": "1104.1.0",
     "@pnpm/test-fixtures": "1100.0.1",
     "@pnpm/testing.mock-agent": "1101.0.7",
     "@types/normalize-path": "^3.0.2",