@pnpm/installing.deps-installer 1101.1.2 → 1101.2.0

package/lib/install/verifyLockfileResolutions.js

@@ -0,0 +1,225 @@
+import { lockfileVerificationLogger } from '@pnpm/core-loggers';
+import { hashObject } from '@pnpm/crypto.object-hasher';
+import { PnpmError } from '@pnpm/error';
+import { nameVerFromPkgSnapshot } from '@pnpm/lockfile.utils';
+import pLimit from 'p-limit';
+import { recordVerification, tryLockfileVerificationCache, } from './verifyLockfileResolutionsCache.js';
+// Cap the per-entry breakdown so a verifier rejecting hundreds of entries
+// (e.g. a poisoned lockfile) doesn't flood the terminal / CI log; the full
+// count is in the header and the remainder is summarized at the end.
+const MAX_VIOLATIONS_TO_PRINT = 20;
+// 16 mirrors the floor of pnpm's package-requester network-concurrency
+// (Math.min(64, Math.max(workers*3, 16))); keep them aligned so the
+// verification pass doesn't push past what the rest of the install respects.
+const DEFAULT_CONCURRENCY = 16;
+/**
+ * Policy-neutral pass that asks every resolver-supplied
+ * {@link ResolutionVerifier} to check every entry in a lockfile loaded
+ * from disk. Iteration runs before resolution decisions are touched and
+ * before any tarball is fetched, so a lockfile whose entries were
+ * resolved elsewhere (committed to the repo, restored from a cache,
+ * etc.) under a weaker or absent policy cannot reach the filesystem.
+ * Fresh local resolution is covered by the resolver's own per-version
+ * filter.
+ *
+ * Each verifier handles its own protocol short-circuit inside `verify`
+ * (returning `{ ok: true }` for resolutions outside its scope), so the
+ * fan-out is policy-neutral and dispatch-free at this layer.
+ *
+ * Designed for fail-closed semantics at the verifier level: a verifier
+ * that can't confirm a resolution is expected to return `{ ok: false }`
+ * rather than passing silently — otherwise a registry hiccup or an
+ * unpublished version would re-open the bypass.
+ *
+ * No-op when `verifiers` is empty.
+ *
+ * When `options.cacheDir` and `options.lockfilePath` are both
+ * provided, an unchanged lockfile that has already been verified
+ * under the same (or stricter) policy short-circuits the registry
+ * round-trip entirely — see {@link tryLockfileVerificationCache} for
+ * the lookup logic.
+ */
+export async function verifyLockfileResolutions(lockfile, verifiers, options) {
+    if (verifiers.length === 0)
+        return;
+    if (!lockfile.packages)
+        return;
+    // Caching kicks in only when the caller surfaced both a writable
+    // cache directory and the lockfile's absolute path — that's the
+    // production wiring; unit tests that skip them get the gate without
+    // memoization and still exercise the same code path.
+    const cache = options?.cacheDir && options?.lockfilePath
+        ? { cacheDir: options.cacheDir, lockfilePath: options.lockfilePath }
+        : undefined;
+    let cachePrecomputed;
+    // hashObject streams and is key-order-stable, unlike JSON.stringify.
+    let cachedHash;
+    const hashLockfile = () => {
+        if (cachedHash == null)
+            cachedHash = hashObject(lockfile);
+        return cachedHash;
+    };
+    if (cache) {
+        const result = tryLockfileVerificationCache(cache.cacheDir, {
+            lockfilePath: cache.lockfilePath,
+            verifiers,
+            hashLockfile,
+        });
+        if (result.hit)
+            return;
+        cachePrecomputed = result.precomputed;
+    }
+    // Emit started/done around the actual verification pass — the
+    // round-trip can be slow on a cold registry cache, and the cached
+    // short-circuit above doesn't reach this branch, so a user only
+    // sees these messages on installs that are doing real work.
+    // A degenerate lockfile where every snapshot fails the
+    // name/version extraction (so candidates is empty) skips emission
+    // entirely — no work, no noise.
+    const candidates = collectCandidates(lockfile);
+    if (candidates.size === 0) {
+        if (cache) {
+            recordVerification(cache.cacheDir, {
+                lockfilePath: cache.lockfilePath,
+                verifiers,
+                hashLockfile,
+            }, cachePrecomputed);
+        }
+        return;
+    }
+    const startedAt = Date.now();
+    lockfileVerificationLogger.debug({
+        status: 'started',
+        entries: candidates.size,
+        lockfilePath: options?.lockfilePath,
+    });
+    // Guarantee a terminal `done` or `failed` event on every exit path
+    // that emitted `started`. Without this, an unexpected throw from the
+    // registry fan-out (or the policy-violation throw below) would leave
+    // the transient "Verifying lockfile…" line as the last frame the
+    // reporter rendered for this block, hanging spinner-style above the
+    // failure output.
+    let terminalStatus = 'failed';
+    try {
+        const violations = await iterateLockfileViolations(candidates, verifiers, options?.concurrency);
+        if (violations.length === 0) {
+            terminalStatus = 'done';
+            // Persist the success so the next install can stat-only the lockfile.
+            if (cache) {
+                recordVerification(cache.cacheDir, {
+                    lockfilePath: cache.lockfilePath,
+                    verifiers,
+                    hashLockfile,
+                }, cachePrecomputed);
+            }
+            return;
+        }
+        throw buildVerificationError(violations);
+    }
+    finally {
+        lockfileVerificationLogger.debug({
+            status: terminalStatus,
+            entries: candidates.size,
+            elapsedMs: Date.now() - startedAt,
+            lockfilePath: options?.lockfilePath,
+        });
+    }
+}
+function buildVerificationError(violations) {
+    // Stable order so the error output is deterministic.
+    violations.sort((a, b) => `${a.name}@${a.version}`.localeCompare(`${b.name}@${b.version}`));
+    // Pick the throw code: a single-code batch keeps the per-policy code
+    // (so existing handlers / docs / search keywords still route correctly);
+    // a mixed batch (e.g. minimumReleaseAge + trust-downgrade on the same
+    // lockfile) escalates to the generic `LOCKFILE_RESOLUTION_VERIFICATION`
+    // and the per-entry code goes into the breakdown so the user can see
+    // which policy each entry tripped.
+    const distinctCodes = new Set(violations.map((v) => v.code));
+    const isMixed = distinctCodes.size > 1;
+    const errorCode = isMixed ? 'LOCKFILE_RESOLUTION_VERIFICATION' : violations[0].code;
+    const visible = violations.slice(0, MAX_VIOLATIONS_TO_PRINT);
+    const omitted = violations.length - visible.length;
+    const formatEntry = isMixed
+        ? (v) => `  ${v.name}@${v.version} [${v.code}] ${v.reason}`
+        : (v) => `  ${v.name}@${v.version} ${v.reason}`;
+    const breakdown = visible.map(formatEntry).join('\n');
+    const details = omitted > 0
+        ? `${breakdown}\n  …and ${omitted} more`
+        : breakdown;
+    return new PnpmError(errorCode, `${violations.length} lockfile entries failed verification:\n${details}`, {
+        hint: 'The lockfile contains entries that the active policies reject. ' +
+            'This can mean the lockfile is stale, or that someone committed a ' +
+            'lockfile that bypassed the policy locally — inspect recent changes ' +
+            'to pnpm-lock.yaml before trusting it. If the changes look expected, ' +
+            'run "pnpm clean --lockfile" and then "pnpm install" to rebuild from ' +
+            'a fresh resolution. Alternatively, relax the policy that flagged ' +
+            'them.',
+    });
+}
+/**
+ * Collect-mode sibling of {@link verifyLockfileResolutions}: runs the
+ * same fan-out over every verifier and every lockfile entry, but
+ * returns the violations as data instead of throwing on the first batch.
+ * No cache lookup or write — the throw-mode `verifyLockfileResolutions`
+ * is what populates / honors the cache; this is for callers that need
+ * to inspect violations (auto-collect into `minimumReleaseAgeExclude`,
+ * the strict-mode interactive prompt, future resolver-specific
+ * policies).
+ *
+ * Returns an empty array when `verifiers` is empty or the lockfile has
+ * no packages, so callers don't need a separate emptiness check.
+ */
+export async function collectResolutionPolicyViolations(lockfile, verifiers, options) {
+    if (verifiers.length === 0)
+        return [];
+    if (!lockfile.packages)
+        return [];
+    return iterateLockfileViolations(collectCandidates(lockfile), verifiers, options?.concurrency);
+}
+// depPath can include peer-dependency and patch_hash suffixes (e.g.
+// `react@18.0.0(peer)(patch_hash=…)`); the same (name, version) pair may
+// therefore appear multiple times. Dedupe so we issue at most one
+// verification per package version.
+//
+// Include a serialization of `resolution` in the key so two entries that
+// share a (name, version) but differ in *what* was resolved (e.g. one
+// pinned via npm, another via a git URL under the same alias) don't
+// collapse: if the wrong shape wins the dedup, a protocol-scoped
+// verifier short-circuits on the surviving entry and the real one is
+// never checked.
+function collectCandidates(lockfile) {
+    const candidates = new Map();
+    for (const [depPath, snapshot] of Object.entries(lockfile.packages ?? {})) {
+        const { name, version } = nameVerFromPkgSnapshot(depPath, snapshot);
+        if (!name || !version)
+            continue;
+        const key = `${name}@${version}@${JSON.stringify(snapshot.resolution)}`;
+        candidates.set(key, {
+            name,
+            version,
+            resolution: snapshot.resolution,
+        });
+    }
+    return candidates;
+}
+async function iterateLockfileViolations(candidates, verifiers, concurrency) {
+    const violations = [];
+    const limit = pLimit(concurrency ?? DEFAULT_CONCURRENCY);
+    await Promise.all(Array.from(candidates.values(), ({ name, version, resolution }) => limit(async () => {
+        // Fan out across every active verifier; each handles its own
+        // protocol short-circuit (e.g. the npm verifier returns ok:true for
+        // git resolutions). We stop at the first failure per entry so a
+        // multi-verifier setup doesn't produce duplicate violations for the
+        // same (name, version).
+        for (const verifier of verifiers) {
+            // eslint-disable-next-line no-await-in-loop
+            const result = await verifier.verify(resolution, { name, version });
+            if (!result.ok) {
+                violations.push({ name, version, resolution, code: result.code, reason: result.reason });
+                break;
+            }
+        }
+    })));
+    return violations;
+}
+//# sourceMappingURL=verifyLockfileResolutions.js.map

package/lib/install/verifyLockfileResolutionsCache.d.ts

@@ -0,0 +1,80 @@
+import type { ResolutionVerifier } from '@pnpm/resolving.resolver-base';
+/**
+ * Subset of {@link ResolutionVerifier} the cache layer needs: the
+ * verifier's `policy` contribution plus the `canTrustPastCheck`
+ * comparator. `verify` is intentionally absent — the cache never runs
+ * verifiers, it just decides whether a previous run is still
+ * trustworthy.
+ */
+export type VerifierCacheIdentity = Pick<ResolutionVerifier, 'policy' | 'canTrustPastCheck'>;
+export interface CacheLookupResult {
+    hit: boolean;
+    /**
+     * stat + hash already computed during the lookup. When the caller
+     * follows up with {@link recordVerification} after running the gate,
+     * passing these back avoids re-stat'ing and (especially) re-hashing
+     * the lockfile a second time. Fields are undefined when the lookup
+     * couldn't (or didn't need to) compute them — `recordVerification`
+     * falls back to computing what's missing.
+     */
+    precomputed: {
+        stat?: LockfileStat;
+        hash?: string;
+    };
+}
+interface LockfileStat {
+    size: number;
+    mtimeNs: string;
+    inode: string;
+}
+export interface LockfileVerificationCacheKey {
+    lockfilePath: string;
+    verifiers: readonly VerifierCacheIdentity[];
+    /**
+     * Lazy: returns a stable hex hash of the in-memory lockfile. The
+     * cache invokes this only when the stat shortcut doesn't apply (the
+     * lockfile is at a new path, or its stat has drifted from the
+     * cached record). When the stat shortcut hits, the in-memory hash is
+     * never computed.
+     */
+    hashLockfile: () => string;
+}
+/**
+ * Try to confirm a cached verification covers the lockfile as it
+ * currently sits on disk and the policies currently in effect. Returns
+ * `{ hit: true }` to skip the gate; `{ hit: false }` means the caller
+ * should run the verifier and persist the result with
+ * {@link recordVerification}.
+ *
+ * Lookup order:
+ *
+ * 1. **Stat shortcut** — if we've previously verified this exact path
+ *    with these exact stat values, trust the cached hash and skip
+ *    reading the lockfile.
+ * 2. **Content lookup** — hash the lockfile and look up by hash.
+ *    Catches the worktree case (same content, different path) and
+ *    CI checkouts where stat fields got reset. Refreshes the
+ *    stat-shortcut entry on hit so the next install at this path
+ *    skips the hash.
+ *
+ * Every active verifier must agree the cached policy snapshot is still
+ * trustworthy under what it currently demands; if any rejects, the
+ * full gate runs.
+ */
+export declare function tryLockfileVerificationCache(cacheDir: string, key: LockfileVerificationCacheKey): CacheLookupResult;
+/**
+ * Persist a successful verification. Called after the gate passes; the
+ * lockfile is hashed once and the resulting record is appended to the
+ * cache file. If the file is past {@link MAX_CACHE_ENTRIES}, it is
+ * rewritten keeping the most recent entries.
+ *
+ * Reuses `precomputed` values from a prior
+ * {@link tryLockfileVerificationCache} lookup so we don't re-stat or
+ * (especially) re-hash the lockfile a second time on the miss-then-
+ * record path.
+ */
+export declare function recordVerification(cacheDir: string, key: LockfileVerificationCacheKey, precomputed?: {
+    stat?: LockfileStat;
+    hash?: string;
+}): void;
+export {};

package/lib/install/verifyLockfileResolutionsCache.js

@@ -0,0 +1,335 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import util from 'node:util';
+import { logger } from '@pnpm/logger';
+/**
+ * On-disk cache of verifyLockfileResolutions results, keyed by lockfile
+ * content hash. Lets repeat installs against an unchanged lockfile skip
+ * the per-package registry round trips entirely — including across git
+ * worktrees, where the same lockfile content lives at different paths.
+ *
+ * Two indexes share the same JSONL records:
+ *
+ * - **by content hash** — the primary index. Recognizing the same
+ *   lockfile content regardless of where it sits on disk is what makes
+ *   worktrees and lockfile copies hit.
+ * - **by absolute path** — a same-machine stat shortcut. When we've
+ *   seen this exact path before with these exact stat values, we
+ *   trust the cached hash and skip reading the lockfile entirely
+ *   (microseconds vs. ms-per-MB). Worktrees that get reinstalled in
+ *   pay the hash cost once, then hit the stat fast path.
+ *
+ * All filesystem operations are synchronous: the cache is consulted
+ * once before verification fan-out and recorded once after — there's
+ * no concurrent install work to overlap with, so blocking the event
+ * loop for the brief read/stat/hash is fine and keeps the call sites
+ * straight-line.
+ *
+ * Persisted as JSON Lines: each verification appends one record;
+ * later records overwrite earlier ones on key collision when read.
+ * Appends of a single line are atomic on POSIX and NTFS, so parallel
+ * pnpm processes (monorepo installs, CI matrices sharing a cache) can
+ * write without coordination.
+ *
+ * Policy-neutral. Every active verifier's `policy` contribution merges
+ * into a single `policy` bag on the record; verifiers sharing a
+ * logical policy (same field name) share the slot — no resolver-level
+ * namespacing.
+ */
+const CACHE_FILE_NAME = 'lockfile-verified.jsonl';
+// Cap the file before it grows large enough to slow down reads. When the
+// cap is exceeded we rewrite the file keeping the N most recently
+// verified entries. The number is generous — a developer machine that
+// touches a thousand distinct (path, content) tuples is far past steady
+// state.
+const MAX_CACHE_ENTRIES = 1000;
+// Records cluster around 250–400 bytes; budget 1 KiB per entry as a
+// conservative upper bound. The compaction check uses `stat().size` to
+// decide whether to read+rewrite, so we never parse the file unless it
+// has actually grown past the cap.
+const COMPACT_TRIGGER_BYTES = MAX_CACHE_ENTRIES * 1024 * 3 / 2;
+/**
+ * Build two indexes over the JSONL records in one pass: by content
+ * hash (primary) and by absolute path (stat shortcut). Records are
+ * walked in file order so the last record for any key wins.
+ */
+function readCache(cacheDir) {
+    const cacheFilePath = path.join(cacheDir, CACHE_FILE_NAME);
+    let contents;
+    try {
+        contents = fs.readFileSync(cacheFilePath, 'utf8');
+    }
+    catch (err) {
+        if (isNodeError(err) && err.code === 'ENOENT')
+            return { byHash: new Map(), byPath: new Map() };
+        throw err;
+    }
+    const byHash = new Map();
+    const byPath = new Map();
+    for (const line of contents.split('\n')) {
+        if (!line)
+            continue;
+        try {
+            const parsed = JSON.parse(line);
+            const hash = parsed?.lockfile?.hash;
+            const lockfilePath = parsed?.lockfile?.path;
+            if (typeof hash !== 'string' || typeof lockfilePath !== 'string')
+                continue;
+            const record = normalizeRecord(parsed);
+            byHash.set(hash, record);
+            byPath.set(lockfilePath, record);
+        }
+        catch {
+            // Skip malformed lines; the next clean append will still work.
+        }
+    }
+    return { byHash, byPath };
+}
+function normalizeRecord(parsed) {
+    const lockfile = parsed.lockfile ?? {};
+    return {
+        lockfile: {
+            hash: lockfile.hash ?? '',
+            path: lockfile.path ?? '',
+            size: lockfile.size ?? -1,
+            mtimeNs: lockfile.mtimeNs ?? '',
+            inode: lockfile.inode ?? '',
+        },
+        verifiedAt: parsed.verifiedAt ?? '',
+        policy: parsed.policy && typeof parsed.policy === 'object' ? parsed.policy : {},
+    };
+}
+function statLockfile(lockfilePath) {
+    try {
+        const stat = fs.statSync(lockfilePath, { bigint: true });
+        return {
+            size: Number(stat.size),
+            mtimeNs: stat.mtimeNs.toString(),
+            inode: stat.ino.toString(),
+        };
+    }
+    catch (err) {
+        if (isNodeError(err) && err.code === 'ENOENT')
+            return null;
+        throw err;
+    }
+}
+function statMatches(stat, lockfile) {
+    return stat.size === lockfile.size &&
+        stat.mtimeNs === lockfile.mtimeNs &&
+        stat.inode === lockfile.inode;
+}
+/**
+ * Try to confirm a cached verification covers the lockfile as it
+ * currently sits on disk and the policies currently in effect. Returns
+ * `{ hit: true }` to skip the gate; `{ hit: false }` means the caller
+ * should run the verifier and persist the result with
+ * {@link recordVerification}.
+ *
+ * Lookup order:
+ *
+ * 1. **Stat shortcut** — if we've previously verified this exact path
+ *    with these exact stat values, trust the cached hash and skip
+ *    reading the lockfile.
+ * 2. **Content lookup** — hash the lockfile and look up by hash.
+ *    Catches the worktree case (same content, different path) and
+ *    CI checkouts where stat fields got reset. Refreshes the
+ *    stat-shortcut entry on hit so the next install at this path
+ *    skips the hash.
+ *
+ * Every active verifier must agree the cached policy snapshot is still
+ * trustworthy under what it currently demands; if any rejects, the
+ * full gate runs.
+ */
+export function tryLockfileVerificationCache(cacheDir, key) {
+    let indexes;
+    try {
+        indexes = readCache(cacheDir);
+    }
+    catch (err) {
+        // A corrupt cache file should never block the install; fall
+        // through to verification so the gate still runs.
+        logger.debug({ msg: 'lockfile-verified cache: read failed', err });
+        return { hit: false, precomputed: {} };
+    }
+    const stat = statLockfile(key.lockfilePath);
+    if (!stat)
+        return { hit: false, precomputed: {} };
+    // Stat shortcut: same path + same stat means we trust the cached
+    // hash without reading the file. Microseconds.
+    const byPathRecord = indexes.byPath.get(key.lockfilePath);
+    if (byPathRecord && statMatches(stat, byPathRecord.lockfile)) {
+        return {
+            hit: everyVerifierTrustsCachedRun(byPathRecord, key.verifiers),
+            // The stat-match implies the file content is unchanged since the
+            // cached record was written, so its hash is still correct. Pass
+            // it through to skip hashing on the miss-then-record path.
+            precomputed: { stat, hash: byPathRecord.lockfile.hash },
+        };
+    }
+    // Content lookup: hash the in-memory lockfile, look up by content
+    // hash. Catches worktrees (same content, different path) and CI
+    // checkouts (same content, reset stat). On hit, refresh the
+    // path/stat entry so the next install at this path takes the stat
+    // shortcut above.
+    let hash;
+    try {
+        hash = key.hashLockfile();
+    }
+    catch (err) {
+        logger.debug({ msg: 'lockfile-verified cache: lockfile hash failed', err });
+        return { hit: false, precomputed: { stat } };
+    }
+    const byHashRecord = indexes.byHash.get(hash);
+    if (!byHashRecord)
+        return { hit: false, precomputed: { stat, hash } };
+    if (!everyVerifierTrustsCachedRun(byHashRecord, key.verifiers)) {
+        return { hit: false, precomputed: { stat, hash } };
+    }
+    appendRecord(cacheDir, {
+        ...byHashRecord,
+        lockfile: { ...byHashRecord.lockfile, path: key.lockfilePath, size: stat.size, mtimeNs: stat.mtimeNs, inode: stat.inode },
+    });
+    return { hit: true, precomputed: { stat, hash } };
+}
+function everyVerifierTrustsCachedRun(record, verifiers) {
+    for (const verifier of verifiers) {
+        if (!verifier.canTrustPastCheck(record.policy))
+            return false;
+    }
+    return true;
+}
+function mergePolicies(verifiers) {
+    // Later verifiers overwrite earlier ones on conflict — a shared field
+    // should carry the same value across verifiers by convention; mismatch
+    // is a config bug and we don't try to reconcile it here.
+    const merged = {};
+    for (const verifier of verifiers) {
+        Object.assign(merged, verifier.policy);
+    }
+    return merged;
+}
+/**
+ * Persist a successful verification. Called after the gate passes; the
+ * lockfile is hashed once and the resulting record is appended to the
+ * cache file. If the file is past {@link MAX_CACHE_ENTRIES}, it is
+ * rewritten keeping the most recent entries.
+ *
+ * Reuses `precomputed` values from a prior
+ * {@link tryLockfileVerificationCache} lookup so we don't re-stat or
+ * (especially) re-hash the lockfile a second time on the miss-then-
+ * record path.
+ */
+export function recordVerification(cacheDir, key, precomputed) {
+    let stat;
+    let hash;
+    try {
+        stat = precomputed?.stat ?? statLockfile(key.lockfilePath);
+        if (!stat)
+            return;
+        hash = precomputed?.hash ?? key.hashLockfile();
+    }
+    catch (err) {
+        // The gate has already passed; if we can't record the cache entry we
+        // just won't get the speedup next time. Not a reason to fail install.
+        logger.debug({ msg: 'lockfile-verified cache: could not record verification', err });
+        return;
+    }
+    const record = {
+        lockfile: {
+            hash,
+            path: key.lockfilePath,
+            size: stat.size,
+            mtimeNs: stat.mtimeNs,
+            inode: stat.inode,
+        },
+        verifiedAt: new Date().toISOString(),
+        policy: mergePolicies(key.verifiers),
+    };
+    appendRecord(cacheDir, record);
+}
+function appendRecord(cacheDir, record) {
+    const cacheFilePath = path.join(cacheDir, CACHE_FILE_NAME);
+    const line = `${JSON.stringify(record)}\n`;
+    try {
+        fs.mkdirSync(cacheDir, { recursive: true });
+        fs.appendFileSync(cacheFilePath, line);
+    }
+    catch (err) {
+        logger.debug({ msg: 'lockfile-verified cache: append failed', err });
+        return;
+    }
+    maybeCompactCache(cacheDir);
+}
+function maybeCompactCache(cacheDir) {
+    const cacheFilePath = path.join(cacheDir, CACHE_FILE_NAME);
+    // Decide whether to compact from the file size alone — avoids reading
+    // and parsing the file on every successful install. Records cluster
+    // around a few hundred bytes; the byte budget translates directly to
+    // the entry cap with generous slack so we don't trigger a rewrite on
+    // every append once we cross the line.
+    let size;
+    try {
+        size = fs.statSync(cacheFilePath).size;
+    }
+    catch (err) {
+        if (isNodeError(err) && err.code === 'ENOENT')
+            return;
+        logger.debug({ msg: 'lockfile-verified cache: stat for compaction failed', err });
+        return;
+    }
+    if (size <= COMPACT_TRIGGER_BYTES)
+        return;
+    let contents;
+    try {
+        contents = fs.readFileSync(cacheFilePath, 'utf8');
+    }
+    catch (err) {
+        if (isNodeError(err) && err.code === 'ENOENT')
+            return;
+        logger.debug({ msg: 'lockfile-verified cache: read for compaction failed', err });
+        return;
+    }
+    const lines = contents.split('\n').filter(Boolean);
+    // Dedup by (path, hash) — that's the unit both indexes care about.
+    // Walking reverse keeps the newest record per tuple; we then trim to
+    // MAX_CACHE_ENTRIES and write back in original order.
+    const seen = new Set();
+    const reversed = [];
+    for (let i = lines.length - 1; i >= 0; i--) {
+        const line = lines[i];
+        try {
+            const parsed = JSON.parse(line);
+            const lockfilePath = parsed?.lockfile?.path;
+            const hash = parsed?.lockfile?.hash;
+            if (typeof lockfilePath !== 'string' || typeof hash !== 'string')
+                continue;
+            const tupleKey = `${lockfilePath}${hash}`;
+            if (seen.has(tupleKey))
+                continue;
+            seen.add(tupleKey);
+            reversed.push(line);
+        }
+        catch {
+            // Skip malformed lines.
+        }
+    }
+    reversed.reverse();
+    const kept = reversed.slice(-MAX_CACHE_ENTRIES);
+    try {
+        // Write to a sibling tempfile + rename so a concurrent pnpm process
+        // can't observe a half-written file.
+        const tmpPath = `${cacheFilePath}.${process.pid}.tmp`;
+        fs.writeFileSync(tmpPath, kept.map((line) => `${line}\n`).join(''));
+        fs.renameSync(tmpPath, cacheFilePath);
+    }
+    catch (err) {
+        logger.debug({ msg: 'lockfile-verified cache: compaction failed', err });
+    }
+}
+function isNodeError(err) {
+    // `instanceof Error` is unreliable across realms (Jest's VM context), so
+    // route through util.types.isNativeError per the repo guideline.
+    return util.types.isNativeError(err) && 'code' in err;
+}
+//# sourceMappingURL=verifyLockfileResolutionsCache.js.map

package/lib/install/writeLockfilesAndRecordVerified.d.ts

@@ -0,0 +1,14 @@
+import { type LockfileObject, type WriteLockfilesResult } from '@pnpm/lockfile.fs';
+import type { ResolutionVerifier } from '@pnpm/resolving.resolver-base';
+export interface WriteLockfilesAndRecordVerifiedOptions {
+    wantedLockfile: LockfileObject;
+    wantedLockfileDir: string;
+    currentLockfile: LockfileObject;
+    currentLockfileDir: string;
+    useGitBranchLockfile?: boolean;
+    mergeGitBranchLockfiles?: boolean;
+    cacheDir?: string;
+    resolutionVerifiers: readonly ResolutionVerifier[] | undefined;
+}
+/** Plural counterpart of {@link writeWantedLockfileAndRecordVerified}. */
+export declare function writeLockfilesAndRecordVerified(opts: WriteLockfilesAndRecordVerifiedOptions): Promise<WriteLockfilesResult>;

package/lib/install/writeLockfilesAndRecordVerified.js

@@ -0,0 +1,32 @@
+import path from 'node:path';
+import { getWantedLockfileName, writeLockfiles } from '@pnpm/lockfile.fs';
+import { recordLockfileVerified } from './recordLockfileVerified.js';
+/** Plural counterpart of {@link writeWantedLockfileAndRecordVerified}. */
+export async function writeLockfilesAndRecordVerified(opts) {
+    const cacheActive = opts.cacheDir != null && (opts.resolutionVerifiers?.length ?? 0) > 0;
+    const wantedLockfileName = cacheActive
+        ? await getWantedLockfileName({
+            useGitBranchLockfile: opts.useGitBranchLockfile,
+            mergeGitBranchLockfiles: opts.mergeGitBranchLockfiles,
+        })
+        : undefined;
+    const written = await writeLockfiles({
+        wantedLockfile: opts.wantedLockfile,
+        wantedLockfileDir: opts.wantedLockfileDir,
+        currentLockfile: opts.currentLockfile,
+        currentLockfileDir: opts.currentLockfileDir,
+        useGitBranchLockfile: opts.useGitBranchLockfile,
+        mergeGitBranchLockfiles: opts.mergeGitBranchLockfiles,
+        wantedLockfileName,
+    });
+    if (cacheActive) {
+        recordLockfileVerified({
+            cacheDir: opts.cacheDir,
+            lockfilePath: path.resolve(opts.wantedLockfileDir, wantedLockfileName),
+            lockfile: written.wantedLockfile,
+            resolutionVerifiers: opts.resolutionVerifiers,
+        });
+    }
+    return written;
+}
+//# sourceMappingURL=writeLockfilesAndRecordVerified.js.map