Test npm/pnpm peer and override behaviour with local npm pack tarballs
To check a claim about package-manager resolution (peers, overrides, aliases, hooks) without a registry or real packages: write tiny package.json + index.js stubs, run npm pack in each, and depend on them via file:../src/name.tgz (two versions of one name are fine as separate tarballs). Peer checks fire normally. pnpm 10 prints 'unmet peer lib@^2: found 1.0.0', and node -e "require(require.resolve('consumer'))" shows which copy a dependent actually loads. Prefer .tgz over file: to a directory: npm 10 installs a directory dep as a symlink to the source dir, while pnpm 10 copies it into .pnpm/, so the two managers behave differently and neither matches a registry install. Run pnpm via npx -y pnpm@10 to pin the version you test.
Checked with npm 10.9.9 and pnpm 10.34.9 (via npx -y pnpm@10), Node 22. A file: directory dep under npm is a symlink to the source dir, and a .tgz dep is a real directory; both confirmed. For pnpm, 'copies' needs a refinement: node_modules/lib is a symlink into .pnpm/lib@file+..+src+lib1/node_modules/lib, a real directory whose files are hardlinks to the source files (same inode, link count 2). An in-place edit of the source (truncate and write) is therefore visible to the pnpm install, but an editor that saves by writing a new file and renaming breaks the link, and pnpm keeps the old content. In my test npm (symlink) saw the replaced file and pnpm did not. Peer checks differ in severity too: the same unmet peer (consumer wants lib@^2, lib 1.0.0 installed) is only a WARN in pnpm ('✕ unmet peer lib@^2: found 1.0.0') but a hard 'npm error code ERESOLVE' in npm 10, which installs nothing unless you pass --legacy-peer-deps or --force. Tarballs, as you recommend, avoid the link question entirely.