@pnpm/workspace.workspace-manifest-writer 1100.2.2 → 1100.2.4

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @pnpm/workspace.manifest-writer
 
+## 1100.2.4
+
+### Patch Changes
+
+- Catalogs now work with entries and catalog names such as `constructor` or `toString`. Pruning unused catalog entries crashed on such names, and a new named catalog called `toString` was silently not written.
+
+## 1100.2.3
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/building.policy@1100.1.4
+  - @pnpm/config.parse-overrides@1100.1.7
+  - @pnpm/config.version-policy@1100.2.5
+  - @pnpm/lockfile.types@1100.1.4
+  - @pnpm/workspace.workspace-manifest-reader@1100.2.1
+
 ## 1100.2.2
 
 ### Patch Changes

package/lib/auditIgnoreGhsas.d.ts

@@ -0,0 +1,12 @@
+import type { WorkspaceManifest } from '@pnpm/workspace.workspace-manifest-reader';
+/**
+ * Set the audit ignore list to `ghsas` (the complete desired list) in
+ * whichever spelling the manifest uses — the canonical `audit.ignore` wins
+ * over the deprecated `auditConfig.ignoreGhsas`, matching the reader's
+ * precedence, so a stale canonical list can't shadow the update on the next
+ * read. When both spellings are present, the shadowed deprecated list is
+ * removed as part of the write. `auditConfig.ignoreGhsas` is created when
+ * neither is present. An empty `ghsas` removes the list, dropping its parent
+ * block when nothing else remains in it. Returns whether anything changed.
+ */
+export declare function setAuditIgnoreGhsas(manifest: Partial<WorkspaceManifest>, ghsas: string[]): boolean;

package/lib/auditIgnoreGhsas.js

@@ -0,0 +1,53 @@
+import { equals } from 'ramda';
+/**
+ * Set the audit ignore list to `ghsas` (the complete desired list) in
+ * whichever spelling the manifest uses — the canonical `audit.ignore` wins
+ * over the deprecated `auditConfig.ignoreGhsas`, matching the reader's
+ * precedence, so a stale canonical list can't shadow the update on the next
+ * read. When both spellings are present, the shadowed deprecated list is
+ * removed as part of the write. `auditConfig.ignoreGhsas` is created when
+ * neither is present. An empty `ghsas` removes the list, dropping its parent
+ * block when nothing else remains in it. Returns whether anything changed.
+ */
+export function setAuditIgnoreGhsas(manifest, ghsas) {
+    if (manifest.audit?.ignore != null) {
+        let changed = setCanonicalAuditIgnore(manifest, manifest.audit, ghsas);
+        if (manifest.auditConfig?.ignoreGhsas != null) {
+            changed = removeAuditConfigIgnoreGhsas(manifest) || changed;
+        }
+        return changed;
+    }
+    if (ghsas.length === 0) {
+        return removeAuditConfigIgnoreGhsas(manifest);
+    }
+    if (equals(manifest.auditConfig?.ignoreGhsas, ghsas)) {
+        return false;
+    }
+    manifest.auditConfig = { ...manifest.auditConfig, ignoreGhsas: ghsas };
+    return true;
+}
+function setCanonicalAuditIgnore(manifest, audit, ghsas) {
+    if (ghsas.length === 0) {
+        delete audit.ignore;
+        if (Object.keys(audit).length === 0) {
+            delete manifest.audit;
+        }
+        return true;
+    }
+    if (equals(audit.ignore, ghsas)) {
+        return false;
+    }
+    audit.ignore = ghsas;
+    return true;
+}
+function removeAuditConfigIgnoreGhsas(manifest) {
+    if (manifest.auditConfig?.ignoreGhsas == null) {
+        return false;
+    }
+    delete manifest.auditConfig.ignoreGhsas;
+    if (Object.keys(manifest.auditConfig).length === 0) {
+        delete manifest.auditConfig;
+    }
+    return true;
+}
+//# sourceMappingURL=auditIgnoreGhsas.js.map

package/lib/catalogs.d.ts

@@ -0,0 +1,5 @@
+import type { Catalogs } from '@pnpm/catalogs.types';
+import type { Project } from '@pnpm/types';
+import type { WorkspaceManifest } from '@pnpm/workspace.workspace-manifest-reader';
+export declare function addCatalogs(manifest: Partial<WorkspaceManifest>, newCatalogs: Catalogs): boolean;
+export declare function removePackagesFromWorkspaceCatalog(manifest: Partial<WorkspaceManifest>, packagesJson: Project[]): boolean;

package/lib/catalogs.js

@@ -0,0 +1,149 @@
+import { parsePkgAndParentSelector } from '@pnpm/config.parse-overrides';
+export function addCatalogs(manifest, newCatalogs) {
+    let shouldBeUpdated = false;
+    for (const catalogName in newCatalogs) {
+        const existingCatalog = findCatalog(manifest, catalogName);
+        const { catalog, changed } = mergeCatalogEntries(existingCatalog, newCatalogs[catalogName] ?? {});
+        shouldBeUpdated = changed || shouldBeUpdated;
+        if (catalog == null || existingCatalog != null)
+            continue;
+        attachCatalog(manifest, catalogName, catalog);
+    }
+    return shouldBeUpdated;
+}
+function findCatalog(manifest, catalogName) {
+    if (catalogName === 'default') {
+        return manifest.catalog ?? manifest.catalogs?.default;
+    }
+    return manifest.catalogs != null && Object.hasOwn(manifest.catalogs, catalogName)
+        ? manifest.catalogs[catalogName]
+        : undefined;
+}
+function mergeCatalogEntries(existingCatalog, newEntries) {
+    let catalog = existingCatalog;
+    let changed = false;
+    for (const [dependencyName, specifier] of Object.entries(newEntries)) {
+        if (specifier == null) {
+            continue;
+        }
+        catalog ??= {};
+        if (catalog[dependencyName] !== specifier) {
+            catalog[dependencyName] = specifier;
+            changed = true;
+        }
+    }
+    return { catalog, changed };
+}
+function attachCatalog(manifest, catalogName, catalog) {
+    if (catalogName === 'default') {
+        manifest.catalog = catalog;
+    }
+    else {
+        manifest.catalogs ??= {};
+        manifest.catalogs[catalogName] = catalog;
+    }
+}
+export function removePackagesFromWorkspaceCatalog(manifest, packagesJson) {
+    if (packagesJson.length === 0 || (manifest.catalog == null && manifest.catalogs == null)) {
+        return false;
+    }
+    const packageReferences = collectCatalogReferences(packagesJson, manifest.overrides ?? {});
+    const defaultCatalogChanged = pruneDefaultCatalog(manifest, packageReferences);
+    const namedCatalogsChanged = pruneNamedCatalogs(manifest, packageReferences);
+    return defaultCatalogChanged || namedCatalogsChanged;
+}
+function collectCatalogReferences(packagesJson, overrides) {
+    const packageReferences = new Map();
+    for (const pkg of packagesJson) {
+        const pkgManifest = pkg.manifest;
+        const dependencyTypes = [
+            pkgManifest.dependencies,
+            pkgManifest.devDependencies,
+            pkgManifest.optionalDependencies,
+            pkgManifest.peerDependencies,
+        ];
+        for (const deps of dependencyTypes) {
+            addPackageReferences(packageReferences, deps ?? {});
+        }
+    }
+    for (const [selector, version] of Object.entries(overrides)) {
+        if (!version.startsWith('catalog:')) {
+            continue;
+        }
+        const pkgName = overrideTargetName(selector);
+        if (pkgName == null)
+            continue;
+        addPackageReference(packageReferences, pkgName, version);
+    }
+    return packageReferences;
+}
+function addPackageReferences(packageReferences, deps) {
+    for (const [pkgName, version] of Object.entries(deps)) {
+        addPackageReference(packageReferences, pkgName, version);
+    }
+}
+function overrideTargetName(selector) {
+    try {
+        return parsePkgAndParentSelector(selector).targetPkg.name;
+    }
+    catch {
+        return undefined;
+    }
+}
+function addPackageReference(packageReferences, pkgName, version) {
+    let references = packageReferences.get(pkgName);
+    if (references == null) {
+        references = new Set();
+        packageReferences.set(pkgName, references);
+    }
+    references.add(version);
+}
+function pruneDefaultCatalog(manifest, packageReferences) {
+    if (!manifest.catalog)
+        return false;
+    let shouldBeUpdated = false;
+    const packagesToRemove = Object.keys(manifest.catalog).filter(pkg => !packageReferences.get(pkg)?.has('catalog:'));
+    for (const pkg of packagesToRemove) {
+        delete manifest.catalog[pkg];
+        shouldBeUpdated = true;
+    }
+    if (Object.keys(manifest.catalog).length === 0) {
+        delete manifest.catalog;
+        shouldBeUpdated = true;
+    }
+    return shouldBeUpdated;
+}
+function pruneNamedCatalogs(manifest, packageReferences) {
+    if (!manifest.catalogs)
+        return false;
+    let shouldBeUpdated = false;
+    const catalogsToRemove = [];
+    for (const [catalogName, catalog] of Object.entries(manifest.catalogs)) {
+        if (!catalog)
+            continue;
+        shouldBeUpdated = pruneNamedCatalog(catalogName, catalog, packageReferences) || shouldBeUpdated;
+        if (Object.keys(catalog).length === 0) {
+            catalogsToRemove.push(catalogName);
+            shouldBeUpdated = true;
+        }
+    }
+    for (const catalogName of catalogsToRemove) {
+        delete manifest.catalogs[catalogName];
+    }
+    if (Object.keys(manifest.catalogs).length === 0) {
+        delete manifest.catalogs;
+        shouldBeUpdated = true;
+    }
+    return shouldBeUpdated;
+}
+function pruneNamedCatalog(catalogName, catalog, packageReferences) {
+    const packagesToRemove = Object.keys(catalog).filter(pkg => {
+        const references = packageReferences.get(pkg);
+        return !references?.has(`catalog:${catalogName}`) && !references?.has('catalog:');
+    });
+    for (const pkg of packagesToRemove) {
+        delete catalog[pkg];
+    }
+    return packagesToRemove.length > 0;
+}
+//# sourceMappingURL=catalogs.js.map

package/lib/index.d.ts

@@ -4,7 +4,7 @@ import type { ResolvedCatalogEntry } from '@pnpm/lockfile.types';
 import type { Project } from '@pnpm/types';
 import { type WorkspaceManifest } from '@pnpm/workspace.workspace-manifest-reader';
 export type FileName = typeof GLOBAL_CONFIG_YAML_FILENAME | typeof WORKSPACE_MANIFEST_FILENAME;
-export declare function updateWorkspaceManifest(dir: string, opts: {
+export interface UpdateWorkspaceManifestOptions {
     updatedFields?: Partial<WorkspaceManifest>;
     updatedCatalogs?: Catalogs;
     updatedOverrides?: Record<string, string>;
@@ -28,7 +28,8 @@ export declare function updateWorkspaceManifest(dir: string, opts: {
     resolvedPackageVersions?: ReadonlyMap<string, ReadonlySet<string>>;
     minimumReleaseAgeExcludePrune?: boolean;
     trustPolicyExcludePrune?: boolean;
-}): Promise<void>;
+}
+export declare function updateWorkspaceManifest(dir: string, opts: UpdateWorkspaceManifestOptions): Promise<void>;
 export interface NewCatalogs {
     [catalogName: string]: {
         [dependencyName: string]: Pick<ResolvedCatalogEntry, 'specifier'>;

package/lib/index.js

@@ -1,15 +1,16 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { packageNameFromAllowBuildKey, UNDECIDED_ALLOW_BUILD } from '@pnpm/building.policy';
-import { parsePkgAndParentSelector } from '@pnpm/config.parse-overrides';
-import { mergePackageVersionSpecs, parseVersionPolicyRule } from '@pnpm/config.version-policy';
+import { mergePackageVersionSpecs } from '@pnpm/config.version-policy';
 import { WORKSPACE_MANIFEST_FILENAME } from '@pnpm/constants';
-import { lexCompare } from '@pnpm/text.ordinal-comparator';
 import { validateWorkspaceManifest } from '@pnpm/workspace.workspace-manifest-reader';
 import { patchDocument } from '@pnpm/yaml.document-sync';
 import { equals } from 'ramda';
 import writeFileAtomic from 'write-file-atomic';
 import yaml from 'yaml';
+import { setAuditIgnoreGhsas } from './auditIgnoreGhsas.js';
+import { addCatalogs, removePackagesFromWorkspaceCatalog } from './catalogs.js';
+import { captureKeyOrder, propagateBlankLinesToNewPairs, reorderRecursive } from './keyOrder.js';
+import { pruneAllowBuilds, pruneExcludeList } from './pruneResolvedLists.js';
 const DEFAULT_FILENAME = WORKSPACE_MANIFEST_FILENAME;
 async function writeManifestFile(dir, fileName, manifest) {
     const manifestStr = manifest.toString({
@@ -40,435 +41,103 @@ export async function updateWorkspaceManifest(dir, opts) {
     validateWorkspaceManifest(manifest);
     manifest ??= {};
     const originalKeyOrder = captureKeyOrder(manifest);
-    let shouldBeUpdated = opts.updatedCatalogs != null && addCatalogs(manifest, opts.updatedCatalogs);
-    if (opts.catalogPrune) {
-        shouldBeUpdated = removePackagesFromWorkspaceCatalog(manifest, opts.allProjects ?? []) || shouldBeUpdated;
-    }
-    const updatedFields = { ...opts.updatedFields };
-    for (const [key, value] of Object.entries(updatedFields)) {
-        if (value == null) {
-            // Clearing a field the manifest never had changes nothing. Counting it as
-            // an update would take the empty-manifest branch below and try to remove a
-            // file that may not exist.
-            if (!Object.hasOwn(manifest, key))
-                continue;
-            shouldBeUpdated = true;
-            delete manifest[key];
-            continue;
-        }
-        if (equals(manifest[key], value))
-            continue;
-        shouldBeUpdated = true;
-        manifest[key] = value;
+    if (!applyManifestUpdates(manifest, opts)) {
+        return;
     }
-    const untypedManifest = manifest;
-    for (const key of opts.deletedLegacyKeys ?? []) {
-        if (Object.hasOwn(untypedManifest, key)) {
-            delete untypedManifest[key];
-            shouldBeUpdated = true;
-        }
+    if (Object.keys(manifest).length === 0) {
+        await fs.promises.rm(path.join(dir, fileName));
+        return;
     }
+    manifest = reorderRecursive(originalKeyOrder, manifest);
+    patchDocument(document, manifest, { preserveScalarAliases: true });
+    propagateBlankLinesToNewPairs(document, originalKeyOrder?.keys ?? []);
+    await writeManifestFile(dir, fileName, document);
+}
+function applyManifestUpdates(manifest, opts) {
+    let shouldBeUpdated = applyCatalogUpdates(manifest, opts);
+    shouldBeUpdated = applyUpdatedFields(manifest, { ...opts.updatedFields }) || shouldBeUpdated;
+    shouldBeUpdated = deleteKeys(manifest, opts.deletedLegacyKeys ?? []) || shouldBeUpdated;
     if (opts.updatedOverrides) {
-        manifest.overrides ??= {};
-        for (const [key, value] of Object.entries(opts.updatedOverrides)) {
-            if (!equals(manifest.overrides[key], value)) {
-                shouldBeUpdated = true;
-                manifest.overrides[key] = value;
-            }
-        }
+        shouldBeUpdated = applyUpdatedOverrides(manifest, opts.updatedOverrides) || shouldBeUpdated;
     }
     if (opts.updatedAuditIgnoreGhsas != null) {
         shouldBeUpdated = setAuditIgnoreGhsas(manifest, opts.updatedAuditIgnoreGhsas) || shouldBeUpdated;
     }
     if (opts.resolvedPackageVersions != null) {
-        if (opts.minimumReleaseAgeExcludePrune) {
-            shouldBeUpdated = pruneExcludeList(manifest, 'minimumReleaseAgeExclude', opts.resolvedPackageVersions) || shouldBeUpdated;
-        }
-        if (opts.trustPolicyExcludePrune) {
-            shouldBeUpdated = pruneExcludeList(manifest, 'trustPolicyExclude', opts.resolvedPackageVersions) || shouldBeUpdated;
-        }
-        shouldBeUpdated = pruneAllowBuilds(manifest, opts.resolvedPackageVersions) || shouldBeUpdated;
+        shouldBeUpdated = pruneResolvedPackageLists(manifest, opts, opts.resolvedPackageVersions) || shouldBeUpdated;
     }
     // Merged after the cleanup pass so entries approved during this install
     // are never pruned by it in the same write.
     if (opts.addedMinimumReleaseAgeExcludes?.length) {
-        const existing = manifest.minimumReleaseAgeExclude ?? [];
-        const merged = mergePackageVersionSpecs([...existing, ...opts.addedMinimumReleaseAgeExcludes]);
-        if (!equals(existing, merged)) {
-            shouldBeUpdated = true;
-            manifest.minimumReleaseAgeExclude = merged;
-        }
-    }
-    if (!shouldBeUpdated) {
-        return;
+        shouldBeUpdated = addMinimumReleaseAgeExcludes(manifest, opts.addedMinimumReleaseAgeExcludes) || shouldBeUpdated;
     }
-    if (Object.keys(manifest).length === 0) {
-        await fs.promises.rm(path.join(dir, fileName));
-        return;
+    return shouldBeUpdated;
+}
+function applyCatalogUpdates(manifest, opts) {
+    const catalogsAdded = opts.updatedCatalogs != null && addCatalogs(manifest, opts.updatedCatalogs);
+    if (!opts.catalogPrune) {
+        return catalogsAdded;
     }
-    manifest = reorderRecursive(originalKeyOrder, manifest);
-    patchDocument(document, manifest, { preserveScalarAliases: true });
-    propagateBlankLinesToNewPairs(document, originalKeyOrder?.keys ?? []);
-    await writeManifestFile(dir, fileName, document);
+    return removePackagesFromWorkspaceCatalog(manifest, opts.allProjects ?? []) || catalogsAdded;
 }
-function addCatalogs(manifest, newCatalogs) {
+function applyUpdatedFields(manifest, updatedFields) {
     let shouldBeUpdated = false;
-    for (const catalogName in newCatalogs) {
-        let targetCatalog = catalogName === 'default'
-            ? manifest.catalog ?? manifest.catalogs?.default
-            : manifest.catalogs?.[catalogName];
-        const targetCatalogWasNil = targetCatalog == null;
-        for (const [dependencyName, specifier] of Object.entries(newCatalogs[catalogName] ?? {})) {
-            if (specifier == null) {
+    for (const [key, value] of Object.entries(updatedFields)) {
+        if (value == null) {
+            // Clearing a field the manifest never had changes nothing. Counting it as
+            // an update would take the empty-manifest branch below and try to remove a
+            // file that may not exist.
+            if (!Object.hasOwn(manifest, key))
                 continue;
-            }
-            targetCatalog ??= {};
-            if (targetCatalog[dependencyName] !== specifier) {
-                targetCatalog[dependencyName] = specifier;
-                shouldBeUpdated = true;
-            }
-        }
-        if (targetCatalog == null)
+            shouldBeUpdated = true;
+            delete manifest[key];
             continue;
-        if (targetCatalogWasNil) {
-            if (catalogName === 'default') {
-                manifest.catalog = targetCatalog;
-            }
-            else {
-                manifest.catalogs ??= {};
-                manifest.catalogs[catalogName] = targetCatalog;
-            }
         }
+        if (equals(manifest[key], value))
+            continue;
+        shouldBeUpdated = true;
+        manifest[key] = value;
     }
     return shouldBeUpdated;
 }
-function removePackagesFromWorkspaceCatalog(manifest, packagesJson) {
+function deleteKeys(manifest, keys) {
     let shouldBeUpdated = false;
-    if (packagesJson.length === 0 || (manifest.catalog == null && manifest.catalogs == null)) {
-        return shouldBeUpdated;
-    }
-    const packageReferences = {};
-    for (const pkg of packagesJson) {
-        const pkgManifest = pkg.manifest;
-        const dependencyTypes = [
-            pkgManifest.dependencies,
-            pkgManifest.devDependencies,
-            pkgManifest.optionalDependencies,
-            pkgManifest.peerDependencies,
-        ];
-        for (const deps of dependencyTypes) {
-            if (!deps)
-                continue;
-            for (const [pkgName, version] of Object.entries(deps)) {
-                addPackageReference(packageReferences, pkgName, version);
-            }
-        }
-    }
-    for (const [selector, version] of Object.entries(manifest.overrides ?? {})) {
-        if (!version.startsWith('catalog:')) {
-            continue;
-        }
-        let pkgName;
-        try {
-            pkgName = parsePkgAndParentSelector(selector).targetPkg.name;
-        }
-        catch {
-            continue;
-        }
-        addPackageReference(packageReferences, pkgName, version);
-    }
-    if (manifest.catalog) {
-        const packagesToRemove = Object.keys(manifest.catalog).filter(pkg => !packageReferences[pkg]?.has('catalog:'));
-        for (const pkg of packagesToRemove) {
-            delete manifest.catalog[pkg];
-            shouldBeUpdated = true;
-        }
-        if (Object.keys(manifest.catalog).length === 0) {
-            delete manifest.catalog;
+    for (const key of keys) {
+        if (Object.hasOwn(manifest, key)) {
+            delete manifest[key];
             shouldBeUpdated = true;
         }
     }
-    if (manifest.catalogs) {
-        const catalogsToRemove = [];
-        for (const [catalogName, catalog] of Object.entries(manifest.catalogs)) {
-            if (!catalog)
-                continue;
-            const packagesToRemove = Object.keys(catalog).filter(pkg => {
-                const references = packageReferences[pkg];
-                return !references?.has(`catalog:${catalogName}`) && !references?.has('catalog:');
-            });
-            for (const pkg of packagesToRemove) {
-                delete catalog[pkg];
-                shouldBeUpdated = true;
-            }
-            if (Object.keys(catalog).length === 0) {
-                catalogsToRemove.push(catalogName);
-                shouldBeUpdated = true;
-            }
-        }
-        for (const catalogName of catalogsToRemove) {
-            delete manifest.catalogs[catalogName];
-        }
-        if (Object.keys(manifest.catalogs).length === 0) {
-            delete manifest.catalogs;
+    return shouldBeUpdated;
+}
+function applyUpdatedOverrides(manifest, updatedOverrides) {
+    let shouldBeUpdated = false;
+    manifest.overrides ??= {};
+    for (const [key, value] of Object.entries(updatedOverrides)) {
+        if (!equals(manifest.overrides[key], value)) {
             shouldBeUpdated = true;
+            manifest.overrides[key] = value;
         }
     }
     return shouldBeUpdated;
 }
-function addPackageReference(packageReferences, pkgName, version) {
-    if (!packageReferences[pkgName]) {
-        packageReferences[pkgName] = new Set();
-    }
-    packageReferences[pkgName].add(version);
-}
-// The `minimumReleaseAgeExcludePrune` / `trustPolicyExcludePrune` pass over
-// the exclude list `field` names. An entry is dropped when the freshly
-// resolved lockfile no longer contains what it names: exact versions that
-// were not resolved are dropped (the entry goes away once none remain), and a
-// bare-name entry goes away when the package is absent entirely. Glob patterns
-// always stay — they are forward-looking and can't be proven stale. Entries
-// that fail to parse stay untouched so cleanup never breaks an install.
-function pruneExcludeList(manifest, field, resolvedPackageVersions) {
-    const excludes = manifest[field];
-    if (excludes == null || excludes.length === 0) {
-        return false;
-    }
-    const survivingSpecs = [];
-    let changed = false;
-    for (const entry of excludes) {
-        let packageName;
-        let exactVersions;
-        try {
-            const rule = parseVersionPolicyRule(entry);
-            packageName = rule.packageName;
-            exactVersions = rule.exactVersions;
-        }
-        catch {
-            survivingSpecs.push(entry);
-            continue;
-        }
-        if (exactVersions.length === 0) {
-            if (packageName.includes('*') || resolvedPackageVersions.has(packageName)) {
-                survivingSpecs.push(entry);
-            }
-            else {
-                changed = true;
-            }
-            continue;
-        }
-        const resolved = resolvedPackageVersions.get(packageName);
-        const survivingVersions = exactVersions.filter((version) => resolved?.has(version));
-        if (survivingVersions.length === exactVersions.length) {
-            survivingSpecs.push(entry);
-        }
-        else if (survivingVersions.length > 0) {
-            survivingSpecs.push(...mergePackageVersionSpecs([`${packageName}@${survivingVersions.join(' || ')}`]));
-            changed = true;
-        }
-        else {
-            changed = true;
-        }
-    }
-    if (!changed) {
-        return false;
-    }
-    if (survivingSpecs.length === 0) {
-        delete manifest[field];
+function pruneResolvedPackageLists(manifest, opts, resolvedPackageVersions) {
+    let shouldBeUpdated = false;
+    if (opts.minimumReleaseAgeExcludePrune) {
+        shouldBeUpdated = pruneExcludeList(manifest, 'minimumReleaseAgeExclude', resolvedPackageVersions) || shouldBeUpdated;
     }
-    else {
-        manifest[field] = survivingSpecs;
+    if (opts.trustPolicyExcludePrune) {
+        shouldBeUpdated = pruneExcludeList(manifest, 'trustPolicyExclude', resolvedPackageVersions) || shouldBeUpdated;
     }
-    return true;
+    return pruneAllowBuilds(manifest, resolvedPackageVersions) || shouldBeUpdated;
 }
-/**
- * Set the audit ignore list to `ghsas` (the complete desired list) in
- * whichever spelling the manifest uses — the canonical `audit.ignore` wins
- * over the deprecated `auditConfig.ignoreGhsas`, matching the reader's
- * precedence, so a stale canonical list can't shadow the update on the next
- * read. When both spellings are present, the shadowed deprecated list is
- * removed as part of the write. `auditConfig.ignoreGhsas` is created when
- * neither is present. An empty `ghsas` removes the list, dropping its parent
- * block when nothing else remains in it. Returns whether anything changed.
- */
-function setAuditIgnoreGhsas(manifest, ghsas) {
-    let changed = false;
-    if (manifest.audit?.ignore != null) {
-        if (ghsas.length === 0) {
-            delete manifest.audit.ignore;
-            if (Object.keys(manifest.audit).length === 0) {
-                delete manifest.audit;
-            }
-            changed = true;
-        }
-        else if (!equals(manifest.audit.ignore, ghsas)) {
-            manifest.audit.ignore = ghsas;
-            changed = true;
-        }
-        if (manifest.auditConfig?.ignoreGhsas != null) {
-            changed = removeAuditConfigIgnoreGhsas(manifest) || changed;
-        }
-        return changed;
-    }
-    if (ghsas.length === 0) {
-        return removeAuditConfigIgnoreGhsas(manifest);
-    }
-    if (equals(manifest.auditConfig?.ignoreGhsas, ghsas)) {
+function addMinimumReleaseAgeExcludes(manifest, addedExcludes) {
+    const existing = manifest.minimumReleaseAgeExclude ?? [];
+    const merged = mergePackageVersionSpecs([...existing, ...addedExcludes]);
+    if (equals(existing, merged)) {
         return false;
     }
-    manifest.auditConfig = { ...manifest.auditConfig, ignoreGhsas: ghsas };
+    manifest.minimumReleaseAgeExclude = merged;
     return true;
 }
-function removeAuditConfigIgnoreGhsas(manifest) {
-    if (manifest.auditConfig?.ignoreGhsas == null) {
-        return false;
-    }
-    delete manifest.auditConfig.ignoreGhsas;
-    if (Object.keys(manifest.auditConfig).length === 0) {
-        delete manifest.auditConfig;
-    }
-    return true;
-}
-// Captures only the key order at each nested level of a plain-object value,
-// without duplicating the values themselves. Used as a lightweight snapshot of
-// the original manifest layout so `reorderRecursive` can decide where to place
-// new keys without holding a structural clone of the entire manifest.
-function captureKeyOrder(value) {
-    if (!isPlainObject(value))
-        return null;
-    const children = {};
-    for (const [key, child] of Object.entries(value)) {
-        const childOrder = captureKeyOrder(child);
-        if (childOrder != null) {
-            children[key] = childOrder;
-        }
-    }
-    return { keys: Object.keys(value), children };
-}
-// Reorders the keys of `current` based on how the keys were arranged in the
-// original manifest. Two "sorted" layouts are recognized:
-//
-//   1. fully alphabetical
-//   2. a leading "packages" key followed by alphabetical
-//
-// When the original matches one of those layouts, new keys are inserted in
-// alphabetical position (preserving the leading "packages" if applicable).
-// Otherwise the existing order is preserved and new keys are appended at the
-// end. New manifests (no original keys) default to layout (2) to match the
-// pnpm convention of placing "packages" first.
-function reorderRecursive(originalOrder, current) {
-    if (!isPlainObject(current))
-        return current;
-    const originalKeys = originalOrder?.keys ?? [];
-    const originalKeySet = new Set(originalKeys);
-    const survivingOriginal = originalKeys.filter((key) => Object.hasOwn(current, key));
-    const newKeys = Object.keys(current).filter((key) => !originalKeySet.has(key));
-    let orderedKeys;
-    if (newKeys.length === 0) {
-        orderedKeys = survivingOriginal;
-    }
-    else {
-        const layout = detectKeyLayout(originalKeys);
-        orderedKeys = layout === 'unordered'
-            ? [...survivingOriginal, ...newKeys]
-            : sortKeys([...survivingOriginal, ...newKeys], layout);
-    }
-    const result = {};
-    for (const key of orderedKeys) {
-        result[key] = reorderRecursive(originalOrder?.children[key] ?? null, current[key]);
-    }
-    return result;
-}
-function detectKeyLayout(keys) {
-    if (keys.length === 0)
-        return 'packages-first';
-    const packagesFirst = keys[0] === 'packages';
-    const start = packagesFirst ? 1 : 0;
-    for (let i = start + 1; i < keys.length; i++) {
-        if (lexCompare(keys[i - 1], keys[i]) > 0)
-            return 'unordered';
-    }
-    return packagesFirst ? 'packages-first' : 'alphabetical';
-}
-function sortKeys(keys, layout) {
-    if (layout === 'packages-first' && keys.includes('packages')) {
-        return ['packages', ...keys.filter((key) => key !== 'packages').sort(lexCompare)];
-    }
-    return [...keys].sort(lexCompare);
-}
-function isPlainObject(value) {
-    return value != null && typeof value === 'object' && !Array.isArray(value);
-}
-// New top-level pairs are inserted without `spaceBefore`, which glues them to
-// the preceding pair even when the document otherwise uses blank-line
-// separators between fields. Detect that style and propagate it to inserted
-// entries (including reordering-induced changes such as a new key sorting to
-// the front, which demotes the previously-first existing pair to a position
-// that should now have a blank before it).
-//
-// The yaml library reads `spaceBefore` from the pair's key node when rendering
-// block collections, not from the pair itself.
-function propagateBlankLinesToNewPairs(document, originalTopLevelKeys) {
-    if (!yaml.isMap(document.contents))
-        return;
-    const items = document.contents.items;
-    const keyOf = (pair) => yaml.isScalar(pair.key) && typeof pair.key.value === 'string'
-        ? pair.key
-        : null;
-    const originalKeySet = new Set(originalTopLevelKeys);
-    // The originally-first pair never had `spaceBefore` set even in a
-    // blank-line-separated document — exclude it when judging the document's
-    // style so we still detect the style when that pair has been moved.
-    const originalFirstKey = originalTopLevelKeys[0] ?? null;
-    let originalNonFirstCount = 0;
-    let originalNonFirstWithBlank = 0;
-    for (const item of items) {
-        const k = keyOf(item);
-        if (k == null || !originalKeySet.has(k.value) || k.value === originalFirstKey)
-            continue;
-        originalNonFirstCount++;
-        if (k.spaceBefore)
-            originalNonFirstWithBlank++;
-    }
-    const usesBlankLineStyle = originalNonFirstCount > 0 && originalNonFirstWithBlank === originalNonFirstCount;
-    for (let i = 1; i < items.length; i++) {
-        const key = keyOf(items[i]);
-        if (key == null || key.spaceBefore)
-            continue;
-        if (usesBlankLineStyle) {
-            key.spaceBefore = true;
-            continue;
-        }
-        if (originalKeySet.has(key.value))
-            continue;
-        const nextKey = items[i + 1] ? keyOf(items[i + 1]) : null;
-        const prevKey = items[i - 1] ? keyOf(items[i - 1]) : null;
-        if (nextKey?.spaceBefore || (nextKey == null && prevKey?.spaceBefore)) {
-            key.spaceBefore = true;
-        }
-    }
-}
-// Drops undecided placeholder entries whose package is provably absent from
-// the resolved lockfile. Explicit decisions, keys with no provable package
-// name, and entries for still-resolved packages always stay.
-function pruneAllowBuilds(manifest, resolvedPackageVersions) {
-    const allowBuilds = manifest.allowBuilds;
-    if (allowBuilds == null) {
-        return false;
-    }
-    let changed = false;
-    for (const [key, value] of Object.entries(allowBuilds)) {
-        if (value !== UNDECIDED_ALLOW_BUILD)
-            continue;
-        const packageName = packageNameFromAllowBuildKey(key);
-        if (packageName == null || resolvedPackageVersions.has(packageName))
-            continue;
-        delete allowBuilds[key];
-        changed = true;
-    }
-    if (changed && Object.keys(allowBuilds).length === 0) {
-        delete manifest.allowBuilds;
-    }
-    return changed;
-}
 //# sourceMappingURL=index.js.map

package/lib/keyOrder.d.ts

@@ -0,0 +1,8 @@
+import yaml from 'yaml';
+export interface KeyOrderNode {
+    keys: string[];
+    children: Map<string, KeyOrderNode>;
+}
+export declare function captureKeyOrder(value: unknown): KeyOrderNode | null;
+export declare function reorderRecursive(originalOrder: KeyOrderNode | null, current: unknown): unknown;
+export declare function propagateBlankLinesToNewPairs(document: yaml.Document, originalTopLevelKeys: readonly string[]): void;

package/lib/keyOrder.js

@@ -0,0 +1,125 @@
+import { lexCompare } from '@pnpm/text.ordinal-comparator';
+import yaml from 'yaml';
+// Captures only the key order at each nested level of a plain-object value,
+// without duplicating the values themselves. Used as a lightweight snapshot of
+// the original manifest layout so `reorderRecursive` can decide where to place
+// new keys without holding a structural clone of the entire manifest.
+export function captureKeyOrder(value) {
+    if (!isPlainObject(value))
+        return null;
+    const children = new Map();
+    for (const [key, child] of Object.entries(value)) {
+        const childOrder = captureKeyOrder(child);
+        if (childOrder != null) {
+            children.set(key, childOrder);
+        }
+    }
+    return { keys: Object.keys(value), children };
+}
+// Reorders the keys of `current` based on how the keys were arranged in the
+// original manifest. Two "sorted" layouts are recognized:
+//
+//   1. fully alphabetical
+//   2. a leading "packages" key followed by alphabetical
+//
+// When the original matches one of those layouts, new keys are inserted in
+// alphabetical position (preserving the leading "packages" if applicable).
+// Otherwise the existing order is preserved and new keys are appended at the
+// end. New manifests (no original keys) default to layout (2) to match the
+// pnpm convention of placing "packages" first.
+export function reorderRecursive(originalOrder, current) {
+    if (!isPlainObject(current))
+        return current;
+    const originalKeys = originalOrder?.keys ?? [];
+    const originalKeySet = new Set(originalKeys);
+    const survivingOriginal = originalKeys.filter((key) => Object.hasOwn(current, key));
+    const newKeys = Object.keys(current).filter((key) => !originalKeySet.has(key));
+    let orderedKeys;
+    if (newKeys.length === 0) {
+        orderedKeys = survivingOriginal;
+    }
+    else {
+        const layout = detectKeyLayout(originalKeys);
+        orderedKeys = layout === 'unordered'
+            ? [...survivingOriginal, ...newKeys]
+            : sortKeys([...survivingOriginal, ...newKeys], layout);
+    }
+    const result = {};
+    for (const key of orderedKeys) {
+        result[key] = reorderRecursive(originalOrder?.children.get(key) ?? null, current[key]);
+    }
+    return result;
+}
+function detectKeyLayout(keys) {
+    if (keys.length === 0)
+        return 'packages-first';
+    const packagesFirst = keys[0] === 'packages';
+    const start = packagesFirst ? 1 : 0;
+    for (let keyIndex = start + 1; keyIndex < keys.length; keyIndex++) {
+        if (lexCompare(keys[keyIndex - 1], keys[keyIndex]) > 0)
+            return 'unordered';
+    }
+    return packagesFirst ? 'packages-first' : 'alphabetical';
+}
+function sortKeys(keys, layout) {
+    if (layout === 'packages-first' && keys.includes('packages')) {
+        return ['packages', ...keys.filter((key) => key !== 'packages').sort(lexCompare)];
+    }
+    return [...keys].sort(lexCompare);
+}
+function isPlainObject(value) {
+    return value != null && typeof value === 'object' && !Array.isArray(value);
+}
+// New top-level pairs are inserted without `spaceBefore`, which glues them to
+// the preceding pair even when the document otherwise uses blank-line
+// separators between fields. Detect that style and propagate it to inserted
+// entries (including reordering-induced changes such as a new key sorting to
+// the front, which demotes the previously-first existing pair to a position
+// that should now have a blank before it).
+//
+// The yaml library reads `spaceBefore` from the pair's key node when rendering
+// block collections, not from the pair itself.
+export function propagateBlankLinesToNewPairs(document, originalTopLevelKeys) {
+    if (!yaml.isMap(document.contents))
+        return;
+    const items = document.contents.items;
+    const originalKeySet = new Set(originalTopLevelKeys);
+    const usesBlankLineStyle = detectBlankLineStyle(items, originalTopLevelKeys);
+    for (let itemIndex = 1; itemIndex < items.length; itemIndex++) {
+        const key = stringKeyOf(items[itemIndex]);
+        if (key == null || key.spaceBefore)
+            continue;
+        if (usesBlankLineStyle || (!originalKeySet.has(key.value) && neighborHasBlankLine(items, itemIndex))) {
+            key.spaceBefore = true;
+        }
+    }
+}
+function detectBlankLineStyle(items, originalTopLevelKeys) {
+    const originalKeySet = new Set(originalTopLevelKeys);
+    // The originally-first pair never had `spaceBefore` set even in a
+    // blank-line-separated document — exclude it when judging the document's
+    // style so we still detect the style when that pair has been moved.
+    const originalFirstKey = originalTopLevelKeys[0] ?? null;
+    let originalNonFirstCount = 0;
+    let originalNonFirstWithBlank = 0;
+    for (const item of items) {
+        const itemKey = stringKeyOf(item);
+        if (itemKey == null || !originalKeySet.has(itemKey.value) || itemKey.value === originalFirstKey)
+            continue;
+        originalNonFirstCount++;
+        if (itemKey.spaceBefore)
+            originalNonFirstWithBlank++;
+    }
+    return originalNonFirstCount > 0 && originalNonFirstWithBlank === originalNonFirstCount;
+}
+function neighborHasBlankLine(items, itemIndex) {
+    const nextKey = items[itemIndex + 1] ? stringKeyOf(items[itemIndex + 1]) : null;
+    const prevKey = items[itemIndex - 1] ? stringKeyOf(items[itemIndex - 1]) : null;
+    return Boolean(nextKey?.spaceBefore || (nextKey == null && prevKey?.spaceBefore));
+}
+function stringKeyOf(pair) {
+    return yaml.isScalar(pair.key) && typeof pair.key.value === 'string'
+        ? pair.key
+        : null;
+}
+//# sourceMappingURL=keyOrder.js.map

package/lib/pruneResolvedLists.d.ts

@@ -0,0 +1,8 @@
+import type { WorkspaceManifest } from '@pnpm/workspace.workspace-manifest-reader';
+export type ExcludeListField = 'minimumReleaseAgeExclude' | 'trustPolicyExclude';
+type ResolvedPackageVersions = ReadonlyMap<string, ReadonlySet<string>>;
+export declare function pruneExcludeList(manifest: Partial<WorkspaceManifest> & {
+    [key in ExcludeListField]?: string[];
+}, field: ExcludeListField, resolvedPackageVersions: ResolvedPackageVersions): boolean;
+export declare function pruneAllowBuilds(manifest: Partial<WorkspaceManifest>, resolvedPackageVersions: ResolvedPackageVersions): boolean;
+export {};

package/lib/pruneResolvedLists.js

@@ -0,0 +1,89 @@
+import { packageNameFromAllowBuildKey, UNDECIDED_ALLOW_BUILD } from '@pnpm/building.policy';
+import { mergePackageVersionSpecs, parseVersionPolicyRule } from '@pnpm/config.version-policy';
+// The `minimumReleaseAgeExcludePrune` / `trustPolicyExcludePrune` pass over
+// the exclude list `field` names. An entry is dropped when the freshly
+// resolved lockfile no longer contains what it names: exact versions that
+// were not resolved are dropped (the entry goes away once none remain), and a
+// bare-name entry goes away when the package is absent entirely. Glob patterns
+// always stay — they are forward-looking and can't be proven stale. Entries
+// that fail to parse stay untouched so cleanup never breaks an install.
+export function pruneExcludeList(manifest, field, resolvedPackageVersions) {
+    const excludes = manifest[field];
+    if (excludes == null || excludes.length === 0) {
+        return false;
+    }
+    const survivingSpecs = [];
+    let changed = false;
+    for (const entry of excludes) {
+        const prunedEntry = pruneExcludeEntry(entry, resolvedPackageVersions);
+        survivingSpecs.push(...prunedEntry.survivingSpecs);
+        changed = prunedEntry.changed || changed;
+    }
+    if (!changed) {
+        return false;
+    }
+    if (survivingSpecs.length === 0) {
+        delete manifest[field];
+    }
+    else {
+        manifest[field] = survivingSpecs;
+    }
+    return true;
+}
+function pruneExcludeEntry(entry, resolvedPackageVersions) {
+    const rule = tryParseVersionPolicyRule(entry);
+    if (rule == null) {
+        return { survivingSpecs: [entry], changed: false };
+    }
+    const { packageName, exactVersions } = rule;
+    if (exactVersions.length === 0) {
+        const isStillRelevant = packageName.includes('*') || resolvedPackageVersions.has(packageName);
+        return isStillRelevant
+            ? { survivingSpecs: [entry], changed: false }
+            : { survivingSpecs: [], changed: true };
+    }
+    const resolved = resolvedPackageVersions.get(packageName);
+    const survivingVersions = exactVersions.filter((version) => resolved?.has(version));
+    if (survivingVersions.length === exactVersions.length) {
+        return { survivingSpecs: [entry], changed: false };
+    }
+    if (survivingVersions.length === 0) {
+        return { survivingSpecs: [], changed: true };
+    }
+    return {
+        survivingSpecs: mergePackageVersionSpecs([`${packageName}@${survivingVersions.join(' || ')}`]),
+        changed: true,
+    };
+}
+function tryParseVersionPolicyRule(entry) {
+    try {
+        return parseVersionPolicyRule(entry);
+    }
+    catch {
+        return undefined;
+    }
+}
+// Drops undecided placeholder entries whose package is provably absent from
+// the resolved lockfile. Explicit decisions, keys with no provable package
+// name, and entries for still-resolved packages always stay.
+export function pruneAllowBuilds(manifest, resolvedPackageVersions) {
+    const allowBuilds = manifest.allowBuilds;
+    if (allowBuilds == null) {
+        return false;
+    }
+    let changed = false;
+    for (const [key, value] of Object.entries(allowBuilds)) {
+        if (value !== UNDECIDED_ALLOW_BUILD)
+            continue;
+        const packageName = packageNameFromAllowBuildKey(key);
+        if (packageName == null || resolvedPackageVersions.has(packageName))
+            continue;
+        delete allowBuilds[key];
+        changed = true;
+    }
+    if (changed && Object.keys(allowBuilds).length === 0) {
+        delete manifest.allowBuilds;
+    }
+    return changed;
+}
+//# sourceMappingURL=pruneResolvedLists.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/workspace.workspace-manifest-writer",
-  "version": "1100.2.2",
+  "version": "1100.2.4",
   "description": "Updates the workspace manifest file",
   "keywords": [
     "pnpm",
@@ -27,15 +27,15 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/building.policy": "1100.1.3",
+    "@pnpm/building.policy": "1100.1.4",
     "@pnpm/catalogs.types": "1100.0.1",
-    "@pnpm/config.parse-overrides": "1100.1.6",
-    "@pnpm/config.version-policy": "1100.2.4",
+    "@pnpm/config.parse-overrides": "1100.1.7",
+    "@pnpm/config.version-policy": "1100.2.5",
     "@pnpm/constants": "1102.0.0",
-    "@pnpm/lockfile.types": "1100.1.3",
+    "@pnpm/lockfile.types": "1100.1.4",
     "@pnpm/text.ordinal-comparator": "1100.0.0",
     "@pnpm/types": "1102.1.1",
-    "@pnpm/workspace.workspace-manifest-reader": "1100.2.0",
+    "@pnpm/workspace.workspace-manifest-reader": "1100.2.1",
     "@pnpm/yaml.document-sync": "1100.0.2",
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "write-file-atomic": "^7.0.1",
@@ -43,10 +43,10 @@
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/prepare": "1100.0.32",
+    "@pnpm/prepare": "1100.0.34",
     "@pnpm/prepare-temp-dir": "1100.0.1",
-    "@pnpm/workspace.projects-reader": "1101.1.0",
-    "@pnpm/workspace.workspace-manifest-writer": "1100.2.2",
+    "@pnpm/workspace.projects-reader": "1101.1.1",
+    "@pnpm/workspace.workspace-manifest-writer": "1100.2.4",
     "@types/ramda": "0.32.0",
     "@types/write-file-atomic": "^4.0.3",
     "read-yaml-file": "^3.0.0",