…m#512)

Pnpm v11 writes runtime depPaths with a scheme prefix in front of
the semver — e.g. `node@runtime:22.0.0` in `packages:` /
`snapshots:` keys, and `runtime:22.0.0` in importer `dependencies:`
values. Pacquet's `PkgVerPeer` parser previously accepted only
bare semver and rejected the prefix, so it couldn't load any v11
lockfile containing a runtime dependency.

Extend `PkgVerPeer` to recognise a leading `runtime:` (closed enum
`Prefix::{None, Runtime}`) and preserve it through `Display` /
`serde`. The version + peer parts continue to parse the same way
— the prefix-strip happens once up front, after which the
parenthesis-based peer-suffix detection is unchanged.

Touch points:
- Added `Prefix` enum with `as_str()` and `Display`.
- `PkgVerPeer::prefix()` exposes the variant so downstream
  consumers can discriminate runtime entries without
  substring-searching the depPath.
- `PkgVerPeer::into_tuple()` keeps the `(Version, String)` shape
  for backward compatibility — pre-runtime callers don't see the
  prefix.

5 new unit tests pin: bare-semver no-prefix, runtime no-peer,
runtime with peer-suffix, runtime-substring-mid-version is NOT a
prefix (anchored at start), and serde round-trip on the runtime
form. All 100 existing `pacquet-lockfile` tests still pass.

Unblocks pnpm#437 slice F (end-to-end install fixtures) — pacquet's
lockfile loader now accepts `node@runtime:X.Y.Z`-shaped keys.

…npm#437 slice F) (pnpm#516)

* test(package-manager): variant-mismatch + --no-runtime install tests (pnpm#437 slice F)

Two end-to-end install tests for the runtime-dependency pipeline,
now that pnpm#512 (`PkgVerPeer::Prefix::Runtime`) unblocked
fixture-lockfile parsing.

- `frozen_lockfile_install_errors_when_no_variant_matches_host`:
  Lockfile with a `VariationsResolution` whose only variant
  targets `aix/ppc64` (a platform pacquet CI never runs on).
  Install fails with `NoMatchingPlatformVariant` from the
  cold-batch dispatcher. Variant selection runs before any
  network fetch, so the bogus archive URL is never read — the
  test stays hermetic. Closes the variant-mismatch checkbox.
- `frozen_lockfile_install_skips_runtime_when_skip_runtimes_set`:
  Same lockfile, but with `skip_runtimes: true`. The
  `--no-runtime` filter iterates importer-direct deps, builds
  `node@runtime:22.0.0` from `(alias, version)`, sees the
  `@runtime:` substring, and adds the snapshot to the skip set
  — so variant selection never runs and the unmatchable variant
  doesn't fail the install. Asserts both the runtime slot and
  the direct-dep symlink are absent. Closes the `--no-runtime`
  checkbox.

Both tests were verified to catch their respective regressions
(disable the `skip_runtimes` filter → the second test fails with
`NoMatchingPlatformVariant` instead of succeeding).

Required a fix in `PkgNameVerPeer::without_peer`: the existing
implementation dropped the `Prefix::Runtime` when stripping the
peer-dependency suffix, so a runtime snapshot key like
`node@runtime:22.0.0(some@peer)` would resolve to the
non-existent `node@22.0.0` `packages:` entry. Now preserves the
prefix through the strip.

Slice F's remaining items (happy-path archive fetch, integrity
mismatch, NODE_EXTRAS verified end-to-end, TEST_PORTING.md
entries) need a mock HTTP server + recorded archive fixture, so
defer to a follow-up — keeping this PR reviewable.

* test(package-manager): use symlink_metadata for absent-entry checks

Address CodeRabbit review on pnpm#516: `Path::exists()` follows
symlinks, so a regression that created a *dangling* symlink at
`<modules_dir>/node` would still pass the
`!direct_dep.exists()` assertion — the install would have created
the entry the skip set was supposed to suppress, but the test
wouldn't notice.

Switch both "must NOT exist" assertions to
`std::fs::symlink_metadata(...).is_err()` so the entry-level
check catches dangling symlinks too.

…npm#525)

* fix(lockfile): skip env document in pnpm v11 combined lockfiles

Pnpm v11 writes `pnpm-lock.yaml` as a stream of up to two YAML
documents: an optional first document carries the package-manager
bootstrap (`packageManagerDependencies` and the snapshots that back
it) and the second document is the regular project lockfile. Pacquet
hands the file straight to `serde_saphyr::from_str`, which rejects a
multi-document stream with "multiple YAML documents detected" — so
every install against a v11 repo that has a `packageManager` /
`devEngines.packageManager` declaration fails before staleness
checking even runs.

Port upstream's `extractMainDocument` to a new `yaml_documents`
module: if the file starts with `---\n`, return the slice after the
next `\n---\n` separator; if there is no second separator, the file
is env-only and the loader returns `Ok(None)`. `load_from_path`
threads the lockfile content through the filter before deserializing,
matching pnpm's `_read` call site at
https://github.com/pnpm/pnpm/blob/31858c544b/lockfile/fs/src/read.ts#L103-L110.

Three unit tests in `yaml_documents/tests` mirror upstream's
`extractMainDocument` test cases, and two integration tests in
`load_lockfile/tests.rs` cover the combined-document and env-only
paths end-to-end.

---
Written by an agent (Claude Code, claude-opus-4-7).

* fix(package-manifest): reify devEngines.runtime into devDependencies

With pnpm#511 / pnpm#512 pacquet recognises `runtime:` specifiers in the
lockfile, so a frozen install against a v11 repo gets past the YAML
parse but then trips the staleness check: the lockfile lists
`node@runtime:24.6.0` under the root importer's `devDependencies`,
while the on-disk `package.json` only declares the runtime through
`devEngines.runtime`. The flat-record diff then surfaces a spurious
"node@runtime:24.6.0 was removed" mismatch.

Port upstream's `convertEnginesRuntimeToDependencies` to a new free
function in `crates/package-manifest`. For each of `node`, `deno`,
`bun`, if `devEngines.runtime` (or `engines.runtime`) declares the
runtime with `onFail: "download"` and an explicit version, and the
target dependencies bucket has no explicit entry yet, insert
`<name>: "runtime:<version>"`. Array and single-object runtime shapes
are both accepted. Skip when `onFail` is anything other than
`"download"` or when the version is absent — upstream warns on the
missing-version path; pacquet skips silently and the staleness check
still surfaces the gap if it matters downstream. WebContainer's
"no runtime download" branch is intentionally omitted since pacquet
does not run there.

`PackageManifest::read_from_file` calls the function for both
`(devEngines, devDependencies)` and `(engines, dependencies)`,
mirroring upstream's `convertManifestAfterRead` at
https://github.com/pnpm/pnpm/blob/9cad8274fd/workspace/project-manifest-reader/src/index.ts#L227-L231.

Six unit tests in `tests.rs` cover the happy path, the
no-version skip, the non-`download` `onFail` skip, preservation of
an explicit user-declared entry, the array-of-runtimes form, and the
`engines` → `dependencies` variant. A seventh test exercises the
hook through `PackageManifest::from_path` end-to-end.

Upstream reference:
https://github.com/pnpm/pnpm/blob/9cad8274fd/pkg-manifest/utils/src/convertEnginesRuntimeToDependencies.ts#L10-L45.

---
Written by an agent (Claude Code, claude-opus-4-7).

…m#512)

Pnpm v11 writes runtime depPaths with a scheme prefix in front of
the semver — e.g. `node@runtime:22.0.0` in `packages:` /
`snapshots:` keys, and `runtime:22.0.0` in importer `dependencies:`
values. Pacquet's `PkgVerPeer` parser previously accepted only
bare semver and rejected the prefix, so it couldn't load any v11
lockfile containing a runtime dependency.

Extend `PkgVerPeer` to recognise a leading `runtime:` (closed enum
`Prefix::{None, Runtime}`) and preserve it through `Display` /
`serde`. The version + peer parts continue to parse the same way
— the prefix-strip happens once up front, after which the
parenthesis-based peer-suffix detection is unchanged.

Touch points:
- Added `Prefix` enum with `as_str()` and `Display`.
- `PkgVerPeer::prefix()` exposes the variant so downstream
  consumers can discriminate runtime entries without
  substring-searching the depPath.
- `PkgVerPeer::into_tuple()` keeps the `(Version, String)` shape
  for backward compatibility — pre-runtime callers don't see the
  prefix.

5 new unit tests pin: bare-semver no-prefix, runtime no-peer,
runtime with peer-suffix, runtime-substring-mid-version is NOT a
prefix (anchored at start), and serde round-trip on the runtime
form. All 100 existing `pacquet-lockfile` tests still pass.

Unblocks pnpm#437 slice F (end-to-end install fixtures) — pacquet's
lockfile loader now accepts `node@runtime:X.Y.Z`-shaped keys.

…npm#437 slice F) (pnpm#516)

* test(package-manager): variant-mismatch + --no-runtime install tests (pnpm#437 slice F)

Two end-to-end install tests for the runtime-dependency pipeline,
now that pnpm#512 (`PkgVerPeer::Prefix::Runtime`) unblocked
fixture-lockfile parsing.

- `frozen_lockfile_install_errors_when_no_variant_matches_host`:
  Lockfile with a `VariationsResolution` whose only variant
  targets `aix/ppc64` (a platform pacquet CI never runs on).
  Install fails with `NoMatchingPlatformVariant` from the
  cold-batch dispatcher. Variant selection runs before any
  network fetch, so the bogus archive URL is never read — the
  test stays hermetic. Closes the variant-mismatch checkbox.
- `frozen_lockfile_install_skips_runtime_when_skip_runtimes_set`:
  Same lockfile, but with `skip_runtimes: true`. The
  `--no-runtime` filter iterates importer-direct deps, builds
  `node@runtime:22.0.0` from `(alias, version)`, sees the
  `@runtime:` substring, and adds the snapshot to the skip set
  — so variant selection never runs and the unmatchable variant
  doesn't fail the install. Asserts both the runtime slot and
  the direct-dep symlink are absent. Closes the `--no-runtime`
  checkbox.

Both tests were verified to catch their respective regressions
(disable the `skip_runtimes` filter → the second test fails with
`NoMatchingPlatformVariant` instead of succeeding).

Required a fix in `PkgNameVerPeer::without_peer`: the existing
implementation dropped the `Prefix::Runtime` when stripping the
peer-dependency suffix, so a runtime snapshot key like
`node@runtime:22.0.0(some@peer)` would resolve to the
non-existent `node@22.0.0` `packages:` entry. Now preserves the
prefix through the strip.

Slice F's remaining items (happy-path archive fetch, integrity
mismatch, NODE_EXTRAS verified end-to-end, TEST_PORTING.md
entries) need a mock HTTP server + recorded archive fixture, so
defer to a follow-up — keeping this PR reviewable.

* test(package-manager): use symlink_metadata for absent-entry checks

Address CodeRabbit review on pnpm#516: `Path::exists()` follows
symlinks, so a regression that created a *dangling* symlink at
`<modules_dir>/node` would still pass the
`!direct_dep.exists()` assertion — the install would have created
the entry the skip set was supposed to suppress, but the test
wouldn't notice.

Switch both "must NOT exist" assertions to
`std::fs::symlink_metadata(...).is_err()` so the entry-level
check catches dangling symlinks too.

…npm#525)

* fix(lockfile): skip env document in pnpm v11 combined lockfiles

Pnpm v11 writes `pnpm-lock.yaml` as a stream of up to two YAML
documents: an optional first document carries the package-manager
bootstrap (`packageManagerDependencies` and the snapshots that back
it) and the second document is the regular project lockfile. Pacquet
hands the file straight to `serde_saphyr::from_str`, which rejects a
multi-document stream with "multiple YAML documents detected" — so
every install against a v11 repo that has a `packageManager` /
`devEngines.packageManager` declaration fails before staleness
checking even runs.

Port upstream's `extractMainDocument` to a new `yaml_documents`
module: if the file starts with `---\n`, return the slice after the
next `\n---\n` separator; if there is no second separator, the file
is env-only and the loader returns `Ok(None)`. `load_from_path`
threads the lockfile content through the filter before deserializing,
matching pnpm's `_read` call site at
https://github.com/pnpm/pnpm/blob/31858c544b/lockfile/fs/src/read.ts#L103-L110.

Three unit tests in `yaml_documents/tests` mirror upstream's
`extractMainDocument` test cases, and two integration tests in
`load_lockfile/tests.rs` cover the combined-document and env-only
paths end-to-end.

---
Written by an agent (Claude Code, claude-opus-4-7).

* fix(package-manifest): reify devEngines.runtime into devDependencies

With pnpm#511 / pnpm#512 pacquet recognises `runtime:` specifiers in the
lockfile, so a frozen install against a v11 repo gets past the YAML
parse but then trips the staleness check: the lockfile lists
`node@runtime:24.6.0` under the root importer's `devDependencies`,
while the on-disk `package.json` only declares the runtime through
`devEngines.runtime`. The flat-record diff then surfaces a spurious
"node@runtime:24.6.0 was removed" mismatch.

Port upstream's `convertEnginesRuntimeToDependencies` to a new free
function in `crates/package-manifest`. For each of `node`, `deno`,
`bun`, if `devEngines.runtime` (or `engines.runtime`) declares the
runtime with `onFail: "download"` and an explicit version, and the
target dependencies bucket has no explicit entry yet, insert
`<name>: "runtime:<version>"`. Array and single-object runtime shapes
are both accepted. Skip when `onFail` is anything other than
`"download"` or when the version is absent — upstream warns on the
missing-version path; pacquet skips silently and the staleness check
still surfaces the gap if it matters downstream. WebContainer's
"no runtime download" branch is intentionally omitted since pacquet
does not run there.

`PackageManifest::read_from_file` calls the function for both
`(devEngines, devDependencies)` and `(engines, dependencies)`,
mirroring upstream's `convertManifestAfterRead` at
https://github.com/pnpm/pnpm/blob/9cad8274fd/workspace/project-manifest-reader/src/index.ts#L227-L231.

Six unit tests in `tests.rs` cover the happy path, the
no-version skip, the non-`download` `onFail` skip, preservation of
an explicit user-declared entry, the array-of-runtimes form, and the
`engines` → `dependencies` variant. A seventh test exercises the
hook through `PackageManifest::from_path` end-to-end.

Upstream reference:
https://github.com/pnpm/pnpm/blob/9cad8274fd/pkg-manifest/utils/src/convertEnginesRuntimeToDependencies.ts#L10-L45.

---
Written by an agent (Claude Code, claude-opus-4-7).