@pnpm/resolving.resolver-base 1100.5.3 → 1100.5.5

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @pnpm/resolver-base
 
+## 1100.5.5
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/types@1101.7.0
+
+## 1100.5.4
+
+### Patch Changes
+
+- Republished every package: the tarballs published by the v11.13.1 through v11.16.0 releases were missing most of their compiled files due to a packing bug [#13164](https://github.com/pnpm/pnpm/issues/13164).
+
+- Updated dependencies:
+  - @pnpm/types@1101.6.0
+
 ## 1100.5.3
 
 ### Patch Changes

package/lib/index.d.ts

@@ -0,0 +1,296 @@
+import type { DependencyManifest, PackageManifest, PackageVersionPolicy, PinnedVersion, PkgResolutionId, ProjectRootDir, SupportedArchitectures, TrustPolicy } from '@pnpm/types';
+export { type PkgResolutionId };
+/**
+ * tarball hosted remotely
+ */
+export interface TarballResolution {
+    type?: undefined;
+    tarball: string;
+    integrity?: string;
+    path?: string;
+    /**
+     * True for tarballs sourced from a git host (codeload.github.com /
+     * gitlab.com / bitbucket.org). Such tarballs need preparation
+     * (preparePackage / packlist) on extraction, and their cached content
+     * depends on whether build scripts ran, so they're addressed by
+     * gitHostedStoreIndexKey rather than the integrity-based key.
+     */
+    gitHosted?: boolean;
+}
+export interface BinaryResolution {
+    type: 'binary';
+    archive: 'tarball' | 'zip';
+    url: string;
+    integrity: string;
+    bin: string | Record<string, string>;
+    prefix?: string;
+}
+/**
+ * directory on a file system
+ */
+export interface DirectoryResolution {
+    type: 'directory';
+    directory: string;
+}
+export interface GitResolution {
+    commit: string;
+    repo: string;
+    path?: string;
+    type: 'git';
+}
+export interface CustomResolution {
+    type: `custom:${string}`;
+    [key: string]: unknown;
+}
+export interface PlatformAssetTarget {
+    os: string;
+    cpu: string;
+    libc?: 'musl';
+}
+export interface PlatformAssetResolution {
+    resolution: AtomicResolution;
+    targets: PlatformAssetTarget[];
+}
+export type AtomicResolution = TarballResolution | DirectoryResolution | GitResolution | BinaryResolution | CustomResolution;
+export interface VariationsResolution {
+    type: 'variations';
+    variants: PlatformAssetResolution[];
+}
+export type Resolution = AtomicResolution | VariationsResolution;
+/**
+ * A tarball URL is git-hosted when it points at a known git provider's immutable
+ * archive endpoint. The result gates integrity exemptions, so the match is
+ * limited to provider-specific path shapes whose ref is a full commit SHA.
+ */
+export declare function isGitHostedTarballUrl(url: string): boolean;
+export type ResolutionKind = 'localTarball' | 'gitHostedTarball' | 'remoteTarball' | 'directory' | 'git' | 'binary' | 'custom';
+/**
+ * Classifies a resolution for fetcher selection. Lockfile-provided flags are
+ * treated as hints; integrity exemptions depend on the resolved source shape.
+ */
+export declare function classifyResolution(resolution: Resolution): ResolutionKind;
+/**
+ * Outcome of asking a `ResolutionVerifier` whether a (name, version,
+ * resolution) entry from a lockfile is acceptable under whatever policies
+ * the resolver chain has been configured with. Resolvers that don't have
+ * an opinion on a given resolution should return `{ ok: true }`.
+ */
+export type ResolutionVerification = {
+    ok: true;
+} | {
+    ok: false;
+    code: string;
+    reason: string;
+};
+/**
+ * Optional companion to a resolver factory.
+ *
+ * `verify` inspects the `resolution` shape to decide whether the entry
+ * is within its protocol; for entries outside its protocol it should
+ * return `{ ok: true }`. The install side fans out across the verifier
+ * list rather than asking a combinator to dispatch.
+ *
+ * `policy` and `canTrustPastCheck` describe the verifier's cache
+ * contract. Policies from every active verifier are merged into a
+ * single shared bag stored alongside the lockfile hash; the
+ * install-side verification cache reads them to decide if a previous
+ * run on the same lockfile is still trustworthy under today's policy
+ * without re-issuing the registry round-trips that `verify` would.
+ * Verifiers that check the same logical policy (e.g. minimumReleaseAge
+ * across registries) name it the same and share the cache slot.
+ */
+export interface ResolutionVerifier {
+    /**
+     * `ctx.nonSemverVersion` is set when the lockfile entry is keyed by a
+     * non-semver reference (URL tarball, git, etc.) rather than a registry
+     * `name@version`. Verifiers that only police registry entries use it to
+     * skip deliberate non-registry deps, which can still carry a semver
+     * `version` copied from the resolved manifest.
+     */
+    verify: (resolution: Resolution, ctx: {
+        name: string;
+        version: string;
+        nonSemverVersion?: string;
+    }) => Promise<ResolutionVerification>;
+    /**
+     * Snapshot of the policy fields this verifier enforces. Merged with
+     * every other active verifier's `policy` into the cache record. A
+     * field shared across verifiers (same key) should carry the same
+     * value; if it doesn't, the last verifier in the list wins.
+     */
+    policy: Record<string, unknown>;
+    /**
+     * Returns true when the previously cached policy (the merged snapshot
+     * from the last successful run) can be trusted to still satisfy what
+     * this verifier currently demands. Reads whichever fields the
+     * verifier owns; missing or non-conforming values (e.g. an older
+     * record shape) should return false. A loosened policy can trust a
+     * stricter cached run; a tightened policy cannot.
+     */
+    canTrustPastCheck: (cachedPolicy: Record<string, unknown>) => boolean;
+}
+/**
+ * A `ResolutionVerifier`'s rejection materialized for one (name,
+ * version, resolution) entry. The install side aggregates these across
+ * every active verifier on the freshly-resolved tree and either prompts
+ * the user, persists them (e.g. into `minimumReleaseAgeExclude`), or
+ * aborts. Code is the verifier-defined error code
+ * (`MINIMUM_RELEASE_AGE_VIOLATION`, `TRUST_DOWNGRADE`, etc.) — the
+ * install command filters by code to decide downstream UX. Lifted here
+ * (rather than in deps-installer) so both deps-resolver and
+ * deps-installer can share one shape; future resolver packages plug in
+ * without needing the deps-installer dependency.
+ */
+export interface ResolutionPolicyViolation {
+    name: string;
+    version: string;
+    resolution: Resolution;
+    code: string;
+    reason: string;
+}
+/** Concrete platform selector used when picking a variant from a VariationsResolution. */
+export interface PlatformSelector {
+    os: string;
+    cpu: string;
+    /** Name of the libc family requested. Omit (or leave `null`) for the default (glibc on Linux, n/a elsewhere). */
+    libc?: string | null;
+}
+/**
+ * Resolve a {@link PlatformSelector} from the user's supportedArchitectures config
+ * and the host's own platform/arch/libc. When `supportedArchitectures.xxx` is set
+ * and its first entry is not `"current"`, that entry wins; otherwise the host's
+ * value is used. Additional entries beyond the first are ignored — variant
+ * selection picks exactly one (os, cpu, libc) triplet per install.
+ */
+export declare function resolvePlatformSelector(supportedArchitectures: SupportedArchitectures | undefined, host: {
+    platform: string;
+    arch: string;
+    libc: string | null | undefined;
+}): PlatformSelector;
+/**
+ * Pick the variant whose target matches the given selector, or `undefined` if
+ * none does. A variant with no `libc` represents the "default" build — glibc on
+ * Linux, irrelevant on macOS/Windows. A non-default libc (e.g. `musl`) is a
+ * separate, non-interchangeable artifact; an exact libc match is required in
+ * that case so the glibc/default variant doesn't silently win (its `target.libc`
+ * is nullish).
+ */
+export declare function selectPlatformVariant(variants: PlatformAssetResolution[], selector: PlatformSelector): PlatformAssetResolution | undefined;
+export interface ResolveResult {
+    id: PkgResolutionId;
+    latest?: string;
+    publishedAt?: string;
+    manifest?: DependencyManifest;
+    resolution: Resolution;
+    resolvedVia: string;
+    normalizedBareSpecifier?: string;
+    alias?: string;
+    /**
+     * Set when the resolver picked this version despite a policy
+     * violation (e.g. immature relative to `publishedBy`, trust
+     * downgrade detected by `failIfTrustDowngraded`). The resolver
+     * already has the metadata it needs to decide, so reporting inline
+     * here avoids the install layer having to re-scan the tree and
+     * re-fetch the same metadata. The deps-resolver aggregates these
+     * across every resolve call into a single set the install command
+     * can react to.
+     *
+     * `resolution` on the violation is the same `resolution` field
+     * above — supplied for symmetry with `ResolutionPolicyViolation`
+     * entries that flow out of `verifyLockfileResolutions` for
+     * lockfile-only paths.
+     */
+    policyViolation?: ResolutionPolicyViolation;
+}
+export interface WorkspacePackage {
+    rootDir: ProjectRootDir;
+    manifest: DependencyManifest;
+}
+export type WorkspacePackagesByVersion = Map<string, WorkspacePackage>;
+export type WorkspacePackages = Map<string, WorkspacePackagesByVersion>;
+export declare const DIRECT_DEP_SELECTOR_WEIGHT = 1000;
+export declare const EXISTING_VERSION_SELECTOR_WEIGHT = 1000000;
+export type VersionSelectorType = 'version' | 'range' | 'tag';
+export interface VersionSelectors {
+    [selector: string]: VersionSelectorWithWeight | VersionSelectorType;
+}
+export interface VersionSelectorWithWeight {
+    selectorType: VersionSelectorType;
+    weight: number;
+}
+export interface PreferredVersions {
+    [packageName: string]: VersionSelectors;
+}
+export interface ResolveOptions {
+    alwaysTryWorkspacePackages?: boolean;
+    trustPolicy?: TrustPolicy;
+    trustPolicyExclude?: PackageVersionPolicy;
+    trustPolicyIgnoreAfter?: number;
+    defaultTag?: string;
+    pickLowestVersion?: boolean;
+    publishedBy?: Date;
+    publishedByExclude?: PackageVersionPolicy;
+    projectDir: string;
+    lockfileDir: string;
+    preferredVersions: PreferredVersions;
+    preferWorkspacePackages?: boolean;
+    workspacePackages?: WorkspacePackages;
+    update?: false | 'compatible' | 'latest';
+    /**
+     * True only when this specific package matches the user's update target
+     * (e.g. `pnpm up <name>`). Unlike `update`, this is false for unrelated
+     * packages that get re-resolved as a side effect of an update, so it can
+     * be used to bypass preferred-version propagation without forcing
+     * unrelated transitives to jump to their latest versions.
+     */
+    updateRequested?: boolean;
+    updateChecksums?: boolean;
+    injectWorkspacePackages?: boolean;
+    calcSpecifier?: boolean;
+    pinnedVersion?: PinnedVersion;
+    currentPkg?: {
+        id: PkgResolutionId;
+        name?: string;
+        version?: string;
+        resolution: Resolution;
+        publishedAt?: string;
+    };
+}
+export type WantedDependency = {
+    injected?: boolean;
+    prevSpecifier?: string;
+} & ({
+    alias?: string;
+    bareSpecifier: string;
+} | {
+    alias: string;
+    bareSpecifier?: string;
+});
+export type ResolveFunction = (wantedDependency: WantedDependency & {
+    optional?: boolean;
+}, opts: ResolveOptions) => Promise<ResolveResult>;
+/**
+ * Input to a resolver's `resolveLatest` function. The resolver decides
+ * whether it owns this dep purely from `wantedDependency` (its alias and
+ * manifest specifier) — the lockfile-resolved ref is the caller's
+ * concern, not the resolver's.
+ */
+export interface LatestQuery {
+    wantedDependency: WantedDependency;
+    compatible?: boolean;
+}
+/**
+ * Result of a resolver's `resolveLatest` call.
+ *
+ * - `undefined` means "this resolver does not handle this dep — try
+ *   the next one".
+ * - An object (even without a `latestManifest`) means "I claim this
+ *   dep, but I can't tell you what's latest" (e.g. policy blocked,
+ *   network unavailable, no concept of latest for this protocol).
+ *   The caller still surfaces a ref-mismatch report if the lockfile
+ *   shifted.
+ */
+export interface LatestInfo {
+    latestManifest?: PackageManifest;
+}
+export type ResolveLatestFunction = (query: LatestQuery, opts: ResolveOptions) => Promise<LatestInfo | undefined>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.resolver-base",
-  "version": "1100.5.3",
+  "version": "1100.5.5",
   "description": "Types for pnpm-compatible resolvers",
   "keywords": [
     "pnpm",
@@ -28,11 +28,11 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/types": "1101.5.0"
+    "@pnpm/types": "1101.7.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/resolving.resolver-base": "1100.5.3"
+    "@pnpm/resolving.resolver-base": "1100.5.5"
   },
   "engines": {
     "node": ">=22.13"