Zoltan Kochan
089ebad918
pnpr resolves and enforces policy server-side, and neither client runs its own verifyLockfileResolutions when a pnpr server is configured. The server assigns each field from the request unconditionally, so a field a client omits is cleared rather than defaulted, and the server resolves under inputs the user never chose. The TypeScript client sent only minimumReleaseAge of the verification policy, so minimumReleaseAgeExclude entries stopped applying and the input-lockfile verifier could reject a lockfile whose entries the user had explicitly excluded. It also never sent the resolution mode, so --frozen-lockfile silently resolved and rewrote the lockfile it promises to leave alone. pacquet never sent catalogs, so every catalog: specifier failed to resolve — the bug #13233 fixed for the TypeScript client and the server, leaving the Rust client behind. Drop the TRUST_POLICY_INCOMPATIBLE_WITH_PNPR guard, written before the server gained trust-policy enforcement and refusing an install pacquet runs happily.
@pnpm/pnpr.client
Client library for the pnpr server. Resolves a project's dependencies server-side and returns the resolved lockfile.
How it works
- Sends
POST /v1/installto the pnpr server with the project's dependencies (and the existing lockfile, if any, for incremental resolution). - The server resolves against the client's registries, verifies the input lockfile under the client's policy, and answers with one gzipped JSON object carrying the resolved lockfile and stats.
- Returns the resolved lockfile for use with pnpm's headless install, which fetches every tarball directly from the registries in parallel — like a normal install. See pnpm/pnpm#12230.
pnpr is a stateless resolver: it stores no tarballs and serves no file content.
Usage
This package is used internally by pnpm when the pnprServer config option is set. It is not intended to be called directly, but can be used programmatically:
import { fetchFromPnpmRegistry } from '@pnpm/pnpr.client'
const { lockfile, stats } = await fetchFromPnpmRegistry({
registryUrl: 'http://localhost:4000',
dependencies: { react: '^19.0.0' },
devDependencies: { typescript: '^5.0.0' },
})
console.log(`Resolved ${stats.totalPackages} packages`)
// lockfile is ready for headless install
Configuration
Add to pnpm-workspace.yaml to enable automatically during pnpm install:
pnprServer: http://localhost:4000