@pnpm/installing.deps-installer 1101.8.0 → 1102.0.0

package/lib/install/extendInstallOptions.d.ts

@@ -18,6 +18,7 @@ export interface StrictInstallOptions {
     cleanupUnusedCatalogs: boolean;
     frozenLockfile: boolean;
     frozenLockfileIfExists: boolean;
+    frozenStore: boolean;
     enableGlobalVirtualStore: boolean;
     enablePnp: boolean;
     extraBinPaths: string[];
@@ -205,23 +206,33 @@ export interface StrictInstallOptions {
     packageVulnerabilityAudit?: PackageVulnerabilityAudit;
     blockExoticSubdeps?: boolean;
     /**
-     * Optional alternative install engine. When set, the frozen-install
-     * path invokes this callback instead of `headlessInstall`. The CLI
-     * layer constructs it (today: spawning the pacquet binary installed
-     * via `configDependencies` and forwarding pnpm's own CLI argv); the
-     * installer treats it as an opaque "do the install" hook so it
-     * doesn't need to know about pacquet's binary path, CLI surface, or
-     * any settings that only pacquet consumes.
+     * Optional alternative install engine. When set, the installer
+     * delegates the install to `run` instead of calling `headlessInstall`.
+     * The CLI layer constructs it (today: the pacquet binary installed via
+     * `configDependencies`, forwarding pnpm's own CLI argv); the installer
+     * treats it as an opaque "do the install" hook so it doesn't need to
+     * know about pacquet's binary path, CLI surface, or any settings that
+     * only pacquet consumes.
      *
-     * `filterResolvedProgress` tells the helper to drop the engine's
-     * own `pnpm:progress status:resolved` events because pnpm already
-     * emitted one per package during a preceding lockfileOnly resolve
-     * pass. The frozen-install path passes `false` (or nothing): no
-     * resolve pass ran, so the engine's events are the only source.
+     * `supportsResolution` is `true` when the engine can resolve
+     * dependencies itself (pacquet >= 0.11.7). When `false` the installer
+     * runs its own resolve pass first and the engine only materializes the
+     * written lockfile.
+     *
+     * `run`'s `filterResolvedProgress` tells the helper to drop the
+     * engine's own `pnpm:progress status:resolved` events because pnpm
+     * already emitted one per package during a preceding lockfileOnly
+     * resolve pass. `resolve` tells the engine to do the resolution
+     * itself (non-frozen install). The frozen/materialize paths leave
+     * both unset.
      */
-    runPacquet?: (opts?: {
-        filterResolvedProgress?: boolean;
-    }) => Promise<void>;
+    runPacquet?: {
+        supportsResolution: boolean;
+        run: (opts?: {
+            filterResolvedProgress?: boolean;
+            resolve?: boolean;
+        }) => Promise<void>;
+    };
     /**
      * If true, `mutateModules` does not emit the per-install `summary` log
      * event. Used by `pnpm add -g` when it runs multiple isolated installs

package/lib/install/extendInstallOptions.js

@@ -27,6 +27,7 @@ const defaults = (opts) => {
         force: false,
         forceFullResolution: false,
         frozenLockfile: false,
+        frozenStore: false,
         hoistPattern: undefined,
         publicHoistPattern: undefined,
         hooks: {},
@@ -144,6 +145,17 @@ export function extendOptions(opts) {
             throw new PnpmError('CONFIG_CONFLICT_LOCKFILE_ONLY_WITH_NO_LOCKFILE', `Cannot generate a ${WANTED_LOCKFILE} because lockfile is set to false`);
         }
     }
+    if (extendedOpts.frozenStore && extendedOpts.force) {
+        throw new PnpmError('CONFIG_CONFLICT_FROZEN_STORE_WITH_FORCE', 'Cannot use force together with frozenStore: --force re-imports packages into the store, which is opened read-only when frozenStore is enabled');
+    }
+    if (extendedOpts.frozenStore) {
+        // The side-effects cache is written into the store, which frozenStore opens
+        // read-only. Caching is an optimization, not a correctness requirement, so
+        // force it off rather than failing (the writable seed-build already
+        // populated it). Without this, a build under frozenStore (e.g. with the
+        // global virtual store disabled) would attempt a store write.
+        extendedOpts.sideEffectsCacheWrite = false;
+    }
     if (extendedOpts.userAgent.startsWith('npm/')) {
         extendedOpts.userAgent = `${extendedOpts.packageManager.name}/${extendedOpts.packageManager.version} ${extendedOpts.userAgent}`;
     }

package/lib/install/index.js

@@ -15,7 +15,7 @@ import { getContext } from '@pnpm/installing.context';
 import { getWantedDependencies, resolveDependencies, } from '@pnpm/installing.deps-resolver';
 import { extendProjectsWithTargetDirs, headlessInstall } from '@pnpm/installing.deps-restorer';
 import { writeModulesManifest } from '@pnpm/installing.modules-yaml';
-import { cleanGitBranchLockfiles, getWantedLockfileName, isEmptyLockfile, readWantedLockfileFile, writeCurrentLockfile, writeLockfiles, writeWantedLockfile, } from '@pnpm/lockfile.fs';
+import { cleanGitBranchLockfiles, getWantedLockfileName, isEmptyLockfile, readEnvLockfile, readWantedLockfile, readWantedLockfileFile, writeCurrentLockfile, writeEnvLockfile, writeLockfiles, writeWantedLockfile, } from '@pnpm/lockfile.fs';
 import { getPreferredVersionsFromLockfileAndManifests } from '@pnpm/lockfile.preferred-versions';
 import { calcPatchHashes, createOverridesMapFromParsed, getOutdatedLockfileSetting, } from '@pnpm/lockfile.settings-checker';
 import { writePnpFile } from '@pnpm/lockfile.to-pnp';
@@ -168,15 +168,24 @@ export async function mutateModules(projects, maybeOpts) {
     // attaching their own verifiers). The threat model is a lockfile that
     // someone else resolved — committed to the repo, restored from a CI
     // cache, etc. — bypassing the local resolver's policy filters; the local
-    // resolver's own filters already cover fresh resolution. We run this
-    // exactly once, right after the lockfile is loaded from disk, before any
-    // path branches.
+    // resolver's own filters already cover fresh resolution.
     //
-    // Skipped when we already know pacquet will run the install: pacquet's
-    // frozen-install path applies the same resolver-policy gate (port of
-    // this function), so re-running here would duplicate the work — and
-    // for `minimumReleaseAge` in strict mode each lockfile entry is an
-    // HTTP probe.
+    // The verification is kicked off here, right after the lockfile is loaded,
+    // but not awaited inline — it would otherwise block every later install
+    // stage on per-entry registry round trips. Its synchronous prologue (cache
+    // lookup, lockfile hashing, candidate collection) runs now against the
+    // pristine lockfile, so the async fan-out reads a stable snapshot even
+    // while the install mutates `ctx.wantedLockfile` concurrently. The verdict
+    // is reconciled with the install in `settleInstall`: a failure aborts the
+    // install even mid-flight, and an install that finishes first is held back
+    // until the verdict arrives.
+    //
+    // Skipped when we already know pacquet will run the install: pacquet
+    // applies the same resolver-policy gate (port of this function) whether
+    // it materializes a frozen lockfile or re-resolves from the manifests,
+    // so re-running here would duplicate the work — and for
+    // `minimumReleaseAge` in strict mode each lockfile entry is an HTTP
+    // probe.
     //
     // The predicate mirrors every short-circuit `tryFrozenInstall` checks
     // before reaching the pacquet branch: anything that would make it
@@ -186,13 +195,28 @@ export async function mutateModules(projects, maybeOpts) {
     // isn't known here — so verification still runs in that window, the
     // duplicate is bounded to it.
     const willDelegateToPacquet = opts.runPacquet != null &&
+        opts.useLockfile &&
+        !opts.useGitBranchLockfile &&
+        !opts.mergeGitBranchLockfiles &&
+        opts.lockfileCheck == null &&
+        opts.enableModulesDir &&
         installsOnly &&
         !opts.lockfileOnly &&
         !opts.fixLockfile &&
         !opts.dedupe &&
         !ctx.lockfileHadConflicts &&
-        ctx.existsNonEmptyWantedLockfile &&
-        (opts.frozenLockfile === true || opts.frozenLockfileIfExists === true);
+        (
+        // Frozen materialization: pacquet reads the existing lockfile and
+        // re-applies the resolver-policy gate as it walks it.
+        (ctx.existsNonEmptyWantedLockfile &&
+            (opts.frozenLockfile === true || opts.frozenLockfileIfExists === true)) ||
+            // Resolving install: pacquet (>= 0.11.7) re-resolves from the
+            // manifests itself — applying the policy during fresh resolution —
+            // so the existing lockfile entries verified here would just be
+            // discarded. If a policy handler is active, keep resolution in pnpm
+            // so violations can be returned to the command layer.
+            (opts.saveLockfile && opts.runPacquet.supportsResolution && opts.frozenLockfile !== true && opts.nodeLinker !== 'hoisted' && opts.handleResolutionPolicyViolations == null));
+    let verifyLockfilePromise;
     if (!willDelegateToPacquet && !opts.trustLockfile) {
         const cacheActive = opts.cacheDir != null && opts.resolutionVerifiers.length > 0;
         const wantedLockfilePath = cacheActive
@@ -201,21 +225,21 @@ export async function mutateModules(projects, maybeOpts) {
                 mergeGitBranchLockfiles: opts.mergeGitBranchLockfiles,
             }))
             : undefined;
-        try {
-            await verifyLockfileResolutions(ctx.wantedLockfile, opts.resolutionVerifiers, {
-                cacheDir: opts.cacheDir,
-                lockfilePath: wantedLockfilePath,
-            });
-        }
-        catch (err) {
-            // verifyLockfileResolutions is the one throw site in this function
-            // that's part of normal user-facing operation (a rejected lockfile);
-            // other throws here are unexpected. Detach the reporter listener so
-            // long-lived processes don't leak it on every rejected install.
-            detachReporter();
-            throw err;
-        }
+        verifyLockfilePromise = verifyLockfileResolutions(ctx.wantedLockfile, opts.resolutionVerifiers, {
+            cacheDir: opts.cacheDir,
+            lockfilePath: wantedLockfilePath,
+        });
+        // Keep the rejection from going unhandled in the window before
+        // `settleInstall` awaits the verdict — a preResolution hook or the
+        // install kickoff below could throw and bail out before we get there.
+        verifyLockfilePromise.catch(() => { });
     }
+    // Gate passed down to the build phase: fetching and linking overlap with
+    // verification, but no dependency lifecycle script may run until the verdict
+    // is in. Awaiting the promise here throws if verification failed, aborting
+    // before any script executes. `settleInstall` is the catch-all that still
+    // reconciles the verdict on paths that never reach the build phase.
+    const verifyLockfile = verifyLockfilePromise && (() => verifyLockfilePromise);
     if (opts.hooks.preResolution) {
         for (const preResolution of opts.hooks.preResolution) {
             // eslint-disable-next-line no-await-in-loop
@@ -251,7 +275,7 @@ export async function mutateModules(projects, maybeOpts) {
             }
         }
     }
-    const result = await _install();
+    const result = await settleInstall(_install(), verifyLockfilePromise);
     // @ts-expect-error
     if (global['verifiedFileIntegrity'] > 1000) {
         // @ts-expect-error
@@ -302,6 +326,31 @@ export async function mutateModules(projects, maybeOpts) {
         ignoredBuilds,
         resolutionPolicyViolations: result.resolutionPolicyViolations ?? [],
     };
+    // Reconcile the install with the lockfile verification that runs alongside
+    // it. The verification verdict is awaited first so it takes precedence and
+    // aborts as soon as it fails, even while the install is still in flight —
+    // matching the original sequencing where verification gated the install, so
+    // a rejected lockfile surfaces its own error rather than whatever the
+    // concurrent install happened to throw. Only once verification passes is the
+    // install's result (or error) surfaced. detachReporter mirrors the success
+    // path's cleanup so a long-lived process doesn't leak the stream listener on
+    // a rejected install.
+    async function settleInstall(install, verification) {
+        if (verification == null)
+            return install;
+        // Handle the install's eventual rejection up front so a fail-fast
+        // verification throw below doesn't leave the still-running install
+        // unhandled.
+        install.catch(() => { });
+        try {
+            await verification;
+            return await install;
+        }
+        catch (err) {
+            detachReporter();
+            throw err;
+        }
+    }
     async function _install() {
         const scriptsOpts = {
             extraBinPaths: opts.extraBinPaths,
@@ -589,6 +638,7 @@ export async function mutateModules(projects, maybeOpts) {
             scriptsOpts,
             updateLockfileMinorVersion: true,
             patchedDependencies: patchGroups,
+            verifyLockfile,
         });
         return {
             updatedCatalogs: result.updatedCatalogs,
@@ -717,9 +767,9 @@ Note that in CI environments, this setting is enabled by default.`,
         else {
             logger.info({ message: 'Lockfile is up to date, resolution step is skipped', prefix: opts.lockfileDir });
         }
-        if (opts.runPacquet != null) {
+        if (opts.runPacquet != null && opts.useLockfile && !opts.useGitBranchLockfile && !opts.mergeGitBranchLockfiles && opts.lockfileCheck == null && opts.enableModulesDir) {
             try {
-                await opts.runPacquet();
+                await opts.runPacquet.run();
             }
             catch (err) {
                 // Same reasoning as the verifyLockfileResolutions catch above: this
@@ -755,6 +805,7 @@ Note that in CI environments, this setting is enabled by default.`,
                 pruneVirtualStore,
                 wantedLockfile: maybeOpts.ignorePackageManifest ? undefined : ctx.wantedLockfile,
                 useLockfile: opts.useLockfile && ctx.wantedLockfileIsModified,
+                verifyLockfile,
             });
             if (opts.useLockfile && opts.saveLockfile && opts.mergeGitBranchLockfiles ||
                 !upToDateLockfileMajorVersion && !opts.frozenLockfile) {
@@ -1189,6 +1240,8 @@ const _installInContext = async (projects, ctx, opts) => {
                         ...makeNodeRequireOption(path.join(opts.lockfileDir, '.pnp.cjs')),
                     };
                 }
+                // Dependency lifecycle scripts must not run on an unverified lockfile.
+                await opts.verifyLockfile?.();
                 ignoredBuilds = (await buildModules(dependenciesGraph, rootNodes, {
                     allowBuild: opts.allowBuild,
                     childConcurrency: opts.childConcurrency,
@@ -1210,6 +1263,7 @@ const _installInContext = async (projects, ctx, opts) => {
                     unsafePerm: opts.unsafePerm,
                     userAgent: opts.userAgent,
                     enableGlobalVirtualStore: opts.enableGlobalVirtualStore,
+                    frozenStore: opts.frozenStore,
                 })).ignoredBuilds;
                 if (ctx.modulesFile?.ignoredBuilds?.size) {
                     ignoredBuilds ??= new Set();
@@ -1332,6 +1386,10 @@ const _installInContext = async (projects, ctx, opts) => {
                 };
             }
             const projectsToBeBuilt = projectsWithTargetDirs.filter(({ mutation }) => mutation === 'install');
+            // The projects' own lifecycle scripts import dependency code linked
+            // from the lockfile, so they are held to the same gate as dependency
+            // builds — also when no new dep paths made the buildModules branch run.
+            await opts.verifyLockfile?.();
             await runLifecycleHooksConcurrently(['preinstall', 'install', 'postinstall', 'preprepare', 'prepare', 'postprepare'], projectsToBeBuilt, opts.childConcurrency, opts.scriptsOpts);
         }
     }
@@ -1413,6 +1471,28 @@ const _installInContext = async (projects, ctx, opts) => {
 function allMutationsAreInstalls(projects) {
     return projects.every((project) => project.mutation === 'install' && !project.update && !project.updateMatching);
 }
+/**
+ * The `InstallFunctionResult` for an install pacquet resolved and
+ * materialized end-to-end. pacquet wrote `pnpm-lock.yaml` and the
+ * `node_modules` tree itself. `ctx.wantedLockfile` has already been
+ * refreshed from disk, and pacquet reports its own stats / ignored-builds
+ * via NDJSON, so the structured `stats` / `ignoredBuilds` fall back to
+ * their no-op defaults. Resolution-policy handlers are guarded out before
+ * this path, so there are no command-layer policy violations to return.
+ * Manifests are returned unchanged — this path only runs for plain
+ * installs, which don't rewrite `package.json`.
+ */
+function pacquetResolveResult(projects, ctx) {
+    return {
+        newLockfile: ctx.wantedLockfile,
+        projects: projects.map((project) => ({
+            manifest: project.originalManifest ?? project.manifest,
+            rootDir: project.rootDir,
+        })),
+        depsRequiringBuild: [],
+        resolutionPolicyViolations: [],
+    };
+}
 /**
  * Run the pacquet binary if it's configured, otherwise run the JS
  * `headlessInstall`. Callers can hand off any code path that materializes
@@ -1429,13 +1509,17 @@ function allMutationsAreInstalls(projects) {
  * stats record and a no-op ignoredBuilds iteration).
  */
 async function materializeOrDelegate(opts, runHeadlessInstall) {
-    if (opts.runPacquet != null) {
+    if (opts.runPacquet != null &&
+        opts.useLockfile !== false &&
+        opts.saveLockfile !== false &&
+        opts.useGitBranchLockfile !== true &&
+        opts.mergeGitBranchLockfiles !== true) {
         // Reached only from the resolve-then-materialize call sites
         // (workspace-partial, hoisted-linker, pnpr server install). Each ran a
         // lockfileOnly resolve pass that emitted one
         // `pnpm:progress status:resolved` per package, so pacquet's
         // duplicate `resolved` events would double the reporter's count.
-        await opts.runPacquet({ filterResolvedProgress: true });
+        await opts.runPacquet.run({ filterResolvedProgress: true });
         return {};
     }
     return runHeadlessInstall();
@@ -1446,7 +1530,7 @@ const installInContext = async (projects, ctx, opts) => {
         if (!opts.frozenLockfile && opts.useLockfile) {
             const allProjectsLocatedInsideWorkspace = Object.values(ctx.projects)
                 .filter((project) => isPathInsideWorkspace(project.rootDirRealPath ?? project.rootDir));
-            if (allProjectsLocatedInsideWorkspace.length > projects.length) {
+            if (allProjectsLocatedInsideWorkspace.length > projects.length && opts.lockfileCheck == null && opts.enableModulesDir) {
                 const newProjects = [...projects];
                 const getWantedDepsOpts = {
                     autoInstallPeers: opts.autoInstallPeers,
@@ -1498,7 +1582,7 @@ const installInContext = async (projects, ctx, opts) => {
                 };
             }
         }
-        if (opts.nodeLinker === 'hoisted' && !opts.lockfileOnly) {
+        if (opts.nodeLinker === 'hoisted' && !opts.lockfileOnly && opts.lockfileCheck == null && opts.enableModulesDir) {
             const result = await _installInContext(projects, ctx, {
                 ...opts,
                 lockfileOnly: true,
@@ -1524,20 +1608,69 @@ const installInContext = async (projects, ctx, opts) => {
                 ignoredBuilds,
             };
         }
-        // Isolated `nodeLinker` (the default) with a non-frozen install:
-        // pacquet doesn't ship a resolver yet, so split the install in two —
-        // ask `_installInContext` for a `lockfileOnly` resolve pass (writes
-        // `pnpm-lock.yaml`), then hand the freshly-written lockfile to
-        // pacquet for the fetch / import / link / build phases. The frozen
-        // branch is handled earlier in `tryFrozenInstall`; the hoisted
-        // branch above already runs the same resolve-then-materialize
-        // sequence (it had to even before pacquet existed). When no pacquet
-        // is configured this falls through to the full single-pass install.
-        if (opts.runPacquet != null && !opts.lockfileOnly) {
+        // Isolated `nodeLinker` (the default) with a non-frozen install.
+        // The frozen branch is handled earlier in `tryFrozenInstall`; the
+        // hoisted branch above runs a resolve-then-materialize sequence.
+        if (opts.runPacquet != null && opts.useLockfile && opts.saveLockfile && !opts.useGitBranchLockfile && !opts.mergeGitBranchLockfiles && !opts.lockfileOnly && opts.lockfileCheck == null && opts.enableModulesDir) {
+            // pacquet >= 0.11.7 resolves itself: hand it the whole install
+            // (resolve + fetch + import + link + build, writing the lockfile)
+            // in a single non-frozen pass. Only for plain installs — `add` /
+            // `update` / `remove` need pnpm to mutate the manifests and
+            // resolve the new specs first (pacquet's `install` reads
+            // package.json from disk, which pnpm hasn't rewritten yet).
+            if (opts.runPacquet.supportsResolution && !opts.frozenLockfile && opts.handleResolutionPolicyViolations == null && allMutationsAreInstalls(projects)) {
+                // `configDependencies` are recorded in a YAML document prepended
+                // to `pnpm-lock.yaml` — purely a pnpm concept that pacquet doesn't
+                // model. Capture it before pacquet rewrites the lockfile and
+                // restore it afterwards (`writeEnvLockfile` re-reads pacquet's main
+                // document and re-prepends the env document), otherwise the next
+                // `--frozen-lockfile` install fails its config-deps freshness gate.
+                // The restore runs even if pacquet fails partway: a non-zero exit can
+                // still leave a rewritten lockfile behind, so the env document must be
+                // put back regardless.
+                const envLockfile = await readEnvLockfile(ctx.lockfileDir);
+                let pacquetError;
+                try {
+                    await opts.runPacquet.run({ resolve: true });
+                }
+                catch (err) {
+                    pacquetError = err;
+                    throw err;
+                }
+                finally {
+                    if (envLockfile != null) {
+                        await writeEnvLockfile(ctx.lockfileDir, envLockfile).catch((restoreErr) => {
+                            if (pacquetError == null) {
+                                throw restoreErr;
+                            }
+                            logger.warn({
+                                error: restoreErr,
+                                message: `Failed to restore the configDependencies document in pnpm-lock.yaml: ${restoreErr.message}`,
+                                prefix: ctx.lockfileDir,
+                            });
+                        });
+                    }
+                }
+                const wantedLockfile = await readWantedLockfile(ctx.lockfileDir, {
+                    ignoreIncompatible: opts.force || opts.ci === true,
+                    mergeGitBranchLockfiles: opts.mergeGitBranchLockfiles,
+                    useGitBranchLockfile: opts.useGitBranchLockfile,
+                    wantedVersions: [LOCKFILE_VERSION],
+                });
+                if (wantedLockfile == null) {
+                    throw new PnpmError('PACQUET_LOCKFILE_READ_FAILED', `pacquet did not write a readable ${WANTED_LOCKFILE}`);
+                }
+                ctx.wantedLockfile = wantedLockfile;
+                return pacquetResolveResult(projects, ctx);
+            }
+            // Older pacquet can only materialize: split the install in two —
+            // ask `_installInContext` for a `lockfileOnly` resolve pass (writes
+            // `pnpm-lock.yaml`), then hand the freshly-written lockfile to
+            // pacquet for the fetch / import / link / build phases. The resolve
+            // pass emitted a `pnpm:progress status:resolved` per package; ask
+            // pacquet to drop its own duplicates.
             const result = await _installInContext(projects, ctx, { ...opts, lockfileOnly: true });
-            // The resolve pass above emitted a `pnpm:progress status:resolved`
-            // per package; ask pacquet to drop its own duplicates.
-            await opts.runPacquet({ filterResolvedProgress: true });
+            await opts.runPacquet.run({ filterResolvedProgress: true });
             return result;
         }
         return await _installInContext(projects, ctx, opts);
@@ -1811,6 +1944,15 @@ async function mutateModulesViaPnpr(projects, opts) {
  * and links packages into node_modules — like a normal install.
  */
 async function installViaPnprServer(manifest, rootDir, opts, allInstallProjects) {
+    // The pnpr server path re-resolves and persists new `index.db` entries plus a
+    // freshly written lockfile, so it inherently writes the store. `frozenStore`
+    // promises the store is complete and read-only, so the two are mutually
+    // exclusive — and the unconditional pnpr gate means this path runs even under
+    // `--offline --frozen-lockfile`, so refuse up front with guidance instead of
+    // crashing later on the read-only `index.db` open.
+    if (opts.frozenStore) {
+        throw new PnpmError('FROZEN_STORE_INCOMPATIBLE_WITH_PNPR', 'The pnpr server resolves dependencies and writes new entries into the store, which is opened read-only when frozenStore is enabled.', { hint: 'Disable the pnpr server (unset `--pnpr-server` / `pnprServer` in pnpm-workspace.yaml) so the install reads from the existing store, or unset `frozenStore` to allow store writes.' });
+    }
     // The pnpr server path skips client-side resolution, so resolver-side policies
     // can't be enforced locally. `minimumReleaseAge` is forwarded to the
     // pnpr server and enforced server-side. `trustPolicy` has no server-side
@@ -1820,7 +1962,7 @@ async function installViaPnprServer(manifest, rootDir, opts, allInstallProjects)
         throw new PnpmError('TRUST_POLICY_INCOMPATIBLE_WITH_PNPR', 'The pnpr server does not yet enforce `trustPolicy: no-downgrade`, so running an install through it under this policy would produce a lockfile that the local verifier rejects.', { hint: 'Unset `trustPolicy` for this install, or disable the pnpr server (unset `--pnpr-server` / `pnprServer` in pnpm-workspace.yaml) so resolution runs locally and the trust check applies.' });
     }
     const { resolveViaPnprServer } = await import('@pnpm/pnpr.client');
-    const { createGetAuthHeaderByURI, getAuthHeadersFromCreds } = await import('@pnpm/network.auth-header');
+    const { createGetAuthHeaderByURI, getAuthHeadersByScope, getAuthHeadersFromCreds } = await import('@pnpm/network.auth-header');
     // Forward the whole credential map (the registries a graph touches
     // aren't known up front), so the server attaches the right token per
     // URL. `authorization` also identifies the caller to pnpr's gate.
@@ -1856,7 +1998,7 @@ async function installViaPnprServer(manifest, rootDir, opts, allInstallProjects)
             projects: projectsList,
             registry: opts.registries?.default,
             namedRegistries: opts.namedRegistries,
-            authHeaders: forwardedAuthHeaders,
+            authHeaders: getAuthHeadersByScope(forwardedAuthHeaders),
             authorization: pnprAuthorization,
             overrides: opts.overrides,
             minimumReleaseAge: opts.minimumReleaseAge,

package/lib/install/recordLockfileVerified.js

@@ -1,5 +1,5 @@
 import { hashObject } from '@pnpm/crypto.object-hasher';
-import { withResolutionShapeCacheIdentity } from './verifyLockfileResolutions.js';
+import { withOfflineCheckCacheIdentities } from './verifyLockfileResolutions.js';
 import { recordVerification } from './verifyLockfileResolutionsCache.js';
 /**
  * Records the post-resolution lockfile as verified so the next install
@@ -18,7 +18,7 @@ export function recordLockfileVerified(opts) {
         return;
     recordVerification(opts.cacheDir, {
         lockfilePath: opts.lockfilePath,
-        verifiers: withResolutionShapeCacheIdentity(opts.resolutionVerifiers),
+        verifiers: withOfflineCheckCacheIdentities(opts.resolutionVerifiers),
         hashLockfile: () => hashObject(opts.lockfile),
     });
 }

package/lib/install/verifyLockfileResolutions.d.ts

@@ -3,15 +3,19 @@ import type { ResolutionPolicyViolation, ResolutionVerifier } from '@pnpm/resolv
 import { type VerifierCacheIdentity } from './verifyLockfileResolutionsCache.js';
 export type { ResolutionPolicyViolation };
 export declare const RESOLUTION_SHAPE_MISMATCH_VIOLATION_CODE = "RESOLUTION_SHAPE_MISMATCH";
+export declare const INVALID_DEPENDENCY_ALIAS_CODE = "INVALID_DEPENDENCY_NAME";
 /**
  * Every verifier list that flows into the verification cache must carry
- * the resolution-shape identity, so records written before the shape rule
- * existed cannot stat-fast-path around it. Used by the gate itself and by
- * {@link recordLockfileVerified}, whose freshly-resolved lockfile satisfies
- * the shape invariant by construction (the writer derives every key from
- * the resolution it just produced).
+ * the always-on offline structural checks' identities, so a record
+ * written before one of those rules existed cannot stat-fast-path around
+ * it — its missing flag fails `canTrustPastCheck`, forcing a
+ * re-verification that runs the new check. Used by the gate itself and by
+ * {@link recordLockfileVerified}, whose freshly-resolved lockfile
+ * satisfies these invariants by construction (the resolver validates
+ * aliases at manifest-read time and derives every resolution key from the
+ * resolution it just produced).
  */
-export declare function withResolutionShapeCacheIdentity(verifiers: readonly VerifierCacheIdentity[]): VerifierCacheIdentity[];
+export declare function withOfflineCheckCacheIdentities(verifiers: readonly VerifierCacheIdentity[]): VerifierCacheIdentity[];
 export interface VerifyLockfileResolutionsOptions {
     concurrency?: number;
     /**

package/lib/install/verifyLockfileResolutions.js

@@ -1,6 +1,7 @@
 import { lockfileVerificationLogger } from '@pnpm/core-loggers';
 import { hashObject } from '@pnpm/crypto.object-hasher';
 import { PnpmError } from '@pnpm/error';
+import { isValidDependencyAlias } from '@pnpm/installing.deps-resolver';
 import { isGitHostedTarballUrl, nameVerFromPkgSnapshot } from '@pnpm/lockfile.utils';
 import pLimit from 'p-limit';
 import { recordVerification, tryLockfileVerificationCache, } from './verifyLockfileResolutionsCache.js';
@@ -8,25 +9,34 @@ import { recordVerification, tryLockfileVerificationCache, } from './verifyLockf
 // (e.g. a poisoned lockfile) doesn't flood the terminal / CI log; the full
 // count is in the header and the remainder is summarized at the end.
 const MAX_VIOLATIONS_TO_PRINT = 20;
-// 16 mirrors the floor of pnpm's package-requester network-concurrency
-// (Math.min(64, Math.max(workers*3, 16))); keep them aligned so the
+// 64 mirrors the floor of pnpm's package-requester network-concurrency
+// (Math.min(96, Math.max(workers*3, 64))); keep them aligned so the
 // verification pass doesn't push past what the rest of the install respects.
-const DEFAULT_CONCURRENCY = 16;
+const DEFAULT_CONCURRENCY = 64;
 export const RESOLUTION_SHAPE_MISMATCH_VIOLATION_CODE = 'RESOLUTION_SHAPE_MISMATCH';
+// Same code the sink-level guards (`safeJoinModulesDir`) throw.
+export const INVALID_DEPENDENCY_ALIAS_CODE = 'INVALID_DEPENDENCY_NAME';
 const RESOLUTION_SHAPE_CACHE_IDENTITY = {
     policy: { resolutionShapeCheck: true },
     canTrustPastCheck: (cached) => cached.resolutionShapeCheck === true,
 };
+const DEPENDENCY_ALIAS_CACHE_IDENTITY = {
+    policy: { dependencyAliasCheck: true },
+    canTrustPastCheck: (cached) => cached.dependencyAliasCheck === true,
+};
 /**
  * Every verifier list that flows into the verification cache must carry
- * the resolution-shape identity, so records written before the shape rule
- * existed cannot stat-fast-path around it. Used by the gate itself and by
- * {@link recordLockfileVerified}, whose freshly-resolved lockfile satisfies
- * the shape invariant by construction (the writer derives every key from
- * the resolution it just produced).
+ * the always-on offline structural checks' identities, so a record
+ * written before one of those rules existed cannot stat-fast-path around
+ * it — its missing flag fails `canTrustPastCheck`, forcing a
+ * re-verification that runs the new check. Used by the gate itself and by
+ * {@link recordLockfileVerified}, whose freshly-resolved lockfile
+ * satisfies these invariants by construction (the resolver validates
+ * aliases at manifest-read time and derives every resolution key from the
+ * resolution it just produced).
  */
-export function withResolutionShapeCacheIdentity(verifiers) {
-    return [...verifiers, RESOLUTION_SHAPE_CACHE_IDENTITY];
+export function withOfflineCheckCacheIdentities(verifiers) {
+    return [...verifiers, RESOLUTION_SHAPE_CACHE_IDENTITY, DEPENDENCY_ALIAS_CACHE_IDENTITY];
 }
 /**
  * Policy-neutral pass that asks every resolver-supplied
@@ -65,7 +75,7 @@ export async function verifyLockfileResolutions(lockfile, verifiers, options) {
     const cache = options?.cacheDir && options?.lockfilePath
         ? { cacheDir: options.cacheDir, lockfilePath: options.lockfilePath }
         : undefined;
-    const cacheVerifiers = withResolutionShapeCacheIdentity(verifiers);
+    const cacheVerifiers = withOfflineCheckCacheIdentities(verifiers);
     let cachePrecomputed;
     // hashObject streams and is key-order-stable, unlike JSON.stringify.
     let cachedHash;
@@ -80,18 +90,34 @@ export async function verifyLockfileResolutions(lockfile, verifiers, options) {
             verifiers: cacheVerifiers,
             hashLockfile,
         });
-        if (result.hit)
+        if (result.hit) {
+            // A silent short-circuit looks like the policy gate never ran
+            // (pnpm/pnpm#12324), so surface the reused verdict — but only
+            // when policy verifiers are active; the shape-only run that
+            // every install performs stays quiet.
+            if (verifiers.length > 0) {
+                lockfileVerificationLogger.debug({
+                    status: 'cached',
+                    verifiedAt: result.verifiedAt,
+                    lockfilePath: options?.lockfilePath,
+                });
+            }
             return;
+        }
         cachePrecomputed = result.precomputed;
     }
     // Emit started/done around the actual verification pass — the
     // round-trip can be slow on a cold registry cache, and the cached
-    // short-circuit above doesn't reach this branch, so a user only
-    // sees these messages on installs that are doing real work.
+    // short-circuit above announces itself with its own `cached` event,
+    // so a user only sees these messages on installs that are doing
+    // real work.
     // A degenerate lockfile where every snapshot fails the
     // name/version extraction (so candidates is empty) skips emission
     // entirely — no work, no noise.
-    const { candidates, shapeViolations } = collectCandidates(lockfile);
+    const { candidates, shapeViolations, invalidAliases } = collectCandidates(lockfile);
+    if (invalidAliases.length > 0) {
+        throw buildInvalidAliasError(invalidAliases);
+    }
     if (shapeViolations.length > 0) {
         throw buildVerificationError(shapeViolations);
     }
@@ -145,6 +171,19 @@ export async function verifyLockfileResolutions(lockfile, verifiers, options) {
         });
     }
 }
+function buildInvalidAliasError(aliases) {
+    const sorted = [...aliases].sort();
+    const visible = sorted.slice(0, MAX_VIOLATIONS_TO_PRINT);
+    const omitted = sorted.length - visible.length;
+    const breakdown = visible.map((alias) => `  ${JSON.stringify(alias)}`).join('\n');
+    const details = omitted > 0 ? `${breakdown}\n  …and ${omitted} more` : breakdown;
+    const plural = aliases.length === 1 ? 'alias' : 'aliases';
+    return new PnpmError(INVALID_DEPENDENCY_ALIAS_CODE, `The lockfile contains ${aliases.length} dependency ${plural} that are not valid package names:\n${details}`, {
+        hint: 'A dependency alias becomes a directory under node_modules, so it must be a valid npm package name — a single `name` or `@scope/name` with no leading `.` or `_`, and not a reserved name such as `node_modules`. ' +
+            'An alias containing path-traversal segments or a reserved name such as `.bin` or `.pnpm` could make an install write outside the intended directory or overwrite pnpm-owned layout. ' +
+            'This usually means the lockfile was tampered with — inspect recent changes to pnpm-lock.yaml before trusting it.',
+    });
+}
 function buildVerificationError(violations) {
     // Stable order so the error output is deterministic.
     violations.sort((a, b) => `${a.name}@${a.version}`.localeCompare(`${b.name}@${b.version}`));
@@ -253,7 +292,17 @@ function isRegistryShapedResolution(resolution) {
 function collectCandidates(lockfile) {
     const candidates = new Map();
     const shapeViolations = [];
+    // The importer alias maps are the one source not reached by the
+    // package loop below, so they're scanned here.
+    const invalidAliases = new Set();
+    for (const importer of Object.values(lockfile.importers ?? {})) {
+        pushInvalidAliases(importer.dependencies, invalidAliases);
+        pushInvalidAliases(importer.devDependencies, invalidAliases);
+        pushInvalidAliases(importer.optionalDependencies, invalidAliases);
+    }
     for (const [depPath, snapshot] of Object.entries(lockfile.packages ?? {})) {
+        pushInvalidAliases(snapshot.dependencies, invalidAliases);
+        pushInvalidAliases(snapshot.optionalDependencies, invalidAliases);
         const { name, version, nonSemverVersion } = nameVerFromPkgSnapshot(depPath, snapshot);
         if (!name || !version)
             continue;
@@ -279,7 +328,21 @@ function collectCandidates(lockfile) {
             resolution: snapshot.resolution,
         });
     }
-    return { candidates, shapeViolations };
+    return { candidates, shapeViolations, invalidAliases: Array.from(invalidAliases) };
+}
+/**
+ * Add every key of `deps` that is not a valid {@link isValidDependencyAlias}
+ * to `invalid`. Only pass maps whose keys become `node_modules/<alias>`
+ * directories — not `overrides` (`foo>bar` selectors) or
+ * `patchedDependencies` (`name@version` keys).
+ */
+function pushInvalidAliases(deps, invalid) {
+    if (deps == null)
+        return;
+    for (const alias of Object.keys(deps)) {
+        if (!isValidDependencyAlias(alias))
+            invalid.add(alias);
+    }
 }
 async function iterateLockfileViolations(candidates, verifiers, concurrency) {
     const violations = [];

package/lib/install/verifyLockfileResolutionsCache.d.ts

@@ -9,6 +9,13 @@ import type { ResolutionVerifier } from '@pnpm/resolving.resolver-base';
 export type VerifierCacheIdentity = Pick<ResolutionVerifier, 'policy' | 'canTrustPastCheck'>;
 export interface CacheLookupResult {
     hit: boolean;
+    /**
+     * ISO-8601 timestamp of the verification run the hit is reusing.
+     * Set only on a hit, and only when the record carries a usable
+     * timestamp (records written before the field existed normalize to
+     * an empty string and surface as `undefined` here).
+     */
+    verifiedAt?: string;
     /**
      * stat + hash already computed during the lookup. When the caller
      * follows up with {@link recordVerification} after running the gate,

package/lib/install/verifyLockfileResolutionsCache.js

@@ -159,8 +159,10 @@ export function tryLockfileVerificationCache(cacheDir, key) {
     // hash without reading the file. Microseconds.
     const byPathRecord = indexes.byPath.get(key.lockfilePath);
     if (byPathRecord && statMatches(stat, byPathRecord.lockfile)) {
+        const hit = everyVerifierTrustsCachedRun(byPathRecord, key.verifiers);
         return {
-            hit: everyVerifierTrustsCachedRun(byPathRecord, key.verifiers),
+            hit,
+            verifiedAt: hit ? byPathRecord.verifiedAt || undefined : undefined,
             // The stat-match implies the file content is unchanged since the
             // cached record was written, so its hash is still correct. Pass
             // it through to skip hashing on the miss-then-record path.
@@ -190,7 +192,7 @@ export function tryLockfileVerificationCache(cacheDir, key) {
         ...byHashRecord,
         lockfile: { ...byHashRecord.lockfile, path: key.lockfilePath, size: stat.size, mtimeNs: stat.mtimeNs, inode: stat.inode },
     });
-    return { hit: true, precomputed: { stat, hash } };
+    return { hit: true, verifiedAt: byHashRecord.verifiedAt || undefined, precomputed: { stat, hash } };
 }
 function everyVerifierTrustsCachedRun(record, verifiers) {
     for (const verifier of verifiers) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-installer",
-  "version": "1101.8.0",
+  "version": "1102.0.0",
   "description": "Fast, disk space efficient installation engine",
   "keywords": [
     "pnpm",
@@ -52,7 +52,7 @@
   "dependencies": {
     "@inquirer/prompts": "^8.4.3",
     "@pnpm/npm-package-arg": "^2.0.0",
-    "@pnpm/util.lex-comparator": "^3.0.2",
+    "@pnpm/util.lex-comparator": "^4.0.1",
     "@zkochan/rimraf": "^4.0.0",
     "is-inner-link": "^5.0.0",
     "is-subdir": "^2.0.0",
@@ -64,104 +64,104 @@
     "path-exists": "^5.0.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "run-groups": "^5.0.0",
-    "semver": "^7.8.1",
-    "@pnpm/bins.linker": "1100.0.12",
-    "@pnpm/building.after-install": "1101.0.20",
+    "semver": "^7.8.4",
+    "@pnpm/building.after-install": "1102.0.0",
+    "@pnpm/building.during-install": "1102.0.0",
     "@pnpm/catalogs.protocol-parser": "1100.0.0",
-    "@pnpm/building.during-install": "1101.0.17",
-    "@pnpm/building.policy": "1100.0.9",
-    "@pnpm/catalogs.types": "1100.0.0",
+    "@pnpm/bins.remover": "1100.0.10",
     "@pnpm/catalogs.resolver": "1100.0.0",
-    "@pnpm/config.normalize-registries": "1100.0.7",
-    "@pnpm/config.matcher": "1100.0.1",
-    "@pnpm/core-loggers": "1100.1.4",
+    "@pnpm/config.normalize-registries": "1100.0.8",
+    "@pnpm/config.parse-overrides": "1100.0.1",
+    "@pnpm/catalogs.types": "1100.0.0",
+    "@pnpm/core-loggers": "1100.2.1",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/crypto.hash": "1100.0.1",
-    "@pnpm/deps.graph-hasher": "1100.2.4",
-    "@pnpm/crypto.object-hasher": "1100.0.0",
+    "@pnpm/config.matcher": "1100.0.1",
+    "@pnpm/deps.graph-hasher": "1100.2.5",
+    "@pnpm/deps.path": "1100.0.8",
     "@pnpm/deps.graph-sequencer": "1100.0.0",
-    "@pnpm/config.parse-overrides": "1100.0.1",
+    "@pnpm/building.policy": "1100.0.10",
+    "@pnpm/bins.linker": "1100.0.14",
+    "@pnpm/crypto.object-hasher": "1100.0.0",
+    "@pnpm/exec.lifecycle": "1100.0.18",
+    "@pnpm/hooks.read-package-hook": "1100.0.8",
+    "@pnpm/fs.symlink-dependency": "1100.0.10",
+    "@pnpm/hooks.types": "1100.0.12",
     "@pnpm/error": "1100.0.0",
+    "@pnpm/installing.context": "1100.0.18",
+    "@pnpm/installing.linking.direct-dep-linker": "1100.0.10",
+    "@pnpm/installing.deps-resolver": "1100.2.3",
+    "@pnpm/crypto.hash": "1100.0.1",
     "@pnpm/fs.read-modules-dir": "1100.0.1",
-    "@pnpm/exec.lifecycle": "1100.0.16",
-    "@pnpm/fs.symlink-dependency": "1100.0.8",
-    "@pnpm/hooks.read-package-hook": "1100.0.7",
-    "@pnpm/installing.deps-restorer": "1101.1.10",
-    "@pnpm/hooks.types": "1100.0.11",
-    "@pnpm/installing.context": "1100.0.16",
-    "@pnpm/installing.deps-resolver": "1100.2.1",
-    "@pnpm/installing.linking.direct-dep-linker": "1100.0.8",
-    "@pnpm/deps.path": "1100.0.7",
-    "@pnpm/installing.linking.modules-cleaner": "1100.1.6",
-    "@pnpm/installing.linking.hoist": "1100.0.12",
-    "@pnpm/bins.remover": "1100.0.8",
-    "@pnpm/installing.modules-yaml": "1100.0.8",
-    "@pnpm/lockfile.fs": "1100.1.4",
-    "@pnpm/installing.package-requester": "1101.0.12",
-    "@pnpm/lockfile.pruner": "1100.0.10",
-    "@pnpm/lockfile.settings-checker": "1100.0.16",
-    "@pnpm/lockfile.preferred-versions": "1100.0.14",
-    "@pnpm/lockfile.filtering": "1100.1.5",
-    "@pnpm/lockfile.to-pnp": "1100.0.13",
-    "@pnpm/lockfile.verification": "1100.0.16",
-    "@pnpm/lockfile.utils": "1100.0.12",
-    "@pnpm/lockfile.walker": "1100.0.10",
-    "@pnpm/network.auth-header": "1101.1.1",
+    "@pnpm/installing.linking.hoist": "1100.0.14",
+    "@pnpm/installing.package-requester": "1102.0.0",
+    "@pnpm/installing.deps-restorer": "1102.0.0",
+    "@pnpm/lockfile.fs": "1100.1.5",
+    "@pnpm/lockfile.pruner": "1100.0.11",
+    "@pnpm/installing.linking.modules-cleaner": "1100.1.8",
+    "@pnpm/lockfile.preferred-versions": "1100.0.16",
+    "@pnpm/installing.modules-yaml": "1100.0.9",
+    "@pnpm/lockfile.settings-checker": "1100.0.18",
+    "@pnpm/lockfile.utils": "1100.0.13",
+    "@pnpm/lockfile.to-pnp": "1100.0.14",
+    "@pnpm/network.auth-header": "1101.1.2",
+    "@pnpm/lockfile.walker": "1100.0.11",
+    "@pnpm/pnpr.client": "1.2.1",
     "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
-    "@pnpm/pkg-manifest.utils": "1100.2.3",
-    "@pnpm/patching.config": "1100.0.7",
-    "@pnpm/pnpr.client": "1.2.0",
-    "@pnpm/resolving.resolver-base": "1100.4.1",
-    "@pnpm/store.controller-types": "1100.1.4",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.11",
-    "@pnpm/store.index": "1100.1.0",
-    "@pnpm/types": "1101.3.1"
+    "@pnpm/pkg-manifest.utils": "1100.2.5",
+    "@pnpm/resolving.resolver-base": "1100.4.2",
+    "@pnpm/lockfile.filtering": "1100.1.7",
+    "@pnpm/types": "1101.3.2",
+    "@pnpm/patching.config": "1100.0.8",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.13",
+    "@pnpm/store.controller-types": "1100.1.5",
+    "@pnpm/lockfile.verification": "1100.0.18",
+    "@pnpm/store.index": "1100.2.0"
   },
   "peerDependencies": {
-    "@pnpm/logger": "^1001.0.1",
-    "@pnpm/worker": "^1100.1.10"
+    "@pnpm/logger": "^1100.0.0",
+    "@pnpm/worker": "^1100.2.0"
   },
   "devDependencies": {
-    "@jest/globals": "30.3.0",
+    "@jest/globals": "30.4.1",
     "@types/fs-extra": "^11.0.4",
     "@types/is-windows": "^1.0.2",
     "@types/normalize-path": "^3.0.2",
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
-    "@yarnpkg/core": "4.5.0",
+    "@yarnpkg/core": "4.8.0",
     "ci-info": "^4.4.0",
     "deep-require-cwd": "1.0.0",
     "execa": "npm:safe-execa@0.3.0",
     "exists-link": "2.0.0",
     "is-windows": "^1.0.2",
-    "nock": "13.3.4",
     "path-name": "^1.0.0",
     "read-yaml-file": "^3.0.0",
     "resolve-link-target": "^3.0.0",
     "symlink-dir": "^10.0.1",
     "write-json-file": "^7.0.0",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/assert-project": "1100.0.14",
-    "@pnpm/lockfile.types": "1100.0.10",
-    "@pnpm/installing.deps-installer": "1101.8.0",
-    "@pnpm/assert-store": "1100.0.14",
-    "@pnpm/network.git-utils": "1100.0.1",
+    "@pnpm/assert-project": "1100.0.16",
+    "@pnpm/installing.deps-installer": "1102.0.0",
+    "@pnpm/assert-store": "1100.0.16",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/pkg-manifest.reader": "1100.0.7",
-    "@pnpm/resolving.registry.types": "1100.1.2",
-    "@pnpm/prepare": "1100.0.14",
-    "@pnpm/test-fixtures": "1100.0.0",
-    "@pnpm/store.cafs": "1100.1.9",
-    "@pnpm/testing.mock-agent": "1101.0.1",
-    "@pnpm/test-ipc-server": "1100.0.0",
+    "@pnpm/network.git-utils": "1100.0.1",
+    "@pnpm/pkg-manifest.reader": "1100.0.8",
+    "@pnpm/store.cafs": "1100.1.10",
+    "@pnpm/prepare": "1100.0.16",
     "@pnpm/store.path": "1100.0.1",
-    "@pnpm/testing.temp-store": "1100.1.7",
-    "@pnpm/testing.registry-mock": "1100.0.4"
+    "@pnpm/test-ipc-server": "1100.0.0",
+    "@pnpm/testing.registry-mock": "1100.0.6",
+    "@pnpm/testing.mock-agent": "1101.0.3",
+    "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/testing.temp-store": "1100.1.9",
+    "@pnpm/resolving.registry.types": "1100.1.3",
+    "@pnpm/lockfile.types": "1100.0.11"
   },
   "engines": {
     "node": ">=22.13"
   },
   "jest": {
+    "collectCoverage": false,
     "preset": "@pnpm/jest-config/with-registry"
   },
   "scripts": {
@@ -170,6 +170,8 @@
     "test-with-preview": "preview && pnpm run test:e2e",
     "test": "pn compile && pn .test",
     "compile": "tsgo --build && pn lint --fix",
-    ".test": "cross-env PNPM_REGISTRY_MOCK_PORT=7769 NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest"
+    ".test": "pn .test:heavy && pn .test:rest",
+    ".test:heavy": "cross-env PNPM_REGISTRY_MOCK_PORT=7769 NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest test/install/deepRecursive.ts",
+    ".test:rest": "cross-env PNPM_REGISTRY_MOCK_PORT=7769 NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest \"^(?!.*deepRecursive)\""
   }
 }