@pnpm/napi 12.0.0-alpha.9 → 12.0.0-beta.1

package/CHANGELOG.md

@@ -0,0 +1,43 @@
+# @pnpm/napi
+
+## 12.0.0-beta.1
+
+### Minor Changes
+
+- Added the `trustLockfile` install option to skip verifying lockfile resolutions against current registry metadata.
+
+### Patch Changes
+
+- Fixed repeat installs ignoring changes in caller-supplied in-memory project manifests.
+
+## 12.0.0-beta.0
+
+## 12.0.0-alpha.21
+
+## 12.0.0-alpha.20
+
+## 12.0.0-alpha.19
+
+## 12.0.0-alpha.18
+
+## 12.0.0-alpha.17
+
+## 12.0.0-alpha.16
+
+## 12.0.0-alpha.15
+
+### Minor Changes
+
+- Added `pnpm licenses` command to the Rust pacquet port to list package licenses in a tabular or JSON format.
+
+## 12.0.0-alpha.14
+
+## 12.0.0-alpha.13
+
+## 12.0.0-alpha.12
+
+## 12.0.0-alpha.11
+
+## 12.0.0-alpha.10
+
+## 12.0.0-alpha.9

package/README.md

@@ -30,7 +30,10 @@ structured envelope.
 
 Auth: pass `authHeaderByUri` — a map of nerf-darted registry URI → `Authorization`
 header value (with `""` for the default registry). The host resolves these from
-its `.npmrc` credentials; the engine applies them as-is.
+its `.npmrc` credentials; the engine applies them as-is. The `""` entry is
+pinned to the `registry` / `registries.default` passed alongside it (npmjs when
+neither is given), so a `registry=` in the project's own `.npmrc` cannot
+redirect that credential to another host.
 
 ## Distribution
 

package/index.d.ts

@@ -30,6 +30,15 @@ export interface NodeApiProject {
   rootDir: string
   /** In-memory manifest; the engine never reads package.json from disk for listed projects. */
   manifest: PackageManifest
+  /**
+   * Manifest used when this project is resolved as a *dependency* of another
+   * importer (an injected workspace instance) instead of `manifest`. Lets a
+   * host pre-transform its importer manifests (e.g. strip workspace-sibling
+   * deps it links itself) while dependency instances keep the raw graph —
+   * without a `readPackage` hook round trip. Omit when both views are the
+   * same.
+   */
+  dependencyManifest?: PackageManifest
 }
 
 export interface ProxyConfig {
@@ -85,6 +94,9 @@ export interface SharedEngineOptions {
    * URI (`//host/path/`), plus `''` for the default registry — e.g.
    * `{ '': 'Bearer abc', '//npm.example.com/': 'Basic <base64(user:pass)>' }`. The
    * host resolves these from its `authConfig`; the engine applies them as-is.
+   * The `''` entry is pinned to the `registry` / `registries.default` passed
+   * alongside it (npmjs when neither is given), so a `registry=` in the
+   * project's own `.npmrc` cannot redirect that credential to another host.
    */
   authHeaderByUri?: Record<string, string>
   proxyConfig?: ProxyConfig
@@ -122,6 +134,13 @@ export interface InstallOptions extends SharedEngineOptions {
   virtualStoreDirMaxLength?: number
   peersSuffixMaxLength?: number
   dedupePeerDependents?: boolean
+  /**
+   * Render every resolved-peer slot in depPath suffixes as `name@version`
+   * instead of the peer's own depPath (the `dedupePeers` setting). Must match
+   * the value the existing lockfile was generated with, or the install
+   * re-resolves from scratch.
+   */
+  dedupePeers?: boolean
   dedupeDirectDeps?: boolean
   dedupeInjectedDeps?: boolean
   resolvePeersFromWorkspaceRoot?: boolean
@@ -131,6 +150,11 @@ export interface InstallOptions extends SharedEngineOptions {
   minimumReleaseAgeExclude?: string[]
   includeOptionalDeps?: boolean
   ignoreScripts?: boolean
+  /**
+   * Trust lockfile resolutions without verifying them against current registry
+   * metadata.
+   */
+  trustLockfile?: boolean
   /**
    * Re-resolve the whole dependency graph to the highest in-range version
    * (pnpm's `update: true` / `depth: Infinity`). The binding takes no package

package/index.js

@@ -166,4 +166,37 @@ function wrapExports(binding) {
   return wrapped
 }
 
-module.exports = wrapExports(loadBinding())
+// The engine dispatches the readPackage hook through a threadsafe function,
+// which costs roughly one event-loop tick per call — tens of thousands of
+// per-manifest calls serialize a large resolution behind the JS event loop.
+// Synthesize the batch form of the consumer's per-manifest hook so the native
+// side can serve a whole batch per call. The extra argument is ignored by
+// binaries that predate the batch contract, and a batch-aware binary falls
+// back to per-manifest dispatch when the wrapper is older than it.
+function withBatchedReadPackageHook(exports) {
+  const nativeInstall = exports.install
+  if (typeof nativeInstall !== 'function') return exports
+  exports.install = function (options, onLog, readPackageHook, ...rest) {
+    const batchHook = typeof readPackageHook === 'function'
+      ? (manifests, resolvedDirs) => {
+        // Guard against a binary that invokes the batch hook without the
+        // dirs array (version skew): treat every entry as a non-directory
+        // resolution rather than throwing.
+        const dirs = Array.isArray(resolvedDirs) ? resolvedDirs : []
+        return manifests.map((manifest, i) => {
+          const transformed = readPackageHook(manifest, dirs[i] == null ? undefined : dirs[i])
+          // The engine cannot await the hook: a returned promise would be
+          // serialized as an empty manifest and silently corrupt resolution.
+          if (transformed && typeof transformed.then === 'function') {
+            throw new TypeError('readPackageHook must be synchronous and return the manifest, not a promise')
+          }
+          return transformed
+        })
+      }
+      : undefined
+    return nativeInstall.call(this, options, onLog, readPackageHook, batchHook, ...rest)
+  }
+  return exports
+}
+
+module.exports = withBatchedReadPackageHook(wrapExports(loadBinding()))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/napi",
-  "version": "12.0.0-alpha.9",
+  "version": "12.0.0-beta.1",
   "description": "Node.js addon bindings for the pnpm v12 Rust engine (pacquet)",
   "keywords": [
     "pnpm",
@@ -27,14 +27,14 @@
     "README.md"
   ],
   "optionalDependencies": {
-    "@pnpm/napi.win32-x64": "12.0.0-alpha.9",
-    "@pnpm/napi.win32-arm64": "12.0.0-alpha.9",
-    "@pnpm/napi.darwin-x64": "12.0.0-alpha.9",
-    "@pnpm/napi.darwin-arm64": "12.0.0-alpha.9",
-    "@pnpm/napi.linux-x64": "12.0.0-alpha.9",
-    "@pnpm/napi.linux-arm64": "12.0.0-alpha.9",
-    "@pnpm/napi.linux-x64-musl": "12.0.0-alpha.9",
-    "@pnpm/napi.linux-arm64-musl": "12.0.0-alpha.9"
+    "@pnpm/napi.win32-x64": "12.0.0-beta.1",
+    "@pnpm/napi.win32-arm64": "12.0.0-beta.1",
+    "@pnpm/napi.darwin-x64": "12.0.0-beta.1",
+    "@pnpm/napi.darwin-arm64": "12.0.0-beta.1",
+    "@pnpm/napi.linux-x64": "12.0.0-beta.1",
+    "@pnpm/napi.linux-arm64": "12.0.0-beta.1",
+    "@pnpm/napi.linux-x64-musl": "12.0.0-beta.1",
+    "@pnpm/napi.linux-arm64-musl": "12.0.0-beta.1"
   },
   "scripts": {
     "generate-packages": "node scripts/generate-packages.mjs"