feat(npm): publishing-trust ranking and no-downgrade trust policy (#34927)

This teaches Deno's npm resolver about how a package version was
published and adds an opt-in `no-downgrade` trust policy, following
pnpm's implementation (`resolving/npm-resolver/src/trustChecks.ts`)
closely.

npm's full packument exposes whether a version was published via trusted
publishing (OIDC, `_npmUser.trustedPublisher`), carries a provenance
attestation (`dist.attestations.provenance`), or went through staged
publishing (`_npmUser.approver`, a maintainer approving with a live 2FA
challenge). Each version's strongest signal is ranked into a single
trust level. The tiers are mutually exclusive and mirror pnpm: a staged
publish is strongest, then trusted publishing *backed by* a provenance
attestation, then a provenance attestation on its own. A
`trustedPublisher` flag without provenance is deliberately not counted,
since on its own it is just metadata a future staged-publish flow could
mint.

The `no-downgrade` policy, enabled with `trust-policy=no-downgrade` in
`.npmrc`, refuses to resolve a version whose trust evidence is weaker
than the strongest evidence on any earlier-published version of the same
package. The comparison is by publish date, not semver, exactly as
pnpm does it: if a package has been published through trusted publishing
or with provenance and a later version suddenly appears as a plain token
publish, that is a strong signal of a stolen maintainer token, and the
policy turns it into a hard error instead of a silent install. When a
downgrade is the only thing blocking resolution, the resolver returns a
dedicated error explaining the rejection and how to override it, rather
than silently falling back to an older version.

The motivation is supply-chain safety. This is the same defense that
would have caught the August 2025 s1ngularity incident, where a package
consistently published through CI was suddenly published from a laptop
with basic credentials.

The trust signals only exist in the full packument. Enabling the policy
fetches the full packument, but `min-release-age` already makes Deno do
that by default, so in the common case there is no extra fetch. To keep
the cached `registry.json` small, the never-read signal objects
(`_npmUser.approver`, `_npmUser.trustedPublisher`,
`dist.attestations.provenance`) are reduced to a one-byte presence
marker before the packument is cached.

A `trust-policy-ignore-after` setting (in minutes, mirroring pnpm's
`trustPolicyIgnoreAfter`) skips the check for versions published more
than that long ago, so genuinely pre-provenance releases still install.
It is turned into an absolute cutoff in the resolver factory so the
resolver stays free of a wall clock.

Coverage: tiered ranking, the publish-date downgrade scan (including
prerelease exclusion and the ignore-after cutoff), the targeted
downgrade error, and compact cache serialization are covered by resolver
unit tests. An end-to-end spec test installs a package whose newer
version downgrades from a staged publish to a plain publish and asserts
the install is rejected, plus a spec test that the cache keeps compact
markers. The test npm registry now preserves `dist.attestations` from
fixtures so provenance is exercisable end to end.

Unlike pnpm, the trust level is not persisted to the lockfile: the
policy recomputes the baseline from the packument's version history on
each resolution, so existing lockfiles are unaffected.

A `trust-policy-exclude[]` setting (mirroring pnpm's
`trustPolicyExclude`) exempts named packages from the policy: repeated
`trust-policy-exclude[]=<package>` entries in `.npmrc` list packages
that resolve as if the policy were off. Home and project excludes are
unioned.

The policy is opt-in and stays off by default. Provenance, trusted
publishing and staged publishing are still unevenly adopted across the
registry, so enabling `no-downgrade` by default would turn legitimate
trust-evidence gaps into hard install failures; it can be revisited
once adoption is high.

Author: bartlomieju

cli/factory.rs

@@ -574,11 +574,20 @@ impl CliFactory {
     self.services.npm_installer_factory.get_or_try_init(|| {
       let cli_options = self.cli_options()?;
       let resolver_factory = self.resolver_factory()?;
-      let needs_full_packument = resolver_factory
-        .minimum_dependency_age_config()
+      // the `no-downgrade` trust policy reads `_npmUser`/`attestations`, which
+      // are only present in the full packument
+      let needs_full_packument_for_trust = resolver_factory
+        .workspace_factory()
+        .npmrc()
         .ok()
-        .and_then(|c| c.age.as_ref().and_then(|d| d.into_option()))
-        .is_some();
+        .map(|rc| rc.trust_policy != deno_npmrc::TrustPolicyConfig::Off)
+        .unwrap_or(false);
+      let needs_full_packument = needs_full_packument_for_trust
+        || resolver_factory
+          .minimum_dependency_age_config()
+          .ok()
+          .and_then(|c| c.age.as_ref().and_then(|d| d.into_option()))
+          .is_some();
       Ok(CliNpmInstallerFactory::new(
         resolver_factory.clone(),
         Arc::new(CliNpmCacheHttpClient::new(

cli/lsp/language_server.rs

@@ -637,6 +637,7 @@ impl Inner {
         link_packages: Default::default(),
         newest_dependency_date_options: Default::default(),
         overrides: Default::default(),
+        trust_policy: Default::default(),
       }),
     );
     let config = Config::default();
@@ -864,6 +865,7 @@ impl Inner {
         link_packages: Default::default(),
         newest_dependency_date_options: Default::default(),
         overrides: Default::default(),
+        trust_policy: Default::default(),
       }),
     );
     self.performance.measure(mark);

cli/lsp/resolver.rs

@@ -1117,6 +1117,7 @@ impl<'a> ResolverFactory<'a> {
         link_packages: link_packages.0.clone(),
         newest_dependency_date_options: Default::default(),
         overrides: Arc::new(overrides),
+        trust_policy: Default::default(),
       });
       let npm_resolution_installer = Arc::new(NpmResolutionInstaller::new(
         Default::default(),

cli/rt/run.rs

@@ -1360,6 +1360,9 @@ pub async fn run_with_options(
         scopes: Default::default(),
         registry_configs: Default::default(),
         min_release_age_days: None,
+        trust_policy: Default::default(),
+        trust_policy_ignore_after_minutes: None,
+        trust_policy_exclude: Vec::new(),
       });
       let npm_cache_dir = Arc::new(NpmCacheDir::new(
         &sys,
@@ -1951,6 +1954,9 @@ fn create_default_npmrc() -> Arc<ResolvedNpmRc> {
     scopes: Default::default(),
     registry_configs: Default::default(),
     min_release_age_days: None,
+    trust_policy: Default::default(),
+    trust_policy_ignore_after_minutes: None,
+    trust_policy_exclude: Vec::new(),
   })
 }
 

cli/tools/installer/global.rs

@@ -2451,6 +2451,9 @@ mod tests {
       scopes,
       registry_configs: Default::default(),
       min_release_age_days: None,
+      trust_policy: Default::default(),
+      trust_policy_ignore_after_minutes: None,
+      trust_policy_exclude: Vec::new(),
     })
   }
 

libs/npm/benches/bench.rs

@@ -198,6 +198,7 @@ async fn run_resolver_and_get_snapshot(
     link_packages: Default::default(),
     newest_dependency_date_options: Default::default(),
     overrides: Default::default(),
+    trust_policy: Default::default(),
   };
   let result = snapshot
     .add_pkg_reqs(

libs/npm/examples/min_repro_solver.rs

@@ -299,6 +299,7 @@ async fn run_resolver_and_get_snapshot(
     link_packages: Default::default(),
     newest_dependency_date_options: Default::default(),
     overrides: Default::default(),
+    trust_policy: Default::default(),
   };
   let result = snapshot
     .add_pkg_reqs(

libs/npm/registry.rs

@@ -246,9 +246,81 @@ pub struct NpmPackageVersionInfo {
   #[serde(default, skip_serializing_if = "Option::is_none")]
   #[serde(deserialize_with = "deserializers::string")]
   pub deprecated: Option<String>,
+  /// The `_npmUser` field from the full packument. Identifies who published
+  /// the version and carries the `trustedPublisher` (OIDC trusted publishing)
+  /// and `approver` (staged publish) trust signals. Only present in the full
+  /// packument.
+  #[serde(
+    default,
+    rename = "_npmUser",
+    skip_serializing_if = "Option::is_none"
+  )]
+  pub npm_user: Option<NpmUser>,
+}
+
+/// A presence marker for a registry field whose mere existence is the signal
+/// we care about (`_npmUser.approver`, `_npmUser.trustedPublisher`,
+/// `dist.attestations.provenance`). The full packument carries large objects
+/// here, but [`NpmPackageVersionInfo::get_trust_evidence`] only checks whether
+/// they are present, so this discards the contents on deserialize and
+/// re-serializes compactly as `true`. That keeps the cached packument small
+/// even though `min-release-age` makes Deno fetch the full packument by
+/// default.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Present;
+
+impl Serialize for Present {
+  fn serialize<S: serde::Serializer>(
+    &self,
+    serializer: S,
+  ) -> Result<S::Ok, S::Error> {
+    serializer.serialize_bool(true)
+  }
+}
+
+impl<'de> Deserialize<'de> for Present {
+  fn deserialize<D: serde::Deserializer<'de>>(
+    deserializer: D,
+  ) -> Result<Self, D::Error> {
+    serde::de::IgnoredAny::deserialize(deserializer)?;
+    Ok(Present)
+  }
 }
 
 impl NpmPackageVersionInfo {
+  /// The strongest publishing-trust evidence this version exposes, derived
+  /// from registry metadata signals. Used by the `no-downgrade` trust policy.
+  ///
+  /// Mirrors pnpm's
+  /// [`getTrustEvidence`](https://github.com/pnpm/pnpm/blob/main/resolving/npm-resolver/src/trustChecks.ts).
+  /// The tiers are mutually exclusive: a staged publish (`_npmUser.approver`)
+  /// is strongest, then trusted publishing (`_npmUser.trustedPublisher`)
+  /// *backed by* a provenance attestation, then a provenance attestation on
+  /// its own. A `trustedPublisher` flag without a provenance attestation is
+  /// not counted: on its own it is just metadata a future staged-publish flow
+  /// could mint, so it only counts as the stronger signal when the version
+  /// also shipped provenance.
+  pub fn get_trust_evidence(&self) -> Option<TrustEvidence> {
+    let npm_user = self.npm_user.as_ref();
+    if npm_user.is_some_and(|u| u.approver.is_some()) {
+      return Some(TrustEvidence::StagedPublish);
+    }
+    let has_provenance = self
+      .dist
+      .as_ref()
+      .and_then(|d| d.attestations.as_ref())
+      .is_some_and(|a| a.provenance.is_some());
+    let has_trusted_publisher =
+      npm_user.is_some_and(|u| u.trusted_publisher.is_some());
+    if has_trusted_publisher && has_provenance {
+      return Some(TrustEvidence::TrustedPublisher);
+    }
+    if has_provenance {
+      return Some(TrustEvidence::Provenance);
+    }
+    None
+  }
+
   /// Helper for getting the bundle dependencies.
   ///
   /// Unfortunately due to limitations in serde, it's not
@@ -445,6 +517,82 @@ pub struct NpmPackageVersionDistInfo {
   pub(crate) shasum: Option<String>,
   #[serde(default, skip_serializing_if = "Option::is_none")]
   pub(crate) integrity: Option<String>,
+  /// Cryptographic attestations for this version (provenance, publish).
+  /// Only present in the full packument.
+  #[serde(default, skip_serializing_if = "Option::is_none")]
+  pub attestations: Option<NpmAttestations>,
+}
+
+/// The `_npmUser` object from the full packument. Only the presence of
+/// `trustedPublisher` and `approver` are trust signals; the `name` and other
+/// fields are dropped on deserialize to keep the cached packument small.
+#[derive(Debug, Default, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct NpmUser {
+  /// Present when the version was published via npm trusted publishing
+  /// (OIDC). Its contents identify the CI provider and workflow.
+  #[serde(
+    default,
+    rename = "trustedPublisher",
+    skip_serializing_if = "Option::is_none"
+  )]
+  pub trusted_publisher: Option<Present>,
+  /// Present when the version went through npm staged publishing: a maintainer
+  /// approved it with a live 2FA challenge before it became installable. This
+  /// is the strongest publishing-trust signal.
+  /// See https://docs.npmjs.com/staged-publishing/
+  #[serde(default, skip_serializing_if = "Option::is_none")]
+  pub approver: Option<Present>,
+}
+
+/// The `dist.attestations` object from the full packument.
+#[derive(Debug, Default, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct NpmAttestations {
+  /// SLSA provenance attestation linking the package to the source commit and
+  /// build. Present when the version was published with `--provenance`.
+  #[serde(default, skip_serializing_if = "Option::is_none")]
+  pub provenance: Option<Present>,
+}
+
+/// The strongest publishing-trust evidence a package version exposes, derived
+/// from registry metadata. Variants are declared weakest-first so the derived
+/// `Ord` matches the trust rank. The `no-downgrade` trust policy refuses to
+/// resolve a version whose evidence is weaker than the strongest evidence on
+/// any earlier-published version of the same package.
+///
+/// "No evidence" is represented as `Option::None` rather than a variant here,
+/// matching pnpm's `undefined`; compare ranks via
+/// `Option::map_or(0, TrustEvidence::rank)`.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub enum TrustEvidence {
+  /// `dist.attestations.provenance` is set (published with `--provenance`).
+  Provenance,
+  /// `_npmUser.trustedPublisher` is set alongside a provenance attestation:
+  /// published via OIDC-backed trusted publishing.
+  TrustedPublisher,
+  /// `_npmUser.approver` is set: a staged publish requiring a 2FA approval.
+  /// The strongest signal.
+  StagedPublish,
+}
+
+impl TrustEvidence {
+  /// The numeric trust rank, mirroring pnpm's `TRUST_RANK` weights. Higher is
+  /// more trusted; "no evidence" is rank `0`.
+  pub fn rank(self) -> u8 {
+    match self {
+      TrustEvidence::Provenance => 1,
+      TrustEvidence::TrustedPublisher => 2,
+      TrustEvidence::StagedPublish => 3,
+    }
+  }
+
+  /// Human-readable description for diagnostics.
+  pub fn pretty(self) -> &'static str {
+    match self {
+      TrustEvidence::Provenance => "provenance attestation",
+      TrustEvidence::TrustedPublisher => "trusted publisher",
+      TrustEvidence::StagedPublish => "staged publish",
+    }
+  }
 }
 
 impl NpmPackageVersionDistInfo {
@@ -1108,12 +1256,101 @@ mod test {
           tarball: "value".to_string(),
           shasum: None,
           integrity: None,
+          attestations: None,
         }),
         ..Default::default()
       }
     );
   }
 
+  #[test]
+  fn trust_evidence_ranking() {
+    fn trust_of(json: &str) -> Option<TrustEvidence> {
+      let info: NpmPackageVersionInfo = serde_json::from_str(json).unwrap();
+      info.get_trust_evidence()
+    }
+
+    // plain token publish: no signals
+    assert_eq!(trust_of(r#"{ "version": "1.0.0" }"#), None);
+
+    // provenance attestation only
+    assert_eq!(
+      trust_of(
+        r#"{ "version": "1.0.0", "dist": { "tarball": "t", "attestations": { "provenance": { "predicateType": "x" } } } }"#,
+      ),
+      Some(TrustEvidence::Provenance)
+    );
+
+    // trusted publishing WITHOUT a provenance attestation is not counted: on
+    // its own the flag is just metadata, mirroring pnpm's getTrustEvidence.
+    assert_eq!(
+      trust_of(
+        r#"{ "version": "1.0.0", "_npmUser": { "name": "ci", "trustedPublisher": { "id": "github" } } }"#,
+      ),
+      None
+    );
+
+    // trusted publishing backed by a provenance attestation
+    assert_eq!(
+      trust_of(
+        r#"{ "version": "1.0.0", "_npmUser": { "trustedPublisher": { "id": "github" } }, "dist": { "tarball": "t", "attestations": { "provenance": {} } } }"#,
+      ),
+      Some(TrustEvidence::TrustedPublisher)
+    );
+
+    // staged publish (human-approved via 2FA) is strongest
+    assert_eq!(
+      trust_of(
+        r#"{ "version": "1.0.0", "_npmUser": { "approver": { "name": "maintainer" } } }"#,
+      ),
+      Some(TrustEvidence::StagedPublish)
+    );
+
+    // ranks are ordered: provenance < trusted publisher < staged publish
+    assert!(TrustEvidence::Provenance < TrustEvidence::TrustedPublisher);
+    assert!(TrustEvidence::TrustedPublisher < TrustEvidence::StagedPublish);
+    assert_eq!(TrustEvidence::Provenance.rank(), 1);
+    assert_eq!(TrustEvidence::TrustedPublisher.rank(), 2);
+    assert_eq!(TrustEvidence::StagedPublish.rank(), 3);
+  }
+
+  #[test]
+  fn trust_signals_serialize_compactly() {
+    // The full packument carries large objects in `_npmUser.approver`,
+    // `_npmUser.trustedPublisher` and `dist.attestations.provenance`, but we
+    // only care that they exist. Re-serializing (as the registry cache does)
+    // must collapse them to compact markers and still preserve the trust
+    // evidence, so caching the full packument by default stays cheap.
+    let info: NpmPackageVersionInfo = serde_json::from_str(
+      r#"{
+        "version": "1.0.0",
+        "_npmUser": { "name": "ci", "trustedPublisher": { "id": "github", "oidcConfigId": "abc" } },
+        "dist": { "tarball": "t", "attestations": { "url": "https://example/att", "provenance": { "predicateType": "https://slsa.dev/provenance/v1" } } }
+      }"#,
+    )
+    .unwrap();
+
+    let serialized = serde_json::to_string(&info).unwrap();
+    assert!(
+      serialized.contains(r#""trustedPublisher":true"#),
+      "{serialized}"
+    );
+    assert!(serialized.contains(r#""provenance":true"#), "{serialized}");
+    // none of the dropped sub-fields survive
+    assert!(!serialized.contains("oidcConfigId"), "{serialized}");
+    assert!(!serialized.contains("predicateType"), "{serialized}");
+    assert!(!serialized.contains("\"name\""), "{serialized}");
+
+    // and the trust evidence round-trips through the slimmed form
+    let reparsed: NpmPackageVersionInfo =
+      serde_json::from_str(&serialized).unwrap();
+    assert_eq!(reparsed.get_trust_evidence(), info.get_trust_evidence());
+    assert_eq!(
+      reparsed.get_trust_evidence(),
+      Some(TrustEvidence::TrustedPublisher)
+    );
+  }
+
   #[test]
   fn deserializes_serializes_time() {
     let text = r#"{ "name": "package", "versions": {}, "time": { "created": "2015-11-07T19:15:58.747Z", "1.0.0": "2015-11-07T19:15:58.747Z" } }"#;
@@ -1148,6 +1385,7 @@ mod test {
           tarball: "value".to_string(),
           shasum: Some("test".to_string()),
           integrity: None,
+          attestations: None,
         }),
         dependencies: HashMap::new(),
         deprecated: Some("aa".to_string()),
@@ -1185,6 +1423,7 @@ mod test {
             tarball: "value".to_string(),
             shasum: Some("test".to_string()),
             integrity: None,
+            attestations: None,
           }),
           dependencies: HashMap::new(),
           deprecated: None,
@@ -1564,6 +1803,7 @@ mod test {
       scripts: Default::default(),
       has_install_script: Default::default(),
       deprecated: Default::default(),
+      npm_user: Default::default(),
     };
     let text = serde_json::to_string(&data).unwrap();
     assert_eq!(text, r#"{"version":"1.0.0"}"#);
@@ -1575,6 +1815,7 @@ mod test {
       tarball: "test".to_string(),
       shasum: None,
       integrity: None,
+      attestations: None,
     };
     let text = serde_json::to_string(&data).unwrap();
     assert_eq!(text, r#"{"tarball":"test"}"#);