vercel/turborepo#12819 was closed; the live root-cause fix (retain the
base packages entry for peer-variant injected deps) is tracked at
vercel/turborepo#12825. Keeps the source comment consistent with the
PR description.

vercel/turborepo#12819 was closed; the live root-cause fix (retain the
base packages entry for peer-variant injected deps) is tracked at
vercel/turborepo#12825. Keeps the source comment consistent with the
PR description.

Mirror the TS-side defense-in-depth fix on the pacquet stack so a
pruned `injectWorkspacePackages` lockfile (older `turbo prune --docker`
output, pre vercel/turborepo#12825) loads on Rust too. Two pieces:

1. Widen `PkgVerPeer` to accept `file:` versions. The version slot
   becomes a `VersionPart::{Semver(Version), File(String)}` sum type
   so a snapshot key like `pkg@file:packages/pkg(peer@1.0.0)` parses
   instead of failing at the semver `from_str`. Display writes the
   `file:` scheme back, so round-trips stay byte-stable. The single
   semver-required caller (`find_runtime_node_major` reading
   `.major`) is migrated to a new `version_semver()` accessor and
   stays gated by the existing `Prefix::Runtime` check; `runtime:`
   and `file:` are explicitly mutually exclusive at parse time.

2. Add `Lockfile::reconstruct_missing_directory_resolutions()` and
   run it at the end of `load_from_path`. This is the analog of the
   TS `convertToLockfileObject` synthesis at
   `lockfile/fs/src/lockfileFormatConverters.ts`: for any peer-variant
   snapshot whose `without_peer()` lookup misses, fabricate a
   `LockfileResolution::Directory` from the `file:` path so every
   downstream `packages.get(...).resolution` call keeps working. The
   tarball-vs-directory boundary mirrors the resolver's
   `/\\.(?:tgz|tar\\.gz|tar)$/i` regex via a case-insensitive suffix
   check on `.tgz` / `.tar.gz` / `.tar`.

Tests:

- `pkg_ver_peer/tests.rs`: round-trip + serde for `file:` (plain and
  with peer suffix); `parse_err` cases for empty path after `file:`
  and `runtime:file:` conflict.
- `load_lockfile/tests.rs`: pruned lockfile with one directory
  peer-variant + lowercase / uppercase / mixed-case tarball
  peer-variants asserts that only the directory case gets a
  synthesized resolution.

---
Written by an agent (Claude Code, claude-opus-4-7).

vercel/turborepo#12819 was closed; the live root-cause fix (retain the
base packages entry for peer-variant injected deps) is tracked at
vercel/turborepo#12825. Keeps the source comment consistent with the
PR description.

Mirror the TS-side defense-in-depth fix on the pacquet stack so a
pruned `injectWorkspacePackages` lockfile (older `turbo prune --docker`
output, pre vercel/turborepo#12825) loads on Rust too. Two pieces:

1. Widen `PkgVerPeer` to accept `file:` versions. The version slot
   becomes a `VersionPart::{Semver(Version), File(String)}` sum type
   so a snapshot key like `pkg@file:packages/pkg(peer@1.0.0)` parses
   instead of failing at the semver `from_str`. Display writes the
   `file:` scheme back, so round-trips stay byte-stable. The two
   semver-required callers (`find_runtime_node_major` and
   `find_own_runtime_node_major`) migrate to a new `version_semver()`
   accessor; `runtime:` and `file:` are explicitly mutually exclusive
   at parse time.

2. Add `Lockfile::reconstruct_missing_directory_resolutions()` and
   run it at the end of `load_from_path`. Analog of the TS
   `convertToLockfileObject` synthesis: for any peer-variant snapshot
   whose `without_peer()` lookup misses, fabricate a
   `LockfileResolution::Directory` from the `file:` path so every
   downstream `packages.get(...).resolution` call keeps working. The
   tarball-vs-directory boundary mirrors the resolver's
   `/\\.(?:tgz|tar\\.gz|tar)$/i` regex via a case-insensitive suffix
   check on `.tgz` / `.tar.gz` / `.tar`.

Tests:

- `pkg_ver_peer/tests.rs`: round-trip + serde for `file:` (plain and
  with peer suffix); `parse_err` cases for empty path after `file:`
  and `runtime:file:` conflict.
- `load_lockfile/tests.rs`: pruned lockfile with one directory
  peer-variant + lowercase / uppercase / mixed-case tarball
  peer-variants asserts that only the directory case gets a
  synthesized resolution.

---
Written by an agent (Claude Code, claude-opus-4-7).

…th + lifecycle re-import (#11662)

Fixes two **independent** crashes hitting `pnpm install --frozen-lockfile` on workspaces with `injectWorkspacePackages: true` (or `dependenciesMeta.*.injected`), surfaced via `turbo prune --docker` pipelines.

## Bug 1 — peer-variant snapshot missing `resolution` (lean, defense-in-depth)

A peer-variant injected workspace snapshot (`@scope/pkg@file:packages/pkg(peerA@1)(peerB@2)`) inherits its `resolution` from the base `packages:` entry (`@scope/pkg@file:packages/pkg`). When a tool prunes the lockfile and drops that base entry, readers that deref `pkgSnapshot.resolution` crash with the cryptic:

```
Cannot use 'in' operator to search for 'directory' in undefined
```

**The root cause is upstream of pnpm**: the pruner (e.g. `turbo prune`) emits an internally inconsistent lockfile. Fixed at the source in **vercel/turborepo#12825** (retain the base entry for peer-variant injected deps; minimal repro in **vercel/turborepo#12824**) — empirically verified to produce a correct pruned lockfile for a real multi-service workspace.

**pnpm side (this PR): one lean normalization at the read layer** — in `convertToLockfileObject`, where base→variant inheritance already happens via `Object.assign`. When the base entry is absent, reconstruct the directory resolution from the `file:` depPath. This is *reconstruction, not guessing*: for a workspace `file:` dep the directory **is** the depPath suffix — exactly what pnpm's own writer emits. It is **defense-in-depth, not load-bearing**: with a well-formed lockfile (turbo#12825 or any correct input) the branch never fires. Because the normalization sits at the single shared read layer, it also covers the sibling `Cannot use 'in' operator … 'integrity' in undefined` on the `pnpm deploy` path (same `resolution === undefined` root, different deref site).

Per review feedback: the earlier per-reader `inheritOrSynthesizeResolution` helper across 5 call sites is **removed**; normalization lives in exactly one place (`convertToLockfileObject`), and the readers are back to `main`.

## Bug 2 — lifecycle re-import wipes `.bin/<tool>` (pure pnpm; the substantive fix)

`runLifecycleHooksConcurrently` re-imports an injected workspace package into its targets after `prepare`/`postinstall`. The 2022 `scanDir`-into-`filesMap` workaround (#4299) fed target-internal paths to `importPackage`; once #11088 made `importIndexedDir`'s `makeEmptyDir` fast path the default, that path wipes the target's `node_modules` before copying, so the re-import dies with `ERR_PNPM_ENOENT` on `node_modules/.bin/<tool>`.

Fix: drop the `scanDir` workaround and pass `keepModulesDir: true` so `importIndexedDir` skips the destructive fast path and preserves the target's existing `node_modules` (bin symlinks + transitive deps) via its staging/move path. Stays on `storeController.importPackage`, so source files keep their **hardlinks** (no copy-loop regression). Net reduction vs `main`: the `scanDir` helper and the `node:fs` / `FilesMap` imports are removed.

## Tests

- The `deps-restorer` regression fixture `peer-variant-missing-resolution` **omits the base `packages:` entry**, so it encodes the actual pruned shape and reproduces the crash on `main`: reverting the `convertToLockfileObject` change yields `resolution: undefined` for the peer-variant (→ the `lockfileToDepGraph` crash); with this PR it is reconstructed as `{ type: 'directory', directory: … }`.
- A `lockfile.fs` unit test pins the heuristic boundary: a directory resolution is synthesized for a pruned `file:` peer-variant but **never** for a `file:` tarball.
- A `deps-installer` regression test covers the Bug 2 re-import (injected dep with a `prepare` script + a bin-having dependency).

## Validation

End-to-end on a real `injectWorkspacePackages` monorepo (`turbo prune --docker` → `pnpm install --frozen-lockfile`), on services that crash on **both** bugs with stock pnpm:

- pnpm with both fixes: the crashing services build.
- **vercel/turborepo#12825 + pnpm with only Bug 2** (Bug 1 fully reverted): the crashing services still **build** → confirms Bug 1 here is genuine defense-in-depth and turbo#12825 owns the root cause.
- Bug 2 reproduces on stock pnpm regardless of turbo (it is purely pnpm's importer fast-path).

Pairs with **vercel/turborepo#12825** (Bug 1 root cause; minimal repro **vercel/turborepo#12824**). Tracks #11663.

---------

Co-authored-by: Zoltan Kochan <z@kochan.io>
Co-authored-by: Eyalm321 <eyal@sunsationsusa.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: UApply Developer <developer@uapply.ai>