@pnpm/installing.commands 1100.7.3 → 1100.9.0

package/lib/import/index.js

@@ -230,7 +230,7 @@ function selectProjectByDir(projects, searchedDir) {
     const project = projects.find(({ rootDir }) => path.relative(rootDir, searchedDir) === '');
     if (project == null)
         return undefined;
-    return { [searchedDir]: { dependencies: [], package: project } };
+    return { [project.rootDir]: { dependencies: [], package: project } };
 }
 function getYarnLockfileType(lockFileContents) {
     return lockFileContents.includes('__metadata')

package/lib/install.d.ts

@@ -7,7 +7,7 @@ export declare const shorthands: Record<string, string>;
 export declare const commandNames: string[];
 export declare const recursiveByDefault = true;
 export declare function help(): string;
-export type InstallCommandOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin' | 'catalogs' | 'configDependencies' | 'dedupeInjectedDeps' | 'dedupeDirectDeps' | 'dedupePeerDependents' | 'dedupePeers' | 'deployAllFiles' | 'depth' | 'dev' | 'enableGlobalVirtualStore' | 'engineStrict' | 'excludeLinksFromLockfile' | 'frozenLockfile' | 'global' | 'globalPnpmfile' | 'hoistPattern' | 'hoistingLimits' | 'publicHoistPattern' | 'ignorePnpmfile' | 'ignoreScripts' | 'injectWorkspacePackages' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'modulesDir' | 'nodeLinker' | 'patchedDependencies' | 'preferFrozenLockfile' | 'preferWorkspacePackages' | 'production' | 'registries' | 'save' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveCatalogName' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'sideEffectsCache' | 'sideEffectsCacheReadonly' | 'sort' | 'sharedWorkspaceLockfile' | 'tag' | 'trustLockfile' | 'allowBuilds' | 'optional' | 'virtualStoreDir' | 'workspaceConcurrency' | 'workspaceDir' | 'workspacePackagePatterns' | 'extraEnv' | 'resolutionMode' | 'ignoreWorkspaceCycles' | 'disallowWorkspaceCycles' | 'updateConfig' | 'overrides' | 'packageExtensions' | 'pnprServer' | 'supportedArchitectures' | 'packageConfigs'> & Pick<ConfigContext, 'allProjects' | 'cliOptions' | 'hooks' | 'rootProjectManifest' | 'rootProjectManifestDir' | 'allProjectsGraph' | 'selectedProjectsGraph'> & CreateStoreControllerOptions & Partial<Pick<Config, 'globalPkgDir'>> & {
+export type InstallCommandOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin' | 'catalogs' | 'configDependencies' | 'dedupeInjectedDeps' | 'dedupeDirectDeps' | 'dedupePeerDependents' | 'dedupePeers' | 'deployAllFiles' | 'depth' | 'dev' | 'enableGlobalVirtualStore' | 'engineStrict' | 'excludeLinksFromLockfile' | 'frozenLockfile' | 'global' | 'globalPnpmfile' | 'hoistPattern' | 'hoistingLimits' | 'publicHoistPattern' | 'ignorePnpmfile' | 'ignoreScripts' | 'injectWorkspacePackages' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'optimisticRepeatInstall' | 'modulesDir' | 'nodeLinker' | 'patchedDependencies' | 'preferFrozenLockfile' | 'preferWorkspacePackages' | 'production' | 'registries' | 'save' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveCatalogName' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'sideEffectsCache' | 'sideEffectsCacheReadonly' | 'sort' | 'sharedWorkspaceLockfile' | 'tag' | 'trustLockfile' | 'allowBuilds' | 'optional' | 'virtualStoreDir' | 'workspaceConcurrency' | 'workspaceDir' | 'workspacePackagePatterns' | 'extraEnv' | 'resolutionMode' | 'ignoreWorkspaceCycles' | 'disallowWorkspaceCycles' | 'updateConfig' | 'overrides' | 'packageExtensions' | 'pnprServer' | 'supportedArchitectures' | 'packageConfigs'> & Pick<ConfigContext, 'allProjects' | 'cliOptions' | 'hooks' | 'rootProjectManifest' | 'rootProjectManifestDir' | 'allProjectsGraph' | 'selectedProjectsGraph'> & CreateStoreControllerOptions & Partial<Pick<Config, 'globalPkgDir'>> & {
     argv: {
         cooked?: string[];
         original: string[];

package/lib/install.js

@@ -71,6 +71,7 @@ export function rcOptionsTypes() {
         'optional',
         'unsafe-perm',
         'verify-store-integrity',
+        'frozen-store',
         'virtual-store-dir',
         'virtual-store-only',
     ], allTypes);
@@ -211,6 +212,10 @@ by any dependencies, so it is an emulation of a flat node_modules',
                         description: 'If false, skips store integrity checks. These checks detect accidental corruption, not tampering by untrusted users with write access to the store',
                         name: '--[no-]verify-store-integrity',
                     },
+                    {
+                        description: 'Open the package store read-only (immutable) and skip all store writes. For installs against a store on a read-only filesystem (e.g. a Nix store); pair with --offline --frozen-lockfile. Incompatible with --force',
+                        name: '--frozen-store',
+                    },
                     {
                         description: 'Fail on missing or invalid peer dependencies',
                         name: '--strict-peer-dependencies',

package/lib/installDeps.d.ts

@@ -4,7 +4,7 @@ import { type UpdateMatchingFunction } from '@pnpm/installing.deps-installer';
 import type { LockfileObject } from '@pnpm/lockfile.types';
 import { type CreateStoreControllerOptions } from '@pnpm/store.connection-manager';
 import type { IncludedDependencies, PackageVulnerabilityAudit } from '@pnpm/types';
-export type InstallDepsOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin' | 'catalogs' | 'catalogMode' | 'cleanupUnusedCatalogs' | 'dedupePeerDependents' | 'dedupePeers' | 'depth' | 'dev' | 'enableGlobalVirtualStore' | 'virtualStoreOnly' | 'engineStrict' | 'excludeLinksFromLockfile' | 'global' | 'globalPnpmfile' | 'ignoreCurrentSpecifiers' | 'ignorePnpmfile' | 'ignoreScripts' | 'optimisticRepeatInstall' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'pnprServer' | 'production' | 'preferWorkspacePackages' | 'registries' | 'runtime' | 'runtimeOnFail' | 'save' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'scriptsPrependNodePath' | 'scriptShell' | 'sideEffectsCache' | 'sideEffectsCacheReadonly' | 'sort' | 'sharedWorkspaceLockfile' | 'shellEmulator' | 'tag' | 'trustLockfile' | 'allowBuilds' | 'optional' | 'workspaceConcurrency' | 'workspaceDir' | 'workspacePackagePatterns' | 'extraEnv' | 'ignoreWorkspaceCycles' | 'disallowWorkspaceCycles' | 'configDependencies' | 'packageExtensions' | 'updateConfig'> & Pick<ConfigContext, 'allProjects' | 'allProjectsGraph' | 'cliOptions' | 'hooks' | 'rootProjectManifestDir' | 'rootProjectManifest' | 'selectedProjectsGraph'> & Partial<Pick<Config, 'ci'>> & CreateStoreControllerOptions & {
+export type InstallDepsOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin' | 'catalogs' | 'catalogMode' | 'cleanupUnusedCatalogs' | 'dedupePeerDependents' | 'dedupePeers' | 'depth' | 'dev' | 'enableGlobalVirtualStore' | 'virtualStoreOnly' | 'engineStrict' | 'excludeLinksFromLockfile' | 'global' | 'globalPnpmfile' | 'ignoreCurrentSpecifiers' | 'ignorePnpmfile' | 'ignoreScripts' | 'optimisticRepeatInstall' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'pnprServer' | 'production' | 'preferWorkspacePackages' | 'registries' | 'runtime' | 'runtimeOnFail' | 'save' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'scriptsPrependNodePath' | 'scriptShell' | 'sideEffectsCache' | 'sideEffectsCacheReadonly' | 'sort' | 'sharedWorkspaceLockfile' | 'shellEmulator' | 'tag' | 'trustLockfile' | 'allowBuilds' | 'optional' | 'workspaceConcurrency' | 'workspaceDir' | 'workspacePackagePatterns' | 'extraEnv' | 'ignoreWorkspaceCycles' | 'disallowWorkspaceCycles' | 'configDependencies' | 'packageExtensions' | 'updateConfig' | 'virtualStoreDirMaxLength'> & Pick<ConfigContext, 'allProjects' | 'allProjectsGraph' | 'cliOptions' | 'hooks' | 'rootProjectManifestDir' | 'rootProjectManifest' | 'selectedProjectsGraph'> & Partial<Pick<Config, 'ci'>> & CreateStoreControllerOptions & {
     argv: {
         cooked?: string[];
         original: string[];
@@ -48,5 +48,5 @@ export type InstallDepsOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin
      * subcommand — see `runPacquet.ts`'s `noRuntime` opt.
      */
     isInstallCommand?: boolean;
-} & Partial<Pick<Config, 'pnpmHomeDir' | 'strictDepBuilds'>>;
+} & Partial<Pick<Config, 'pnpmHomeDir' | 'strictDepBuilds' | 'useLockfile' | 'useGitBranchLockfile'>>;
 export declare function installDeps(opts: InstallDepsOptions, params: string[]): Promise<void>;

package/lib/installDeps.js

@@ -5,6 +5,7 @@ import { checkDepsStatus } from '@pnpm/deps.status';
 import { PnpmError } from '@pnpm/error';
 import { arrayOfWorkspacePackagesToMap } from '@pnpm/installing.context';
 import { install, mutateModulesInSingleProject, } from '@pnpm/installing.deps-installer';
+import { writeWantedLockfile } from '@pnpm/lockfile.fs';
 import { globalInfo, logger } from '@pnpm/logger';
 import { applyRuntimeOnFailOverride, filterDependenciesByType } from '@pnpm/pkg-manifest.utils';
 import { createStoreController } from '@pnpm/store.connection-manager';
@@ -28,11 +29,11 @@ const OVERWRITE_UPDATE_OPTIONS = {
 };
 export async function installDeps(opts, params) {
     if (!opts.update && !opts.dedupe && params.length === 0 && opts.optimisticRepeatInstall) {
-        const { upToDate } = await checkDepsStatus({
+        const { upToDate, wantedLockfileToRestore } = await checkDepsStatus({
             ...opts,
             ignoreFilteredInstallCache: true,
         });
-        if (upToDate) {
+        if (upToDate && await restoreWantedLockfileIfMissing(wantedLockfileToRestore, opts)) {
             if (opts.hooks?.customResolvers?.some(r => r.shouldRefreshResolution)) {
                 logger.warn({
                     message: 'shouldRefreshResolution hooks were skipped because optimisticRepeatInstall is enabled.',
@@ -94,6 +95,7 @@ export async function installDeps(opts, params) {
             packageName: pacquetConfigDepName,
             argv: { original: opts.argv.original, remain: opts.argv.remain ?? [] },
             isInstallCommand: opts.isInstallCommand === true,
+            virtualStoreDirMaxLength: opts.virtualStoreDirMaxLength,
         })
         : undefined;
     const includeDirect = opts.includeDirect ?? {
@@ -351,7 +353,7 @@ function selectProjectByDir(projects, searchedDir) {
     const project = projects.find(({ rootDir }) => path.relative(rootDir, searchedDir) === '');
     if (project == null)
         return undefined;
-    return { [searchedDir]: { dependencies: [], package: project } };
+    return { [project.rootDir]: { dependencies: [], package: project } };
 }
 async function recursiveInstallThenUpdateWorkspaceState(allProjects, params, opts, cmdFullName) {
     const recursiveResult = await recursive(allProjects, params, opts, cmdFullName);
@@ -416,4 +418,26 @@ function preferNonvulnerablePackageVersions(packageVulnerabilityAudit) {
     }
     return preferredVersions;
 }
+/**
+ * Restore a missing `pnpm-lock.yaml` from the current lockfile before the
+ * optimistic repeat-install short-circuit reports "Already up to date", so
+ * the fast path leaves the same on-disk contract a full install would.
+ * Returns `true` when the short-circuit may proceed: nothing to restore,
+ * lockfile writing is disabled (`useLockfile: false`), or the restore
+ * succeeded. A failed write returns `false` so the caller falls through to
+ * the full install instead of reporting up to date while `pnpm-lock.yaml`
+ * stays missing.
+ */
+async function restoreWantedLockfileIfMissing(wantedLockfileToRestore, opts) {
+    if (wantedLockfileToRestore == null || opts.useLockfile === false)
+        return true;
+    try {
+        await writeWantedLockfile(wantedLockfileToRestore.lockfileDir, wantedLockfileToRestore.lockfile);
+        return true;
+    }
+    catch (error) {
+        logger.debug({ msg: 'Failed to restore pnpm-lock.yaml from the current lockfile', error });
+        return false;
+    }
+}
 //# sourceMappingURL=installDeps.js.map

package/lib/link.js

@@ -31,6 +31,7 @@ export function cliOptionsTypes() {
         'save-exact',
         'save-optional',
         'save-prefix',
+        'trust-lockfile',
         'unsafe-perm',
     ], allTypes);
 }

package/lib/recursive.d.ts

@@ -32,11 +32,17 @@ export type RecursiveOptions = CreateStoreControllerOptions & Pick<Config, 'bail
     pnpmfile: string[];
     /**
      * Alternative install engine (today: pacquet) the deps-installer
-     * delegates the materialization phase to. Built in `installDeps`
-     * when `configDependencies.pacquet` is declared, threaded through
-     * here so the recursive workspace path picks it up too.
+     * delegates the install to. Built in `installDeps` when
+     * `configDependencies.pacquet` is declared, threaded through here so
+     * the recursive workspace path picks it up too.
      */
-    runPacquet?: () => Promise<void>;
+    runPacquet?: {
+        supportsResolution: boolean;
+        run: (opts?: {
+            filterResolvedProgress?: boolean;
+            resolve?: boolean;
+        }) => Promise<void>;
+    };
 } & Partial<Pick<Config, 'ci' | 'sort' | 'strictDepBuilds' | 'workspaceConcurrency'>> & Required<Pick<Config, 'workspaceDir'>>;
 export type CommandFullName = 'install' | 'add' | 'remove' | 'update' | 'import';
 export declare function recursive(allProjects: Project[], params: string[], opts: RecursiveOptions, cmdFullName: CommandFullName): Promise<boolean | string>;

package/lib/runPacquet.d.ts

@@ -1,5 +1,12 @@
 export interface MakeRunPacquetOpts {
     lockfileDir: string;
+    /**
+     * Effective pnpm config value. Forwarded through `PNPM_CONFIG_*` so
+     * pacquet writes the same `.modules.yaml` and virtual-store paths as
+     * the pnpm process that delegated to it, including Windows' shorter
+     * default.
+     */
+    virtualStoreDirMaxLength: number;
     /**
      * Which `configDependencies` entry installed pacquet: either the
      * original unscoped `pacquet` or the official scoped
@@ -32,21 +39,6 @@ export interface MakeRunPacquetOpts {
      */
     isInstallCommand: boolean;
 }
-/**
- * Build the install-engine callback `mutateModules` invokes when
- * `configDependencies` declares pacquet.
- *
- * The callback spawns the pacquet binary installed under
- * `node_modules/.pnpm-config/pacquet`. From `pnpm install`/`pnpm i` it
- * forwards the user's own pnpm CLI flags to pacquet's `install`
- * subcommand; from `add`/`update`/`dedupe` it doesn't forward (warning
- * instead). Pacquet's NDJSON stderr is parsed line-by-line and the
- * valid JSON records are re-emitted on pnpm's global `streamParser` so
- * `@pnpm/cli.default-reporter` renders pacquet's events the same way it
- * renders pnpm's own. Non-JSON stderr lines (panic backtraces,
- * unexpected diagnostics) are forwarded to the real stderr verbatim so
- * they reach the user.
- */
 /** Args the deps-installer passes per pacquet invocation. */
 export interface RunPacquetCallOpts {
     /**
@@ -60,5 +52,51 @@ export interface RunPacquetCallOpts {
      * source.
      */
     filterResolvedProgress?: boolean;
+    /**
+     * `true` to let pacquet perform the resolution itself rather than
+     * materialize an already-resolved lockfile. Drops the injected
+     * `--frozen-lockfile`, so pacquet resolves the manifests, writes
+     * `pnpm-lock.yaml`, and materializes in a single pass. Only valid
+     * when {@link PacquetEngine.supportsResolution} is `true` (pacquet
+     * >= 0.11.7).
+     */
+    resolve?: boolean;
 }
-export declare function makeRunPacquet(opts: MakeRunPacquetOpts): (callOpts?: RunPacquetCallOpts) => Promise<void>;
+/**
+ * Handle to the pacquet install engine: its capabilities plus the
+ * callback `mutateModules` invokes to run it.
+ */
+export interface PacquetEngine {
+    /**
+     * `true` when the installed pacquet is new enough (>= 0.11.7) to
+     * perform dependency resolution itself. When `false`, pacquet can
+     * only materialize an already-resolved lockfile, so the deps-installer
+     * runs its own resolve pass first and hands the written lockfile to
+     * pacquet.
+     */
+    supportsResolution: boolean;
+    run: (callOpts?: RunPacquetCallOpts) => Promise<void>;
+}
+/**
+ * Build the pacquet install engine `mutateModules` delegates to when
+ * `configDependencies` declares pacquet.
+ *
+ * `run` spawns the pacquet binary installed under
+ * `node_modules/.pnpm-config/pacquet`. From `pnpm install`/`pnpm i` it
+ * forwards the user's own pnpm CLI flags to pacquet's `install`
+ * subcommand; from `add`/`update`/`dedupe` it doesn't forward (warning
+ * instead). Pacquet's NDJSON stderr is parsed line-by-line and the
+ * valid JSON records are re-emitted on pnpm's global `streamParser` so
+ * `@pnpm/cli.default-reporter` renders pacquet's events the same way it
+ * renders pnpm's own. Non-JSON stderr lines (panic backtraces,
+ * unexpected diagnostics) are forwarded to the real stderr verbatim so
+ * they reach the user.
+ */
+export declare function makeRunPacquet(opts: MakeRunPacquetOpts): PacquetEngine;
+/**
+ * Name of the `@pacquet/<platform>-<arch>[-musl]` package that holds the
+ * native pacquet binary for the host. On linux the binary packages are
+ * split by libc and only the matching one is installed, so spawning and
+ * signature verification must agree on this exact name.
+ */
+export declare function pacquetPlatformPkgName(): string;

package/lib/runPacquet.js

@@ -6,12 +6,34 @@ import readline from 'node:readline';
 import { PnpmError } from '@pnpm/error';
 import { logger, streamParser } from '@pnpm/logger';
 import chalk from 'chalk';
+import { familySync as getLibcFamilySync, MUSL } from 'detect-libc';
 // The runtime `streamParser` is a `Transform` stream (split2 + JSON.parse).
 // Its public typing only exposes `on`/`removeListener`, so we narrow to the
 // writable side here to feed pacquet's NDJSON lines back through the same
 // parser that `@pnpm/cli.default-reporter` listens on.
 const streamParserWritable = streamParser;
+/**
+ * Build the pacquet install engine `mutateModules` delegates to when
+ * `configDependencies` declares pacquet.
+ *
+ * `run` spawns the pacquet binary installed under
+ * `node_modules/.pnpm-config/pacquet`. From `pnpm install`/`pnpm i` it
+ * forwards the user's own pnpm CLI flags to pacquet's `install`
+ * subcommand; from `add`/`update`/`dedupe` it doesn't forward (warning
+ * instead). Pacquet's NDJSON stderr is parsed line-by-line and the
+ * valid JSON records are re-emitted on pnpm's global `streamParser` so
+ * `@pnpm/cli.default-reporter` renders pacquet's events the same way it
+ * renders pnpm's own. Non-JSON stderr lines (panic backtraces,
+ * unexpected diagnostics) are forwarded to the real stderr verbatim so
+ * they reach the user.
+ */
 export function makeRunPacquet(opts) {
+    return {
+        supportsResolution: pacquetSupportsResolution(resolvePacquetVersion(opts.lockfileDir, opts.packageName)),
+        run: makeRun(opts),
+    };
+}
+function makeRun(opts) {
     return async (callOpts) => {
         const pacquetBin = resolvePacquetBin(opts.lockfileDir, opts.packageName);
         // From `pnpm install`/`pnpm i` we forward the user's flags through to
@@ -19,21 +41,23 @@ export function makeRunPacquet(opts) {
         // surface closely enough on that command that they're safe to pass
         // along. From `add`/`update`/`dedupe` we don't forward anything: those
         // commands carry flags pacquet's `install` doesn't recognize
-        // (`--save-dev`, `--save-peer`, etc.) which clap would reject. Either
-        // way pacquet picks up the settings users care about from
-        // `pnpm-workspace.yaml` / `.npmrc` on its own, so a non-install
-        // delegation isn't broken by the omission.
+        // (`--save-dev`, `--save-peer`, etc.) which clap would reject.
         const forwardedFlags = opts.isInstallCommand ? collectForwardedFlags(opts.argv) : [];
-        // `--ignore-manifest-check` tells pacquet to skip its per-importer
-        // `package.json` ↔ `pnpm-lock.yaml` freshness gate. pnpm just
-        // resolved and wrote the lockfile itself; on `pnpm up` / `add` /
-        // `remove` the manifest on disk is still the pre-mutation copy
-        // (pnpm writes it after `mutateModules` returns), so pacquet's own
-        // check would always fire here. See
+        // In resolve mode pacquet does the resolution itself, so it must not
+        // be pinned to the existing lockfile — drop both injected flags.
+        //
+        // Otherwise (frozen materialization) inject `--frozen-lockfile` plus
+        // `--ignore-manifest-check`. The latter tells pacquet to skip its
+        // per-importer `package.json` ↔ `pnpm-lock.yaml` freshness gate:
+        // pnpm just resolved and wrote the lockfile itself; on `pnpm up` /
+        // `add` / `remove` the manifest on disk is still the pre-mutation
+        // copy (pnpm writes it after `mutateModules` returns), so pacquet's
+        // own check would always fire here. See
         // https://github.com/pnpm/pnpm/issues/11797. The flag is narrow
         // (only the manifest check); settings drift like `overrides` is
         // still enforced and was already re-validated by pnpm.
-        const args = ['--reporter=ndjson', 'install', '--frozen-lockfile', '--ignore-manifest-check', ...forwardedFlags];
+        const frozenArgs = callOpts?.resolve === true ? [] : ['--frozen-lockfile', '--ignore-manifest-check'];
+        const args = ['--reporter=ndjson', 'install', ...frozenArgs, ...forwardedFlags];
         const droppedFlags = opts.isInstallCommand ? [] : collectDroppedFlags(opts.argv);
         if (droppedFlags.length > 0) {
             logger.warn({
@@ -53,6 +77,7 @@ export function makeRunPacquet(opts) {
         logger.info({ message: banner, prefix: opts.lockfileDir });
         const child = spawn(pacquetBin, args, {
             cwd: opts.lockfileDir,
+            env: makePacquetEnv(opts),
             stdio: ['ignore', 'inherit', 'pipe'],
         });
         const filterResolved = callOpts?.filterResolvedProgress === true;
@@ -89,6 +114,16 @@ export function makeRunPacquet(opts) {
         });
     };
 }
+function makePacquetEnv(opts) {
+    const env = { ...process.env };
+    for (const key of Object.keys(env)) {
+        if (key.toLowerCase() === 'pnpm_config_virtual_store_dir_max_length') {
+            delete env[key];
+        }
+    }
+    env.PNPM_CONFIG_VIRTUAL_STORE_DIR_MAX_LENGTH = String(opts.virtualStoreDirMaxLength);
+    return env;
+}
 /**
  * Path of the platform-specific native pacquet binary for the host. The
  * pacquet npm package ships a Node wrapper at `bin/pacquet` that uses
@@ -108,7 +143,47 @@ export function makeRunPacquet(opts) {
 function resolvePacquetBin(lockfileDir, packageName) {
     const ext = process.platform === 'win32' ? '.exe' : '';
     const pacquetPkg = fs.realpathSync(path.join(lockfileDir, 'node_modules/.pnpm-config', packageName, 'package.json'));
-    return createRequire(pacquetPkg).resolve(`@pacquet/${process.platform}-${process.arch}/pacquet${ext}`);
+    return createRequire(pacquetPkg).resolve(`${pacquetPlatformPkgName()}/pacquet${ext}`);
+}
+/**
+ * Name of the `@pacquet/<platform>-<arch>[-musl]` package that holds the
+ * native pacquet binary for the host. On linux the binary packages are
+ * split by libc and only the matching one is installed, so spawning and
+ * signature verification must agree on this exact name.
+ */
+export function pacquetPlatformPkgName() {
+    const libc = process.platform === 'linux' && getLibcFamilySync() === MUSL ? '-musl' : '';
+    return `@pacquet/${process.platform}-${process.arch}${libc}`;
+}
+/**
+ * Read the installed pacquet's version from its `package.json` under
+ * `node_modules/.pnpm-config/<packageName>`. Returns `undefined` if it
+ * can't be read — callers treat that as "assume the older,
+ * materialization-only pacquet" so a missing/garbled manifest degrades
+ * to the safe path rather than failing the install.
+ */
+function resolvePacquetVersion(lockfileDir, packageName) {
+    try {
+        const pacquetPkg = fs.realpathSync(path.join(lockfileDir, 'node_modules/.pnpm-config', packageName, 'package.json'));
+        const { version } = JSON.parse(fs.readFileSync(pacquetPkg, 'utf8'));
+        return version;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * pacquet gained full resolving installs in 0.11.7; earlier releases
+ * stay on pnpm's resolve-then-materialize path. Pre-release builds of
+ * 0.11.7 (e.g. `0.11.7-rc.1`) count as supporting it.
+ */
+function pacquetSupportsResolution(version) {
+    if (version == null)
+        return false;
+    const [major, minor, patch] = version.split('.', 3).map((part) => parseInt(part, 10));
+    if (Number.isNaN(major) || Number.isNaN(minor) || Number.isNaN(patch))
+        return false;
+    return major > 0 || (major === 0 && (minor > 11 || (minor === 11 && patch >= 7)));
 }
 /**
  * From `pnpm install`/`pnpm i`, return everything in argv that should

package/lib/update/index.js

@@ -205,6 +205,11 @@ async function interactiveUpdate(input, opts, rebuildHandler) {
                 flatChoices.push({
                     name: choice.message,
                     value: choice.value,
+                    // `name` is the rendered table row (label + versions + workspace + url)
+                    // that lays out a single choice during selection. After submission
+                    // @inquirer/prompts comma-joins each choice's `short`, which without
+                    // this defaults to `name` and dumps the whole table back to stdout.
+                    short: choice.value,
                 });
             }
         }

package/lib/verifyPacquetIdentity.js

@@ -4,6 +4,7 @@ import { PnpmError } from '@pnpm/error';
 import { readEnvLockfile } from '@pnpm/lockfile.fs';
 import { logger } from '@pnpm/logger';
 import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
+import { pacquetPlatformPkgName } from './runPacquet.js';
 /**
  * Decides whether pnpm may spawn the pacquet binary installed under
  * `node_modules/.pnpm-config/<packageName>` as an install engine.
@@ -60,7 +61,7 @@ async function collectPacquetPackagesToVerify(packageName, rootDir, registries)
         return undefined;
     // Only the host's platform binary is ever spawned, so that's the one whose
     // identity matters. If it isn't in the lockfile, pacquet couldn't run here.
-    const platformPkgName = `@pacquet/${process.platform}-${process.arch}`;
+    const platformPkgName = pacquetPlatformPkgName();
     const platformVersion = envLockfile.snapshots[shimKey]?.optionalDependencies?.[platformPkgName];
     if (platformVersion == null)
         return undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.commands",
-  "version": "1100.7.3",
+  "version": "1100.9.0",
   "description": "Commands for installation",
   "keywords": [
     "pnpm",
@@ -30,14 +30,15 @@
     "@inquirer/prompts": "^8.4.3",
     "@pnpm/colorize-semver-diff": "^2.0.0",
     "@pnpm/semver-diff": "^2.0.0",
-    "@pnpm/util.lex-comparator": "^3.0.2",
-    "@yarnpkg/core": "4.5.0",
+    "@pnpm/util.lex-comparator": "^4.0.1",
+    "@yarnpkg/core": "4.8.0",
     "@yarnpkg/lockfile": "^1.1.0",
     "@yarnpkg/parsers": "3.0.3",
     "@zkochan/rimraf": "^4.0.0",
     "@zkochan/table": "^2.0.1",
     "chalk": "^5.6.2",
     "ci-info": "^4.4.0",
+    "detect-libc": "^2.1.2",
     "get-npm-tarball-url": "^2.1.0",
     "is-subdir": "^2.0.0",
     "load-json-file": "^7.0.1",
@@ -47,62 +48,62 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "render-help": "^2.0.0",
     "version-selector-type": "^3.0.0",
-    "@pnpm/building.policy": "1100.0.9",
-    "@pnpm/cli.command": "1100.0.1",
+    "@pnpm/building.after-install": "1102.0.0",
+    "@pnpm/building.policy": "1100.0.10",
     "@pnpm/catalogs.types": "1100.0.0",
+    "@pnpm/cli.utils": "1101.0.12",
     "@pnpm/cli.common-cli-options-help": "1100.0.2",
-    "@pnpm/cli.utils": "1101.0.10",
+    "@pnpm/cli.command": "1100.0.1",
     "@pnpm/config.matcher": "1100.0.1",
-    "@pnpm/config.pick-registry-for-package": "1100.0.8",
-    "@pnpm/config.writer": "1100.0.12",
+    "@pnpm/config.pick-registry-for-package": "1100.0.9",
+    "@pnpm/config.reader": "1101.9.0",
+    "@pnpm/config.writer": "1100.0.13",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/config.reader": "1101.7.0",
-    "@pnpm/deps.inspection.outdated": "1100.1.6",
-    "@pnpm/deps.status": "1100.0.23",
-    "@pnpm/deps.path": "1100.0.7",
-    "@pnpm/deps.security.signatures": "1101.2.0",
+    "@pnpm/deps.inspection.outdated": "1100.1.8",
+    "@pnpm/deps.path": "1100.0.8",
+    "@pnpm/deps.security.signatures": "1101.2.2",
+    "@pnpm/deps.status": "1100.1.1",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/fs.graceful-fs": "1100.1.0",
     "@pnpm/fs.read-modules-dir": "1100.0.1",
-    "@pnpm/global.commands": "1100.0.26",
-    "@pnpm/hooks.pnpmfile": "1100.0.13",
-    "@pnpm/installing.context": "1100.0.16",
-    "@pnpm/installing.dedupe.check": "1100.0.10",
-    "@pnpm/building.after-install": "1101.0.20",
-    "@pnpm/installing.deps-installer": "1101.8.0",
-    "@pnpm/lockfile.fs": "1100.1.4",
-    "@pnpm/installing.env-installer": "1101.1.7",
-    "@pnpm/lockfile.types": "1100.0.10",
-    "@pnpm/network.fetch": "1100.1.1",
-    "@pnpm/network.auth-header": "1101.1.1",
-    "@pnpm/resolving.npm-resolver": "1101.5.1",
+    "@pnpm/fs.graceful-fs": "1100.1.0",
+    "@pnpm/global.commands": "1100.0.28",
+    "@pnpm/hooks.pnpmfile": "1100.0.15",
+    "@pnpm/installing.dedupe.check": "1100.0.11",
+    "@pnpm/installing.context": "1100.0.18",
+    "@pnpm/installing.env-installer": "1102.0.0",
+    "@pnpm/lockfile.types": "1100.0.11",
+    "@pnpm/installing.deps-installer": "1102.0.0",
+    "@pnpm/network.fetch": "1100.1.3",
+    "@pnpm/lockfile.fs": "1100.1.5",
+    "@pnpm/network.auth-header": "1101.1.2",
+    "@pnpm/pkg-manifest.reader": "1100.0.8",
+    "@pnpm/resolving.npm-resolver": "1102.0.0",
     "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
-    "@pnpm/pkg-manifest.utils": "1100.2.3",
-    "@pnpm/resolving.resolver-base": "1100.4.1",
-    "@pnpm/store.controller": "1101.0.12",
-    "@pnpm/types": "1101.3.1",
-    "@pnpm/store.connection-manager": "1100.2.7",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.11",
-    "@pnpm/workspace.projects-filter": "1100.0.19",
-    "@pnpm/workspace.project-manifest-writer": "1100.0.7",
-    "@pnpm/workspace.projects-reader": "1101.0.10",
-    "@pnpm/workspace.projects-sorter": "1100.0.6",
-    "@pnpm/workspace.projects-graph": "1100.0.16",
-    "@pnpm/workspace.state": "1100.0.20",
-    "@pnpm/workspace.workspace-manifest-writer": "1100.0.12",
+    "@pnpm/pkg-manifest.utils": "1100.2.5",
+    "@pnpm/store.connection-manager": "1100.3.0",
+    "@pnpm/resolving.resolver-base": "1100.4.2",
+    "@pnpm/store.controller": "1102.0.0",
+    "@pnpm/types": "1101.3.2",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.13",
+    "@pnpm/workspace.project-manifest-writer": "1100.0.8",
+    "@pnpm/workspace.projects-filter": "1100.0.21",
+    "@pnpm/workspace.projects-reader": "1101.0.12",
+    "@pnpm/workspace.projects-graph": "1100.0.18",
+    "@pnpm/workspace.projects-sorter": "1100.0.7",
     "@pnpm/workspace.root-finder": "1100.0.1",
-    "@pnpm/pkg-manifest.reader": "1100.0.7"
+    "@pnpm/workspace.state": "1100.0.22",
+    "@pnpm/workspace.workspace-manifest-writer": "1100.0.13"
   },
   "peerDependencies": {
-    "@pnpm/logger": "^1001.0.1"
+    "@pnpm/logger": "^1100.0.0"
   },
   "devDependencies": {
-    "@jest/globals": "30.3.0",
+    "@jest/globals": "30.4.1",
     "@types/normalize-path": "^3.0.2",
     "@types/proxyquire": "^1.3.31",
     "@types/ramda": "0.31.1",
     "@types/yarnpkg__lockfile": "^1.1.9",
-    "@types/zkochan__table": "npm:@types/table@6.0.0",
+    "@types/zkochan__table": "npm:@types/table@6.3.2",
     "delay": "^7.0.0",
     "jest-diff": "^30.4.1",
     "path-name": "^1.0.0",
@@ -113,19 +114,19 @@
     "write-json-file": "^7.0.0",
     "write-package": "7.2.0",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/installing.commands": "1100.7.3",
-    "@pnpm/installing.modules-yaml": "1100.0.8",
+    "@pnpm/installing.commands": "1100.9.0",
+    "@pnpm/assert-project": "1100.0.16",
+    "@pnpm/installing.modules-yaml": "1100.0.9",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/prepare": "1100.0.14",
-    "@pnpm/assert-project": "1100.0.14",
-    "@pnpm/store.index": "1100.1.0",
+    "@pnpm/prepare": "1100.0.16",
     "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/testing.command-defaults": "1100.0.4",
-    "@pnpm/testing.registry-mock": "1100.0.4",
-    "@pnpm/testing.mock-agent": "1101.0.1",
     "@pnpm/test-ipc-server": "1100.0.0",
-    "@pnpm/workspace.projects-filter": "1100.0.19",
-    "@pnpm/worker": "1100.1.10"
+    "@pnpm/testing.command-defaults": "1100.0.6",
+    "@pnpm/testing.mock-agent": "1101.0.3",
+    "@pnpm/testing.registry-mock": "1100.0.6",
+    "@pnpm/store.index": "1100.2.0",
+    "@pnpm/worker": "1100.2.0",
+    "@pnpm/workspace.projects-filter": "1100.0.21"
   },
   "engines": {
     "node": ">=22.13"