fix: install pnpm deps in hoisted mode + declare @babel/types (#24288) (CP: 24.10) (#24297)

Cherry-pick of #24288 (commit d9290f8) from main to 24.10.

## Summary

Same fix as #24288: switches pnpm install to hoisted (flat npm-style)
layout so transitive npm deps (`@babel/types`, `@lit/reactive-element`,
`cookie`, `set-cookie-parser`, `@preact/signals-react/runtime`) are
always reachable from project root, eliminating the `vite-basics` IT
hang and similar symptoms.

## Adjustments for 24.10

24.10 is pre-`flow-build-tools` refactor (#23161), so all the Java
files the original commit touches (`FrontendTools.java`,
`FrontendToolsTest.java`, `NodeUpdaterTest.java`,
`TaskRunPnpmInstallTest.java`) live under `flow-server/` here. The
edits are otherwise identical.

Two version adjustments to match this branch's dep graph:

1. **`@babel/types` pinned to `7.28.5`** (matching
`@babel/preset-react`)
   instead of main's `7.29.0`. 24.10 does not declare `@babel/core`,
   so version coherence is anchored to `preset-react`.

2. **Skipped `@babel/core` and
`@babel/plugin-transform-react-jsx-development`**
   declarations from the main commit — not declared as direct deps on
   24.10, and the React function location plugin only imports
   `@babel/types`.

## Supersedes #24289

This PR replaces #24289 (the narrower @babel/types-only fix). Once
this lands, #24289 should be closed.

## Test plan

- [ ] CI on this PR passes (specifically `it-tests (1)` and `it-tests
(2)`).
- [ ] `mvn -pl flow-server test
-Dtest=NodeUpdaterTest,TaskRunPnpmInstallTest,FrontendToolsTest` passes.
- [ ] After install in any vite-using IT module, `node_modules/.pnpm/`
does not exist (or is empty); `node_modules/@babel/types/` and
`node_modules/@lit/reactive-element/` exist as real directories at the
project root.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Zhe Sun <zhe@vaadin.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: 3 people

flow-server/src/main/java/com/vaadin/flow/server/frontend/FrontendTools.java

@@ -589,7 +589,13 @@ public List<String> getPnpmExecutable() {
         List<String> pnpmCommand = getSuitablePnpm();
         assert !pnpmCommand.isEmpty();
         pnpmCommand = new ArrayList<>(pnpmCommand);
-        pnpmCommand.add("--shamefully-hoist=true");
+        // Force hoisted (flat npm-style) layout. CLI takes precedence over
+        // .npmrc, so this is unambiguous even if the project lacks the
+        // generated .npmrc. Replaces the previous --shamefully-hoist=true,
+        // which only controls the partial-hoist heuristic on top of the
+        // default isolated layout and did not consistently expose every
+        // transitive at the project root.
+        pnpmCommand.add("--config.node-linker=hoisted");
         return pnpmCommand;
     }
 

flow-server/src/main/resources/com/vaadin/flow/server/frontend/dependencies/vite/package.json

@@ -15,6 +15,7 @@
     "@rollup/plugin-replace": "6.0.3",
     "@rollup/pluginutils": "5.3.0",
     "@babel/preset-react": "7.28.5",
+    "@babel/types": "7.28.5",
     "rollup-plugin-visualizer": "6.0.5",
     "rollup-plugin-brotli": "3.1.0",
     "vite-plugin-checker": "0.12.0",

flow-server/src/main/resources/npmrc

@@ -3,5 +3,11 @@
 #
 # This file sets the default parameters for manual `pnpm install`.
 #
+# node-linker=hoisted produces a flat node_modules layout (like npm),
+# so every transitive dependency lives at the project root. Flow's
+# frontend tooling and bundled Vite plugins (e.g. the React function
+# location plugin) import transitive deps that pnpm's symlink-based
+# layout did not consistently hoist, even with shamefully-hoist=true.
+node-linker=hoisted
 shamefully-hoist=true
 strict-peer-dependencies=false

flow-server/src/test/java/com/vaadin/flow/server/frontend/FrontendToolsTest.java

@@ -449,8 +449,10 @@ public void knownFaultyNpmVersionThrowsException() {
     @Test
     public void getPnpmExecutable_executableIsAvailable() {
         List<String> executable = tools.getPnpmExecutable();
-        // command line should contain --shamefully-hoist=true option
-        Assert.assertTrue(executable.contains("--shamefully-hoist=true"));
+        // command line should force hoisted node-linker so transitive
+        // deps are always installed at the project root
+        Assert.assertTrue(
+                executable.contains("--config.node-linker=hoisted"));
         Assert.assertTrue(
                 executable.stream().anyMatch(cmd -> cmd.contains("pnpm")));
     }

flow-server/src/test/java/com/vaadin/flow/server/frontend/NodeUpdaterTest.java

@@ -169,6 +169,7 @@ public void getDefaultDevDependencies_includesAllDependencies_whenUsingVite() {
         expectedDependencies.add("transform-ast");
         expectedDependencies.add("strip-css-comments");
         expectedDependencies.add("@babel/preset-react");
+        expectedDependencies.add("@babel/types");
         expectedDependencies.add("@types/react");
         expectedDependencies.add("@types/react-dom");
         expectedDependencies.add("@preact/signals-react-transform");

flow-server/src/test/java/com/vaadin/flow/server/frontend/TaskRunPnpmInstallTest.java

@@ -245,6 +245,7 @@ public void runPnpmInstall_npmRcFileNotFound_newNpmRcFileIsGenerated()
         String content = FileUtils.readFileToString(npmRcFile,
                 StandardCharsets.UTF_8);
         Assert.assertTrue(content.contains("shamefully-hoist"));
+        Assert.assertTrue(content.contains("node-linker=hoisted"));
     }
 
     @Test