Struct Resolver 

pub struct Resolver { /* private fields */ }

BFS dependency resolver.

Implementations

impl Resolver

pub fn new(client: Arc<RegistryClient>) -> Self

pub fn with_stream( client: Arc<RegistryClient>, ) -> (Self, Receiver<ResolvedPackage>)

Create a resolver that streams resolved packages through a channel. Returns (resolver, receiver). The receiver yields packages as they’re discovered, allowing tarball fetches to start during resolution.

pub fn with_stream_capacity( client: Arc<RegistryClient>, capacity: usize, ) -> (Self, Receiver<ResolvedPackage>)

Create a streaming resolver with a bounded resolved-package buffer.

pub fn with_packument_network_concurrency(self, n: Option<usize>) -> Self

pub fn with_packument_cache(self, cache_dir: PathBuf) -> Self

Enable disk-backed packument caching with ETag/Last-Modified revalidation.

pub fn with_packument_full_cache(self, cache_dir: PathBuf) -> Self

Disk cache for full (non-corgi) packuments, used in ResolutionMode::TimeBased so we can read the time: map.

pub fn with_resolution_mode(self, mode: ResolutionMode) -> Self

Set the resolution mode. Defaults to Highest (pnpm’s classic behavior). TimeBased switches direct deps to lowest-satisfying and constrains transitives by a publish-date cutoff.

pub fn with_minimum_release_age(self, mra: Option<MinimumReleaseAge>) -> Self

Configure pnpm v11’s minimumReleaseAge family of settings. Pass None (or a config with minutes == 0) to disable.

pub fn with_auto_install_peers(self, auto_install_peers: bool) -> Self

Override the default auto-install-peers=true behavior. pnpm reads this from .npmrc or pnpm-workspace.yaml; aube’s install command plumbs the resolved value through here before running resolution.

pub fn with_peers_suffix_max_length(self, max_length: usize) -> Self

Configure pnpm’s peersSuffixMaxLength. When the peer suffix body on a dep_path would exceed this many bytes, the post-pass replaces the whole suffix with a parenthesized short hash (<short-hash>) (pnpm’s createPeerDepGraphHash). Default 1000 (pnpm’s default).

pub fn with_dedupe_peer_dependents(self, value: bool) -> Self

Override the default dedupe-peer-dependents=true behavior. When false, the peer-context pass keeps every distinct ancestor-scope variant of a package instead of collapsing peer-equivalent ones into a single dep_path. Plumbed from .npmrc / pnpm-workspace.yaml via the install command.

pub fn with_dedupe_peers(self, value: bool) -> Self

Override the default dedupe-peers=false behavior. When true, peer suffixes in the lockfile drop the peer name and emit only the resolved version — (18.2.0) instead of (react@18.2.0). Plumbed from .npmrc / pnpm-workspace.yaml via the install command.

pub fn with_resolve_peers_from_workspace_root(self, value: bool) -> Self

Override the default resolve-peers-from-workspace-root=true behavior. When false, peer resolution stops at the importer’s own scope + BFS-auto-installed transitives instead of consulting the workspace root’s direct deps as a fallback tier. Plumbed from .npmrc / pnpm-workspace.yaml via the install command.

pub fn with_registry_supports_time_field(self, value: bool) -> Self

Configure pnpm’s registry-supports-time-field. When true, the resolver keeps using the abbreviated (corgi) packument path even when time: is needed, saving one full-packument fetch per distinct package. Safe for registries that embed time in their abbreviated responses (Verdaccio 5.15.1+, JSR, most in-house mirrors); leave at the default false for npmjs.org.

pub fn with_force_metadata_primer(self, value: bool) -> Self

Force the bundled metadata primer on for npm-compatible mirrors. Normally the primer only seeds npmjs.org cache entries because it was generated from npmjs metadata.

pub fn with_exclude_links_from_lockfile(self, value: bool) -> Self

Configure pnpm’s exclude-links-from-lockfile setting. Only affects lockfile serialization — the resolver still builds the same graph either way, but the value is stamped into LockfileGraph::settings so the pnpm writer can filter link: importer entries on write.

pub fn with_supported_architectures(self, value: SupportedArchitectures) -> Self

Override the host platform triple used when filtering optional dependencies. See [platform::SupportedArchitectures].

pub fn with_overrides(self, overrides: BTreeMap<String, String>) -> Self

Provide dependency overrides. The map’s keys are selector strings — bare name, parent>child, foo@<2, **/foo, or any combination thereof — and values are version specifiers (or npm: aliases). Keys are compiled into override_rule structures; unparseable keys are dropped. Whenever the resolver encounters a task matching a rule (by name + ancestor chain + optional version constraints), the requested range is replaced with the rule’s replacement before any packument fetch or version pick. Workspace + manifest sources are merged by the caller.

pub fn with_catalogs( self, catalogs: BTreeMap<String, BTreeMap<String, String>>, ) -> Self

Provide workspace catalog ranges. Outer key is the catalog name (default for the unnamed catalog: field in pnpm-workspace.yaml); inner key is the package name. The resolver rewrites catalog: and catalog:<name> task ranges against this map before the override / npm-alias passes, and records the picks in the output graph’s catalogs field.

pub fn with_project_root(self, project_root: PathBuf) -> Self

Set the project root used to resolve file: / link: paths. file:./vendor/foo resolves against this directory, and a matching directory / tarball is read to drive resolution of the local package’s transitive deps.

pub fn with_ignore_scripts(self, ignore_scripts: bool) -> Self

pub fn with_ignored_optional_dependencies( self, ignored: BTreeSet<String>, ) -> Self

Names to strip from every optionalDependencies map before enqueueing (pnpm’s pnpm.ignoredOptionalDependencies). Applied to both root and transitive optional deps. Empty by default.

pub fn with_read_package_hook(self, hook: Box<dyn ReadPackageHook>) -> Self

Install a readPackage hook. The resolver calls it once per version-picked packument before enqueueing transitives; see ReadPackageHook for what mutations are honored.

pub fn with_dependency_policy(self, policy: DependencyPolicy) -> Self

Configure dependency resolution policy settings such as packageExtensions, allowedDeprecatedVersions, trustPolicy*, and blockExoticSubdeps.

pub fn with_vulnerable_ranges( self, ranges: BTreeMap<String, Vec<String>>, ) -> Self

Prefer non-vulnerable versions for the supplied audit ranges. Used by audit --fix=update to reuse the normal resolver while steering only vulnerable packages away from affected versions.

pub fn with_git_shallow_hosts(self, hosts: Vec<String>) -> Self

Set the git-shallow-hosts list used when cloning git deps. When a git URL’s host matches an entry here (exact match, same as pnpm), aube attempts a shallow fetch by SHA; other hosts get a plain git fetch origin. An empty list forces every git dep through the full-fetch path.

impl Resolver

pub fn direct_dep_info( &self, graph: &LockfileGraph, ) -> HashMap<String, DirectDepInfo>

Snapshot per-direct-dep packument facts so the install summary printer can render them inline after the resolver — and its packument cache — is dropped. Keys are DirectDep::dep_path; importer direct deps don’t carry peer-context suffixes, so the key matches the LockfileGraph.packages entry 1:1.

Skips deps whose packument wasn’t fetched (frozen-lockfile reuse, non-registry sources) and deps whose registry didn’t publish a latest dist-tag. Returns only entries where at least one signal is set so the caller’s printer can use get(dep_path) as the “should I render badges?” check.

impl Resolver

pub async fn resolve( &mut self, manifest: &PackageJson, existing: Option<&LockfileGraph>, ) -> Result<LockfileGraph, Error>

Resolve all dependencies from a package.json.

Uses batch-parallel BFS: each “wave” drains the queue, identifies uncached package names, fetches their packuments concurrently, then processes the entire batch before starting the next wave.

pub async fn resolve_workspace( &mut self, manifests: &[(String, PackageJson)], existing: Option<&LockfileGraph>, workspace_packages: &HashMap<String, String>, ) -> Result<LockfileGraph, Error>

Resolve all dependencies for a workspace (multiple importers).

manifests is a list of (importer_path, PackageJson) — e.g. (“.”, root), (“packages/app”, app). workspace_packages maps package name → version. Used both for explicit workspace: protocol resolution and for yarn/npm/bun style linkage where a bare semver range on a workspace-package name resolves to the local copy when its version satisfies the range.