Per CodeRabbit review on pnpm#11662 — `.resolves.not.toThrow()`
doesn't behave as intended here: after `.resolves` the matcher operates
on the resolved value (an `InstallationResult`), not on a function, so
`.toThrow()` would never validate the rejection path. Just awaiting the
call makes jest fail naturally on rejection, which is what the
regression test actually wants.

Peer-dep variant snapshots in the lockfile (e.g.
`pkg@1.0.0(peer@2.0.0)`) inherit their `resolution` from the base entry
— pnpm's lockfile writer omits `resolution` on variants to avoid
duplication. The previous commit guarded the `'directory' in
pkgSnapshot.resolution` access against `undefined`, but downstream code
(`pkgSnapshotToResolution`, the fetch path, etc.) still expected a
fully-formed snapshot and crashed on the same shape.

Inherit the base entry's resolution onto the variant snapshot early in
`buildGraphFromPackages` so every downstream access sees a complete
snapshot. If the base entry has been pruned by upstream tooling (e.g.
`turbo prune --docker` only keeps the variant referenced by the
consumer) and is therefore not in `lockfile.packages`, synthesize a
directory resolution from the depPath's `file:` prefix instead of
letting the fall-through path treat the workspace dir as a tarball
(which then crashes with EISDIR at fetch time).

…eateDeployFiles

`createDeployFiles` iterates `lockfile.packages` and passes each
snapshot to `convertPackageSnapshot`, which dereferences
`inputSnapshot.resolution` with `'integrity' in inputResolution`. Peer-
dep variant snapshots have no `resolution` of their own (they inherit
from the base entry), so the access throws
`Cannot use 'in' operator to search for 'integrity' in undefined`
during `pnpm deploy`.

Apply the same inherit-from-base + synthesize-directory-from-depPath
pattern used in `buildGraphFromPackages` so the variant has a complete
resolution before reaching `convertPackageSnapshot`. Same root cause,
different code path.

The original changeset described only the graph-builder guard. The
follow-up commits cover the same root cause in createDeployFiles, so
the changeset now also bumps @pnpm/releasing.commands and explains the
inherit-from-base + synthesize-directory pattern that addresses the
multiple unguarded access sites in one go.

…ipts

When `runLifecycleHooksConcurrently` re-imports a workspace package into
its injected targets after running prepare/postinstall, it has to
preserve the existing `node_modules/` inside each target — set up
during the initial install (bin symlinks, transitive deps) — while
overlaying the script's output (typically a freshly-built `dist/`).

The previous approach was a manual `scanDir` over `<targetDir>/node_modules`
that fed absolute paths into the re-import's `filesMap`. That worked in
2022 (pnpm#4299) when `importIndexedDir` always staged-and-renamed, but
pnpm#11088 made the fast path (write directly into the final dir) the
default. The fast path's `makeEmptyDirSync(targetDir)` wipes the very
files the scanned entries point at, so `tryImportIndexedDir`'s first
copy throws:

    ERR_PNPM_ENOENT on <targetDir>/node_modules/.bin/<tool>

Reproduces on any workspace package that has a `prepare`/`postinstall`
script + a dep with a bin entry, when injected via
`injectWorkspacePackages: true` or `dependenciesMeta.<dep>.injected`.

Fix: skip the `importPackage` round-trip entirely. After lifecycle
scripts complete, iterate the source's `filesMap` (from `fetchFromDir`,
which already excludes `node_modules/`) and copy each entry directly
into each `targetDir`. The target's existing `node_modules/` is never
touched — its bin links + transitive deps stay intact — and there's no
tmp-dir staging swap to trip over `.bin/<tool>` symlinks.

Regression test in `injectLocalPackages.ts`: an injected workspace
package with a `prepublishOnly` script + `@pnpm.e2e/hello-world-js-bin`
dep. Before the fix this throws `ERR_PNPM_ENOENT` on
`.bin/hello-world-js-bin`; after the fix both the script's output and
the bin symlink survive into the injected copy.

The regression test's preamble still described the abandoned
`keepModulesDir: true` + move-or-merge approach. Rewrite to match
the mirror-based implementation that shipped in the parent commit
(fetchFromDir + mirrorFilesIntoTarget, no importPackage round-trip).

…ly to all readers

The inherit/synthesize logic for peer-variant snapshots (which legally omit
`resolution` because they inherit it from the base entry) was previously
inlined in `buildGraphFromPackages` and `createDeployFiles`. Auditing every
caller of `pkgSnapshotToResolution` surfaced four more iteration sites that
dereference `pkgSnapshot.resolution` directly on a raw `lockfile.packages`
entry and therefore had the same latent crash:

  - `lockfileToHoistedDepGraph` — `pnpm install --node-linker=hoisted`
  - `collectSbomComponents` — `pnpm sbom`
  - `getPkgInfo` — `pnpm list` / tree view
  - (graph-builder + createDeployFiles, already fixed inline)

Extract the inherit/synthesize logic into a new exported helper in
`@pnpm/lockfile.utils` and call it at every iteration site. Downstream
code paths — `pkgSnapshotToResolution`, `convertPackageSnapshot`,
`'directory' in resolution`, `'integrity' in resolution` — now all see a
fully-formed snapshot regardless of which command entered the loop.

The synthesize-from-`file:` fallback (covers pruned lockfiles, e.g.
`turbo prune --docker` keeping only the variant entry) is now documented
in the helper to discourage future readers from widening it to other
`file:` shapes (`file:./local-tarball.tgz` etc., which reach a different
code path).

Unit tests for the helper added in `lockfile/utils/test/`. The existing
fixture-based regression test in `installing/deps-restorer/test/index.ts`
continues to cover the install-path end-to-end.

…test

Synthesizing `{ type: 'directory' }` resolution for any depPath starting
with `file:` was too wide — `file:./foo.tgz`, `file:./foo.tar.gz`, and
`file:./foo.tar` are local-tarball refs that reach a different code path
in pnpm. Misclassifying them as directories would route them through
local-package install code with a `directory` field they don't have on
disk.

Use the existing `refIsLocalDirectory` helper (which is `startsWith('file:')`
minus the local-tarball extensions) so the synthesis branch only fires for
true workspace-directory refs.

Also expands the JSDoc with the helper's usage contract: every iteration
site that touches `pkgSnapshot.resolution` directly or via a downstream
utility (`pkgSnapshotToResolution`, `convertPackageSnapshot`, etc.) must
route its raw `lockfile.packages[depPath]` entry through this helper first.
Downstream utilities assume their input is already normalized.

Regression test added for the three local-tarball extensions.

Two follow-ups from the upstream CI run on canora.11:

1. `mirrorFilesIntoTarget` only mkdir'd intermediate sub-directories
   (collected via `path.dirname(relPath)`), so any workspace package with
   only top-level files (e.g. `main.js`) ended up calling unlinkSync
   against a path whose parent target dir didn't exist yet — failing
   three pre-existing `inject local packages and relink them after build`
   tests on Linux. Pre-create the target dir itself before the sub-dir
   loop so top-level relPaths are covered.

2. The catch around unlinkSync used `err instanceof Error` to narrow
   before reading `.code`. That check is unreliable across bundler /
   realm boundaries (the bundled pnpm CLI is one artifact running under
   Node's experimental-vm-modules in tests, where Error identity can
   diverge). Match the pattern used elsewhere in the pnpm tree
   (bins.linker, modules-yaml, bins.resolver) and cast directly to
   `NodeJS.ErrnoException`, which is what those call sites do.

Also corrects the bin-having-dep regression test to use `prepare`
(which pnpm runs during install) instead of `prepublishOnly` (only
fires during publish). The original test name is unchanged — the test
still asserts the same behaviour, just with a lifecycle script that
actually runs in the install path being tested.

…ture

The fixture's lockfile was minimal — it had the pkg-a base + peer-variant
entries (the shape that triggered the original `'directory' in undefined`
TypeError in graph-builder) but no `peer@1.0.0` entry. That was enough
before Bug 1's fix, because graph-builder crashed early. Now that the
graph-builder + helper changes let the install path proceed, the next
stage (`filterLockfileByImportersAndEngine`) walks the dependency graph
and throws `LockfileMissingDependencyError: no entry for 'peer@1.0.0'`.

Add a stub directory-resolution entry pointing at the existing
`packages/peer/` workspace package so the graph walker finds it.

The disable comment targeted @typescript-eslint/no-explicit-any but the
catch is typed `unknown`, not `any`. No suppression needed.

Per the PR review (zkochan); pairs with the turbo-side root-cause fix
vercel/turborepo#12819.

Bug 1 (peer-variant resolution): normalize once at the read layer in
convertToLockfileObject — when a pruned lockfile dropped the base
packages entry, synthesize the directory resolution from the file:
depPath (reconstruction of exactly what pnpm's writer emits, not a
guess). This makes inheritOrSynthesizeResolution + its 5 reader call
sites inert idempotent guards (resolution is always populated before
they run); the active normalization now lives solely in the converter.
Mechanical removal of the now-dead helper is a trivial follow-up.

Bug 2 (lifecycle re-import .bin ENOENT): drop the pnpm#4299 scanDir-into-
filesMap workaround and pass keepModulesDir: true so importIndexedDir
skips the pnpm#11088 makeEmptyDir fast path and preserves the target's
existing node_modules via its staging/move path. Stays on
storeController.importPackage so source files keep hardlinks — replaces
the copy-loop mirror.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Removes the inheritOrSynthesizeResolution helper + its test + all 5
reader call-sites, reverting them to direct snapshot access. With the
single read-layer synthesize in convertToLockfileObject every reader
already sees a fully-formed snapshot; the per-reader helper was
redundant. Matches the PR description and zkochan's review. Bug-2
lifecycle fix and the regression fixtures/tests are unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The 4 reader files (sbom collect, graph-builder, tree-builder getPkgInfo,
deps-restorer hoisted) are reverted fully to upstream — the leftover
helper-era scaffolding (rawPkgSnapshot renames, pkgPackages plumbing,
the standalone `'directory'/'integrity' in …` null-guards) is removed.
Bug-1 now lives ONLY in convertToLockfileObject. The unused
@pnpm/lockfile.utils dep is removed from releasing.commands
(package.json + tsconfig + pnpm-lock). The two stale changesets
(describing the abandoned mirror + helper approaches, wrong package
bumps) are replaced with one accurate changeset.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…s; my prior revert wrongly stripped it → compile error). getPkgInfo now pristine vs upstream.

The deps-restorer regression fixture still shipped the base
`pkg-a@file:packages/pkg-a` packages entry, so convertToLockfileObject
inherited `resolution` from it and the synthesize branch was never
exercised — the test passed on main without the fix (tautological, as
raised in review). Drop the base entry so the fixture is the real
pruned shape (`turbo prune --docker` output).

- lockfile.fs: add a convertToLockfileObject unit test asserting a
  directory resolution is synthesized for a pruned `file:` peer-variant
  but never for a `file:` tarball.
- deps-installer: correct the stale injectLocalPackages comment that
  described an abandoned mirrorFilesIntoTarget approach instead of the
  shipped `keepModulesDir: true` importPackage path, and make its
  project-1 existence check an explicit `expect(...).not.toThrow()`.

vercel/turborepo#12819 was closed; the live root-cause fix (retain the
base packages entry for peer-variant injected deps) is tracked at
vercel/turborepo#12825. Keeps the source comment consistent with the
PR description.

The peer-variant resolution synthesis in `convertToLockfileObject` skips
local tarballs via an `endsWith` chain against `.tgz` / `.tar.gz` / `.tar`,
but `parseBareSpecifier`'s `isFilename = /\.(?:tgz|tar.gz|tar)$/i` matches
case-insensitively. A `file:vendor/pkg.TGZ` ref with a dropped base entry
would have been synthesized as `{ type: 'directory', directory: ... }`,
diverging from how the resolver classifies the same ref at install time.

Replace the chain with `LOCAL_TARBALL_RE = /\\.(?:tgz|tar\\.gz|tar)$/i` and
extend the heuristic-boundary test in `lockfileV6Converters.test.ts` with
`.TGZ` and `.Tar.Gz` cases.

---
Written by an agent (Claude Code, claude-opus-4-7).

Mirror the TS-side defense-in-depth fix on the pacquet stack so a
pruned `injectWorkspacePackages` lockfile (older `turbo prune --docker`
output, pre vercel/turborepo#12825) loads on Rust too. Two pieces:

1. Widen `PkgVerPeer` to accept `file:` versions. The version slot
   becomes a `VersionPart::{Semver(Version), File(String)}` sum type
   so a snapshot key like `pkg@file:packages/pkg(peer@1.0.0)` parses
   instead of failing at the semver `from_str`. Display writes the
   `file:` scheme back, so round-trips stay byte-stable. The two
   semver-required callers (`find_runtime_node_major` and
   `find_own_runtime_node_major`) migrate to a new `version_semver()`
   accessor; `runtime:` and `file:` are explicitly mutually exclusive
   at parse time.

2. Add `Lockfile::reconstruct_missing_directory_resolutions()` and
   run it at the end of `load_from_path`. Analog of the TS
   `convertToLockfileObject` synthesis: for any peer-variant snapshot
   whose `without_peer()` lookup misses, fabricate a
   `LockfileResolution::Directory` from the `file:` path so every
   downstream `packages.get(...).resolution` call keeps working. The
   tarball-vs-directory boundary mirrors the resolver's
   `/\\.(?:tgz|tar\\.gz|tar)$/i` regex via a case-insensitive suffix
   check on `.tgz` / `.tar.gz` / `.tar`.

Tests:

- `pkg_ver_peer/tests.rs`: round-trip + serde for `file:` (plain and
  with peer suffix); `parse_err` cases for empty path after `file:`
  and `runtime:file:` conflict.
- `load_lockfile/tests.rs`: pruned lockfile with one directory
  peer-variant + lowercase / uppercase / mixed-case tarball
  peer-variants asserts that only the directory case gets a
  synthesized resolution.

---
Written by an agent (Claude Code, claude-opus-4-7).