Read the two-document pnpm-lock.yaml written by pnpm 12

.claude/CLAUDE.md

@@ -53,8 +53,11 @@ by name.
 
 **lockfile/** - Generates isolated lockfiles for each package manager:
 
-- PNPM: Prunes and adapts lockfile using `@pnpm/lockfile-file` and
-  `@pnpm/prune-lockfile` (supports v8 and v9)
+- PNPM: Prunes and adapts lockfile using `@pnpm/prune-lockfile`, reading and
+  writing with `@pnpm/lockfile-file` for lockfile v8 and `@pnpm/lockfile.fs`
+  for v9 (the maintained successor, which handles the two-document lockfile
+  pnpm 12 writes). Both are aliased in package.json as `pnpm_lockfile_file_v8`
+  and `pnpm_lockfile_file_v9`.
 - NPM: Uses `@npmcli/arborist`'s `loadVirtual` + `workspaceDependencySet`
   to compute the target's transitive closure, then copies matching entries
   verbatim from the root `package-lock.json` (preserves original resolved
@@ -103,6 +106,13 @@ The codebase uses `~/` as path alias for `src/` (configured in tsconfig.json).
 
 Tests use Vitest and are co-located with source files (`*.test.ts`).
 
+When a change exists to get different behavior out of a dependency, at least
+one test must exercise that dependency unmocked. Mocking the package whose
+behavior the change was made for proves nothing about it. Use the
+`*.integration.test.ts` pattern with a fixture under
+`__fixtures__/<name>/workspace`, as `generate-npm-lockfile.integration.test.ts`
+and `generate-pnpm-lockfile.integration.test.ts` do.
+
 ## Code Style
 
 - Use JSDoc style comments (`/** ... */`) for all comments, including

package.json

@@ -67,7 +67,7 @@
     "meow": "^14.1.0",
     "outdent": "^0.8.0",
     "pnpm_lockfile_file_v8": "npm:@pnpm/lockfile-file@8",
-    "pnpm_lockfile_file_v9": "npm:@pnpm/lockfile-file@9.0.0",
+    "pnpm_lockfile_file_v9": "npm:@pnpm/lockfile.fs@1100.2.2",
     "pnpm_prune_lockfile_v8": "npm:@pnpm/prune-lockfile@5",
     "pnpm_prune_lockfile_v9": "npm:@pnpm/prune-lockfile@6.0.0",
     "remeda": "^2.33.7",

pnpm-workspace.yaml

@@ -2,3 +2,9 @@ allowBuilds:
   esbuild: true
 minimumReleaseAge: 10080 # 7 days in minutes
 
+overrides:
+  # pretty-ms@9.3.1 was published 2026-08-28 and is inside the minimumReleaseAge
+  # window above. It arrives transitively via @pnpm/lockfile.fs -> network.git-utils
+  # -> safe-execa -> execa. 9.3.0 satisfies execa's ^9.2.0 range and is a year old.
+  # Drop this override once 9.3.1 has aged past the cutoff.
+  pretty-ms: 9.3.0

src/lib/lockfile/helpers/__fixtures__/pnpm-config-dependencies/workspace/apps/svc/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "svc",
+  "version": "1.0.0",
+  "files": [
+    "dist"
+  ],
+  "main": "./dist/index.js",
+  "dependencies": {
+    "left-pad": "1.3.0"
+  }
+}

src/lib/lockfile/helpers/__fixtures__/pnpm-config-dependencies/workspace/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "root",
+  "private": true,
+  "packageManager": "pnpm@12.0.0"
+}

src/lib/lockfile/helpers/__fixtures__/pnpm-config-dependencies/workspace/pnpm-workspace.yaml

@@ -0,0 +1,4 @@
+packages:
+  - apps/*
+configDependencies:
+  my-config: 1.0.0+sha512-AAAAw5EZlYaNyUuBdcIXwn6VQI+gO0oidJd48rNPdzt3zdOznt6BcbIvzVO+ajU0Lp+smUimjvWN9kiM6Jp+Zw==

src/lib/lockfile/helpers/__fixtures__/pnpm-two-document/workspace/apps/svc/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "svc",
+  "version": "1.0.0",
+  "files": [
+    "dist"
+  ],
+  "main": "./dist/index.js",
+  "dependencies": {
+    "left-pad": "1.3.0"
+  }
+}

src/lib/lockfile/helpers/__fixtures__/pnpm-two-document/workspace/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "root",
+  "private": true,
+  "packageManager": "pnpm@12.0.0"
+}

src/lib/lockfile/helpers/__fixtures__/pnpm-two-document/workspace/pnpm-workspace.yaml

@@ -0,0 +1,2 @@
+packages:
+  - apps/*