@pnpm/store.connection-manager 1100.3.5 → 1100.3.6

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @pnpm/store-connection-manager
 
+## 1100.3.6
+
+### Patch Changes
+
+- `pnpm add -g`, `pnpm update -g`, `pnpm setup`, and the self-updater no longer fail with `ERR_PNPM_MISSING_TIME` when `trustPolicy: no-downgrade` or `resolutionMode: time-based` is set in the global config [#12883](https://github.com/pnpm/pnpm/issues/12883). The decision to fetch full registry metadata now lives in one place, and the `no-downgrade` trust policy always requests full metadata (matching the self-updater), since the trust evidence it checks is missing from abbreviated metadata even on registries that include the `time` field.
+
+- Updated dependencies:
+  - @pnpm/cli.meta@1100.0.9
+  - @pnpm/config.reader@1101.12.0
+  - @pnpm/installing.client@1100.2.14
+  - @pnpm/resolving.resolver-base@1100.5.2
+  - @pnpm/store.controller@1102.0.5
+
 ## 1100.3.5
 
 ### Patch Changes

package/lib/createNewStoreController.d.ts

@@ -3,7 +3,7 @@ import { type ClientOptions } from '@pnpm/installing.client';
 import type { ResolutionVerifier } from '@pnpm/resolving.resolver-base';
 import { type CafsLocker, type StoreController } from '@pnpm/store.controller';
 type CreateResolverOptions = Pick<Config, 'fetchRetries' | 'fetchRetryFactor' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'offline' | 'configByUri' | 'verifyStoreIntegrity'> & Required<Pick<Config, 'cacheDir' | 'storeDir'>>;
-export type CreateNewStoreControllerOptions = CreateResolverOptions & Pick<Config, 'ca' | 'cert' | 'engineStrict' | 'force' | 'frozenStore' | 'nodeDownloadMirrors' | 'nodeVersion' | 'fetchTimeout' | 'fetchWarnTimeoutMs' | 'fetchMinSpeedKiBps' | 'gitShallowHosts' | 'ignoreScripts' | 'httpProxy' | 'httpsProxy' | 'key' | 'localAddress' | 'maxSockets' | 'minimumReleaseAge' | 'minimumReleaseAgeExclude' | 'minimumReleaseAgeIgnoreMissingTime' | 'minimumReleaseAgeStrict' | 'networkConcurrency' | 'noProxy' | 'offline' | 'packageImportMethod' | 'preferOffline' | 'preserveAbsolutePaths' | 'registries' | 'namedRegistries' | 'registrySupportsTimeField' | 'resolutionMode' | 'saveWorkspaceProtocol' | 'strictSsl' | 'trustPolicy' | 'trustPolicyExclude' | 'trustPolicyIgnoreAfter' | 'unsafePerm' | 'userAgent' | 'verifyStoreIntegrity' | 'virtualStoreDirMaxLength'> & Pick<ConfigContext, 'hooks'> & {
+export type CreateNewStoreControllerOptions = CreateResolverOptions & Pick<Config, 'ca' | 'cert' | 'engineStrict' | 'force' | 'frozenStore' | 'nodeDownloadMirrors' | 'nodeVersion' | 'fetchTimeout' | 'fetchWarnTimeoutMs' | 'fetchMinSpeedKiBps' | 'gitShallowHosts' | 'ignoreScripts' | 'httpProxy' | 'httpsProxy' | 'key' | 'localAddress' | 'maxSockets' | 'minimumReleaseAge' | 'minimumReleaseAgeExclude' | 'minimumReleaseAgeIgnoreMissingTime' | 'minimumReleaseAgeStrict' | 'networkConcurrency' | 'noProxy' | 'offline' | 'packageImportMethod' | 'preferOffline' | 'preserveAbsolutePaths' | 'registries' | 'namedRegistries' | 'registrySupportsTimeField' | 'resolutionMode' | 'saveWorkspaceProtocol' | 'strictSsl' | 'supportedArchitectures' | 'trustPolicy' | 'trustPolicyExclude' | 'trustPolicyIgnoreAfter' | 'unsafePerm' | 'userAgent' | 'verifyStoreIntegrity' | 'virtualStoreDirMaxLength'> & Pick<ConfigContext, 'hooks'> & {
     cafsLocker?: CafsLocker;
     ignoreFile?: (filename: string) => boolean;
     fetchFullMetadata?: boolean;
@@ -13,4 +13,24 @@ export declare function createNewStoreController(opts: CreateNewStoreControllerO
     dir: string;
     resolutionVerifiers: ResolutionVerifier[];
 }>;
+/**
+ * Whether the resolver should request full registry metadata instead of the
+ * abbreviated document.
+ *
+ * An explicit `fetchFullMetadata` wins over every derived reason below: `true`
+ * always fetches full metadata and `false` always suppresses it. When it is
+ * unset, the reasons below apply, and the default (no reason present) is
+ * `false` (abbreviated metadata).
+ *
+ * Full metadata is needed when:
+ * - `supportedArchitectures.libc` is set, because the npm registry's
+ *   abbreviated metadata currently does not contain `libc`
+ *   (see <https://github.com/pnpm/pnpm/issues/7362#issuecomment-1971964689>);
+ * - the trust policy is `no-downgrade`, because the trust checks read trust
+ *   evidence (`_npmUser`) that abbreviated metadata never carries, regardless
+ *   of `registrySupportsTimeField`;
+ * - the resolution mode is time-based and the registry does not include the
+ *   `time` field in abbreviated metadata.
+ */
+export declare function shouldFetchFullMetadata(opts: Pick<CreateNewStoreControllerOptions, 'fetchFullMetadata' | 'registrySupportsTimeField' | 'resolutionMode' | 'supportedArchitectures' | 'trustPolicy'>): boolean;
 export {};

package/lib/createNewStoreController.js

@@ -4,8 +4,7 @@ import { createClient } from '@pnpm/installing.client';
 import { createPackageStore } from '@pnpm/store.controller';
 import { ReadOnlyStoreIndex, StoreIndex } from '@pnpm/store.index';
 export async function createNewStoreController(opts) {
-    const fullMetadata = opts.fetchFullMetadata ?? ((opts.resolutionMode === 'time-based' ||
-        opts.trustPolicy === 'no-downgrade') && !opts.registrySupportsTimeField);
+    const fullMetadata = shouldFetchFullMetadata(opts);
     if (!opts.frozenStore) {
         await fs.mkdir(opts.storeDir, { recursive: true });
     }
@@ -88,4 +87,28 @@ export async function createNewStoreController(opts) {
         resolutionVerifiers,
     };
 }
+/**
+ * Whether the resolver should request full registry metadata instead of the
+ * abbreviated document.
+ *
+ * An explicit `fetchFullMetadata` wins over every derived reason below: `true`
+ * always fetches full metadata and `false` always suppresses it. When it is
+ * unset, the reasons below apply, and the default (no reason present) is
+ * `false` (abbreviated metadata).
+ *
+ * Full metadata is needed when:
+ * - `supportedArchitectures.libc` is set, because the npm registry's
+ *   abbreviated metadata currently does not contain `libc`
+ *   (see <https://github.com/pnpm/pnpm/issues/7362#issuecomment-1971964689>);
+ * - the trust policy is `no-downgrade`, because the trust checks read trust
+ *   evidence (`_npmUser`) that abbreviated metadata never carries, regardless
+ *   of `registrySupportsTimeField`;
+ * - the resolution mode is time-based and the registry does not include the
+ *   `time` field in abbreviated metadata.
+ */
+export function shouldFetchFullMetadata(opts) {
+    return opts.fetchFullMetadata ?? (opts.supportedArchitectures?.libc != null ||
+        opts.trustPolicy === 'no-downgrade' ||
+        (opts.resolutionMode === 'time-based' && !opts.registrySupportsTimeField));
+}
 //# sourceMappingURL=createNewStoreController.js.map

package/lib/index.d.ts

@@ -1,8 +1,8 @@
 import type { Config } from '@pnpm/config.reader';
 import type { ResolutionVerifier } from '@pnpm/resolving.resolver-base';
 import type { StoreController } from '@pnpm/store.controller';
-import { createNewStoreController, type CreateNewStoreControllerOptions } from './createNewStoreController.js';
-export { createNewStoreController };
+import { createNewStoreController, type CreateNewStoreControllerOptions, shouldFetchFullMetadata } from './createNewStoreController.js';
+export { createNewStoreController, shouldFetchFullMetadata };
 export type CreateStoreControllerOptions = Omit<CreateNewStoreControllerOptions, 'storeDir'> & Pick<Config, 'storeDir' | 'dir' | 'pnpmHomeDir' | 'workspaceDir'>;
 export interface StoreControllerHandle {
     ctrl: StoreController;

package/lib/index.js

@@ -1,6 +1,6 @@
 import { getStorePath } from '@pnpm/store.path';
-import { createNewStoreController } from './createNewStoreController.js';
-export { createNewStoreController };
+import { createNewStoreController, shouldFetchFullMetadata } from './createNewStoreController.js';
+export { createNewStoreController, shouldFetchFullMetadata };
 export async function createStoreControllerCached(storeControllerCache, opts) {
     const storeDir = await getStorePath({
         pkgRoot: opts.dir,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/store.connection-manager",
-  "version": "1100.3.5",
+  "version": "1100.3.6",
   "description": "Create a pnpm store controller",
   "keywords": [
     "pnpm",
@@ -27,11 +27,11 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/cli.meta": "1100.0.8",
-    "@pnpm/config.reader": "1101.11.2",
-    "@pnpm/installing.client": "1100.2.13",
-    "@pnpm/resolving.resolver-base": "1100.5.1",
-    "@pnpm/store.controller": "1102.0.4",
+    "@pnpm/cli.meta": "1100.0.9",
+    "@pnpm/config.reader": "1101.12.0",
+    "@pnpm/installing.client": "1100.2.14",
+    "@pnpm/resolving.resolver-base": "1100.5.2",
+    "@pnpm/store.controller": "1102.0.5",
     "@pnpm/store.index": "1100.2.1",
     "@pnpm/store.path": "1100.0.2",
     "dir-is-case-sensitive": "^3.0.0"
@@ -40,8 +40,9 @@
     "@pnpm/logger": "^1100.0.0"
   },
   "devDependencies": {
+    "@jest/globals": "30.4.1",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/store.connection-manager": "1100.3.5"
+    "@pnpm/store.connection-manager": "1100.3.6"
   },
   "engines": {
     "node": ">=22.13"
@@ -50,9 +51,10 @@
     "preset": "@pnpm/jest-config"
   },
   "scripts": {
-    "lint": "eslint \"src/**/*.ts\"",
+    "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",
     "pretest": "rimraf node_modules/.bin/pnpm",
-    "test": "pn compile",
+    "test": "pn compile && pn .test",
+    ".test": "pn pretest && cross-env NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest",
     "compile": "tsgo --build && pn lint --fix"
   }
 }