@pnpm/pnpr.client 1.1.0 → 1.2.0

package/README.md

@@ -1,15 +1,14 @@
 # @pnpm/pnpr.client
 
-Client library for the pnpr server. Reads the local store state, sends it to the server, and writes the received files into the content-addressable store.
+Client library for the pnpr server. Resolves a project's dependencies server-side and returns the resolved lockfile.
 
 ## How it works
 
-1. Reads integrity hashes from the local store index (`index.db`).
-2. Sends `POST /v1/install` to the pnpr server with the project's dependencies and the store integrities.
-3. Parses the NDJSON streaming response — `D`-lines (missing file digests) are dispatched to worker downloads against `/v1/files`, `I`-lines are buffered as raw store-index entries, and the final `L`-line yields the resolved lockfile and stats.
-4. File download workers write each received file directly to the local CAFS (`files/{hash[:2]}/{hash[2:]}`).
-5. Writes store index entries for all new packages in a single SQLite transaction.
-6. Returns the resolved lockfile for use with pnpm's headless install (linking phase).
+1. Sends `POST /v1/install` to the pnpr server with the project's dependencies (and the existing lockfile, if any, for incremental resolution).
+2. The server resolves against the client's registries, verifies the input lockfile under the client's policy, and answers with one gzipped JSON object carrying the resolved lockfile and stats.
+3. Returns the resolved lockfile for use with pnpm's headless install, which fetches every tarball directly from the registries in parallel — like a normal install. See [pnpm/pnpm#12230](https://github.com/pnpm/pnpm/issues/12230).
+
+pnpr is a stateless resolver: it stores no tarballs and serves no file content.
 
 ## Usage
 
@@ -17,20 +16,14 @@ This package is used internally by pnpm when the `pnprServer` config option is s
 
 ```typescript
 import { fetchFromPnpmRegistry } from '@pnpm/pnpr.client'
-import { StoreIndex } from '@pnpm/store.index'
-
-const storeIndex = new StoreIndex('/path/to/store')
 
 const { lockfile, stats } = await fetchFromPnpmRegistry({
   registryUrl: 'http://localhost:4000',
-  storeDir: '/path/to/store',
-  storeIndex,
   dependencies: { react: '^19.0.0' },
   devDependencies: { typescript: '^5.0.0' },
 })
 
 console.log(`Resolved ${stats.totalPackages} packages`)
-console.log(`${stats.alreadyInStore} cached, ${stats.filesToDownload} files downloaded`)
 // lockfile is ready for headless install
 ```
 

package/lib/index.d.ts

@@ -1,2 +1,2 @@
-export { fetchFromPnpmRegistry, type FetchFromPnpmRegistryOptions, type FetchFromPnpmRegistryResult, writeRawIndexEntries } from './fetchFromPnpmRegistry.js';
 export { type ResponseMetadata } from './protocol.js';
+export { resolveViaPnprServer, type ResolveViaPnprServerOptions, type ResolveViaPnprServerResult } from './resolveViaPnprServer.js';

package/lib/index.js

@@ -1,3 +1,3 @@
-export { fetchFromPnpmRegistry, writeRawIndexEntries } from './fetchFromPnpmRegistry.js';
 export {} from './protocol.js';
+export { resolveViaPnprServer } from './resolveViaPnprServer.js';
 //# sourceMappingURL=index.js.map

package/lib/protocol.d.ts

@@ -3,11 +3,5 @@ export interface ResponseMetadata {
     lockfile: LockfileObject;
     stats: {
         totalPackages: number;
-        alreadyInStore: number;
-        packagesToFetch: number;
-        filesInNewPackages: number;
-        filesAlreadyInCafs: number;
-        filesToDownload: number;
-        downloadBytes: number;
     };
 }

package/lib/{fetchFromPnpmRegistry.d.ts → resolveViaPnprServer.d.ts}

@@ -1,5 +1,4 @@
 import type { LockfileFile, LockfileObject } from '@pnpm/lockfile.types';
-import { StoreIndex } from '@pnpm/store.index';
 import type { ResponseMetadata } from './protocol.js';
 export interface PnprProject {
     /** Relative dir within the workspace (e.g. "." or "packages/foo") */
@@ -8,13 +7,9 @@ export interface PnprProject {
     devDependencies?: Record<string, string>;
     optionalDependencies?: Record<string, string>;
 }
-export interface FetchFromPnpmRegistryOptions {
+export interface ResolveViaPnprServerOptions {
     /** URL of the pnpr server */
     registryUrl: string;
-    /** Client's store directory */
-    storeDir: string;
-    /** Client's store index */
-    storeIndex: StoreIndex;
     /** Dependencies to resolve (single project) */
     dependencies?: Record<string, string>;
     /** Dev dependencies to resolve (single project) */
@@ -32,13 +27,13 @@ export interface FetchFromPnpmRegistryOptions {
     namedRegistries?: Record<string, string>;
     /**
      * The caller's forwarded upstream credentials, keyed by nerf-darted
-     * registry URI, so the server resolves/fetches private content as the
+     * registry URI, so the server resolves private content as the
      * caller. Distinct from `authorization` (pnpr identity).
      */
     authHeaders?: Record<string, string>;
     /**
      * `Authorization` for the pnpr server's own URL (`undefined` if none):
-     * identifies the caller to pnpr's gate and keys the grant table.
+     * identifies the caller to pnpr's gate.
      */
     authorization?: string;
     /** Overrides */
@@ -53,37 +48,20 @@ export interface FetchFromPnpmRegistryOptions {
      * `readWantedLockfileFile` so no in-memory→on-disk round-trip is needed.
      */
     lockfile?: LockfileFile;
-    /**
-     * `--lockfile-only`: resolve and return only the lockfile — fetch no
-     * files into the local store. Forwarded to the server (which skips the
-     * file diff); the client ignores the (empty) file payload so the store
-     * stays untouched. Mirrors pnpm's resolve + write, fetch nothing, link
-     * nothing. See https://github.com/pnpm/pnpm/issues/12146.
-     */
-    lockfileOnly?: boolean;
 }
-export interface FetchFromPnpmRegistryResult {
+export interface ResolveViaPnprServerResult {
     lockfile: LockfileObject;
     stats: ResponseMetadata['stats'];
-    /** Promise that resolves when all file downloads are written to CAFS */
-    fileDownloads: Promise<void>;
-    /** Pre-packed store index entries to write to SQLite */
-    indexEntries: Array<{
-        key: string;
-        buffer: Uint8Array;
-    }>;
 }
 /**
- * Fetch resolved dependencies from a pnpr server in a single round trip.
+ * Resolve a project against a pnpr server and return the resolved
+ * lockfile.
  *
- * `POST /v1/install` (with `inlineFiles`) answers with one gzipped binary
- * body: a length-prefixed JSON header (lockfile, stats, store-index
- * entries, or verification violations) followed by the missing files'
- * contents as binary frames. We parse the header here and hand the file
- * frames to a worker that writes them straight into the CAFS.
+ * `POST /v1/resolve` answers with an `application/x-ndjson` stream: one
+ * `package` frame per resolved tarball as the server's tree walk yields
+ * it, then exactly one terminal frame — `done` (full lockfile + stats),
+ * `error`, or `violations`. pnpr serves no file content — the caller
+ * fetches every tarball itself, in parallel, like a normal install
+ * ([pnpm/pnpm#12230](https://github.com/pnpm/pnpm/issues/12230)).
  */
-export declare function fetchFromPnpmRegistry(opts: FetchFromPnpmRegistryOptions): Promise<FetchFromPnpmRegistryResult>;
-export declare function writeRawIndexEntries(indexEntries: Array<{
-    key: string;
-    buffer: Uint8Array;
-}>, storeIndex: StoreIndex): void;
+export declare function resolveViaPnprServer(opts: ResolveViaPnprServerOptions): Promise<ResolveViaPnprServerResult>;

package/lib/{fetchFromPnpmRegistry.js → resolveViaPnprServer.js}

@@ -3,19 +3,18 @@ import https from 'node:https';
 import { URL } from 'node:url';
 import { gunzip } from 'node:zlib';
 import { convertToLockfileObject } from '@pnpm/lockfile.fs';
-import { StoreIndex } from '@pnpm/store.index';
-import { writeCafsFiles } from '@pnpm/worker';
 /**
- * Fetch resolved dependencies from a pnpr server in a single round trip.
+ * Resolve a project against a pnpr server and return the resolved
+ * lockfile.
  *
- * `POST /v1/install` (with `inlineFiles`) answers with one gzipped binary
- * body: a length-prefixed JSON header (lockfile, stats, store-index
- * entries, or verification violations) followed by the missing files'
- * contents as binary frames. We parse the header here and hand the file
- * frames to a worker that writes them straight into the CAFS.
+ * `POST /v1/resolve` answers with an `application/x-ndjson` stream: one
+ * `package` frame per resolved tarball as the server's tree walk yields
+ * it, then exactly one terminal frame — `done` (full lockfile + stats),
+ * `error`, or `violations`. pnpr serves no file content — the caller
+ * fetches every tarball itself, in parallel, like a normal install
+ * ([pnpm/pnpm#12230](https://github.com/pnpm/pnpm/issues/12230)).
  */
-export async function fetchFromPnpmRegistry(opts) {
-    const storeIntegrities = readStoreIntegrities(opts.storeIndex);
+export async function resolveViaPnprServer(opts) {
     const projects = opts.projects ?? [{
             dir: '.',
             dependencies: opts.dependencies,
@@ -36,85 +35,66 @@ export async function fetchFromPnpmRegistry(opts) {
         // protocol carries (split `packages`/`snapshots`, `{ specifier, version }`
         // importer deps).
         lockfile: opts.lockfile,
-        lockfileOnly: opts.lockfileOnly,
-        storeIntegrities,
-        inlineFiles: true,
     });
-    const body = await postInstall(opts.registryUrl, requestBody, opts.authorization);
-    // The combined response is `[u32 header length][header JSON][file frames]`.
-    if (body.length < 4) {
-        throw new Error('pnpr server returned a truncated /v1/install response');
+    const body = await postResolve(opts.registryUrl, requestBody, opts.authorization);
+    const terminal = parseTerminalFrame(body.toString('utf-8'));
+    if (terminal.type === 'error') {
+        throw new Error(terminal.message);
     }
-    const headerLength = body.readUInt32BE(0);
-    const header = JSON.parse(body.subarray(4, 4 + headerLength).toString('utf-8'));
-    if (header.violations != null && header.violations.length > 0) {
-        const rendered = header.violations
+    if (terminal.type === 'violations') {
+        const rendered = terminal.violations
             .map((violation) => `  ${violation.name}@${violation.version}: ${violation.reason}`)
             .join('\n');
         throw new Error(`pnpr server rejected the lockfile under the verification policy:\n${rendered}`);
     }
-    const indexEntries = (header.indexEntries ?? []).map(({ key, b64 }) => ({
-        key,
-        buffer: new Uint8Array(Buffer.from(b64, 'base64')),
-    }));
-    // `--lockfile-only` fetches nothing: there are no file frames to write
-    // (the server sends only the end-of-stream marker), so leave the store
-    // untouched.
-    const fileDownloads = opts.lockfileOnly
-        ? Promise.resolve()
-        : writeCafsFiles({
-            storeDir: opts.storeDir,
-            payload: body.subarray(4 + headerLength),
-        }).then(() => { });
     return {
         // The server speaks the on-disk lockfile format; convert it to the
         // in-memory `LockfileObject` the rest of pnpm consumes.
-        lockfile: convertToLockfileObject(header.lockfile),
-        stats: header.stats,
-        fileDownloads,
-        indexEntries,
+        lockfile: convertToLockfileObject(terminal.lockfile),
+        stats: terminal.stats,
     };
 }
-function readStoreIntegrities(storeIndex) {
-    const seen = new Set();
-    for (const key of storeIndex.keys()) {
-        const tabIdx = key.indexOf('\t');
-        if (tabIdx === -1)
+/**
+ * Parse the NDJSON `/v1/resolve` body and return its single terminal
+ * frame. `package` frames are skipped — this client fetches tarballs the
+ * normal way after resolution rather than overlapping fetch with the
+ * stream. Throws on an unknown frame type (so a protocol mismatch fails
+ * fast here rather than as a confusing lockfile error downstream) or if
+ * the stream carries no terminal frame.
+ */
+function parseTerminalFrame(body) {
+    for (const line of body.split('\n')) {
+        if (line.trim() === '')
             continue;
-        const integrity = key.slice(0, tabIdx);
-        // StoreIndex also stores non-integrity keys (e.g. git-hosted entries
-        // keyed by URL). Filter to actual SRI hashes — sending those over to
-        // the pnpr server would just bloat the request without ever matching.
-        if (!isIntegrityLike(integrity))
+        const frame = JSON.parse(line);
+        if (frame.type === 'package')
             continue;
-        seen.add(integrity);
+        if (frame.type === 'done' || frame.type === 'error' || frame.type === 'violations') {
+            return frame;
+        }
+        throw new Error(`pnpr server /v1/resolve stream emitted an unknown frame type: ${String(frame.type)}`);
     }
-    return [...seen];
-}
-function isIntegrityLike(value) {
-    return value.startsWith('sha512-') ||
-        value.startsWith('sha256-') ||
-        value.startsWith('sha1-');
+    throw new Error('pnpr server /v1/resolve stream ended without a terminal frame');
 }
 const REQUEST_TIMEOUT = 600_000; // 10 minutes — server-side resolution can be slow on first run
 /**
- * `POST /v1/install` and return the full response body, decompressed.
+ * `POST /v1/resolve` and return the full response body, decompressed.
  *
  * `urlPath` resolution normalizes the base to end with "/" so a path
  * prefix configured on the pnpr server URL (e.g. https://host/pnpr/) is
  * preserved.
  */
-async function postInstall(registryUrl, body, authorization) {
+async function postResolve(registryUrl, body, authorization) {
     const base = registryUrl.endsWith('/') ? registryUrl : `${registryUrl}/`;
-    const url = new URL('v1/install', base);
+    const url = new URL('v1/resolve', base);
     const requestFn = url.protocol === 'https:' ? https.request : http.request;
     const headers = {
         'Content-Type': 'application/json',
         'Content-Length': Buffer.byteLength(body),
         'Accept-Encoding': 'gzip',
     };
-    // Identify the caller to the pnpr server's access gate so protected
-    // packages resolve and the per-user grant table keys on the right user.
+    // Identify the caller to the pnpr server so private packages resolve
+    // with the right credentials.
     if (authorization != null) {
         headers.Authorization = authorization;
     }
@@ -170,10 +150,4 @@ async function postInstall(registryUrl, body, authorization) {
         req.end();
     });
 }
-export function writeRawIndexEntries(indexEntries, storeIndex) {
-    const writes = indexEntries.filter(({ key }) => !storeIndex.has(key));
-    if (writes.length > 0) {
-        storeIndex.setRawMany(writes);
-    }
-}
-//# sourceMappingURL=fetchFromPnpmRegistry.js.map
+//# sourceMappingURL=resolveViaPnprServer.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@pnpm/pnpr.client",
-  "version": "1.1.0",
-  "description": "Client for the pnpr server — sends store state, receives resolved lockfile and missing files",
+  "version": "1.2.0",
+  "description": "Client for the pnpr server — resolves a project server-side and receives the resolved lockfile",
   "keywords": [
     "pnpm",
     "pnpm11"
@@ -27,18 +27,12 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/store.index": "1100.1.0",
-    "@pnpm/lockfile.fs": "1100.1.3",
-    "@pnpm/store.cafs": "1100.1.8",
-    "@pnpm/lockfile.types": "1100.0.9"
-  },
-  "peerDependencies": {
-    "@pnpm/logger": "^1001.0.1",
-    "@pnpm/worker": "^1100.1.9"
+    "@pnpm/lockfile.fs": "1100.1.4",
+    "@pnpm/lockfile.types": "1100.0.10"
   },
   "devDependencies": {
-    "@pnpm/types": "1101.3.0",
-    "@pnpm/pnpr.client": "1.1.0"
+    "@pnpm/types": "1101.3.1",
+    "@pnpm/pnpr.client": "1.2.0"
   },
   "engines": {
     "node": ">=22.13"