Summary

• Replaces pacquet's placeholder peer-folding (which folded peer deps in as nested children of every consumer) with a faithful port of pnpm's hoistPeers algorithm — missing peers are hoisted to the importer's direct deps, shared across consumers and deduplicated against the preferred-versions map.
• Adds the multi-pass loop (resolveRootDependencies shape): inner loop hoists missing required peers and re-resolves until none remain; outer loop hoists optional peers whose version is already in scope, then re-enters the inner loop.
• Adds the auto-install-peers-from-highest-match setting mirroring upstream's flag for range-merge behavior across conflicting consumers.

What changed

• New crate pacquet-lockfile-preferred-versions — port of @pnpm/lockfile.preferred-versions. Seeds the version-picker tie-break table from manifest + lockfile snapshots, with weight-bump on dual-source matches. Includes a get_version_selector_type helper that mirrors the version-selector-type npm package (semver version → range → URI-safe tag → None).
• New hoist_peers module in pacquet-resolving-deps-resolver — ports hoistPeers + getHoistableOptionalPeers from upstream's hoistPeers.ts with all 10 upstream test cases (PR fix: handle non-string version selectors in hoistPeers #11048, fix: invalid specifiers for peers on all non-exact version selectors #11049 regressions, workspace: protocol, exact override pinning, weighted selectors, etc.).
• New resolve_importer orchestrator in pacquet-resolving-deps-resolver — public entry point that runs the tree pass, then drives the hoist loop, then runs the final peer pass. Returns { resolved_tree, peers_result } for the install layer. Mirrors upstream's resolveRootDependencies.
• resolve_dependency_tree refactor: removed the placeholder peer-folding in extract_children; split the entry point into reusable building blocks (TreeCtx::new, extend_tree, into_resolved_tree, snapshot, resolved_versions) so the orchestrator can extend the tree incrementally without re-walking already-resolved subtrees.
• Config: added auto_install_peers_from_highest_match: bool (default false, matching pnpm) to pacquet-config with yaml deserializer, env-overlay key AUTO_INSTALL_PEERS_FROM_HIGHEST_MATCH, and clear_workspace_only_fields entry.
• install_without_lockfile now calls resolve_importer instead of resolve_dependency_tree + resolve_peers directly, seeding all_preferred_versions from the importer manifest via get_preferred_versions_from_lockfile_and_manifests(None, &[manifest]).

Architecture notes

• The orchestrator's hoist loop runs resolve_peers over a snapshot of the in-flight tree each iteration to find missing peers, then calls hoist_peers (or get_hoistable_optional_peers for the outer pass) to pick specifiers, then calls extend_tree to walk those new deps. The existing per-id dedup gate in resolve_node means re-entering walked packages costs only a cache lookup — equivalent to upstream's inline pkgAddresses.push(...) extension. all_preferred_versions is mutated as each new package resolves, mirroring upstream's per-resolve allPreferredVersions[name][version] = 'version' assignment at resolveDependencies.ts:1440.
• get_hoistable_optional_peers faithfully ports upstream's specType === 'version' filter — which only matches plain Version selectors, not weighted ones from lockfile/manifest seeding. This means it picks up versions added to the preferred-versions map during the walk (which we now do, per the bullet above), matching upstream behavior including its known limitation.
• merge_ranges is a simplification of upstream's mergePkgsDeps + safeIntersect: single-range and all-identical-range cases pass through; non-identical multi-range cases drop on intersection (matching upstream's intersection === null arm) or ||-join when auto_install_peers_from_highest_match is set. Full semver-range intersection (via a port of semver-range-intersect) is a follow-up.
• Single-importer slice; workspace support waits on pacquet's workspace work. resolve_peers_from_workspace_root flag is plumbed and uses the importer's direct deps as workspace_root_deps when set (single-importer ⇒ importer is root).

Test plan

• cargo nextest run -p pacquet-lockfile-preferred-versions — 9 tests
• cargo nextest run -p pacquet-resolving-deps-resolver hoist_peers — 10 ported upstream tests
• cargo nextest run -p pacquet-resolving-deps-resolver resolve_importer — 4 orchestrator tests (auto-installs missing required peer, doesn't hoist when disabled, transitive peer hoisting, preferred-version reuse)
• cargo nextest run -p pacquet-resolving-deps-resolver -p pacquet-lockfile-preferred-versions -p pacquet-config — 238 tests pass
• cargo nextest run -p pacquet-cli auto_install_peers_hoists — E2E install against mock registry, asserts peer-a / peer-b / peer-c land in node_modules/.pnpm/ and node_modules/@pnpm.e2e/ symlinks
• cargo clippy --workspace --all-targets -- --deny warnings clean
• cargo fmt --check + taplo format --check clean
• typos clean on new files
• CI green

Out of scope (follow-ups)

• Full semver-range-intersect port for merge_ranges non-identical-range case.
• Workspace support — multi-importer hoist loop, resolve_peers_from_workspace_root for cross-importer peer satisfaction.
• Pre-seeding all_preferred_versions from the wanted lockfile in install_without_lockfile's sibling install paths (frozen-lockfile doesn't re-resolve, so no change needed there).

Written by an agent (Claude Code, claude-opus-4-7).

Summary by CodeRabbit

• New Features
  • Added a setting to prefer highest-match when auto-installing peers.
  • Enhanced peer auto-installation and hoisting (required and optional peers) with multi-pass resolution and improved preferred-version handling.
  • Better seeding of preferred versions from lockfiles and manifests to influence installs.
• Tests
  • Expanded unit and end-to-end tests covering peer hoisting, optional-peer selection, preferred-version logic, and an auto-install-peers e2e scenario.