Supply-chain mitigation: forbid versions younger than min_age for
every package whose name isn’t in exclude. Mirrors pnpm’s
minimumReleaseAge / minimumReleaseAgeExclude /
minimumReleaseAgeStrict triplet. Constructed by the install
command, threaded into [Resolver::with_minimum_release_age].
Context attached to a NoMatch error so the miette help() output can
show importer path, parent chain, and what versions the packument
actually contains. Boxed into the enum variant to keep Error’s size
under clippy::result_large_err.
Walk the resolved graph top-down from each importer and compute a
peer-dependency context for every package, producing a new graph whose
dep_paths carry pnpm-style (peer@ver) suffixes.
Parsed trustPolicyExclude rules. Mirrors pnpm’s
createPackageVersionPolicy (config/version-policy/src/index.ts).
Each rule is <name> (matches all versions, supports * glob in
the name) or <name>@<exact-version>[ || <exact-version>]… (no
ranges, no name globs combined with versions).
Trust-evidence ranks. Higher is stronger. Variants intentionally do
not derive Ord — the variant declaration order does not match the
rank order, so callers must go through Self::rank.
Default is NoDowngrade to match the user-facing default in
crates/aube-settings/settings.toml. The install command overrides
this from the resolved settings anyway, but library consumers
constructing a Resolver via [Resolver::new] inherit the
documented default behavior without extra plumbing.
Hook invoked once per resolved package, right after its version has
been picked from the packument and before its dependency set is
enqueued. Implementations may mutate dependencies,
optionalDependencies, peerDependencies, and
peerDependenciesMeta; every other field is ignored on the way
back, matching how pnpm’s readPackage hook is used in the wild.
Scan the resolved graph and return every declared required peer whose
resolved version doesn’t satisfy its declared range. Optional peers
(peerDependenciesMeta.optional = true) are skipped — pnpm treats
those as “warn suppressed” with auto-install-peers=true. The result
is purely informational; aube never fails an install on unmet peers,
matching pnpm.
Honor allowedDeprecatedVersions: does the pinned range (keyed by
package name) mute the deprecation warning for this specific version?
Used by the resolver’s fresh-resolve path and by aube deprecations.