@pnpm/cli.default-reporter 1100.1.1 → 1100.2.0

package/lib/index.js

@@ -69,6 +69,7 @@ export function toOutput$(opts) {
     const deprecationPushStream = new Rx.Subject();
     const summaryPushStream = new Rx.Subject();
     const lifecyclePushStream = new Rx.Subject();
+    const lockfileVerificationPushStream = new Rx.Subject();
     const statsPushStream = new Rx.Subject();
     const packageImportMethodPushStream = new Rx.Subject();
     const installCheckPushStream = new Rx.Subject();
@@ -112,6 +113,9 @@ export function toOutput$(opts) {
                 case 'pnpm:lifecycle':
                     lifecyclePushStream.next(log);
                     break;
+                case 'pnpm:lockfile-verification':
+                    lockfileVerificationPushStream.next(log);
+                    break;
                 case 'pnpm:stats':
                     statsPushStream.next(log);
                     break;
@@ -185,6 +189,7 @@ export function toOutput$(opts) {
         ignoredScripts: Rx.from(ignoredScriptsPushStream),
         lifecycle: Rx.from(lifecyclePushStream),
         link: Rx.from(linkPushStream),
+        lockfileVerification: Rx.from(lockfileVerificationPushStream),
         other,
         packageImportMethod: Rx.from(packageImportMethodPushStream),
         packageManifest: Rx.from(packageManifestPushStream),

package/lib/reportError.js

@@ -51,6 +51,11 @@ function getErrorInfo(logObj, config) {
                 return { title: err.message, body: 'If you cannot fix this registry issue, then set "resolution-mode" to "highest".' };
             case 'ERR_PNPM_NO_MATCHING_VERSION':
             case 'ERR_PNPM_NO_MATURE_MATCHING_VERSION':
+                // ERR_PNPM_NO_MATURE_MATCHING_VERSION used to come from the resolver
+                // with `packageMeta` attached; it now comes from the install / dlx /
+                // self-update callers as a plain PnpmError once the resolver has
+                // surfaced the violations. `packageMeta` may be undefined, in which
+                // case the formatter falls back to the bare title+message.
                 return formatNoMatchingVersion(err, logObj);
             case 'ERR_PNPM_RECURSIVE_FAIL':
                 return formatRecursiveCommandSummary(logObj); // eslint-disable-line @typescript-eslint/no-explicit-any
@@ -94,10 +99,17 @@ ${formatPkgNameVer(pkgsStack[0])}\
 ${pkgsStack.slice(1).map((pkgInfo) => `${EOL} at ${formatPkgNameVer(pkgInfo)}`).join('')}`;
 }
 function formatNoMatchingVersion(err, msg) {
+    // Errors raised by the install/dlx/self-update layer after the resolver
+    // surfaces violations may not carry the original packageMeta. In that
+    // case the error message alone already names every offending entry,
+    // so we just echo it through without the registry-metadata appendix.
     const meta = msg.packageMeta;
+    if (!meta) {
+        return { title: err.message };
+    }
     const latestVersion = meta['dist-tags'].latest;
     let output = `The latest release of ${meta.name} is "${latestVersion}".`;
-    const latestTime = msg.packageMeta.time?.[latestVersion];
+    const latestTime = meta.time?.[latestVersion];
     if (latestTime) {
         output += ` Published at ${stringifyDate(latestTime)}`;
     }
@@ -108,7 +120,7 @@ function formatNoMatchingVersion(err, msg) {
             if (tag !== 'latest') {
                 const version = meta['dist-tags'][tag];
                 output += `  * ${tag}: ${version}`;
-                const time = msg.packageMeta.time?.[version];
+                const time = meta.time?.[version];
                 if (time) {
                     output += ` published at ${stringifyDate(time)}`;
                 }
@@ -117,9 +129,6 @@ function formatNoMatchingVersion(err, msg) {
         }
     }
     output += `${EOL}If you need the full list of all ${Object.keys(meta.versions).length} published versions run "pnpm view ${meta.name} versions".`;
-    if (msg.immatureVersion) {
-        output += `${EOL}${EOL}If you want to install the matched version ignoring the time it was published, you can add the package name to the minimumReleaseAgeExclude setting. Read more about it: https://pnpm.io/settings#minimumreleaseageexclude`;
-    }
     return {
         title: err.message,
         body: output,

package/lib/reporterForClient/index.d.ts

@@ -13,6 +13,7 @@ export declare function reporterForClient(log$: {
     deprecation: Rx.Observable<logs.DeprecationLog>;
     summary: Rx.Observable<logs.SummaryLog>;
     lifecycle: Rx.Observable<logs.LifecycleLog>;
+    lockfileVerification: Rx.Observable<logs.LockfileVerificationLog>;
     stats: Rx.Observable<logs.StatsLog>;
     installCheck: Rx.Observable<logs.InstallCheckLog>;
     installingConfigDeps: Rx.Observable<logs.InstallingConfigDepsLog>;

package/lib/reporterForClient/index.js

@@ -8,6 +8,7 @@ import { reportIgnoredBuilds } from './reportIgnoredBuilds.js';
 import { reportInstallChecks } from './reportInstallChecks.js';
 import { reportInstallingConfigDeps } from './reportInstallingConfigDeps.js';
 import { reportLifecycleScripts } from './reportLifecycleScripts.js';
+import { reportLockfileVerification } from './reportLockfileVerification.js';
 import { LOG_LEVEL_NUMBER, reportMisc } from './reportMisc.js';
 import { reportPeerDependencyIssues } from './reportPeerDependencyIssues.js';
 import { reportProgress } from './reportProgress.js';
@@ -60,7 +61,10 @@ export function reporterForClient(log$, opts) {
             hideLifecyclePrefix: opts.hideLifecyclePrefix,
             cwd,
             width,
-        }), reportInstallChecks(log$.installCheck, { cwd }), reportInstallingConfigDeps(log$.installingConfigDeps), reportScope(log$.scope, { isRecursive: opts.isRecursive, cmd: opts.cmd }), reportSkippedOptionalDependencies(log$.skippedOptionalDependency, { cwd }), reportHooks(log$.hook, { cwd, isRecursive: opts.isRecursive }), reportUpdateCheck(log$.updateCheck, opts), reportProgress(log$, {
+        }), reportInstallChecks(log$.installCheck, { cwd }), reportInstallingConfigDeps(log$.installingConfigDeps), reportLockfileVerification(log$.lockfileVerification, {
+            cwd,
+            workspaceDir: opts.pnpmConfig?.workspaceDir,
+        }), reportScope(log$.scope, { isRecursive: opts.isRecursive, cmd: opts.cmd }), reportSkippedOptionalDependencies(log$.skippedOptionalDependency, { cwd }), reportHooks(log$.hook, { cwd, isRecursive: opts.isRecursive }), reportUpdateCheck(log$.updateCheck, opts), reportProgress(log$, {
             cwd,
             throttle,
             hideAddedPkgsProgress: opts.hideAddedPkgsProgress,

package/lib/reporterForClient/reportLockfileVerification.d.ts

@@ -0,0 +1,15 @@
+import type { LockfileVerificationLog } from '@pnpm/core-loggers';
+import * as Rx from 'rxjs';
+export interface ReportLockfileVerificationOptions {
+    cwd: string;
+    /**
+     * The workspace root, when one exists. Used as the "expected"
+     * location for the lockfile — when the lockfile lives there, the
+     * path is implied and we don't repeat it in the rendered message.
+     * Falls back to `cwd` for single-project installs.
+     */
+    workspaceDir?: string;
+}
+export declare function reportLockfileVerification(lockfileVerification$: Rx.Observable<LockfileVerificationLog>, opts: ReportLockfileVerificationOptions): Rx.Observable<Rx.Observable<{
+    msg: string;
+}>>;

package/lib/reporterForClient/reportLockfileVerification.js

@@ -0,0 +1,56 @@
+import path from 'node:path';
+import chalk from 'chalk';
+import normalize from 'normalize-path';
+import prettyMs from 'pretty-ms';
+import * as Rx from 'rxjs';
+import { map } from 'rxjs/operators';
+export function reportLockfileVerification(lockfileVerification$, opts) {
+    const expectedDir = opts.workspaceDir ?? opts.cwd;
+    // A single inner observable so the `done` message overwrites the
+    // transient `started` message in ansi-diff mode. In appendOnly mode
+    // both lines are printed.
+    return Rx.of(lockfileVerification$.pipe(map((log) => {
+        const path_ = formatLockfilePath(log.lockfilePath, opts.cwd, expectedDir);
+        const entries = `${log.entries} ${log.entries === 1 ? 'entry' : 'entries'}`;
+        switch (log.status) {
+            case 'started':
+                return {
+                    msg: `${chalk.cyan('?')} Verifying lockfile${path_} against supply-chain policies (${entries})...`,
+                };
+            case 'done':
+                return {
+                    msg: `${chalk.green('✓')} Lockfile${path_} passes supply-chain policies (${entries} in ${prettyMs(log.elapsedMs)})`,
+                };
+            case 'failed':
+                // Brief one-liner so the transient `started` frame doesn't
+                // stay on screen above the detailed PnpmError block that the
+                // error reporter prints next.
+                return {
+                    msg: `${chalk.red('✗')} Lockfile${path_} failed supply-chain policy check (${entries} in ${prettyMs(log.elapsedMs)})`,
+                };
+        }
+    })));
+}
+// Returns a leading-space-prefixed `at <path>` suffix only when the
+// lockfile sits outside the obvious project/workspace root — otherwise
+// the path is implied and printing it would just add noise to every
+// install. Empty string when the path is omitted or matches the
+// expected location.
+//
+// Uses `path.relative` rather than a strict `===` between
+// `path.dirname(lockfilePath)` and `expectedDir`: relative path
+// computation normalizes slash direction and trailing separators, so
+// a workspaceDir like `C:/repo/` correctly matches a lockfilePath at
+// `C:\repo\pnpm-lock.yaml` on Windows. The lockfile is considered
+// "inside the expected dir" when the relative path is a bare file
+// name (no separator) that doesn't escape upward.
+function formatLockfilePath(lockfilePath, cwd, expectedDir) {
+    if (lockfilePath == null)
+        return '';
+    const fromExpected = path.relative(expectedDir, lockfilePath);
+    const isDirectChild = !fromExpected.includes(path.sep) && !fromExpected.startsWith('..');
+    if (isDirectChild)
+        return '';
+    return ` at ${normalize(path.relative(cwd, lockfilePath))}`;
+}
+//# sourceMappingURL=reportLockfileVerification.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/cli.default-reporter",
-  "version": "1100.1.1",
+  "version": "1100.2.0",
   "description": "The default reporter of pnpm",
   "keywords": [
     "pnpm",
@@ -42,14 +42,14 @@
     "semver": "^7.7.2",
     "stacktracey": "^2.2.0",
     "string-length": "^7.0.1",
-    "@pnpm/cli.meta": "1100.0.3",
-    "@pnpm/core-loggers": "1100.0.2",
-    "@pnpm/error": "1100.0.0",
+    "@pnpm/config.reader": "1101.3.2",
+    "@pnpm/core-loggers": "1100.1.0",
     "@pnpm/deps.inspection.peers-issues-renderer": "1100.0.1",
-    "@pnpm/types": "1101.1.0",
-    "@pnpm/config.reader": "1101.3.0",
+    "@pnpm/error": "1100.0.0",
+    "@pnpm/installing.dedupe.issues-renderer": "1100.0.1",
     "@pnpm/installing.dedupe.types": "1100.0.1",
-    "@pnpm/installing.dedupe.issues-renderer": "1100.0.1"
+    "@pnpm/types": "1101.1.0",
+    "@pnpm/cli.meta": "1100.0.3"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0"
@@ -62,8 +62,8 @@
     "ghooks": "2.0.4",
     "load-json-file": "^7.0.1",
     "normalize-newline": "5.0.0",
-    "@pnpm/cli.default-reporter": "1100.1.1",
-    "@pnpm/logger": "1100.0.0"
+    "@pnpm/logger": "1100.0.0",
+    "@pnpm/cli.default-reporter": "1100.2.0"
   },
   "engines": {
     "node": ">=22.13"