Capture created_at metadata on EndpointSpecification

The cooldown feature needs each gem version's publish timestamp on the
client side. Compact index v2 exposes it as a `created_at:ISO8601`
entry in the info-line metadata; expose a Time-typed `created_at`
attribute on the spec so the resolver can consult it later.

Parsing is defensive against older rubygems whose APISet GemParser
splits ISO8601 timestamps on every colon, accepting both Array and
flat String shapes and silently dropping malformed values. The time
stdlib is required lazily inside the case branch so loading the file
does not activate the `time` default gem during Bundler.setup.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: hsbt

bundler/lib/bundler/endpoint_specification.rb

@@ -5,7 +5,7 @@ module Bundler
   class EndpointSpecification < Gem::Specification
     include MatchRemoteMetadata
 
-    attr_reader :name, :version, :platform, :checksum
+    attr_reader :name, :version, :platform, :checksum, :created_at
     attr_writer :dependencies
     attr_accessor :remote, :locked_platform
 
@@ -145,6 +145,7 @@ def parse_metadata(data)
       unless data
         @required_ruby_version = nil
         @required_rubygems_version = nil
+        @created_at = nil
         return
       end
 
@@ -161,6 +162,16 @@ def parse_metadata(data)
           @required_rubygems_version = Gem::Requirement.new(v)
         when "ruby"
           @required_ruby_version = Gem::Requirement.new(v)
+        when "created_at"
+          value = v.is_a?(Array) ? v.last : v
+          if value.is_a?(String)
+            require "time"
+            begin
+              @created_at = Time.iso8601(value)
+            rescue ArgumentError
+              @created_at = nil
+            end
+          end
         end
       end
     rescue StandardError => e

spec/bundler/endpoint_specification_spec.rb

@@ -46,6 +46,46 @@
         )
       end
     end
+
+    context "when the metadata has created_at" do
+      let(:metadata) { { "created_at" => ["2026-05-12T10:00:00Z"] } }
+
+      it "parses created_at as a Time" do
+        expect(subject.created_at).to eq(Time.utc(2026, 5, 12, 10, 0, 0))
+      end
+    end
+
+    context "when the metadata has a string created_at (older rubygems shape)" do
+      let(:metadata) { { "created_at" => "2026-05-12T10:00:00Z" } }
+
+      it "still parses created_at" do
+        expect(subject.created_at).to eq(Time.utc(2026, 5, 12, 10, 0, 0))
+      end
+    end
+
+    context "when created_at is truncated (older rubygems splits on colons)" do
+      let(:metadata) { { "created_at" => "2026-05-12T10" } }
+
+      it "leaves created_at as nil instead of raising" do
+        expect(subject.created_at).to be_nil
+      end
+    end
+
+    context "when the metadata has no created_at" do
+      let(:metadata) { { "checksum" => ["abc"] } }
+      let(:spec_fetcher) { double(:spec_fetcher, uri: "https://rubygems.org") }
+
+      it "leaves created_at as nil" do
+        allow(Bundler::Checksum).to receive(:from_api).and_return(nil)
+        expect(subject.created_at).to be_nil
+      end
+    end
+
+    context "when the metadata is nil" do
+      it "leaves created_at as nil" do
+        expect(subject.created_at).to be_nil
+      end
+    end
   end
 
   describe "#required_ruby_version" do