Implements a pnpm lockfile migration & more (#197)

This PR adds some basic logic to import pnpm lockfile into Yarn. It's
not perfect because the pnpm lockfile is unfortunately a little bare -
for example it doesn't contain the original ranges. The import process
works like this:

- We run `pnpm list -r --depth 3` to try and get the list of packages in
the dependency tree, and their path + tarball
- `--depth 3` is arbitrary; more than that crashes the process, and less
than that means we'd miss more ranges
- Then we read the `package.json` for each path
- We iterate the `dependencies` field from the `package.json` to obtain
the original range, and we attach it to whatever version we have in the
`pnpm list` output

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Introduces pnpm installation/migration support and improves registry
fetching/auth.
> 
> - Adds lockfile import from existing `pnpm` installs by parsing `pnpm
list --json` and package manifests; falls back to this when no lockfile
exists
> - Switches pnpm virtual store from `node_modules/.store` to
`node_modules/.pnpm`; updates config schema (`pnpmStoreFolder`), docs,
tests, and linker paths/hoisting pattern type (`IdentGlob`)
> - Extends `npm:` references with optional tarball URL; preserve
shorthand only when URL absent; adjust descriptor resolution/alias
handling accordingly
> - Implements registry auth resolution (scopes, per-registry,
`npmAlwaysAuth`), sends Authorization headers for npm and URL fetches;
adds stricter auth requirement helper and scope normalization
> - Tweaks install graph for inner dependencies (alias vs patch) to
resolve/refresh vs fetch appropriately
> - Minor utils: `UrlEncoded` deref, string serialization error type,
case-insensitive %2f decoding; new error for pnpm node_modules read
> - New acceptance tests for pnpm migration and custom pnpm store
location
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
1aaebb5. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Author: arcanis

.claude/settings.local.json

@@ -15,7 +15,8 @@
       "Bash(git push)",
       "Bash(yarn test:integration:*)",
       "Bash(cargo check:*)",
-      "Bash(git stash:*)"
+      "Bash(git stash:*)",
+      "Bash(RUST_BACKTRACE=1 ~/Repositories/zpm/target/release/yarn-bin:*)"
     ],
     "deny": [],
     "ask": []

documentation/src/content/docs/concepts/core/linkers.md

@@ -39,7 +39,7 @@ Yarn Plug'n'Play has been the default installation strategy in Yarn since 2019,
 
 ## `nodeLinker: pnpm`
 
-Under this mode, a flat folder is generated in `node_modules/.store` containing one folder for each dependency in the project. Each dependency folder is populated with hardlinks obtained from a central store common to all projects on the system (by default `$HOME/.yarn/berry/index`). Finally, symlinks to the relevant folders from the flat store are placed into the `node_modules` folders.
+Under this mode, a flat folder is generated in `node_modules/.pnpm` containing one folder for each dependency in the project. Each dependency folder is populated with hardlinks obtained from a central store common to all projects on the system (by default `$HOME/.yarn/berry/index`). Finally, symlinks to the relevant folders from the flat store are placed into the `node_modules` folders.
 
 <div class="[&_table]:table-fixed [&_th]:w-[50%]">
 

documentation/src/utils/configuration/yarnrc.json

@@ -482,10 +482,10 @@
     "pnpmStoreFolder": {
       "_package": "@yarnpkg/plugin-pnpm",
       "title": "Path where the pnpm store will be stored",
-      "description": "By default, the store is stored in the `node_modules/.store` of the project. Sometimes in CI scenario's it is convenient to store this in a different location so it can be cached and reused.",
+      "description": "By default, the store is stored in the `node_modules/.pnpm` of the project. Sometimes in CI scenario's it is convenient to store this in a different location so it can be cached and reused.",
       "type": "string",
       "format": "uri-reference",
-      "examples": [".cache/.store"]
+      "examples": [".cache/.pnpm"]
     },
     "winLinkType": {
       "_package": "@yarnpkg/core",

packages/zpm-config/schema.json

@@ -282,23 +282,23 @@
     },
     "pnpmHoistPatterns": {
       "type": "array",
-      "description": "Patterns specifying which packages should be hoisted to node_modules/.store/node_modules. By default, all packages are hoisted. Use empty array to disable hoisting.",
+      "description": "Patterns specifying which packages should be hoisted to node_modules/.pnpm/node_modules. By default, all packages are hoisted. Use empty array to disable hoisting.",
       "items": {
-        "type": "zpm_utils::Glob"
+        "type": "zpm_primitives::IdentGlob"
       },
       "default": ["*"]
     },
     "pnpmPublicHoistPatterns": {
       "type": "array",
       "description": "Patterns specifying which packages should be hoisted to the root node_modules directory. Unlike pnpmHoistPatterns which hoists to the hidden modules directory inside the virtual store, this hoists to the public root modules directory.",
       "items": {
-        "type": "zpm_utils::Glob"
+        "type": "zpm_primitives::IdentGlob"
       }
     },
     "pnpmStoreFolder": {
       "type": "string",
       "description": "The folder to use for the Pnpm store",
-      "default": "node_modules/.store"
+      "default": "node_modules/.pnpm"
     },
     "preferDeferredVersions": {
       "type": "boolean",

packages/zpm-config/src/exts.rs

@@ -931,9 +931,6 @@ impl Configuration {
     }
 }
 
-mod exts;
-pub use exts::*;
-
 mod fns;
 pub use fns::*;
 
@@ -954,6 +951,7 @@ merge_settings!(zpm_formats::CompressionAlgorithm, |s: &str| FromFileString::fro
 merge_settings!(zpm_primitives::Descriptor, |s: &str| FromFileString::from_file_string(s).unwrap());
 merge_settings!(zpm_primitives::FilterDescriptor, |s: &str| FromFileString::from_file_string(s).unwrap());
 merge_settings!(zpm_primitives::Ident, |s: &str| FromFileString::from_file_string(s).unwrap());
+merge_settings!(zpm_primitives::IdentGlob, |s: &str| FromFileString::from_file_string(s).unwrap());
 merge_settings!(zpm_primitives::Locator, |s: &str| FromFileString::from_file_string(s).unwrap());
 merge_settings!(zpm_primitives::PeerRange, |s: &str| FromFileString::from_file_string(s).unwrap());
 merge_settings!(zpm_primitives::Range, |s: &str| FromFileString::from_file_string(s).unwrap());

packages/zpm-config/src/lib.rs

@@ -86,7 +86,7 @@ impl Descriptor {
         };
 
         let reference = match reference {
-            Reference::Registry(params) if params.ident == self.ident => reference::ShorthandReference {
+            Reference::Registry(params) if params.ident == self.ident && params.url.is_none() => reference::ShorthandReference {
                 version: params.version,
             }.into(),
 

packages/zpm-primitives/src/descriptor.rs

@@ -11,7 +11,12 @@ pub struct IdentGlob {
 
 impl IdentGlob {
     pub fn new(raw: &str) -> Result<Self, globset::Error> {
-        let glob = GlobBuilder::new(raw)
+        let actual_raw = match raw {
+            "*" => "**",
+            _ => raw,
+        };
+
+        let glob = GlobBuilder::new(actual_raw)
             .literal_separator(false)
             .build()?;
 

packages/zpm-primitives/src/ident_glob.rs

@@ -13,6 +13,13 @@ fn format_patch(inner: &UrlEncoded<Locator>, path: &str, checksum: &Option<Hash6
     }
 }
 
+fn format_registry(ident: &Ident, version: &zpm_semver::Version, url: Option<&String>) -> String {
+    match url {
+        Some(url) => format!("npm:{}@{}#{}", ident.to_file_string(), version.to_file_string(), url.to_file_string()),
+        None => format!("npm:{}@{}", ident.to_file_string(), version.to_file_string()),
+    }
+}
+
 fn format_workspace_path(path: &Path) -> String {
     if path.is_empty() {
         "workspace:.".to_string()
@@ -47,12 +54,13 @@ pub enum Reference {
         version: zpm_semver::Version,
     },
 
-    #[pattern(r"npm:(?<ident>.*)@(?<version>.*)")]
-    #[to_file_string(|params| format!("npm:{}@{}", params.ident.to_file_string(), params.version.to_file_string()))]
-    #[to_print_string(|params| DataType::Reference.colorize(&format!("npm:{}@{}", params.ident.to_file_string(), params.version.to_file_string())))]
+    #[pattern(r"npm:(?<ident>(?:@[^#@]+/)?[^#@]+)@(?<version>[^#]*)(?:#(?<url>.*))?")]
+    #[to_file_string(|params| format_registry(&params.ident, &params.version, params.url.as_deref()))]
+    #[to_print_string(|params| DataType::Reference.colorize(&format_registry(&params.ident, &params.version, params.url.as_deref())))]
     Registry {
         ident: Ident,
         version: zpm_semver::Version,
+        url: Option<UrlEncoded<String>>,
     },
 
     #[pattern(r"file:(?<path>.*\.(?:tgz|tar\.gz))")]

packages/zpm-primitives/src/reference.rs

@@ -1,4 +1,4 @@
-use std::fmt;
+use std::{fmt, string::FromUtf8Error};
 
 use colored::Colorize;
 use erased_serde::serialize_trait_object;
@@ -209,7 +209,7 @@ impl ToHumanString for std::time::Duration {
 }
 
 impl FromFileString for String {
-    type Error = std::convert::Infallible;
+    type Error = FromUtf8Error;
 
     fn from_file_string(s: &str) -> Result<Self, Self::Error> {
         Ok(s.to_string())