* feat: report lockfile verification progress
The lockfile resolution verifier introduced in #11705 runs an unbounded
registry round-trip on cache miss and was previously silent — on a cold
registry cache users saw nothing for several seconds. Emit pnpm:lockfile-verification
log events (started/done) around the actual verification pass and render
them in the default reporter as a transient progress line that collapses
into a final "verified" summary with entry count and elapsed time. The
cached short-circuit stays silent.
* feat: include lockfile path in verification log and render when non-standard
Add `lockfilePath` to the `pnpm:lockfile-verification` event payload so
consumers always know which lockfile a `started`/`done` pair refers to.
In the default reporter, render the path in the message only when the
lockfile lives outside the workspace root (or, for non-workspace
installs, outside cwd) — the common case stays uncluttered, while
custom `lockfileDir` setups now surface in the verification line.
* feat: name what the lockfile verification actually checks in the rendered message
"Verifying lockfile" was opaque about *what* was being verified. Reword
the rendered messages to explicitly name the check ("supply-chain
policies"), so users on a cold-cache pause understand what's happening
instead of just seeing the pause.
* fix: skip lockfile verification emission for empty candidate set
A non-empty lockfile.packages whose snapshots all fail name/version
extraction would still emit a "Verifying lockfile (0 entries)" line even
though no verifier work runs. Bail before emission when the candidate
map is empty so the no-op branch stays silent, matching the contract
for the other no-op branches (empty verifiers, no lockfile.packages).
* fix(reporter): always close out the verifying-lockfile frame
Address two Copilot review points on #11712:
1. The verifier emitted `started` but no terminal event when violations
were found or when the registry fan-out threw, leaving "Verifying
lockfile…" as the last frame for that block in ansi-diff mode (and
an unmatched line in CI logs). Add a `failed` status to the logger,
wrap the fan-out in try/finally so a terminal event is emitted on
every exit path that emitted `started`, and render a brief failure
line so the spinner-style frame is replaced before the PnpmError
block prints.
2. The path-suppression heuristic used strict `===` between
path.dirname(lockfilePath) and expectedDir, which broke on trailing
separators and slash-direction differences. Switch to a
path.relative-based check so a workspaceDir like `/repo/` or a
Windows path with mixed slashes still correctly suppresses the
redundant "at <path>" suffix.
* docs: update lockfile verification logging behavior
The lockfile verifier now emits log events during the registry round-trip pass, improving user visibility into the process.
Zoltan Kochan
4a79336473