resolving/npm-resolver/src/fetchAttestationPublishedAt.ts (1)

35-40: ⚡ Quick win

Reduce positional parameters in fetchAttestationPublishedAt

This signature currently uses 4 positional args; please collapse pkgName + version into a single options object to match repo conventions and make call sites less error-prone.

♻️ Proposed refactor

 export async function fetchAttestationPublishedAt (
   fetchOpts: FetchMetadataFromFromRegistryOptions,
-  pkgName: string,
-  version: string,
+  spec: { pkgName: string, version: string },
   opts: FetchAttestationOptions
 ): Promise<string | undefined> {
-  const url = `${opts.registry.replace(/\/$/, '')}/-/npm/v1/attestations/${pkgName}@${version}`
+  const url = `${opts.registry.replace(/\/$/, '')}/-/npm/v1/attestations/${spec.pkgName}@${spec.version}`
   const retryOperation = retry.operation(fetchOpts.retry)
   return new Promise<string | undefined>((resolve) => {

As per coding guidelines: "Functions should have no more than two or three arguments. If a function needs more parameters, use a single options object instead."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@resolving/npm-resolver/src/fetchAttestationPublishedAt.ts` around lines 35 -
40, The function fetchAttestationPublishedAt currently takes four positional
args; change its signature to accept (fetchOpts:
FetchMetadataFromFromRegistryOptions, pkg: { name: string; version: string } |
PackageIdentifier, opts: FetchAttestationOptions) so pkgName and version are
collapsed into a single package identifier object (or define a PackageIdentifier
type), then update the implementation to read pkg.name and pkg.version and
update all call sites to pass the new object instead of two separate strings;
also update any related type definitions/imports (and tests) that reference
fetchAttestationPublishedAt to use the new parameter shape.

resolving/npm-resolver/src/createNpmResolutionVerifier.ts (1)

245-250: ⚡ Quick win

Collapse (registry, name, version) into one lookup object in helper signatures

The new helper pair repeats 4 positional parameters; wrapping the package lookup fields into a single object will align with project conventions and reduce call-site churn.

♻️ Proposed refactor

+interface PublishedAtLookupKey {
+  registry: string
+  name: string
+  version: string
+}
+
 async function fetchPublishedAt (
   context: PublishedAtLookupContext,
-  registry: string,
-  name: string,
-  version: string
+  key: PublishedAtLookupKey
 ): Promise<string | undefined> {
-  const cacheKey = `${registry}\x00${name}\x00${version}`
+  const cacheKey = `${key.registry}\x00${key.name}\x00${key.version}`
   let cachedPromise = context.publishedAtCache.get(cacheKey)
   if (cachedPromise == null) {
-    cachedPromise = resolvePublishedAt(context, registry, name, version)
+    cachedPromise = resolvePublishedAt(context, key)
     context.publishedAtCache.set(cacheKey, cachedPromise)
   }
   return cachedPromise
 }

 async function resolvePublishedAt (
   context: PublishedAtLookupContext,
-  registry: string,
-  name: string,
-  version: string
+  key: PublishedAtLookupKey
 ): Promise<string | undefined> {
-  const abbreviatedShortcut = await tryAbbreviatedModifiedShortcut(context, registry, name)
+  const abbreviatedShortcut = await tryAbbreviatedModifiedShortcut(context, key.registry, key.name)
   if (abbreviatedShortcut != null) return abbreviatedShortcut

-  const localTime = await readLocalMetaTime(context, registry, name)
-  if (localTime?.[version]) return localTime[version]
+  const localTime = await readLocalMetaTime(context, key.registry, key.name)
+  if (localTime?.[key.version]) return localTime[key.version]

As per coding guidelines: "Functions should have no more than two or three arguments. If a function needs more parameters, use a single options object instead."

Also applies to: 260-265

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@resolving/npm-resolver/src/createNpmResolutionVerifier.ts` around lines 245 -
250, Collapse the repeated positional parameters (registry, name, version) into
a single lookup object in the helper signatures: change
fetchPublishedAt(context: PublishedAtLookupContext, registry: string, name:
string, version: string) to accept a single lookup parameter (e.g., lookup: {
registry: string; name: string; version: string }) plus the context, update the
function body to use lookup.registry/lookup.name/lookup.version, and update all
call sites accordingly; apply the same refactor to the other helper in the file
that accepts the same three parameters (the helper around lines 260-265) so both
signatures and callers use the unified lookup object.

.changeset/attestation-first-min-release-age.md (1)

8-8: ⚡ Quick win

Clarify the fallback flow description.

The current wording suggests that both "local mirror has timestamp" and "attestation 404s/errors" trigger a fallback, but per the stack context, the local mirror is checked before the attestation endpoint is tried. If the local mirror has the timestamp, attestation is never attempted (no fallback needed). The actual fallback is: when the local mirror is cold and the attestation endpoint fails (404/errors), then the full metadata is fetched.

Consider rewording to: "The publish time comes from bundle.verificationMaterial.tlogEntries[].integratedTime (the Rekor inclusion time, a couple of seconds after the actual publish — close enough for a policy that operates in minutes/hours/days). The attestation endpoint is tried when the local full-metadata mirror is cold; if the endpoint returns 404 or errors, the verifier fetches the full metadata document. Sigstore signature verification is not performed; the trust model is unchanged versus reading the registry's time field #11687."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.changeset/attestation-first-min-release-age.md at line 8, The paragraph
should be rewritten to clarify order: state that publish time is taken from
bundle.verificationMaterial.tlogEntries[].integratedTime, that the verifier
checks the local full-metadata mirror first and only tries the attestation
endpoint when the local mirror is cold, and that if the attestation endpoint
returns 404 or errors the verifier falls back to the existing
fetchFullMetadataCached path; also keep the note that Sigstore signature
verification is not performed and the trust model is unchanged versus reading
the registry's time field.