@pnpm/pnpr 0.0.0-26070301 → 0.1.0-alpha.10

package/CHANGELOG.md

@@ -0,0 +1,118 @@
+# @pnpm/pnpr
+
+## 0.1.0-alpha.10
+
+### Patch Changes
+
+- A shared build artifact publication that cannot unregister itself no longer stops the registry reclaiming space or refusing further publications. A publication says at intervals that it is still working, and a registration that has gone quiet for an hour is written off, so a publication whose bookkeeping write failed stops holding back the collector that reclaims unreferenced blobs and returns the compatibility scopes a failed publication claimed, and stops counting toward the limit on publications in flight.
+
+## 0.1.0-alpha.9
+
+### Minor Changes
+
+- Made the signed shared-artifact cache horizontally scalable with S3-compatible storage and an independent top-level `artifacts` feature toggle.
+
+- Generalized the experimental shared-artifact protocol so candidates and signed payloads identify a discriminated subject. Dependency side effects use package and source-integrity subjects, while workspace tasks use project and task subjects.
+
+  This changes shared-artifact request bodies and signed payloads. A pnpr server and its clients have to be on matching versions.
+
+### Patch Changes
+
+- A published build artifact is now immutable: one input key and one set of compatibility constraints admit one artifact, so publishing a different one over it answers `409 Conflict`, the same as a re-published `name@version`. Republishing the identical artifact still succeeds. Artifacts already stored by an earlier version keep their slot, so upgrading a populated registry does not leave them replaceable.
+
+- A published build artifact is now immutable for every consumer it can reach, not only for the exact compatibility constraints it declares. Publishing an artifact that reaches a machine an existing one already reaches answers `409 Conflict`, so a later universal, broader, or higher-floor build can no longer take precedence over the artifact a consumer already receives. Publishing across a platform matrix is unaffected: artifacts for different operating systems, architectures, or Node majors reach no machine in common and coexist as before.
+
+- pnpr reclaims unreferenced shared artifact blobs after ambiguous object-storage write failures once active publications drain.
+
+- Recognize `pnpm install --fix-lockfile`, including filtered installs, and regenerate broken lockfile metadata while preserving compatible locked versions [pnpm/pnpm#14250](https://github.com/pnpm/pnpm/issues/14250).
+
+- pnpr retains shared artifact quota after object storage reports an ambiguous write failure.
+
+## 0.1.0-alpha.8
+
+### Minor Changes
+
+- Added an opt-in proof of concept that lets installs reuse a dependency's build output across machines, by publishing and restoring signed, organization-scoped artifacts through pnpr instead of running the lifecycle scripts locally.
+
+  Configure it with the new `remoteSideEffectsCache` setting. A workspace names the eligible `organization` and `packages`; everything describing the act of signing — `publish`, `keyId`, `builderId`, `trustedKeys`, `privateKey` and the provenance fields — is refused in `pnpm-workspace.yaml` and read from the global config file or the environment instead.
+
+- Hosted pnpr registries now serve newly published original artifacts from registry-scoped SHA-512 digest URLs.
+
+- Allowed `pnpm update --patches` to refresh registry revisions through a configured pnpr server while retaining locked package versions.
+
+- Added explicit registry revision selection with `<version>+rN` and `pnpm update --patches` for refreshing revision artifacts without changing package versions. Registry-backed lockfile policy checks recognize historical revisions, and pnpr now preserves safe revision histories from upstream registries.
+
+- Added support for registry replacement tarballs using standard integrity values, explicit revision fields, registry routing from the `registries` setting, non-redirecting integrity-addressed URLs, canonical safe-integer revision numbers, and pnpr proxying for immutable upstream revision artifacts.
+
+### Patch Changes
+
+- Forward `patchedDependencies` hashes and `packageExtensions` to pnpr so server-side resolution preserves patches and package extensions in the lockfile and installed packages.
+
+## 0.1.0-alpha.7
+
+### Minor Changes
+
+- Packument responses now carry a `Last-Modified` header derived from the document's `time.modified`, so a client's release-age check can learn the package-level last-publish bound from a cheap `HEAD` probe instead of downloading the metadata body.
+
+- A pnpr resolve request now carries the client's registries the way the `registries` setting declares them — keyed by URL, with the scopes routed to each, the bare-specifier prefix each answers to, and each one's `serverType` — in place of the prefix map it used to send.
+
+  The server routes them through the same inversion the config reader runs, so a pnpr-served install resolves a scoped dependency from the registry that scope is routed to, which it previously could not: only the default registry and the prefix-addressed ones reached the server. A declared `serverType` reaches it too, so the tarball URLs pnpr omits from the lockfile match the ones the client reconstructs.
+
+  Built-in scope routes the project has not pointed elsewhere are not declared, so a pnpr server's allowlist is not asked about `npm.jsr.io` on requests that resolve no JSR package.
+
+  A registry a request only declares is no longer refused up front for being off the server's allowlist — a client describes its whole configuration, including scopes a given resolve never reaches, so a stray `@scope:registry` in a developer's `~/.npmrc` no longer fails every install against a pnpr server that does not serve it. The boundary moves to the fetch itself: an origin the resolve does reach is refused before the request leaves the server, with the same message.
+
+  This changes the resolve and verify-lockfile request bodies. A pnpr server and its clients have to be on matching versions; the protocol is still experimental and unversioned.
+
+- A resolve request now carries the client's `resolutionMode`, so an install delegated to a pnpr server picks versions the way the client would. `time-based` and `lowest-direct` reached the server as nothing at all, leaving it on its `highest` default: the returned lockfile pinned the highest satisfying version of every dependency, and the setting appeared to be ignored.
+
+  This adds a field to the resolve request body. A server older than its client ignores it and keeps resolving `highest`; the protocol is still experimental and unversioned.
+
+### Patch Changes
+
+- Fixed `pnpm` installs using pnpr to honor the client's `autoInstallPeers`, `dedupePeers`, and `excludeLinksFromLockfile` settings [pnpm/pnpm#13389](https://github.com/pnpm/pnpm/issues/13389).
+
+## 0.1.0-alpha.6
+
+### Patch Changes
+
+- Validated forwarded catalog targets and kept catalog-specific resolutions isolated in the server cache.
+
+## 0.1.0-alpha.5
+
+### Patch Changes
+
+- Fixed `catalog:` references in dependencies and overrides failing to resolve when installing through a pnpr server, which errored with "No catalog entry '<name>' was found for catalog 'default'." even though the catalog entry existed. Also fixed a crash on Windows when installing a nested workspace member (e.g. `packages/foo`) through a pnpr server [#13232](https://github.com/pnpm/pnpm/issues/13232).
+
+## 0.1.0-alpha.4
+
+### Patch Changes
+
+- Fixed Pacquet workspace commands to honor project filters, preserve complete lockfile state, and materialize only the selected dependency closure, including pnpr-backed installs.
+
+- Fixed pnpr workspace resolution to preserve project names and versions for `workspace:` dependencies.
+
+## 0.1.0-alpha.3
+
+### Patch Changes
+
+- The `--help` text now reads as user-facing help rather than developer documentation. Command and flag descriptions say what each option does for you, and the leftover markdown that was printing verbatim in the terminal — intra-doc links, an inline link, and an HTML-like path placeholder — has been cleaned out.
+
+## 0.1.0-alpha.2
+
+### Patch Changes
+
+- Bump version.
+
+## 0.1.0-alpha.1
+
+### Patch Changes
+
+- On publish, the README of the `latest` version is now hoisted to the packument's top-level `readme` (and `readmeFilename`) field, matching npm and verdaccio. Publish clients only send the readme inside the version manifest, so without this a package published to pnpr exposed no top-level readme for full-packument consumers and registry UIs to render.
+
+## 0.1.0-alpha.0
+
+### Minor Changes
+
+- `@pnpm/pnpr` is now versioned with changesets and released from the unified release workflow. Versions switch from the `0.0.0-<datestamp>` scheme to semver, starting the 0.1.0 prerelease line at 0.1.0-alpha.0.
+- The install script exits without error in the pnpm monorepo checkout, where the per-platform binary packages are not generated.

package/install.js

@@ -44,6 +44,13 @@ const PLATFORMS = {
 setup()
 
 function setup () {
+  // The committed manifest has no `optionalDependencies`; generate-packages.mjs
+  // adds them at release time. Without them this is the monorepo checkout, where
+  // the wrapper is a workspace package and there is no native binary to link.
+  if (readOwnManifest().optionalDependencies == null) {
+    return
+  }
+
   const candidates = getBinCandidates()
   if (candidates.length === 0) {
     fail(`@pnpm/pnpr does not ship a prebuilt binary for ${platform}-${arch}.`)
@@ -142,6 +149,23 @@ function fail (message) {
   process.exit(1)
 }
 
+// A successful read with no optionalDependencies is the dev checkout (setup
+// no-ops there); a read/parse failure is a corrupt published package and must
+// not be silently swallowed into that same no-op path.
+function readOwnManifest () {
+  const manifestPath = path.join(ownDir, 'package.json')
+  let manifest
+  try {
+    manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'))
+  } catch (err) {
+    throw new Error(`Failed to read ${manifestPath}: ${err.message}`)
+  }
+  if (typeof manifest !== 'object' || manifest == null || Array.isArray(manifest)) {
+    throw new Error(`Expected ${manifestPath} to contain a JSON object`)
+  }
+  return manifest
+}
+
 /**
  * Native binary specifiers to try, most-preferred first; empty when the host is
  * unsupported. The linux glibc/musl pair is ordered by detected libc, which

package/package.json

@@ -1,5 +1,6 @@
 {
   "name": "@pnpm/pnpr",
+  "version": "0.1.0-alpha.10",
   "description": "pnpm-compatible npm registry server, written in Rust",
   "keywords": [
     "pnpm",
@@ -14,6 +15,9 @@
     "url": "https://github.com/pnpm/pnpm",
     "directory": "pnpr/npm/pnpr"
   },
+  "bin": {
+    "pnpr": "bin/pnpr"
+  },
   "type": "module",
   "engines": {
     "node": ">=18.*"
@@ -23,21 +27,17 @@
     "install.js",
     "LICENSE.md"
   ],
-  "version": "0.0.0-26070301",
   "optionalDependencies": {
-    "@pnpm/pnpr.win32-x64": "0.0.0-26070301",
-    "@pnpm/pnpr.win32-arm64": "0.0.0-26070301",
-    "@pnpm/pnpr.darwin-x64": "0.0.0-26070301",
-    "@pnpm/pnpr.darwin-arm64": "0.0.0-26070301",
-    "@pnpm/pnpr.linux-x64": "0.0.0-26070301",
-    "@pnpm/pnpr.linux-arm64": "0.0.0-26070301",
-    "@pnpm/pnpr.linux-x64-musl": "0.0.0-26070301",
-    "@pnpm/pnpr.linux-arm64-musl": "0.0.0-26070301"
+    "@pnpm/pnpr.win32-x64": "0.1.0-alpha.10",
+    "@pnpm/pnpr.win32-arm64": "0.1.0-alpha.10",
+    "@pnpm/pnpr.darwin-x64": "0.1.0-alpha.10",
+    "@pnpm/pnpr.darwin-arm64": "0.1.0-alpha.10",
+    "@pnpm/pnpr.linux-x64": "0.1.0-alpha.10",
+    "@pnpm/pnpr.linux-arm64": "0.1.0-alpha.10",
+    "@pnpm/pnpr.linux-x64-musl": "0.1.0-alpha.10",
+    "@pnpm/pnpr.linux-arm64-musl": "0.1.0-alpha.10"
   },
   "scripts": {
     "preinstall": "node install.js"
-  },
-  "bin": {
-    "pnpr": "bin/pnpr"
   }
 }