Subset of packument facts the install summary printer wants to
render next to a direct-dependency line. Returned only for direct
deps where at least one signal is set — the printer skips the badge
column when Resolver::direct_dep_info’s map has no entry.
Supply-chain mitigation: forbid versions younger than min_age
unless the package (or specific version) is exempted by exclude.
Mirrors pnpm’s minimumReleaseAge / minimumReleaseAgeExclude /
minimumReleaseAgeStrict triplet. Constructed by the install
command, threaded into [Resolver::with_minimum_release_age].
Context attached to a NoMatch error so the miette help() output can
show importer path, parent chain, and what versions the packument
actually contains. Boxed into the enum variant to keep Error’s size
under clippy::result_large_err.
Walk the resolved graph top-down from each importer and compute a
peer-dependency context for every package, producing a new graph whose
dep_paths carry pnpm-style (peer@ver) suffixes.
Outcome of [pick_version]. Distinguishes “nothing in the range
at all” from “the cutoff filtered every otherwise-satisfying
version” so the caller can surface a meaningful strict-mode error
instead of pretending the range itself was wrong.
Trust-evidence ranks. Higher is stronger. Variants intentionally do
not derive Ord — the variant declaration order does not match the
rank order, so callers must go through Self::rank.
Default is NoDowngrade to match the user-facing default in
crates/aube-settings/settings.toml. The install command overrides
this from the resolved settings anyway, but library consumers
constructing a Resolver via [Resolver::new] inherit the
documented default behavior without extra plumbing.
Hook invoked once per resolved package, right after its version has
been picked from the packument and before its dependency set is
enqueued. Implementations may mutate dependencies,
optionalDependencies, peerDependencies, and
peerDependenciesMeta; every other field is ignored on the way
back, matching how pnpm’s readPackage hook is used in the wild.
Run the trust-downgrade check. Returns Ok(()) when the picked
version is acceptable (excluded, missing-evidence-everywhere, older
than ignore_after_minutes, or carrying evidence at least as strong
as the strongest prior version’s). Errors otherwise.
Scan the resolved graph and return every declared required peer whose
resolved version doesn’t satisfy its declared range. Optional peers
(peerDependenciesMeta.optional = true) are skipped — pnpm treats
those as “warn suppressed” with auto-install-peers=true. The result
is purely informational; aube never fails an install on unmet peers,
matching pnpm.
Strongest trust evidence carried by a single version’s metadata.
approver outranks _npmUser.trustedPublisher, which outranks
dist.attestations.provenance.
Honor allowedDeprecatedVersions: does the pinned range (keyed by
package name) mute the deprecation warning for this specific version?
Used by the resolver’s fresh-resolve path and by aube deprecations.
Single-package version pick for aube add’s manifest step, honoring
minimumReleaseAge with the same dist-tag preference, exemption, and
strict/lenient fallback semantics [pick_version] applies inside full
resolution. Without it, add writes the freshly published version into
the manifest as a pinned spec, which the resolver’s lenient fallback then
honors — bypassing the very gate minimumReleaseAge exists to provide.
A parsed package-version policy: a set of <name>[@<semver-range>…]
rules with * name globs. pnpm backs both trustPolicyExclude and
minimumReleaseAgeExclude with the same createPackageVersionPolicy
engine, so we do too — TrustExcludeRules is the neutral
PackageVersionPolicy type seeded with the trust defaults, while
minimumReleaseAgeExclude builds an empty one from user rules only.