@pnpm/installing.deps-installer 1101.6.1 → 1101.7.0

package/lib/install/extendInstallOptions.d.ts

@@ -229,8 +229,11 @@ export interface StrictInstallOptions {
      * summary at the very end instead of one summary per install.
      */
     omitSummaryLog: boolean;
-    /** URL of a pnpm agent server. See the pnpm-agent README. */
-    agent?: string;
+    /**
+     * URL of a pnpr server that resolves dependencies server-side and serves
+     * only the files missing from the client's store.
+     */
+    pnprServer?: string;
 }
 export type InstallOptions = Partial<StrictInstallOptions> & Pick<StrictInstallOptions, 'storeDir' | 'storeController'>;
 export interface ProcessedInstallOptions extends StrictInstallOptions {

package/lib/install/index.js

@@ -15,7 +15,7 @@ import { getContext } from '@pnpm/installing.context';
 import { getWantedDependencies, resolveDependencies, } from '@pnpm/installing.deps-resolver';
 import { extendProjectsWithTargetDirs, headlessInstall } from '@pnpm/installing.deps-restorer';
 import { writeModulesManifest } from '@pnpm/installing.modules-yaml';
-import { cleanGitBranchLockfiles, getWantedLockfileName, isEmptyLockfile, readWantedLockfile, writeCurrentLockfile, writeLockfiles, writeWantedLockfile, } from '@pnpm/lockfile.fs';
+import { cleanGitBranchLockfiles, getWantedLockfileName, isEmptyLockfile, readWantedLockfileFile, writeCurrentLockfile, writeLockfiles, writeWantedLockfile, } from '@pnpm/lockfile.fs';
 import { getPreferredVersionsFromLockfileAndManifests } from '@pnpm/lockfile.preferred-versions';
 import { calcPatchHashes, createOverridesMapFromParsed, getOutdatedLockfileSetting, } from '@pnpm/lockfile.settings-checker';
 import { writePnpFile } from '@pnpm/lockfile.to-pnp';
@@ -55,9 +55,9 @@ const BROKEN_LOCKFILE_INTEGRITY_ERRORS = new Set([
 const DEV_PREINSTALL = 'pnpm:devPreinstall';
 export async function install(manifest, opts) {
     const rootDir = (opts.dir ?? process.cwd());
-    // When a pnpm agent is configured, use server-side resolution
+    // When a pnpr server is configured, use server-side resolution
     // instead of the normal resolution flow.
-    if (opts.agent) {
+    if (opts.pnprServer) {
         return installFromPnpmRegistry(manifest, rootDir, opts);
     }
     const { updatedCatalogs, updatedProjects: projects, ignoredBuilds, resolutionPolicyViolations } = await mutateModules([
@@ -120,14 +120,14 @@ export async function mutateModules(projects, maybeOpts) {
         streamParser.on('data', reporter);
     }
     const opts = extendOptions(maybeOpts);
-    // When a pnpm agent is configured, use server-side resolution. The agent
+    // When a pnpr server is configured, use server-side resolution. The pnpr server
     // path supports `install`, `installSome` (pnpm add), and `uninstallSome`
     // (pnpm remove). Mutations that need full client-side resolution (update
     // flags) still fall through to the normal flow.
-    if (opts.agent && canUseAgentForMutations(projects)) {
-        const agentResult = await mutateModulesViaAgent(projects, opts);
-        if (agentResult)
-            return agentResult;
+    if (opts.pnprServer && canUsePnprForMutations(projects)) {
+        const pnprResult = await mutateModulesViaPnpr(projects, opts);
+        if (pnprResult)
+            return pnprResult;
     }
     const allowBuild = createAllowBuildFunction(opts);
     if (!opts.include.dependencies && opts.include.optionalDependencies) {
@@ -536,14 +536,21 @@ export async function mutateModules(projects, maybeOpts) {
             });
             if (opts.catalogMode !== 'manual') {
                 for (const wantedDep of wantedDeps) {
+                    // A `runtime:` specifier (e.g. node from `devEngines.runtime` or
+                    // `pnpm runtime set`) round-trips to `devEngines.runtime` through the
+                    // manifest writer, which only recognizes the `runtime:` protocol.
+                    // Promoting it into a catalog rewrites the entry to `catalog:`, which
+                    // breaks that round-trip and strands it in `devDependencies`.
+                    if (wantedDep.bareSpecifier?.startsWith('runtime:'))
+                        continue;
                     const perDepCatalogName = getPerDepCatalogName(wantedDep, opts.saveCatalogName);
                     const catalogBareSpecifier = `catalog:${perDepCatalogName === 'default' ? '' : perDepCatalogName}`;
                     const catalog = resolveFromCatalog(opts.catalogs, { ...wantedDep, bareSpecifier: catalogBareSpecifier });
                     const catalogDepSpecifier = matchCatalogResolveResult(catalog, pickCatalogSpecifier);
                     if (!catalogDepSpecifier ||
                         wantedDep.bareSpecifier === catalogBareSpecifier ||
-                        semver.validRange(wantedDep.bareSpecifier) &&
-                            semver.validRange(catalogDepSpecifier) &&
+                        semver.valid(wantedDep.bareSpecifier) &&
+                            semver.valid(catalogDepSpecifier) &&
                             semver.eq(wantedDep.bareSpecifier, catalogDepSpecifier)) {
                         wantedDep.saveCatalogName = perDepCatalogName;
                         continue;
@@ -1409,7 +1416,7 @@ function allMutationsAreInstalls(projects) {
  * Run the pacquet binary if it's configured, otherwise run the JS
  * `headlessInstall`. Callers can hand off any code path that materializes
  * an already-resolved lockfile (workspace partial install, hoisted
- * linker, agent-server install, frozen install) without restating the
+ * linker, pnpr server install, frozen install) without restating the
  * delegation choice.
  *
  * Pacquet reads the wanted lockfile from disk and produces its own
@@ -1423,7 +1430,7 @@ function allMutationsAreInstalls(projects) {
 async function materializeOrDelegate(opts, runHeadlessInstall) {
     if (opts.runPacquet != null) {
         // Reached only from the resolve-then-materialize call sites
-        // (workspace-partial, hoisted-linker, agent install). Each ran a
+        // (workspace-partial, hoisted-linker, pnpr server install). Each ran a
         // lockfileOnly resolve pass that emitted one
         // `pnpm:progress status:resolved` per package, so pacquet's
         // duplicate `resolved` events would double the reporter's count.
@@ -1588,13 +1595,13 @@ function getProjectsWithTargetDirs(projects, lockfile, dependenciesGraph) {
     return extendProjectsWithTargetDirs(projects, injectionTargetsByDepPath);
 }
 /**
- * Whether the agent path can handle this batch of mutations. The agent flow
+ * Whether the pnpr server path can handle this batch of mutations. The pnpr server flow
  * supports installing the manifest as-is (`install`), adding new deps
  * (`installSome`), and removing deps (`uninstallSome`). It cannot model the
  * client-side update-flag behavior (`update`/`updateMatching`/`updateToLatest`)
  * yet, so those still go through the normal client-side resolver.
  */
-function canUseAgentForMutations(projects) {
+function canUsePnprForMutations(projects) {
     if (projects.length === 0)
         return false;
     return projects.every((p) => {
@@ -1607,26 +1614,26 @@ function canUseAgentForMutations(projects) {
     });
 }
 /**
- * Pre-process projects for the agent flow:
+ * Pre-process projects for the pnpr server flow:
  * - `install`: send the manifest as-is.
  * - `uninstallSome`: drop the named deps from the manifest before sending,
- *   so the agent's resolution naturally produces a lockfile without them.
+ *   so the pnpr server's resolution naturally produces a lockfile without them.
  * - `installSome`: parse selectors and merge them into the manifest. The
- *   agent server then resolves the merged manifest, and we read the resolved
+ *   pnpr server then resolves the merged manifest, and we read the resolved
  *   specifiers (with the right save-prefix applied server-side) back from
  *   the lockfile importer entries to update the client-side manifest.
  *
  * Returns null if the projects don't map cleanly to allProjects (caller
  * should fall through to the normal flow).
  */
-async function prepareAgentProjects(projects, opts) {
+async function preparePnprProjects(projects, opts) {
     const allProjects = opts.allProjects ?? [];
     const mutationByRootDir = new Map();
     for (const p of projects) {
         mutationByRootDir.set(p.rootDir, p);
     }
     // Include every workspace project, not just the mutated ones — otherwise
-    // the agent's resulting lockfile would only contain the targeted importer
+    // the pnpr server's resulting lockfile would only contain the targeted importer
     // and `headlessInstall` (or a later install) would crash on the missing
     // entries for the other workspace projects. Projects without a mutation
     // are sent with their current manifest (no-op for resolution).
@@ -1685,7 +1692,7 @@ async function prepareAgentProjects(projects, opts) {
  * dependency field per the mutation's `targetDependenciesField` (or the
  * existing field if the dep is already in the manifest, defaulting to
  * `dependencies`). Selectors without a version use `'latest'` so the
- * agent's resolver picks the newest matching release.
+ * pnpr server's resolver picks the newest matching release.
  */
 function mergeInstallSelectors(manifest, mutation) {
     const target = mutation.targetDependenciesField;
@@ -1729,10 +1736,10 @@ function findExistingSpec(alias, manifest) {
         manifest.optionalDependencies?.[alias];
 }
 /**
- * After the agent resolves, copy the lockfile importer's per-dep specifier
+ * After the pnpr server resolves, copy the lockfile importer's per-dep specifier
  * (which the server's resolver computed with the right save-prefix) back
  * into the client manifest for any newly added aliases. We rely on the
- * lockfile because the agent server applies catalog substitution,
+ * lockfile because the pnpr server applies catalog substitution,
  * normalizedBareSpecifier, and save-prefix logic during resolution.
  */
 function applyResolvedSpecsFromLockfile(manifest, importerSnapshot, newDeps, pinnedVersion) {
@@ -1751,7 +1758,7 @@ function applyResolvedSpecsFromLockfile(manifest, importerSnapshot, newDeps, pin
             const resolvedVersion = importerSnapshot[field]?.[dep.alias];
             if (!resolvedVersion || manifest[field]?.[dep.alias] == null)
                 continue;
-            // The agent server resolved the tree but, on the plain-install path, it
+            // The pnpr server resolved the tree but, on the plain-install path, it
             // writes the user's raw spec (`'latest'`) into the lockfile specifier
             // rather than normalizing to a save-prefix range. Compute the
             // save-prefix spec client-side from the resolved version.
@@ -1762,24 +1769,24 @@ function applyResolvedSpecsFromLockfile(manifest, importerSnapshot, newDeps, pin
     return manifest;
 }
 /**
- * Drives the agent path for a `mutateModules` call across one or more
- * projects. Returns null if the call can't be served by the agent (e.g. one
+ * Drives the pnpr server path for a `mutateModules` call across one or more
+ * projects. Returns null if the call can't be served by the pnpr server (e.g. one
  * of the projects isn't in `allProjects`).
  */
-async function mutateModulesViaAgent(projects, opts) {
-    const agentProjects = await prepareAgentProjects(projects, opts);
-    if (!agentProjects)
+async function mutateModulesViaPnpr(projects, opts) {
+    const pnprProjects = await preparePnprProjects(projects, opts);
+    if (!pnprProjects)
         return null;
     // installFromPnpmRegistry runs the headless install for the first
     // project's root and the workspace path for the rest. Pass the
     // pre-processed manifests so resolution sees the post-mutation state.
-    const result = await installFromPnpmRegistry(agentProjects[0].manifest, agentProjects[0].rootDir, opts, agentProjects.map((p) => ({ rootDir: p.rootDir, manifest: p.manifest })));
+    const result = await installFromPnpmRegistry(pnprProjects[0].manifest, pnprProjects[0].rootDir, opts, pnprProjects.map((p) => ({ rootDir: p.rootDir, manifest: p.manifest })));
     // For installSome projects, copy resolved specs from the lockfile importer
     // entries back into the client manifest so save-prefix/catalog/etc. take
     // effect (the server applies these during its resolution step).
     const lockfileDir = opts.lockfileDir ?? projects[0].rootDir;
     const mutatedRootDirs = new Set(projects.map((p) => p.rootDir));
-    const updatedProjects = agentProjects
+    const updatedProjects = pnprProjects
         .filter((p) => mutatedRootDirs.has(p.rootDir))
         .map((p) => {
         if (p.mutation === 'installSome' && p.newDeps.length > 0) {
@@ -1798,63 +1805,79 @@ async function mutateModulesViaAgent(projects, opts) {
     };
 }
 /**
- * When a pnpm agent is configured, resolve dependencies server-side
+ * When a pnpr server is configured, resolve dependencies server-side
  * and download only the missing files. Then run a headless install to link
  * packages into node_modules.
  */
 async function installFromPnpmRegistry(manifest, rootDir, opts, allInstallProjects) {
-    // The agent path skips client-side resolution, so resolver-side policies
+    // The pnpr server path skips client-side resolution, so resolver-side policies
     // can't be enforced locally. `minimumReleaseAge` is forwarded to the
-    // agent and enforced server-side. `trustPolicy` has no server-side
+    // pnpr server and enforced server-side. `trustPolicy` has no server-side
     // counterpart yet, so refuse to run under it instead of silently
     // letting through a lockfile the local verifier would reject.
     if (opts.trustPolicy === 'no-downgrade') {
-        throw new PnpmError('TRUST_POLICY_INCOMPATIBLE_WITH_AGENT', 'The pnpm agent does not yet enforce `trustPolicy: no-downgrade`, so running an install through the agent under this policy would produce a lockfile that the local verifier rejects.', { hint: 'Unset `trustPolicy` for this install, or disable the agent (unset `--agent` / `agent` in pnpm-workspace.yaml) so resolution runs locally and the trust check applies.' });
+        throw new PnpmError('TRUST_POLICY_INCOMPATIBLE_WITH_PNPR', 'The pnpr server does not yet enforce `trustPolicy: no-downgrade`, so running an install through it under this policy would produce a lockfile that the local verifier rejects.', { hint: 'Unset `trustPolicy` for this install, or disable the pnpr server (unset `--pnpr-server` / `pnprServer` in pnpm-workspace.yaml) so resolution runs locally and the trust check applies.' });
     }
-    const { fetchFromPnpmRegistry } = await import('@pnpm/agent.client');
+    const { fetchFromPnpmRegistry } = await import('@pnpm/pnpr.client');
+    const { createGetAuthHeaderByURI, getAuthHeadersFromCreds } = await import('@pnpm/network.auth-header');
     const { StoreIndex } = await import('@pnpm/store.index');
     const { setImportConcurrency } = await import('@pnpm/worker');
-    // Raise import concurrency for this install only — the agent path has no
+    // Forward the whole credential map (the registries a graph touches
+    // aren't known up front), so the server attaches the right token per
+    // URL. `authorization` also identifies the caller to pnpr's gate.
+    const configByUri = opts.configByUri ?? {};
+    const forwardedAuthHeaders = getAuthHeadersFromCreds(configByUri);
+    const pnprAuthorization = createGetAuthHeaderByURI(configByUri)(opts.pnprServer);
+    // Raise import concurrency for this install only — the pnpr server path has no
     // concurrent fetching competing for workers. Restore afterwards so we
     // don't leak a process-wide mutation to other installs (e.g. tests).
     const restoreImportConcurrency = setImportConcurrency(6);
     try {
         const lockfileDir = opts.lockfileDir ?? rootDir;
-        // Read existing lockfile if available
-        const existingLockfile = await readWantedLockfile(lockfileDir, {
+        // Read the existing lockfile (if any) in its on-disk shape — that's
+        // what the pnpr server protocol carries, so no conversion is needed before
+        // sending it.
+        const existingLockfile = await readWantedLockfileFile(lockfileDir, {
             ignoreIncompatible: true,
         }).catch(() => null);
-        logger.info({ message: 'Resolving dependencies via pnpm agent', prefix: rootDir });
+        logger.info({ message: 'Resolving dependencies via the pnpr server', prefix: rootDir });
         // Open the store index to read integrities and write new entries.
         // Close it in a finally so a failure in fetchFromPnpmRegistry doesn't
         // leak an open SQLite handle (on Windows that also blocks store cleanup).
         const storeIndex = new StoreIndex(opts.storeDir);
-        let lockfile, agentStats, fileDownloads, indexEntries;
+        let lockfile, pnprStats, fileDownloads, indexEntries;
         try {
             // Build projects list for workspace support.
             // Normalize separators to POSIX — on Windows `path.relative` returns
-            // backslashes, which the agent server rejects (it treats `\` as an
+            // backslashes, which the pnpr server rejects (it treats `\` as an
             // unsafe/YAML-injection character and normalizes paths as POSIX).
             const projectsList = allInstallProjects && allInstallProjects.length > 1
                 ? allInstallProjects.map(p => ({
                     dir: (path.relative(lockfileDir, p.rootDir) || '.').split(path.sep).join('/'),
                     dependencies: p.manifest.dependencies,
                     devDependencies: p.manifest.devDependencies,
+                    optionalDependencies: p.manifest.optionalDependencies,
                 }))
                 : undefined;
-            ({ lockfile, stats: agentStats, fileDownloads, indexEntries } = await fetchFromPnpmRegistry({
-                registryUrl: opts.agent,
+            ({ lockfile, stats: pnprStats, fileDownloads, indexEntries } = await fetchFromPnpmRegistry({
+                registryUrl: opts.pnprServer,
                 storeDir: opts.storeDir,
                 storeIndex,
                 dependencies: projectsList ? undefined : manifest.dependencies,
                 devDependencies: projectsList ? undefined : manifest.devDependencies,
+                optionalDependencies: projectsList ? undefined : manifest.optionalDependencies,
                 projects: projectsList,
+                registry: opts.registries?.default,
+                namedRegistries: opts.namedRegistries,
+                authHeaders: forwardedAuthHeaders,
+                authorization: pnprAuthorization,
                 overrides: opts.overrides,
                 minimumReleaseAge: opts.minimumReleaseAge,
                 lockfile: existingLockfile ?? undefined,
+                lockfileOnly: opts.lockfileOnly,
             }));
             // Write store index entries so headless install finds them.
-            const { writeRawIndexEntries } = await import('@pnpm/agent.client');
+            const { writeRawIndexEntries } = await import('@pnpm/pnpr.client');
             writeRawIndexEntries(indexEntries, storeIndex);
             storeIndex.checkpoint();
         }
@@ -1870,12 +1893,29 @@ async function installFromPnpmRegistry(manifest, rootDir, opts, allInstallProjec
             mergeGitBranchLockfiles: opts.mergeGitBranchLockfiles,
         });
         logger.info({
-            message: `Resolved ${agentStats.totalPackages} packages: ${agentStats.alreadyInStore} cached, ${agentStats.filesToDownload} files to download`,
+            message: `Resolved ${pnprStats.totalPackages} packages: ${pnprStats.alreadyInStore} cached, ${pnprStats.filesToDownload} files to download`,
             prefix: rootDir,
         });
+        // `--lockfile-only`: the pnpr server resolved and we wrote the lockfile, but
+        // pnpm fetches nothing and links nothing in this mode — stop before the
+        // headless install. See https://github.com/pnpm/pnpm/issues/12146.
+        if (opts.lockfileOnly) {
+            // Nothing is downloaded in this mode, but the lockfile arrives before
+            // the stream closes — observe `fileDownloads` so a stream error after
+            // the `L` frame doesn't surface as an unhandled rejection.
+            void fileDownloads.catch(() => { });
+            return {
+                updatedCatalogs: undefined,
+                updatedManifest: manifest,
+                ignoredBuilds: undefined,
+                stats: { added: 0, removed: 0, linkedToRoot: 0 },
+                lockfile,
+                resolutionPolicyViolations: [],
+            };
+        }
         // Wrap fetchPackage to:
-        // 1. Wait for agent file downloads before checking the store
-        // 2. Skip integrity verification — files just written from the agent
+        // 1. Wait for pnpr server file downloads before checking the store
+        // 2. Skip integrity verification — files just written from the pnpr server
         //    are guaranteed correct (server verified, no rehashing needed)
         const { readPkgFromCafs } = await import('@pnpm/worker');
         const { storeIndexKey: _storeIndexKey } = await import('@pnpm/store.index');
@@ -1887,7 +1927,7 @@ async function installFromPnpmRegistry(manifest, rootDir, opts, allInstallProjec
                 const integrity = resolution?.integrity;
                 // Fall through to the regular store controller for git-hosted tarballs.
                 // Their cached entry lives under gitHostedStoreIndexKey (preserves the
-                // built/not-built dimension), not the integrity-keyed path the agent
+                // built/not-built dimension), not the integrity-keyed path the pnpr server
                 // uses for npm tarballs. See @pnpm/store.pkg-finder for the rationale.
                 if (integrity && !resolution?.gitHosted) {
                     const filesIndexFile = _storeIndexKey(integrity, fetchOpts.pkg.id);
@@ -1906,7 +1946,7 @@ async function installFromPnpmRegistry(manifest, rootDir, opts, allInstallProjec
         };
         const headlessOpts = {
             ...opts,
-            // Skip re-verifying files just written from the agent — they're
+            // Skip re-verifying files just written from the pnpr server — they're
             // guaranteed correct (server verified, no rehashing needed).
             verifyStoreIntegrity: false,
             storeController: wrappedStoreController,
@@ -1948,13 +1988,13 @@ async function installFromPnpmRegistry(manifest, rootDir, opts, allInstallProjec
             updatedManifest: manifest,
             ignoredBuilds,
             // Pacquet doesn't surface a structured stats return; default to
-            // zeros so the agent-path's non-optional `stats` slot is filled.
+            // zeros so the pnpr server's non-optional `stats` slot is filled.
             // The reporter still renders accurate counts from pacquet's
             // `pnpm:stats` log events.
             stats: stats ?? { added: 0, removed: 0, linkedToRoot: 0 },
             lockfile,
-            // Server-side resolution (pnpm agent) enforces `minimumReleaseAge`
-            // itself — the agent picks only mature versions and the lockfile
+            // Server-side resolution (pnpr server) enforces `minimumReleaseAge`
+            // itself — the pnpr server picks only mature versions and the lockfile
             // can't contain immature entries to auto-collect. `trustPolicy` is
             // guarded above (we refuse to enter this path when it's set), so
             // there's nothing for the install command to react to here.

package/lib/install/verifyLockfileResolutions.js

@@ -181,22 +181,25 @@ export async function collectResolutionPolicyViolations(lockfile, verifiers, opt
 // therefore appear multiple times. Dedupe so we issue at most one
 // verification per package version.
 //
-// Include a serialization of `resolution` in the key so two entries that
-// share a (name, version) but differ in *what* was resolved (e.g. one
-// pinned via npm, another via a git URL under the same alias) don't
-// collapse: if the wrong shape wins the dedup, a protocol-scoped
-// verifier short-circuits on the surviving entry and the real one is
+// Include a serialization of `resolution` and `nonSemverVersion` in the key
+// so two entries that share a (name, version) but differ in *what* was
+// resolved (e.g. one pinned via npm, another a URL-keyed tarball whose
+// snapshot copied the same semver `version` from its manifest) don't
+// collapse: `nonSemverVersion` flips whether the npm verifier enforces or
+// skips the tarball/policy checks, so if the wrong shape wins the dedup the
+// surviving entry is verified under the wrong rules and the real one is
 // never checked.
 function collectCandidates(lockfile) {
     const candidates = new Map();
     for (const [depPath, snapshot] of Object.entries(lockfile.packages ?? {})) {
-        const { name, version } = nameVerFromPkgSnapshot(depPath, snapshot);
+        const { name, version, nonSemverVersion } = nameVerFromPkgSnapshot(depPath, snapshot);
         if (!name || !version)
             continue;
-        const key = `${name}@${version}@${JSON.stringify(snapshot.resolution)}`;
+        const key = `${name}@${version}@${nonSemverVersion ?? ''}@${JSON.stringify(snapshot.resolution)}`;
         candidates.set(key, {
             name,
             version,
+            nonSemverVersion,
             resolution: snapshot.resolution,
         });
     }
@@ -205,7 +208,7 @@ function collectCandidates(lockfile) {
 async function iterateLockfileViolations(candidates, verifiers, concurrency) {
     const violations = [];
     const limit = pLimit(concurrency ?? DEFAULT_CONCURRENCY);
-    await Promise.all(Array.from(candidates.values(), ({ name, version, resolution }) => limit(async () => {
+    await Promise.all(Array.from(candidates.values(), ({ name, version, nonSemverVersion, resolution }) => limit(async () => {
         // Fan out across every active verifier; each handles its own
         // protocol short-circuit (e.g. the npm verifier returns ok:true for
         // git resolutions). We stop at the first failure per entry so a
@@ -213,7 +216,7 @@ async function iterateLockfileViolations(candidates, verifiers, concurrency) {
         // same (name, version).
         for (const verifier of verifiers) {
             // eslint-disable-next-line no-await-in-loop
-            const result = await verifier.verify(resolution, { name, version });
+            const result = await verifier.verify(resolution, { name, version, nonSemverVersion });
             if (!result.ok) {
                 violations.push({ name, version, resolution, code: result.code, reason: result.reason });
                 break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-installer",
-  "version": "1101.6.1",
+  "version": "1101.7.0",
   "description": "Fast, disk space efficient installation engine",
   "keywords": [
     "pnpm",
@@ -28,7 +28,10 @@
   ],
   "license": "MIT",
   "funding": "https://opencollective.com/pnpm",
-  "repository": "https://github.com/pnpm/pnpm/tree/main/installing/deps-installer",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/pnpm/pnpm/tree/main/installing/deps-installer"
+  },
   "homepage": "https://github.com/pnpm/pnpm/tree/main/installing/deps-installer#readme",
   "bugs": {
     "url": "https://github.com/pnpm/pnpm/issues"
@@ -62,60 +65,61 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "run-groups": "^5.0.0",
     "semver": "^7.8.1",
-    "@pnpm/agent.client": "1.0.8",
-    "@pnpm/bins.remover": "1100.0.6",
-    "@pnpm/building.after-install": "1101.0.18",
-    "@pnpm/bins.linker": "1100.0.10",
-    "@pnpm/building.during-install": "1101.0.15",
-    "@pnpm/catalogs.protocol-parser": "1100.0.0",
-    "@pnpm/building.policy": "1100.0.7",
+    "@pnpm/building.after-install": "1101.0.19",
+    "@pnpm/bins.linker": "1100.0.11",
+    "@pnpm/building.policy": "1100.0.8",
     "@pnpm/catalogs.resolver": "1100.0.0",
     "@pnpm/config.matcher": "1100.0.1",
-    "@pnpm/config.normalize-registries": "1100.0.5",
+    "@pnpm/catalogs.protocol-parser": "1100.0.0",
+    "@pnpm/building.during-install": "1101.0.16",
+    "@pnpm/config.normalize-registries": "1100.0.6",
+    "@pnpm/core-loggers": "1100.1.3",
+    "@pnpm/bins.remover": "1100.0.7",
     "@pnpm/catalogs.types": "1100.0.0",
-    "@pnpm/config.parse-overrides": "1100.0.1",
-    "@pnpm/deps.graph-hasher": "1100.2.2",
-    "@pnpm/crypto.hash": "1100.0.1",
-    "@pnpm/crypto.object-hasher": "1100.0.0",
     "@pnpm/deps.graph-sequencer": "1100.0.0",
-    "@pnpm/deps.path": "1100.0.5",
-    "@pnpm/exec.lifecycle": "1100.0.14",
-    "@pnpm/hooks.read-package-hook": "1100.0.5",
-    "@pnpm/fs.symlink-dependency": "1100.0.6",
-    "@pnpm/fs.read-modules-dir": "1100.0.1",
-    "@pnpm/installing.deps-resolver": "1100.1.6",
-    "@pnpm/installing.deps-restorer": "1101.1.8",
-    "@pnpm/error": "1100.0.0",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/hooks.types": "1100.0.9",
-    "@pnpm/installing.context": "1100.0.14",
-    "@pnpm/installing.linking.direct-dep-linker": "1100.0.6",
-    "@pnpm/installing.modules-yaml": "1100.0.6",
-    "@pnpm/installing.linking.modules-cleaner": "1100.1.4",
-    "@pnpm/lockfile.filtering": "1100.1.3",
-    "@pnpm/installing.package-requester": "1101.0.10",
-    "@pnpm/installing.linking.hoist": "1100.0.10",
-    "@pnpm/lockfile.fs": "1100.1.2",
-    "@pnpm/lockfile.pruner": "1100.0.8",
-    "@pnpm/lockfile.settings-checker": "1100.0.14",
-    "@pnpm/lockfile.preferred-versions": "1100.0.12",
-    "@pnpm/lockfile.to-pnp": "1100.0.11",
-    "@pnpm/lockfile.verification": "1100.0.14",
-    "@pnpm/lockfile.walker": "1100.0.8",
-    "@pnpm/lockfile.utils": "1100.0.10",
-    "@pnpm/patching.config": "1100.0.5",
-    "@pnpm/core-loggers": "1100.1.2",
-    "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
-    "@pnpm/pkg-manifest.utils": "1100.2.1",
-    "@pnpm/resolving.resolver-base": "1100.3.1",
+    "@pnpm/crypto.object-hasher": "1100.0.0",
+    "@pnpm/deps.path": "1100.0.6",
+    "@pnpm/deps.graph-hasher": "1100.2.3",
+    "@pnpm/error": "1100.0.0",
+    "@pnpm/config.parse-overrides": "1100.0.1",
+    "@pnpm/exec.lifecycle": "1100.0.15",
+    "@pnpm/hooks.read-package-hook": "1100.0.6",
+    "@pnpm/fs.read-modules-dir": "1100.0.1",
+    "@pnpm/hooks.types": "1100.0.10",
+    "@pnpm/installing.context": "1100.0.15",
+    "@pnpm/crypto.hash": "1100.0.1",
+    "@pnpm/installing.deps-resolver": "1100.2.0",
+    "@pnpm/installing.deps-restorer": "1101.1.9",
+    "@pnpm/installing.linking.direct-dep-linker": "1100.0.7",
+    "@pnpm/installing.linking.hoist": "1100.0.11",
+    "@pnpm/installing.modules-yaml": "1100.0.7",
+    "@pnpm/installing.package-requester": "1101.0.11",
+    "@pnpm/lockfile.fs": "1100.1.3",
+    "@pnpm/lockfile.filtering": "1100.1.4",
+    "@pnpm/lockfile.to-pnp": "1100.0.12",
+    "@pnpm/lockfile.preferred-versions": "1100.0.13",
+    "@pnpm/lockfile.utils": "1100.0.11",
+    "@pnpm/lockfile.walker": "1100.0.9",
+    "@pnpm/network.auth-header": "1101.1.0",
+    "@pnpm/pkg-manifest.utils": "1100.2.2",
+    "@pnpm/patching.config": "1100.0.6",
+    "@pnpm/lockfile.pruner": "1100.0.9",
     "@pnpm/store.index": "1100.1.0",
-    "@pnpm/types": "1101.2.0",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.9",
-    "@pnpm/store.controller-types": "1100.1.2"
+    "@pnpm/resolving.resolver-base": "1100.4.0",
+    "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.10",
+    "@pnpm/pnpr.client": "1.1.0",
+    "@pnpm/types": "1101.3.0",
+    "@pnpm/lockfile.settings-checker": "1100.0.15",
+    "@pnpm/installing.linking.modules-cleaner": "1100.1.5",
+    "@pnpm/store.controller-types": "1100.1.3",
+    "@pnpm/lockfile.verification": "1100.0.15",
+    "@pnpm/fs.symlink-dependency": "1100.0.7"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1001.0.1",
-    "@pnpm/worker": "^1100.1.8"
+    "@pnpm/worker": "^1100.1.9"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
@@ -137,22 +141,22 @@
     "symlink-dir": "^10.0.1",
     "write-json-file": "^7.0.0",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/assert-project": "1100.0.12",
-    "@pnpm/installing.deps-installer": "1101.6.1",
-    "@pnpm/assert-store": "1100.0.12",
-    "@pnpm/lockfile.types": "1100.0.8",
+    "@pnpm/assert-project": "1100.0.13",
+    "@pnpm/lockfile.types": "1100.0.9",
+    "@pnpm/installing.deps-installer": "1101.7.0",
+    "@pnpm/prepare": "1100.0.13",
+    "@pnpm/pkg-manifest.reader": "1100.0.6",
     "@pnpm/network.git-utils": "1100.0.1",
-    "@pnpm/pkg-manifest.reader": "1100.0.5",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/prepare": "1100.0.12",
+    "@pnpm/resolving.registry.types": "1100.1.1",
+    "@pnpm/store.cafs": "1100.1.8",
+    "@pnpm/testing.mock-agent": "1101.0.0",
+    "@pnpm/test-ipc-server": "1100.0.0",
     "@pnpm/store.path": "1100.0.1",
-    "@pnpm/resolving.registry.types": "1100.1.0",
     "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/store.cafs": "1100.1.7",
-    "@pnpm/testing.mock-agent": "1100.0.8",
-    "@pnpm/testing.temp-store": "1100.1.5",
-    "@pnpm/test-ipc-server": "1100.0.0",
-    "@pnpm/testing.registry-mock": "1100.0.2"
+    "@pnpm/testing.registry-mock": "1100.0.3",
+    "@pnpm/testing.temp-store": "1100.1.6",
+    "@pnpm/assert-store": "1100.0.13"
   },
   "engines": {
     "node": ">=22.13"