@pnpm/installing.deps-installer 1101.2.0 → 1101.3.0

package/lib/install/extendInstallOptions.d.ts

@@ -186,6 +186,24 @@ export interface StrictInstallOptions {
     trustPolicyIgnoreAfter?: number;
     packageVulnerabilityAudit?: PackageVulnerabilityAudit;
     blockExoticSubdeps?: boolean;
+    /**
+     * Optional alternative install engine. When set, the frozen-install
+     * path invokes this callback instead of `headlessInstall`. The CLI
+     * layer constructs it (today: spawning the pacquet binary installed
+     * via `configDependencies` and forwarding pnpm's own CLI argv); the
+     * installer treats it as an opaque "do the install" hook so it
+     * doesn't need to know about pacquet's binary path, CLI surface, or
+     * any settings that only pacquet consumes.
+     *
+     * `filterResolvedProgress` tells the helper to drop the engine's
+     * own `pnpm:progress status:resolved` events because pnpm already
+     * emitted one per package during a preceding lockfileOnly resolve
+     * pass. The frozen-install path passes `false` (or nothing): no
+     * resolve pass ran, so the engine's events are the only source.
+     */
+    runPacquet?: (opts?: {
+        filterResolvedProgress?: boolean;
+    }) => Promise<void>;
     /**
      * If true, `mutateModules` does not emit the per-install `summary` log
      * event. Used by `pnpm add -g` when it runs multiple isolated installs

package/lib/install/index.js

@@ -171,26 +171,50 @@ export async function mutateModules(projects, maybeOpts) {
     // resolver's own filters already cover fresh resolution. We run this
     // exactly once, right after the lockfile is loaded from disk, before any
     // path branches.
-    const cacheActive = opts.cacheDir != null && opts.resolutionVerifiers.length > 0;
-    const wantedLockfilePath = cacheActive
-        ? path.resolve(ctx.lockfileDir, await getWantedLockfileName({
-            useGitBranchLockfile: opts.useGitBranchLockfile,
-            mergeGitBranchLockfiles: opts.mergeGitBranchLockfiles,
-        }))
-        : undefined;
-    try {
-        await verifyLockfileResolutions(ctx.wantedLockfile, opts.resolutionVerifiers, {
-            cacheDir: opts.cacheDir,
-            lockfilePath: wantedLockfilePath,
-        });
-    }
-    catch (err) {
-        // verifyLockfileResolutions is the one throw site in this function
-        // that's part of normal user-facing operation (a rejected lockfile);
-        // other throws here are unexpected. Detach the reporter listener so
-        // long-lived processes don't leak it on every rejected install.
-        detachReporter();
-        throw err;
+    //
+    // Skipped when we already know pacquet will run the install: pacquet's
+    // frozen-install path applies the same resolver-policy gate (port of
+    // this function), so re-running here would duplicate the work — and
+    // for `minimumReleaseAge` in strict mode each lockfile entry is an
+    // HTTP probe.
+    //
+    // The predicate mirrors every short-circuit `tryFrozenInstall` checks
+    // before reaching the pacquet branch: anything that would make it
+    // return null, throw, or fall through to the JS path must keep
+    // verification on. The optimistic `preferFrozenLockfile` path decides
+    // whether to delegate later (based on `allProjectsAreUpToDate`), which
+    // isn't known here — so verification still runs in that window, the
+    // duplicate is bounded to it.
+    const willDelegateToPacquet = opts.runPacquet != null &&
+        installsOnly &&
+        !opts.lockfileOnly &&
+        !opts.fixLockfile &&
+        !opts.dedupe &&
+        !ctx.lockfileHadConflicts &&
+        ctx.existsNonEmptyWantedLockfile &&
+        (opts.frozenLockfile === true || opts.frozenLockfileIfExists === true);
+    if (!willDelegateToPacquet) {
+        const cacheActive = opts.cacheDir != null && opts.resolutionVerifiers.length > 0;
+        const wantedLockfilePath = cacheActive
+            ? path.resolve(ctx.lockfileDir, await getWantedLockfileName({
+                useGitBranchLockfile: opts.useGitBranchLockfile,
+                mergeGitBranchLockfiles: opts.mergeGitBranchLockfiles,
+            }))
+            : undefined;
+        try {
+            await verifyLockfileResolutions(ctx.wantedLockfile, opts.resolutionVerifiers, {
+                cacheDir: opts.cacheDir,
+                lockfilePath: wantedLockfilePath,
+            });
+        }
+        catch (err) {
+            // verifyLockfileResolutions is the one throw site in this function
+            // that's part of normal user-facing operation (a rejected lockfile);
+            // other throws here are unexpected. Detach the reporter listener so
+            // long-lived processes don't leak it on every rejected install.
+            detachReporter();
+            throw err;
+        }
     }
     if (opts.hooks.preResolution) {
         for (const preResolution of opts.hooks.preResolution) {
@@ -672,6 +696,28 @@ Note that in CI environments, this setting is enabled by default.`,
         else {
             logger.info({ message: 'Lockfile is up to date, resolution step is skipped', prefix: opts.lockfileDir });
         }
+        if (opts.runPacquet != null) {
+            try {
+                await opts.runPacquet();
+            }
+            catch (err) {
+                // Same reasoning as the verifyLockfileResolutions catch above: this
+                // is the user-facing failure path, so detach the reporter listener
+                // before rethrowing so long-lived processes don't leak it.
+                detachReporter();
+                throw err;
+            }
+            return {
+                updatedProjects: projects.map((mutatedProject) => {
+                    const project = ctx.projects[mutatedProject.rootDir];
+                    return {
+                        ...project,
+                        manifest: project.originalManifest ?? project.manifest,
+                    };
+                }),
+                ignoredBuilds: undefined,
+            };
+        }
         try {
             const { stats, ignoredBuilds } = await headlessInstall({
                 ...ctx,
@@ -1284,8 +1330,16 @@ const _installInContext = async (projects, ctx, opts) => {
                 ...lockfileOpts,
             });
         }
-        if (opts.nodeLinker !== 'hoisted') {
-            // This is only needed because otherwise the reporter will hang
+        if (opts.nodeLinker !== 'hoisted' && opts.runPacquet == null) {
+            // This is only needed because otherwise the reporter will hang.
+            // Skipped when pacquet is about to take over the materialization
+            // phase: the default reporter completes the progress stream for
+            // this prefix on `importing_done`, so emitting it from the
+            // lockfileOnly resolve pass would prematurely close the stream
+            // and pacquet's own `importing_started` / progress events would
+            // render to a stale stream. Pacquet emits its own
+            // `importing_done` after the install, which closes the stream
+            // normally.
             stageLogger.debug({
                 prefix: opts.lockfileDir,
                 stage: 'importing_done',
@@ -1309,7 +1363,15 @@ const _installInContext = async (projects, ctx, opts) => {
         strictPeerDependencies: opts.strictPeerDependencies,
         rules: opts.peerDependencyRules,
     });
-    if (!opts.omitSummaryLog) {
+    // Skipped when pacquet will take over the materialization. The
+    // default reporter's `reportSummary` `take(1)`s the first summary
+    // event and combines it with whatever `pkgsDiff` it has at that
+    // moment — which is empty here, since pacquet hasn't emitted its
+    // per-direct-dep `pnpm:root` events yet. Letting pnpm fire summary
+    // now would lock in an empty diff. Pacquet emits its own
+    // `pnpm:summary` after the install completes, by which point its
+    // root events have populated the diff.
+    if (!opts.omitSummaryLog && opts.runPacquet == null) {
         summaryLogger.debug({ prefix: opts.lockfileDir });
     }
     // Similar to the sequencing for when the original wanted lockfile is
@@ -1336,6 +1398,33 @@ const _installInContext = async (projects, ctx, opts) => {
 function allMutationsAreInstalls(projects) {
     return projects.every((project) => project.mutation === 'install' && !project.update && !project.updateMatching);
 }
+/**
+ * Run the pacquet binary if it's configured, otherwise run the JS
+ * `headlessInstall`. Callers can hand off any code path that materializes
+ * an already-resolved lockfile (workspace partial install, hoisted
+ * linker, agent-server install, frozen install) without restating the
+ * delegation choice.
+ *
+ * Pacquet reads the wanted lockfile from disk and produces its own
+ * `pnpm:stats` / `pnpm:ignored-scripts` log events that drive the
+ * reporter. The structured stats / ignoredBuilds return values that
+ * `headlessInstall` produces aren't recovered here — pacquet doesn't
+ * surface them through any return path — so callers get `undefined` for
+ * both. `mutateModules` already tolerates that (it falls back to a zero
+ * stats record and a no-op ignoredBuilds iteration).
+ */
+async function materializeOrDelegate(opts, runHeadlessInstall) {
+    if (opts.runPacquet != null) {
+        // Reached only from the resolve-then-materialize call sites
+        // (workspace-partial, hoisted-linker, agent install). Each ran a
+        // lockfileOnly resolve pass that emitted one
+        // `pnpm:progress status:resolved` per package, so pacquet's
+        // duplicate `resolved` events would double the reporter's count.
+        await opts.runPacquet({ filterResolvedProgress: true });
+        return {};
+    }
+    return runHeadlessInstall();
+}
 const installInContext = async (projects, ctx, opts) => {
     try {
         const isPathInsideWorkspace = isSubdir.bind(null, opts.lockfileDir);
@@ -1372,7 +1461,7 @@ const installInContext = async (projects, ctx, opts) => {
                     ...opts,
                     lockfileOnly: true,
                 });
-                const { stats, ignoredBuilds } = await headlessInstall({
+                const { stats, ignoredBuilds } = await materializeOrDelegate(opts, () => headlessInstall({
                     ...ctx,
                     ...opts,
                     currentEngine: {
@@ -1386,7 +1475,7 @@ const installInContext = async (projects, ctx, opts) => {
                     wantedLockfile: result.newLockfile,
                     useLockfile: opts.useLockfile && ctx.wantedLockfileIsModified,
                     hoistWorkspacePackages: opts.hoistWorkspacePackages,
-                });
+                }));
                 return {
                     ...result,
                     stats,
@@ -1399,7 +1488,7 @@ const installInContext = async (projects, ctx, opts) => {
                 ...opts,
                 lockfileOnly: true,
             });
-            const { stats, ignoredBuilds } = await headlessInstall({
+            const { stats, ignoredBuilds } = await materializeOrDelegate(opts, () => headlessInstall({
                 ...ctx,
                 ...opts,
                 currentEngine: {
@@ -1413,13 +1502,29 @@ const installInContext = async (projects, ctx, opts) => {
                 wantedLockfile: result.newLockfile,
                 useLockfile: opts.useLockfile && ctx.wantedLockfileIsModified,
                 hoistWorkspacePackages: opts.hoistWorkspacePackages,
-            });
+            }));
             return {
                 ...result,
                 stats,
                 ignoredBuilds,
             };
         }
+        // Isolated `nodeLinker` (the default) with a non-frozen install:
+        // pacquet doesn't ship a resolver yet, so split the install in two —
+        // ask `_installInContext` for a `lockfileOnly` resolve pass (writes
+        // `pnpm-lock.yaml`), then hand the freshly-written lockfile to
+        // pacquet for the fetch / import / link / build phases. The frozen
+        // branch is handled earlier in `tryFrozenInstall`; the hoisted
+        // branch above already runs the same resolve-then-materialize
+        // sequence (it had to even before pacquet existed). When no pacquet
+        // is configured this falls through to the full single-pass install.
+        if (opts.runPacquet != null && !opts.lockfileOnly) {
+            const result = await _installInContext(projects, ctx, { ...opts, lockfileOnly: true });
+            // The resolve pass above emitted a `pnpm:progress status:resolved`
+            // per package; ask pacquet to drop its own duplicates.
+            await opts.runPacquet({ filterResolvedProgress: true });
+            return result;
+        }
         return await _installInContext(projects, ctx, opts);
     }
     catch (error) { // eslint-disable-line
@@ -1831,13 +1936,18 @@ async function installFromPnpmRegistry(manifest, rootDir, opts, allInstallProjec
             skipped: new Set(),
             wantedLockfile: lockfile,
         };
+        const { ignoredBuilds, stats } = await materializeOrDelegate(opts, 
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        const { ignoredBuilds, stats } = await headlessInstall(headlessOpts);
+        () => headlessInstall(headlessOpts));
         return {
             updatedCatalogs: undefined,
             updatedManifest: manifest,
             ignoredBuilds,
-            stats,
+            // Pacquet doesn't surface a structured stats return; default to
+            // zeros so the agent-path's non-optional `stats` slot is filled.
+            // The reporter still renders accurate counts from pacquet's
+            // `pnpm:stats` log events.
+            stats: stats ?? { added: 0, removed: 0, linkedToRoot: 0 },
             lockfile,
             // Server-side resolution (pnpm agent) enforces `minimumReleaseAge`
             // itself — the agent picks only mature versions and the lockfile

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-installer",
-  "version": "1101.2.0",
+  "version": "1101.3.0",
   "description": "Fast, disk space efficient installation engine",
   "keywords": [
     "pnpm",
@@ -62,60 +62,60 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "run-groups": "^5.0.0",
     "semver": "^7.7.2",
-    "@pnpm/agent.client": "1.0.6",
-    "@pnpm/bins.linker": "1100.0.7",
-    "@pnpm/bins.remover": "1100.0.4",
-    "@pnpm/building.after-install": "1101.0.13",
-    "@pnpm/building.during-install": "1101.0.11",
-    "@pnpm/building.policy": "1100.0.5",
+    "@pnpm/agent.client": "1.0.7",
+    "@pnpm/bins.linker": "1100.0.8",
+    "@pnpm/bins.remover": "1100.0.5",
+    "@pnpm/building.after-install": "1101.0.14",
+    "@pnpm/building.during-install": "1101.0.12",
+    "@pnpm/building.policy": "1100.0.6",
     "@pnpm/catalogs.protocol-parser": "1100.0.0",
     "@pnpm/catalogs.resolver": "1100.0.0",
     "@pnpm/catalogs.types": "1100.0.0",
     "@pnpm/config.matcher": "1100.0.1",
-    "@pnpm/config.normalize-registries": "1100.0.3",
+    "@pnpm/config.normalize-registries": "1100.0.4",
     "@pnpm/config.parse-overrides": "1100.0.1",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/core-loggers": "1100.1.0",
+    "@pnpm/core-loggers": "1100.1.1",
     "@pnpm/crypto.hash": "1100.0.1",
-    "@pnpm/crypto.object-hasher": "1100.0.0",
-    "@pnpm/deps.graph-hasher": "1100.2.0",
+    "@pnpm/deps.graph-hasher": "1100.2.1",
+    "@pnpm/deps.path": "1100.0.4",
     "@pnpm/deps.graph-sequencer": "1100.0.0",
-    "@pnpm/deps.path": "1100.0.3",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/exec.lifecycle": "1100.0.11",
+    "@pnpm/exec.lifecycle": "1100.0.12",
     "@pnpm/fs.read-modules-dir": "1100.0.1",
-    "@pnpm/fs.symlink-dependency": "1100.0.4",
-    "@pnpm/hooks.read-package-hook": "1100.0.3",
-    "@pnpm/hooks.types": "1100.0.7",
-    "@pnpm/installing.context": "1100.0.11",
-    "@pnpm/installing.deps-resolver": "1100.1.0",
-    "@pnpm/installing.deps-restorer": "1101.1.3",
-    "@pnpm/installing.linking.direct-dep-linker": "1100.0.4",
-    "@pnpm/installing.linking.hoist": "1100.0.7",
-    "@pnpm/installing.linking.modules-cleaner": "1100.1.2",
-    "@pnpm/installing.modules-yaml": "1100.0.4",
-    "@pnpm/installing.package-requester": "1101.0.7",
-    "@pnpm/lockfile.filtering": "1100.1.1",
-    "@pnpm/lockfile.fs": "1100.1.0",
-    "@pnpm/lockfile.preferred-versions": "1100.0.10",
-    "@pnpm/lockfile.pruner": "1100.0.6",
-    "@pnpm/lockfile.settings-checker": "1100.0.11",
-    "@pnpm/lockfile.to-pnp": "1100.0.9",
-    "@pnpm/lockfile.utils": "1100.0.8",
-    "@pnpm/lockfile.verification": "1100.0.11",
-    "@pnpm/lockfile.walker": "1100.0.6",
-    "@pnpm/patching.config": "1100.0.3",
-    "@pnpm/pkg-manifest.utils": "1100.1.4",
+    "@pnpm/fs.symlink-dependency": "1100.0.5",
+    "@pnpm/installing.context": "1100.0.12",
+    "@pnpm/crypto.object-hasher": "1100.0.0",
+    "@pnpm/installing.deps-restorer": "1101.1.4",
+    "@pnpm/hooks.types": "1100.0.8",
+    "@pnpm/installing.deps-resolver": "1100.1.1",
+    "@pnpm/installing.linking.direct-dep-linker": "1100.0.5",
+    "@pnpm/installing.linking.hoist": "1100.0.8",
+    "@pnpm/installing.linking.modules-cleaner": "1100.1.3",
+    "@pnpm/installing.package-requester": "1101.0.8",
+    "@pnpm/installing.modules-yaml": "1100.0.5",
+    "@pnpm/lockfile.filtering": "1100.1.2",
+    "@pnpm/hooks.read-package-hook": "1100.0.4",
+    "@pnpm/lockfile.fs": "1100.1.1",
+    "@pnpm/lockfile.preferred-versions": "1100.0.11",
+    "@pnpm/lockfile.pruner": "1100.0.7",
+    "@pnpm/lockfile.to-pnp": "1100.0.10",
+    "@pnpm/lockfile.utils": "1100.0.9",
+    "@pnpm/lockfile.walker": "1100.0.7",
+    "@pnpm/lockfile.settings-checker": "1100.0.12",
+    "@pnpm/lockfile.verification": "1100.0.12",
+    "@pnpm/patching.config": "1100.0.4",
+    "@pnpm/pkg-manifest.utils": "1100.2.0",
     "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
-    "@pnpm/resolving.resolver-base": "1100.2.0",
-    "@pnpm/store.controller-types": "1100.1.0",
+    "@pnpm/resolving.resolver-base": "1100.3.0",
+    "@pnpm/store.controller-types": "1100.1.1",
     "@pnpm/store.index": "1100.1.0",
-    "@pnpm/types": "1101.1.0",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.6"
+    "@pnpm/types": "1101.1.1",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.7"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0",
-    "@pnpm/worker": "^1100.1.6"
+    "@pnpm/worker": "^1100.1.7"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
@@ -138,21 +138,21 @@
     "symlink-dir": "^10.0.1",
     "write-json-file": "^7.0.0",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/assert-project": "1100.0.9",
-    "@pnpm/assert-store": "1100.0.9",
-    "@pnpm/installing.deps-installer": "1101.2.0",
-    "@pnpm/lockfile.types": "1100.0.6",
+    "@pnpm/assert-project": "1100.0.10",
+    "@pnpm/assert-store": "1100.0.10",
+    "@pnpm/installing.deps-installer": "1101.3.0",
+    "@pnpm/lockfile.types": "1100.0.7",
     "@pnpm/logger": "1100.0.0",
     "@pnpm/network.git-utils": "1100.0.1",
-    "@pnpm/pkg-manifest.reader": "1100.0.3",
-    "@pnpm/prepare": "1100.0.9",
-    "@pnpm/resolving.registry.types": "1100.0.3",
-    "@pnpm/store.cafs": "1100.1.5",
+    "@pnpm/pkg-manifest.reader": "1100.0.4",
+    "@pnpm/prepare": "1100.0.10",
+    "@pnpm/resolving.registry.types": "1100.0.4",
     "@pnpm/store.path": "1100.0.1",
+    "@pnpm/store.cafs": "1100.1.6",
     "@pnpm/test-fixtures": "1100.0.0",
     "@pnpm/test-ipc-server": "1100.0.0",
-    "@pnpm/testing.mock-agent": "1100.0.5",
-    "@pnpm/testing.temp-store": "1100.1.0"
+    "@pnpm/testing.mock-agent": "1100.0.6",
+    "@pnpm/testing.temp-store": "1100.1.1"
   },
   "engines": {
     "node": ">=22.13"