Zoltan Kochan 089ebad918 fix(pnpr): send the full request both clients owe the server (policy, catalogs, resolution mode) (#13279) ...

pnpr resolves and enforces policy server-side, and neither client runs its own
verifyLockfileResolutions when a pnpr server is configured. The server assigns
each field from the request unconditionally, so a field a client omits is cleared
rather than defaulted, and the server resolves under inputs the user never chose.

The TypeScript client sent only minimumReleaseAge of the verification policy, so
minimumReleaseAgeExclude entries stopped applying and the input-lockfile verifier
could reject a lockfile whose entries the user had explicitly excluded. It also
never sent the resolution mode, so --frozen-lockfile silently resolved and rewrote
the lockfile it promises to leave alone.

pacquet never sent catalogs, so every catalog: specifier failed to resolve — the
bug #13233 fixed for the TypeScript client and the server, leaving the Rust client
behind.

Drop the TRUST_POLICY_INCOMPATIBLE_WITH_PNPR guard, written before the server
gained trust-policy enforcement and refusing an install pacquet runs happily.

2026-07-25 10:56:36 +02:00

..

index.ts

fix(pacquet): honor workspace install filters (#13030)

2026-07-18 13:06:37 +02:00

protocol.ts

perf(pnpr): resolve server-side and fetch tarballs directly (#12232)

2026-06-06 02:16:33 +02:00

resolveViaPnprServer.ts

fix(pnpr): send the full request both clients owe the server (policy, catalogs, resolution mode) (#13279)

2026-07-25 10:56:36 +02:00