Named catalog dependencies in a relative injected workspace package fail during resolution #17280

import assert from 'node:assert/strict';
import fs from 'node:fs';
import os from 'node:os';
import path from 'node:path';
import { spawnSync } from 'node:child_process';

const pnpm = process.argv[2] || 'pnpm';
const root = fs.mkdtempSync(path.join(os.tmpdir(), 'pnpm-catalog-peer-'));
const env = Object.fromEntries(Object.entries(process.env)
  .filter(([key]) => !/^(npm|pnpm)_config_/i.test(key)));
const home = path.join(root, 'home');
fs.mkdirSync(home);
fs.writeFileSync(path.join(home, 'empty.npmrc'), '');
Object.assign(env, {
  HOME: home, USERPROFILE: home, CI: '', NO_COLOR: '1',
  XDG_CONFIG_HOME: path.join(home, 'config'),
  XDG_CACHE_HOME: path.join(home, 'cache'),
  XDG_DATA_HOME: path.join(home, 'data'),
  XDG_STATE_HOME: path.join(home, 'state'),
  npm_config_userconfig: path.join(home, 'empty.npmrc'),
});
const write = (name, value) => {
  const filename = path.join(root, name);
  fs.mkdirSync(path.dirname(filename), { recursive: true });
  fs.writeFileSync(filename, typeof value === 'string' ? value : JSON.stringify(value, null, 2));
};
const peerManifest = (specifier) => ({
  name: 'peer', version: '1.0.0', dependencies: { colors: specifier },
});
const config = {
  packages: [],
  injectWorkspacePackages: true,
  ignoreScripts: true,
  ignorePnpmfile: true,
  preferFrozenLockfile: true,
  trustLockfile: true,
  registry: 'https://registry.npmjs.org/',
  minimumReleaseAge: 0,
  catalogs: { 'project/common': { colors: '1.4.0' } },
};
const run = (label, expected, lockfileOnly = true) => {
  const args = ['install', '--no-frozen-lockfile', '--reporter=append-only',
    '--store-dir', path.join(root, 'store')];
  if (lockfileOnly) args.push('--lockfile-only');
  const result = spawnSync(pnpm, args, {
    cwd: path.join(root, 'app'), env, encoding: 'utf8', timeout: 60000,
  });
  if (result.error) throw result.error;
  console.log(`\n${label}: exit ${result.status}\n${result.stdout}${result.stderr}`);
  fs.writeFileSync(path.join(root, `${label}.log`), result.stdout + result.stderr);
  if (expected === 'success') {
    assert.equal(result.status, 0, label);
  } else {
    assert.notEqual(result.status, 0, `${label}: this case no longer reproduces`);
    assert.match(result.stdout + result.stderr, /ERR_PNPM_UNSUPPORTED_PROTOCOL/);
    assert.match(result.stdout + result.stderr, /catalog:project\/common/);
  }
};
console.log('Reproduction:', root);
console.log('Node:', process.version, 'OS:', os.platform(), os.release(), os.arch());
const version = spawnSync(pnpm, ['--version'], { env, encoding: 'utf8' });
assert.equal(version.status, 0, version.stderr);
console.log('pnpm:', version.stdout.trim());
write('app/package.json', {
  name: 'app', version: '1.0.0', private: true,
  dependencies: { peer: 'workspace:../peer', colors: 'catalog:project/common' },
});
write('peer/package.json', peerManifest('1.4.0'));
write('app/pnpm-workspace.yaml', config); // JSON is valid YAML.
run('1-seed-lockfile-with-literal-peer-dependency', 'success');

// Restore the real case: the injected peer itself uses the named catalog.
write('peer/package.json', peerManifest('catalog:project/common'));
run('2-catalog-peer-existing-lockfile', 'success');

config.preferFrozenLockfile = false;
write('app/pnpm-workspace.yaml', config);
run('3-catalog-peer-recalculate', 'failure');
fs.unlinkSync(path.join(root, 'app/pnpm-lock.yaml'));
run('4-catalog-peer-new-lockfile', 'failure');
run('5-catalog-peer-full-install-new-lockfile', 'failure', false);

// Change only the peer's dependency, leaving app's catalog reference intact.
write('peer/package.json', peerManifest('1.4.0'));
run('6-control-only-peer-catalog-expanded', 'success');
const lock = fs.readFileSync(path.join(root, 'app/pnpm-lock.yaml'), 'utf8');
assert.match(lock, /peer@file:\.\.\/peer/);
assert.match(lock, /colors: 1\.4\.0/);
console.log('Observed the three failures and the existing-lockfile/literal-version controls.');