@pnpm/installing.deps-installer 1101.9.0 → 1102.1.0

package/lib/install/index.js

@@ -3,22 +3,24 @@ import { linkBins, linkBinsOfPackages } from '@pnpm/bins.linker';
 import { buildSelectedPkgs } from '@pnpm/building.after-install';
 import { buildModules, linkBinsOfDependencies } from '@pnpm/building.during-install';
 import { createAllowBuildFunction, isBuildExplicitlyDisallowed } from '@pnpm/building.policy';
+import { mergeCatalogs } from '@pnpm/catalogs.config';
 import { parseCatalogProtocol } from '@pnpm/catalogs.protocol-parser';
 import { matchCatalogResolveResult, resolveFromCatalog } from '@pnpm/catalogs.resolver';
+import { parseOverrides } from '@pnpm/config.parse-overrides';
 import { LAYOUT_VERSION, LOCKFILE_MAJOR_VERSION, LOCKFILE_VERSION, WANTED_LOCKFILE, } from '@pnpm/constants';
 import { ignoredScriptsLogger, stageLogger, summaryLogger, } from '@pnpm/core-loggers';
 import { hashObjectNullableWithPrefix } from '@pnpm/crypto.object-hasher';
 import * as dp from '@pnpm/deps.path';
 import { PnpmError } from '@pnpm/error';
-import { makeNodeRequireOption, runLifecycleHook, runLifecycleHooksConcurrently, } from '@pnpm/exec.lifecycle';
+import { makeNodePackageMapOption, makeNodeRequireOption, runLifecycleHook, runLifecycleHooksConcurrently, } from '@pnpm/exec.lifecycle';
 import { getContext } from '@pnpm/installing.context';
 import { getWantedDependencies, resolveDependencies, } from '@pnpm/installing.deps-resolver';
 import { extendProjectsWithTargetDirs, headlessInstall } from '@pnpm/installing.deps-restorer';
-import { writeModulesManifest } from '@pnpm/installing.modules-yaml';
-import { cleanGitBranchLockfiles, getWantedLockfileName, isEmptyLockfile, readWantedLockfileFile, writeCurrentLockfile, writeLockfiles, writeWantedLockfile, } from '@pnpm/lockfile.fs';
+import { readModulesManifest, writeModulesManifest } from '@pnpm/installing.modules-yaml';
+import { cleanGitBranchLockfiles, getWantedLockfileName, isEmptyLockfile, readEnvLockfile, readWantedLockfile, readWantedLockfileFile, writeCurrentLockfile, writeEnvLockfile, writeLockfiles, writeWantedLockfile, } from '@pnpm/lockfile.fs';
 import { getPreferredVersionsFromLockfileAndManifests } from '@pnpm/lockfile.preferred-versions';
 import { calcPatchHashes, createOverridesMapFromParsed, getOutdatedLockfileSetting, } from '@pnpm/lockfile.settings-checker';
-import { writePnpFile } from '@pnpm/lockfile.to-pnp';
+import { PACKAGE_MAP_FILENAME, writePackageMap, writePnpFile } from '@pnpm/lockfile.to-pnp';
 import { allProjectsAreUpToDate, satisfiesPackageManifest } from '@pnpm/lockfile.verification';
 import { globalInfo, logger, streamParser } from '@pnpm/logger';
 import { groupPatchedDependencies } from '@pnpm/patching.config';
@@ -60,7 +62,7 @@ export async function install(manifest, opts) {
     if (opts.pnprServer) {
         return installViaPnprServer(manifest, rootDir, opts);
     }
-    const { updatedCatalogs, updatedProjects: projects, ignoredBuilds, resolutionPolicyViolations } = await mutateModules([
+    const { updatedCatalogs, updatedProjects: projects, ignoredBuilds, resolutionPolicyViolations, dryRunResult } = await mutateModules([
         {
             mutation: 'install',
             pruneDirectDependencies: opts.pruneDirectDependencies,
@@ -79,7 +81,7 @@ export async function install(manifest, opts) {
                 binsDir: opts.binsDir,
             }],
     });
-    return { updatedCatalogs, updatedManifest: projects[0].manifest, ignoredBuilds, resolutionPolicyViolations };
+    return { updatedCatalogs, updatedManifest: projects[0].manifest, ignoredBuilds, resolutionPolicyViolations, dryRunResult };
 }
 export async function mutateModulesInSingleProject(project, maybeOpts) {
     const result = await mutateModules([
@@ -102,6 +104,7 @@ export async function mutateModulesInSingleProject(project, maybeOpts) {
         updatedProject: result.updatedProjects[0],
         ignoredBuilds: result.ignoredBuilds,
         resolutionPolicyViolations: result.resolutionPolicyViolations,
+        dryRunResult: result.dryRunResult,
     };
 }
 const pickCatalogSpecifier = {
@@ -168,15 +171,24 @@ export async function mutateModules(projects, maybeOpts) {
     // attaching their own verifiers). The threat model is a lockfile that
     // someone else resolved — committed to the repo, restored from a CI
     // cache, etc. — bypassing the local resolver's policy filters; the local
-    // resolver's own filters already cover fresh resolution. We run this
-    // exactly once, right after the lockfile is loaded from disk, before any
-    // path branches.
+    // resolver's own filters already cover fresh resolution.
     //
-    // Skipped when we already know pacquet will run the install: pacquet's
-    // frozen-install path applies the same resolver-policy gate (port of
-    // this function), so re-running here would duplicate the work — and
-    // for `minimumReleaseAge` in strict mode each lockfile entry is an
-    // HTTP probe.
+    // The verification is kicked off here, right after the lockfile is loaded,
+    // but not awaited inline — it would otherwise block every later install
+    // stage on per-entry registry round trips. Its synchronous prologue (cache
+    // lookup, lockfile hashing, candidate collection) runs now against the
+    // pristine lockfile, so the async fan-out reads a stable snapshot even
+    // while the install mutates `ctx.wantedLockfile` concurrently. The verdict
+    // is reconciled with the install in `settleInstall`: a failure aborts the
+    // install even mid-flight, and an install that finishes first is held back
+    // until the verdict arrives.
+    //
+    // Skipped when we already know pacquet will run the install: pacquet
+    // applies the same resolver-policy gate (port of this function) whether
+    // it materializes a frozen lockfile or re-resolves from the manifests,
+    // so re-running here would duplicate the work — and for
+    // `minimumReleaseAge` in strict mode each lockfile entry is an HTTP
+    // probe.
     //
     // The predicate mirrors every short-circuit `tryFrozenInstall` checks
     // before reaching the pacquet branch: anything that would make it
@@ -186,13 +198,28 @@ export async function mutateModules(projects, maybeOpts) {
     // isn't known here — so verification still runs in that window, the
     // duplicate is bounded to it.
     const willDelegateToPacquet = opts.runPacquet != null &&
+        opts.useLockfile &&
+        !opts.useGitBranchLockfile &&
+        !opts.mergeGitBranchLockfiles &&
+        !isCheckOnlyInstall(opts) &&
+        opts.enableModulesDir &&
         installsOnly &&
         !opts.lockfileOnly &&
         !opts.fixLockfile &&
         !opts.dedupe &&
         !ctx.lockfileHadConflicts &&
-        ctx.existsNonEmptyWantedLockfile &&
-        (opts.frozenLockfile === true || opts.frozenLockfileIfExists === true);
+        (
+        // Frozen materialization: pacquet reads the existing lockfile and
+        // re-applies the resolver-policy gate as it walks it.
+        (ctx.existsNonEmptyWantedLockfile &&
+            (opts.frozenLockfile === true || opts.frozenLockfileIfExists === true)) ||
+            // Resolving install: pacquet (>= 0.11.7) re-resolves from the
+            // manifests itself — applying the policy during fresh resolution —
+            // so the existing lockfile entries verified here would just be
+            // discarded. If a policy handler is active, keep resolution in pnpm
+            // so violations can be returned to the command layer.
+            (opts.saveLockfile && opts.runPacquet.supportsResolution && opts.frozenLockfile !== true && opts.nodeLinker !== 'hoisted' && opts.handleResolutionPolicyViolations == null));
+    let verifyLockfilePromise;
     if (!willDelegateToPacquet && !opts.trustLockfile) {
         const cacheActive = opts.cacheDir != null && opts.resolutionVerifiers.length > 0;
         const wantedLockfilePath = cacheActive
@@ -201,21 +228,21 @@ export async function mutateModules(projects, maybeOpts) {
                 mergeGitBranchLockfiles: opts.mergeGitBranchLockfiles,
             }))
             : undefined;
-        try {
-            await verifyLockfileResolutions(ctx.wantedLockfile, opts.resolutionVerifiers, {
-                cacheDir: opts.cacheDir,
-                lockfilePath: wantedLockfilePath,
-            });
-        }
-        catch (err) {
-            // verifyLockfileResolutions is the one throw site in this function
-            // that's part of normal user-facing operation (a rejected lockfile);
-            // other throws here are unexpected. Detach the reporter listener so
-            // long-lived processes don't leak it on every rejected install.
-            detachReporter();
-            throw err;
-        }
+        verifyLockfilePromise = verifyLockfileResolutions(ctx.wantedLockfile, opts.resolutionVerifiers, {
+            cacheDir: opts.cacheDir,
+            lockfilePath: wantedLockfilePath,
+        });
+        // Keep the rejection from going unhandled in the window before
+        // `settleInstall` awaits the verdict — a preResolution hook or the
+        // install kickoff below could throw and bail out before we get there.
+        verifyLockfilePromise.catch(() => { });
     }
+    // Gate passed down to the build phase: fetching and linking overlap with
+    // verification, but no dependency lifecycle script may run until the verdict
+    // is in. Awaiting the promise here throws if verification failed, aborting
+    // before any script executes. `settleInstall` is the catch-all that still
+    // reconciles the verdict on paths that never reach the build phase.
+    const verifyLockfile = verifyLockfilePromise && (() => verifyLockfilePromise);
     if (opts.hooks.preResolution) {
         for (const preResolution of opts.hooks.preResolution) {
             // eslint-disable-next-line no-await-in-loop
@@ -251,7 +278,7 @@ export async function mutateModules(projects, maybeOpts) {
             }
         }
     }
-    const result = await _install();
+    const result = await settleInstall(_install(), verifyLockfilePromise);
     // @ts-expect-error
     if (global['verifiedFileIntegrity'] > 1000) {
         // @ts-expect-error
@@ -264,6 +291,7 @@ export async function mutateModules(projects, maybeOpts) {
     if (!opts.ignoreScripts && ignoredBuilds?.size) {
         ignoredBuilds = await runUnignoredDependencyBuilds(opts, ignoredBuilds, ctx.wantedLockfile, allowBuild);
     }
+    let revokedBuilds = false;
     // Detect packages whose build approval was revoked between the previous
     // and current install. A package is considered revoked when it was
     // previously allowed (true) but is now undecided (undefined). Packages
@@ -286,10 +314,28 @@ export async function mutateModules(projects, maybeOpts) {
                 if (allowBuild?.(depPath) === undefined) {
                     ignoredBuilds ??= new Set();
                     ignoredBuilds.add(depPath);
+                    revokedBuilds = true;
                 }
             }
         }
     }
+    if (revokedBuilds && !opts.lockfileOnly && opts.enableModulesDir) {
+        // The install path already wrote .modules.yaml with the current
+        // install's state, but it captured ignoredBuilds before the revocation
+        // scan above added to it. Re-read the manifest from disk so we only
+        // update ignoredBuilds and don't clobber fields (hoistedDependencies,
+        // pendingBuilds, etc.) the install just wrote. The current computed
+        // set is authoritative — runUnignoredDependencyBuilds may have removed
+        // entries (for packages it successfully rebuilt) that the on-disk
+        // manifest still records, and those must not be re-introduced.
+        const writtenManifest = await readModulesManifest(ctx.rootModulesDir);
+        if (writtenManifest) {
+            // writeModulesManifest converts ignoredBuilds to an array before
+            // serializing, so a Set is fine here.
+            writtenManifest.ignoredBuilds = ignoredBuilds;
+            await writeModulesManifest(ctx.rootModulesDir, writtenManifest);
+        }
+    }
     ignoredScriptsLogger.debug({
         packageNames: ignoredBuilds ? dedupePackageNamesFromIgnoredBuilds(ignoredBuilds) : [],
     });
@@ -301,7 +347,33 @@ export async function mutateModules(projects, maybeOpts) {
         depsRequiringBuild: result.depsRequiringBuild,
         ignoredBuilds,
         resolutionPolicyViolations: result.resolutionPolicyViolations ?? [],
+        dryRunResult: result.dryRunResult,
     };
+    // Reconcile the install with the lockfile verification that runs alongside
+    // it. The verification verdict is awaited first so it takes precedence and
+    // aborts as soon as it fails, even while the install is still in flight —
+    // matching the original sequencing where verification gated the install, so
+    // a rejected lockfile surfaces its own error rather than whatever the
+    // concurrent install happened to throw. Only once verification passes is the
+    // install's result (or error) surfaced. detachReporter mirrors the success
+    // path's cleanup so a long-lived process doesn't leak the stream listener on
+    // a rejected install.
+    async function settleInstall(install, verification) {
+        if (verification == null)
+            return install;
+        // Handle the install's eventual rejection up front so a fail-fast
+        // verification throw below doesn't leave the still-running install
+        // unhandled.
+        install.catch(() => { });
+        try {
+            await verification;
+            return await install;
+        }
+        catch (err) {
+            detachReporter();
+            throw err;
+        }
+    }
     async function _install() {
         const scriptsOpts = {
             extraBinPaths: opts.extraBinPaths,
@@ -589,6 +661,7 @@ export async function mutateModules(projects, maybeOpts) {
             scriptsOpts,
             updateLockfileMinorVersion: true,
             patchedDependencies: patchGroups,
+            verifyLockfile,
         });
         return {
             updatedCatalogs: result.updatedCatalogs,
@@ -597,6 +670,7 @@ export async function mutateModules(projects, maybeOpts) {
             depsRequiringBuild: result.depsRequiringBuild,
             ignoredBuilds: result.ignoredBuilds,
             resolutionPolicyViolations: result.resolutionPolicyViolations,
+            dryRunResult: result.dryRunResult,
         };
     }
     /**
@@ -630,6 +704,11 @@ export async function mutateModules(projects, maybeOpts) {
         !ctx.lockfileHadConflicts &&
             !opts.fixLockfile &&
             !opts.dedupe &&
+            // A check-only install (`lockfileCheck`, used by `--dry-run` and
+            // `dedupe --check`) must always run a full resolution so the wanted
+            // lockfile can be compared, and must never materialize anything. The
+            // frozen path would skip resolution and/or perform a real install.
+            !isCheckOnlyInstall(opts) &&
             installsOnly &&
             (
             // If the user explicitly requested a frozen lockfile install, attempt
@@ -717,9 +796,9 @@ Note that in CI environments, this setting is enabled by default.`,
         else {
             logger.info({ message: 'Lockfile is up to date, resolution step is skipped', prefix: opts.lockfileDir });
         }
-        if (opts.runPacquet != null) {
+        if (opts.runPacquet != null && opts.useLockfile && !opts.useGitBranchLockfile && !opts.mergeGitBranchLockfiles && !isCheckOnlyInstall(opts) && opts.enableModulesDir) {
             try {
-                await opts.runPacquet();
+                await opts.runPacquet.run();
             }
             catch (err) {
                 // Same reasoning as the verifyLockfileResolutions catch above: this
@@ -755,6 +834,7 @@ Note that in CI environments, this setting is enabled by default.`,
                 pruneVirtualStore,
                 wantedLockfile: maybeOpts.ignorePackageManifest ? undefined : ctx.wantedLockfile,
                 useLockfile: opts.useLockfile && ctx.wantedLockfileIsModified,
+                verifyLockfile,
             });
             if (opts.useLockfile && opts.saveLockfile && opts.mergeGitBranchLockfiles ||
                 !upToDateLockfileMajorVersion && !opts.frozenLockfile) {
@@ -938,18 +1018,29 @@ export async function addDependenciesToPackage(manifest, dependencySelectors, op
     });
     return { updatedCatalogs, updatedManifest: projects[0].manifest, ignoredBuilds, resolutionPolicyViolations };
 }
+/**
+ * A "check-only" install resolves fully but writes nothing: `dryRun`
+ * (`pnpm install --dry-run`) and `lockfileCheck` (`pnpm dedupe --check`)
+ * both take this path. The shared flag suppresses every write and forces a
+ * full resolution (the frozen/headless fast paths are skipped) so the wanted
+ * lockfile can always be compared.
+ */
+function isCheckOnlyInstall(opts) {
+    return opts.lockfileCheck != null || opts.dryRun === true;
+}
 const _installInContext = async (projects, ctx, opts) => {
+    // Aliasing for clarity in boolean expressions below. True for both
+    // `--dry-run` and `dedupe --check`: resolve fully, write nothing.
+    const isInstallationOnlyForLockfileCheck = isCheckOnlyInstall(opts);
     // The wanted lockfile is mutated during installation. To compare changes, a
     // deep copy before installation is needed. This copy should represent the
     // original wanted lockfile on disk as close as possible.
     //
     // This object can be quite large. Intentionally avoiding an expensive copy
-    // if no lockfileCheck option was passed in.
-    const originalLockfileForCheck = opts.lockfileCheck != null
+    // unless this is a check-only install that needs the comparison.
+    const originalLockfileForCheck = isInstallationOnlyForLockfileCheck
         ? clone(ctx.wantedLockfile)
         : null;
-    // Aliasing for clarity in boolean expressions below.
-    const isInstallationOnlyForLockfileCheck = opts.lockfileCheck != null;
     ctx.wantedLockfile.importers = ctx.wantedLockfile.importers || {};
     for (const { id } of projects) {
         if (!ctx.wantedLockfile.importers[id]) {
@@ -1108,6 +1199,17 @@ const _installInContext = async (projects, ctx, opts) => {
         prefix: ctx.lockfileDir,
         stage: 'resolution_done',
     });
+    // `pnpm update` may bump catalog entries during resolution. Overrides that
+    // reference a catalog (e.g. `overrides: { foo: 'catalog:' }`) were resolved
+    // against the pre-update catalog when the install options were extended, so
+    // re-resolve them against the updated catalog. Done before `afterAllResolved`
+    // so that hook still sees (and can amend) the final overrides. Otherwise
+    // lockfile `overrides` keeps pointing at the old version while `catalogs`
+    // advances, and a later `--frozen-lockfile` install fails with
+    // ERR_PNPM_LOCKFILE_CONFIG_MISMATCH.
+    if (updatedCatalogs != null && opts.overrides != null && Object.keys(opts.overrides).length > 0) {
+        newLockfile.overrides = createOverridesMapFromParsed(parseOverrides(opts.overrides, mergeCatalogs(opts.catalogs, updatedCatalogs)));
+    }
     newLockfile = ((opts.hooks?.afterAllResolved) != null)
         ? await pipeWith(async (f, res) => f(await res), opts.hooks.afterAllResolved)(newLockfile) // eslint-disable-line
         : newLockfile;
@@ -1121,6 +1223,7 @@ const _installInContext = async (projects, ctx, opts) => {
     };
     let stats;
     let ignoredBuilds;
+    const shouldWritePackageMap = opts.enableModulesDir !== false && opts.nodeLinker === 'isolated' && !opts.virtualStoreOnly;
     if (!opts.lockfileOnly && !isInstallationOnlyForLockfileCheck && opts.enableModulesDir) {
         const result = await linkPackages(projects, dependenciesGraph, {
             allowBuild: opts.allowBuild,
@@ -1160,6 +1263,20 @@ const _installInContext = async (projects, ctx, opts) => {
             supportedArchitectures: opts.supportedArchitectures,
         });
         stats = result.stats;
+        if (shouldWritePackageMap) {
+            // Omit the importer self-mapping when a project has no name (see the
+            // deps-restorer write): a non-package-name key like `.` would be invalid.
+            const importerNames = Object.fromEntries(projects.map(({ manifest, id }) => [id, manifest.name]));
+            await writePackageMap(result.currentLockfile, {
+                importerNames,
+                lockfileDir: ctx.lockfileDir,
+                locationByDepPath: Object.fromEntries(Object.values(dependenciesGraph).map((node) => [node.depPath, node.dir])),
+                packageMapType: opts.nodePackageMapType,
+                rootModulesDir: ctx.rootModulesDir,
+                virtualStoreDir: ctx.virtualStoreDir,
+                virtualStoreDirMaxLength: ctx.virtualStoreDirMaxLength,
+            });
+        }
         if (opts.enablePnp) {
             const importerNames = Object.fromEntries(projects.map(({ manifest, id }) => [id, manifest.name ?? id]));
             await writePnpFile(result.currentLockfile, {
@@ -1186,9 +1303,17 @@ const _installInContext = async (projects, ctx, opts) => {
                 if (opts.enablePnp) {
                     extraEnv = {
                         ...extraEnv,
-                        ...makeNodeRequireOption(path.join(opts.lockfileDir, '.pnp.cjs')),
+                        ...makeNodeRequireOption(path.join(opts.lockfileDir, '.pnp.cjs'), extraEnv),
+                    };
+                }
+                if (opts.nodeExperimentalPackageMap && shouldWritePackageMap) {
+                    extraEnv = {
+                        ...extraEnv,
+                        ...makeNodePackageMapOption(path.join(ctx.rootModulesDir, PACKAGE_MAP_FILENAME), extraEnv),
                     };
                 }
+                // Dependency lifecycle scripts must not run on an unverified lockfile.
+                await opts.verifyLockfile?.();
                 ignoredBuilds = (await buildModules(dependenciesGraph, rootNodes, {
                     allowBuild: opts.allowBuild,
                     childConcurrency: opts.childConcurrency,
@@ -1210,6 +1335,7 @@ const _installInContext = async (projects, ctx, opts) => {
                     unsafePerm: opts.unsafePerm,
                     userAgent: opts.userAgent,
                     enableGlobalVirtualStore: opts.enableGlobalVirtualStore,
+                    frozenStore: opts.frozenStore,
                 })).ignoredBuilds;
                 if (ctx.modulesFile?.ignoredBuilds?.size) {
                     ignoredBuilds ??= new Set();
@@ -1328,10 +1454,20 @@ const _installInContext = async (projects, ctx, opts) => {
             if (opts.enablePnp) {
                 opts.scriptsOpts.extraEnv = {
                     ...opts.scriptsOpts.extraEnv,
-                    ...makeNodeRequireOption(path.join(opts.lockfileDir, '.pnp.cjs')),
+                    ...makeNodeRequireOption(path.join(opts.lockfileDir, '.pnp.cjs'), opts.scriptsOpts.extraEnv),
+                };
+            }
+            if (opts.nodeExperimentalPackageMap && shouldWritePackageMap) {
+                opts.scriptsOpts.extraEnv = {
+                    ...opts.scriptsOpts.extraEnv,
+                    ...makeNodePackageMapOption(path.join(ctx.rootModulesDir, PACKAGE_MAP_FILENAME), opts.scriptsOpts.extraEnv),
                 };
             }
             const projectsToBeBuilt = projectsWithTargetDirs.filter(({ mutation }) => mutation === 'install');
+            // The projects' own lifecycle scripts import dependency code linked
+            // from the lockfile, so they are held to the same gate as dependency
+            // builds — also when no new dep paths made the buildModules branch run.
+            await opts.verifyLockfile?.();
             await runLifecycleHooksConcurrently(['preinstall', 'install', 'postinstall', 'preprepare', 'prepare', 'postprepare'], projectsToBeBuilt, opts.childConcurrency, opts.scriptsOpts);
         }
     }
@@ -1408,11 +1544,36 @@ const _installInContext = async (projects, ctx, opts) => {
         depsRequiringBuild,
         ignoredBuilds,
         resolutionPolicyViolations,
+        dryRunResult: (opts.dryRun && originalLockfileForCheck != null)
+            ? { originalLockfile: originalLockfileForCheck, wantedLockfile: newLockfile }
+            : undefined,
     };
 };
 function allMutationsAreInstalls(projects) {
     return projects.every((project) => project.mutation === 'install' && !project.update && !project.updateMatching);
 }
+/**
+ * The `InstallFunctionResult` for an install pacquet resolved and
+ * materialized end-to-end. pacquet wrote `pnpm-lock.yaml` and the
+ * `node_modules` tree itself. `ctx.wantedLockfile` has already been
+ * refreshed from disk, and pacquet reports its own stats / ignored-builds
+ * via NDJSON, so the structured `stats` / `ignoredBuilds` fall back to
+ * their no-op defaults. Resolution-policy handlers are guarded out before
+ * this path, so there are no command-layer policy violations to return.
+ * Manifests are returned unchanged — this path only runs for plain
+ * installs, which don't rewrite `package.json`.
+ */
+function pacquetResolveResult(projects, ctx) {
+    return {
+        newLockfile: ctx.wantedLockfile,
+        projects: projects.map((project) => ({
+            manifest: project.originalManifest ?? project.manifest,
+            rootDir: project.rootDir,
+        })),
+        depsRequiringBuild: [],
+        resolutionPolicyViolations: [],
+    };
+}
 /**
  * Run the pacquet binary if it's configured, otherwise run the JS
  * `headlessInstall`. Callers can hand off any code path that materializes
@@ -1429,13 +1590,17 @@ function allMutationsAreInstalls(projects) {
  * stats record and a no-op ignoredBuilds iteration).
  */
 async function materializeOrDelegate(opts, runHeadlessInstall) {
-    if (opts.runPacquet != null) {
+    if (opts.runPacquet != null &&
+        opts.useLockfile !== false &&
+        opts.saveLockfile !== false &&
+        opts.useGitBranchLockfile !== true &&
+        opts.mergeGitBranchLockfiles !== true) {
         // Reached only from the resolve-then-materialize call sites
         // (workspace-partial, hoisted-linker, pnpr server install). Each ran a
         // lockfileOnly resolve pass that emitted one
         // `pnpm:progress status:resolved` per package, so pacquet's
         // duplicate `resolved` events would double the reporter's count.
-        await opts.runPacquet({ filterResolvedProgress: true });
+        await opts.runPacquet.run({ filterResolvedProgress: true });
         return {};
     }
     return runHeadlessInstall();
@@ -1446,7 +1611,7 @@ const installInContext = async (projects, ctx, opts) => {
         if (!opts.frozenLockfile && opts.useLockfile) {
             const allProjectsLocatedInsideWorkspace = Object.values(ctx.projects)
                 .filter((project) => isPathInsideWorkspace(project.rootDirRealPath ?? project.rootDir));
-            if (allProjectsLocatedInsideWorkspace.length > projects.length) {
+            if (allProjectsLocatedInsideWorkspace.length > projects.length && !isCheckOnlyInstall(opts) && opts.enableModulesDir) {
                 const newProjects = [...projects];
                 const getWantedDepsOpts = {
                     autoInstallPeers: opts.autoInstallPeers,
@@ -1498,7 +1663,7 @@ const installInContext = async (projects, ctx, opts) => {
                 };
             }
         }
-        if (opts.nodeLinker === 'hoisted' && !opts.lockfileOnly) {
+        if (opts.nodeLinker === 'hoisted' && !opts.lockfileOnly && !isCheckOnlyInstall(opts) && opts.enableModulesDir) {
             const result = await _installInContext(projects, ctx, {
                 ...opts,
                 lockfileOnly: true,
@@ -1524,20 +1689,69 @@ const installInContext = async (projects, ctx, opts) => {
                 ignoredBuilds,
             };
         }
-        // Isolated `nodeLinker` (the default) with a non-frozen install:
-        // pacquet doesn't ship a resolver yet, so split the install in two —
-        // ask `_installInContext` for a `lockfileOnly` resolve pass (writes
-        // `pnpm-lock.yaml`), then hand the freshly-written lockfile to
-        // pacquet for the fetch / import / link / build phases. The frozen
-        // branch is handled earlier in `tryFrozenInstall`; the hoisted
-        // branch above already runs the same resolve-then-materialize
-        // sequence (it had to even before pacquet existed). When no pacquet
-        // is configured this falls through to the full single-pass install.
-        if (opts.runPacquet != null && !opts.lockfileOnly) {
+        // Isolated `nodeLinker` (the default) with a non-frozen install.
+        // The frozen branch is handled earlier in `tryFrozenInstall`; the
+        // hoisted branch above runs a resolve-then-materialize sequence.
+        if (opts.runPacquet != null && opts.useLockfile && opts.saveLockfile && !opts.useGitBranchLockfile && !opts.mergeGitBranchLockfiles && !opts.lockfileOnly && !isCheckOnlyInstall(opts) && opts.enableModulesDir) {
+            // pacquet >= 0.11.7 resolves itself: hand it the whole install
+            // (resolve + fetch + import + link + build, writing the lockfile)
+            // in a single non-frozen pass. Only for plain installs — `add` /
+            // `update` / `remove` need pnpm to mutate the manifests and
+            // resolve the new specs first (pacquet's `install` reads
+            // package.json from disk, which pnpm hasn't rewritten yet).
+            if (opts.runPacquet.supportsResolution && !opts.frozenLockfile && opts.handleResolutionPolicyViolations == null && allMutationsAreInstalls(projects)) {
+                // `configDependencies` are recorded in a YAML document prepended
+                // to `pnpm-lock.yaml` — purely a pnpm concept that pacquet doesn't
+                // model. Capture it before pacquet rewrites the lockfile and
+                // restore it afterwards (`writeEnvLockfile` re-reads pacquet's main
+                // document and re-prepends the env document), otherwise the next
+                // `--frozen-lockfile` install fails its config-deps freshness gate.
+                // The restore runs even if pacquet fails partway: a non-zero exit can
+                // still leave a rewritten lockfile behind, so the env document must be
+                // put back regardless.
+                const envLockfile = await readEnvLockfile(ctx.lockfileDir);
+                let pacquetError;
+                try {
+                    await opts.runPacquet.run({ resolve: true });
+                }
+                catch (err) {
+                    pacquetError = err;
+                    throw err;
+                }
+                finally {
+                    if (envLockfile != null) {
+                        await writeEnvLockfile(ctx.lockfileDir, envLockfile).catch((restoreErr) => {
+                            if (pacquetError == null) {
+                                throw restoreErr;
+                            }
+                            logger.warn({
+                                error: restoreErr,
+                                message: `Failed to restore the configDependencies document in pnpm-lock.yaml: ${restoreErr.message}`,
+                                prefix: ctx.lockfileDir,
+                            });
+                        });
+                    }
+                }
+                const wantedLockfile = await readWantedLockfile(ctx.lockfileDir, {
+                    ignoreIncompatible: opts.force || opts.ci === true,
+                    mergeGitBranchLockfiles: opts.mergeGitBranchLockfiles,
+                    useGitBranchLockfile: opts.useGitBranchLockfile,
+                    wantedVersions: [LOCKFILE_VERSION],
+                });
+                if (wantedLockfile == null) {
+                    throw new PnpmError('PACQUET_LOCKFILE_READ_FAILED', `pacquet did not write a readable ${WANTED_LOCKFILE}`);
+                }
+                ctx.wantedLockfile = wantedLockfile;
+                return pacquetResolveResult(projects, ctx);
+            }
+            // Older pacquet can only materialize: split the install in two —
+            // ask `_installInContext` for a `lockfileOnly` resolve pass (writes
+            // `pnpm-lock.yaml`), then hand the freshly-written lockfile to
+            // pacquet for the fetch / import / link / build phases. The resolve
+            // pass emitted a `pnpm:progress status:resolved` per package; ask
+            // pacquet to drop its own duplicates.
             const result = await _installInContext(projects, ctx, { ...opts, lockfileOnly: true });
-            // The resolve pass above emitted a `pnpm:progress status:resolved`
-            // per package; ask pacquet to drop its own duplicates.
-            await opts.runPacquet({ filterResolvedProgress: true });
+            await opts.runPacquet.run({ filterResolvedProgress: true });
             return result;
         }
         return await _installInContext(projects, ctx, opts);
@@ -1811,6 +2025,15 @@ async function mutateModulesViaPnpr(projects, opts) {
  * and links packages into node_modules — like a normal install.
  */
 async function installViaPnprServer(manifest, rootDir, opts, allInstallProjects) {
+    // The pnpr server path re-resolves and persists new `index.db` entries plus a
+    // freshly written lockfile, so it inherently writes the store. `frozenStore`
+    // promises the store is complete and read-only, so the two are mutually
+    // exclusive — and the unconditional pnpr gate means this path runs even under
+    // `--offline --frozen-lockfile`, so refuse up front with guidance instead of
+    // crashing later on the read-only `index.db` open.
+    if (opts.frozenStore) {
+        throw new PnpmError('FROZEN_STORE_INCOMPATIBLE_WITH_PNPR', 'The pnpr server resolves dependencies and writes new entries into the store, which is opened read-only when frozenStore is enabled.', { hint: 'Disable the pnpr server (unset `--pnpr-server` / `pnprServer` in pnpm-workspace.yaml) so the install reads from the existing store, or unset `frozenStore` to allow store writes.' });
+    }
     // The pnpr server path skips client-side resolution, so resolver-side policies
     // can't be enforced locally. `minimumReleaseAge` is forwarded to the
     // pnpr server and enforced server-side. `trustPolicy` has no server-side
@@ -1820,7 +2043,7 @@ async function installViaPnprServer(manifest, rootDir, opts, allInstallProjects)
         throw new PnpmError('TRUST_POLICY_INCOMPATIBLE_WITH_PNPR', 'The pnpr server does not yet enforce `trustPolicy: no-downgrade`, so running an install through it under this policy would produce a lockfile that the local verifier rejects.', { hint: 'Unset `trustPolicy` for this install, or disable the pnpr server (unset `--pnpr-server` / `pnprServer` in pnpm-workspace.yaml) so resolution runs locally and the trust check applies.' });
     }
     const { resolveViaPnprServer } = await import('@pnpm/pnpr.client');
-    const { createGetAuthHeaderByURI, getAuthHeadersFromCreds } = await import('@pnpm/network.auth-header');
+    const { createGetAuthHeaderByURI, getAuthHeadersByScope, getAuthHeadersFromCreds } = await import('@pnpm/network.auth-header');
     // Forward the whole credential map (the registries a graph touches
     // aren't known up front), so the server attaches the right token per
     // URL. `authorization` also identifies the caller to pnpr's gate.
@@ -1856,7 +2079,7 @@ async function installViaPnprServer(manifest, rootDir, opts, allInstallProjects)
             projects: projectsList,
             registry: opts.registries?.default,
             namedRegistries: opts.namedRegistries,
-            authHeaders: forwardedAuthHeaders,
+            authHeaders: getAuthHeadersByScope(forwardedAuthHeaders),
             authorization: pnprAuthorization,
             overrides: opts.overrides,
             minimumReleaseAge: opts.minimumReleaseAge,

package/lib/install/link.d.ts

@@ -1,5 +1,5 @@
 import { type DepsStateCache } from '@pnpm/deps.graph-hasher';
-import type { DependenciesGraph, LinkedDependency } from '@pnpm/installing.deps-resolver';
+import { type DependenciesGraph, type LinkedDependency } from '@pnpm/installing.deps-resolver';
 import type { InstallationResultStats } from '@pnpm/installing.deps-restorer';
 import type { IncludedDependencies } from '@pnpm/installing.modules-yaml';
 import type { LockfileObject } from '@pnpm/lockfile.fs';