cnpmcore 4.33.2 → 4.34.0

package/dist/app/core/service/PackageManagerService.d.ts

@@ -39,10 +39,37 @@ export declare class PackageManagerService extends AbstractService {
     private static downloadCounters;
     static resetDownloadCounters(): void;
     publish(cmd: PublishPackageCmd, publisher: User): Promise<PackageVersion>;
+    private _shouldIsolateNewVersion;
+    private _isolateNewVersion;
+    private _isDependencyIsolationExcluded;
     blockPackageByFullname(name: string, reason: string): Promise<PackageVersionBlock>;
     blockPackage(pkg: Package, reason: string): Promise<PackageVersionBlock>;
     unblockPackageByFullname(name: string): Promise<void>;
     unblockPackage(pkg: Package): Promise<void>;
+    blockPackageVersion(pkg: Package, version: string, reason: string): Promise<PackageVersionBlock>;
+    unblockPackageVersion(pkg: Package, version: string): Promise<void>;
+    /**
+     * Idempotently set whether a package version is available (visible) to the outside, for
+     * external decision sources (e.g. a deployment's security scan).
+     * - available=false: permanently block; if the version is currently in the dependency-isolation
+     *   buffer, the buffer record is overwritten to a permanent block (type=null, no auto-release).
+     * - available=true: only lifts a PERMANENT block. It deliberately does NOT release a buffer
+     *   record — automated "make available" must not let a version escape the isolation window
+     *   ahead of its timer. Buffer release is owned by the timer (releaseBufferedVersions); an
+     *   admin can still force-release via unblockPackageVersion (the explicit escape channel).
+     */
+    ensurePackageVersionAvailability(pkg: Package, version: string, available: boolean, reason?: string): Promise<{
+        changed: boolean;
+    }>;
+    /**
+     * Dependency isolation: release expired buffer versions of a single package in one batch.
+     * Only records still of type='buffer' are released (a record overwritten to a permanent
+     * block is left alone). The package manifest is rebuilt once for the whole batch (the
+     * rebuild is O(versions) regardless of how many are released), then PACKAGE_VERSION_ADDED
+     * is emitted per released version so search / changes stream / file sync pick them up.
+     * Idempotent: already-removed / no-longer-buffer versions are skipped.
+     */
+    releaseBufferedVersions(packageId: string, versions: string[]): Promise<string[]>;
     replacePackageMaintainersAndDist(pkg: Package, maintainers: User[]): Promise<void>;
     savePackageMaintainers(pkg: Package, maintainers: User[]): Promise<boolean>;
     removePackageMaintainer(pkg: Package, maintainer: User): Promise<void>;
@@ -138,6 +165,7 @@ export declare class PackageManagerService extends AbstractService {
     private _listPackageFullOrAbbreviatedManifests;
     private _listPackageFullOrAbbreviatedManifestsBuffer;
     maintainers(pkg: Package): Promise<AuthorType[]>;
+    private _listBlockedVersionMap;
     private _listPackageFullManifests;
     private _listPackageAbbreviatedManifests;
     private _checkPackageDepsVersion;