app-builder-lib 27.0.0-alpha.1 → 27.0.0-alpha.3

package/dist/node-module-collector/packageManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"packageManager.js","sourceRoot":"","sources":["../../src/node-module-collector/packageManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAAE,MAAM,UAAU,CAAA;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAE9B,MAAM,CAAN,IAAY,EAOX;AAPD,WAAY,EAAE;IACZ,mBAAa,CAAA;IACb,mBAAa,CAAA;IACb,+BAAyB,CAAA;IACzB,iBAAW,CAAA;IACX,iBAAW,CAAA;IACX,6BAAuB,CAAA;AACzB,CAAC,EAPW,EAAE,KAAF,EAAE,QAOb;AAED,2BAA2B;AAC3B,MAAM,WAAW,GAA0C;IACzD,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,SAAS;IACnB,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS;IACpB,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS;IACpB,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,SAAS;IAC1B,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,SAAS;IACnB,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,SAAS;CAC1B,CAAA;AAED,SAAS,cAAc,CAAC,EAAM;IAC5B,MAAM,QAAQ,GAAG,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IAEnD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,IAAI,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,OAAO,QAAQ,CAAA;IACjB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,EAAM;IAC7C,IAAI,WAAW,CAAC,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,WAAW,CAAC,EAAE,CAAE,CAAA;IACzB,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,CAAA;IACnC,WAAW,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAA;IAC1B,OAAO,QAAQ,CAAA;AACjB,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,WAAqB;IAC9D,IAAI,EAAE,GAAc,IAAI,CAAA;IACxB,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAA,CAAC,wFAAwF;IAE9I,MAAM,aAAa,GAAG,CAAC,EAAM,EAAE,OAAe,EAAE,GAAW,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAErH,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;QACtD,MAAM,cAAc,GAAG,CAAC,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,SAAS,CAAA;QACjI,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC/C,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAQ,CAAC,EAAE,CAAC;gBACzC,MAAM,sBAAsB,GAAG,MAAM,aAAa,CAAC,EAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;gBAC1E,OAAO,EAAE,EAAE,EAAE,sBAAsB,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,GAAG,EAAE,eAAe,EAAE,sBAAsB,EAAE,CAAA;YACxI,CAAC;QACH,CAAC;QAED,EAAE,GAAG,MAAM,0BAA0B,CAAC,GAAG,CAAC,CAAA;QAC1C,IAAI,EAAE,EAAE,CAAC;YACP,MAAM,sBAAsB,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;YAC/D,OAAO,EAAE,EAAE,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE,CAAA;QACxH,CAAC;IACH,CAAC;IAED,EAAE,GAAG,yBAAyB,EAAE,IAAI,EAAE,CAAC,GAAG,CAAA;IAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/H,MAAM,sBAAsB,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;IAC/D,GAAG,CAAC,IAAI,CAAC,EAAE,sBAAsB,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,4EAA4E,CAAC,CAAA;IACjI,OAAO,EAAE,EAAE,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAA;AACxI,CAAC;AAED,SAAS,yBAAyB;IAChC,MAAM,iBAAiB,GAAG,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IAEvJ,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,CAAA;IAChE,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;gBAChB,OAAO,EAAE,CAAA;YACX,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,GAAW;IACnD,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAA;IAE1D,MAAM,QAAQ,GAAS,EAAE,CAAA;IACzB,IAAI,MAAM,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;IACD,IAAI,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAA;IACpB,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,OAAe;IACzD,MAAM,UAAU,GAAG,GAAG,EAAE;QACtB,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,OAAO,EAAE,CAAC,UAAU,CAAA;YACtB,CAAC;QACH,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,iDAAiD,CAAC,CAAA;YAC/E,iIAAiI;QACnI,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;IAED,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QAChD,OAAO,EAAE,CAAC,UAAU,CAAA;IACtB,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,UAAU,EAAE,IAAI,EAAE,CAAC,IAAI,CAAA;IAChC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;IAC5C,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC9B,OAAO,UAAU,EAAE,IAAI,EAAE,CAAC,IAAI,CAAA;IAChC,CAAC;IACD,iEAAiE;IACjE,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAE5F,0DAA0D;IAC1D,IAAI,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,CAAC,UAAU,CAAA;IACtB,CAAC;IAED,0DAA0D;IAC1D,IAAI,UAAU,CAAC,QAAQ,CAAC,iCAAiC,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,CAAC,IAAI,CAAA;IAChB,CAAC;IAED,OAAO,UAAU,EAAE,IAAI,EAAE,CAAC,IAAI,CAAA;AAChC,CAAC","sourcesContent":["import { exists, log } from \"builder-util\"\nimport fs from \"fs-extra\"\nimport * as path from \"path\"\nimport * as which from \"which\"\n\nexport enum PM {\n  PNPM = \"pnpm\",\n  YARN = \"yarn\",\n  YARN_BERRY = \"yarn-berry\",\n  BUN = \"bun\",\n  NPM = \"npm\",\n  TRAVERSAL = \"traversal\",\n}\n\n// Cache for resolved paths\nconst pmPathCache: Record<PM, string | null | undefined> = {\n  [PM.NPM]: undefined,\n  [PM.YARN]: undefined,\n  [PM.PNPM]: undefined,\n  [PM.YARN_BERRY]: undefined,\n  [PM.BUN]: undefined,\n  [PM.TRAVERSAL]: undefined,\n}\n\nfunction resolveCommand(pm: PM): string {\n  const fallback = pm === PM.YARN_BERRY ? \"yarn\" : pm\n\n  if (process.platform !== \"win32\") {\n    return fallback\n  }\n\n  try {\n    return which.sync(fallback)\n  } catch {\n    // If `which` fails (not found), still return the fallback string\n    return fallback\n  }\n}\n\nexport function getPackageManagerCommand(pm: PM) {\n  if (pmPathCache[pm] !== undefined) {\n    return pmPathCache[pm]!\n  }\n\n  const resolved = resolveCommand(pm)\n  pmPathCache[pm] = resolved\n  return resolved\n}\n\ntype PackageManagerSetup = {\n  pm: PM\n  corepackConfig: string | undefined\n  resolvedDirectory: string | undefined\n  detectionMethod: string\n}\n\nexport async function detectPackageManager(searchPaths: string[]): Promise<PackageManagerSetup> {\n  let pm: PM | null = null\n  const dedupedPaths = Array.from(new Set(searchPaths)) // reduce file operations, dedupe paths since primary use case has projectDir === appDir\n\n  const resolveIfYarn = (pm: PM, version: string, cwd: string) => (pm === PM.YARN ? detectYarnBerry(cwd, version) : pm)\n\n  for (const dir of dedupedPaths) {\n    const packageJsonPath = path.join(dir, \"package.json\")\n    const packageManager = (await exists(packageJsonPath)) ? (await fs.readJson(packageJsonPath, \"utf8\"))?.packageManager : undefined\n    if (packageManager) {\n      const [pm, version] = packageManager.split(\"@\")\n      if (Object.values(PM).includes(pm as PM)) {\n        const resolvedPackageManager = await resolveIfYarn(pm as PM, version, dir)\n        return { pm: resolvedPackageManager, corepackConfig: packageManager, resolvedDirectory: dir, detectionMethod: \"packageManager field\" }\n      }\n    }\n\n    pm = await detectPackageManagerByFile(dir)\n    if (pm) {\n      const resolvedPackageManager = await resolveIfYarn(pm, \"\", dir)\n      return { pm: resolvedPackageManager, resolvedDirectory: dir, corepackConfig: undefined, detectionMethod: \"lock file\" }\n    }\n  }\n\n  pm = detectPackageManagerByEnv() || PM.NPM\n  const cwd = process.env.npm_package_json ? path.dirname(process.env.npm_package_json) : (process.env.INIT_CWD ?? process.cwd())\n  const resolvedPackageManager = await resolveIfYarn(pm, \"\", cwd)\n  log.info({ resolvedPackageManager, detected: cwd }, \"packageManager not detected by file, falling back to environment detection\")\n  return { pm: resolvedPackageManager, resolvedDirectory: undefined, corepackConfig: undefined, detectionMethod: \"process environment\" }\n}\n\nfunction detectPackageManagerByEnv(): PM | null {\n  const priorityChecklist = [(key: string) => process.env.npm_config_user_agent?.includes(key), (key: string) => process.env.npm_execpath?.includes(key)]\n\n  const pms = Object.values(PM).filter(pm => pm !== PM.YARN_BERRY)\n  for (const checker of priorityChecklist) {\n    for (const pm of pms) {\n      if (checker(pm)) {\n        return pm\n      }\n    }\n  }\n  return null\n}\n\nasync function detectPackageManagerByFile(dir: string): Promise<PM | null> {\n  const has = (file: string) => exists(path.join(dir, file))\n\n  const detected: PM[] = []\n  if (await has(\"yarn.lock\")) {\n    detected.push(PM.YARN)\n  }\n  if (await has(\"pnpm-lock.yaml\")) {\n    detected.push(PM.PNPM)\n  }\n  if (await has(\"package-lock.json\")) {\n    detected.push(PM.NPM)\n  }\n  if ((await has(\"bun.lock\")) || (await has(\"bun.lockb\"))) {\n    detected.push(PM.BUN)\n  }\n\n  if (detected.length === 1) {\n    return detected[0]\n  }\n\n  return null\n}\n\nasync function detectYarnBerry(cwd: string, version: string): Promise<PM.YARN | PM.YARN_BERRY> {\n  const checkBerry = () => {\n    try {\n      if (parseInt(version.split(\".\")[0]) > 1) {\n        return PM.YARN_BERRY\n      }\n    } catch (_error) {\n      log.debug({ error: _error }, \"cannot determine yarn version, assuming yarn v1\")\n      // If `yarn` is not found or another error occurs, fall back to the regular Yarn since we're already determined in a Yarn project\n    }\n    return undefined\n  }\n\n  if (version === \"latest\" || version === \"berry\") {\n    return PM.YARN_BERRY\n  }\n\n  if (version.length > 0) {\n    return checkBerry() ?? PM.YARN\n  }\n\n  const lockPath = path.join(cwd, \"yarn.lock\")\n  if (!(await exists(lockPath))) {\n    return checkBerry() ?? PM.YARN\n  }\n  // Read the first few lines of yarn.lock to determine the version\n  const firstBytes = (await fs.readFile(lockPath, \"utf8\")).split(\"\\n\").slice(0, 10).join(\"\\n\")\n\n  // Yarn v2+ (Berry) has a \"__metadata:\" block near the top\n  if (firstBytes.includes(\"__metadata:\")) {\n    return PM.YARN_BERRY\n  }\n\n  // Yarn v1 format is classic semi-YAML with comment header\n  if (firstBytes.includes(\"DO NOT EDIT THIS FILE DIRECTLY.\")) {\n    return PM.YARN\n  }\n\n  return checkBerry() ?? PM.YARN\n}\n"]}
+{"version":3,"file":"packageManager.js","sourceRoot":"","sources":["../../src/node-module-collector/packageManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAAE,MAAM,UAAU,CAAA;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,MAAM,CAAN,IAAY,EAOX;AAPD,WAAY,EAAE;IACZ,mBAAa,CAAA;IACb,mBAAa,CAAA;IACb,+BAAyB,CAAA;IACzB,iBAAW,CAAA;IACX,iBAAW,CAAA;IACX,6BAAuB,CAAA;AACzB,CAAC,EAPW,EAAE,KAAF,EAAE,QAOb;AAED,2BAA2B;AAC3B,MAAM,WAAW,GAA0C;IACzD,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,SAAS;IACnB,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS;IACpB,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS;IACpB,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,SAAS;IAC1B,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,SAAS;IACnB,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,SAAS;CAC1B,CAAA;AAED,SAAS,cAAc,CAAC,EAAM;IAC5B,MAAM,QAAQ,GAAG,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IAEnD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,IAAI,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,OAAO,QAAQ,CAAA;IACjB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,EAAM;IAC7C,IAAI,WAAW,CAAC,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,WAAW,CAAC,EAAE,CAAE,CAAA;IACzB,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,CAAA;IACnC,WAAW,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAA;IAC1B,OAAO,QAAQ,CAAA;AACjB,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,WAAqB;IAC9D,IAAI,EAAE,GAAc,IAAI,CAAA;IACxB,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAA,CAAC,wFAAwF;IAE9I,MAAM,aAAa,GAAG,CAAC,EAAM,EAAE,OAAe,EAAE,GAAW,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAErH,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;QACtD,MAAM,cAAc,GAAG,CAAC,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,SAAS,CAAA;QACjI,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC/C,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAQ,CAAC,EAAE,CAAC;gBACzC,MAAM,sBAAsB,GAAG,MAAM,aAAa,CAAC,EAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;gBAC1E,OAAO,EAAE,EAAE,EAAE,sBAAsB,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,GAAG,EAAE,eAAe,EAAE,sBAAsB,EAAE,CAAA;YACxI,CAAC;QACH,CAAC;QAED,EAAE,GAAG,MAAM,0BAA0B,CAAC,GAAG,CAAC,CAAA;QAC1C,IAAI,EAAE,EAAE,CAAC;YACP,MAAM,sBAAsB,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;YAC/D,OAAO,EAAE,EAAE,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE,CAAA;QACxH,CAAC;IACH,CAAC;IAED,EAAE,GAAG,yBAAyB,EAAE,IAAI,EAAE,CAAC,GAAG,CAAA;IAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/H,MAAM,sBAAsB,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;IAC/D,GAAG,CAAC,IAAI,CAAC,EAAE,sBAAsB,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,4EAA4E,CAAC,CAAA;IACjI,OAAO,EAAE,EAAE,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAA;AACxI,CAAC;AAED,SAAS,yBAAyB;IAChC,MAAM,iBAAiB,GAAG,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IAEvJ,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,CAAA;IAChE,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;gBAChB,OAAO,EAAE,CAAA;YACX,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,GAAW;IACnD,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAA;IAE1D,MAAM,QAAQ,GAAS,EAAE,CAAA;IACzB,IAAI,MAAM,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;IACD,IAAI,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAA;IACpB,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,OAAe;IACzD,MAAM,UAAU,GAAG,GAAG,EAAE;QACtB,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,OAAO,EAAE,CAAC,UAAU,CAAA;YACtB,CAAC;QACH,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,iDAAiD,CAAC,CAAA;YAC/E,iIAAiI;QACnI,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;IAED,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QAChD,OAAO,EAAE,CAAC,UAAU,CAAA;IACtB,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,UAAU,EAAE,IAAI,EAAE,CAAC,IAAI,CAAA;IAChC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;IAC5C,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC9B,OAAO,UAAU,EAAE,IAAI,EAAE,CAAC,IAAI,CAAA;IAChC,CAAC;IACD,iEAAiE;IACjE,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAE5F,0DAA0D;IAC1D,IAAI,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,CAAC,UAAU,CAAA;IACtB,CAAC;IAED,0DAA0D;IAC1D,IAAI,UAAU,CAAC,QAAQ,CAAC,iCAAiC,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,CAAC,IAAI,CAAA;IAChB,CAAC;IAED,OAAO,UAAU,EAAE,IAAI,EAAE,CAAC,IAAI,CAAA;AAChC,CAAC","sourcesContent":["import { exists, log } from \"builder-util\"\nimport fs from \"fs-extra\"\nimport * as path from \"path\"\nimport which from \"which\"\n\nexport enum PM {\n  PNPM = \"pnpm\",\n  YARN = \"yarn\",\n  YARN_BERRY = \"yarn-berry\",\n  BUN = \"bun\",\n  NPM = \"npm\",\n  TRAVERSAL = \"traversal\",\n}\n\n// Cache for resolved paths\nconst pmPathCache: Record<PM, string | null | undefined> = {\n  [PM.NPM]: undefined,\n  [PM.YARN]: undefined,\n  [PM.PNPM]: undefined,\n  [PM.YARN_BERRY]: undefined,\n  [PM.BUN]: undefined,\n  [PM.TRAVERSAL]: undefined,\n}\n\nfunction resolveCommand(pm: PM): string {\n  const fallback = pm === PM.YARN_BERRY ? \"yarn\" : pm\n\n  if (process.platform !== \"win32\") {\n    return fallback\n  }\n\n  try {\n    return which.sync(fallback)\n  } catch {\n    // If `which` fails (not found), still return the fallback string\n    return fallback\n  }\n}\n\nexport function getPackageManagerCommand(pm: PM) {\n  if (pmPathCache[pm] !== undefined) {\n    return pmPathCache[pm]!\n  }\n\n  const resolved = resolveCommand(pm)\n  pmPathCache[pm] = resolved\n  return resolved\n}\n\ntype PackageManagerSetup = {\n  pm: PM\n  corepackConfig: string | undefined\n  resolvedDirectory: string | undefined\n  detectionMethod: string\n}\n\nexport async function detectPackageManager(searchPaths: string[]): Promise<PackageManagerSetup> {\n  let pm: PM | null = null\n  const dedupedPaths = Array.from(new Set(searchPaths)) // reduce file operations, dedupe paths since primary use case has projectDir === appDir\n\n  const resolveIfYarn = (pm: PM, version: string, cwd: string) => (pm === PM.YARN ? detectYarnBerry(cwd, version) : pm)\n\n  for (const dir of dedupedPaths) {\n    const packageJsonPath = path.join(dir, \"package.json\")\n    const packageManager = (await exists(packageJsonPath)) ? (await fs.readJson(packageJsonPath, \"utf8\"))?.packageManager : undefined\n    if (packageManager) {\n      const [pm, version] = packageManager.split(\"@\")\n      if (Object.values(PM).includes(pm as PM)) {\n        const resolvedPackageManager = await resolveIfYarn(pm as PM, version, dir)\n        return { pm: resolvedPackageManager, corepackConfig: packageManager, resolvedDirectory: dir, detectionMethod: \"packageManager field\" }\n      }\n    }\n\n    pm = await detectPackageManagerByFile(dir)\n    if (pm) {\n      const resolvedPackageManager = await resolveIfYarn(pm, \"\", dir)\n      return { pm: resolvedPackageManager, resolvedDirectory: dir, corepackConfig: undefined, detectionMethod: \"lock file\" }\n    }\n  }\n\n  pm = detectPackageManagerByEnv() || PM.NPM\n  const cwd = process.env.npm_package_json ? path.dirname(process.env.npm_package_json) : (process.env.INIT_CWD ?? process.cwd())\n  const resolvedPackageManager = await resolveIfYarn(pm, \"\", cwd)\n  log.info({ resolvedPackageManager, detected: cwd }, \"packageManager not detected by file, falling back to environment detection\")\n  return { pm: resolvedPackageManager, resolvedDirectory: undefined, corepackConfig: undefined, detectionMethod: \"process environment\" }\n}\n\nfunction detectPackageManagerByEnv(): PM | null {\n  const priorityChecklist = [(key: string) => process.env.npm_config_user_agent?.includes(key), (key: string) => process.env.npm_execpath?.includes(key)]\n\n  const pms = Object.values(PM).filter(pm => pm !== PM.YARN_BERRY)\n  for (const checker of priorityChecklist) {\n    for (const pm of pms) {\n      if (checker(pm)) {\n        return pm\n      }\n    }\n  }\n  return null\n}\n\nasync function detectPackageManagerByFile(dir: string): Promise<PM | null> {\n  const has = (file: string) => exists(path.join(dir, file))\n\n  const detected: PM[] = []\n  if (await has(\"yarn.lock\")) {\n    detected.push(PM.YARN)\n  }\n  if (await has(\"pnpm-lock.yaml\")) {\n    detected.push(PM.PNPM)\n  }\n  if (await has(\"package-lock.json\")) {\n    detected.push(PM.NPM)\n  }\n  if ((await has(\"bun.lock\")) || (await has(\"bun.lockb\"))) {\n    detected.push(PM.BUN)\n  }\n\n  if (detected.length === 1) {\n    return detected[0]\n  }\n\n  return null\n}\n\nasync function detectYarnBerry(cwd: string, version: string): Promise<PM.YARN | PM.YARN_BERRY> {\n  const checkBerry = () => {\n    try {\n      if (parseInt(version.split(\".\")[0]) > 1) {\n        return PM.YARN_BERRY\n      }\n    } catch (_error) {\n      log.debug({ error: _error }, \"cannot determine yarn version, assuming yarn v1\")\n      // If `yarn` is not found or another error occurs, fall back to the regular Yarn since we're already determined in a Yarn project\n    }\n    return undefined\n  }\n\n  if (version === \"latest\" || version === \"berry\") {\n    return PM.YARN_BERRY\n  }\n\n  if (version.length > 0) {\n    return checkBerry() ?? PM.YARN\n  }\n\n  const lockPath = path.join(cwd, \"yarn.lock\")\n  if (!(await exists(lockPath))) {\n    return checkBerry() ?? PM.YARN\n  }\n  // Read the first few lines of yarn.lock to determine the version\n  const firstBytes = (await fs.readFile(lockPath, \"utf8\")).split(\"\\n\").slice(0, 10).join(\"\\n\")\n\n  // Yarn v2+ (Berry) has a \"__metadata:\" block near the top\n  if (firstBytes.includes(\"__metadata:\")) {\n    return PM.YARN_BERRY\n  }\n\n  // Yarn v1 format is classic semi-YAML with comment header\n  if (firstBytes.includes(\"DO NOT EDIT THIS FILE DIRECTLY.\")) {\n    return PM.YARN\n  }\n\n  return checkBerry() ?? PM.YARN\n}\n"]}

package/dist/node-module-collector/pnpmNodeModulesCollector.d.ts

@@ -1,6 +1,7 @@
+import { Lazy } from "lazy-val";
 import { NodeModulesCollector } from "./nodeModulesCollector.js";
 import { PM } from "./packageManager.js";
-import { PnpmDependency } from "./types.js";
+import type { PnpmDependency } from "./types.js";
 export declare class PnpmNodeModulesCollector extends NodeModulesCollector<PnpmDependency, PnpmDependency> {
     readonly installOptions: {
         manager: PM;
@@ -9,6 +10,21 @@ export declare class PnpmNodeModulesCollector extends NodeModulesCollector<PnpmD
     private _allWorkspacePackages;
     private _pnpmMajorVersion;
     private readonly pnpmVersion;
+    /**
+     * Detect pnpm's installed layout from the on-disk structure rather than `pnpm config list`.
+     * pnpm 11 no longer echoes `node-linker` (from `.npmrc`) in `config list`, so the base-class
+     * config-parsing detection silently reports "not hoisted" for a hoisted install, which would
+     * disable the downward search needed to find version-conflicted nested deps.
+     *
+     * In the default isolated store every regular top-level package resolves — through a symlink
+     * on POSIX, a junction on Windows — into `node_modules/.pnpm/<name>@<ver>/node_modules/<name>`.
+     * In a hoisted layout the same package is a real directory directly under `node_modules`.
+     * `realpath` transparently follows both symlinks and junctions, so a layout is isolated iff
+     * *any* top-level package's real path routes through `.pnpm`. We scan rather than sample the
+     * first entry because `link:` packages resolve to their source (never under `.pnpm`) and could
+     * otherwise mask an isolated store.
+     */
+    protected isHoisted: Lazy<boolean>;
     /**
      * Memo for `locateFromDepOrRoot`, keyed by `name@version`. pnpm's content-addressed virtual
      * store guarantees that any given `name@version` resolves to a single location on disk, so
@@ -22,6 +38,9 @@ export declare class PnpmNodeModulesCollector extends NodeModulesCollector<PnpmD
      * every shared subtree of the pnpm list output, exploding work in deep workspaces.
      */
     private readonly collectedDeps;
+    /** Reverse index of `allDependencies` keyed by package name (without version). Built once on
+     *  first access inside `extractProductionDependencyGraph`, after `allDependencies` is settled. */
+    private _allDepsByName;
     /**
      * Returns the workspace packages to iterate over, gated by detected pnpm version:
      * - pnpm v11+: multi-entry workspace output → return the full parsed array
@@ -29,6 +48,7 @@ export declare class PnpmNodeModulesCollector extends NodeModulesCollector<PnpmD
      */
     private get allWorkspacePackages();
     protected getArgs(): string[];
+    private getAllDepsByName;
     /**
      * Locate a package version, preferring the dep's own reported path before falling back to rootDir.
      * This is critical for pnpm non-hoisted (virtual store) setups where each package has its own
@@ -38,7 +58,34 @@ export declare class PnpmNodeModulesCollector extends NodeModulesCollector<PnpmD
     private locateFromDepOrRoot;
     protected extractProductionDependencyGraph(tree: PnpmDependency, dependencyId: string): Promise<void>;
     protected collectAllDependencies(_tree: PnpmDependency, _appPackageName: string): Promise<void>;
+    /**
+     * Resolve a `link:` dependency to its real on-disk source directory — never the `node_modules`
+     * junction pnpm creates for it. Returns null for non-link deps.
+     *
+     * Why this matters: resolving a link: dep through `node_modules` (locateFromDepOrRoot) yields the
+     * junction, which CI cannot read across drives. CI checks out the repo on `D:` but installs the
+     * app under `C:\…\Temp`, so the junction is a cross-volume link that `realpath`/`stat` fail on,
+     * silently dropping the package from the asar. The link target is a plain directory that reads
+     * fine from any drive, so we resolve straight to it.
+     */
+    private resolveLinkTarget;
+    private readPackageJsonAt;
+    /**
+     * Visit a single dependency node, adding it and its transitive deps to allDependencies.
+     *
+     * For packages that pnpm list did NOT expand (link: packages and the synthetic entries
+     * derived from them), the tree has empty dependencies/optionalDependencies. In that case
+     * we fall back to the on-disk package.json to discover transitive deps, resolving each one
+     * from the package's own node_modules first (where pnpm placed them).
+     */
+    private visitDep;
     private collectDepsRecursively;
+    /**
+     * pnpm excludes link: packages from `pnpm list --prod` output. Read the app's package.json
+     * directly to find any link: deps that were silently omitted and visit them so their
+     * transitive deps end up in allDependencies.
+     */
+    private collectOmittedLinkPackages;
     protected getTreeFromWorkspaces(tree: PnpmDependency, packageName: string): PnpmDependency;
     protected parseDependenciesTree(jsonBlob: string): Promise<PnpmDependency>;
 }

package/dist/node-module-collector/pnpmNodeModulesCollector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pnpmNodeModulesCollector.d.ts","sourceRoot":"","sources":["../../src/node-module-collector/pnpmNodeModulesCollector.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAA4B,EAAE,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE3C,qBAAa,wBAAyB,SAAQ,oBAAoB,CAAC,cAAc,EAAE,cAAc,CAAC;IAChG,SAAgB,cAAc;;;MAG7B;IAGD,OAAO,CAAC,qBAAqB,CAAuB;IAEpD,OAAO,CAAC,iBAAiB,CAAI;IAE7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAI1B;IAEF;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkD;IAE7E;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAyB;IAEvD;;;;OAIG;IACH,OAAO,KAAK,oBAAoB,GAK/B;IAED,SAAS,CAAC,OAAO,IAAI,MAAM,EAAE;IAI7B;;;;;OAKG;YACW,mBAAmB;cAqCjB,gCAAgC,CAAC,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM;cAsD3E,sBAAsB,CAAC,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAMvF,sBAAsB;cAyBjB,qBAAqB,CAAC,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,GAAG,cAAc;cAYnF,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;CAMjF"}
+{"version":3,"file":"pnpmNodeModulesCollector.d.ts","sourceRoot":"","sources":["../../src/node-module-collector/pnpmNodeModulesCollector.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAG/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAA4B,EAAE,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,KAAK,EAAe,cAAc,EAAE,MAAM,YAAY,CAAA;AAG7D,qBAAa,wBAAyB,SAAQ,oBAAoB,CAAC,cAAc,EAAE,cAAc,CAAC;IAChG,SAAgB,cAAc;;;MAG7B;IAGD,OAAO,CAAC,qBAAqB,CAAuB;IAEpD,OAAO,CAAC,iBAAiB,CAAI;IAE7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAI1B;IAEF;;;;;;;;;;;;;OAaG;IACH,UAAmB,SAAS,gBAwB1B;IAEF;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkD;IAE7E;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAyB;IAEvD;sGACkG;IAClG,OAAO,CAAC,cAAc,CAA2C;IAEjE;;;;OAIG;IACH,OAAO,KAAK,oBAAoB,GAK/B;IAED,SAAS,CAAC,OAAO,IAAI,MAAM,EAAE;IAI7B,OAAO,CAAC,gBAAgB;IAaxB;;;;;OAKG;YACW,mBAAmB;cAwDjB,gCAAgC,CAAC,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM;cAyE3E,sBAAsB,CAAC,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASrG;;;;;;;;;OASG;IACH,OAAO,CAAC,iBAAiB;YAkBX,iBAAiB;IAK/B;;;;;;;OAOG;YACW,QAAQ;YA+CR,sBAAsB;IASpC;;;;OAIG;YACW,0BAA0B;cA+BrB,qBAAqB,CAAC,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,GAAG,cAAc;cAYnF,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;CAMjF"}

package/dist/node-module-collector/pnpmNodeModulesCollector.js

@@ -1,7 +1,10 @@
+import _fsExtra from "fs-extra";
 import { Lazy } from "lazy-val";
+import * as path from "path";
 import { LogMessageByKey } from "./moduleManager.js";
 import { NodeModulesCollector } from "./nodeModulesCollector.js";
 import { getPackageManagerCommand, PM } from "./packageManager.js";
+import { isValidKey } from "builder-util";
 export class PnpmNodeModulesCollector extends NodeModulesCollector {
     constructor() {
         super(...arguments);
@@ -19,6 +22,45 @@ export class PnpmNodeModulesCollector extends NodeModulesCollector {
             const major = parseInt((result.stdout ?? "0").split(".")[0], 10);
             return isNaN(major) ? 0 : major;
         });
+        /**
+         * Detect pnpm's installed layout from the on-disk structure rather than `pnpm config list`.
+         * pnpm 11 no longer echoes `node-linker` (from `.npmrc`) in `config list`, so the base-class
+         * config-parsing detection silently reports "not hoisted" for a hoisted install, which would
+         * disable the downward search needed to find version-conflicted nested deps.
+         *
+         * In the default isolated store every regular top-level package resolves — through a symlink
+         * on POSIX, a junction on Windows — into `node_modules/.pnpm/<name>@<ver>/node_modules/<name>`.
+         * In a hoisted layout the same package is a real directory directly under `node_modules`.
+         * `realpath` transparently follows both symlinks and junctions, so a layout is isolated iff
+         * *any* top-level package's real path routes through `.pnpm`. We scan rather than sample the
+         * first entry because `link:` packages resolve to their source (never under `.pnpm`) and could
+         * otherwise mask an isolated store.
+         */
+        this.isHoisted = new Lazy(async () => {
+            const nmDir = path.join(this.rootDir, "node_modules");
+            const entries = await _fsExtra.readdir(nmDir).catch(() => []);
+            let sawPackage = false;
+            for (const name of entries) {
+                if (name.startsWith(".")) {
+                    continue; // .pnpm, .bin, .modules.yaml
+                }
+                const entryPath = path.join(nmDir, name);
+                // A scoped dir (@scope) is not a package itself; descend to its packages.
+                const candidates = name.startsWith("@") ? (await _fsExtra.readdir(entryPath).catch(() => [])).map(s => path.join(entryPath, s)) : [entryPath];
+                for (const candidate of candidates) {
+                    const real = await _fsExtra.realpath(candidate).catch(() => null);
+                    if (real == null) {
+                        continue;
+                    }
+                    sawPackage = true;
+                    if (real.split(path.sep).includes(".pnpm")) {
+                        return false; // isolated store: a package routes through the virtual store
+                    }
+                }
+            }
+            // Packages exist and none route through `.pnpm` → hoisted. No packages → flat default.
+            return sawPackage;
+        });
         /**
          * Memo for `locateFromDepOrRoot`, keyed by `name@version`. pnpm's content-addressed virtual
          * store guarantees that any given `name@version` resolves to a single location on disk, so
@@ -32,6 +74,9 @@ export class PnpmNodeModulesCollector extends NodeModulesCollector {
          * every shared subtree of the pnpm list output, exploding work in deep workspaces.
          */
         this.collectedDeps = new Set();
+        /** Reverse index of `allDependencies` keyed by package name (without version). Built once on
+         *  first access inside `extractProductionDependencyGraph`, after `allDependencies` is settled. */
+        this._allDepsByName = null;
     }
     /**
      * Returns the workspace packages to iterate over, gated by detected pnpm version:
@@ -47,6 +92,18 @@ export class PnpmNodeModulesCollector extends NodeModulesCollector {
     getArgs() {
         return ["list", "--prod", "--json", "--depth", "Infinity", "--silent", "--loglevel=error"];
     }
+    getAllDepsByName() {
+        if (!this._allDepsByName) {
+            this._allDepsByName = new Map();
+            for (const [id, dep] of this.allDependencies.entries()) {
+                const { name } = this.parseNameVersion(id);
+                if (!this._allDepsByName.has(name)) {
+                    this._allDepsByName.set(name, dep);
+                }
+            }
+        }
+        return this._allDepsByName;
+    }
     /**
      * Locate a package version, preferring the dep's own reported path before falling back to rootDir.
      * This is critical for pnpm non-hoisted (virtual store) setups where each package has its own
@@ -72,6 +129,24 @@ export class PnpmNodeModulesCollector extends NodeModulesCollector {
         // land at `<root>/node_modules/A/node_modules/B` — downward BFS is needed to find them.
         const skipDownwardSearch = !(await this.isHoisted.value);
         const promise = (async () => {
+            // Phase 1: find a version that SATISFIES requiredRange, trying the dep's own location
+            // first, then the workspace root. Crucially, neither pass accepts an out-of-range override
+            // here — so a wrong-version copy reachable via upward search from `parentPath` (e.g. a
+            // hoisted top-level dep) can't shadow the correct nested copy under root. Without this, a
+            // package that pnpm deduped to a peer's node_modules resolves its transitive deps to the
+            // wrong hoisted version (see jsonfile under two fs-extra majors). The root pass uses the
+            // same `skipDownwardSearch` as everywhere else: in a hoisted layout it is already false, so
+            // the nested `<root>/node_modules/A/node_modules/B` copy is found via BFS; in the flat
+            // `.pnpm` virtual store it stays true (forcing it on there would burn thousands of
+            // readdir/lstat calls — and on Windows, where pnpm uses junctions that `lstat` reports as
+            // directories, the BFS walks the entire store and resolves the wrong paths).
+            const satisfying = (parentPath ? await this.cache.locatePackageVersion({ pkgName, parentDir: parentPath, requiredRange, skipDownwardSearch, skipOverrideFallback: true }) : null) ??
+                (await this.cache.locatePackageVersion({ pkgName, parentDir: this.rootDir, requiredRange, skipDownwardSearch, skipOverrideFallback: true }));
+            if (satisfying) {
+                return satisfying;
+            }
+            // Phase 2: no version satisfies requiredRange (package-manager override, or no range
+            // given). Fall back to the original dep-then-root order, now allowing override versions.
             const fromDep = parentPath ? await this.cache.locatePackageVersion({ pkgName, parentDir: parentPath, requiredRange, skipDownwardSearch }) : null;
             if (fromDep) {
                 return fromDep;
@@ -104,10 +179,27 @@ export class PnpmNodeModulesCollector extends NodeModulesCollector {
             }
         }
         const packageName = tree.name || tree.from;
-        const { packageJson } = (await this.locateFromDepOrRoot(packageName, tree.path, tree.version)) || {};
+        const { packageJson: locatedJson } = (await this.locateFromDepOrRoot(packageName, tree.path, tree.version)) || {};
+        // Fallback: the app root package is never installed inside a node_modules directory, so
+        // the name-based lookup above returns null. Reading directly from tree.path ensures that
+        // link: dependencies — which some pnpm versions omit from `pnpm list --prod` output —
+        // still appear in `all` and therefore reach the production graph.
+        const packageJson = locatedJson ?? (tree.path ? (await _fsExtra.readJson(path.join(tree.path, "package.json")).catch(() => null)) : null);
         const all = packageJson ? { ...packageJson.dependencies, ...packageJson.optionalDependencies } : { ...tree.dependencies, ...tree.optionalDependencies };
         const optional = packageJson ? { ...packageJson.optionalDependencies } : {};
         const deps = { ...(tree.dependencies || {}), ...(tree.optionalDependencies || {}) };
+        // pnpm --prod omits sub-deps for link: packages (and synthetic entries derived from them).
+        // For any dep declared in the package.json (all) that pnpm left out of the tree, recover
+        // the resolved entry from allDependencies so it lands in the production graph.
+        const byName = this.getAllDepsByName();
+        for (const depName of Object.keys(all)) {
+            if (!deps[depName]) {
+                const dep = byName.get(depName);
+                if (dep && isValidKey(depName)) {
+                    deps[depName] = dep;
+                }
+            }
+        }
         this.productionGraph[dependencyId] = { dependencies: [] };
         const depPromises = Object.entries(deps).map(async ([packageName, dependency]) => {
             // First check if it's in production dependencies
@@ -139,28 +231,135 @@ export class PnpmNodeModulesCollector extends NodeModulesCollector {
         for (const root of this.allWorkspacePackages) {
             await this.collectDepsRecursively(root);
         }
+        // pnpm --prod omits link: packages from its JSON output entirely; pick them up from the
+        // app's package.json so their transitive deps are included in allDependencies.
+        await this.collectOmittedLinkPackages();
     }
-    async collectDepsRecursively(tree) {
-        const visit = async (key, value) => {
-            if ((value?.dedupedDependenciesCount ?? 0) > 0) {
-                return;
-            }
-            const id = `${key}@${value.version}`;
-            // The pnpm list output can include the same `name@version` thousands of times across a
-            // deep workspace; without this guard we re-resolve and re-recurse each occurrence.
-            if (this.collectedDeps.has(id)) {
-                return;
+    /**
+     * Resolve a `link:` dependency to its real on-disk source directory — never the `node_modules`
+     * junction pnpm creates for it. Returns null for non-link deps.
+     *
+     * Why this matters: resolving a link: dep through `node_modules` (locateFromDepOrRoot) yields the
+     * junction, which CI cannot read across drives. CI checks out the repo on `D:` but installs the
+     * app under `C:\…\Temp`, so the junction is a cross-volume link that `realpath`/`stat` fail on,
+     * silently dropping the package from the asar. The link target is a plain directory that reads
+     * fine from any drive, so we resolve straight to it.
+     */
+    resolveLinkTarget(value) {
+        const version = value.version;
+        if (typeof version !== "string" || !version.startsWith("link:")) {
+            return null;
+        }
+        const spec = version.slice("link:".length);
+        // A cross-drive link cannot be expressed relative, so pnpm reports it as an absolute path —
+        // use it directly. Otherwise prefer pnpm's already-resolved absolute `path` (the source dir,
+        // never the junction), falling back to resolving the relative spec against the workspace root.
+        if (path.isAbsolute(spec)) {
+            return path.normalize(spec);
+        }
+        if (value.path && path.isAbsolute(value.path)) {
+            return path.normalize(value.path);
+        }
+        return path.resolve(this.rootDir, spec);
+    }
+    async readPackageJsonAt(dir) {
+        const packageJson = (await _fsExtra.readJson(path.join(dir, "package.json")).catch(() => null));
+        return packageJson ? { packageDir: dir, packageJson } : null;
+    }
+    /**
+     * Visit a single dependency node, adding it and its transitive deps to allDependencies.
+     *
+     * For packages that pnpm list did NOT expand (link: packages and the synthetic entries
+     * derived from them), the tree has empty dependencies/optionalDependencies. In that case
+     * we fall back to the on-disk package.json to discover transitive deps, resolving each one
+     * from the package's own node_modules first (where pnpm placed them).
+     */
+    async visitDep(key, value) {
+        const id = `${key}@${value.version}`;
+        // The pnpm list output can include the same `name@version` thousands of times across a
+        // deep workspace; without this guard we re-resolve and re-recurse each occurrence.
+        if (this.collectedDeps.has(id)) {
+            return;
+        }
+        this.collectedDeps.add(id);
+        const located = await this.locateFromDepOrRoot(key, value.path, value.version);
+        // For a link: dep, store the real source dir (the link target) rather than the located path,
+        // which is the node_modules junction. Across drives that junction is unreadable (see
+        // resolveLinkTarget), so storing it makes the package vanish from the asar.
+        const linkTarget = this.resolveLinkTarget(value);
+        const resolvedPath = linkTarget ?? located?.packageDir ?? value.path;
+        this.allDependencies.set(id, { ...value, path: resolvedPath });
+        // For transitive-dep discovery of entries pnpm did not expand (link: packages), use the
+        // located package.json; fall back to the link target's own package.json when the junction
+        // could not be resolved (again, the cross-drive case).
+        const pkg = located ?? (linkTarget != null ? await this.readPackageJsonAt(linkTarget) : null);
+        const hasTreeDeps = Object.keys(value.dependencies ?? {}).length > 0 || Object.keys(value.optionalDependencies ?? {}).length > 0;
+        if (!hasTreeDeps && pkg?.packageJson) {
+            // pnpm list omits sub-deps for link: packages and for entries where the reported path
+            // doesn't expand transitive deps (e.g. a link: package's nested dep). Use the on-disk
+            // package.json to discover what to include, and pass the declared version range so that
+            // resolution skips wrong-version hoisted packages and finds the correct nested copy.
+            const pkgDepsDecl = { ...(pkg.packageJson.dependencies || {}), ...(pkg.packageJson.optionalDependencies || {}) };
+            for (const [depName, depRange] of Object.entries(pkgDepsDecl)) {
+                const resolved = await this.locateFromDepOrRoot(depName, pkg.packageDir, typeof depRange === "string" ? depRange : undefined);
+                if (!resolved) {
+                    continue;
+                }
+                await this.visitDep(depName, {
+                    from: depName,
+                    name: depName,
+                    version: resolved.packageJson.version,
+                    path: resolved.packageDir,
+                    dependencies: {},
+                    optionalDependencies: {},
+                });
             }
-            this.collectedDeps.add(id);
-            const pkg = await this.locateFromDepOrRoot(key, value.path, value.version);
-            this.allDependencies.set(id, { ...value, path: pkg?.packageDir ?? value.path });
+        }
+        else {
             await this.collectDepsRecursively(value);
-        };
+        }
+    }
+    async collectDepsRecursively(tree) {
         for (const [key, value] of Object.entries(tree.dependencies || {})) {
-            await visit(key, value);
+            await this.visitDep(key, value);
         }
         for (const [key, value] of Object.entries(tree.optionalDependencies || {})) {
-            await visit(key, value);
+            await this.visitDep(key, value);
+        }
+    }
+    /**
+     * pnpm excludes link: packages from `pnpm list --prod` output. Read the app's package.json
+     * directly to find any link: deps that were silently omitted and visit them so their
+     * transitive deps end up in allDependencies.
+     */
+    async collectOmittedLinkPackages() {
+        const appPkgJson = (await _fsExtra.readJson(path.join(this.rootDir, "package.json")).catch(() => null));
+        if (!appPkgJson) {
+            return;
+        }
+        const allDeps = { ...(appPkgJson.dependencies || {}), ...(appPkgJson.optionalDependencies || {}) };
+        for (const [name, version] of Object.entries(allDeps)) {
+            if (typeof version !== "string" || !version.startsWith("link:")) {
+                continue;
+            }
+            // Resolve the link: target path directly — bypasses potentially broken cross-drive
+            // Windows junctions (C:→D:) that locateFromDepOrRoot would traverse through
+            // node_modules and silently fail on (readJson returns null via .catch).
+            const linkRelPath = version.slice("link:".length);
+            const linkTarget = path.isAbsolute(linkRelPath) ? linkRelPath : path.resolve(this.rootDir, linkRelPath);
+            const directPkg = (await _fsExtra.readJson(path.join(linkTarget, "package.json")).catch(() => null));
+            const resolved = directPkg ? { packageDir: linkTarget, packageJson: directPkg } : await this.locateFromDepOrRoot(name, this.rootDir, undefined);
+            if (!resolved) {
+                continue;
+            }
+            await this.visitDep(name, {
+                from: name,
+                name,
+                version: resolved.packageJson.version,
+                path: resolved.packageDir,
+                dependencies: {},
+                optionalDependencies: {},
+            });
         }
     }
     getTreeFromWorkspaces(tree, packageName) {

package/dist/node-module-collector/pnpmNodeModulesCollector.js.map

@@ -1 +1 @@
-{"version":3,"file":"pnpmNodeModulesCollector.js","sourceRoot":"","sources":["../../src/node-module-collector/pnpmNodeModulesCollector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,eAAe,EAAgB,MAAM,oBAAoB,CAAA;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,wBAAwB,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAA;AAGlE,MAAM,OAAO,wBAAyB,SAAQ,oBAAoD;IAAlG;;QACkB,mBAAc,GAAG;YAC/B,OAAO,EAAE,EAAE,CAAC,IAAI;YAChB,QAAQ,EAAE,gBAAgB;SAC3B,CAAA;QAED,0DAA0D;QAClD,0BAAqB,GAAqB,EAAE,CAAA;QACpD,4FAA4F;QACpF,sBAAiB,GAAG,CAAC,CAAA;QAC7B,iEAAiE;QAChD,gBAAW,GAAG,IAAI,IAAI,CAAS,KAAK,IAAI,EAAE;YACzD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,wBAAwB,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;YACrF,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAChE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACjC,CAAC,CAAC,CAAA;QAEF;;;;;;WAMG;QACc,eAAU,GAAyC,IAAI,GAAG,EAAE,CAAA;QAE7E;;;WAGG;QACc,kBAAa,GAAgB,IAAI,GAAG,EAAE,CAAA;IAoKzD,CAAC;IAlKC;;;;OAIG;IACH,IAAY,oBAAoB;QAC9B,IAAI,IAAI,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,qBAAqB,CAAA;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/C,CAAC;IAES,OAAO;QACf,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAA;IAC5F,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,mBAAmB,CAAC,OAAe,EAAE,UAA8B,EAAE,aAAsB;QACvG,2FAA2F;QAC3F,4FAA4F;QAC5F,yFAAyF;QACzF,yFAAyF;QACzF,sFAAsF;QACtF,MAAM,OAAO,GAAG,aAAa,IAAI,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QACjG,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAC3C,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,OAAO,MAAM,CAAA;YACf,CAAC;QACH,CAAC;QAED,yFAAyF;QACzF,uFAAuF;QACvF,uFAAuF;QACvF,wFAAwF;QACxF,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QACxD,MAAM,OAAO,GAAG,CAAC,KAAK,IAA6B,EAAE;YACnD,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAChJ,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,OAAO,CAAA;YAChB,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC,CAAA;QACjH,CAAC,CAAC,EAAE,CAAA;QAEJ,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvC,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,iFAAiF;IACjF,+EAA+E;IAC/E,6EAA6E;IAC7E,mEAAmE;IACzD,KAAK,CAAC,gCAAgC,CAAC,IAAoB,EAAE,YAAoB;QACzF,IAAI,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;YACvC,OAAM;QACR,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE,CAAA;QAEzD,IAAI,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;YACtD,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;gBAC3E,IAAI,GAAG,OAAO,CAAA;YAChB,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,4BAA4B,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;gBACtF,OAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAA;QAC1C,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;QAEpG,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,YAAY,EAAE,GAAG,WAAW,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAA;QACvJ,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAE3E,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAC,EAAE,CAAA;QACnF,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE,CAAA;QACzD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,EAAE;YAC/E,iDAAiD;YACjD,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtB,OAAO,SAAS,CAAA;YAClB,CAAC;YAED,6EAA6E;YAC7E,IAAI,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,CAAA;gBACtF,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,IAAI,CAAC,oBAAoB,CAAC,GAAG,WAAW,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC,CAAA;oBACjE,OAAO,SAAS,CAAA;gBAClB,CAAC;YACH,CAAC;YACD,MAAM,EAAE,EAAE,EAAE,iBAAiB,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;YACpG,MAAM,IAAI,CAAC,gCAAgC,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAA;YAC3E,OAAO,iBAAiB,CAAA;QAC1B,CAAC,CAAC,CAAA;QAEF,MAAM,qBAAqB,GAAa,EAAE,CAAA;QAC1C,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAA;YACxB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACpC,CAAC;QACH,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,qBAAqB,EAAE,CAAA;IAC9E,CAAC;IAES,KAAK,CAAC,sBAAsB,CAAC,KAAqB,EAAE,eAAuB;QACnF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAA;QACzC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,IAAoB;QACvD,MAAM,KAAK,GAAG,KAAK,EAAE,GAAW,EAAE,KAAqB,EAAE,EAAE;YACzD,IAAI,CAAC,KAAK,EAAE,wBAAwB,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/C,OAAM;YACR,CAAC;YACD,MAAM,EAAE,GAAG,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAA;YACpC,uFAAuF;YACvF,mFAAmF;YACnF,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC/B,OAAM;YACR,CAAC;YACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;YAC1E,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;YAC/E,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAA;QAC1C,CAAC,CAAA;QAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;YACnE,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACzB,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAC,EAAE,CAAC;YAC3E,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;IAEkB,qBAAqB,CAAC,IAAoB,EAAE,WAAmB;QAChF,oFAAoF;QACpF,MAAM,MAAM,GAAG,KAAK,CAAC,qBAAqB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QAC7D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,MAAM,CAAA;QACf,CAAC;QACD,kFAAkF;QAClF,4FAA4F;QAC5F,MAAM,KAAK,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,CAAA;QACzG,OAAO,KAAK,IAAI,IAAI,CAAA;IACtB,CAAC;IAES,KAAK,CAAC,qBAAqB,CAAC,QAAgB;QACpD,MAAM,cAAc,GAAG,IAAI,CAAC,6BAA6B,CAAmB,QAAQ,CAAC,CAAA;QACrF,IAAI,CAAC,qBAAqB,GAAG,cAAc,CAAA;QAC3C,IAAI,CAAC,iBAAiB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAA;QACrD,OAAO,cAAc,CAAC,CAAC,CAAC,CAAA;IAC1B,CAAC;CACF","sourcesContent":["import { Lazy } from \"lazy-val\"\nimport { LogMessageByKey, type Package } from \"./moduleManager.js\"\nimport { NodeModulesCollector } from \"./nodeModulesCollector.js\"\nimport { getPackageManagerCommand, PM } from \"./packageManager.js\"\nimport { PnpmDependency } from \"./types.js\"\n\nexport class PnpmNodeModulesCollector extends NodeModulesCollector<PnpmDependency, PnpmDependency> {\n  public readonly installOptions = {\n    manager: PM.PNPM,\n    lockfile: \"pnpm-lock.yaml\",\n  }\n\n  // Raw backing field — all entries from `pnpm list --json`\n  private _allWorkspacePackages: PnpmDependency[] = []\n  // Cached after parseDependenciesTree resolves the Lazy; 0 = safe default (treated as < v11)\n  private _pnpmMajorVersion = 0\n  // Runs `pnpm --version` once and caches the major version number\n  private readonly pnpmVersion = new Lazy<number>(async () => {\n    const result = await this.asyncExec(getPackageManagerCommand(PM.PNPM), [\"--version\"])\n    const major = parseInt((result.stdout ?? \"0\").split(\".\")[0], 10)\n    return isNaN(major) ? 0 : major\n  })\n\n  /**\n   * Memo for `locateFromDepOrRoot`, keyed by `name@version`. pnpm's content-addressed virtual\n   * store guarantees that any given `name@version` resolves to a single location on disk, so\n   * once we've resolved a package we can short-circuit every subsequent lookup. This is the\n   * dominant speedup for large workspaces where the `pnpm list --json` tree contains the same\n   * `name@version` thousands of times (one entry per dependent).\n   */\n  private readonly locateMemo: Map<string, Promise<Package | null>> = new Map()\n\n  /**\n   * Visited set for `collectDepsRecursively`, keyed by `name@version`. Without this we re-walk\n   * every shared subtree of the pnpm list output, exploding work in deep workspaces.\n   */\n  private readonly collectedDeps: Set<string> = new Set()\n\n  /**\n   * Returns the workspace packages to iterate over, gated by detected pnpm version:\n   * - pnpm v11+: multi-entry workspace output → return the full parsed array\n   * - pnpm < v11 / non-workspace / detection failure: single-tree behavior → return only [0]\n   */\n  private get allWorkspacePackages(): PnpmDependency[] {\n    if (this._pnpmMajorVersion >= 11) {\n      return this._allWorkspacePackages\n    }\n    return this._allWorkspacePackages.slice(0, 1)\n  }\n\n  protected getArgs(): string[] {\n    return [\"list\", \"--prod\", \"--json\", \"--depth\", \"Infinity\", \"--silent\", \"--loglevel=error\"]\n  }\n\n  /**\n   * Locate a package version, preferring the dep's own reported path before falling back to rootDir.\n   * This is critical for pnpm non-hoisted (virtual store) setups where each package has its own\n   * nested node_modules. Searching only from rootDir can resolve the wrong version when multiple\n   * versions of a dep exist in the workspace.\n   */\n  private async locateFromDepOrRoot(pkgName: string, parentPath: string | undefined, requiredRange?: string) {\n    // pnpm's virtual store is content-addressed: every `name@version` lookup is deterministic,\n    // so memoize on the exact version. `requiredRange` is normally an exact version coming from\n    // the pnpm list output (e.g. `value.version`), which makes this cache hit on duplicates.\n    // Only memoize when we have a concrete version — semver ranges could resolve differently\n    // depending on what's installed at `parentPath` vs root, so skip the cache for those.\n    const memoKey = requiredRange && /^\\d/.test(requiredRange) ? `${pkgName}@${requiredRange}` : null\n    if (memoKey != null) {\n      const cached = this.locateMemo.get(memoKey)\n      if (cached != null) {\n        return cached\n      }\n    }\n\n    // pnpm's default `.pnpm` virtual store is flat, so `downwardSearch` would burn thousands\n    // of `readdir`/`lstat` calls finding nothing. With `nodeLinker: hoisted`, however, the\n    // layout is a traditional nested `node_modules` tree where version-conflicted packages\n    // land at `<root>/node_modules/A/node_modules/B` — downward BFS is needed to find them.\n    const skipDownwardSearch = !(await this.isHoisted.value)\n    const promise = (async (): Promise<Package | null> => {\n      const fromDep = parentPath ? await this.cache.locatePackageVersion({ pkgName, parentDir: parentPath, requiredRange, skipDownwardSearch }) : null\n      if (fromDep) {\n        return fromDep\n      }\n      return this.cache.locatePackageVersion({ pkgName, parentDir: this.rootDir, requiredRange, skipDownwardSearch })\n    })()\n\n    if (memoKey != null) {\n      this.locateMemo.set(memoKey, promise)\n    }\n    return promise\n  }\n\n  // pnpm 10+ does not automatically preserve transitive optional platform-specific\n  // packages (e.g. sass-embedded-linux-x64) across lock file regeneration. Users\n  // must list them as direct optionalDependencies. Missing ones are emitted as\n  // PKG_OPTIONAL_PLATFORM_NOT_INSTALLED warnings in the log summary.\n  protected async extractProductionDependencyGraph(tree: PnpmDependency, dependencyId: string) {\n    if (this.productionGraph[dependencyId]) {\n      return\n    }\n    this.productionGraph[dependencyId] = { dependencies: [] }\n\n    if ((tree.dedupedDependenciesCount ?? 0) > 0) {\n      const realDep = this.allDependencies.get(dependencyId)\n      if (realDep) {\n        this.cache.logSummary[LogMessageByKey.PKG_DUPLICATE_REF].push(dependencyId)\n        tree = realDep\n      } else {\n        this.cache.logSummary[LogMessageByKey.PKG_DUPLICATE_REF_UNRESOLVED].push(dependencyId)\n        return\n      }\n    }\n\n    const packageName = tree.name || tree.from\n    const { packageJson } = (await this.locateFromDepOrRoot(packageName, tree.path, tree.version)) || {}\n\n    const all = packageJson ? { ...packageJson.dependencies, ...packageJson.optionalDependencies } : { ...tree.dependencies, ...tree.optionalDependencies }\n    const optional = packageJson ? { ...packageJson.optionalDependencies } : {}\n\n    const deps = { ...(tree.dependencies || {}), ...(tree.optionalDependencies || {}) }\n    this.productionGraph[dependencyId] = { dependencies: [] }\n    const depPromises = Object.entries(deps).map(async ([packageName, dependency]) => {\n      // First check if it's in production dependencies\n      if (!all[packageName]) {\n        return undefined\n      }\n\n      // Then check if optional dependency path exists (using actual resolved path)\n      if (optional[packageName]) {\n        const pkg = await this.locateFromDepOrRoot(packageName, tree.path, dependency.version)\n        if (!pkg) {\n          this.logMissingDependency(`${packageName}@${dependency.version}`)\n          return undefined\n        }\n      }\n      const { id: childDependencyId, pkgOverride } = this.normalizePackageVersion(packageName, dependency)\n      await this.extractProductionDependencyGraph(pkgOverride, childDependencyId)\n      return childDependencyId\n    })\n\n    const collectedDependencies: string[] = []\n    for (const dep of depPromises) {\n      const result = await dep\n      if (result !== undefined) {\n        collectedDependencies.push(result)\n      }\n    }\n    this.productionGraph[dependencyId] = { dependencies: collectedDependencies }\n  }\n\n  protected async collectAllDependencies(_tree: PnpmDependency, _appPackageName: string): Promise<void> {\n    for (const root of this.allWorkspacePackages) {\n      await this.collectDepsRecursively(root)\n    }\n  }\n\n  private async collectDepsRecursively(tree: PnpmDependency): Promise<void> {\n    const visit = async (key: string, value: PnpmDependency) => {\n      if ((value?.dedupedDependenciesCount ?? 0) > 0) {\n        return\n      }\n      const id = `${key}@${value.version}`\n      // The pnpm list output can include the same `name@version` thousands of times across a\n      // deep workspace; without this guard we re-resolve and re-recurse each occurrence.\n      if (this.collectedDeps.has(id)) {\n        return\n      }\n      this.collectedDeps.add(id)\n      const pkg = await this.locateFromDepOrRoot(key, value.path, value.version)\n      this.allDependencies.set(id, { ...value, path: pkg?.packageDir ?? value.path })\n      await this.collectDepsRecursively(value)\n    }\n\n    for (const [key, value] of Object.entries(tree.dependencies || {})) {\n      await visit(key, value)\n    }\n    for (const [key, value] of Object.entries(tree.optionalDependencies || {})) {\n      await visit(key, value)\n    }\n  }\n\n  protected override getTreeFromWorkspaces(tree: PnpmDependency, packageName: string): PnpmDependency {\n    // pnpm v10 workspace: app is nested as a dependency of root — handled by base class\n    const result = super.getTreeFromWorkspaces(tree, packageName)\n    if (result !== tree) {\n      return result\n    }\n    // pnpm v11 workspace: each workspace package is a separate top-level array entry;\n    // non-workspace (single-tree): find returns the one entry or undefined → falls back to tree\n    const match = this.allWorkspacePackages.find(pkg => pkg.name === packageName || pkg.from === packageName)\n    return match ?? tree\n  }\n\n  protected async parseDependenciesTree(jsonBlob: string): Promise<PnpmDependency> {\n    const dependencyTree = this.extractJsonFromPollutedOutput<PnpmDependency[]>(jsonBlob)\n    this._allWorkspacePackages = dependencyTree\n    this._pnpmMajorVersion = await this.pnpmVersion.value\n    return dependencyTree[0]\n  }\n}\n"]}
+{"version":3,"file":"pnpmNodeModulesCollector.js","sourceRoot":"","sources":["../../src/node-module-collector/pnpmNodeModulesCollector.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAE,eAAe,EAAgB,MAAM,oBAAoB,CAAA;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,wBAAwB,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAA;AAElE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAEzC,MAAM,OAAO,wBAAyB,SAAQ,oBAAoD;IAAlG;;QACkB,mBAAc,GAAG;YAC/B,OAAO,EAAE,EAAE,CAAC,IAAI;YAChB,QAAQ,EAAE,gBAAgB;SAC3B,CAAA;QAED,0DAA0D;QAClD,0BAAqB,GAAqB,EAAE,CAAA;QACpD,4FAA4F;QACpF,sBAAiB,GAAG,CAAC,CAAA;QAC7B,iEAAiE;QAChD,gBAAW,GAAG,IAAI,IAAI,CAAS,KAAK,IAAI,EAAE;YACzD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,wBAAwB,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;YACrF,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAChE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACjC,CAAC,CAAC,CAAA;QAEF;;;;;;;;;;;;;WAaG;QACgB,cAAS,GAAG,IAAI,IAAI,CAAU,KAAK,IAAI,EAAE;YAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;YACrD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAc,CAAC,CAAA;YACzE,IAAI,UAAU,GAAG,KAAK,CAAA;YACtB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,SAAQ,CAAC,6BAA6B;gBACxC,CAAC;gBACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;gBACxC,0EAA0E;gBAC1E,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;gBACzJ,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;oBACnC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;oBACjE,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;wBACjB,SAAQ;oBACV,CAAC;oBACD,UAAU,GAAG,IAAI,CAAA;oBACjB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC3C,OAAO,KAAK,CAAA,CAAC,6DAA6D;oBAC5E,CAAC;gBACH,CAAC;YACH,CAAC;YACD,uFAAuF;YACvF,OAAO,UAAU,CAAA;QACnB,CAAC,CAAC,CAAA;QAEF;;;;;;WAMG;QACc,eAAU,GAAyC,IAAI,GAAG,EAAE,CAAA;QAE7E;;;WAGG;QACc,kBAAa,GAAgB,IAAI,GAAG,EAAE,CAAA;QAEvD;0GACkG;QAC1F,mBAAc,GAAuC,IAAI,CAAA;IAsUnE,CAAC;IApUC;;;;OAIG;IACH,IAAY,oBAAoB;QAC9B,IAAI,IAAI,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,qBAAqB,CAAA;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/C,CAAC;IAES,OAAO;QACf,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAA;IAC5F,CAAC;IAEO,gBAAgB;QACtB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,EAAE,CAAA;YAC/B,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC;gBACvD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;gBAC1C,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;gBACpC,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,mBAAmB,CAAC,OAAe,EAAE,UAA8B,EAAE,aAAsB;QACvG,2FAA2F;QAC3F,4FAA4F;QAC5F,yFAAyF;QACzF,yFAAyF;QACzF,sFAAsF;QACtF,MAAM,OAAO,GAAG,aAAa,IAAI,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QACjG,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAC3C,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,OAAO,MAAM,CAAA;YACf,CAAC;QACH,CAAC;QAED,yFAAyF;QACzF,uFAAuF;QACvF,uFAAuF;QACvF,wFAAwF;QACxF,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QACxD,MAAM,OAAO,GAAG,CAAC,KAAK,IAA6B,EAAE;YACnD,sFAAsF;YACtF,2FAA2F;YAC3F,uFAAuF;YACvF,0FAA0F;YAC1F,yFAAyF;YACzF,yFAAyF;YACzF,4FAA4F;YAC5F,uFAAuF;YACvF,mFAAmF;YACnF,0FAA0F;YAC1F,6EAA6E;YAC7E,MAAM,UAAU,GACd,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC9J,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAC9I,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,UAAU,CAAA;YACnB,CAAC;YACD,qFAAqF;YACrF,yFAAyF;YACzF,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAChJ,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,OAAO,CAAA;YAChB,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC,CAAA;QACjH,CAAC,CAAC,EAAE,CAAA;QAEJ,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvC,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,iFAAiF;IACjF,+EAA+E;IAC/E,6EAA6E;IAC7E,mEAAmE;IACzD,KAAK,CAAC,gCAAgC,CAAC,IAAoB,EAAE,YAAoB;QACzF,IAAI,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;YACvC,OAAM;QACR,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE,CAAA;QAEzD,IAAI,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;YACtD,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;gBAC3E,IAAI,GAAG,OAAO,CAAA;YAChB,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,4BAA4B,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;gBACtF,OAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAA;QAC1C,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;QACjH,wFAAwF;QACxF,yFAAyF;QACzF,sFAAsF;QACtF,kEAAkE;QAClE,MAAM,WAAW,GAAG,WAAW,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAEjK,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,YAAY,EAAE,GAAG,WAAW,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAA;QACvJ,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAE3E,MAAM,IAAI,GAAmC,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAC,EAAE,CAAA;QAEnH,2FAA2F;QAC3F,yFAAyF;QACzF,+EAA+E;QAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAA;QACtC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBAC/B,IAAI,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC/B,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,CAAA;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE,CAAA;QACzD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,EAAE;YAC/E,iDAAiD;YACjD,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtB,OAAO,SAAS,CAAA;YAClB,CAAC;YAED,6EAA6E;YAC7E,IAAI,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,CAAA;gBACtF,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,IAAI,CAAC,oBAAoB,CAAC,GAAG,WAAW,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC,CAAA;oBACjE,OAAO,SAAS,CAAA;gBAClB,CAAC;YACH,CAAC;YACD,MAAM,EAAE,EAAE,EAAE,iBAAiB,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;YACpG,MAAM,IAAI,CAAC,gCAAgC,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAA;YAC3E,OAAO,iBAAiB,CAAA;QAC1B,CAAC,CAAC,CAAA;QAEF,MAAM,qBAAqB,GAAa,EAAE,CAAA;QAC1C,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAA;YACxB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACpC,CAAC;QACH,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,qBAAqB,EAAE,CAAA;IAC9E,CAAC;IAES,KAAK,CAAC,sBAAsB,CAAC,KAAqB,EAAE,eAAuB;QACnF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAA;QACzC,CAAC;QACD,wFAAwF;QACxF,+EAA+E;QAC/E,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAA;IACzC,CAAC;IAED;;;;;;;;;OASG;IACK,iBAAiB,CAAC,KAAqB;QAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;QAC7B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAChE,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC1C,4FAA4F;QAC5F,6FAA6F;QAC7F,+FAA+F;QAC/F,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC7B,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IACzC,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,GAAW;QACzC,MAAM,WAAW,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAuB,CAAA;QACrH,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9D,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,KAAqB;QACvD,MAAM,EAAE,GAAG,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAA;QACpC,uFAAuF;QACvF,mFAAmF;QACnF,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/B,OAAM;QACR,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAE1B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;QAC9E,6FAA6F;QAC7F,qFAAqF;QACrF,4EAA4E;QAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAA;QAChD,MAAM,YAAY,GAAG,UAAU,IAAI,OAAO,EAAE,UAAU,IAAI,KAAK,CAAC,IAAI,CAAA;QACpE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAA;QAE9D,wFAAwF;QACxF,0FAA0F;QAC1F,uDAAuD;QACvD,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC7F,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;QAChI,IAAI,CAAC,WAAW,IAAI,GAAG,EAAE,WAAW,EAAE,CAAC;YACrC,sFAAsF;YACtF,sFAAsF;YACtF,wFAAwF;YACxF,qFAAqF;YACrF,MAAM,WAAW,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,oBAAoB,IAAI,EAAE,CAAC,EAAE,CAAA;YAChH,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;gBAC7H,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,SAAQ;gBACV,CAAC;gBACD,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE;oBAC3B,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,OAAO;oBACb,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC,OAAO;oBACrC,IAAI,EAAE,QAAQ,CAAC,UAAU;oBACzB,YAAY,EAAE,EAAE;oBAChB,oBAAoB,EAAE,EAAE;iBACI,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAA;QAC1C,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,IAAoB;QACvD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACjC,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,0BAA0B;QACtC,MAAM,UAAU,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAuB,CAAA;QAC7H,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAM;QACR,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,oBAAoB,IAAI,EAAE,CAAC,EAAE,CAAA;QAClG,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChE,SAAQ;YACV,CAAC;YACD,mFAAmF;YACnF,4EAA4E;YAC5E,wEAAwE;YACxE,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACjD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;YACvG,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAuB,CAAA;YAC1H,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;YAC/I,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,SAAQ;YACV,CAAC;YACD,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;gBACxB,IAAI,EAAE,IAAI;gBACV,IAAI;gBACJ,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC,OAAO;gBACrC,IAAI,EAAE,QAAQ,CAAC,UAAU;gBACzB,YAAY,EAAE,EAAE;gBAChB,oBAAoB,EAAE,EAAE;aACI,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAEkB,qBAAqB,CAAC,IAAoB,EAAE,WAAmB;QAChF,oFAAoF;QACpF,MAAM,MAAM,GAAG,KAAK,CAAC,qBAAqB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QAC7D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,MAAM,CAAA;QACf,CAAC;QACD,kFAAkF;QAClF,4FAA4F;QAC5F,MAAM,KAAK,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,CAAA;QACzG,OAAO,KAAK,IAAI,IAAI,CAAA;IACtB,CAAC;IAES,KAAK,CAAC,qBAAqB,CAAC,QAAgB;QACpD,MAAM,cAAc,GAAG,IAAI,CAAC,6BAA6B,CAAmB,QAAQ,CAAC,CAAA;QACrF,IAAI,CAAC,qBAAqB,GAAG,cAAc,CAAA;QAC3C,IAAI,CAAC,iBAAiB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAA;QACrD,OAAO,cAAc,CAAC,CAAC,CAAC,CAAA;IAC1B,CAAC;CACF","sourcesContent":["import _fsExtra from \"fs-extra\"\nimport { Lazy } from \"lazy-val\"\nimport * as path from \"path\"\nimport { LogMessageByKey, type Package } from \"./moduleManager.js\"\nimport { NodeModulesCollector } from \"./nodeModulesCollector.js\"\nimport { getPackageManagerCommand, PM } from \"./packageManager.js\"\nimport type { PackageJson, PnpmDependency } from \"./types.js\"\nimport { isValidKey } from \"builder-util\"\n\nexport class PnpmNodeModulesCollector extends NodeModulesCollector<PnpmDependency, PnpmDependency> {\n  public readonly installOptions = {\n    manager: PM.PNPM,\n    lockfile: \"pnpm-lock.yaml\",\n  }\n\n  // Raw backing field — all entries from `pnpm list --json`\n  private _allWorkspacePackages: PnpmDependency[] = []\n  // Cached after parseDependenciesTree resolves the Lazy; 0 = safe default (treated as < v11)\n  private _pnpmMajorVersion = 0\n  // Runs `pnpm --version` once and caches the major version number\n  private readonly pnpmVersion = new Lazy<number>(async () => {\n    const result = await this.asyncExec(getPackageManagerCommand(PM.PNPM), [\"--version\"])\n    const major = parseInt((result.stdout ?? \"0\").split(\".\")[0], 10)\n    return isNaN(major) ? 0 : major\n  })\n\n  /**\n   * Detect pnpm's installed layout from the on-disk structure rather than `pnpm config list`.\n   * pnpm 11 no longer echoes `node-linker` (from `.npmrc`) in `config list`, so the base-class\n   * config-parsing detection silently reports \"not hoisted\" for a hoisted install, which would\n   * disable the downward search needed to find version-conflicted nested deps.\n   *\n   * In the default isolated store every regular top-level package resolves — through a symlink\n   * on POSIX, a junction on Windows — into `node_modules/.pnpm/<name>@<ver>/node_modules/<name>`.\n   * In a hoisted layout the same package is a real directory directly under `node_modules`.\n   * `realpath` transparently follows both symlinks and junctions, so a layout is isolated iff\n   * *any* top-level package's real path routes through `.pnpm`. We scan rather than sample the\n   * first entry because `link:` packages resolve to their source (never under `.pnpm`) and could\n   * otherwise mask an isolated store.\n   */\n  protected override isHoisted = new Lazy<boolean>(async () => {\n    const nmDir = path.join(this.rootDir, \"node_modules\")\n    const entries = await _fsExtra.readdir(nmDir).catch(() => [] as string[])\n    let sawPackage = false\n    for (const name of entries) {\n      if (name.startsWith(\".\")) {\n        continue // .pnpm, .bin, .modules.yaml\n      }\n      const entryPath = path.join(nmDir, name)\n      // A scoped dir (@scope) is not a package itself; descend to its packages.\n      const candidates = name.startsWith(\"@\") ? (await _fsExtra.readdir(entryPath).catch(() => [] as string[])).map(s => path.join(entryPath, s)) : [entryPath]\n      for (const candidate of candidates) {\n        const real = await _fsExtra.realpath(candidate).catch(() => null)\n        if (real == null) {\n          continue\n        }\n        sawPackage = true\n        if (real.split(path.sep).includes(\".pnpm\")) {\n          return false // isolated store: a package routes through the virtual store\n        }\n      }\n    }\n    // Packages exist and none route through `.pnpm` → hoisted. No packages → flat default.\n    return sawPackage\n  })\n\n  /**\n   * Memo for `locateFromDepOrRoot`, keyed by `name@version`. pnpm's content-addressed virtual\n   * store guarantees that any given `name@version` resolves to a single location on disk, so\n   * once we've resolved a package we can short-circuit every subsequent lookup. This is the\n   * dominant speedup for large workspaces where the `pnpm list --json` tree contains the same\n   * `name@version` thousands of times (one entry per dependent).\n   */\n  private readonly locateMemo: Map<string, Promise<Package | null>> = new Map()\n\n  /**\n   * Visited set for `collectDepsRecursively`, keyed by `name@version`. Without this we re-walk\n   * every shared subtree of the pnpm list output, exploding work in deep workspaces.\n   */\n  private readonly collectedDeps: Set<string> = new Set()\n\n  /** Reverse index of `allDependencies` keyed by package name (without version). Built once on\n   *  first access inside `extractProductionDependencyGraph`, after `allDependencies` is settled. */\n  private _allDepsByName: Map<string, PnpmDependency> | null = null\n\n  /**\n   * Returns the workspace packages to iterate over, gated by detected pnpm version:\n   * - pnpm v11+: multi-entry workspace output → return the full parsed array\n   * - pnpm < v11 / non-workspace / detection failure: single-tree behavior → return only [0]\n   */\n  private get allWorkspacePackages(): PnpmDependency[] {\n    if (this._pnpmMajorVersion >= 11) {\n      return this._allWorkspacePackages\n    }\n    return this._allWorkspacePackages.slice(0, 1)\n  }\n\n  protected getArgs(): string[] {\n    return [\"list\", \"--prod\", \"--json\", \"--depth\", \"Infinity\", \"--silent\", \"--loglevel=error\"]\n  }\n\n  private getAllDepsByName(): Map<string, PnpmDependency> {\n    if (!this._allDepsByName) {\n      this._allDepsByName = new Map()\n      for (const [id, dep] of this.allDependencies.entries()) {\n        const { name } = this.parseNameVersion(id)\n        if (!this._allDepsByName.has(name)) {\n          this._allDepsByName.set(name, dep)\n        }\n      }\n    }\n    return this._allDepsByName\n  }\n\n  /**\n   * Locate a package version, preferring the dep's own reported path before falling back to rootDir.\n   * This is critical for pnpm non-hoisted (virtual store) setups where each package has its own\n   * nested node_modules. Searching only from rootDir can resolve the wrong version when multiple\n   * versions of a dep exist in the workspace.\n   */\n  private async locateFromDepOrRoot(pkgName: string, parentPath: string | undefined, requiredRange?: string) {\n    // pnpm's virtual store is content-addressed: every `name@version` lookup is deterministic,\n    // so memoize on the exact version. `requiredRange` is normally an exact version coming from\n    // the pnpm list output (e.g. `value.version`), which makes this cache hit on duplicates.\n    // Only memoize when we have a concrete version — semver ranges could resolve differently\n    // depending on what's installed at `parentPath` vs root, so skip the cache for those.\n    const memoKey = requiredRange && /^\\d/.test(requiredRange) ? `${pkgName}@${requiredRange}` : null\n    if (memoKey != null) {\n      const cached = this.locateMemo.get(memoKey)\n      if (cached != null) {\n        return cached\n      }\n    }\n\n    // pnpm's default `.pnpm` virtual store is flat, so `downwardSearch` would burn thousands\n    // of `readdir`/`lstat` calls finding nothing. With `nodeLinker: hoisted`, however, the\n    // layout is a traditional nested `node_modules` tree where version-conflicted packages\n    // land at `<root>/node_modules/A/node_modules/B` — downward BFS is needed to find them.\n    const skipDownwardSearch = !(await this.isHoisted.value)\n    const promise = (async (): Promise<Package | null> => {\n      // Phase 1: find a version that SATISFIES requiredRange, trying the dep's own location\n      // first, then the workspace root. Crucially, neither pass accepts an out-of-range override\n      // here — so a wrong-version copy reachable via upward search from `parentPath` (e.g. a\n      // hoisted top-level dep) can't shadow the correct nested copy under root. Without this, a\n      // package that pnpm deduped to a peer's node_modules resolves its transitive deps to the\n      // wrong hoisted version (see jsonfile under two fs-extra majors). The root pass uses the\n      // same `skipDownwardSearch` as everywhere else: in a hoisted layout it is already false, so\n      // the nested `<root>/node_modules/A/node_modules/B` copy is found via BFS; in the flat\n      // `.pnpm` virtual store it stays true (forcing it on there would burn thousands of\n      // readdir/lstat calls — and on Windows, where pnpm uses junctions that `lstat` reports as\n      // directories, the BFS walks the entire store and resolves the wrong paths).\n      const satisfying =\n        (parentPath ? await this.cache.locatePackageVersion({ pkgName, parentDir: parentPath, requiredRange, skipDownwardSearch, skipOverrideFallback: true }) : null) ??\n        (await this.cache.locatePackageVersion({ pkgName, parentDir: this.rootDir, requiredRange, skipDownwardSearch, skipOverrideFallback: true }))\n      if (satisfying) {\n        return satisfying\n      }\n      // Phase 2: no version satisfies requiredRange (package-manager override, or no range\n      // given). Fall back to the original dep-then-root order, now allowing override versions.\n      const fromDep = parentPath ? await this.cache.locatePackageVersion({ pkgName, parentDir: parentPath, requiredRange, skipDownwardSearch }) : null\n      if (fromDep) {\n        return fromDep\n      }\n      return this.cache.locatePackageVersion({ pkgName, parentDir: this.rootDir, requiredRange, skipDownwardSearch })\n    })()\n\n    if (memoKey != null) {\n      this.locateMemo.set(memoKey, promise)\n    }\n    return promise\n  }\n\n  // pnpm 10+ does not automatically preserve transitive optional platform-specific\n  // packages (e.g. sass-embedded-linux-x64) across lock file regeneration. Users\n  // must list them as direct optionalDependencies. Missing ones are emitted as\n  // PKG_OPTIONAL_PLATFORM_NOT_INSTALLED warnings in the log summary.\n  protected async extractProductionDependencyGraph(tree: PnpmDependency, dependencyId: string) {\n    if (this.productionGraph[dependencyId]) {\n      return\n    }\n    this.productionGraph[dependencyId] = { dependencies: [] }\n\n    if ((tree.dedupedDependenciesCount ?? 0) > 0) {\n      const realDep = this.allDependencies.get(dependencyId)\n      if (realDep) {\n        this.cache.logSummary[LogMessageByKey.PKG_DUPLICATE_REF].push(dependencyId)\n        tree = realDep\n      } else {\n        this.cache.logSummary[LogMessageByKey.PKG_DUPLICATE_REF_UNRESOLVED].push(dependencyId)\n        return\n      }\n    }\n\n    const packageName = tree.name || tree.from\n    const { packageJson: locatedJson } = (await this.locateFromDepOrRoot(packageName, tree.path, tree.version)) || {}\n    // Fallback: the app root package is never installed inside a node_modules directory, so\n    // the name-based lookup above returns null. Reading directly from tree.path ensures that\n    // link: dependencies — which some pnpm versions omit from `pnpm list --prod` output —\n    // still appear in `all` and therefore reach the production graph.\n    const packageJson = locatedJson ?? (tree.path ? ((await _fsExtra.readJson(path.join(tree.path, \"package.json\")).catch(() => null)) as PackageJson | null) : null)\n\n    const all = packageJson ? { ...packageJson.dependencies, ...packageJson.optionalDependencies } : { ...tree.dependencies, ...tree.optionalDependencies }\n    const optional = packageJson ? { ...packageJson.optionalDependencies } : {}\n\n    const deps: Record<string, PnpmDependency> = { ...(tree.dependencies || {}), ...(tree.optionalDependencies || {}) }\n\n    // pnpm --prod omits sub-deps for link: packages (and synthetic entries derived from them).\n    // For any dep declared in the package.json (all) that pnpm left out of the tree, recover\n    // the resolved entry from allDependencies so it lands in the production graph.\n    const byName = this.getAllDepsByName()\n    for (const depName of Object.keys(all)) {\n      if (!deps[depName]) {\n        const dep = byName.get(depName)\n        if (dep && isValidKey(depName)) {\n          deps[depName] = dep\n        }\n      }\n    }\n\n    this.productionGraph[dependencyId] = { dependencies: [] }\n    const depPromises = Object.entries(deps).map(async ([packageName, dependency]) => {\n      // First check if it's in production dependencies\n      if (!all[packageName]) {\n        return undefined\n      }\n\n      // Then check if optional dependency path exists (using actual resolved path)\n      if (optional[packageName]) {\n        const pkg = await this.locateFromDepOrRoot(packageName, tree.path, dependency.version)\n        if (!pkg) {\n          this.logMissingDependency(`${packageName}@${dependency.version}`)\n          return undefined\n        }\n      }\n      const { id: childDependencyId, pkgOverride } = this.normalizePackageVersion(packageName, dependency)\n      await this.extractProductionDependencyGraph(pkgOverride, childDependencyId)\n      return childDependencyId\n    })\n\n    const collectedDependencies: string[] = []\n    for (const dep of depPromises) {\n      const result = await dep\n      if (result !== undefined) {\n        collectedDependencies.push(result)\n      }\n    }\n    this.productionGraph[dependencyId] = { dependencies: collectedDependencies }\n  }\n\n  protected async collectAllDependencies(_tree: PnpmDependency, _appPackageName: string): Promise<void> {\n    for (const root of this.allWorkspacePackages) {\n      await this.collectDepsRecursively(root)\n    }\n    // pnpm --prod omits link: packages from its JSON output entirely; pick them up from the\n    // app's package.json so their transitive deps are included in allDependencies.\n    await this.collectOmittedLinkPackages()\n  }\n\n  /**\n   * Resolve a `link:` dependency to its real on-disk source directory — never the `node_modules`\n   * junction pnpm creates for it. Returns null for non-link deps.\n   *\n   * Why this matters: resolving a link: dep through `node_modules` (locateFromDepOrRoot) yields the\n   * junction, which CI cannot read across drives. CI checks out the repo on `D:` but installs the\n   * app under `C:\\…\\Temp`, so the junction is a cross-volume link that `realpath`/`stat` fail on,\n   * silently dropping the package from the asar. The link target is a plain directory that reads\n   * fine from any drive, so we resolve straight to it.\n   */\n  private resolveLinkTarget(value: PnpmDependency): string | null {\n    const version = value.version\n    if (typeof version !== \"string\" || !version.startsWith(\"link:\")) {\n      return null\n    }\n    const spec = version.slice(\"link:\".length)\n    // A cross-drive link cannot be expressed relative, so pnpm reports it as an absolute path —\n    // use it directly. Otherwise prefer pnpm's already-resolved absolute `path` (the source dir,\n    // never the junction), falling back to resolving the relative spec against the workspace root.\n    if (path.isAbsolute(spec)) {\n      return path.normalize(spec)\n    }\n    if (value.path && path.isAbsolute(value.path)) {\n      return path.normalize(value.path)\n    }\n    return path.resolve(this.rootDir, spec)\n  }\n\n  private async readPackageJsonAt(dir: string): Promise<Package | null> {\n    const packageJson = (await _fsExtra.readJson(path.join(dir, \"package.json\")).catch(() => null)) as PackageJson | null\n    return packageJson ? { packageDir: dir, packageJson } : null\n  }\n\n  /**\n   * Visit a single dependency node, adding it and its transitive deps to allDependencies.\n   *\n   * For packages that pnpm list did NOT expand (link: packages and the synthetic entries\n   * derived from them), the tree has empty dependencies/optionalDependencies. In that case\n   * we fall back to the on-disk package.json to discover transitive deps, resolving each one\n   * from the package's own node_modules first (where pnpm placed them).\n   */\n  private async visitDep(key: string, value: PnpmDependency): Promise<void> {\n    const id = `${key}@${value.version}`\n    // The pnpm list output can include the same `name@version` thousands of times across a\n    // deep workspace; without this guard we re-resolve and re-recurse each occurrence.\n    if (this.collectedDeps.has(id)) {\n      return\n    }\n    this.collectedDeps.add(id)\n\n    const located = await this.locateFromDepOrRoot(key, value.path, value.version)\n    // For a link: dep, store the real source dir (the link target) rather than the located path,\n    // which is the node_modules junction. Across drives that junction is unreadable (see\n    // resolveLinkTarget), so storing it makes the package vanish from the asar.\n    const linkTarget = this.resolveLinkTarget(value)\n    const resolvedPath = linkTarget ?? located?.packageDir ?? value.path\n    this.allDependencies.set(id, { ...value, path: resolvedPath })\n\n    // For transitive-dep discovery of entries pnpm did not expand (link: packages), use the\n    // located package.json; fall back to the link target's own package.json when the junction\n    // could not be resolved (again, the cross-drive case).\n    const pkg = located ?? (linkTarget != null ? await this.readPackageJsonAt(linkTarget) : null)\n    const hasTreeDeps = Object.keys(value.dependencies ?? {}).length > 0 || Object.keys(value.optionalDependencies ?? {}).length > 0\n    if (!hasTreeDeps && pkg?.packageJson) {\n      // pnpm list omits sub-deps for link: packages and for entries where the reported path\n      // doesn't expand transitive deps (e.g. a link: package's nested dep). Use the on-disk\n      // package.json to discover what to include, and pass the declared version range so that\n      // resolution skips wrong-version hoisted packages and finds the correct nested copy.\n      const pkgDepsDecl = { ...(pkg.packageJson.dependencies || {}), ...(pkg.packageJson.optionalDependencies || {}) }\n      for (const [depName, depRange] of Object.entries(pkgDepsDecl)) {\n        const resolved = await this.locateFromDepOrRoot(depName, pkg.packageDir, typeof depRange === \"string\" ? depRange : undefined)\n        if (!resolved) {\n          continue\n        }\n        await this.visitDep(depName, {\n          from: depName,\n          name: depName,\n          version: resolved.packageJson.version,\n          path: resolved.packageDir,\n          dependencies: {},\n          optionalDependencies: {},\n        } as unknown as PnpmDependency)\n      }\n    } else {\n      await this.collectDepsRecursively(value)\n    }\n  }\n\n  private async collectDepsRecursively(tree: PnpmDependency): Promise<void> {\n    for (const [key, value] of Object.entries(tree.dependencies || {})) {\n      await this.visitDep(key, value)\n    }\n    for (const [key, value] of Object.entries(tree.optionalDependencies || {})) {\n      await this.visitDep(key, value)\n    }\n  }\n\n  /**\n   * pnpm excludes link: packages from `pnpm list --prod` output. Read the app's package.json\n   * directly to find any link: deps that were silently omitted and visit them so their\n   * transitive deps end up in allDependencies.\n   */\n  private async collectOmittedLinkPackages(): Promise<void> {\n    const appPkgJson = (await _fsExtra.readJson(path.join(this.rootDir, \"package.json\")).catch(() => null)) as PackageJson | null\n    if (!appPkgJson) {\n      return\n    }\n    const allDeps = { ...(appPkgJson.dependencies || {}), ...(appPkgJson.optionalDependencies || {}) }\n    for (const [name, version] of Object.entries(allDeps)) {\n      if (typeof version !== \"string\" || !version.startsWith(\"link:\")) {\n        continue\n      }\n      // Resolve the link: target path directly — bypasses potentially broken cross-drive\n      // Windows junctions (C:→D:) that locateFromDepOrRoot would traverse through\n      // node_modules and silently fail on (readJson returns null via .catch).\n      const linkRelPath = version.slice(\"link:\".length)\n      const linkTarget = path.isAbsolute(linkRelPath) ? linkRelPath : path.resolve(this.rootDir, linkRelPath)\n      const directPkg = (await _fsExtra.readJson(path.join(linkTarget, \"package.json\")).catch(() => null)) as PackageJson | null\n      const resolved = directPkg ? { packageDir: linkTarget, packageJson: directPkg } : await this.locateFromDepOrRoot(name, this.rootDir, undefined)\n      if (!resolved) {\n        continue\n      }\n      await this.visitDep(name, {\n        from: name,\n        name,\n        version: resolved.packageJson.version,\n        path: resolved.packageDir,\n        dependencies: {},\n        optionalDependencies: {},\n      } as unknown as PnpmDependency)\n    }\n  }\n\n  protected override getTreeFromWorkspaces(tree: PnpmDependency, packageName: string): PnpmDependency {\n    // pnpm v10 workspace: app is nested as a dependency of root — handled by base class\n    const result = super.getTreeFromWorkspaces(tree, packageName)\n    if (result !== tree) {\n      return result\n    }\n    // pnpm v11 workspace: each workspace package is a separate top-level array entry;\n    // non-workspace (single-tree): find returns the one entry or undefined → falls back to tree\n    const match = this.allWorkspacePackages.find(pkg => pkg.name === packageName || pkg.from === packageName)\n    return match ?? tree\n  }\n\n  protected async parseDependenciesTree(jsonBlob: string): Promise<PnpmDependency> {\n    const dependencyTree = this.extractJsonFromPollutedOutput<PnpmDependency[]>(jsonBlob)\n    this._allWorkspacePackages = dependencyTree\n    this._pnpmMajorVersion = await this.pnpmVersion.value\n    return dependencyTree[0]\n  }\n}\n"]}