@pnpm/installing.env-installer 1000.0.19

package/LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2015-2016 Rico Sta. Cruz and other contributors
+Copyright (c) 2016-2026 Zoltan Kochan and other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,17 @@
+# @pnpm/installing.env-installer
+
+> Installer for configurational dependencies
+
+<!--@shields('npm')-->
+[![npm version](https://img.shields.io/npm/v/@pnpm/installing.env-installer.svg)](https://www.npmjs.com/package/@pnpm/installing.env-installer)
+<!--/@-->
+
+## Installation
+
+```sh
+pnpm add @pnpm/installing.env-installer
+```
+
+## License
+
+MIT

package/lib/index.d.ts

@@ -0,0 +1,4 @@
+export { installConfigDeps, type InstallConfigDepsOpts } from './installConfigDeps.js';
+export { resolveAndInstallConfigDeps, type ResolveAndInstallConfigDepsOpts } from './resolveAndInstallConfigDeps.js';
+export { resolveConfigDeps, type ResolveConfigDepsOpts } from './resolveConfigDeps.js';
+export { isPackageManagerResolved, resolvePackageManagerIntegrities, type ResolvePackageManagerIntegritiesOpts } from './resolvePackageManagerIntegrities.js';

package/lib/index.js

@@ -0,0 +1,5 @@
+export { installConfigDeps } from './installConfigDeps.js';
+export { resolveAndInstallConfigDeps } from './resolveAndInstallConfigDeps.js';
+export { resolveConfigDeps } from './resolveConfigDeps.js';
+export { isPackageManagerResolved, resolvePackageManagerIntegrities } from './resolvePackageManagerIntegrities.js';
+//# sourceMappingURL=index.js.map

package/lib/installConfigDeps.d.ts

@@ -0,0 +1,15 @@
+import { type EnvLockfile } from '@pnpm/lockfile.fs';
+import type { StoreController } from '@pnpm/store.controller';
+import type { ConfigDependencies, Registries } from '@pnpm/types';
+export interface InstallConfigDepsOpts {
+    registries: Registries;
+    rootDir: string;
+    store: StoreController;
+    storeDir: string;
+}
+/**
+ * Install config dependencies using the env lockfile.
+ * Accepts either a EnvLockfile directly (from resolveConfigDeps) or
+ * ConfigDependencies from the workspace manifest (legacy/migration).
+ */
+export declare function installConfigDeps(configDepsOrLockfile: ConfigDependencies | EnvLockfile, opts: InstallConfigDepsOpts): Promise<void>;

package/lib/installConfigDeps.js

@@ -0,0 +1,123 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
+import { installingConfigDepsLogger } from '@pnpm/core-loggers';
+import { calcLeafGlobalVirtualStorePath } from '@pnpm/deps.graph-hasher';
+import { PnpmError } from '@pnpm/error';
+import { readModulesDir } from '@pnpm/fs.read-modules-dir';
+import { readEnvLockfile } from '@pnpm/lockfile.fs';
+import { safeReadPackageJsonFromDir } from '@pnpm/pkg-manifest.reader';
+import { rimraf } from '@zkochan/rimraf';
+import getNpmTarballUrl from 'get-npm-tarball-url';
+import symlinkDir from 'symlink-dir';
+import { migrateConfigDepsToLockfile } from './migrateConfigDeps.js';
+/**
+ * Install config dependencies using the env lockfile.
+ * Accepts either a EnvLockfile directly (from resolveConfigDeps) or
+ * ConfigDependencies from the workspace manifest (legacy/migration).
+ */
+export async function installConfigDeps(configDepsOrLockfile, opts) {
+    const normalizedDeps = await normalizeForInstall(configDepsOrLockfile, opts);
+    const globalVirtualStoreDir = path.join(opts.storeDir, 'links');
+    const configModulesDir = path.join(opts.rootDir, 'node_modules/.pnpm-config');
+    const existingConfigDeps = await readModulesDir(configModulesDir) ?? [];
+    await Promise.all(existingConfigDeps.map(async (existingConfigDep) => {
+        if (!normalizedDeps[existingConfigDep]) {
+            await rimraf(path.join(configModulesDir, existingConfigDep));
+        }
+    }));
+    const installedConfigDeps = [];
+    await Promise.all(Object.entries(normalizedDeps).map(async ([pkgName, pkg]) => {
+        const configDepPath = path.join(configModulesDir, pkgName);
+        const existingPkgJson = existingConfigDeps.includes(pkgName)
+            ? await safeReadPackageJsonFromDir(configDepPath)
+            : null;
+        if (existingPkgJson != null && existingPkgJson.name === pkgName && existingPkgJson.version === pkg.version) {
+            return;
+        }
+        installingConfigDepsLogger.debug({ status: 'started' });
+        const fullPkgId = `${pkgName}@${pkg.version}:${pkg.resolution.integrity}`;
+        const relPath = calcLeafGlobalVirtualStorePath(fullPkgId, pkgName, pkg.version);
+        const pkgDirInGlobalVirtualStore = path.join(globalVirtualStoreDir, relPath, 'node_modules', pkgName);
+        if (!fs.existsSync(path.join(pkgDirInGlobalVirtualStore, 'package.json'))) {
+            const { fetching } = await opts.store.fetchPackage({
+                force: true,
+                lockfileDir: opts.rootDir,
+                pkg: {
+                    id: `${pkgName}@${pkg.version}`,
+                    resolution: pkg.resolution,
+                },
+            });
+            const { files: filesResponse } = await fetching();
+            await opts.store.importPackage(pkgDirInGlobalVirtualStore, {
+                force: true,
+                requiresBuild: false,
+                filesResponse,
+            });
+        }
+        if (existingConfigDeps.includes(pkgName)) {
+            await rimraf(configDepPath);
+        }
+        await fs.promises.mkdir(path.dirname(configDepPath), { recursive: true });
+        await symlinkDir(pkgDirInGlobalVirtualStore, configDepPath);
+        installedConfigDeps.push({
+            name: pkgName,
+            version: pkg.version,
+        });
+    }));
+    if (installedConfigDeps.length) {
+        installingConfigDepsLogger.debug({ status: 'done', deps: installedConfigDeps });
+    }
+}
+async function normalizeForInstall(configDepsOrLockfile, opts) {
+    // If it's a EnvLockfile object (has lockfileVersion), use it directly
+    if (isEnvLockfile(configDepsOrLockfile)) {
+        return normalizeFromLockfile(configDepsOrLockfile, opts.registries);
+    }
+    // It's ConfigDependencies from workspace manifest.
+    // Try to read the env lockfile first.
+    const envLockfile = await readEnvLockfile(opts.rootDir);
+    if (envLockfile) {
+        return normalizeFromLockfile(envLockfile, opts.registries);
+    }
+    // No env lockfile yet — migrate from old inline integrity format
+    return migrateConfigDepsToLockfile(configDepsOrLockfile, opts);
+}
+function isEnvLockfile(obj) {
+    return 'lockfileVersion' in obj &&
+        'importers' in obj &&
+        obj.importers != null &&
+        typeof obj.importers === 'object' &&
+        'packages' in obj &&
+        obj.packages != null &&
+        typeof obj.packages === 'object' &&
+        'snapshots' in obj &&
+        obj.snapshots != null &&
+        typeof obj.snapshots === 'object';
+}
+function normalizeFromLockfile(lockfile, registries) {
+    const deps = {};
+    const configDeps = lockfile.importers['.']?.configDependencies ?? {};
+    for (const [pkgName, { version }] of Object.entries(configDeps)) {
+        const pkgKey = `${pkgName}@${version}`;
+        const pkgInfo = lockfile.packages[pkgKey];
+        if (!pkgInfo) {
+            throw new PnpmError('ENV_LOCKFILE_CORRUPTED', `pnpm-lock.yaml is corrupted or incomplete: missing packages entry for "${pkgKey}" ` +
+                'referenced from importers[\'.\'].configDependencies');
+        }
+        const resolution = pkgInfo.resolution;
+        if (!resolution.integrity) {
+            throw new PnpmError('ENV_LOCKFILE_CORRUPTED', `pnpm-lock.yaml is corrupted or incomplete: missing integrity for "${pkgKey}"`);
+        }
+        const registry = pickRegistryForPackage(registries, pkgName);
+        deps[pkgName] = {
+            version,
+            resolution: {
+                integrity: resolution.integrity,
+                tarball: resolution.tarball ?? getNpmTarballUrl(pkgName, version, { registry }),
+            },
+        };
+    }
+    return deps;
+}
+//# sourceMappingURL=installConfigDeps.js.map

package/lib/migrateConfigDeps.d.ts

@@ -0,0 +1,15 @@
+import type { ConfigDependencies, Registries } from '@pnpm/types';
+import type { NormalizedConfigDep } from './parseIntegrity.js';
+interface MigrateOpts {
+    registries: Registries;
+    rootDir: string;
+}
+/**
+ * Migrates old-format configDependencies (with inline integrity in pnpm-workspace.yaml)
+ * to the new pnpm-lock.yaml format.
+ *
+ * Returns normalized deps for immediate installation, and writes the env lockfile
+ * and clean specifiers to pnpm-workspace.yaml as a side effect.
+ */
+export declare function migrateConfigDepsToLockfile(configDeps: ConfigDependencies, opts: MigrateOpts): Promise<Record<string, NormalizedConfigDep>>;
+export {};

package/lib/migrateConfigDeps.js

@@ -0,0 +1,80 @@
+import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
+import { writeSettings } from '@pnpm/config.writer';
+import { PnpmError } from '@pnpm/error';
+import { createEnvLockfile, writeEnvLockfile } from '@pnpm/lockfile.fs';
+import { toLockfileResolution } from '@pnpm/lockfile.utils';
+import getNpmTarballUrl from 'get-npm-tarball-url';
+import { parseIntegrity } from './parseIntegrity.js';
+/**
+ * Migrates old-format configDependencies (with inline integrity in pnpm-workspace.yaml)
+ * to the new pnpm-lock.yaml format.
+ *
+ * Returns normalized deps for immediate installation, and writes the env lockfile
+ * and clean specifiers to pnpm-workspace.yaml as a side effect.
+ */
+export async function migrateConfigDepsToLockfile(configDeps, opts) {
+    const envLockfile = createEnvLockfile();
+    const cleanSpecifiers = {};
+    const normalizedDeps = {};
+    for (const [pkgName, pkgSpec] of Object.entries(configDeps)) {
+        const registry = pickRegistryForPackage(opts.registries, pkgName);
+        if (typeof pkgSpec === 'object') {
+            const { version, integrity } = parseIntegrity(pkgName, pkgSpec.integrity);
+            const tarball = pkgSpec.tarball ?? getNpmTarballUrl(pkgName, version, { registry });
+            cleanSpecifiers[pkgName] = version;
+            const pkgKey = `${pkgName}@${version}`;
+            envLockfile.importers['.'].configDependencies[pkgName] = {
+                specifier: version,
+                version,
+            };
+            envLockfile.packages[pkgKey] = {
+                resolution: toLockfileResolution({ name: pkgName, version }, { integrity, tarball }, registry),
+            };
+            envLockfile.snapshots[pkgKey] = {};
+            normalizedDeps[pkgName] = {
+                version,
+                resolution: { integrity, tarball },
+            };
+            continue;
+        }
+        if (typeof pkgSpec === 'string') {
+            // This branch only handles the legacy inline format (version+integrity).
+            // New clean specifiers (just version/range) require an existing pnpm-lock.yaml.
+            if (!pkgSpec.includes('+')) {
+                throw new PnpmError('CONFIG_DEP_MISSING_LOCKFILE', `Config dependency "${pkgName}" is already in clean-specifier form (${pkgSpec}) ` +
+                    'but no pnpm-lock.yaml was found to resolve it. ' +
+                    'Please generate and commit pnpm-lock.yaml (for example by running ' +
+                    '`pnpm install` in the workspace root) before attempting to migrate configDependencies.');
+            }
+            const { version, integrity } = parseIntegrity(pkgName, pkgSpec);
+            const tarball = getNpmTarballUrl(pkgName, version, { registry });
+            cleanSpecifiers[pkgName] = version;
+            const pkgKey = `${pkgName}@${version}`;
+            envLockfile.importers['.'].configDependencies[pkgName] = {
+                specifier: version,
+                version,
+            };
+            envLockfile.packages[pkgKey] = {
+                resolution: { integrity },
+            };
+            envLockfile.snapshots[pkgKey] = {};
+            normalizedDeps[pkgName] = {
+                version,
+                resolution: { integrity, tarball },
+            };
+        }
+    }
+    // Write the new env lockfile and clean up workspace manifest
+    await Promise.all([
+        writeEnvLockfile(opts.rootDir, envLockfile),
+        writeSettings({
+            rootProjectManifestDir: opts.rootDir,
+            workspaceDir: opts.rootDir,
+            updatedSettings: {
+                configDependencies: cleanSpecifiers,
+            },
+        }),
+    ]);
+    return normalizedDeps;
+}
+//# sourceMappingURL=migrateConfigDeps.js.map

package/lib/parseIntegrity.d.ts

@@ -0,0 +1,11 @@
+export interface NormalizedConfigDep {
+    version: string;
+    resolution: {
+        integrity: string;
+        tarball: string;
+    };
+}
+export declare function parseIntegrity(pkgName: string, pkgSpec: string): {
+    version: string;
+    integrity: string;
+};

package/lib/parseIntegrity.js

@@ -0,0 +1,18 @@
+import { PnpmError } from '@pnpm/error';
+export function parseIntegrity(pkgName, pkgSpec) {
+    const sepIndex = pkgSpec.indexOf('+');
+    if (sepIndex === -1) {
+        throw new PnpmError('CONFIG_DEP_NO_INTEGRITY', `Your config dependency called "${pkgName}" doesn't have an integrity checksum`, {
+            hint: `Integrity checksum should be inlined in the version specifier. For example:
+
+pnpm-workspace.yaml:
+configDependencies:
+  my-config: "1.0.0+sha512-Xg0tn4HcfTijTwfDwYlvVCl43V6h4KyVVX2aEm4qdO/PC6L2YvzLHFdmxhoeSA3eslcE6+ZVXHgWwopXYLNq4Q=="
+`,
+        });
+    }
+    const version = pkgSpec.substring(0, sepIndex);
+    const integrity = pkgSpec.substring(sepIndex + 1);
+    return { version, integrity };
+}
+//# sourceMappingURL=parseIntegrity.js.map

package/lib/pruneEnvLockfile.d.ts

@@ -0,0 +1,12 @@
+import type { EnvLockfile, LockfileObject } from '@pnpm/lockfile.types';
+/**
+ * Converts an env lockfile to a standard LockfileObject by merging
+ * configDependencies and packageManagerDependencies into a single
+ * importers['.'].dependencies map.
+ */
+export declare function convertToLockfileEnvObject(envLockfile: EnvLockfile): LockfileObject;
+/**
+ * Prunes stale packages and snapshots from an env lockfile by converting to
+ * a standard lockfile object, pruning unreferenced entries, and converting back.
+ */
+export declare function pruneEnvLockfile(envLockfile: EnvLockfile): void;

package/lib/pruneEnvLockfile.js

@@ -0,0 +1,34 @@
+import { convertToLockfileFile, convertToLockfileObject } from '@pnpm/lockfile.fs';
+import { pruneSharedLockfile } from '@pnpm/lockfile.pruner';
+/**
+ * Converts an env lockfile to a standard LockfileObject by merging
+ * configDependencies and packageManagerDependencies into a single
+ * importers['.'].dependencies map.
+ */
+export function convertToLockfileEnvObject(envLockfile) {
+    return convertToLockfileObject({
+        lockfileVersion: envLockfile.lockfileVersion,
+        importers: {
+            '.': {
+                dependencies: {
+                    ...envLockfile.importers['.'].configDependencies,
+                    ...(envLockfile.importers['.'].packageManagerDependencies ?? {}),
+                },
+            },
+        },
+        packages: envLockfile.packages,
+        snapshots: envLockfile.snapshots,
+    });
+}
+/**
+ * Prunes stale packages and snapshots from an env lockfile by converting to
+ * a standard lockfile object, pruning unreferenced entries, and converting back.
+ */
+export function pruneEnvLockfile(envLockfile) {
+    const lockfileObject = convertToLockfileEnvObject(envLockfile);
+    const pruned = pruneSharedLockfile(lockfileObject);
+    const prunedFile = convertToLockfileFile(pruned);
+    envLockfile.packages = prunedFile.packages ?? {};
+    envLockfile.snapshots = prunedFile.snapshots ?? {};
+}
+//# sourceMappingURL=pruneEnvLockfile.js.map

package/lib/resolveAndInstallConfigDeps.d.ts

@@ -0,0 +1,17 @@
+import { type CreateFetchFromRegistryOptions } from '@pnpm/network.fetch';
+import { type ResolverFactoryOptions } from '@pnpm/resolving.npm-resolver';
+import type { ConfigDependencies } from '@pnpm/types';
+import { type InstallConfigDepsOpts } from './installConfigDeps.js';
+export type ResolveAndInstallConfigDepsOpts = CreateFetchFromRegistryOptions & ResolverFactoryOptions & InstallConfigDepsOpts & {
+    rootDir: string;
+    userConfig?: Record<string, string>;
+};
+/**
+ * Resolves any config dependencies that are missing from the env lockfile,
+ * then installs all config dependencies.
+ *
+ * This handles two scenarios:
+ * 1. User manually added config deps to pnpm-workspace.yaml
+ * 2. User deleted pnpm-lock.yaml after installing config deps
+ */
+export declare function resolveAndInstallConfigDeps(configDeps: ConfigDependencies, opts: ResolveAndInstallConfigDepsOpts): Promise<void>;

package/lib/resolveAndInstallConfigDeps.js

@@ -0,0 +1,108 @@
+import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
+import { PnpmError } from '@pnpm/error';
+import { createEnvLockfile, readEnvLockfile, writeEnvLockfile, } from '@pnpm/lockfile.fs';
+import { toLockfileResolution } from '@pnpm/lockfile.utils';
+import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
+import { createFetchFromRegistry } from '@pnpm/network.fetch';
+import { createNpmResolver } from '@pnpm/resolving.npm-resolver';
+import getNpmTarballUrl from 'get-npm-tarball-url';
+import { installConfigDeps } from './installConfigDeps.js';
+import { parseIntegrity } from './parseIntegrity.js';
+import { pruneEnvLockfile } from './pruneEnvLockfile.js';
+/**
+ * Resolves any config dependencies that are missing from the env lockfile,
+ * then installs all config dependencies.
+ *
+ * This handles two scenarios:
+ * 1. User manually added config deps to pnpm-workspace.yaml
+ * 2. User deleted pnpm-lock.yaml after installing config deps
+ */
+export async function resolveAndInstallConfigDeps(configDeps, opts) {
+    const envLockfile = (await readEnvLockfile(opts.rootDir)) ?? createEnvLockfile();
+    const lockfileConfigDeps = envLockfile.importers['.'].configDependencies;
+    const depsToResolve = [];
+    let lockfileChanged = false;
+    for (const [name, value] of Object.entries(configDeps)) {
+        if (typeof value === 'object') {
+            // Old object format — migrate inline into lockfile
+            if (!lockfileConfigDeps[name]) {
+                const registry = pickRegistryForPackage(opts.registries, name);
+                const { version, integrity } = parseIntegrity(name, value.integrity);
+                const tarball = value.tarball ?? getNpmTarballUrl(name, version, { registry });
+                const pkgKey = `${name}@${version}`;
+                lockfileConfigDeps[name] = { specifier: version, version };
+                envLockfile.packages[pkgKey] = {
+                    resolution: toLockfileResolution({ name, version }, { integrity, tarball }, registry),
+                };
+                envLockfile.snapshots[pkgKey] = {};
+                lockfileChanged = true;
+            }
+            continue;
+        }
+        if (value.includes('+')) {
+            // Old string format with inline integrity — migrate into lockfile
+            if (!lockfileConfigDeps[name]) {
+                const registry = pickRegistryForPackage(opts.registries, name);
+                const { version, integrity } = parseIntegrity(name, value);
+                const tarball = getNpmTarballUrl(name, version, { registry });
+                const pkgKey = `${name}@${version}`;
+                lockfileConfigDeps[name] = { specifier: version, version };
+                envLockfile.packages[pkgKey] = {
+                    resolution: toLockfileResolution({ name, version }, { integrity, tarball }, registry),
+                };
+                envLockfile.snapshots[pkgKey] = {};
+                lockfileChanged = true;
+            }
+            continue;
+        }
+        // New format (clean specifier like "1.2.0" or "^1.0.0")
+        const specifier = value;
+        const existing = lockfileConfigDeps[name];
+        if (existing && existing.specifier === specifier) {
+            const pkgKey = `${name}@${existing.version}`;
+            if (envLockfile.packages[pkgKey])
+                continue; // fully resolved
+        }
+        depsToResolve.push({ name, specifier });
+    }
+    if (depsToResolve.length === 0) {
+        if (lockfileChanged) {
+            await writeEnvLockfile(opts.rootDir, envLockfile);
+        }
+        await installConfigDeps(envLockfile, opts);
+        return;
+    }
+    // Resolve missing deps
+    const userConfig = opts.userConfig ?? {};
+    const fetch = createFetchFromRegistry(opts);
+    const getAuthHeader = createGetAuthHeaderByURI({ allSettings: userConfig, userSettings: userConfig });
+    const { resolveFromNpm } = createNpmResolver(fetch, getAuthHeader, opts);
+    await Promise.all(depsToResolve.map(async ({ name, specifier }) => {
+        const resolution = await resolveFromNpm({ alias: name, bareSpecifier: specifier }, {
+            lockfileDir: opts.rootDir,
+            preferredVersions: {},
+            projectDir: opts.rootDir,
+        });
+        if (resolution?.resolution == null ||
+            !('integrity' in resolution.resolution) ||
+            typeof resolution.resolution.integrity !== 'string' ||
+            !resolution.resolution.integrity) {
+            throw new PnpmError('BAD_CONFIG_DEP', `Cannot resolve ${name}@${specifier} as a configuration dependency because it has no integrity`);
+        }
+        const version = resolution.manifest.version;
+        const registry = pickRegistryForPackage(opts.registries, name);
+        const pkgKey = `${name}@${version}`;
+        lockfileConfigDeps[name] = {
+            specifier,
+            version,
+        };
+        envLockfile.packages[pkgKey] = {
+            resolution: toLockfileResolution({ name, version }, resolution.resolution, registry),
+        };
+        envLockfile.snapshots[pkgKey] = {};
+    }));
+    pruneEnvLockfile(envLockfile);
+    await writeEnvLockfile(opts.rootDir, envLockfile);
+    await installConfigDeps(envLockfile, opts);
+}
+//# sourceMappingURL=resolveAndInstallConfigDeps.js.map

package/lib/resolveConfigDeps.d.ts

@@ -0,0 +1,10 @@
+import { type CreateFetchFromRegistryOptions } from '@pnpm/network.fetch';
+import { type ResolverFactoryOptions } from '@pnpm/resolving.npm-resolver';
+import type { ConfigDependencies } from '@pnpm/types';
+import { type InstallConfigDepsOpts } from './installConfigDeps.js';
+export type ResolveConfigDepsOpts = CreateFetchFromRegistryOptions & ResolverFactoryOptions & InstallConfigDepsOpts & {
+    configDependencies?: ConfigDependencies;
+    rootDir: string;
+    userConfig?: Record<string, string>;
+};
+export declare function resolveConfigDeps(configDeps: string[], opts: ResolveConfigDepsOpts): Promise<void>;

package/lib/resolveConfigDeps.js

@@ -0,0 +1,82 @@
+import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
+import { writeSettings } from '@pnpm/config.writer';
+import { PnpmError } from '@pnpm/error';
+import { createEnvLockfile, readEnvLockfile, writeEnvLockfile, } from '@pnpm/lockfile.fs';
+import { toLockfileResolution } from '@pnpm/lockfile.utils';
+import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
+import { createFetchFromRegistry } from '@pnpm/network.fetch';
+import { createNpmResolver } from '@pnpm/resolving.npm-resolver';
+import { parseWantedDependency } from '@pnpm/resolving.parse-wanted-dependency';
+import { installConfigDeps } from './installConfigDeps.js';
+export async function resolveConfigDeps(configDeps, opts) {
+    const fetch = createFetchFromRegistry(opts);
+    const getAuthHeader = createGetAuthHeaderByURI({ allSettings: opts.userConfig, userSettings: opts.userConfig });
+    const { resolveFromNpm } = createNpmResolver(fetch, getAuthHeader, opts);
+    // Extract existing specifiers from configDependencies (handles both old and new formats)
+    const configDependencySpecifiers = extractSpecifiers(opts.configDependencies);
+    const envLockfile = (await readEnvLockfile(opts.rootDir)) ?? createEnvLockfile();
+    await Promise.all(configDeps.map(async (configDep) => {
+        const wantedDep = parseWantedDependency(configDep);
+        if (!wantedDep.alias) {
+            throw new PnpmError('BAD_CONFIG_DEP', `Cannot install ${configDep} as configuration dependency`);
+        }
+        const resolution = await resolveFromNpm(wantedDep, {
+            lockfileDir: opts.rootDir,
+            preferredVersions: {},
+            projectDir: opts.rootDir,
+        });
+        if (resolution?.resolution == null || !('integrity' in resolution.resolution) || typeof resolution.resolution.integrity !== 'string' || !resolution.resolution.integrity) {
+            throw new PnpmError('BAD_CONFIG_DEP', `Cannot install ${configDep} as configuration dependency because it has no integrity`);
+        }
+        const pkgName = wantedDep.alias;
+        const version = resolution.manifest.version;
+        const registry = pickRegistryForPackage(opts.registries, pkgName);
+        // Write clean specifier to workspace manifest
+        configDependencySpecifiers[pkgName] = wantedDep.bareSpecifier ?? version;
+        // Write resolved info to env lockfile
+        const pkgKey = `${pkgName}@${version}`;
+        envLockfile.importers['.'].configDependencies[pkgName] = {
+            specifier: configDependencySpecifiers[pkgName],
+            version,
+        };
+        envLockfile.packages[pkgKey] = {
+            resolution: toLockfileResolution({ name: pkgName, version }, resolution.resolution, registry),
+        };
+        envLockfile.snapshots[pkgKey] = {};
+    }));
+    await Promise.all([
+        writeSettings({
+            ...opts,
+            rootProjectManifestDir: opts.rootDir,
+            workspaceDir: opts.rootDir,
+            updatedSettings: {
+                configDependencies: configDependencySpecifiers,
+            },
+        }),
+        writeEnvLockfile(opts.rootDir, envLockfile),
+    ]);
+    await installConfigDeps(envLockfile, opts);
+}
+/**
+ * Extracts plain specifiers from configDependencies, handling both old format
+ * ("version+integrity") and new format (plain specifiers).
+ */
+function extractSpecifiers(configDependencies) {
+    if (!configDependencies)
+        return {};
+    const specifiers = {};
+    for (const [name, value] of Object.entries(configDependencies)) {
+        if (typeof value === 'object') {
+            // Old format with tarball: extract version from integrity string
+            const sepIndex = value.integrity.indexOf('+');
+            specifiers[name] = sepIndex !== -1 ? value.integrity.substring(0, sepIndex) : value.integrity;
+        }
+        else {
+            // Could be old "version+integrity" or new plain specifier
+            const sepIndex = value.indexOf('+');
+            specifiers[name] = sepIndex !== -1 ? value.substring(0, sepIndex) : value;
+        }
+    }
+    return specifiers;
+}
+//# sourceMappingURL=resolveConfigDeps.js.map

package/lib/resolveManifestDependencies.d.ts

@@ -0,0 +1,17 @@
+import type { LockfileObject } from '@pnpm/lockfile.types';
+import type { StoreController } from '@pnpm/store.controller-types';
+import type { ProjectManifest, Registries } from '@pnpm/types';
+export interface ResolveManifestDependenciesOpts {
+    dir: string;
+    registries: Registries;
+    storeController: StoreController;
+    storeDir: string;
+}
+/**
+ * Resolves the dependencies of a manifest and returns the resulting lockfile
+ * without writing anything to disk.
+ *
+ * This is a lightweight wrapper around resolveDependencies for cases where
+ * you only need the lockfile output (e.g., resolving package manager integrities).
+ */
+export declare function resolveManifestDependencies(manifest: ProjectManifest, opts: ResolveManifestDependenciesOpts): Promise<LockfileObject>;

package/lib/resolveManifestDependencies.js

@@ -0,0 +1,61 @@
+import path from 'node:path';
+import { LOCKFILE_VERSION } from '@pnpm/constants';
+import { getWantedDependencies, resolveDependencies, } from '@pnpm/installing.deps-resolver';
+/**
+ * Resolves the dependencies of a manifest and returns the resulting lockfile
+ * without writing anything to disk.
+ *
+ * This is a lightweight wrapper around resolveDependencies for cases where
+ * you only need the lockfile output (e.g., resolving package manager integrities).
+ */
+export async function resolveManifestDependencies(manifest, opts) {
+    const dir = opts.dir;
+    const emptyLockfile = {
+        lockfileVersion: LOCKFILE_VERSION,
+        importers: {
+            ['.']: { specifiers: {} },
+        },
+    };
+    const wantedDependencies = getWantedDependencies(manifest)
+        .map((dep) => ({ ...dep, updateSpec: true }));
+    const { newLockfile, waitTillAllFetchingsFinish } = await resolveDependencies([
+        {
+            id: '.',
+            manifest,
+            modulesDir: path.join(opts.dir, 'node_modules'),
+            rootDir: dir,
+            wantedDependencies,
+            binsDir: path.join(opts.dir, 'node_modules', '.bin'),
+            updatePackageManifest: false,
+        },
+    ], {
+        allowedDeprecatedVersions: {},
+        allowUnusedPatches: true,
+        currentLockfile: emptyLockfile,
+        defaultUpdateDepth: 0,
+        dryRun: true,
+        engineStrict: false,
+        force: false,
+        forceFullResolution: true,
+        hooks: {},
+        lockfileDir: opts.dir,
+        nodeVersion: process.version,
+        pnpmVersion: '',
+        preferWorkspacePackages: false,
+        preserveWorkspaceProtocol: false,
+        registries: opts.registries,
+        saveWorkspaceProtocol: false,
+        storeController: opts.storeController,
+        tag: 'latest',
+        virtualStoreDir: path.join(opts.dir, 'node_modules', '.pnpm'),
+        globalVirtualStoreDir: path.join(opts.storeDir, 'links'),
+        virtualStoreDirMaxLength: 120,
+        wantedLockfile: emptyLockfile,
+        workspacePackages: new Map(),
+        peersSuffixMaxLength: 1000,
+        allProjectIds: ['.'],
+    });
+    await waitTillAllFetchingsFinish();
+    return newLockfile;
+}
+//# sourceMappingURL=resolveManifestDependencies.js.map

package/lib/resolvePackageManagerIntegrities.d.ts

@@ -0,0 +1,20 @@
+import type { EnvLockfile } from '@pnpm/lockfile.types';
+import type { StoreController } from '@pnpm/store.controller';
+import type { Registries } from '@pnpm/types';
+export interface ResolvePackageManagerIntegritiesOpts {
+    envLockfile?: EnvLockfile;
+    registries: Registries;
+    rootDir: string;
+    storeController: StoreController;
+    storeDir: string;
+}
+/**
+ * Checks if the wanted pnpm version integrities are already fully resolved in the env lockfile.
+ */
+export declare function isPackageManagerResolved(envLockfile: EnvLockfile | undefined, pnpmVersion: string): boolean;
+/**
+ * Resolves integrity checksums for `pnpm`, `@pnpm/exe`, and their dependencies
+ * by calling resolveManifestDependencies.
+ * Writes the results to the `packageManagerDependencies` section of pnpm-lock.yaml.
+ */
+export declare function resolvePackageManagerIntegrities(pnpmVersion: string, opts: ResolvePackageManagerIntegritiesOpts): Promise<EnvLockfile>;

package/lib/resolvePackageManagerIntegrities.js

@@ -0,0 +1,61 @@
+import { convertToLockfileFile, createEnvLockfile, readEnvLockfile, writeEnvLockfile } from '@pnpm/lockfile.fs';
+import { pruneSharedLockfile } from '@pnpm/lockfile.pruner';
+import { convertToLockfileEnvObject } from './pruneEnvLockfile.js';
+import { resolveManifestDependencies } from './resolveManifestDependencies.js';
+/**
+ * Checks if the wanted pnpm version integrities are already fully resolved in the env lockfile.
+ */
+export function isPackageManagerResolved(envLockfile, pnpmVersion) {
+    if (!envLockfile)
+        return false;
+    const pmDeps = envLockfile.importers['.'].packageManagerDependencies;
+    return pmDeps != null &&
+        pmDeps['pnpm']?.version === pnpmVersion &&
+        pmDeps['@pnpm/exe']?.version === pnpmVersion;
+}
+/**
+ * Resolves integrity checksums for `pnpm`, `@pnpm/exe`, and their dependencies
+ * by calling resolveManifestDependencies.
+ * Writes the results to the `packageManagerDependencies` section of pnpm-lock.yaml.
+ */
+export async function resolvePackageManagerIntegrities(pnpmVersion, opts) {
+    const envLockfile = opts.envLockfile ?? (await readEnvLockfile(opts.rootDir)) ?? createEnvLockfile();
+    if (isPackageManagerResolved(envLockfile, pnpmVersion)) {
+        return envLockfile;
+    }
+    const lockfile = await resolveManifestDependencies({
+        dependencies: {
+            'pnpm': pnpmVersion,
+            '@pnpm/exe': pnpmVersion,
+        },
+    }, {
+        dir: opts.rootDir,
+        registries: opts.registries,
+        storeController: opts.storeController,
+        storeDir: opts.storeDir,
+    });
+    if (lockfile.packages) {
+        // Build packageManagerDependencies from the resolved lockfile importers
+        const importer = lockfile.importers['.'];
+        const packageManagerDependencies = {};
+        for (const [name, version] of Object.entries(importer.dependencies ?? {})) {
+            packageManagerDependencies[name] = {
+                specifier: importer.specifiers[name],
+                version,
+            };
+        }
+        envLockfile.importers['.'].packageManagerDependencies = packageManagerDependencies;
+        // Merge new packages into the env lockfile object, then prune stale entries
+        const merged = convertToLockfileEnvObject(envLockfile);
+        for (const [depPath, pkg] of Object.entries(lockfile.packages)) {
+            merged.packages[depPath] = pkg;
+        }
+        const pruned = pruneSharedLockfile(merged);
+        const prunedFile = convertToLockfileFile(pruned);
+        envLockfile.packages = prunedFile.packages ?? {};
+        envLockfile.snapshots = prunedFile.snapshots ?? {};
+        await writeEnvLockfile(opts.rootDir, envLockfile);
+    }
+    return envLockfile;
+}
+//# sourceMappingURL=resolvePackageManagerIntegrities.js.map

package/package.json

@@ -0,0 +1,77 @@
+{
+  "name": "@pnpm/installing.env-installer",
+  "version": "1000.0.19",
+  "description": "Installer for configurational dependencies",
+  "keywords": [
+    "pnpm",
+    "pnpm11",
+    "config"
+  ],
+  "license": "MIT",
+  "funding": "https://opencollective.com/pnpm",
+  "repository": "https://github.com/pnpm/pnpm/tree/main/installing/env-installer",
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/installing/env-installer#readme",
+  "bugs": {
+    "url": "https://github.com/pnpm/pnpm/issues"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": "./lib/index.js"
+  },
+  "files": [
+    "lib",
+    "!*.map"
+  ],
+  "dependencies": {
+    "@zkochan/rimraf": "^4.0.0",
+    "get-npm-tarball-url": "^2.1.0",
+    "symlink-dir": "^7.0.0",
+    "@pnpm/config.writer": "1000.0.14",
+    "@pnpm/config.pick-registry-for-package": "1000.0.11",
+    "@pnpm/constants": "1001.3.1",
+    "@pnpm/core-loggers": "1001.0.4",
+    "@pnpm/error": "1000.0.5",
+    "@pnpm/installing.deps-resolver": "1008.3.1",
+    "@pnpm/deps.graph-hasher": "1002.0.8",
+    "@pnpm/fs.read-modules-dir": "1000.0.0",
+    "@pnpm/lockfile.fs": "1001.1.21",
+    "@pnpm/lockfile.pruner": "1001.0.17",
+    "@pnpm/lockfile.types": "1002.0.2",
+    "@pnpm/network.auth-header": "1000.0.6",
+    "@pnpm/lockfile.utils": "1003.0.3",
+    "@pnpm/network.fetch": "1000.2.6",
+    "@pnpm/pkg-manifest.reader": "1000.1.2",
+    "@pnpm/resolving.npm-resolver": "1004.4.1",
+    "@pnpm/resolving.parse-wanted-dependency": "1001.0.0",
+    "@pnpm/store.controller-types": "1004.1.0",
+    "@pnpm/store.controller": "1004.0.0",
+    "@pnpm/types": "1000.9.0"
+  },
+  "peerDependencies": {
+    "@pnpm/logger": ">=1001.0.0 <1002.0.0",
+    "@pnpm/worker": "^1000.3.0"
+  },
+  "devDependencies": {
+    "@pnpm/registry-mock": "5.2.4",
+    "load-json-file": "^7.0.1",
+    "read-yaml-file": "^3.0.0",
+    "@pnpm/installing.env-installer": "1000.0.19",
+    "@pnpm/testing.temp-store": "1000.0.23",
+    "@pnpm/prepare": "1000.0.4"
+  },
+  "engines": {
+    "node": ">=22.13"
+  },
+  "jest": {
+    "preset": "@pnpm/jest-config/with-registry"
+  },
+  "scripts": {
+    "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",
+    "_test": "cross-env NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest",
+    "test": "pnpm run compile && pnpm run _test",
+    "start": "tsgo --watch",
+    "compile": "tsgo --build && pnpm run lint --fix"
+  }
+}