@pnpm/installing.commands 1100.3.0 → 1100.4.0

package/lib/add.js

@@ -10,6 +10,7 @@ import { pick } from 'ramda';
 import { renderHelp } from 'render-help';
 import { getFetchFullMetadata } from './getFetchFullMetadata.js';
 import { installDeps } from './installDeps.js';
+import { createGlobalPolicyCallbacks } from './resolutionPolicyManifest.js';
 export const shorthands = {
     'save-catalog': '--save-catalog-name=default',
     d: '--save-dev',
@@ -228,7 +229,10 @@ export async function handler(opts, params, commands) {
         if (params.includes('pnpm') || params.includes('@pnpm/exe')) {
             throw new PnpmError('GLOBAL_PNPM_INSTALL', 'Use the "pnpm self-update" command to install or update pnpm');
         }
-        return handleGlobalAdd(opts, params, commands ?? {});
+        return handleGlobalAdd({
+            ...opts,
+            ...createGlobalPolicyCallbacks(opts),
+        }, params, commands ?? {});
     }
     const include = {
         dependencies: opts.production !== false,

package/lib/installDeps.js

@@ -19,6 +19,7 @@ import { getSaveType } from './getSaveType.js';
 import { handleIgnoredBuilds } from './handleIgnoredBuilds.js';
 import { setupPolicyHandlers } from './policyHandlers.js';
 import { createMatcher, makeIgnorePatterns, matchDependencies, recursive, } from './recursive.js';
+import { makeRunPacquet } from './runPacquet.js';
 import { createWorkspaceSpecs, updateToWorkspacePackagesFromManifest } from './updateWorkspaceDependencies.js';
 const OVERWRITE_UPDATE_OPTIONS = {
     allowNew: true,
@@ -55,6 +56,29 @@ export async function installDeps(opts, params) {
         opts['preserveWorkspaceProtocol'] = !opts.linkWorkspacePackages;
     }
     const store = await createStoreController(opts);
+    // When `configDependencies` declares pacquet, build the alternative
+    // install engine the deps-installer delegates to. The CLI layer owns
+    // the construction so the installer doesn't need to know about
+    // pacquet's binary path, CLI surface, or any settings that only
+    // pacquet consumes. Threaded through both the workspace recursive
+    // path and the single-project path below. Two declaration names are
+    // accepted: the original unscoped `pacquet` and the official scoped
+    // `@pnpm/pacquet` mirror. Both packages ship the same JS shim and
+    // optional `@pacquet/<plat>-<arch>` binary sub-packages, so the
+    // resolved \`node_modules/.pnpm-config/<name>\` layout pacquet's
+    // wrapper expects is identical either way.
+    const pacquetConfigDepName = opts.configDependencies?.['@pnpm/pacquet'] != null
+        ? '@pnpm/pacquet'
+        : opts.configDependencies?.pacquet != null
+            ? 'pacquet'
+            : undefined;
+    const runPacquet = pacquetConfigDepName != null
+        ? makeRunPacquet({
+            lockfileDir: opts.lockfileDir ?? opts.dir,
+            packageName: pacquetConfigDepName,
+            argv: opts.argv.original,
+        })
+        : undefined;
     const includeDirect = opts.includeDirect ?? {
         dependencies: true,
         devDependencies: true,
@@ -95,6 +119,7 @@ export async function installDeps(opts, params) {
                 selectedProjectsGraph,
                 storeControllerAndDir: store,
                 workspaceDir: opts.workspaceDir,
+                runPacquet,
             }, opts.update ? 'update' : (params.length === 0 ? 'install' : 'add'));
             return;
         }
@@ -138,6 +163,7 @@ export async function installDeps(opts, params) {
         workspacePackages,
         preferredVersions: opts.packageVulnerabilityAudit ? preferNonvulnerablePackageVersions(opts.packageVulnerabilityAudit) : undefined,
         handleResolutionPolicyViolations: policyHandlers?.handleResolutionPolicyViolations,
+        runPacquet,
     };
     let updateMatch;
     let updatePackageManifest = opts.updatePackageManifest;
@@ -273,6 +299,7 @@ export async function installDeps(opts, params) {
             allProjectsGraph: opts.allProjectsGraph,
             selectedProjectsGraph,
             workspaceDir: opts.workspaceDir, // Otherwise TypeScript doesn't understand that is not undefined
+            runPacquet,
         }, 'install');
         if (opts.ignoreScripts)
             return;

package/lib/recursive.d.ts

@@ -30,6 +30,13 @@ export type RecursiveOptions = CreateStoreControllerOptions & Pick<Config, 'bail
         resolutionVerifiers: ResolutionVerifier[];
     };
     pnpmfile: string[];
+    /**
+     * Alternative install engine (today: pacquet) the deps-installer
+     * delegates the materialization phase to. Built in `installDeps`
+     * when `configDependencies.pacquet` is declared, threaded through
+     * here so the recursive workspace path picks it up too.
+     */
+    runPacquet?: () => Promise<void>;
 } & Partial<Pick<Config, 'ci' | 'sort' | 'strictDepBuilds' | 'workspaceConcurrency'>> & Required<Pick<Config, 'workspaceDir'>>;
 export type CommandFullName = 'install' | 'add' | 'remove' | 'update' | 'import';
 export declare function recursive(allProjects: Project[], params: string[], opts: RecursiveOptions, cmdFullName: CommandFullName): Promise<boolean | string>;

package/lib/resolutionPolicyManifest.d.ts

@@ -0,0 +1,6 @@
+import { type PolicyHandlersOptions, type PolicyViolation } from './policyHandlers.js';
+export interface GlobalPolicyCallbacks {
+    handleResolutionPolicyViolations?: (violations: readonly PolicyViolation[]) => Promise<void>;
+    updateResolutionPolicyManifest?: (violations: readonly PolicyViolation[], dir: string) => Promise<void>;
+}
+export declare function createGlobalPolicyCallbacks(opts: PolicyHandlersOptions): GlobalPolicyCallbacks;

package/lib/resolutionPolicyManifest.js

@@ -0,0 +1,17 @@
+import { updateWorkspaceManifest } from '@pnpm/workspace.workspace-manifest-writer';
+import { setupPolicyHandlers, } from './policyHandlers.js';
+export function createGlobalPolicyCallbacks(opts) {
+    const policyHandlers = setupPolicyHandlers(opts);
+    if (policyHandlers == null)
+        return {};
+    return {
+        handleResolutionPolicyViolations: policyHandlers.handleResolutionPolicyViolations,
+        updateResolutionPolicyManifest: async (violations, dir) => {
+            const policyUpdates = policyHandlers.pickManifestUpdates(violations);
+            if (policyUpdates != null) {
+                await updateWorkspaceManifest(dir, policyUpdates);
+            }
+        },
+    };
+}
+//# sourceMappingURL=resolutionPolicyManifest.js.map

package/lib/runPacquet.d.ts

@@ -0,0 +1,48 @@
+export interface MakeRunPacquetOpts {
+    lockfileDir: string;
+    /**
+     * Which `configDependencies` entry installed pacquet: either the
+     * original unscoped `pacquet` or the official scoped
+     * `@pnpm/pacquet` mirror. Drives the directory we look in under
+     * `node_modules/.pnpm-config/<packageName>/`. Both packages ship
+     * the same shim and the same `@pacquet/<plat>-<arch>` binary
+     * sub-packages, so the rest of the lookup is identical.
+     */
+    packageName: 'pacquet' | '@pnpm/pacquet';
+    /**
+     * The user's original `pnpm` argv (`process.argv.slice(2)`). Not
+     * forwarded to pacquet — we only inspect it to warn about flags
+     * pacquet won't see.
+     */
+    argv: string[];
+}
+/**
+ * Build the install-engine callback `mutateModules` invokes when
+ * `configDependencies` declares pacquet. Returns `undefined` when no
+ * pacquet binary is on disk — the caller falls back to the JS path in
+ * that case.
+ *
+ * The callback spawns the pacquet binary installed under
+ * `node_modules/.pnpm-config/pacquet` and forwards the user's own
+ * pnpm CLI flags. Pacquet's NDJSON stderr is parsed line-by-line and
+ * the valid JSON records are re-emitted on pnpm's global
+ * `streamParser` so `@pnpm/cli.default-reporter` renders pacquet's
+ * events the same way it renders pnpm's own. Non-JSON stderr lines
+ * (panic backtraces, unexpected diagnostics) are forwarded to the
+ * real stderr verbatim so they reach the user.
+ */
+/** Args the deps-installer passes per pacquet invocation. */
+export interface RunPacquetCallOpts {
+    /**
+     * `true` when pnpm has already run a lockfileOnly resolve pass and
+     * the reporter has already accumulated one `pnpm:progress
+     * status:resolved` per package. Pacquet's own `resolved` events
+     * (emitted for wire-format parity as it walks the lockfile) are
+     * dropped on the way back through the reader so the reporter
+     * doesn't double-count. The frozen-install path passes `false`:
+     * pnpm did no resolution there, so pacquet's events are the only
+     * source.
+     */
+    filterResolvedProgress?: boolean;
+}
+export declare function makeRunPacquet(opts: MakeRunPacquetOpts): (callOpts?: RunPacquetCallOpts) => Promise<void>;

package/lib/runPacquet.js

@@ -0,0 +1,126 @@
+import { spawn } from 'node:child_process';
+import fs from 'node:fs';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import readline from 'node:readline';
+import { PnpmError } from '@pnpm/error';
+import { logger, streamParser } from '@pnpm/logger';
+import chalk from 'chalk';
+// The runtime `streamParser` is a `Transform` stream (split2 + JSON.parse).
+// Its public typing only exposes `on`/`removeListener`, so we narrow to the
+// writable side here to feed pacquet's NDJSON lines back through the same
+// parser that `@pnpm/cli.default-reporter` listens on.
+const streamParserWritable = streamParser;
+export function makeRunPacquet(opts) {
+    return async (callOpts) => {
+        const pacquetBin = resolvePacquetBin(opts.lockfileDir, opts.packageName);
+        // Always the same fixed args. We don't forward pnpm's CLI flags
+        // even though pacquet's `install` subcommand mirrors most of them:
+        // pnpm has commands like `add` and `update` that carry flags
+        // pacquet's `install` doesn't recognize (e.g., `--save-dev`,
+        // `--save-peer`), and clap would reject them. The settings users
+        // care about live in `pnpm-workspace.yaml` / `.npmrc`, which
+        // pacquet reads on its own.
+        const args = ['--reporter=ndjson', 'install', '--frozen-lockfile'];
+        const droppedFlags = collectDroppedFlags(opts.argv);
+        if (droppedFlags.length > 0) {
+            logger.warn({
+                message: `The following CLI flags are not forwarded to pacquet and may not be honored: ${droppedFlags.join(' ')}. Move the equivalent settings into pnpm-workspace.yaml (or .npmrc for auth/registry) if pacquet needs them.`,
+                prefix: opts.lockfileDir,
+            });
+        }
+        // Banner so users can tell at a glance their install is going
+        // through the Rust engine rather than the JS path. Chalk is the
+        // same dependency the default reporter uses for the "+ pkg
+        // version" summary, so colorization respects the user's TTY
+        // settings consistently.
+        const banner = [
+            chalk.magentaBright('▶ Using pacquet for this install'),
+            chalk.gray('  pacquet is pnpm\'s Rust install engine (preview); declared in configDependencies.'),
+        ].join('\n');
+        logger.info({ message: banner, prefix: opts.lockfileDir });
+        const child = spawn(pacquetBin, args, {
+            cwd: opts.lockfileDir,
+            stdio: ['ignore', 'inherit', 'pipe'],
+        });
+        const filterResolved = callOpts?.filterResolvedProgress === true;
+        const rl = readline.createInterface({ input: child.stderr, crlfDelay: Infinity });
+        rl.on('line', (line) => {
+            if (!line)
+                return;
+            let parsed;
+            try {
+                parsed = JSON.parse(line);
+            }
+            catch {
+                process.stderr.write(`${line}\n`);
+                return;
+            }
+            if (filterResolved &&
+                typeof parsed === 'object' && parsed !== null &&
+                parsed.name === 'pnpm:progress' &&
+                parsed.status === 'resolved') {
+                return;
+            }
+            streamParserWritable.write(`${line}\n`);
+        });
+        await new Promise((resolve, reject) => {
+            child.once('error', reject);
+            child.once('close', (code) => {
+                rl.close();
+                if (code === 0) {
+                    resolve();
+                    return;
+                }
+                reject(new PnpmError('PACQUET_INSTALL_FAILED', `pacquet exited with code ${code ?? 'null'}`));
+            });
+        });
+    };
+}
+/**
+ * Path of the platform-specific native pacquet binary for the host. The
+ * pacquet npm package ships a Node wrapper at `bin/pacquet` that uses
+ * `require.resolve('@pacquet/<platform>-<arch>/pacquet[.exe]')` to find
+ * the binary — so the platform package lands as a *sibling* of pacquet,
+ * not inside its own `node_modules` (pacquet's own `node_modules` is
+ * empty after configDependencies install). Use Node's resolver rooted
+ * at pacquet's own `package.json` so we follow the same path the
+ * wrapper would have.
+ *
+ * The `realpathSync` is required: `.pnpm-config/pacquet` is a symlink
+ * into the global virtual store, and Node's `createRequire` builds its
+ * search paths from the *literal* ancestors of the path it's given —
+ * it won't follow the symlink up into the store dir where the
+ * `@pacquet/<plat>-<arch>` sibling actually lives.
+ */
+function resolvePacquetBin(lockfileDir, packageName) {
+    const ext = process.platform === 'win32' ? '.exe' : '';
+    const pacquetPkg = fs.realpathSync(path.join(lockfileDir, 'node_modules/.pnpm-config', packageName, 'package.json'));
+    return createRequire(pacquetPkg).resolve(`@pacquet/${process.platform}-${process.arch}/pacquet${ext}`);
+}
+/**
+ * Pull the CLI flags out of pnpm's argv so we can warn about them
+ * before pacquet runs. We don't forward any of them — pacquet always
+ * gets `install --frozen-lockfile --reporter=ndjson` — but most are
+ * handled by pnpm itself before delegation (`--save-dev` rewrites
+ * `package.json`, `--filter` selects projects, etc.) so listing them
+ * to the user makes the "not forwarded" surface concrete.
+ *
+ * Flags we explicitly emit ourselves (`--frozen-lockfile`,
+ * `--reporter=ndjson`) are filtered out: they're honored, so warning
+ * about them would be misleading. `--config.*` is filtered too —
+ * those configure pnpm's runtime and aren't intended for the install
+ * engine.
+ */
+function collectDroppedFlags(argv) {
+    return argv.filter((arg) => {
+        if (!arg.startsWith('-'))
+            return false;
+        if (arg === '--frozen-lockfile' || arg === '--reporter=ndjson')
+            return false;
+        if (arg.startsWith('--config.'))
+            return false;
+        return true;
+    });
+}
+//# sourceMappingURL=runPacquet.js.map

package/lib/update/index.js

@@ -12,6 +12,7 @@ import { pick, pluck, unnest } from 'ramda';
 import { renderHelp } from 'render-help';
 import { installDeps } from '../installDeps.js';
 import { parseUpdateParam } from '../recursive.js';
+import { createGlobalPolicyCallbacks } from '../resolutionPolicyManifest.js';
 import { getUpdateChoices } from './getUpdateChoices.js';
 export function rcOptionsTypes() {
     return pick([
@@ -151,7 +152,10 @@ export async function handler(opts, params = [], commands) {
                 hint: 'Run "pnpm setup" to create it automatically, or set the global-bin-dir setting, or the PNPM_HOME env variable. The global bin directory should be in the PATH.',
             });
         }
-        return handleGlobalUpdate(opts, params, commands ?? {});
+        return handleGlobalUpdate({
+            ...opts,
+            ...createGlobalPolicyCallbacks(opts),
+        }, params, commands ?? {});
     }
     const rebuildHandler = commands?.rebuild;
     if (opts.interactive) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.commands",
-  "version": "1100.3.0",
+  "version": "1100.4.0",
   "description": "Commands for installation",
   "keywords": [
     "pnpm",
@@ -44,46 +44,46 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "render-help": "^2.0.0",
     "version-selector-type": "^3.0.0",
-    "@pnpm/building.after-install": "1101.0.13",
+    "@pnpm/building.after-install": "1101.0.14",
     "@pnpm/catalogs.types": "1100.0.0",
-    "@pnpm/cli.command": "1100.0.1",
     "@pnpm/cli.common-cli-options-help": "1100.0.1",
-    "@pnpm/config.pick-registry-for-package": "1100.0.3",
+    "@pnpm/cli.utils": "1101.0.6",
+    "@pnpm/config.pick-registry-for-package": "1100.0.4",
     "@pnpm/config.matcher": "1100.0.1",
-    "@pnpm/cli.utils": "1101.0.5",
-    "@pnpm/config.writer": "1100.0.8",
-    "@pnpm/deps.status": "1100.0.16",
+    "@pnpm/config.reader": "1101.3.3",
+    "@pnpm/cli.command": "1100.0.1",
+    "@pnpm/config.writer": "1100.0.9",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/deps.path": "1100.0.3",
+    "@pnpm/deps.inspection.outdated": "1100.1.0",
+    "@pnpm/deps.path": "1100.0.4",
+    "@pnpm/deps.status": "1100.0.17",
+    "@pnpm/error": "1100.0.0",
     "@pnpm/fs.graceful-fs": "1100.1.0",
     "@pnpm/fs.read-modules-dir": "1100.0.1",
-    "@pnpm/config.reader": "1101.3.2",
-    "@pnpm/error": "1100.0.0",
-    "@pnpm/installing.context": "1100.0.11",
-    "@pnpm/global.commands": "1100.0.18",
-    "@pnpm/hooks.pnpmfile": "1100.0.9",
-    "@pnpm/installing.dedupe.check": "1100.0.6",
-    "@pnpm/installing.deps-installer": "1101.2.0",
-    "@pnpm/installing.env-installer": "1101.0.10",
-    "@pnpm/lockfile.types": "1100.0.6",
-    "@pnpm/pkg-manifest.reader": "1100.0.3",
+    "@pnpm/global.commands": "1100.0.19",
+    "@pnpm/hooks.pnpmfile": "1100.0.10",
+    "@pnpm/installing.context": "1100.0.12",
+    "@pnpm/installing.dedupe.check": "1100.0.7",
+    "@pnpm/installing.env-installer": "1101.1.0",
+    "@pnpm/installing.deps-installer": "1101.3.0",
+    "@pnpm/lockfile.types": "1100.0.7",
+    "@pnpm/pkg-manifest.utils": "1100.2.0",
+    "@pnpm/pkg-manifest.reader": "1100.0.4",
     "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
-    "@pnpm/pkg-manifest.utils": "1100.1.4",
-    "@pnpm/resolving.resolver-base": "1100.2.0",
-    "@pnpm/types": "1101.1.0",
-    "@pnpm/resolving.npm-resolver": "1101.2.0",
-    "@pnpm/deps.inspection.outdated": "1100.0.16",
-    "@pnpm/store.connection-manager": "1100.2.0",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.6",
-    "@pnpm/workspace.projects-filter": "1100.0.12",
-    "@pnpm/workspace.project-manifest-writer": "1100.0.3",
-    "@pnpm/store.controller": "1101.0.7",
-    "@pnpm/workspace.projects-graph": "1100.0.9",
-    "@pnpm/workspace.projects-sorter": "1100.0.2",
-    "@pnpm/workspace.projects-reader": "1101.0.5",
-    "@pnpm/workspace.workspace-manifest-writer": "1100.0.8",
+    "@pnpm/resolving.resolver-base": "1100.3.0",
+    "@pnpm/store.connection-manager": "1100.2.1",
+    "@pnpm/resolving.npm-resolver": "1101.3.0",
+    "@pnpm/store.controller": "1101.0.8",
+    "@pnpm/types": "1101.1.1",
+    "@pnpm/workspace.projects-filter": "1100.0.13",
+    "@pnpm/workspace.projects-graph": "1100.0.10",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.7",
+    "@pnpm/workspace.projects-sorter": "1100.0.3",
+    "@pnpm/workspace.projects-reader": "1101.0.6",
     "@pnpm/workspace.root-finder": "1100.0.1",
-    "@pnpm/workspace.state": "1100.0.13"
+    "@pnpm/workspace.project-manifest-writer": "1100.0.4",
+    "@pnpm/workspace.state": "1100.0.14",
+    "@pnpm/workspace.workspace-manifest-writer": "1100.0.9"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0"
@@ -106,18 +106,18 @@
     "write-json-file": "^7.0.0",
     "write-package": "7.2.0",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/assert-project": "1100.0.9",
-    "@pnpm/prepare": "1100.0.9",
-    "@pnpm/installing.commands": "1100.3.0",
-    "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/assert-project": "1100.0.10",
+    "@pnpm/installing.commands": "1100.4.0",
+    "@pnpm/installing.modules-yaml": "1100.0.5",
+    "@pnpm/prepare": "1100.0.10",
     "@pnpm/logger": "1100.0.0",
+    "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/store.index": "1100.1.0",
     "@pnpm/test-ipc-server": "1100.0.0",
+    "@pnpm/testing.mock-agent": "1100.0.6",
     "@pnpm/testing.command-defaults": "1100.0.1",
-    "@pnpm/testing.mock-agent": "1100.0.5",
-    "@pnpm/store.index": "1100.1.0",
-    "@pnpm/worker": "1100.1.6",
-    "@pnpm/workspace.projects-filter": "1100.0.12",
-    "@pnpm/installing.modules-yaml": "1100.0.4"
+    "@pnpm/worker": "1100.1.7",
+    "@pnpm/workspace.projects-filter": "1100.0.13"
   },
   "engines": {
     "node": ">=22.13"