pnpm-settings-migrator 0.19.0 → 0.20.0

package/README.md

@@ -333,6 +333,26 @@ destination write fails. Credentials and trusted global settings keep their
 existing protections. Earlier or unconfirmed targets retain incoming include
 indexes with diagnostics and reject existing included workspaces.
 
+From pnpm 12.16.0, `strictSsl` and `runtime` accept booleans or null,
+`localAddress` and `tag` accept strings or null, and `requiredScripts` accepts
+string arrays or null. These settings remain in their sources for earlier or
+unconfirmed v12 targets. `runtime: false` disables installing declared runtimes;
+`tag: next` selects that distribution tag when adding a package without a version.
+Invalid IP address strings stay unchanged because pnpm treats them as unset.
+String placeholders are preserved without expansion. Invalid types keep the
+complete setting in its source. For example, `required-scripts[]=build` becomes
+`requiredScripts: [build]` at 12.16.0 and stays in `.npmrc` at 12.15.0.
+
+From pnpm 11.28.9, v11 registry declarations also accept `serverType: pnpr`.
+Earlier or unconfirmed v11 targets retain the complete registry map. The setting
+does not enable v12-only registry fields such as `networkConcurrency` or `ecosystem`.
+
+pnpm 12.16 no longer consumes `scriptsPrependNodePath`, so the migrator keeps
+incoming values in their sources and rejects existing workspace values before
+writes. Project `ci` values and the global-only `symlinkedLockfileTargetDirs`
+also stay in their sources. Configure the latter in trusted global configuration
+or through `PNPM_CONFIG_SYMLINKED_LOCKFILE_TARGET_DIRS`.
+
 pnpm v12 reads `filter` and `filterProd` from CLI arguments or `updateConfig`
 hooks, not workspace YAML. These settings remain in their source with
 diagnostics for v12 targets; existing YAML containing them blocks migration.
@@ -385,6 +405,24 @@ Notes:
 - Invalid registry locations, including relative paths and object property names
   such as `__proto__`, remain in their sources with diagnostics. Registry
   conversion never uses inherited object properties as declarations.
+- Registry maps are validated as a whole, including declarations without
+  versioned fields. An invalid sibling
+  declaration keeps every registry in its source under all merge strategies;
+  existing incompatible maps block migration before any writes.
+- A URL key must name a declaration object. String values are accepted only in
+  the legacy scope map representation, whose keys cannot look like URLs.
+  Invalid registry settings remain intact in `package.json` and `.npmrc`, while
+  unrelated valid settings can still migrate and be cleaned from their sources.
+- Legacy `<scope>: <url>` routes and URL-keyed declarations cannot be mixed,
+  including when `replaceDeprecated` introduces the mixture. The structure is
+  checked independently of versioned registry fields.
+- Registry prefixes must be unique. A scope may be repeated only when it routes
+  to the same registry after the target pnpm version's URL normalization. From
+  12.11.1, the exact HTTPS and protocol-relative npm `.com` registry roots are
+  equivalent to `.org`; earlier or unconfirmed v12 targets compare them literally.
+  Routing conflicts introduced by merging or deprecated-setting conversion stop
+  migration before any destination writes
+  or source cleanup, including when registries belong to an included YAML file.
 - Dynamic `${...}` values in `httpProxy`, `httpsProxy`, `noProxy`, `proxy`, and
   `noproxy` stay in their source for every target. Project YAML does not expand
   these placeholders; configure them globally in trusted configuration or use
@@ -429,21 +467,29 @@ Notes:
 - The migrator does not update the `packageManager` version, CI environment variables,
   shell setup, or pnpm commands in scripts. When `packageManager` still pins pnpm 10,
   pass `--compatibility v11` explicitly and update the pin separately.
-- Compatibility checks cover pnpm 11.28.7 and 12.15.0, including 11.28.0,
+- Compatibility checks cover pnpm 11.28.9 and 12.16.1, including 11.28.0,
   11.28.1, 11.28.2, 11.28.3, 11.28.4, 11.28.5, 11.28.6, 12.7.0, 12.8.0,
   12.8.1, 12.8.2, 12.9.0, 12.9.1, 12.10.0, 12.10.1, 12.11.0, 12.11.1,
-  12.11.2, 12.12.0, 12.12.1, 12.13.0, and 12.14.0.
+  12.11.2, 12.12.0, 12.12.1, 12.13.0, 12.14.0, 11.28.7, 11.28.8,
+  12.15.0, and 12.16.0.
   Earlier regressions remain at 11.25.0,
   11.26.0, 11.27.1, 12.2.1, 12.3.4, 12.4.0, 12.4.2, 12.5.0, 12.5.1, and 12.6.0.
-  As [audited on 2026-10-22](docs/research/pnpm-settings-bump-2026-10-22.md),
-  npm `latest` and the highest confirmed stable release are 12.15.0, also on
-  `latest-12` and `next-12`. The highest stable v11 release, 11.28.7, is on
-  `next-11`; `latest-11` still points to 11.28.6. GitHub marks both targets as
-  non-prereleases. The project is pinned to 12.15.0. These checks verify the
+  As [audited on 2026-10-29](docs/research/pnpm-settings-bump-2026-10-29.md),
+  npm `latest` and the highest confirmed stable release are 12.16.1, also on
+  `latest-12` and `next-12`. The highest stable v11 release, 11.28.9, is on
+  `latest-11` and `next-11`. GitHub marks both targets as non-prereleases.
+  The project is pinned to 12.16.1. These checks verify the
   documented fixtures, not every setting in every release. Local and config
   dependency `include` consumption is verified on 12.15.0, with 12.14.0 as the
   preceding boundary. v10 has unit regressions and source review
-  through 10.34.7; real v10 consumption remains unverified.
+  through 10.34.9; real v10 consumption remains unverified. The 12.16 fixtures
+  verify TLS certificate handling against a temporary HTTPS registry, dist-tag
+  selection, runtime suppression, required script enforcement, and frozen
+  installs. They use OpenSSL to create a disposable certificate.
+  Routing fixtures at 11.28.8, 11.28.9, 12.9.0, 12.10.0, 12.11.0, 12.11.1,
+  12.11.2, 12.15.0, and 12.16.1 verify prefix/scope conflicts, mixed registry
+  representations after conversion, and rejection before writes under all three
+  strategies. They compare native URL normalization across the 12.11.1 boundary.
   The removed `pnpm install --resolution-only` CLI flag is outside this settings
   migrator's scope; replace it with `pnpm peers check` in scripts before upgrading.
 

package/dist/cli.mjs

@@ -335,6 +335,7 @@ const PNPM_PROJECT_REFUSED_SETTINGS = [
 	"scope",
 	"selectedProjectsGraph",
 	"stateDir",
+	"symlinkedLockfileTargetDirs",
 	"tools",
 	"userConfig",
 	"userconfig",
@@ -635,6 +636,14 @@ const PNPM_V12_11_MINIMUM_VERSION = [
 	0
 ];
 /**
+* Release canonicalizing npm's HTTPS and protocol-relative registry aliases.
+*/
+const PNPM_V12_11_1_MINIMUM_VERSION = [
+	12,
+	11,
+	1
+];
+/**
 * Release introducing remote cache configuration and missing peer types.
 */
 const PNPM_V12_12_MINIMUM_VERSION = [
@@ -683,6 +692,32 @@ const PNPM_V12_15_MINIMUM_VERSION = [
 	0
 ];
 /**
+* Release introducing pnpr registry declarations in v11.
+*/
+const PNPM_V11_28_9_MINIMUM_VERSION = [
+	11,
+	28,
+	9
+];
+/**
+* Release consuming TLS, runtime, script requirements, and dist-tag settings.
+*/
+const PNPM_V12_16_MINIMUM_VERSION = [
+	12,
+	16,
+	0
+];
+/**
+* Workspace settings first consumed by pnpm v12 in 12.16.0.
+*/
+const PNPM_V12_16_WORKSPACE_SETTINGS = [
+	"localAddress",
+	"requiredScripts",
+	"runtime",
+	"strictSsl",
+	"tag"
+];
+/**
 * Workspace settings first consumed by pnpm v12 in 12.11.0.
 */
 const PNPM_V12_11_WORKSPACE_SETTINGS = [
@@ -708,6 +743,11 @@ const PNPM_V12_7_WORKSPACE_SETTINGS = [
 * @see https://github.com/pnpm/pnpm/blob/v12.4.0/pnpm/crates/config/src/workspace_yaml.rs
 */
 const PNPM_SETTINGS_CAPABILITIES = [
+	{
+		minimumVersion: PNPM_V12_16_MINIMUM_VERSION,
+		workspaceFields: PNPM_V12_16_WORKSPACE_SETTINGS,
+		taskFields: []
+	},
 	{
 		minimumVersion: PNPM_V11_28_7_MINIMUM_VERSION,
 		workspaceFields: [
@@ -817,7 +857,8 @@ const PNPM_V12_ONLY_WORKSPACE_SETTINGS = [
 	"globalShims"
 ];
 /**
-* Legacy fields absent from pnpm v12's workspace reader through 12.15.0.
+* Legacy fields absent from pnpm v12's base workspace reader.
+* Version capabilities restore fields consumed by later releases.
 * Removed aliases with explicit migration replacements are kept separately.
 *
 * @see https://github.com/pnpm/pnpm/blob/v12.15.0/pnpm/crates/config/src/workspace_yaml/settings.rs
@@ -829,6 +870,7 @@ const PNPM_V12_IGNORED_WORKSPACE_SETTINGS = [
 	"auditIgnorePrune",
 	"autoConfirmAllPrompts",
 	"binLinks",
+	"ci",
 	"commitHooks",
 	"cpu",
 	"depth",
@@ -1304,6 +1346,52 @@ function isRegistryUrl(value) {
 	return isString(value) && URL.canParse(value.startsWith("//") ? `https:${value}` : value);
 }
 /**
+* Normalize a registry only for comparing scope routes, as the target does.
+* Prefix uniqueness deliberately uses the original declarations instead.
+*
+* @param registry - Registry URL already checked for valid syntax
+* @param target - Confirmed target controlling URL normalization
+*
+* @returns Registry identity used by the target's scope lookup
+*/
+function normalizeScopeRegistry(registry, target) {
+	let normalized = registry;
+	if (target.compatibility === "v11" && URL.canParse(registry)) normalized = new URL(registry).toString();
+	else if (supportsMinimumVersion(target.version, PNPM_V12_11_1_MINIMUM_VERSION)) normalized = registry.replace(/^(?<protocol>https:\/\/|\/\/)registry\.npmjs\.com\/?$/u, "$<protocol>registry.npmjs.org/");
+	return normalized.endsWith("/") ? normalized : `${normalized}/`;
+}
+/**
+* Detect duplicate prefixes and scope routes pointing at different registries.
+* Called during source selection and final workspace validation before writes.
+*
+* @param key - Canonical setting name
+* @param value - Untrusted registry map
+* @param target - Release whose declaration routing rules apply
+*
+* @returns Whether declarations conflict with another route in the same map
+*/
+function hasConflictingRegistryRoutes(key, value, target) {
+	if (key !== "registries" || target.compatibility === "v10" || !isPlainObject(value)) return false;
+	const prefixes = /* @__PURE__ */ new Set();
+	const scopes = /* @__PURE__ */ new Map();
+	return Object.entries(value).some(([registry, declaration]) => {
+		if (!isPlainObject(declaration)) return false;
+		const { prefix } = declaration;
+		if (isString(prefix)) {
+			if (prefixes.has(prefix)) return true;
+			prefixes.add(prefix);
+		}
+		if (!isArray(declaration.scopes)) return false;
+		const normalized = normalizeScopeRegistry(registry, target);
+		return declaration.scopes.filter(isString).some((scope) => {
+			const existing = scopes.get(scope);
+			if (existing !== void 0 && existing !== normalized) return true;
+			scopes.set(scope, normalized);
+			return false;
+		});
+	});
+}
+/**
 * Validate locations in legacy registry maps and URL-keyed declarations.
 *
 * @param key - Canonical workspace setting name
@@ -1317,6 +1405,73 @@ function hasInvalidRegistryLocations(key, value) {
 	if (key === "namedRegistries") return Object.values(value).some((url) => !isRegistryUrl(url));
 	return Object.entries(value).some(([url, entry]) => isString(entry) ? !isRegistryUrl(entry) : !isRegistryUrl(url));
 }
+/**
+* Check the declared type of a non-null registry option.
+*
+* @param field - Registry declaration field name
+* @param value - Untrusted option value
+* @param target - Release controlling registry server types
+*
+* @returns Whether a nested option is invalid for pnpm 12.9
+*/
+function hasInvalidRegistryOptionValue(field, value, target) {
+	switch (field) {
+		case "networkConcurrency": return !isNumber(value) || !Number.isSafeInteger(value) || value <= 0;
+		case "ecosystem": return !isString(value) || ![
+			"npm",
+			"cargo",
+			"pypi"
+		].includes(value);
+		case "packages": return !isArray(value) || !value.every(isString);
+		case "scopes": return !isArray(value) || value.some((scope) => !isString(scope) || !scope.startsWith("@"));
+		case "prefix": return !isString(value);
+		case "serverType": return !isString(value) || ![
+			"npm",
+			"artifactory",
+			...supportsMinimumVersion(target.version, PNPM_V12_15_MINIMUM_VERSION) || supportsMinimumVersion(target.version, PNPM_V11_28_9_MINIMUM_VERSION) ? ["pnpr"] : []
+		].includes(value);
+		case "supportsTimeField": return !isBoolean(value);
+		default: return true;
+	}
+}
+/**
+* Validate every field in a registry declaration for the selected release.
+*
+* @param declaration - Registry options with or without versioned fields
+* @param target - Release controlling registry server types
+*
+* @returns Whether a nested option is unknown or invalid for the target
+*/
+function hasInvalidRegistryDeclaration(declaration, target) {
+	const ecosystem = Reflect.get(declaration, "ecosystem") ?? "npm";
+	return Object.entries(declaration).some(([field, value]) => {
+		if (!PNPM_V12_REGISTRY_DECLARATION_FIELDS.includes(field)) return true;
+		if (value === null) return false;
+		if (field === "packages" && ecosystem !== "pypi") return true;
+		if ([
+			"scopes",
+			"prefix",
+			"serverType",
+			"supportsTimeField"
+		].includes(field) && ecosystem !== "npm") return true;
+		return hasInvalidRegistryOptionValue(field, value, target);
+	});
+}
+/**
+* Validate registry representation before release-specific declaration fields.
+* Pure legacy scope maps must use scope keys rather than registry URLs.
+*
+* @param value - Registry map already checked for valid locations
+* @param target - Release controlling declaration fields and enum values
+*
+* @returns Whether any entry prevents migration of the complete map
+*/
+function hasIncompatibleRegistryValue(value, target) {
+	const entries = Object.values(value);
+	if (entries.every(isString)) return Object.keys(value).some((key) => key.includes("://") || key.startsWith("//"));
+	if (!entries.every(isPlainObject)) return true;
+	return entries.some((entry) => Object.hasOwn(entry, "networkConcurrency") && !supportsMinimumVersion(target.version, PNPM_V12_9_MINIMUM_VERSION) || hasInvalidRegistryDeclaration(entry, target));
+}
 //#endregion
 //#region src/features/settings/permissions.ts
 /**
@@ -1630,58 +1785,6 @@ function hasInvalidNodeLinkerOptions(value) {
 	return Object.hasOwn(value, "excluded") && (!isArray(excluded) || !excluded.every(isString));
 }
 /**
-* Check the declared type of a non-null registry option.
-*
-* @param field - Registry declaration field name
-* @param value - Untrusted option value
-* @param target - Release controlling registry server types
-*
-* @returns Whether a nested option is invalid for pnpm 12.9
-*/
-function hasInvalidRegistryOptionValue(field, value, target) {
-	switch (field) {
-		case "networkConcurrency": return !isNumber(value) || !Number.isSafeInteger(value) || value <= 0;
-		case "ecosystem": return !isString(value) || ![
-			"npm",
-			"cargo",
-			"pypi"
-		].includes(value);
-		case "packages": return !isArray(value) || !value.every(isString);
-		case "scopes": return !isArray(value) || value.some((scope) => !isString(scope) || !scope.startsWith("@"));
-		case "prefix": return !isString(value);
-		case "serverType": return !isString(value) || ![
-			"npm",
-			"artifactory",
-			...supportsMinimumVersion(target.version, PNPM_V12_15_MINIMUM_VERSION) ? ["pnpr"] : []
-		].includes(value);
-		case "supportsTimeField": return !isBoolean(value);
-		default: return true;
-	}
-}
-/**
-* Validate a registry declaration that opts into per-registry concurrency.
-*
-* @param declaration - Registry options containing versioned fields
-* @param target - Release controlling registry server types
-*
-* @returns Whether a nested option is invalid for pnpm 12.9
-*/
-function hasInvalidRegistryConcurrencyDeclaration(declaration, target) {
-	const ecosystem = Reflect.get(declaration, "ecosystem") ?? "npm";
-	return Object.entries(declaration).some(([field, value]) => {
-		if (!PNPM_V12_REGISTRY_DECLARATION_FIELDS.includes(field)) return true;
-		if (value === null) return false;
-		if (field === "packages" && ecosystem !== "pypi") return true;
-		if ([
-			"scopes",
-			"prefix",
-			"serverType",
-			"supportsTimeField"
-		].includes(field) && ecosystem !== "npm") return true;
-		return hasInvalidRegistryOptionValue(field, value, target);
-	});
-}
-/**
 * Validate scalar alternatives of the pnpm 12.10 linker and lockfile unions.
 *
 * @param key - Canonical setting name
@@ -1737,14 +1840,7 @@ function hasIncompatibleV12SettingValue(key, value, target) {
 	if (!value || typeof value !== "object") return false;
 	if (key === "nodeLinker") return !supportsV12_10 || hasInvalidNodeLinkerOptions(value);
 	if (key === "lockfile") return hasInvalidLockfileOptions(value, target);
-	if (key === "registries") {
-		const entries = Object.values(value);
-		return entries.some((entry) => {
-			if (!entry || typeof entry !== "object" || !Object.hasOwn(entry, "networkConcurrency") && !(Object.hasOwn(entry, "serverType") && (Reflect.get(entry, "serverType") === "pnpr" || supportsMinimumVersion(target.version, PNPM_V12_15_MINIMUM_VERSION)))) return false;
-			if (Object.hasOwn(entry, "networkConcurrency") && !supportsMinimumVersion(target.version, PNPM_V12_9_MINIMUM_VERSION)) return true;
-			return entries.some(isString) || hasInvalidRegistryConcurrencyDeclaration(entry, target);
-		});
-	}
+	if (key === "registries") return hasIncompatibleRegistryValue(value, target);
 	return false;
 }
 //#endregion
@@ -1793,6 +1889,23 @@ function hasInvalidV11PatchValue(key, value, target) {
 	return false;
 }
 /**
+* Validate the fields newly consumed or ignored by pnpm 12.16.
+*
+* @param key - Canonical setting name
+* @param value - Untrusted source value
+* @param target - Release controlling the workspace reader
+*
+* @returns Whether the setting cannot be represented for this target
+*/
+function hasInvalidV12_16Value(key, value, target) {
+	if (!supportsMinimumVersion(target.version, PNPM_V12_16_MINIMUM_VERSION)) return false;
+	if (key === "scriptsPrependNodePath") return true;
+	if (["strictSsl", "runtime"].includes(key)) return value !== null && !isBoolean(value);
+	if (["localAddress", "tag"].includes(key)) return value !== null && !isString(value);
+	if (key === "requiredScripts") return value !== null && (!isArray(value) || !value.every(isString));
+	return false;
+}
+/**
 * Validate scalar settings introduced or first consumed in pnpm 12.6.
 *
 * @param key - Canonical setting name
@@ -1838,6 +1951,7 @@ function hasInvalidScalarValue(key, value, target) {
 * @returns Whether the value cannot be used by the target release
 */
 function hasInvalidReleaseValue(key, value, target) {
+	if (hasInvalidV12_16Value(key, value, target)) return true;
 	if (key === "globalShims" && supportsMinimumVersion(target.version, PNPM_V12_8_2_MINIMUM_VERSION)) return true;
 	if (key === "userAgent" && isString(value) && value.includes("${") && (supportsMinimumVersion(target.version, PNPM_V11_28_MINIMUM_VERSION) || supportsMinimumVersion(target.version, PNPM_V12_7_MINIMUM_VERSION))) return true;
 	if (key === "packages" && value !== null && value !== void 0 && supportsMinimumVersion(target.version, PNPM_V11_28_1_MINIMUM_VERSION)) return !isArray(value) || value.some((entry) => !isString(entry) || !entry);
@@ -2025,7 +2139,7 @@ function resolveSettingIssue({ allowedFields, target, key, npmrc, value }) {
 	if (compatibility !== "v10" && PROJECT_REFUSED_SETTINGS.has(key)) return "refused";
 	if (REGISTRY_SETTINGS.has(key) && containsUnsafeRegistryValue(value)) return "unsafe";
 	if (PROXY_SETTINGS.has(key) && isString(value) && value.includes("${")) return "unsafe";
-	if (hasInvalidRegistryLocations(key, value) || hasUnmigratableRuntimeFields(key, value, compatibility) || hasIncompatibleSettingValue(key, value, target)) return "incompatible";
+	if (hasInvalidRegistryLocations(key, value) || hasConflictingRegistryRoutes(key, value, target) || hasUnmigratableRuntimeFields(key, value, compatibility) || hasIncompatibleSettingValue(key, value, target)) return "incompatible";
 	if (key === "tasks" && hasUnsupportedTaskFields(value, taskSettings)) return "incompatible";
 	if (!workspaceSettings.has(key)) return isSettingFromAnotherVersion(key, compatibility) ? "incompatible" : "unknown";
 	if (allowedFields && !allowedFields.has(key)) return "unsupported";
@@ -4288,6 +4402,7 @@ async function migratePnpmSettings(rawOptions = {}) {
 		yarnResolutions: sources.packageJson.yarnResolutions
 	})) return result;
 	const pnpmWorkspaceResult = mergeIncludedWorkspace(workspace, incomingSettings, options.strategy);
+	assertCompatibleWorkspaceSettings(pnpmWorkspaceResult, target);
 	const workspaceFiles = workspace.include === void 0 ? [] : renderIncludedWorkspace(workspace, pnpmWorkspaceResult, {
 		...options,
 		target
@@ -4368,7 +4483,7 @@ const bold = getColor("bold");
 //#endregion
 //#region package.json
 var name = "pnpm-settings-migrator";
-var version = "0.19.0";
+var version = "0.20.0";
 //#endregion
 //#region src/cli/options.ts
 /**

package/dist/index.d.mts

@@ -193,7 +193,7 @@ interface PnpmCargoSettings {
  */
 interface PnpmRegistryDeclaration extends Omit<RegistryDeclaration, 'serverType'> {
   /**
-   * Registry protocol; pnpr tar registries require pnpm 12.15+.
+   * Registry protocol; pnpr requires pnpm 11.28.9+ or 12.15+.
    */
   serverType?: 'npm' | 'artifactory' | 'pnpr' | null;
   /**
@@ -268,6 +268,28 @@ interface PnpmSkillsSettings {
  * Settings supported by pnpm v12, subject to the resolved version capabilities.
  */
 interface PnpmSettingsV12 {
+  /**
+   * Verify registry TLS certificates (consumed by v12 from 12.16).
+   * Null leaves the upstream default effective.
+   */
+  strictSsl?: boolean | null;
+  /**
+   * Source IP for registry connections (consumed by v12 from 12.16).
+   * Invalid addresses are treated as unset by pnpm.
+   */
+  localAddress?: string | null;
+  /**
+   * Install declared runtimes unless false (consumed by v12 from 12.16).
+   */
+  runtime?: boolean | null;
+  /**
+   * Scripts every selected workspace project must define (v12.16+).
+   */
+  requiredScripts?: string[] | null;
+  /**
+   * Default distribution tag used when adding packages (v12.16+).
+   */
+  tag?: string | null;
   /**
    * Settings delegated to local YAML files or config dependencies (12.15+).
    * Wildcards are allowed only for local files.
@@ -648,7 +670,7 @@ interface PnpmSettingsV11 {
 /**
  * `pnpm-workspace.yaml` types.
  */
-type PnpmWorkspace = Omit<PnpmSettings, 'autoInstallPeersFromHighestMatch' | 'externalDependencies' | 'httpProxy' | 'httpsProxy' | 'lockfile' | 'nodeLinker' | 'provenance' | 'registries' | 'sideEffectsCache' | 'supportedArchitectures' | 'tasks'> & PnpmSettingsDeprecated & PnpmSettingsV11 & PnpmSettingsV12 & PnpmWorkspaceLegacy;
+type PnpmWorkspace = Omit<PnpmSettings, 'autoInstallPeersFromHighestMatch' | 'externalDependencies' | 'httpProxy' | 'httpsProxy' | 'lockfile' | 'nodeLinker' | 'provenance' | 'registries' | 'requiredScripts' | 'sideEffectsCache' | 'supportedArchitectures' | 'tasks'> & PnpmSettingsDeprecated & PnpmSettingsV11 & PnpmSettingsV12 & PnpmWorkspaceLegacy;
 //#endregion
 //#region src/types/package-json.d.ts
 /**

package/dist/index.mjs

@@ -333,6 +333,7 @@ const PNPM_PROJECT_REFUSED_SETTINGS = [
 	"scope",
 	"selectedProjectsGraph",
 	"stateDir",
+	"symlinkedLockfileTargetDirs",
 	"tools",
 	"userConfig",
 	"userconfig",
@@ -633,6 +634,14 @@ const PNPM_V12_11_MINIMUM_VERSION = [
 	0
 ];
 /**
+* Release canonicalizing npm's HTTPS and protocol-relative registry aliases.
+*/
+const PNPM_V12_11_1_MINIMUM_VERSION = [
+	12,
+	11,
+	1
+];
+/**
 * Release introducing remote cache configuration and missing peer types.
 */
 const PNPM_V12_12_MINIMUM_VERSION = [
@@ -681,6 +690,32 @@ const PNPM_V12_15_MINIMUM_VERSION = [
 	0
 ];
 /**
+* Release introducing pnpr registry declarations in v11.
+*/
+const PNPM_V11_28_9_MINIMUM_VERSION = [
+	11,
+	28,
+	9
+];
+/**
+* Release consuming TLS, runtime, script requirements, and dist-tag settings.
+*/
+const PNPM_V12_16_MINIMUM_VERSION = [
+	12,
+	16,
+	0
+];
+/**
+* Workspace settings first consumed by pnpm v12 in 12.16.0.
+*/
+const PNPM_V12_16_WORKSPACE_SETTINGS = [
+	"localAddress",
+	"requiredScripts",
+	"runtime",
+	"strictSsl",
+	"tag"
+];
+/**
 * Workspace settings first consumed by pnpm v12 in 12.11.0.
 */
 const PNPM_V12_11_WORKSPACE_SETTINGS = [
@@ -706,6 +741,11 @@ const PNPM_V12_7_WORKSPACE_SETTINGS = [
 * @see https://github.com/pnpm/pnpm/blob/v12.4.0/pnpm/crates/config/src/workspace_yaml.rs
 */
 const PNPM_SETTINGS_CAPABILITIES = [
+	{
+		minimumVersion: PNPM_V12_16_MINIMUM_VERSION,
+		workspaceFields: PNPM_V12_16_WORKSPACE_SETTINGS,
+		taskFields: []
+	},
 	{
 		minimumVersion: PNPM_V11_28_7_MINIMUM_VERSION,
 		workspaceFields: [
@@ -815,7 +855,8 @@ const PNPM_V12_ONLY_WORKSPACE_SETTINGS = [
 	"globalShims"
 ];
 /**
-* Legacy fields absent from pnpm v12's workspace reader through 12.15.0.
+* Legacy fields absent from pnpm v12's base workspace reader.
+* Version capabilities restore fields consumed by later releases.
 * Removed aliases with explicit migration replacements are kept separately.
 *
 * @see https://github.com/pnpm/pnpm/blob/v12.15.0/pnpm/crates/config/src/workspace_yaml/settings.rs
@@ -827,6 +868,7 @@ const PNPM_V12_IGNORED_WORKSPACE_SETTINGS = [
 	"auditIgnorePrune",
 	"autoConfirmAllPrompts",
 	"binLinks",
+	"ci",
 	"commitHooks",
 	"cpu",
 	"depth",
@@ -1297,6 +1339,52 @@ function isRegistryUrl(value) {
 	return isString(value) && URL.canParse(value.startsWith("//") ? `https:${value}` : value);
 }
 /**
+* Normalize a registry only for comparing scope routes, as the target does.
+* Prefix uniqueness deliberately uses the original declarations instead.
+*
+* @param registry - Registry URL already checked for valid syntax
+* @param target - Confirmed target controlling URL normalization
+*
+* @returns Registry identity used by the target's scope lookup
+*/
+function normalizeScopeRegistry(registry, target) {
+	let normalized = registry;
+	if (target.compatibility === "v11" && URL.canParse(registry)) normalized = new URL(registry).toString();
+	else if (supportsMinimumVersion(target.version, PNPM_V12_11_1_MINIMUM_VERSION)) normalized = registry.replace(/^(?<protocol>https:\/\/|\/\/)registry\.npmjs\.com\/?$/u, "$<protocol>registry.npmjs.org/");
+	return normalized.endsWith("/") ? normalized : `${normalized}/`;
+}
+/**
+* Detect duplicate prefixes and scope routes pointing at different registries.
+* Called during source selection and final workspace validation before writes.
+*
+* @param key - Canonical setting name
+* @param value - Untrusted registry map
+* @param target - Release whose declaration routing rules apply
+*
+* @returns Whether declarations conflict with another route in the same map
+*/
+function hasConflictingRegistryRoutes(key, value, target) {
+	if (key !== "registries" || target.compatibility === "v10" || !isPlainObject(value)) return false;
+	const prefixes = /* @__PURE__ */ new Set();
+	const scopes = /* @__PURE__ */ new Map();
+	return Object.entries(value).some(([registry, declaration]) => {
+		if (!isPlainObject(declaration)) return false;
+		const { prefix } = declaration;
+		if (isString(prefix)) {
+			if (prefixes.has(prefix)) return true;
+			prefixes.add(prefix);
+		}
+		if (!isArray(declaration.scopes)) return false;
+		const normalized = normalizeScopeRegistry(registry, target);
+		return declaration.scopes.filter(isString).some((scope) => {
+			const existing = scopes.get(scope);
+			if (existing !== void 0 && existing !== normalized) return true;
+			scopes.set(scope, normalized);
+			return false;
+		});
+	});
+}
+/**
 * Validate locations in legacy registry maps and URL-keyed declarations.
 *
 * @param key - Canonical workspace setting name
@@ -1310,6 +1398,73 @@ function hasInvalidRegistryLocations(key, value) {
 	if (key === "namedRegistries") return Object.values(value).some((url) => !isRegistryUrl(url));
 	return Object.entries(value).some(([url, entry]) => isString(entry) ? !isRegistryUrl(entry) : !isRegistryUrl(url));
 }
+/**
+* Check the declared type of a non-null registry option.
+*
+* @param field - Registry declaration field name
+* @param value - Untrusted option value
+* @param target - Release controlling registry server types
+*
+* @returns Whether a nested option is invalid for pnpm 12.9
+*/
+function hasInvalidRegistryOptionValue(field, value, target) {
+	switch (field) {
+		case "networkConcurrency": return !isNumber(value) || !Number.isSafeInteger(value) || value <= 0;
+		case "ecosystem": return !isString(value) || ![
+			"npm",
+			"cargo",
+			"pypi"
+		].includes(value);
+		case "packages": return !isArray(value) || !value.every(isString);
+		case "scopes": return !isArray(value) || value.some((scope) => !isString(scope) || !scope.startsWith("@"));
+		case "prefix": return !isString(value);
+		case "serverType": return !isString(value) || ![
+			"npm",
+			"artifactory",
+			...supportsMinimumVersion(target.version, PNPM_V12_15_MINIMUM_VERSION) || supportsMinimumVersion(target.version, PNPM_V11_28_9_MINIMUM_VERSION) ? ["pnpr"] : []
+		].includes(value);
+		case "supportsTimeField": return !isBoolean(value);
+		default: return true;
+	}
+}
+/**
+* Validate every field in a registry declaration for the selected release.
+*
+* @param declaration - Registry options with or without versioned fields
+* @param target - Release controlling registry server types
+*
+* @returns Whether a nested option is unknown or invalid for the target
+*/
+function hasInvalidRegistryDeclaration(declaration, target) {
+	const ecosystem = Reflect.get(declaration, "ecosystem") ?? "npm";
+	return Object.entries(declaration).some(([field, value]) => {
+		if (!PNPM_V12_REGISTRY_DECLARATION_FIELDS.includes(field)) return true;
+		if (value === null) return false;
+		if (field === "packages" && ecosystem !== "pypi") return true;
+		if ([
+			"scopes",
+			"prefix",
+			"serverType",
+			"supportsTimeField"
+		].includes(field) && ecosystem !== "npm") return true;
+		return hasInvalidRegistryOptionValue(field, value, target);
+	});
+}
+/**
+* Validate registry representation before release-specific declaration fields.
+* Pure legacy scope maps must use scope keys rather than registry URLs.
+*
+* @param value - Registry map already checked for valid locations
+* @param target - Release controlling declaration fields and enum values
+*
+* @returns Whether any entry prevents migration of the complete map
+*/
+function hasIncompatibleRegistryValue(value, target) {
+	const entries = Object.values(value);
+	if (entries.every(isString)) return Object.keys(value).some((key) => key.includes("://") || key.startsWith("//"));
+	if (!entries.every(isPlainObject)) return true;
+	return entries.some((entry) => Object.hasOwn(entry, "networkConcurrency") && !supportsMinimumVersion(target.version, PNPM_V12_9_MINIMUM_VERSION) || hasInvalidRegistryDeclaration(entry, target));
+}
 //#endregion
 //#region src/features/settings/permissions.ts
 /**
@@ -1623,58 +1778,6 @@ function hasInvalidNodeLinkerOptions(value) {
 	return Object.hasOwn(value, "excluded") && (!isArray(excluded) || !excluded.every(isString));
 }
 /**
-* Check the declared type of a non-null registry option.
-*
-* @param field - Registry declaration field name
-* @param value - Untrusted option value
-* @param target - Release controlling registry server types
-*
-* @returns Whether a nested option is invalid for pnpm 12.9
-*/
-function hasInvalidRegistryOptionValue(field, value, target) {
-	switch (field) {
-		case "networkConcurrency": return !isNumber(value) || !Number.isSafeInteger(value) || value <= 0;
-		case "ecosystem": return !isString(value) || ![
-			"npm",
-			"cargo",
-			"pypi"
-		].includes(value);
-		case "packages": return !isArray(value) || !value.every(isString);
-		case "scopes": return !isArray(value) || value.some((scope) => !isString(scope) || !scope.startsWith("@"));
-		case "prefix": return !isString(value);
-		case "serverType": return !isString(value) || ![
-			"npm",
-			"artifactory",
-			...supportsMinimumVersion(target.version, PNPM_V12_15_MINIMUM_VERSION) ? ["pnpr"] : []
-		].includes(value);
-		case "supportsTimeField": return !isBoolean(value);
-		default: return true;
-	}
-}
-/**
-* Validate a registry declaration that opts into per-registry concurrency.
-*
-* @param declaration - Registry options containing versioned fields
-* @param target - Release controlling registry server types
-*
-* @returns Whether a nested option is invalid for pnpm 12.9
-*/
-function hasInvalidRegistryConcurrencyDeclaration(declaration, target) {
-	const ecosystem = Reflect.get(declaration, "ecosystem") ?? "npm";
-	return Object.entries(declaration).some(([field, value]) => {
-		if (!PNPM_V12_REGISTRY_DECLARATION_FIELDS.includes(field)) return true;
-		if (value === null) return false;
-		if (field === "packages" && ecosystem !== "pypi") return true;
-		if ([
-			"scopes",
-			"prefix",
-			"serverType",
-			"supportsTimeField"
-		].includes(field) && ecosystem !== "npm") return true;
-		return hasInvalidRegistryOptionValue(field, value, target);
-	});
-}
-/**
 * Validate scalar alternatives of the pnpm 12.10 linker and lockfile unions.
 *
 * @param key - Canonical setting name
@@ -1730,14 +1833,7 @@ function hasIncompatibleV12SettingValue(key, value, target) {
 	if (!value || typeof value !== "object") return false;
 	if (key === "nodeLinker") return !supportsV12_10 || hasInvalidNodeLinkerOptions(value);
 	if (key === "lockfile") return hasInvalidLockfileOptions(value, target);
-	if (key === "registries") {
-		const entries = Object.values(value);
-		return entries.some((entry) => {
-			if (!entry || typeof entry !== "object" || !Object.hasOwn(entry, "networkConcurrency") && !(Object.hasOwn(entry, "serverType") && (Reflect.get(entry, "serverType") === "pnpr" || supportsMinimumVersion(target.version, PNPM_V12_15_MINIMUM_VERSION)))) return false;
-			if (Object.hasOwn(entry, "networkConcurrency") && !supportsMinimumVersion(target.version, PNPM_V12_9_MINIMUM_VERSION)) return true;
-			return entries.some(isString) || hasInvalidRegistryConcurrencyDeclaration(entry, target);
-		});
-	}
+	if (key === "registries") return hasIncompatibleRegistryValue(value, target);
 	return false;
 }
 //#endregion
@@ -1786,6 +1882,23 @@ function hasInvalidV11PatchValue(key, value, target) {
 	return false;
 }
 /**
+* Validate the fields newly consumed or ignored by pnpm 12.16.
+*
+* @param key - Canonical setting name
+* @param value - Untrusted source value
+* @param target - Release controlling the workspace reader
+*
+* @returns Whether the setting cannot be represented for this target
+*/
+function hasInvalidV12_16Value(key, value, target) {
+	if (!supportsMinimumVersion(target.version, PNPM_V12_16_MINIMUM_VERSION)) return false;
+	if (key === "scriptsPrependNodePath") return true;
+	if (["strictSsl", "runtime"].includes(key)) return value !== null && !isBoolean(value);
+	if (["localAddress", "tag"].includes(key)) return value !== null && !isString(value);
+	if (key === "requiredScripts") return value !== null && (!isArray(value) || !value.every(isString));
+	return false;
+}
+/**
 * Validate scalar settings introduced or first consumed in pnpm 12.6.
 *
 * @param key - Canonical setting name
@@ -1831,6 +1944,7 @@ function hasInvalidScalarValue(key, value, target) {
 * @returns Whether the value cannot be used by the target release
 */
 function hasInvalidReleaseValue(key, value, target) {
+	if (hasInvalidV12_16Value(key, value, target)) return true;
 	if (key === "globalShims" && supportsMinimumVersion(target.version, PNPM_V12_8_2_MINIMUM_VERSION)) return true;
 	if (key === "userAgent" && isString(value) && value.includes("${") && (supportsMinimumVersion(target.version, PNPM_V11_28_MINIMUM_VERSION) || supportsMinimumVersion(target.version, PNPM_V12_7_MINIMUM_VERSION))) return true;
 	if (key === "packages" && value !== null && value !== void 0 && supportsMinimumVersion(target.version, PNPM_V11_28_1_MINIMUM_VERSION)) return !isArray(value) || value.some((entry) => !isString(entry) || !entry);
@@ -2018,7 +2132,7 @@ function resolveSettingIssue({ allowedFields, target, key, npmrc, value }) {
 	if (compatibility !== "v10" && PROJECT_REFUSED_SETTINGS.has(key)) return "refused";
 	if (REGISTRY_SETTINGS.has(key) && containsUnsafeRegistryValue(value)) return "unsafe";
 	if (PROXY_SETTINGS.has(key) && isString(value) && value.includes("${")) return "unsafe";
-	if (hasInvalidRegistryLocations(key, value) || hasUnmigratableRuntimeFields(key, value, compatibility) || hasIncompatibleSettingValue(key, value, target)) return "incompatible";
+	if (hasInvalidRegistryLocations(key, value) || hasConflictingRegistryRoutes(key, value, target) || hasUnmigratableRuntimeFields(key, value, compatibility) || hasIncompatibleSettingValue(key, value, target)) return "incompatible";
 	if (key === "tasks" && hasUnsupportedTaskFields(value, taskSettings)) return "incompatible";
 	if (!workspaceSettings.has(key)) return isSettingFromAnotherVersion(key, compatibility) ? "incompatible" : "unknown";
 	if (allowedFields && !allowedFields.has(key)) return "unsupported";
@@ -4281,6 +4395,7 @@ async function migratePnpmSettings(rawOptions = {}) {
 		yarnResolutions: sources.packageJson.yarnResolutions
 	})) return result;
 	const pnpmWorkspaceResult = mergeIncludedWorkspace(workspace, incomingSettings, options.strategy);
+	assertCompatibleWorkspaceSettings(pnpmWorkspaceResult, target);
 	const workspaceFiles = workspace.include === void 0 ? [] : renderIncludedWorkspace(workspace, pnpmWorkspaceResult, {
 		...options,
 		target

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pnpm-settings-migrator",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "Move pnpm settings from `pnpm` field in `package.json` and `.npmrc` file to `pnpm-workspace.yaml`",
   "keywords": [
     "migrator",