@pnpm/napi 12.0.0-beta.0 → 12.0.0-beta.2

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @pnpm/napi
 
+## 12.0.0-beta.2
+
+### Minor Changes
+
+- Added `readConfig(options)`: resolves the configuration the engine's own installs use — registries with their resolved `Authorization` headers, `authHeaderByUri`, proxy, TLS, network limits, store/cache directories, and install behavior settings from the `.npmrc` / `pnpm-workspace.yaml` cascade — so hosts that embed the engine no longer need a JavaScript config reader.
+
+## 12.0.0-beta.1
+
+### Minor Changes
+
+- Added the `trustLockfile` install option to skip verifying lockfile resolutions against current registry metadata.
+
+### Patch Changes
+
+- Fixed repeat installs ignoring changes in caller-supplied in-memory project manifests.
+
 ## 12.0.0-beta.0
 
 ## 12.0.0-alpha.21

package/index.d.ts

@@ -30,6 +30,15 @@ export interface NodeApiProject {
   rootDir: string
   /** In-memory manifest; the engine never reads package.json from disk for listed projects. */
   manifest: PackageManifest
+  /**
+   * Manifest used when this project is resolved as a *dependency* of another
+   * importer (an injected workspace instance) instead of `manifest`. Lets a
+   * host pre-transform its importer manifests (e.g. strip workspace-sibling
+   * deps it links itself) while dependency instances keep the raw graph —
+   * without a `readPackage` hook round trip. Omit when both views are the
+   * same.
+   */
+  dependencyManifest?: PackageManifest
 }
 
 export interface ProxyConfig {
@@ -125,6 +134,13 @@ export interface InstallOptions extends SharedEngineOptions {
   virtualStoreDirMaxLength?: number
   peersSuffixMaxLength?: number
   dedupePeerDependents?: boolean
+  /**
+   * Render every resolved-peer slot in depPath suffixes as `name@version`
+   * instead of the peer's own depPath (the `dedupePeers` setting). Must match
+   * the value the existing lockfile was generated with, or the install
+   * re-resolves from scratch.
+   */
+  dedupePeers?: boolean
   dedupeDirectDeps?: boolean
   dedupeInjectedDeps?: boolean
   resolvePeersFromWorkspaceRoot?: boolean
@@ -134,6 +150,11 @@ export interface InstallOptions extends SharedEngineOptions {
   minimumReleaseAgeExclude?: string[]
   includeOptionalDeps?: boolean
   ignoreScripts?: boolean
+  /**
+   * Trust lockfile resolutions without verifying them against current registry
+   * metadata.
+   */
+  trustLockfile?: boolean
   /**
    * Re-resolve the whole dependency graph to the highest in-range version
    * (pnpm's `update: true` / `depth: Infinity`). The binding takes no package
@@ -308,5 +329,85 @@ export interface ParsedBareSpecifier {
 /** Parses/validates a dependency specifier. Returns null for unparsable input. */
 export function parseBareSpecifier(spec: string, alias?: string): ParsedBareSpecifier | null
 
+export interface ReadConfigOptions {
+  /**
+   * Directory whose config cascade to resolve — its `.npmrc`, the enclosing
+   * workspace's `pnpm-workspace.yaml` and `.npmrc`, the user and global
+   * config files, and `npm_config_*` environment variables.
+   */
+  dir: string
+}
+
+/** One configured registry: the `default` entry plus one per `@scope`. */
+export interface ResolvedRegistry {
+  /** `"default"` or the package scope (`"@teambit"`). */
+  name: string
+  url: string
+  /**
+   * Ready-to-send `Authorization` header for this registry, when the config
+   * carries a static credential for it. `tokenHelper` credentials are not
+   * executed here and yield no header.
+   */
+  authHeader?: string
+}
+
+export interface ResolvedConfig {
+  registries: ResolvedRegistry[]
+  /**
+   * Static `Authorization` headers keyed by nerf-darted registry URI
+   * (`//host[:port]/path/`) — the shape `install`'s `authHeaderByUri`
+   * accepts.
+   */
+  authHeaderByUri: Record<string, string>
+  httpProxy?: string
+  httpsProxy?: string
+  /** `true` (bypass every proxy) or a comma-separated host list. */
+  noProxy?: boolean | string
+  /** PEM-encoded CA certificates (`ca` / `cafile` already merged). */
+  ca?: string[]
+  cert?: string
+  key?: string
+  strictSsl?: boolean
+  storeDir: string
+  cacheDir: string
+  virtualStoreDirMaxLength: number
+  networkConcurrency: number
+  maxSockets?: number
+  fetchRetries: number
+  fetchRetryFactor: number
+  fetchRetryMintimeout: number
+  fetchRetryMaxtimeout: number
+  fetchTimeout: number
+  /**
+   * The explicitly configured user agent, when the cascade set one. The
+   * engine's own computed default is omitted — an embedder that passes
+   * nothing back to `install` gets that same default.
+   */
+  userAgent?: string
+  engineStrict: boolean
+  nodeVersion?: string
+  /** `"auto"` / `"hardlink"` / `"copy"` / `"clone"` / `"clone-or-copy"`. */
+  packageImportMethod: string
+  hoistPattern?: string[]
+  publicHoistPattern?: string[]
+  /**
+   * The legacy `shamefullyHoist` flag; `publicHoistPattern` already
+   * reflects it, exposed for embedders that branch on the flag itself.
+   */
+  shamefullyHoist: boolean
+  /**
+   * The engine's pnpm home directory (`PNPM_HOME` or the platform default) —
+   * not a per-project setting. Absent when no home directory is resolvable.
+   */
+  pnpmHomeDir?: string
+}
+
+/**
+ * Resolve the configuration the engine's own installs use — registries,
+ * credentials, proxy, TLS, and network settings from the `.npmrc` cascade —
+ * so the embedder needs no JavaScript config reader.
+ */
+export function readConfig(options: ReadConfigOptions): ResolvedConfig
+
 /** Version of the underlying Rust engine (pacquet). */
 export function engineVersion(): string

package/index.js

@@ -166,4 +166,37 @@ function wrapExports(binding) {
   return wrapped
 }
 
-module.exports = wrapExports(loadBinding())
+// The engine dispatches the readPackage hook through a threadsafe function,
+// which costs roughly one event-loop tick per call — tens of thousands of
+// per-manifest calls serialize a large resolution behind the JS event loop.
+// Synthesize the batch form of the consumer's per-manifest hook so the native
+// side can serve a whole batch per call. The extra argument is ignored by
+// binaries that predate the batch contract, and a batch-aware binary falls
+// back to per-manifest dispatch when the wrapper is older than it.
+function withBatchedReadPackageHook(exports) {
+  const nativeInstall = exports.install
+  if (typeof nativeInstall !== 'function') return exports
+  exports.install = function (options, onLog, readPackageHook, ...rest) {
+    const batchHook = typeof readPackageHook === 'function'
+      ? (manifests, resolvedDirs) => {
+        // Guard against a binary that invokes the batch hook without the
+        // dirs array (version skew): treat every entry as a non-directory
+        // resolution rather than throwing.
+        const dirs = Array.isArray(resolvedDirs) ? resolvedDirs : []
+        return manifests.map((manifest, i) => {
+          const transformed = readPackageHook(manifest, dirs[i] == null ? undefined : dirs[i])
+          // The engine cannot await the hook: a returned promise would be
+          // serialized as an empty manifest and silently corrupt resolution.
+          if (transformed && typeof transformed.then === 'function') {
+            throw new TypeError('readPackageHook must be synchronous and return the manifest, not a promise')
+          }
+          return transformed
+        })
+      }
+      : undefined
+    return nativeInstall.call(this, options, onLog, readPackageHook, batchHook, ...rest)
+  }
+  return exports
+}
+
+module.exports = withBatchedReadPackageHook(wrapExports(loadBinding()))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/napi",
-  "version": "12.0.0-beta.0",
+  "version": "12.0.0-beta.2",
   "description": "Node.js addon bindings for the pnpm v12 Rust engine (pacquet)",
   "keywords": [
     "pnpm",
@@ -27,14 +27,14 @@
     "README.md"
   ],
   "optionalDependencies": {
-    "@pnpm/napi.win32-x64": "12.0.0-beta.0",
-    "@pnpm/napi.win32-arm64": "12.0.0-beta.0",
-    "@pnpm/napi.darwin-x64": "12.0.0-beta.0",
-    "@pnpm/napi.darwin-arm64": "12.0.0-beta.0",
-    "@pnpm/napi.linux-x64": "12.0.0-beta.0",
-    "@pnpm/napi.linux-arm64": "12.0.0-beta.0",
-    "@pnpm/napi.linux-x64-musl": "12.0.0-beta.0",
-    "@pnpm/napi.linux-arm64-musl": "12.0.0-beta.0"
+    "@pnpm/napi.win32-x64": "12.0.0-beta.2",
+    "@pnpm/napi.win32-arm64": "12.0.0-beta.2",
+    "@pnpm/napi.darwin-x64": "12.0.0-beta.2",
+    "@pnpm/napi.darwin-arm64": "12.0.0-beta.2",
+    "@pnpm/napi.linux-x64": "12.0.0-beta.2",
+    "@pnpm/napi.linux-arm64": "12.0.0-beta.2",
+    "@pnpm/napi.linux-x64-musl": "12.0.0-beta.2",
+    "@pnpm/napi.linux-arm64-musl": "12.0.0-beta.2"
   },
   "scripts": {
     "generate-packages": "node scripts/generate-packages.mjs"