fix(resolver): fail closed when publish time can't prove a version's age

[colinhacks]

minimumReleaseAge treated a version with no time: entry as eligible, so a packument without publish times silently disabled the gate, even under minimumReleaseAgeStrict=true.

Repro: with a 10-year cutoff and strict on, adding registry-supports-time-field=true to .npmrc flipped nub add strip-ansi-cjs from ERR_NUB_NO_MATURE_MATCHING_VERSION to a clean install.

A missing time is now resolved against the packument's modified — an upper bound proving every version in the document is mature, which keeps abbreviated metadata usable without a full fetch. When even that can't settle it, strict decides: strict blocks, lenient stays eligible as before, so standalone aube's default is preserved. The modified bound is pnpm 11's mechanism (pickPackageFromMeta); the terminal default differs, since pnpm warns-and-skips where nub blocks.

The vulnerability re-pick ranks in two tiers rather than vetoing: an undated safe version still beats returning a known-vulnerable fallback, but a dated-and-too-new one stays excluded.

Also gives registrySupportsTimeField a workspaceYaml source and field — pnpm reads it only from pnpm-workspace.yaml.

BEHAVIOR CHANGE: under strict, a registry serving no time map blocks packages whose modified is newer than the cutoff. Escapes: minimumReleaseAgeExclude, minimumReleaseAge=0.

Overlaps #587, which carries the same strict gate without the modified bound.

Closes #581

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nub	Ready	Preview, Comment	Jul 29, 2026 6:35am

[pullfrog]

Important

The fail-closed direction is right, but it is implemented unconditionally, which changes standalone aube's default behavior (fork-discipline) and skips the minimumReleaseAgeIgnoreMissingTime knob the plan on #581 specified. pnpm 11 defaults that knob to true (skip the gate, warn once), so "Matches pnpm 11" does not hold for this branch. Two secondary effects worth a look: loose mode now silently resolves to the lowest satisfying version with no diagnostic, and the vulnerability re-pick can keep a known-vulnerable version.

Reviewed changes — closes the minimumReleaseAge fail-open hole where a packument with no usable publish time let a version through the age gate, including under minimumReleaseAgeStrict=true.

• Add version_clears_cutoff as the single publish-age wall — one helper in semver_util.rs decides all three cases: time known, hole in a populated time map, and no per-version times at all.
• Admit timeless packuments via modified as an upper bound — modified <= cutoff proves every version in the document is mature, keeping abbreviated (corgi) metadata usable; absent or newer modified blocks.
• Treat a created/modified-only time map as timeless — avoids a raw is_empty() misreading a bookkeeping-only mirror response as "populated, with holes".
• Route the vulnerability re-pick through the same helper — prefer_non_vulnerable_pick had its own copy of the comparison that kept the fail-open after pick_version dropped it.
• Replace the old fail-open test with four-case coverage — plus a bookkeeping-only-map test; both drive pick_version directly with strict=true.
• Extend registrySupportsTimeField — new docs paragraph on the interaction, plus a workspaceYaml source and precedence = ["workspaceYaml", "npmrc"] matching the minimumReleaseAge* family.

⚠️ A missing publish time reports as "blocked by age gate"

When the new wall blocks a version because its age is unknown, the resolver still raises Error::AgeGate, so the user sees "blocked by age gate" plus a list of versions that were never actually shown to be too new. The help text's first suggestion is minimumReleaseAgeStrict=false, which in exactly this case drops the user into the silent lowest-version fallback rather than a mature pick.

The plan on #581 called for a distinct missing-time diagnostic mirroring the existing ERR_AUBE_TRUST_MISSING_TIME shape, naming the package and pointing at the real escape hatches.

Technical details

# A missing publish time reports as "blocked by age gate"

## Affected sites
- `vendor/aube/crates/aube-resolver/src/resolve/driver.rs:996-1003` — `PickResult::AgeGated` maps unconditionally to `Error::AgeGate` / `build_age_gate`, with no way to distinguish "cutoff excluded it" from "age undeterminable".
- `vendor/aube/crates/aube-resolver/src/error.rs:238-262` — `build_age_gate` lists every range-satisfying version as `gated`, including versions with no time entry.
- `vendor/aube/crates/aube-resolver/src/error.rs:318` — help text: "to bypass: loosen `minimumReleaseAge` ... set `minimumReleaseAgeStrict=false` to fall back to the lowest satisfying version ...".
- `vendor/aube/crates/aube-codes/src/errors.rs` — `ERR_AUBE_TRUST_MISSING_TIME` is the established precedent for a missing-time failure code.

## Required outcome
- A block caused by undeterminable publish age is distinguishable, in both the error code and the message, from a block caused by a version being too new.
- The message names the package and the escape hatches that actually apply to this failure mode.
- The suggestion to set `minimumReleaseAgeStrict=false` is not offered for a missing-time block unless loose mode produces a defensible pick (see the inline comment on `semver_util.rs:211`).

## Open questions for the human
- Should a missing-time block get its own `ERR_AUBE_*` code (mirroring the trust-policy sibling) or reuse `ERR_AUBE_NO_MATURE_MATCHING_VERSION` with amended help text?

ℹ️ Two invariant comments elsewhere still describe the old fail-open

The flip invalidates a documented assumption on the offline add path, and leaves a sibling check keyed on the exact heuristic this PR's new comment argues against.

• vendor/aube/crates/aube/src/commands/add/manifest.rs:326-328 states that "corgi's missing time map keeps its versions cutoff-eligible in pick_version, so either format picks correctly" — the justification for serving an offline add from whichever cache format is on disk. That is no longer true, and no test covers offline + corgi + minimumReleaseAge.
• vendor/aube/crates/aube-resolver/src/trust.rs:166 skips the trust check on packument.time.is_empty(). For a mirror serving only created/modified, that check reads the map as populated and the next line raises TrustCheckError::MissingTime — the same misread the new helper's comment calls out at semver_util.rs:109-112.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

⚠️ The wall is unconditional, so this changes standalone aube's behavior on its default path — AGENTS.md requires vendor/aube changes to be default-preserving with the embedder opting in. It also skips the mechanism the plan on #581 specified: pnpm 11's minimumReleaseAgeIgnoreMissingTime, whose default is true (skip the gate for a timeless package, warn once), with false opting into failure. That makes "Matches pnpm 11" inaccurate for the block-when-unprovable branch, and leaves users of a registry that omits time with no proportionate escape.

Technical details

# Fail-closed is hard-coded; pnpm's opt-in knob is missing

## Affected sites
- `vendor/aube/crates/aube-resolver/src/semver_util.rs:101-121` — `version_clears_cutoff` blocks whenever nothing proves maturity, with no setting to consult.
- `vendor/aube/crates/aube-resolver/src/semver_util.rs:86-87` — doc comment claims parity with pnpm's `pickPackageFromMeta` + `filterPkgMetadataByPublishDate`. Both functions are real and the two admit-paths match, but pnpm's third branch (no time data, `modified` absent or too new) throws and is then caught by `ignoreMissingTimeField`, which is on by default.
- `crates/nub-cli/src/pm_engine/use_nub.rs:286` — `minimumReleaseAgeIgnoreMissingTime` sits in `WARN_TAIL`, so a user setting pnpm's documented escape hatch gets it warned-and-dropped.
- `crates/nub-cli/src/pm_engine/mod.rs:2256-2257` — nub's embedder defaults are `minimumReleaseAge=1440` + `minimumReleaseAgeStrict=true`, so under nub the new wall is a hard install failure by default.
- pnpm docs: `minimumReleaseAgeIgnoreMissingTime`, added v11.0.0, default `true` — "skips the minimumReleaseAge check for a package whose registry metadata does not include the time field (some private registries and mirrors omit it). Set to false to fail resolution in that case instead of installing the package."

## Required outcome
- `MinimumReleaseAge` carries an `ignore_missing_time` flag that `version_clears_cutoff` honors, declared in `aube-settings/settings.toml` as `minimumReleaseAgeIgnoreMissingTime`.
- Standalone aube's default path is unchanged (flag defaults to `true` there); nub opts in via its embedder defaults if that is the posture chosen.
- `minimumReleaseAgeIgnoreMissingTime` moves out of nub's `WARN_TAIL` into the honored path.
- The doc comment's parity claim is narrowed to the two branches that actually match pnpm.

## Open questions for the human
- nub's default for `ignore_missing_time`: `false` (genuinely closed 24h floor, breaks installs against time-less mirrors) or `true` (pnpm parity)? This is the same call left open on [#581](https://github.com/nubjs/nub/issues/581) and it was never answered.
- Whether a per-package warning ships regardless of the default (option 2 on that issue).

[pullfrog]

Partly addressed in 4a627b7: standalone aube's default path is preserved and the pnpm-parity claim is now narrowed to the modified bound, so the fork-discipline half is resolved. Still open — there is no minimumReleaseAgeIgnoreMissingTime, so the missing-time posture rides on minimumReleaseAgeStrict (see the new review), and nub's WARN_TAIL still drops that key.

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

ℹ️ This holds only in strict mode. With minimumReleaseAgeStrict=false (this crate's default) the cost is neither over-blocking nor a bypass: the resolver silently falls back to the lowest satisfying version of every affected package. Worth stating both outcomes so the flag's risk is legible to someone reading only this doc.

[pullfrog]

Still inaccurate after 4a627b7, now in the other direction: under the lenient default an undated version stays eligible, so enabling this flag against a registry that omits time does effectively disable minimumReleaseAge — a silent bypass, not over-blocking. The over-blocking wording holds only under minimumReleaseAgeStrict.

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

ℹ️ The vulnerability question is answered well — two minor findings inline, both about invariants stated in the new code not quite matching what it does.

Reviewed changes — the two new commits answer the "which protection wins" question from the first review and repair a settings-parity gap the earlier commits opened.

• Rank the vulnerability re-pick in two tiers instead of gating it — prefer_non_vulnerable_pick now prefers a safe version that clears the age wall, falls back to a safe version whose age is merely undeterminable, and excludes a dated-but-too-new version outright. A confirmed advisory hit is never traded for an unprovable publish date.
• Add the first unit test for the re-pick — covers the undated-beats-vulnerable case and the dated-too-new exclusion on the same fixture shape; make_version / make_packument become pub(crate) so sibling modules can build packuments.
• Give registrySupportsTimeField its WorkspaceConfig field — the earlier commit declared a workspaceYaml source without the matching struct field, which the settings-meta parity self-test rejects. The new values.rs test asserts the value actually resolves rather than merely that the metadata names a real field.
• Rewrite the stale invariant comment on the offline add fallback — add/manifest.rs no longer claims corgi's missing time map keeps versions cutoff-eligible.

The four other threads from the first review are unchanged by these commits and remain open.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

ℹ️ Tier-2 eligibility is !time.contains_key(ver) alone, so it never re-checks exempt_cutoff — the time-based wall this file's own comment at lines 40-44 calls never-droppable, and which pick_version's lenient fallback re-tests explicitly (semver_util.rs:275). An undated candidate can therefore be returned in resolutionMode=time-based even though every other pick path treats that cutoff as absolute.

Adding the wall to the exclusion condition is a no-op whenever time-based mode is off (exempt_cutoff is None, so the helper returns true).

Technical details

# Tier 2 drops the time-based hard wall

## Affected sites
- `vendor/aube/crates/aube-resolver/src/resolve/vulnerable.rs:81-86` — tier-2 admission keys only on the absence of a `time` entry.
- `vendor/aube/crates/aube-resolver/src/resolve/vulnerable.rs:40-44` — the function's own comment states an age-gate-exempt version is "still subject to `exempt_cutoff`, the time-based wall".
- `vendor/aube/crates/aube-resolver/src/semver_util.rs:271-279` — the sibling lenient fallback re-runs `passes_effective_cutoff(ver_str, exempt_cutoff)` before a candidate becomes eligible. Tier 2 is the analogous bucket and does not.
- `vendor/aube/crates/aube-resolver/src/resolve/driver.rs:212-217,781-782,1020-1030` — `exempt_cutoff` is `time_cutoff`, documented as a hard floor that even `minimumReleaseAgeExclude` never relaxes; both cutoffs are forwarded unchanged into the re-pick.

## Required outcome
- A tier-2 candidate clears the time-based wall, so the re-pick cannot select a version that `pick_version` would treat as hard-blocked.
- Behavior outside time-based mode is unchanged.

## Suggested approach
Fold the wall into the exclusion branch so the two paths share one rule:

```rust
} else if packument.time.contains_key(ver_str)
    || !crate::semver_util::version_clears_cutoff(packument, ver_str, exempt_cutoff)
{
    continue;
}
```

## Open questions for the human
- Tier 2 also admits a version that is a HOLE in an otherwise-populated `time` map, which `version_clears_cutoff`'s doc calls "anomalous, never a reason to admit a version" and which `pick_version` excludes under `strict`. Is an anomalous hole meant to rank with a genuinely timeless corgi document, or should tier 2 be restricted to documents carrying no per-version times at all?

Suggested change

	} else if packument.time.contains_key(ver_str) {
	// Dated and too new — excluded outright.
	continue;
	} else {
	&mut best_undated
	};
	} else if packument.time.contains_key(ver_str)
	|| !crate::semver_util::version_clears_cutoff(packument, ver_str, exempt_cutoff)
	{
	// Dated and too new, or short of the time-based hard wall that no
	// age-gate concession ever drops — excluded outright.
	continue;
	} else {
	&mut best_undated
	};

[pullfrog]

Correction for 4a627b7: version_clears_cutoff now takes a fourth strict argument, so the suggested guard is !crate::semver_util::version_clears_cutoff(packument, ver_str, exempt_cutoff, true) — the concern itself is unchanged, since tier-2 eligibility is still !time.contains_key(ver_str) alone.

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

ℹ️ "Reports the age gate instead of silently installing" holds only under minimumReleaseAgeStrict=true. strict is the sole route to AgeGated (semver_util.rs:300), it defaults to false in this crate, and pick_version_for_add passes exempt_cutoff = None while normalizing a gated latest to * — so on the lenient default this path silently returns the lowest version in the whole packument.

The error arm two functions down already concedes this (AgeGated is "only reachable in strict mode today"), so the new comment contradicts a neighbour.

Technical details

# Rewritten invariant comment describes strict mode only

## Affected sites
- `vendor/aube/crates/aube/src/commands/add/manifest.rs:333-337` — claims the corgi fallback "reports the age gate instead of silently installing".
- `vendor/aube/crates/aube-resolver/src/semver_util.rs:300-313` — `if strict || cutoff.is_none()` is the only path returning `PickResult::AgeGated`; otherwise `fallback_lowest` is returned as `Found`.
- `vendor/aube/crates/aube-resolver/src/semver_util.rs:53-57,69-78` — `pick_version_for_add` rewrites a gated `latest` to `*` and passes `exempt_cutoff = None`, so `fallback_lowest` is unfiltered by time and resolves to the lowest version in the packument.
- `vendor/aube/crates/aube-resolver/src/types.rs:44-56` and `vendor/aube/crates/aube-settings/settings.toml:277-292` — `strict` defaults to `false` in standalone aube. `crates/nub-cli/src/pm_engine/mod.rs:2255-2257` overrides it to `true` as an embedder default only, so explicit user config still reaches the lenient path.
- `vendor/aube/crates/aube/src/commands/add/manifest.rs:476-479` — the existing `AgeGated` arm already notes it is "[o]nly reachable in strict mode today (the lenient pick falls back instead)".

## Required outcome
- The comment states both outcomes, so a reader does not conclude the offline fallback is fail-safe under the default configuration.

## Suggested approach
See the inline suggestion. The underlying loose-mode behavior is tracked by the open thread on `semver_util.rs:211`; this is only about the comment agreeing with the code.

Suggested change

	// resolves only what the document's `modified` timestamp
	// proves mature, and otherwise reports the age gate instead
	// of silently installing. Intended: an offline fallback must
	// not be a way around the gate. But it does mean this
	// fallback can now fail where it previously succeeded.
	// resolves only what the document's `modified` timestamp
	// proves mature. Under `minimumReleaseAgeStrict` the rest
	// reports the age gate; under the lenient default the pick
	// drops to the lowest satisfying version instead, silently.
	// Intended: an offline fallback must not be a way around the
	// gate. But it does mean this fallback can now fail, or pick
	// an older version, where it previously succeeded.

[pullfrog]

Correction for 4a627b7: lenient mode now keeps undated versions eligible, so there is no silent lowest-version downgrade here — disregard that half of the suggestion. What remains is that the whole "WEAKER than it once was" paragraph describes strict mode only; under the lenient default this fallback behaves exactly as it did before.

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

Important

Gating on strict is the right shape and resolves the fork-discipline and lenient-downgrade concerns cleanly. One consequence needs a decision before merge: minimumReleaseAgeStrict now decides two different things, and the age-gate error text still tells users to turn it off. Separately, PR #587 already carries this same gate on the same lines.

Reviewed changes — the third commit in this run reworks the wall's terminal case so it is opt-in rather than unconditional.

• Gate the missing-time wall on strict — version_clears_cutoff takes a fourth strict argument and returns modified_proves_maturity || !strict for an undeterminable age. Strict blocks, lenient keeps the version eligible, so standalone aube's out-of-box behavior is unchanged and the age wall becomes the embedder's posture.
• Pin lenient mode with its own test — pick_version_lenient_mode_keeps_undated_versions_eligible asserts 1.1.0, which distinguishes "stayed eligible" from "blocked, then fell back to the lowest" rather than passing either way.
• Hard-code strict = true in the vulnerability re-pick — the re-pick uses the flag to mean "provably mature" for its first-choice tier only, so its two-tier ranking is unaffected by the project's strictness while still never vetoing down to a vulnerable fallback.
• Narrow the pnpm claim — the doc comment and PR body now attribute only the modified upper bound to pnpm 11 and state plainly that the terminal default differs, replacing the earlier three-case parity claim.

ℹ️ PR #587 lands the same gate on the same lines

Commit 5a01418d on the nub-jsonc branch already changes the missing-time arm of pick_version to honor strict, reached from a different direction (an embedder project-config settings tier). Its version has neither the modified upper bound nor the shared helper that routes the vulnerability re-pick through the same wall, so the two branches implement overlapping subsets of one behavior and will conflict on the same closure.

The PR body notes the overlap but not the resolution, and whichever lands second has to reconcile more than a textual conflict — #587's arm blocks every undated version under strict, including ones this branch's modified bound would admit.

Technical details

# Overlapping missing-time gate across two open PRs

## Affected sites
- `vendor/aube/crates/aube-resolver/src/semver_util.rs:218-220` (this branch) — `passes_effective_cutoff` delegates to `version_clears_cutoff(packument, ver, effective, strict)`.
- `vendor/aube/crates/aube-resolver/src/semver_util.rs:164-176` on branch `nub-jsonc`, commit `5a01418d` — the same closure, with `None => !strict` inline and no `modified` fallback.
- `vendor/aube/crates/aube-resolver/src/resolve/vulnerable.rs:51` (this branch only) — the re-pick shares the helper. #587 leaves that path on its own comparator.

## Required outcome
- One branch owns the missing-time gate; the other drops its copy rather than resolving a conflict line-by-line.
- Whichever lands second preserves the `modified` upper bound and the shared-helper wiring, so the two pick paths do not drift again.

## Open questions for the human
- Which PR merges first, and does the other get rebased onto it or have its gate removed?
- Does #587's `revalidate_release_policy` freshness-hash work need the `modified` bound to be present to behave correctly, or is it independent?

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

⚠️ This makes minimumReleaseAgeStrict decide two unrelated things: whether an age-gated range falls back to the lowest satisfying version, and whether an unprovable publish age blocks at all. The age-gate help text (error.rs:317) advertises only the first — "set minimumReleaseAgeStrict=false to fall back to the lowest satisfying version" — so a nub user hitting a time-less mirror follows that advice and silently stops age-checking every undated package, which on such a registry can be the entire tree.

There is also no way left to express "enforce the floor, but tolerate a mirror that omits time", which is what pnpm's dedicated knob provides.

Technical details

# `minimumReleaseAgeStrict` now doubles as the missing-time switch

## Affected sites
- `vendor/aube/crates/aube-resolver/src/semver_util.rs:126` — `modified_proves_maturity || !strict` couples the missing-time posture to the fallback flag.
- `vendor/aube/crates/aube-resolver/src/error.rs:317` — `"to bypass: loosen `minimumReleaseAge` in .npmrc, set `minimumReleaseAgeStrict=false` to fall back to the lowest satisfying version, or add ... to `minimumReleaseAgeExclude`"`. The middle clause now understates what it does.
- `vendor/aube/crates/aube-settings/settings.toml:277-292` — the setting's own documentation describes only the fallback behavior.
- `vendor/aube/crates/aube-manifest/src/workspace/config.rs:541-545` — same, on the typed field.
- `crates/nub-cli/src/pm_engine/mod.rs:2255-2257` — nub pins `minimumReleaseAgeStrict=true`, so nub users are the population that meets the strict block and reads that help text.
- `crates/nub-cli/src/pm_engine/use_nub.rs:286` — `minimumReleaseAgeIgnoreMissingTime` is still warned-and-dropped, so pnpm's own escape hatch for this exact situation is unavailable.

## Required outcome
- Following the age-gate error's advice does not silently widen the change beyond what the advice describes.
- A user can keep the age floor enforced for dated packages while tolerating a registry that omits `time`, or is told plainly that the two are inseparable.
- Wherever `minimumReleaseAgeStrict` is documented, both effects are stated.

## Suggested approach
Either of two directions, not both:

1. Land `minimumReleaseAgeIgnoreMissingTime` as originally planned on [#581](https://github.com/nubjs/nub/issues/581), have `version_clears_cutoff` consult it instead of `strict`, and move the key out of nub's `WARN_TAIL`. This restores the separation and matches pnpm's surface.
2. Keep the coupling, but amend `format_age_gate_help` so a block caused by an undeterminable age says so and names `minimumReleaseAgeExclude` first — the escape that does not weaken the gate for everything else — and update the setting's docs on both the toml and the typed field.

Direction 2 leaves the missing diagnostic distinction from the first review's body section unresolved; direction 1 subsumes it.

## Open questions for the human
- Is coupling to `strict` the intended long-term surface, or a stopgap until the dedicated knob lands?

[colinhacks]

Shipped in v0.7.0: https://github.com/nubjs/nub/releases/tag/v0.7.0