@teambit/pnpm 1.0.1124 → 1.0.1125

package/dist/lynx.js

@@ -8,6 +8,21 @@ exports.generateResolverAndFetcher = generateResolverAndFetcher;
 exports.getPeerDependencyIssues = getPeerDependencyIssues;
 exports.install = install;
 exports.resolveRemoteVersion = resolveRemoteVersion;
+exports.resolveScriptPolicies = resolveScriptPolicies;
+function _path() {
+  const data = require("path");
+  _path = function () {
+    return data;
+  };
+  return data;
+}
+function _fs() {
+  const data = require("fs");
+  _fs = function () {
+    return data;
+  };
+  return data;
+}
 function _semver() {
   const data = _interopRequireDefault(require("semver"));
   _semver = function () {
@@ -22,9 +37,9 @@ function _parsePackageName() {
   };
   return data;
 }
-function _defaultReporter() {
-  const data = require("@pnpm/default-reporter");
-  _defaultReporter = function () {
+function _cli() {
+  const data = require("@pnpm/cli.default-reporter");
+  _cli = function () {
     return data;
   };
   return data;
@@ -43,30 +58,16 @@ function _pluginTrustedDeps() {
   };
   return data;
 }
-function _pluginCommandsRebuild() {
-  const data = require("@pnpm/plugin-commands-rebuild");
-  _pluginCommandsRebuild = function () {
+function nodeApi() {
+  const data = _interopRequireWildcard(require("@pnpm/napi"));
+  nodeApi = function () {
     return data;
   };
   return data;
 }
-function _storeConnectionManager() {
-  const data = require("@pnpm/store-connection-manager");
-  _storeConnectionManager = function () {
-    return data;
-  };
-  return data;
-}
-function _sortPackages() {
-  const data = require("@pnpm/sort-packages");
-  _sortPackages = function () {
-    return data;
-  };
-  return data;
-}
-function _pkgConfig() {
-  const data = require("@teambit/pkg.config.auth");
-  _pkgConfig = function () {
+function _nerfDart() {
+  const data = _interopRequireDefault(require("nerf-dart"));
+  _nerfDart = function () {
     return data;
   };
   return data;
@@ -85,42 +86,6 @@ function _legacy() {
   };
   return data;
 }
-function _core() {
-  const data = _interopRequireWildcard(require("@pnpm/core"));
-  _core = function () {
-    return data;
-  };
-  return data;
-}
-var pnpm = _core;
-function _client() {
-  const data = require("@pnpm/client");
-  _client = function () {
-    return data;
-  };
-  return data;
-}
-function _worker() {
-  const data = require("@pnpm/worker");
-  _worker = function () {
-    return data;
-  };
-  return data;
-}
-function _workspace() {
-  const data = require("@pnpm/workspace.pkgs-graph");
-  _workspace = function () {
-    return data;
-  };
-  return data;
-}
-function _lockfile() {
-  const data = require("@pnpm/lockfile.fs");
-  _lockfile = function () {
-    return data;
-  };
-  return data;
-}
 function _dependenciesPnpm() {
   const data = require("@teambit/dependencies.pnpm.dep-path");
   _dependenciesPnpm = function () {
@@ -163,42 +128,95 @@ function _toPrimitive(t, r) { if ("object" != typeof t || !t) return t; var e =
  */
 const UNTRUSTED_PACKAGE_NAMES = ['es5-ext', 'less', 'protobufjs', 'ssh', 'core-js-pure', 'core-js'];
 const installsRunning = {};
-const cafsLocker = new Map();
-async function createStoreController(options) {
-  const authConfig = (0, _pkgConfig().getAuthConfig)(options.registries);
-  const opts = {
-    dir: options.rootDir,
-    cacheDir: options.cacheDir,
-    cafsLocker,
-    storeDir: options.storeDir,
-    rawConfig: authConfig,
-    verifyStoreIntegrity: true,
-    httpProxy: options.proxyConfig?.httpProxy,
-    httpsProxy: options.proxyConfig?.httpsProxy,
-    ca: options.networkConfig?.ca,
-    cert: options.networkConfig?.cert,
-    key: options.networkConfig?.key,
-    localAddress: options.networkConfig?.localAddress,
-    noProxy: options.proxyConfig?.noProxy,
-    strictSsl: options.networkConfig.strictSSL,
-    maxSockets: options.networkConfig.maxSockets,
-    networkConcurrency: options.networkConfig.networkConcurrency,
-    packageImportMethod: options.packageImportMethod,
-    preferOffline: options.preferOffline,
-    resolveSymlinksInInjectedDirs: true,
-    pnpmHomeDir: options.pnpmHomeDir,
-    userAgent: options.networkConfig.userAgent,
-    fetchRetries: options.networkConfig.fetchRetries,
-    fetchRetryFactor: options.networkConfig.fetchRetryFactor,
-    fetchRetryMaxtimeout: options.networkConfig.fetchRetryMaxtimeout,
-    fetchRetryMintimeout: options.networkConfig.fetchRetryMintimeout,
-    fetchTimeout: options.networkConfig.fetchTimeout,
-    virtualStoreDirMaxLength: _dependenciesPnpm().VIRTUAL_STORE_DIR_MAX_LENGTH,
-    registries: options.registries.toMap(),
-    fetchWarnTimeoutMs: options.networkConfig.fetchWarnTimeoutMs,
-    fetchMinSpeedKiBps: options.networkConfig.fetchMinSpeedKiBps
+let lockfileFsPromise;
+function loadLockfileFs() {
+  lockfileFsPromise ??= (async () => {
+    const {
+      loadEsm
+    } = require('./load-pnpm-esm.cjs');
+    const {
+      lockfileFs
+    } = await loadEsm();
+    return lockfileFs;
+  })();
+  return lockfileFsPromise;
+}
+
+/**
+ * Minimal structural signature of the `resolve` function returned by
+ * `generateResolverAndFetcher`. It mirrors what the old
+ * `@pnpm/installing.client` `ResolveFunction` exposed, but is backed by
+ * `@pnpm/napi`'s `resolveDependency`.
+ */
+
+function toNodeApiProxyConfig(proxyConfig) {
+  return {
+    httpProxy: proxyConfig.httpProxy,
+    httpsProxy: proxyConfig.httpsProxy,
+    noProxy: proxyConfig.noProxy
+  };
+}
+function toNodeApiNetworkConfig(networkConfig) {
+  return {
+    ca: networkConfig.ca,
+    cert: networkConfig.cert,
+    key: networkConfig.key,
+    localAddress: networkConfig.localAddress,
+    strictSsl: networkConfig.strictSSL,
+    maxSockets: networkConfig.maxSockets,
+    networkConcurrency: networkConfig.networkConcurrency,
+    fetchRetries: networkConfig.fetchRetries,
+    fetchRetryFactor: networkConfig.fetchRetryFactor,
+    fetchRetryMintimeout: networkConfig.fetchRetryMintimeout,
+    fetchRetryMaxtimeout: networkConfig.fetchRetryMaxtimeout,
+    fetchTimeout: networkConfig.fetchTimeout,
+    userAgent: networkConfig.userAgent
   };
-  return (0, _storeConnectionManager().createOrConnectStoreController)(opts);
+}
+
+/**
+ * Pre-computed `Authorization` headers keyed by nerf-darted registry URI
+ * (plus `''` for the default registry) — the shape `@pnpm/napi` applies
+ * directly. Bit's registries model already carries ready-to-send header
+ * values (from the engine's `readConfig` plus Bit's own cloud token), so no
+ * npmrc-style credential round-trip is needed.
+ */
+function buildAuthHeaderByUri(registries) {
+  const result = {};
+  for (const registry of Object.values(registries.scopes)) {
+    if (registry.uri && registry.authHeaderValue) {
+      result[(0, _nerfDart().default)(registry.uri)] = registry.authHeaderValue;
+    }
+  }
+  const {
+    defaultRegistry
+  } = registries;
+  if (defaultRegistry?.authHeaderValue) {
+    if (defaultRegistry.uri) {
+      result[(0, _nerfDart().default)(defaultRegistry.uri)] = defaultRegistry.authHeaderValue;
+    }
+    result[''] = defaultRegistry.authHeaderValue;
+  }
+  return result;
+}
+
+/**
+ * Compose the list of read-package hooks into a single synchronous transform.
+ * The Bit hooks are all synchronous, so the accumulator stays synchronous even
+ * though the pnpm `ReadPackageHook` type allows returning a promise.
+ */
+function applyReadPackageHooks(hooks, manifest, workspaceDir) {
+  return hooks.reduce((m, hook) => hook(m, workspaceDir), manifest);
+}
+
+/**
+ * Feed a wire-compatible pnpm log event into the default reporter. The engine
+ * emits bunyan-shaped events; the reporter subscribes to `streamParser` via
+ * `.on('data', ...)`, so emitting a `data` event on the underlying stream
+ * delivers the event straight to the reporter.
+ */
+function emitLogEvent(event) {
+  _logger().streamParser.emit('data', event);
 }
 async function generateResolverAndFetcher({
   cacheDir,
@@ -208,66 +226,49 @@ async function generateResolverAndFetcher({
   fullMetadata
 }) {
   const pnpmConfig = await (0, _readConfig().readConfig)();
-  const authConfig = (0, _pkgConfig().getAuthConfig)(registries);
-  proxyConfig ??= {};
-  networkConfig ??= {};
-  const opts = {
-    authConfig: Object.assign({}, pnpmConfig.config.rawConfig, authConfig),
+  // The engine-resolved `.npmrc` headers first; Bit's own registries model
+  // (which carries the cloud token) wins on conflict.
+  const authHeaderByUri = _objectSpread(_objectSpread({}, pnpmConfig.config.authHeaderByUri), buildAuthHeaderByUri(registries));
+  const registriesMap = registries.toMap();
+  const resolve = (wantedDep, resolveOpts) => nodeApi().resolveDependency(wantedDep, {
+    dir: resolveOpts.projectDir || resolveOpts.lockfileDir || process.cwd(),
     cacheDir,
-    httpProxy: proxyConfig?.httpProxy,
-    httpsProxy: proxyConfig?.httpsProxy,
-    ca: networkConfig?.ca,
-    cert: networkConfig?.cert,
-    key: networkConfig?.key,
-    localAddress: networkConfig?.localAddress,
-    noProxy: proxyConfig?.noProxy,
-    strictSsl: networkConfig.strictSSL,
-    timeout: networkConfig.fetchTimeout,
-    rawConfig: pnpmConfig.config.rawConfig,
-    userAgent: networkConfig.userAgent,
-    retry: {
-      factor: networkConfig.fetchRetryFactor,
-      maxTimeout: networkConfig.fetchRetryMaxtimeout,
-      minTimeout: networkConfig.fetchRetryMintimeout,
-      retries: networkConfig.fetchRetries
-    },
-    registries: registries.toMap(),
-    fullMetadata,
-    fetchWarnTimeoutMs: networkConfig?.fetchWarnTimeoutMs,
-    fetchMinSpeedKiBps: networkConfig?.fetchMinSpeedKiBps
+    registries: registriesMap,
+    authHeaderByUri,
+    proxyConfig: proxyConfig ? toNodeApiProxyConfig(proxyConfig) : undefined,
+    networkConfig: networkConfig ? toNodeApiNetworkConfig(networkConfig) : undefined,
+    fullMetadata
+  });
+  return {
+    resolve
   };
-  const result = (0, _client().createClient)(opts);
-  return result;
 }
 async function getPeerDependencyIssues(manifestsByPaths, opts) {
-  const projects = [];
-  for (const [rootDir, manifest] of Object.entries(manifestsByPaths)) {
-    projects.push({
-      buildIndex: 0,
-      // this is not used while searching for peer issues anyway
-      manifest,
-      rootDir: rootDir
+  const projects = Object.entries(manifestsByPaths).map(([rootDir, manifest]) => ({
+    rootDir,
+    manifest: manifest
+  }));
+  try {
+    return await nodeApi().getPeerDependencyIssues({
+      dir: opts.rootDir,
+      projects,
+      storeDir: opts.storeDir,
+      cacheDir: opts.cacheDir,
+      overrides: opts.overrides,
+      peersSuffixMaxLength: 1000,
+      registries: opts.registries.toMap(),
+      authHeaderByUri: buildAuthHeaderByUri(opts.registries),
+      proxyConfig: toNodeApiProxyConfig(opts.proxyConfig),
+      networkConfig: toNodeApiNetworkConfig(opts.networkConfig),
+      virtualStoreDirMaxLength: _dependenciesPnpm().VIRTUAL_STORE_DIR_MAX_LENGTH
     });
+  } catch (err) {
+    throw (0, _pnpmErrorToBitError().pnpmErrorToBitError)(err);
   }
-  const storeController = await createStoreController(_objectSpread(_objectSpread({}, opts), {}, {
-    rootDir: opts.rootDir
-  }));
-  return pnpm().getPeerDependencyIssues(projects, {
-    autoInstallPeers: false,
-    excludeLinksFromLockfile: true,
-    storeController: storeController.ctrl,
-    storeDir: storeController.dir,
-    overrides: opts.overrides,
-    peersSuffixMaxLength: 1000,
-    registries: opts.registries.toMap(),
-    virtualStoreDirMaxLength: _dependenciesPnpm().VIRTUAL_STORE_DIR_MAX_LENGTH
-  });
 }
-async function install(rootDir, manifestsByPaths, storeDir, cacheDir, registries, proxyConfig = {}, networkConfig = {}, options,
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
-logger) {
+async function install(rootDir, manifestsByPaths, storeDir, cacheDir, registries, proxyConfig = {}, networkConfig = {}, options, logger) {
   const externalDependencies = new Set();
-  const readPackage = createReadPackageHooks(options);
+  const hooks = createReadPackageHooks(options);
   if (options?.rootComponents && !options?.rootComponentsForCapsules) {
     for (const [dir, {
       name
@@ -290,85 +291,118 @@ logger) {
       })
     });
   }
-  const {
-    allProjects,
-    packagesToBuild
-  } = groupPkgs(manifestsByPaths, {
-    update: options?.updateAll
-  });
-  const authConfig = (0, _pkgConfig().getAuthConfig)(registries);
-  const storeController = await createStoreController({
-    rootDir,
-    storeDir,
-    cacheDir,
-    registries,
-    preferOffline: options?.preferOffline,
-    proxyConfig,
-    networkConfig,
-    packageImportMethod: options?.packageImportMethod,
-    pnpmHomeDir: options?.pnpmHomeDir
-  });
   const hoistPattern = options.hoistPattern ?? ['*'];
   if (hoistPattern.length > 0 && externalDependencies.size > 0 && !options.hoistInjectedDependencies) {
     for (const pkgName of externalDependencies) {
       hoistPattern.push(`!${pkgName}`);
     }
   }
-  const opts = _objectSpread(_objectSpread(_objectSpread({
-    allProjects,
-    autoInstallPeers: options.autoInstallPeers,
-    autoInstallPeersFromHighestMatch: options.autoInstallPeers,
-    confirmModulesPurge: false,
-    storeDir: storeController.dir,
-    dedupePeerDependents: true,
+  const scriptPolicies = resolveScriptPolicies({
+    allowScripts: options.allowScripts,
+    dangerouslyAllowAllScripts: options.dangerouslyAllowAllScripts,
+    neverBuiltDependencies: options.neverBuiltDependencies
+  });
+
+  // The in-memory importer manifests are transformed up front (with each
+  // importer's own directory as workspaceDir). The dependency manifests are
+  // transformed lazily by the engine through the readPackageHook (which has no
+  // workspaceDir).
+  const projects = Object.entries(manifestsByPaths).map(([dir, manifest]) => ({
+    rootDir: dir,
+    manifest: applyReadPackageHooks(hooks, manifest, dir)
+  }));
+  // When the engine resolves a workspace project as a dependency (an injected
+  // "file:" instance), it hands the hook that project's importer manifest —
+  // which the up-front transform above already stripped of workspace-sibling
+  // deps. The instance must keep those deps (they become the component's graph
+  // edges), so substitute the project's raw manifest, identified by the
+  // lockfile-root-relative directory the engine passes for directory
+  // resolutions. pnpm's TS engine reaches the same split by keeping raw
+  // project manifests and applying the hook chain contextually.
+  const readPackageHookForDeps = (manifest, resolvedDir) => {
+    const rawManifest = resolvedDir ? manifestsByPaths[(0, _path().join)(rootDir, resolvedDir)] : undefined;
+    const resolvedManifest = applyReadPackageHooks(hooks, rawManifest ?? manifest);
+    return removeScriptsFromNeverBuiltPackages(resolvedManifest, scriptPolicies.neverBuildPackageNames);
+  };
+  const onLog = event => {
+    emitLogEvent(event);
+  };
+  const installOptions = {
     dir: rootDir,
-    storeController: storeController.ctrl,
-    preferFrozenLockfile: true,
-    pruneLockfileImporters: true,
-    lockfileOnly: options.lockfileOnly ?? false,
-    modulesCacheMaxAge: Infinity,
-    // pnpm should never prune the virtual store. Bit does it on its own.
+    projects,
+    storeDir,
+    cacheDir,
     registries: registries.toMap(),
-    resolutionMode: 'highest',
-    rawConfig: authConfig,
-    hooks: {
-      readPackage
-    },
-    externalDependencies,
-    strictPeerDependencies: false,
-    peersSuffixMaxLength: 1000,
-    resolveSymlinksInInjectedDirs: true,
-    resolvePeersFromWorkspaceRoot: true,
-    dedupeDirectDeps: true,
-    include: {
-      dependencies: true,
-      devDependencies: true,
-      optionalDependencies: options?.includeOptionalDeps !== false
-    },
-    userAgent: networkConfig.userAgent
-  }, options), {}, {
-    injectWorkspacePackages: true
-  }, resolveScriptPolicies({
-    allowScripts: options.allowScripts,
-    neverBuiltDependencies: options.neverBuiltDependencies,
-    dangerouslyAllowAllScripts: options.dangerouslyAllowAllScripts
-  })), {}, {
-    returnListOfDepsRequiringBuild: true,
-    excludeLinksFromLockfile: options.excludeLinksFromLockfile ?? true,
-    depth: options.updateAll ? Infinity : 0,
-    disableRelinkLocalDirDeps: true,
+    authHeaderByUri: buildAuthHeaderByUri(registries),
+    proxyConfig: toNodeApiProxyConfig(proxyConfig),
+    networkConfig: toNodeApiNetworkConfig(networkConfig),
+    overrides,
+    nodeLinker: options.nodeLinker,
+    // Resolve bare-semver deps on workspace components (incl. auto-installed
+    // peers naming a sibling component) from the workspace instead of the
+    // registry — otherwise an unpublished component peer 404s. `'deep'` so
+    // transitive component deps link locally too.
+    linkWorkspacePackages: 'deep',
     hoistPattern,
+    publicHoistPattern: options.publicHoistPattern,
+    externalDependencies: [...externalDependencies],
+    allowBuilds: scriptPolicies.allowBuilds,
+    dangerouslyAllowAllBuilds: scriptPolicies.dangerouslyAllowAllBuilds,
+    // `neverBuiltDependencies` is already folded into `allowBuilds` above by
+    // `resolveScriptPolicies`; the binding rejects a non-empty pass-through.
+    autoInstallPeers: options.autoInstallPeers,
+    excludeLinksFromLockfile: options.excludeLinksFromLockfile ?? true,
+    lockfileOnly: options.lockfileOnly ?? false,
+    packageImportMethod: options.packageImportMethod,
+    preferOffline: options.preferOffline,
     virtualStoreDirMaxLength: _dependenciesPnpm().VIRTUAL_STORE_DIR_MAX_LENGTH,
-    overrides,
+    peersSuffixMaxLength: 1000,
+    dedupePeerDependents: true,
+    dedupePeers: options.dedupePeers,
+    dedupeDirectDeps: true,
+    dedupeInjectedDeps: options.dedupeInjectedDeps,
+    injectWorkspacePackages: true,
+    includeOptionalDeps: options.includeOptionalDeps !== false,
+    // `update` re-resolves the whole graph; the binding ignores `depth` (there
+    // are no package selectors), but pass a finite full-depth value for parity
+    // with the old engine's `depth: Infinity` update-all call.
+    update: options.updateAll,
+    depth: options.updateAll ? 1000 : undefined,
+    nodeVersion: options.nodeVersion,
+    engineStrict: options.engineStrict,
+    // pnpm v12 defaults minimumReleaseAge to 1440 when the option is absent.
+    // bit.cloud packuments are huge (a version per snap) and their abbreviated
+    // form carries no `time` field, so the maturity cutoff forces a full-
+    // packument upgrade fetch for every component on a cold resolve. Disable
+    // the policy unless the workspace opts in.
+    minimumReleaseAge: options.minimumReleaseAge ?? 0,
+    minimumReleaseAgeExclude: options.minimumReleaseAgeExclude,
+    // Bit lockfiles are trusted workspace input. Keep installs compatible with
+    // lockfiles generated before pnpm v12 added registry resolution verification.
+    trustLockfile: true,
+    ignorePackageManifest: options.ignorePackageManifest,
+    hoistWorkspacePackages: options.hoistWorkspacePackages,
+    enableModulesDir: options.enableModulesDir,
+    resolvePeersFromWorkspaceRoot: true,
+    frozenLockfile: options.updateAll ? false : undefined,
+    preferFrozenLockfile: !options.updateAll,
+    // Suppress peer-dependency warnings by default (allow any version, ignore
+    // missing), letting the workspace's own rules override.
     peerDependencyRules: _objectSpread({
       allowAny: ['*'],
       ignoreMissing: ['*']
-    }, options.reportOptions?.peerDependencyRules)
-  });
+    }, options.reportOptions?.peerDependencyRules),
+    // Bit reports the deps requiring a build in the lockfile instead of failing.
+    strictDepBuilds: false,
+    pnpmHomeDir: options.pnpmHomeDir
+  };
   let dependenciesChanged = false;
   let depsRequiringBuild;
+  let resolvedStoreDir = storeDir;
   if (!options.dryRun) {
     let stopReporting;
+    let installPromise;
+    let restoreWantedLockfile;
     if (!options.hidePackageManagerOutput) {
       stopReporting = initReporter(_objectSpread(_objectSpread({}, options.reportOptions), {}, {
         hideAddedPkgsProgress: options.lockfileOnly
@@ -376,100 +410,134 @@ logger) {
     }
     try {
       await installsRunning[rootDir];
-      await (0, _worker().restartWorkerPool)();
-      installsRunning[rootDir] = (0, _core().mutateModules)(packagesToBuild, opts);
-      const installResult = await installsRunning[rootDir];
-      depsRequiringBuild = installResult.depsRequiringBuild?.sort();
-      if (depsRequiringBuild != null) {
-        await addDepsRequiringBuildToLockfile(rootDir, depsRequiringBuild);
+      // The engine rewrites pnpm-lock.yaml from its typed model, which
+      // does not round-trip Bit's `bit:` extension block (the v11 TS
+      // engine mutated the loaded object in place, so the block
+      // survived). Capture it up front and re-assert it after the
+      // install alongside `depsRequiringBuild`.
+      const preInstallBitAttrs = await readBitLockfileAttrs(rootDir);
+      restoreWantedLockfile = await removeWantedLockfileForUpdate(rootDir, options.updateAll);
+      // The extra `resolvedDir` param lands in `@pnpm/napi`'s ReadPackageHook
+      // type in the release that ships the directory-resolution context; the
+      // cast bridges the older published typing.
+      installPromise = nodeApi().install(installOptions, onLog, readPackageHookForDeps);
+      installsRunning[rootDir] = installPromise;
+      const installResult = await installPromise;
+      resolvedStoreDir = installResult.storeDir;
+      const sortedDepsRequiringBuild = [...(installResult.depsRequiringBuild ?? [])].sort();
+      if (sortedDepsRequiringBuild.length > 0 || preInstallBitAttrs != null) {
+        await addBitAttributesToLockfile(rootDir, _objectSpread(_objectSpread({}, preInstallBitAttrs), {}, {
+          depsRequiringBuild: sortedDepsRequiringBuild
+        }));
+      }
+      if (sortedDepsRequiringBuild.length > 0) {
+        depsRequiringBuild = sortedDepsRequiringBuild;
       }
       dependenciesChanged = installResult.stats.added + installResult.stats.removed + installResult.stats.linkedToRoot > 0;
-      delete installsRunning[rootDir];
     } catch (err) {
+      await restoreWantedLockfile?.();
       if (logger) {
-        logger.warn('got an error from pnpm mutateModules function', err);
+        logger.warn('got an error from the pnpm install function', err);
       }
       throw (0, _pnpmErrorToBitError().pnpmErrorToBitError)(err);
     } finally {
+      if (installPromise && installsRunning[rootDir] === installPromise) {
+        delete installsRunning[rootDir];
+      }
       stopReporting?.();
-      await (0, _worker().finishWorkers)();
     }
   }
   return {
     dependenciesChanged,
-    rebuild: async rebuildOpts => {
+    // The Rust engine's rebuild rebuilds every build-needing package and does not
+    // support the pending / skipIfHasSideEffectsCache selectors of the old engine.
+    rebuild: async () => {
       let stopReporting;
-      const _opts = _objectSpread(_objectSpread(_objectSpread({}, opts), rebuildOpts), {}, {
-        cacheDir
-      }); // eslint-disable-line @typescript-eslint/no-explicit-any
-      if (!_opts.hidePackageManagerOutput) {
+      if (!options.hidePackageManagerOutput) {
         stopReporting = initReporter({
           appendOnly: true,
           hideLifecycleOutput: true
         });
       }
       try {
-        await _pluginCommandsRebuild().rebuild.handler(_opts, []);
+        await nodeApi().rebuild(_objectSpread(_objectSpread({}, installOptions), {}, {
+          storeDir: resolvedStoreDir
+        }), onLog, undefined);
       } finally {
         stopReporting?.();
       }
     },
-    storeDir: storeController.dir,
+    storeDir: resolvedStoreDir ?? '',
     depsRequiringBuild
   };
 }
+async function removeWantedLockfileForUpdate(rootDir, updateAll) {
+  if (!updateAll) return undefined;
+  const lockfilePath = (0, _path().join)(rootDir, 'pnpm-lock.yaml');
+  let lockfileContent;
+  try {
+    lockfileContent = await _fs().promises.readFile(lockfilePath);
+  } catch (err) {
+    if (err?.code === 'ENOENT') return undefined;
+    throw err;
+  }
+  await _fs().promises.unlink(lockfilePath);
+  return async () => {
+    await _fs().promises.writeFile(lockfilePath, lockfileContent);
+  };
+}
 function resolveScriptPolicies({
   allowScripts,
-  neverBuiltDependencies,
-  dangerouslyAllowAllScripts
+  dangerouslyAllowAllScripts,
+  neverBuiltDependencies
 }) {
-  let resolvedNeverBuilt = neverBuiltDependencies;
-  let onlyBuiltDependencies;
-  let ignoredBuiltDependencies;
+  const allowBuilds = {};
   if (dangerouslyAllowAllScripts) {
-    if (resolvedNeverBuilt == null) {
-      // If neverBuiltDependencies is not explicitly set, use a default list
-      // we tell pnpm to allow all scripts to be executed, except the packages listed below.
-      resolvedNeverBuilt = ['core-js'];
+    if (!neverBuiltDependencies?.length) {
+      return {
+        allowBuilds,
+        dangerouslyAllowAllBuilds: true
+      };
     }
-  } else {
-    onlyBuiltDependencies = [];
-    ignoredBuiltDependencies = [];
-    for (const [packageDescriptor, allowedScript] of Object.entries(allowScripts ?? {})) {
-      switch (allowedScript) {
-        case true:
-          onlyBuiltDependencies.push(packageDescriptor);
-          break;
-        case false:
-          ignoredBuiltDependencies.push(packageDescriptor);
-          break;
-        default:
-          // Ignore any non-boolean values. String values are placeholders that the user
-          // should replace with booleans.
-          // pnpm will print a warning about these during installation.
-          break;
-      }
+    for (const pkg of neverBuiltDependencies) {
+      allowBuilds[pkg] = false;
     }
-    for (const trustedPkgName of _pluginTrustedDeps().TRUSTED_PACKAGE_NAMES) {
-      if (allowScripts?.[trustedPkgName] == null) {
-        onlyBuiltDependencies.push(trustedPkgName);
-      }
+    return {
+      allowBuilds,
+      neverBuildPackageNames: neverBuiltDependencies
+    };
+  }
+  for (const [packageDescriptor, allowedScript] of Object.entries(allowScripts ?? {})) {
+    if (allowedScript === true || allowedScript === false) {
+      allowBuilds[packageDescriptor] = allowedScript;
     }
-    // Add untrusted packages to ignoredBuiltDependencies unless the user explicitly allows them
-    for (const untrustedPkgName of UNTRUSTED_PACKAGE_NAMES) {
-      if (allowScripts?.[untrustedPkgName] !== true) {
-        ignoredBuiltDependencies.push(untrustedPkgName);
-      }
+    // String values (e.g. 'warn') are placeholders — ignore them; pnpm warns about these.
+  }
+  for (const trustedPkgName of _pluginTrustedDeps().TRUSTED_PACKAGE_NAMES) {
+    if (allowScripts?.[trustedPkgName] == null) {
+      allowBuilds[trustedPkgName] = true;
+    }
+  }
+  for (const untrustedPkgName of UNTRUSTED_PACKAGE_NAMES) {
+    if (allowScripts?.[untrustedPkgName] !== true) {
+      allowBuilds[untrustedPkgName] = false;
     }
   }
+  for (const pkg of neverBuiltDependencies ?? []) {
+    allowBuilds[pkg] = false;
+  }
   return {
-    neverBuiltDependencies: resolvedNeverBuilt,
-    onlyBuiltDependencies,
-    ignoredBuiltDependencies
+    allowBuilds
   };
 }
+function removeScriptsFromNeverBuiltPackages(manifest, neverBuildPackageNames) {
+  if (!manifest.name || !manifest.scripts || !neverBuildPackageNames?.includes(manifest.name)) return manifest;
+  return _objectSpread(_objectSpread({}, manifest), {}, {
+    scripts: undefined
+  });
+}
 function initReporter(opts) {
-  return (0, _defaultReporter().initDefaultReporter)({
+  return (0, _cli().initDefaultReporter)({
     context: {
       argv: [],
       process: opts?.process
@@ -565,9 +633,6 @@ function removeHarmonyFromDeps(pkg) {
  * For direct dependencies, Bit's linking is used.
  */
 function readPackageHook(pkg, workspaceDir) {
-  if (!pkg.dependencies) {
-    return pkg;
-  }
   // workspaceDir is set only for workspace packages
   if (workspaceDir && !workspaceDir.includes(_legacy().BIT_ROOTS_DIR)) {
     return readWorkspacePackageHook(pkg);
@@ -593,49 +658,6 @@ function readWorkspacePackageHook(pkg) {
     dependencies: _objectSpread(_objectSpread({}, pkg.peerDependencies), newDeps)
   });
 }
-function groupPkgs(manifestsByPaths, opts) {
-  const pkgs = Object.entries(manifestsByPaths).map(([rootDir, manifest]) => ({
-    rootDir: rootDir,
-    manifest
-  }));
-  const {
-    graph
-  } = (0, _workspace().createPkgGraph)(pkgs);
-  const chunks = (0, _sortPackages().sortPackages)(graph);
-
-  // This will create local link by pnpm to a component exists in the ws.
-  // it will later deleted by the link process
-  // we keep it here to better support case like this:
-  // compA@1.0.0 uses compB@1.0.0
-  // I have compB@2.0.0 in my workspace
-  // now I install compA@1.0.0
-  // compA is hoisted to the root and install B@1.0.0 hoisted to the root as well
-  // now we will make link to B@2.0.0 and A will break
-  // with this we will have a link to the local B by pnpm so it will install B@1.0.0 inside A
-  // then when overriding the link, A will still works
-  // This is the rational behind not deleting this completely, but need further check that it really works
-  const packagesToBuild = []; // @pnpm/core will use this to install the packages
-  const allProjects = [];
-  chunks.forEach((dirs, buildIndex) => {
-    for (const rootDir of dirs) {
-      const manifest = manifestsByPaths[rootDir];
-      allProjects.push({
-        buildIndex,
-        manifest,
-        rootDir
-      });
-      packagesToBuild.push({
-        rootDir,
-        mutation: 'install',
-        update: opts.update
-      });
-    }
-  });
-  return {
-    packagesToBuild,
-    allProjects
-  };
-}
 async function resolveRemoteVersion(packageName, {
   rootDir,
   cacheDir,
@@ -663,20 +685,23 @@ async function resolveRemoteVersion(packageName, {
     const parsedPackage = (0, _parsePackageName().default)(packageName);
     const wantedDep = {
       alias: parsedPackage.name,
-      bareSpecifier: parsedPackage.version
+      // parse-package-name returns an empty string when no version is present,
+      // but the engine resolves only undefined (or an explicit range) as "latest".
+      bareSpecifier: parsedPackage.version || undefined
     };
     const val = await resolve(wantedDep, resolveOpts);
     if (!val.manifest) {
       throw new (_bitError().BitError)('The resolved package has no manifest');
     }
+    const manifest = val.manifest;
     const wantedRange = parsedPackage.version && _semver().default.validRange(parsedPackage.version) ? parsedPackage.version : undefined;
     return {
-      packageName: val.manifest.name,
-      version: val.manifest.version,
+      packageName: manifest.name,
+      version: manifest.version,
       wantedRange,
       isSemver: true,
       resolvedVia: val.resolvedVia,
-      manifest: val.manifest
+      manifest
     };
   } catch (e) {
     if (!e.message?.includes('is not a valid string')) {
@@ -694,25 +719,56 @@ async function resolveRemoteVersion(packageName, {
     if (!val.normalizedBareSpecifier) {
       throw new (_bitError().BitError)('The resolved package has no version');
     }
+    const manifest = val.manifest;
     return {
-      packageName: val.manifest.name,
+      packageName: manifest.name,
       version: val.normalizedBareSpecifier,
       isSemver: false,
       resolvedVia: val.resolvedVia,
-      manifest: val.manifest
+      manifest
     };
   }
 }
-async function addDepsRequiringBuildToLockfile(rootDir, depsRequiringBuild) {
-  const lockfile = await (0, _lockfile().readWantedLockfile)(rootDir, {
+
+/**
+ * Read the `bit:` extension block of the workspace's wanted lockfile,
+ * or undefined when there is no lockfile or no block.
+ */
+async function readBitLockfileAttrs(rootDir) {
+  try {
+    const {
+      readWantedLockfile
+    } = await loadLockfileFs();
+    const lockfile = await readWantedLockfile(rootDir, {
+      ignoreIncompatible: true
+    });
+    return lockfile?.bit;
+  } catch {
+    // A malformed lockfile fails the install itself later with a proper
+    // error; there is nothing to preserve here.
+    return undefined;
+  }
+}
+
+/**
+ * Re-assert Bit's `bit:` extension block on the wanted lockfile after
+ * an engine install rewrote it. Merges over whatever the file has, so
+ * an attribute captured before the install (e.g. `restoredFromModel`)
+ * survives the rewrite.
+ */
+async function addBitAttributesToLockfile(rootDir, attrs) {
+  const {
+    readWantedLockfile,
+    writeWantedLockfile
+  } = await loadLockfileFs();
+  const lockfile = await readWantedLockfile(rootDir, {
     ignoreIncompatible: true
   });
   if (lockfile == null) return;
-  if ((0, _lodash().isEqual)(lockfile.bit?.depsRequiringBuild, depsRequiringBuild)) return;
-  lockfile.bit = _objectSpread(_objectSpread({}, lockfile.bit), {}, {
-    depsRequiringBuild
-  });
-  await (0, _lockfile().writeWantedLockfile)(rootDir, lockfile);
+  const merged = _objectSpread(_objectSpread({}, lockfile.bit), attrs);
+  if ((0, _lodash().isEqual)(lockfile.bit, merged)) return;
+  lockfile.bit = merged;
+  await writeWantedLockfile(rootDir, lockfile);
 }
 
 //# sourceMappingURL=lynx.js.map