@catladder/cli 0.0.0-next-d71e41ba → 0.0.0-next-dccc0a36

package/dist/bundles/catenv/index.js

@@ -2321,7 +2321,7 @@ class GithubBackend {
         await (0, promises_1.rm)(scriptFiles_1.GITHUB_SCRIPTS_FOLDER, { recursive: true, force: true });
     }
     async createFiles(config) {
-        const images = this.createImagesPlan();
+        const images = this.createImagesPlan(config);
         const scripts = new scriptFiles_1.GithubScriptFiles();
         const workflows = await this.createWorkflows(config, images, scripts);
         return [
@@ -2336,13 +2336,13 @@ class GithubBackend {
             ...(0, shippedCatci_1.getCatciGeneratedFiles)(),
         ];
     }
-    createImagesPlan() {
-        return new jobImagesPlan_1.JobImagesPlan(this.type);
+    createImagesPlan(config) {
+        return new jobImagesPlan_1.JobImagesPlan(this.type, config.images);
     }
     /**
      * all workflows keyed by file name, mainly for testing purposes
      */
-    async createWorkflows(config, images = this.createImagesPlan(), scripts = new scriptFiles_1.GithubScriptFiles()) {
+    async createWorkflows(config, images = this.createImagesPlan(config), scripts = new scriptFiles_1.GithubScriptFiles()) {
         var _a, _b, _c, _d;
         const workflows = {};
         // per-pipeline-type variables (pipelines.github.runnerVariables);
@@ -3311,7 +3311,7 @@ class GitlabBackend {
         await (0, promises_1.rm)(this.generatedFolder, { force: true, recursive: true });
     }
     async createFiles(config) {
-        const images = this.createImagesPlan();
+        const images = this.createImagesPlan(config);
         const includes = await this.createIncludes(config, images);
         const mainFile = {
             path: ".gitlab-ci.yml",
@@ -3328,15 +3328,15 @@ class GitlabBackend {
             ...(0, shippedCatci_1.getCatciGeneratedFiles)(),
         ];
     }
-    createImagesPlan() {
-        return new jobImagesPlan_1.JobImagesPlan(this.type);
+    createImagesPlan(config) {
+        return new jobImagesPlan_1.JobImagesPlan(this.type, config.images);
     }
     /**
      * the complete pipeline as one object (all includes merged into one),
      * mainly for testing purposes
      */
     async createCompletePipeline(config) {
-        const includes = await this.createIncludes(config, this.createImagesPlan());
+        const includes = await this.createIncludes(config, this.createImagesPlan(config));
         return includes.reduce((acc, { content }) => {
             return {
                 ...acc,
@@ -4428,7 +4428,7 @@ const jobs_1 = __nccwpck_require__(28006);
 const utils_1 = __nccwpck_require__(24516);
 const removeUndefined_1 = __nccwpck_require__(54420);
 const createBuildJobArtifact_1 = __nccwpck_require__(98820);
-const yarn_1 = __nccwpck_require__(59874);
+const packageManagerInstall_1 = __nccwpck_require__(18600);
 const constants_1 = __nccwpck_require__(69302);
 const writeBuildInfo_1 = __nccwpck_require__(92254);
 const writeDotEnv_1 = __nccwpck_require__(76670);
@@ -4468,7 +4468,7 @@ class AppBuildJob extends jobs_1.CatladderJob {
                             .flatMap((c) => (0, writeDotEnv_1.writeDotEnv)(c))
                         : []),
                 ...(context.type === "component" ? (0, writeBuildInfo_1.writeBuildInfo)(context) : []),
-                ...(0, yarn_1.ensureNodeVersion)(context), // in pure node repos, we might want to have the nvmrc file in top-level
+                ...(0, packageManagerInstall_1.ensureNodeVersion)(context), // in pure node repos, we might want to have the nvmrc file in top-level
                 `cd ${context.build.dir}`,
                 ...(0, utils_1.ensureArray)(script),
             ],
@@ -5165,27 +5165,32 @@ const node_1 = __nccwpck_require__(23114);
 const rails_1 = __nccwpck_require__(42427);
 __exportStar(__nccwpck_require__(23114), exports);
 __exportStar(__nccwpck_require__(40632), exports);
+/**
+ * run a package.json script with the project's package manager
+ * (`yarn build` / `pnpm build`)
+ */
+const runScript = (packageManager, script) => `${packageManager} ${script}`;
 exports.BUILD_TYPES = {
     node: {
         jobs: node_1.createNodeJobs,
-        defaults: () => ({
-            buildCommand: "yarn build",
-            startCommand: "yarn start",
+        defaults: (_, pm) => ({
+            buildCommand: runScript(pm, "build"),
+            startCommand: runScript(pm, "start"),
             artifactsPaths: ["dist", ".next"],
             artifactsExcludePaths: [".next/cache/**/*"],
         }),
     },
     "node-static": {
         jobs: node_1.createNodeJobs,
-        defaults: () => ({
-            buildCommand: "yarn build",
+        defaults: (_, pm) => ({
+            buildCommand: runScript(pm, "build"),
             artifactsPaths: ["dist"],
         }),
     },
     storybook: {
         jobs: node_1.createStorybookJobs,
-        defaults: () => ({
-            buildCommand: ["yarn build-storybook --quiet -o ./dist"],
+        defaults: (_, pm) => ({
+            buildCommand: [runScript(pm, "build-storybook --quiet -o ./dist")],
             artifactsPaths: ["dist"],
         }),
     },
@@ -5215,13 +5220,13 @@ exports.BUILD_TYPES = {
 exports.WORKSPACE_BUILD_TYPES = {
     node: {
         jobs: node_1.createNodeJobs,
-        defaults: () => ({
-            buildCommand: "yarn build",
+        defaults: (pm) => ({
+            buildCommand: runScript(pm, "build"),
             lint: {
-                command: "yarn lint",
+                command: runScript(pm, "lint"),
             },
             test: {
-                command: "yarn test",
+                command: runScript(pm, "test"),
             },
         }),
     },
@@ -5242,7 +5247,7 @@ const base_1 = __nccwpck_require__(61619);
 const createBuildJobDefinition_1 = __nccwpck_require__(88685);
 const docker_1 = __nccwpck_require__(83777);
 const cache_1 = __nccwpck_require__(21100);
-const yarn_1 = __nccwpck_require__(59874);
+const packageManagerInstall_1 = __nccwpck_require__(18600);
 const createNodeBuildJobs = async (context) => {
     if (context.type === "workspace") {
         return (0, base_1.createWorkspaceBuildJobs)(context, {
@@ -5259,18 +5264,17 @@ const createNodeBuildJobs = async (context) => {
 exports.createNodeBuildJobs = createNodeBuildJobs;
 const createNodeBuildJobDefinition = async (context) => {
     const buildConfig = context.build.config;
-    const [yarnInstall, nodeCache] = await Promise.all([
-        (0, yarn_1.getYarnInstall)(context),
+    const [packageManagerInstall, nodeCache] = await Promise.all([
+        (0, packageManagerInstall_1.getPackageManagerInstall)(context),
         (0, cache_1.getNodeCache)(context),
     ]);
     return (0, createBuildJobDefinition_1.createBuildJobDefinition)(context, buildConfig, {
-        prescript: yarnInstall,
+        prescript: packageManagerInstall,
         cache: nodeCache,
     });
 };
 exports.createNodeBuildJobDefinition = createNodeBuildJobDefinition;
 const createNodeDockerJobDefinition = async (context) => {
-    var _a;
     // get the default docker built-in type based on the build type
     const dockerDefaultBuiltIn = context.build.buildType === "node-static" ||
         context.build.buildType === "storybook"
@@ -5278,16 +5282,58 @@ const createNodeDockerJobDefinition = async (context) => {
         : "node";
     const [yarnCache, dockerAppCopyAndBuildScript, packageManagerInfo] = await Promise.all([
         (0, cache_1.getYarnCache)(context, "pull"),
-        (0, yarn_1.getDockerAppCopyAndBuildScript)(context),
+        (0, packageManagerInstall_1.getDockerAppCopyAndBuildScript)(context),
         context.packageManagerInfo,
     ]);
+    // the pnpm store (pulled via the cache above) is copied into the
+    // image so the prod install works offline — like the yarn zip cache,
+    // which travels inside the copied `.yarn` config folder
+    const copyPnpmStore = packageManagerInfo.type === "pnpm" &&
+        packageManagerInfo.componentIsInWorkspace;
+    // pnpm copies every workspace manifest into the image — as individual
+    // COPY instructions that many layers exceed docker's depth limit, so
+    // the job tars them up and a single ADD extracts them
+    const isPnpm = packageManagerInfo.type === "pnpm";
+    const WORKSPACE_FILES_TAR = ".catladder-workspace-files.tar";
     return {
-        script: (0, docker_1.getDockerBuildScriptWithBuiltInDockerFile)(context, dockerDefaultBuiltIn),
+        script: [
+            // the COPY source must exist even when the cache was cold
+            ...(copyPnpmStore ? ["mkdir -p .pnpm-store"] : []),
+            ...(isPnpm
+                ? [
+                    `tar -cf ${WORKSPACE_FILES_TAR} ${packageManagerInfo.pathsToCopyInDocker.join(" ")}`,
+                ]
+                : []),
+            ...(0, docker_1.getDockerBuildScriptWithBuiltInDockerFile)(context, dockerDefaultBuiltIn),
+        ],
         cache: [...yarnCache],
         variables: {
             // only required for non static
             DOCKER_COPY_AND_INSTALL_APP: dockerAppCopyAndBuildScript,
-            DOCKER_COPY_WORKSPACE_FILES: (_a = packageManagerInfo === null || packageManagerInfo === void 0 ? void 0 : packageManagerInfo.pathsToCopyInDocker.map((dir) => `COPY --chown=node:node ${dir} /app/${dir}`)) === null || _a === void 0 ? void 0 : _a.join("\n"),
+            DOCKER_COPY_WORKSPACE_FILES: isPnpm
+                ? [
+                    `ADD ${WORKSPACE_FILES_TAR} /app/`,
+                    // ADD does not apply --chown to extracted tars, and parent
+                    // dirs of the entries come out root-owned — fix ownership
+                    // while the stage still runs as root (store not copied yet,
+                    // so this only touches the small manifest tree). Custom
+                    // base images without a node user run as root and don't
+                    // need it, hence the fallback
+                    `RUN chown -R node:node /app || true`,
+                    ...(copyPnpmStore
+                        ? [`COPY --chown=node:node .pnpm-store /app/.pnpm-store`]
+                        : []),
+                ].join("\n")
+                : packageManagerInfo.pathsToCopyInDocker
+                    .map((dir) => `COPY --chown=node:node ${dir} /app/${dir}`)
+                    .join("\n"),
+            // pnpm is not preinstalled in the node base images; installed as
+            // root before the image switches to the node user
+            ...(isPnpm
+                ? {
+                    DOCKER_SETUP_PACKAGE_MANAGER: `RUN npm install -g pnpm@${packageManagerInfo.version}`,
+                }
+                : {}),
         },
     };
 };
@@ -5306,12 +5352,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.getNodeCache = exports.getNodeModulesCache = exports.getYarnCache = void 0;
+const lodash_es_1 = __nccwpck_require__(50866);
 const path_1 = __nccwpck_require__(16928);
 const slugify_1 = __importDefault(__nccwpck_require__(21396));
 /**
- * stable reference between the two node caches: the yarn (zip) cache
- * declares itself redundant when the node_modules cache scored an
- * exact-lockfile hit (github skips the ~0.6GB download on warm runs)
+ * stable reference between the two node caches: the package-manager
+ * (yarn zip / pnpm store) cache declares itself redundant when the
+ * node_modules cache scored an exact-lockfile hit (github skips the
+ * ~0.6GB download on warm runs)
  */
 const NODE_MODULES_CACHE_ID = "node-modules";
 /**
@@ -5338,23 +5386,37 @@ const getCacheBaseDir = async (context) => {
         ? ((_a = context.build.workspaceBuildConfig.dir) !== null && _a !== void 0 ? _a : ".")
         : ".";
 };
+/**
+ * the package manager's download cache: yarn's `.yarn` zip cache, or
+ * pnpm's content-addressable store (which catladder points at a
+ * project-local `.pnpm-store`, see the install script)
+ */
 const getYarnCache = async (context, policy = "pull-push") => {
+    const packageManagerInfo = await context.packageManagerInfo;
+    const isPnpm = packageManagerInfo.type === "pnpm";
     const baseDir = await getCacheBaseDir(context);
+    // pnpm keeps its store in a format-versioned subdir (v10, v11, ...)
+    // and never cleans old ones up — scope the cache slot by major so a
+    // pnpm upgrade starts a fresh slot instead of dragging the dead old
+    // store tree along in every cache transfer (formats change only on
+    // majors)
+    const pnpmStoreKey = `pnpm-v${packageManagerInfo.version.split(".")[0]}`;
     return [
         {
             scope: "buildDir",
             pathMode: "relative",
             buildDir: baseDir,
-            key: "yarn",
+            key: isPnpm ? pnpmStoreKey : "yarn",
             policy,
-            paths: [".yarn"],
+            paths: [isPnpm ? ".pnpm-store" : ".yarn"],
             // content-key for immutable-cache backends (github); the lockfile
             // decides whether the cached content could have changed
-            keyFiles: ["yarn.lock"],
-            // the .yarn zips (~hundreds of MB) are only read when yarn has to
-            // (re)install packages. When the node_modules cache hit for the
-            // same lockfile, install verifies via install-state.gz and never
-            // opens a zip — so github skips downloading this cache entirely
+            keyFiles: [isPnpm ? "pnpm-lock.yaml" : "yarn.lock"],
+            // the package manager's download cache (~hundreds of MB) is only
+            // read when packages have to be (re)installed. When the
+            // node_modules cache hit for the same lockfile, install verifies
+            // its state file and never touches the store — so github skips
+            // downloading this cache entirely
             redundantOnExactHitOf: NODE_MODULES_CACHE_ID,
         },
     ];
@@ -5363,27 +5425,50 @@ exports.getYarnCache = getYarnCache;
 const getNodeModulesCache = async (context, policy = "pull-push") => {
     const packageManagerInfo = await context.packageManagerInfo;
     const baseDir = await getCacheBaseDir(context);
-    const { isClassic } = packageManagerInfo;
-    // We intentionally do not use the contents of yarn.lock as a cache key, as yarn install should always guarantee that the files are updated, but it can still use part of the cache if not all packages are up-to-date.
+    const { workspaces } = packageManagerInfo;
+    const isPnpm = packageManagerInfo.type === "pnpm";
+    const lockFileName = isPnpm ? "pnpm-lock.yaml" : "yarn.lock";
+    // yarn berry tracks install state in .yarn/install-state.gz (pnpm's
+    // equivalent lives inside node_modules and is covered by the paths)
+    const hasInstallState = packageManagerInfo.type === "yarn" && !packageManagerInfo.isClassic;
+    // We intentionally do not use the contents of the lockfile as a cache key, as install should always guarantee that the files are updated, but it can still use part of the cache if not all packages are up-to-date.
     // It would slow down all pipelines whenever one adds a new dependency as it will need to download all node_modules again.
     return [
         {
             scope: "global",
             pathMode: "absolute",
             // we use the dirname, not the component name, because in certain cases we have two apps in the same directory and want to share the cache, e.g. when having storybook in the same package.json
-            key: (0, slugify_1.default)(baseDir) + "-node-modules",
+            //
+            // pnpm gets its own, lockfile-keyed cache: node_modules layouts
+            // are not compatible between package managers (a migrating
+            // project must not inherit the yarn slot), and unlike yarn, a
+            // pnpm install on top of a node_modules from a different lockfile
+            // leaves orphaned .pnpm dirs behind that break type identity —
+            // so the slot changes whenever the lockfile changes
+            key: isPnpm
+                ? {
+                    prefix: "pnpm-" + (0, slugify_1.default)(baseDir) + "-node-modules",
+                    files: [(0, path_1.join)(baseDir, "pnpm-lock.yaml")],
+                }
+                : (0, slugify_1.default)(baseDir) + "-node-modules",
             // content-key for immutable-cache backends (github); the lockfile
             // decides whether the cached content could have changed (absolute
             // pathMode: resolve the lockfile explicitly)
-            keyFiles: [(0, path_1.join)(baseDir, "yarn.lock")],
-            // referenced by the yarn cache: an exact hit here makes the yarn
-            // zips unnecessary (see redundantOnExactHitOf on getYarnCache)
+            keyFiles: [(0, path_1.join)(baseDir, lockFileName)],
+            // referenced by the package-manager cache: an exact hit here makes
+            // it unnecessary (see redundantOnExactHitOf on getYarnCache)
             cacheId: NODE_MODULES_CACHE_ID,
             policy,
-            paths: [
+            paths: (0, lodash_es_1.uniq)([
                 (0, path_1.join)(baseDir, "node_modules"),
-                ...(!isClassic ? [(0, path_1.join)(baseDir, ".yarn/install-state.gz")] : []),
-            ],
+                // pnpm's per-package node_modules are symlink farms worth
+                // keeping warm (yarn hoists into the root, so root-only
+                // matches its historical behavior)
+                ...(isPnpm
+                    ? workspaces.map((w) => (0, path_1.join)(w.location, "node_modules"))
+                    : []),
+                ...(hasInstallState ? [(0, path_1.join)(baseDir, ".yarn/install-state.gz")] : []),
+            ]),
         },
     ];
 };
@@ -5462,7 +5547,7 @@ const base_1 = __nccwpck_require__(61619);
 const docker_1 = __nccwpck_require__(83777);
 const types_1 = __nccwpck_require__(40632);
 const cache_1 = __nccwpck_require__(21100);
-const yarn_1 = __nccwpck_require__(59874);
+const packageManagerInstall_1 = __nccwpck_require__(18600);
 const getMeteorCache = (context) => [
     {
         key: "meteor-build-cache",
@@ -5477,6 +5562,11 @@ const getMeteorCache = (context) => [
 ];
 const getMeteorDockerInstallScripts = async (context) => {
     const packageManagerInfo = await context.packageManagerInfo;
+    if (packageManagerInfo.type === "pnpm") {
+        // not a meteor limitation — catladder's meteor docker install path
+        // is only implemented for yarn so far
+        throw new Error("the meteor build type is only implemented for yarn in catladder");
+    }
     if (packageManagerInfo.isClassic) {
         return new bash_1.BashExpression(`
 COPY $APP_DIR/package.json $APP_DIR/yarn.lock ./
@@ -5503,8 +5593,8 @@ const createMeteorBuildJobs = async (context) => {
     if (!(0, types_1.isOfBuildType)(buildConfig, "meteor")) {
         throw new Error("deploy config is not meteor");
     }
-    const [yarnInstall, nodeCache, meteorInstallScripts] = await Promise.all([
-        (0, yarn_1.getYarnInstall)(context),
+    const [packageManagerInstall, nodeCache, meteorInstallScripts] = await Promise.all([
+        (0, packageManagerInstall_1.getPackageManagerInstall)(context),
         (0, cache_1.getNodeCache)(context),
         buildConfig.installScripts
             ? getMeteorDockerInstallScripts(context)
@@ -5519,7 +5609,7 @@ const createMeteorBuildJobs = async (context) => {
                     METEOR_DISABLE_OPTIMISTIC_CACHING: "1", // see https://forums.meteor.com/t/veeery-long-building-time-inside-docker-container/58673/17?u=macrozone
                 },
                 script: [
-                    ...yarnInstall,
+                    ...packageManagerInstall,
                     'TOOL_NODE_FLAGS="--max_old_space_size=3584 --min_semi_space_size=8 --max_semi_space_size=256 --optimize_for_size" meteor build ./dist --architecture os.linux.x86_64 --allow-superuser --server-only --directory',
                     "cp ./__build_info.json ./dist/bundle/programs/server",
                 ],
@@ -5538,6 +5628,158 @@ exports.createMeteorBuildJobs = createMeteorBuildJobs;
 
 /***/ }),
 
+/***/ 18600:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.getDockerAppCopyAndBuildScript = exports.getPackageManagerInstall = exports.ensureNodeVersion = exports.getDefaultAuditCommand = void 0;
+const bash_1 = __nccwpck_require__(92390);
+const utils_1 = __nccwpck_require__(24516);
+const gitlab_1 = __nccwpck_require__(37393);
+const YARN_INSTALL_CLASSIC = `yarn install --frozen-lockfile`;
+const YARN_BERRY_PROD_INSTALL = `yarn workspaces focus --production`;
+// FIXME: check why and when rebuild is needed
+const YARN_BERRY_PROD_REBUILD = `yarn rebuild`;
+const getYarnInstallCommand = (packageManagerInfo) => {
+    if (packageManagerInfo.isClassic) {
+        return YARN_INSTALL_CLASSIC;
+    }
+    // inline builds make debugging easier as it prints it out in the logs, instead of writing it in temp files
+    return `yarn install --immutable --inline-builds`;
+};
+const isInWorkspace = (context, packageManagerInfo) => context.type === "workspace" ||
+    ("componentIsInWorkspace" in packageManagerInfo &&
+        packageManagerInfo.componentIsInWorkspace);
+/**
+ * make sure pnpm is available (job images ship it, older/custom images
+ * fall back to corepack or a pinned global install)
+ */
+const getEnsurePnpmCommand = (version) => `if ! command -v pnpm &> /dev/null; then corepack enable pnpm 2>/dev/null || npm install -g pnpm@${version}; fi`;
+/**
+ * pnpm's store is global by default; point it at a project-local
+ * directory so CI can cache it (the pnpm equivalent of the `.yarn`
+ * zip cache). Passed as the --store-dir flag: pnpm 11 stopped reading
+ * the npm_config_store_dir env var (settings only come from
+ * pnpm-workspace.yaml / global config / CLI flags), the flag works on
+ * v10 and v11
+ */
+const getPnpmStoreDirExpression = (inWorkspace) => inWorkspace
+    ? `"$(git rev-parse --show-toplevel 2>/dev/null || pwd)/.pnpm-store"`
+    : `"$PWD/.pnpm-store"`;
+const getPnpmInstallCommands = (context, packageManagerInfo) => [
+    getEnsurePnpmCommand(packageManagerInfo.version),
+    `pnpm install --frozen-lockfile --store-dir ${getPnpmStoreDirExpression(isInWorkspace(context, packageManagerInfo))}`,
+];
+/**
+ * default `audit` job command per package manager. Exhaustive on the
+ * package-manager type and throws for anything unsupported, so adding a
+ * new package manager surfaces every place that needs a command here.
+ */
+const getDefaultAuditCommand = (packageManagerInfo) => {
+    switch (packageManagerInfo.type) {
+        case "pnpm":
+            return "pnpm audit --prod --audit-level critical";
+        case "yarn":
+            return packageManagerInfo.isClassic
+                ? "yarn audit --level critical"
+                : "yarn npm audit --environment production --severity critical"; // yarn 2+
+        default:
+            throw new Error(`no audit command implemented for package manager "${packageManagerInfo.type}"`);
+    }
+};
+exports.getDefaultAuditCommand = getDefaultAuditCommand;
+const ensureNodeVersion = (context) => (0, gitlab_1.collapseableSection)("nodeinstall", "Ensure node version")([
+    // github actions overrides HOME in container jobs, so also look
+    // for nvm where the catladder images install it (/root/.nvm)
+    'if [ -f "$HOME/.nvm/nvm.sh" ]; then source "$HOME/.nvm/nvm.sh"; elif [ -f /root/.nvm/nvm.sh ]; then export NVM_DIR=/root/.nvm; source /root/.nvm/nvm.sh; fi',
+    "if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi",
+]);
+exports.ensureNodeVersion = ensureNodeVersion;
+const getPackageManagerInstall = async (context, options) => {
+    const packageManagerInfo = await context.packageManagerInfo;
+    const postInstall = context.type !== "workspace" &&
+        context.build.type !== "disabled" &&
+        "postInstall" in context.build.config
+        ? context.build.config.postInstall
+        : null;
+    const installSection = packageManagerInfo.type === "pnpm"
+        ? (0, gitlab_1.collapseableSection)("pnpminstall", "pnpm install")(getPnpmInstallCommands(context, packageManagerInfo))
+        : (0, gitlab_1.collapseableSection)("yarninstall", "Yarn install")([getYarnInstallCommand(packageManagerInfo)]);
+    return [
+        ...(0, exports.ensureNodeVersion)(context),
+        ...installSection,
+        ...(postInstall && !(options === null || options === void 0 ? void 0 : options.noCustomPostInstall)
+            ? (0, gitlab_1.collapseableSection)("postinstall", "Custom post install")((0, utils_1.ensureArray)(postInstall))
+            : []),
+    ];
+};
+exports.getPackageManagerInstall = getPackageManagerInstall;
+const DOCKER_COPY_FILES = `COPY --chown=node:node $APP_DIR .`;
+const getPnpmDockerAppCopyAndBuildScript = (packageManagerInfo) => {
+    // the store was copied into the image (like the yarn zip cache), so
+    // the prod install links from it instead of hitting the registry
+    const storeDir = packageManagerInfo.componentIsInWorkspace
+        ? "/app/.pnpm-store"
+        : "/app/$APP_DIR/.pnpm-store";
+    // in a workspace, only install the component (and its workspace
+    // dependencies) — the pnpm equivalent of `yarn workspaces focus`.
+    // npm package names are shell-safe unquoted (the whole script is
+    // embedded in a double-quoted bash export, so inner quotes would nest)
+    const filter = packageManagerInfo.componentIsInWorkspace &&
+        packageManagerInfo.currentWorkspace
+        ? ` --filter ${packageManagerInfo.currentWorkspace.name}...`
+        : "";
+    return new bash_1.BashExpression(`
+${DOCKER_COPY_FILES}
+RUN command -v pnpm >/dev/null 2>&1 || npm install -g pnpm@${packageManagerInfo.version}
+RUN pnpm install --prod --frozen-lockfile --store-dir ${storeDir}${filter}
+    `.trim());
+};
+const getDockerAppCopyAndBuildScript = async (context) => {
+    var _a, _b, _c;
+    const packageManagerInfo = await context.packageManagerInfo;
+    if (packageManagerInfo.type === "pnpm") {
+        return getPnpmDockerAppCopyAndBuildScript(packageManagerInfo);
+    }
+    if (packageManagerInfo.isClassic) {
+        return new bash_1.BashExpression(`
+RUN ${YARN_INSTALL_CLASSIC} --production --ignore-scripts
+${DOCKER_COPY_FILES}
+RUN ${YARN_INSTALL_CLASSIC} --production
+    `.trim());
+    }
+    const yarnRebuildEnabledDefault = context.build.type === "fromWorkspace"
+        ? ((_b = (_a = context.build.workspaceBuildConfig.dockerDefaults) === null || _a === void 0 ? void 0 : _a.yarnRebuildEnabled) !== null && _b !== void 0 ? _b : true)
+        : true;
+    const yarnRebuildEnabled = "docker" in context.build.config &&
+        context.build.config.docker &&
+        "yarnRebuildEnabled" in context.build.config.docker
+        ? ((_c = context.build.config.docker.yarnRebuildEnabled) !== null && _c !== void 0 ? _c : yarnRebuildEnabledDefault)
+        : yarnRebuildEnabledDefault;
+    // yarn >= 4 ships with build in plugins, see https://github.com/yarnpkg/berry/pull/4253
+    // trying to import those fail on this version
+    const doesNotShipWithBuiltInPlugins = ["2", "3"].some((v) => packageManagerInfo.version.startsWith(v));
+    const maybeAddWorkspaceToolsCommand = doesNotShipWithBuiltInPlugins
+        ? "RUN yarn plugin import workspace-tools"
+        : "";
+    // copy first everything and then install
+    // rebuild first does not work as it will run postinstall and that might require files in the app
+    return new bash_1.BashExpression(`
+    ENV YARN_ENABLE_INLINE_BUILDS=1
+${DOCKER_COPY_FILES}
+${maybeAddWorkspaceToolsCommand}
+RUN ${YARN_BERRY_PROD_INSTALL}
+${yarnRebuildEnabled ? `RUN ${YARN_BERRY_PROD_REBUILD}` : ""}
+
+    `.trim());
+};
+exports.getDockerAppCopyAndBuildScript = getDockerAppCopyAndBuildScript;
+//# sourceMappingURL=packageManagerInstall.js.map
+
+/***/ }),
+
 /***/ 79769:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -5552,7 +5794,7 @@ const utils_1 = __nccwpck_require__(24516);
 const createArtifactsConfig_1 = __nccwpck_require__(24494);
 const cache_1 = __nccwpck_require__(21100);
 const constants_1 = __nccwpck_require__(97627);
-const yarn_1 = __nccwpck_require__(59874);
+const packageManagerInstall_1 = __nccwpck_require__(18600);
 const createNodeTestJobs = async (context) => {
     var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2, _3;
     // don't run tests after release
@@ -5579,8 +5821,8 @@ const createNodeTestJobs = async (context) => {
         needs: [],
     };
     const buildConfig = context.build.config;
-    const [yarnInstall, packageManagerInfo, nodeCache] = await Promise.all([
-        (0, yarn_1.getYarnInstall)(context),
+    const [packageManagerInstall, packageManagerInfo, nodeCache] = await Promise.all([
+        (0, packageManagerInstall_1.getPackageManagerInstall)(context),
         context.packageManagerInfo,
         // pull-only: the build job is the designated cache writer — lint and
         // test produce equivalent content from the same lockfile, so their
@@ -5596,13 +5838,11 @@ const createNodeTestJobs = async (context) => {
                 ...((_b = (_a = buildConfig.audit) === null || _a === void 0 ? void 0 : _a.runnerVariables) !== null && _b !== void 0 ? _b : {}),
             },
             image: (_d = (_c = buildConfig.audit) === null || _c === void 0 ? void 0 : _c.jobImage) !== null && _d !== void 0 ? _d : defaultImage,
-            caches: undefined, // audit does not need yarn install and no cache
+            caches: undefined, // audit does not need an install and no cache
             script: [
                 `cd ${context.build.dir}`,
                 ...((_f = (0, utils_1.ensureArrayOrNull)((_e = buildConfig.audit) === null || _e === void 0 ? void 0 : _e.command)) !== null && _f !== void 0 ? _f : [
-                    packageManagerInfo.isClassic
-                        ? "yarn audit --level critical"
-                        : "yarn npm audit --environment production --severity critical", // yarn 2
+                    (0, packageManagerInstall_1.getDefaultAuditCommand)(packageManagerInfo),
                 ]),
             ],
             allow_failure: (_h = (_g = buildConfig.audit) === null || _g === void 0 ? void 0 : _g.allowFailure) !== null && _h !== void 0 ? _h : true,
@@ -5620,9 +5860,9 @@ const createNodeTestJobs = async (context) => {
             image: (_p = (_o = buildConfig.lint) === null || _o === void 0 ? void 0 : _o.jobImage) !== null && _p !== void 0 ? _p : defaultImage,
             caches: nodeCache,
             script: [
-                ...(0, yarn_1.ensureNodeVersion)(context),
+                ...(0, packageManagerInstall_1.ensureNodeVersion)(context),
                 `cd ${context.build.dir}`,
-                ...yarnInstall,
+                ...packageManagerInstall,
                 ...((_r = (0, utils_1.ensureArrayOrNull)((_q = buildConfig.lint) === null || _q === void 0 ? void 0 : _q.command)) !== null && _r !== void 0 ? _r : ["yarn lint"]),
             ],
             allow_failure: (_s = buildConfig.lint) === null || _s === void 0 ? void 0 : _s.allowFailure,
@@ -5640,9 +5880,9 @@ const createNodeTestJobs = async (context) => {
             image: (_y = (_x = buildConfig.test) === null || _x === void 0 ? void 0 : _x.jobImage) !== null && _y !== void 0 ? _y : (0, runner_1.getRunnerImage)("jobs-testing-chrome"),
             caches: nodeCache,
             script: [
-                ...(0, yarn_1.ensureNodeVersion)(context),
+                ...(0, packageManagerInstall_1.ensureNodeVersion)(context),
                 `cd ${context.build.dir}`,
-                ...yarnInstall,
+                ...packageManagerInstall,
                 ...((_0 = (0, utils_1.ensureArrayOrNull)((_z = buildConfig.test) === null || _z === void 0 ? void 0 : _z.command)) !== null && _0 !== void 0 ? _0 : ["yarn test"]),
             ],
             allow_failure: (_1 = buildConfig.test) === null || _1 === void 0 ? void 0 : _1.allowFailure,
@@ -5656,91 +5896,6 @@ exports.createNodeTestJobs = createNodeTestJobs;
 
 /***/ }),
 
-/***/ 59874:
-/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
-
-"use strict";
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getDockerAppCopyAndBuildScript = exports.getYarnInstall = exports.ensureNodeVersion = void 0;
-const bash_1 = __nccwpck_require__(92390);
-const utils_1 = __nccwpck_require__(24516);
-const gitlab_1 = __nccwpck_require__(37393);
-const YARN_INSTALL_CLASSIC = `yarn install --frozen-lockfile`;
-const YARN_BERRY_PROD_INSTALL = `yarn workspaces focus --production`;
-// FIXME: check why and when rebuild is needed
-const YARN_BERRY_PROD_REBUILD = `yarn rebuild`;
-const getYarnInstallCommand = async (context) => {
-    const packageManagerInfo = await context.packageManagerInfo;
-    if (packageManagerInfo.isClassic) {
-        return YARN_INSTALL_CLASSIC;
-    }
-    // inline builds make debugging easier as it prints it out in the logs, instead of writing it in temp files
-    return `yarn install --immutable --inline-builds`;
-};
-const ensureNodeVersion = (context) => (0, gitlab_1.collapseableSection)("nodeinstall", "Ensure node version")([
-    // github actions overrides HOME in container jobs, so also look
-    // for nvm where the catladder images install it (/root/.nvm)
-    'if [ -f "$HOME/.nvm/nvm.sh" ]; then source "$HOME/.nvm/nvm.sh"; elif [ -f /root/.nvm/nvm.sh ]; then export NVM_DIR=/root/.nvm; source /root/.nvm/nvm.sh; fi',
-    "if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi",
-]);
-exports.ensureNodeVersion = ensureNodeVersion;
-const getYarnInstall = async (context, options) => {
-    const postInstall = context.type !== "workspace" &&
-        context.build.type !== "disabled" &&
-        "postInstall" in context.build.config
-        ? context.build.config.postInstall
-        : null;
-    return [
-        ...(0, exports.ensureNodeVersion)(context),
-        ...(0, gitlab_1.collapseableSection)("yarninstall", "Yarn install")([await getYarnInstallCommand(context)]),
-        ...(postInstall && !(options === null || options === void 0 ? void 0 : options.noCustomPostInstall)
-            ? (0, gitlab_1.collapseableSection)("postinstall", "Custom post install")((0, utils_1.ensureArray)(postInstall))
-            : []),
-    ];
-};
-exports.getYarnInstall = getYarnInstall;
-const DOCKER_COPY_FILES = `COPY --chown=node:node $APP_DIR .`;
-const getDockerAppCopyAndBuildScript = async (context) => {
-    var _a, _b, _c;
-    const packageManagerInfo = await context.packageManagerInfo;
-    if (packageManagerInfo.isClassic) {
-        return new bash_1.BashExpression(`
-RUN ${YARN_INSTALL_CLASSIC} --production --ignore-scripts
-${DOCKER_COPY_FILES}
-RUN ${YARN_INSTALL_CLASSIC} --production
-    `.trim());
-    }
-    const yarnRebuildEnabledDefault = context.build.type === "fromWorkspace"
-        ? ((_b = (_a = context.build.workspaceBuildConfig.dockerDefaults) === null || _a === void 0 ? void 0 : _a.yarnRebuildEnabled) !== null && _b !== void 0 ? _b : true)
-        : true;
-    const yarnRebuildEnabled = "docker" in context.build.config &&
-        context.build.config.docker &&
-        "yarnRebuildEnabled" in context.build.config.docker
-        ? ((_c = context.build.config.docker.yarnRebuildEnabled) !== null && _c !== void 0 ? _c : yarnRebuildEnabledDefault)
-        : yarnRebuildEnabledDefault;
-    // yarn >= 4 ships with build in plugins, see https://github.com/yarnpkg/berry/pull/4253
-    // trying to import those fail on this version
-    const doesNotShipWithBuiltInPlugins = ["2", "3"].some((v) => packageManagerInfo.version.startsWith(v));
-    const maybeAddWorkspaceToolsCommand = doesNotShipWithBuiltInPlugins
-        ? "RUN yarn plugin import workspace-tools"
-        : "";
-    // copy first everything and then install
-    // rebuild first does not work as it will run postinstall and that might require files in the app
-    return new bash_1.BashExpression(`
-    ENV YARN_ENABLE_INLINE_BUILDS=1
-${DOCKER_COPY_FILES}
-${maybeAddWorkspaceToolsCommand}
-RUN ${YARN_BERRY_PROD_INSTALL}
-${yarnRebuildEnabled ? `RUN ${YARN_BERRY_PROD_REBUILD}` : ""}
-
-    `.trim());
-};
-exports.getDockerAppCopyAndBuildScript = getDockerAppCopyAndBuildScript;
-//# sourceMappingURL=yarn.js.map
-
-/***/ }),
-
 /***/ 50663:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -6206,6 +6361,7 @@ const createComponentContext = async (ctx) => {
         throw new Error("componentName may only contain lower case letters, numbers and -");
     }
     const packageManagerInfoPromise = (0, packageManager_1.getPackageManagerInfoForComponent)(ctx.config, ctx.componentName);
+    const { type: packageManagerType } = await packageManagerInfoPromise;
     const envContext = (0, getEnvironmentContext_1.getEnvironmentContext)(ctx);
     const componentConfigWithoutDefaults = envContext.envConfigRaw;
     const resolvedBuildType = componentConfigWithoutDefaults.build === false
@@ -6219,12 +6375,12 @@ const createComponentContext = async (ctx) => {
     const defaults = componentConfigWithoutDefaults.deploy
         ? {
             build: resolvedBuildType &&
-                build_1.BUILD_TYPES[resolvedBuildType].defaults(envContext),
+                build_1.BUILD_TYPES[resolvedBuildType].defaults(envContext, packageManagerType),
             deploy: deploy_1.DEPLOY_TYPES[componentConfigWithoutDefaults.deploy.type].defaults(envContext),
         }
         : {
             build: resolvedBuildType &&
-                build_1.BUILD_TYPES[resolvedBuildType].defaults(envContext),
+                build_1.BUILD_TYPES[resolvedBuildType].defaults(envContext, packageManagerType),
             deploy: {},
         };
     const componentConfig = (0, utils_1.mergeWithMergingArrays)(defaults, componentConfigWithoutDefaults);
@@ -6321,7 +6477,8 @@ async function createWorkspaceContext({ env, components, workspaceName, config,
     if (!workspaceConfigRaw) {
         throw new Error(`Workspace ${workspaceName} not found in config`);
     }
-    const defaults = __1.WORKSPACE_BUILD_TYPES[workspaceConfigRaw.type].defaults();
+    const packageManagerInfo = (0, packageManager_1.getPackageManagerInfoBase)(config);
+    const defaults = __1.WORKSPACE_BUILD_TYPES[workspaceConfigRaw.type].defaults((await packageManagerInfo).type);
     const workspaceConfig = (0, utils_1.mergeWithMergingArrays)(defaults, workspaceConfigRaw);
     return {
         name: workspaceName,
@@ -6332,7 +6489,7 @@ async function createWorkspaceContext({ env, components, workspaceName, config,
         env,
         components,
         fullConfig: config,
-        packageManagerInfo: (0, packageManager_1.getPackageManagerInfoBase)(),
+        packageManagerInfo,
         build: {
             type: "workspace",
             dir: (_b = workspaceConfig.dir) !== null && _b !== void 0 ? _b : ".",
@@ -6824,7 +6981,7 @@ exports.makeSecretEnvVarMapping = makeSecretEnvVarMapping;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.computeCustomImageHash = void 0;
+exports.computeInlineImageHash = exports.computeCustomImageHash = void 0;
 const crypto_1 = __nccwpck_require__(76982);
 const fs_1 = __nccwpck_require__(79896);
 const path_1 = __nccwpck_require__(16928);
@@ -6845,6 +7002,29 @@ function listFilesRecursive(dir) {
     })
         .sort();
 }
+/**
+ * the parts every image definition hashes on top of its content:
+ * files outside the definition, and the build args
+ */
+function hashExtras(hash, config) {
+    const watchedPaths = [];
+    // Hash extra paths (for files outside the dir)
+    if (config.hashExtraPaths) {
+        // Extra paths are literal file paths (not globs) for simplicity
+        const extraFiles = [...config.hashExtraPaths].sort();
+        for (const file of extraFiles) {
+            hash.update(file);
+            hash.update((0, fs_1.readFileSync)(file));
+        }
+        watchedPaths.push(...config.hashExtraPaths);
+    }
+    // Hash build args (sorted keys for determinism)
+    if (config.buildArgs) {
+        const sorted = Object.entries(config.buildArgs).sort(([a], [b]) => a.localeCompare(b));
+        hash.update(JSON.stringify(sorted));
+    }
+    return watchedPaths;
+}
 function computeCustomImageHash(config) {
     var _a;
     const hash = (0, crypto_1.createHash)("sha256");
@@ -6865,27 +7045,29 @@ function computeCustomImageHash(config) {
         }
         watchedPaths.push(`${extraDir}/**/*`);
     }
-    // Hash extra paths (for files outside the dir)
-    if (config.hashExtraPaths) {
-        // Extra paths are literal file paths (not globs) for simplicity
-        const extraFiles = [...config.hashExtraPaths].sort();
-        for (const file of extraFiles) {
-            hash.update(file);
-            hash.update((0, fs_1.readFileSync)(file));
-        }
-        watchedPaths.push(...config.hashExtraPaths);
-    }
-    // Hash build args (sorted keys for determinism)
-    if (config.buildArgs) {
-        const sorted = Object.entries(config.buildArgs).sort(([a], [b]) => a.localeCompare(b));
-        hash.update(JSON.stringify(sorted));
-    }
+    watchedPaths.push(...hashExtras(hash, config));
     return {
         hash: hash.digest("hex").slice(0, 12),
         watchedPaths,
     };
 }
 exports.computeCustomImageHash = computeCustomImageHash;
+/**
+ * the hash of an image defined by an inline Dockerfile: its content
+ * stands in for the definition dir. The build context is deliberately
+ * NOT hashed (it may be the whole repository) — `hashExtraPaths` is how
+ * context files opt into the hash.
+ */
+function computeInlineImageHash(config) {
+    const hash = (0, crypto_1.createHash)("sha256");
+    hash.update(config.dockerfileContent);
+    const watchedPaths = hashExtras(hash, config);
+    return {
+        hash: hash.digest("hex").slice(0, 12),
+        watchedPaths,
+    };
+}
+exports.computeInlineImageHash = computeInlineImageHash;
 //# sourceMappingURL=hash.js.map
 
 /***/ }),
@@ -6896,7 +7078,7 @@ exports.computeCustomImageHash = computeCustomImageHash;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.JobImagesPlan = exports.GENERATED_IMAGES_FOLDER = void 0;
+exports.JobImagesPlan = exports.PROJECT_IMAGES_FOLDER = exports.GENERATED_IMAGES_FOLDER = void 0;
 const fs_1 = __nccwpck_require__(79896);
 const path_1 = __nccwpck_require__(16928);
 const ciVariables_1 = __nccwpck_require__(72700);
@@ -6904,6 +7086,7 @@ const docker_1 = __nccwpck_require__(83777);
 const runner_1 = __nccwpck_require__(71065);
 const gitlab_1 = __nccwpck_require__(37393);
 const hash_1 = __nccwpck_require__(34092);
+const projectImages_1 = __nccwpck_require__(55537);
 const shippedImages_1 = __nccwpck_require__(28687);
 exports.GENERATED_IMAGES_FOLDER = ".catladder-generated/images";
 /**
@@ -6911,7 +7094,44 @@ exports.GENERATED_IMAGES_FOLDER = ".catladder-generated/images";
  * catladder image, so building images never depends on one (bootstrap)
  */
 const BUILDER_IMAGE = "docker.io/docker:29.5.1";
-const ensureJobName = (name) => `🐳 job image ${name}`;
+/**
+ * every planned image is consumed the same way: its url, plus an
+ * optional dependency on its build job
+ */
+const toResolvedJobImage = ({ imageRef, jobName, }) => ({
+    image: imageRef,
+    fromRepoRegistry: true,
+    need: {
+        job: jobName,
+        artifacts: false,
+        optional: true,
+        global: true,
+    },
+});
+/**
+ * materializes an image definition directory into the generated files
+ * (used for the definitions catladder ships)
+ */
+const materializeDir = (sourceDir, targetDir) => listFilesRecursive(sourceDir).map((file) => ({
+    path: (0, path_1.join)(targetDir, file),
+    content: (0, fs_1.readFileSync)((0, path_1.join)(sourceDir, file), "utf-8"),
+}));
+// built-in (catladder-shipped) images carry the catladder marker in
+// their job name; project-declared images get the short plain name
+const ensureJobName = (name) => `🐳 catladder image ${name}`;
+const projectEnsureJobName = (name) => `🐳 image ${name}`;
+/**
+ * the config file whose content feeds the project image hashes
+ * (`buildArgs`, `hashExtraPaths`): the gitlab change detection has to
+ * watch it, because a config-only change alters the image tag without
+ * touching the image dir
+ */
+const CONFIG_FILE = "catladder.ts";
+/**
+ * where inline project Dockerfiles are materialized — a subfolder, so a
+ * project image can carry the same name as a shipped one
+ */
+exports.PROJECT_IMAGES_FOLDER = `${exports.GENERATED_IMAGES_FOLDER}/project`;
 /**
  * plans the catladder job images of one backend run: resolves image
  * references, collects the image build jobs, and the image definitions
@@ -6922,33 +7142,30 @@ const ensureJobName = (name) => `🐳 job image ${name}`;
  * Reference-driven: only images actually used by a job are built.
  */
 class JobImagesPlan {
-    constructor(pipelineType) {
+    constructor(pipelineType, projectImages = {}) {
         this.pipelineType = pipelineType;
+        this.projectImages = projectImages;
         this.used = new Map();
+        this.usedProject = new Map();
     }
     /**
      * resolves a job image (marker or concrete) to a concrete image url
      * plus the build job dependency
      */
     resolve(image) {
-        if (!(0, runner_1.isCatladderImageRef)(image)) {
-            return { image };
+        if ((0, runner_1.isCatladderImageRef)(image)) {
+            return this.resolveRef(image);
+        }
+        if ((0, projectImages_1.isProjectImageRef)(image)) {
+            return this.resolveProjectRef(image);
         }
-        return this.resolveRef(image);
+        return { image };
     }
     resolveRef(ref) {
-        const name = ref.catladderImage;
-        const { hash } = this.use(name);
-        return {
-            image: `${this.registryImageRef()}/catladder/${name}:${hash}`,
-            fromRepoRegistry: true,
-            need: {
-                job: ensureJobName(name),
-                artifacts: false,
-                optional: true,
-                global: true,
-            },
-        };
+        return toResolvedJobImage(this.use(ref.catladderImage));
+    }
+    resolveProjectRef(ref) {
+        return toResolvedJobImage(this.useProject(ref.image));
     }
     /**
      * the registry image prefix. On github, container images can't use
@@ -6959,6 +7176,85 @@ class JobImagesPlan {
             ? "ghcr.io/${{ github.repository }}"
             : `${(0, ciVariables_1.getCiVariable)({ pipelineType: this.pipelineType }, "registryImage")}`;
     }
+    useProject(name) {
+        const existing = this.usedProject.get(name);
+        if (existing) {
+            return existing;
+        }
+        const imageConfig = this.projectImages[name];
+        if (!imageConfig) {
+            const declared = Object.keys(this.projectImages);
+            throw new Error(`unknown job image "${name}" — ${declared.length > 0
+                ? `images declared in config.images: ${declared.join(", ")}`
+                : "no images are declared in config.images"}`);
+        }
+        const source = this.planProjectSource(name, imageConfig);
+        const planned = {
+            ...source,
+            jobName: projectEnsureJobName(name),
+            buildArgs: imageConfig.buildArgs,
+            // `job-images/` keeps the project's job images apart from its
+            // deployable component images (registry root) and build caches
+            imageRef: `${this.registryImageRef()}/job-images/${name}:${source.hash}`,
+        };
+        this.usedProject.set(name, planned);
+        return planned;
+    }
+    /**
+     * the source-dependent half of a project image: an inline Dockerfile
+     * is materialized into the generated files and hashed by its content,
+     * a directory is hashed and watched in place
+     */
+    planProjectSource(name, imageConfig) {
+        var _a, _b;
+        if (imageConfig.dockerfile !== undefined) {
+            const content = toDockerfileContent(imageConfig.dockerfile);
+            const dockerfilePath = `${exports.PROJECT_IMAGES_FOLDER}/${name}/Dockerfile`;
+            const { hash, watchedPaths } = (0, hash_1.computeInlineImageHash)({
+                dockerfileContent: content,
+                hashExtraPaths: imageConfig.hashExtraPaths,
+                buildArgs: imageConfig.buildArgs,
+            });
+            return {
+                hash,
+                dockerfilePath,
+                // an inline definition carries no directory of its own — the
+                // repository root is the sensible default context
+                contextDir: (_a = imageConfig.context) !== null && _a !== void 0 ? _a : ".",
+                watchedPaths: [
+                    `${exports.PROJECT_IMAGES_FOLDER}/${name}/**/*`,
+                    ...watchedPaths,
+                    CONFIG_FILE,
+                ],
+                files: [{ path: dockerfilePath, content }],
+            };
+        }
+        const dir = imageConfig.dir;
+        // fail at generation time with the offending image named: an
+        // unreadable dir would otherwise surface as a bare fs ENOENT, and a
+        // missing Dockerfile only as a docker build failure in CI
+        if (!(0, fs_1.existsSync)(dir)) {
+            throw new Error(`job image "${name}": the directory "${dir}" does not exist (config.images.${name}.dir, relative to the repository root)`);
+        }
+        if (!(0, fs_1.existsSync)((0, path_1.join)(dir, "Dockerfile"))) {
+            throw new Error(`job image "${name}": no Dockerfile in "${dir}" (config.images.${name}.dir)`);
+        }
+        const { hash, watchedPaths } = (0, hash_1.computeCustomImageHash)({
+            dir,
+            hashExtraPaths: imageConfig.hashExtraPaths,
+            buildArgs: imageConfig.buildArgs,
+        });
+        return {
+            hash,
+            dockerfilePath: `${dir}/Dockerfile`,
+            contextDir: (_b = imageConfig.context) !== null && _b !== void 0 ? _b : dir,
+            // the dir is committed in the project — watched in place, nothing
+            // is materialized. The config file is watched too: buildArgs /
+            // hashExtraPaths changes alter the tag without touching the dir
+            watchedPaths: [...watchedPaths, CONFIG_FILE],
+            files: [],
+        };
+    }
     use(name) {
         var _a;
         const existing = this.used.get(name);
@@ -6973,27 +7269,43 @@ class JobImagesPlan {
             dir: (0, shippedImages_1.getShippedImageDir)(name),
             extraDirs: dependencies.map((dependency) => (0, shippedImages_1.getShippedImageDir)(dependency)),
         });
-        const entry = { hash };
-        this.used.set(name, entry);
-        return entry;
+        const targetDir = `${exports.GENERATED_IMAGES_FOLDER}/${name}`;
+        const planned = {
+            hash,
+            jobName: ensureJobName(name),
+            imageRef: `${this.registryImageRef()}/catladder/${name}:${hash}`,
+            dockerfilePath: `${targetDir}/Dockerfile`,
+            // the jobs family INCLUDEs sibling images, so it builds from the
+            // images root; the others from their own dir
+            contextDir: shippedImages_1.RUNNER_IMAGE_BUILD_CONTEXT[name] === "root"
+                ? exports.GENERATED_IMAGES_FOLDER
+                : targetDir,
+            watchedPaths: [name, ...dependencies].map((dir) => `${exports.GENERATED_IMAGES_FOLDER}/${dir}/**/*`),
+            // pipelines build from committed, reviewable files (and gitlab's
+            // rules:changes can watch them)
+            files: materializeDir((0, shippedImages_1.getShippedImageDir)(name), targetDir),
+        };
+        this.used.set(name, planned);
+        return planned;
     }
     /**
      * the image build jobs for all used images
      */
     getEnsureJobs() {
-        return [...this.used.entries()].map(([name, { hash }]) => this.createEnsureJob(name, hash));
+        return [...this.used.values(), ...this.usedProject.values()].map((planned) => this.createImageBuildJob(planned));
     }
-    createEnsureJob(name, hash) {
-        var _a;
+    createImageBuildJob({ jobName, imageRef, watchedPaths, dockerfilePath, contextDir, buildArgs, }) {
+        const buildArgFlags = Object.entries(buildArgs !== null && buildArgs !== void 0 ? buildArgs : {})
+            .map(([key, value]) => ` --build-arg '${key}=${value}'`)
+            .join("");
+        const buildCommand = `DOCKER_BUILDKIT=1 docker build -t ${imageRef}${buildArgFlags} -f ${dockerfilePath} ${contextDir}`;
         const ctx = { pipelineType: this.pipelineType };
         const registryUser = (0, ciVariables_1.getCiVariable)(ctx, "registryUser");
         const jobToken = (0, ciVariables_1.getCiVariable)(ctx, "jobToken");
         const registry = (0, ciVariables_1.getCiVariable)(ctx, "registry");
-        const imageRef = `${this.registryImageRef()}/catladder/${name}:${hash}`;
-        const watchedDirs = [name, ...((_a = shippedImages_1.RUNNER_IMAGE_DEPENDENCIES[name]) !== null && _a !== void 0 ? _a : [])];
         const { services, runnerVariables } = (0, docker_1.getDockerJobBaseProps)();
         return {
-            name: ensureJobName(name),
+            name: jobName,
             stage: "setup",
             image: BUILDER_IMAGE,
             services,
@@ -7003,7 +7315,9 @@ class JobImagesPlan {
             // no equivalent and always runs (the existence check is fast)
             rules: [
                 {
-                    changes: watchedDirs.map((dir) => `${exports.GENERATED_IMAGES_FOLDER}/${dir}/**/*`),
+                    // a fresh array per job: the yaml serializer anchors repeated
+                    // objects, and a shared reference would reshuffle anchors
+                    changes: [...watchedPaths],
                 },
             ],
             variables: {},
@@ -7017,31 +7331,33 @@ class JobImagesPlan {
                     `  exit 0`,
                     `fi`,
                 ]),
-                ...(0, gitlab_1.collapseableSection)("docker-build", "Building image")([
-                    `DOCKER_BUILDKIT=1 docker build -t ${imageRef} -f ${exports.GENERATED_IMAGES_FOLDER}/${name}/Dockerfile ${shippedImages_1.RUNNER_IMAGE_BUILD_CONTEXT[name] === "root"
-                        ? exports.GENERATED_IMAGES_FOLDER
-                        : `${exports.GENERATED_IMAGES_FOLDER}/${name}`}`,
-                ]),
+                ...(0, gitlab_1.collapseableSection)("docker-build", "Building image")([buildCommand]),
                 ...(0, gitlab_1.collapseableSection)("docker-push", "Pushing image")([`docker push ${imageRef}`]),
             ],
         };
     }
     /**
-     * the image definitions of all used images, materialized into the
-     * generated files (so pipelines build from committed, reviewable
-     * files and gitlab's rules:changes can watch them)
+     * the image definitions to materialize into the generated files (so
+     * pipelines build from committed, reviewable files and gitlab's
+     * rules:changes can watch them): the definitions catladder ships and
+     * the project's inline Dockerfiles. A project image directory is
+     * already committed and contributes nothing.
      */
     getGeneratedFiles() {
-        return [...this.used.keys()].flatMap((name) => {
-            const dir = (0, shippedImages_1.getShippedImageDir)(name);
-            return listFilesRecursive(dir).map((file) => ({
-                path: (0, path_1.join)(exports.GENERATED_IMAGES_FOLDER, name, file),
-                content: (0, fs_1.readFileSync)((0, path_1.join)(dir, file), "utf-8"),
-            }));
-        });
+        return [...this.used.values(), ...this.usedProject.values()].flatMap(({ files }) => files);
     }
 }
 exports.JobImagesPlan = JobImagesPlan;
+/**
+ * an inline Dockerfile is written as given — as one string, or as lines
+ * joined with newlines (always newline-terminated)
+ */
+const toDockerfileContent = (dockerfile) => {
+    const content = Array.isArray(dockerfile)
+        ? dockerfile.join("\n")
+        : dockerfile;
+    return content.endsWith("\n") ? content : `${content}\n`;
+};
 const IGNORED_FILES = new Set([".DS_Store", "Thumbs.db"]);
 const listFilesRecursive = (dir) => (0, fs_1.readdirSync)(dir, { recursive: true, encoding: "utf-8" })
     .filter((entry) => {
@@ -7055,6 +7371,22 @@ const listFilesRecursive = (dir) => (0, fs_1.readdirSync)(dir, { recursive: true
 
 /***/ }),
 
+/***/ 55537:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.isProjectImageRef = void 0;
+const isProjectImageRef = (value) => typeof value === "object" &&
+    value !== null &&
+    "image" in value &&
+    typeof value.image === "string";
+exports.isProjectImageRef = isProjectImageRef;
+//# sourceMappingURL=projectImages.js.map
+
+/***/ }),
+
 /***/ 28687:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -8806,19 +9138,18 @@ exports.getFullDbName = getFullDbName;
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.createCustomDeployJobs = void 0;
 const getAllCacheConfigsFromConfig_1 = __nccwpck_require__(19034);
-const yarn_1 = __nccwpck_require__(59874);
+const packageManagerInstall_1 = __nccwpck_require__(18600);
 const runner_1 = __nccwpck_require__(71065);
 const base_1 = __nccwpck_require__(93664);
 const types_1 = __nccwpck_require__(71446);
 const createCustomDeployJobs = async (context) => {
-    var _a, _b, _c;
+    var _a, _b, _c, _d;
     const deployConfig = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
     if (!(0, types_1.isOfDeployType)(deployConfig, "custom")) {
         // should not happen
         throw new Error("deploy config is not custom");
     }
-    // FIXME: custom deploy currently assumes yarn-based project
-    const yarnInstall = await (0, yarn_1.getYarnInstall)(context, {
+    const packageManagerInstall = await (0, packageManagerInstall_1.getPackageManagerInstall)(context, {
         noCustomPostInstall: true,
     });
     const result = (0, base_1.createDeployementJobs)(context, {
@@ -8830,14 +9161,16 @@ const createCustomDeployJobs = async (context) => {
                 : undefined,
             script: [
                 `cd ${context.build.dir}`,
-                ...(deployConfig.requiresYarnInstall ? yarnInstall : []),
+                ...(((_c = deployConfig.requiresInstall) !== null && _c !== void 0 ? _c : deployConfig.requiresYarnInstall)
+                    ? packageManagerInstall
+                    : []),
                 ...deployConfig.script,
             ],
             variables: {},
         },
         stop: deployConfig.stopScript
             ? {
-                image: (_c = deployConfig.jobImage) !== null && _c !== void 0 ? _c : (0, runner_1.getRunnerImage)("jobs-default"),
+                image: (_d = deployConfig.jobImage) !== null && _d !== void 0 ? _d : (0, runner_1.getRunnerImage)("jobs-default"),
                 script: [...deployConfig.stopScript],
                 variables: {},
             }
@@ -9513,12 +9846,12 @@ exports.NPM_PACKAGE_DEPLOY_TYPE = {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.createPagesDeployJobs = void 0;
 const getAllCacheConfigsFromConfig_1 = __nccwpck_require__(19034);
-const yarn_1 = __nccwpck_require__(59874);
+const packageManagerInstall_1 = __nccwpck_require__(18600);
 const runner_1 = __nccwpck_require__(71065);
 const base_1 = __nccwpck_require__(93664);
 const types_1 = __nccwpck_require__(71446);
 const createPagesDeployJobs = async (context) => {
-    var _a, _b, _c;
+    var _a, _b, _c, _d;
     const deployConfig = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
     if (!(0, types_1.isOfDeployType)(deployConfig, "pages")) {
         // should not happen
@@ -9533,7 +9866,7 @@ const createPagesDeployJobs = async (context) => {
     // parallel deployments) — every merge request gets a site preview
     const pathPrefix = context.environment.envType === "review" ? "mr-$CI_MERGE_REQUEST_IID" : "";
     const publishDir = (_b = deployConfig.publishDir) !== null && _b !== void 0 ? _b : "public";
-    const yarnInstall = await (0, yarn_1.getYarnInstall)(context, {
+    const packageManagerInstall = await (0, packageManagerInstall_1.getPackageManagerInstall)(context, {
         noCustomPostInstall: true,
     });
     return (0, base_1.createDeployementJobs)(context, {
@@ -9544,7 +9877,9 @@ const createPagesDeployJobs = async (context) => {
             pages: { path_prefix: pathPrefix },
             script: [
                 `cd ${context.build.dir}`,
-                ...(deployConfig.requiresYarnInstall ? yarnInstall : []),
+                ...(((_d = deployConfig.requiresInstall) !== null && _d !== void 0 ? _d : deployConfig.requiresYarnInstall)
+                    ? packageManagerInstall
+                    : []),
                 ...deployConfig.script,
                 // the gitlab environment url should point at the published site
                 // (the base deploy job reports $ROOT_URL as environment url)
@@ -9765,6 +10100,8 @@ __exportStar(__nccwpck_require__(68906), exports);
 __exportStar(__nccwpck_require__(23040), exports);
 __exportStar(__nccwpck_require__(35086), exports);
 __exportStar(__nccwpck_require__(71065), exports);
+__exportStar(__nccwpck_require__(55537), exports);
+__exportStar(__nccwpck_require__(47864), exports);
 __exportStar(__nccwpck_require__(80769), exports);
 __exportStar(__nccwpck_require__(7732), exports);
 __exportStar(__nccwpck_require__(66526), exports);
@@ -10421,6 +10758,89 @@ exports.createJobsForWorkspace = createJobsForWorkspace;
 
 /***/ }),
 
+/***/ 7633:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.detectPackageManager = void 0;
+const child_process_promise_1 = __nccwpck_require__(42242);
+const fs_1 = __nccwpck_require__(79896);
+const promises_1 = __nccwpck_require__(91943);
+const path_1 = __nccwpck_require__(16928);
+const memoizee_1 = __importDefault(__nccwpck_require__(14199));
+const readPackageManagerField = async (dir) => {
+    try {
+        const pkg = JSON.parse(await (0, promises_1.readFile)((0, path_1.join)(dir, "package.json"), "utf-8"));
+        const match = /^(yarn|pnpm)@(.+)$/.exec(pkg.packageManager);
+        if (!match)
+            return null;
+        return { type: match[1], version: match[2] };
+    }
+    catch (_a) {
+        return null;
+    }
+};
+const detectByLockfile = (dir) => {
+    if ((0, fs_1.existsSync)((0, path_1.join)(dir, "pnpm-lock.yaml")))
+        return "pnpm";
+    if ((0, fs_1.existsSync)((0, path_1.join)(dir, "yarn.lock")))
+        return "yarn";
+    return null;
+};
+const getGitRoot = async () => {
+    try {
+        return (await (0, child_process_promise_1.exec)("git rev-parse --show-toplevel")).stdout.trim();
+    }
+    catch (_a) {
+        return null;
+    }
+};
+const getInstalledVersion = async (type) => {
+    try {
+        return (await (0, child_process_promise_1.exec)(`${type} --version`)).stdout.trim();
+    }
+    catch (_a) {
+        return "";
+    }
+};
+/**
+ * detect which package manager the project uses (and its version).
+ *
+ * Order: the `packageManager` field in package.json (cwd, then git root)
+ * wins, then the lockfile present (pnpm-lock.yaml → pnpm, yarn.lock →
+ * yarn), then falling back to yarn (the historical default).
+ *
+ * An `explicitType` (from `packageManager` in catladder.ts) overrides the
+ * detected type; the version is still taken from the `packageManager`
+ * field when it pins the same manager, otherwise from the installed CLI.
+ */
+exports.detectPackageManager = (0, memoizee_1.default)(async (explicitType) => {
+    var _a, _b;
+    const roots = [process.cwd()];
+    const gitRoot = await getGitRoot();
+    if (gitRoot && gitRoot !== process.cwd())
+        roots.push(gitRoot);
+    let fromField = null;
+    for (const root of roots) {
+        fromField = await readPackageManagerField(root);
+        if (fromField)
+            break;
+    }
+    const detectedType = (_b = (_a = explicitType !== null && explicitType !== void 0 ? explicitType : fromField === null || fromField === void 0 ? void 0 : fromField.type) !== null && _a !== void 0 ? _a : roots.map(detectByLockfile).find(Boolean)) !== null && _b !== void 0 ? _b : "yarn";
+    const version = (fromField === null || fromField === void 0 ? void 0 : fromField.type) === detectedType
+        ? fromField.version
+        : await getInstalledVersion(detectedType);
+    return { type: detectedType, version };
+}, { promise: true });
+//# sourceMappingURL=detectPackageManager.js.map
+
+/***/ }),
+
 /***/ 43249:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -10528,12 +10948,23 @@ exports.getPackageManagerInfoBase = exports.getPackageManagerInfoForComponent =
 const fs_1 = __nccwpck_require__(79896);
 const path_1 = __nccwpck_require__(16928);
 const path_equal_1 = __nccwpck_require__(43882);
+const detectPackageManager_1 = __nccwpck_require__(7633);
+const pnpmUtils_1 = __nccwpck_require__(3497);
 const yarnUtils_1 = __nccwpck_require__(94191);
 const memoizee_1 = __importDefault(__nccwpck_require__(14199));
+const PACKAGE_MANAGER_FILES = {
+    yarn: {
+        lockFile: "yarn.lock",
+        configFiles: [".yarnrc", ".yarnrc.yml", ".npmrc", ".yarn"], // ".yarn" is yarn 2 folder
+    },
+    pnpm: {
+        lockFile: "pnpm-lock.yaml",
+        configFiles: ["pnpm-workspace.yaml", ".npmrc", ".pnpmfile.cjs"],
+    },
+};
 const getPackageManagerInfoForComponent = async (config, componentName) => {
-    const baseInfo = await (0, exports.getPackageManagerInfoBase)();
+    const baseInfo = await (0, exports.getPackageManagerInfoBase)(config);
     const { workspaces } = baseInfo;
-    // currently only supports yarn
     const component = config.components[componentName];
     const currentWorkspace = workspaces.find((w) => (0, path_equal_1.pathEqual)(component.dir, w.location));
     const componentIsInWorkspace = Boolean(currentWorkspace);
@@ -10542,10 +10973,10 @@ const getPackageManagerInfoForComponent = async (config, componentName) => {
     const workspacePackageJson = componentIsInWorkspace
         ? (0, path_1.join)(workspaceRoot, "package.json")
         : null;
+    const { lockFile: lockFileName, configFiles } = PACKAGE_MANAGER_FILES[baseInfo.type];
     const lockFile = componentIsInWorkspace
-        ? (0, path_1.join)(workspaceRoot, "yarn.lock")
-        : (0, path_1.join)(component.dir, "yarn.lock");
-    const configFiles = [".yarnrc", ".yarnrc.yml", ".npmrc", ".yarn"]; // ".yarn" is yarn 2 folder
+        ? (0, path_1.join)(workspaceRoot, lockFileName)
+        : (0, path_1.join)(component.dir, lockFileName);
     // copy all those configFiles from workspace root and/or component folder
     const configFilePaths = [
         ...configFiles,
@@ -10556,12 +10987,27 @@ const getPackageManagerInfoForComponent = async (config, componentName) => {
     const currentWorkspaceDependencies = currentWorkspace
         ? (0, yarnUtils_1.getWorkspaceDependencies)(currentWorkspace, workspaces)
         : [];
+    // pnpm's --frozen-lockfile check requires every importer of the
+    // lockfile to exist on disk, so all workspace manifests (not just the
+    // dependency workspaces, which are copied entirely) go into the image
+    const allWorkspaceManifests = baseInfo.type === "pnpm" && componentIsInWorkspace
+        ? workspaces
+            .map((w) => (0, path_1.join)(w.location, "package.json"))
+            .filter((f) => (0, fs_1.existsSync)(f))
+        : [];
+    // patch files referenced by patchedDependencies must exist in the
+    // image, or pnpm's frozen install fails verifying them
+    const patchFiles = baseInfo.type === "pnpm"
+        ? (0, pnpmUtils_1.getPnpmPatchFiles)(componentIsInWorkspace ? workspaceRoot : component.dir)
+        : [];
     const pathsToCopyInDocker = [
         ...new Set([
             packageJson,
             ...(workspacePackageJson ? [workspacePackageJson] : []),
             lockFile,
             ...configFilePaths,
+            ...allWorkspaceManifests,
+            ...patchFiles,
             ...currentWorkspaceDependencies,
         ]),
     ];
@@ -10574,11 +11020,17 @@ const getPackageManagerInfoForComponent = async (config, componentName) => {
     };
 };
 exports.getPackageManagerInfoForComponent = getPackageManagerInfoForComponent;
-const _getPackageManagerInfoBase = async () => {
-    // currently only supports yarn
-    const version = await (0, yarnUtils_1.getYarnVersion)();
+const _getPackageManagerInfoBase = async (config) => {
+    const { type, version } = await (0, detectPackageManager_1.detectPackageManager)(config === null || config === void 0 ? void 0 : config.packageManager);
     if (!version)
-        throw new Error("could not get yarn version");
+        throw new Error(`could not get ${type} version`);
+    if (type === "pnpm") {
+        return {
+            type: "pnpm",
+            workspaces: await (0, pnpmUtils_1.getPnpmWorkspaces)(),
+            version,
+        };
+    }
     const isClassic = version.startsWith("1");
     const workspaces = await (0, yarnUtils_1.getWorkspaces)(isClassic);
     return {
@@ -10590,11 +11042,113 @@ const _getPackageManagerInfoBase = async () => {
 };
 exports.getPackageManagerInfoBase = (0, memoizee_1.default)(_getPackageManagerInfoBase, {
     promise: true,
+    // memoize per explicit packageManager choice, not per config identity
+    normalizer: ([config]) => { var _a; return (_a = config === null || config === void 0 ? void 0 : config.packageManager) !== null && _a !== void 0 ? _a : ""; },
 });
 //# sourceMappingURL=packageManager.js.map
 
 /***/ }),
 
+/***/ 3497:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.getPnpmWorkspaces = exports.getPnpmPatchFiles = void 0;
+const child_process_promise_1 = __nccwpck_require__(42242);
+const fs_1 = __nccwpck_require__(79896);
+const promises_1 = __nccwpck_require__(91943);
+const path_1 = __nccwpck_require__(16928);
+const memoizee_1 = __importDefault(__nccwpck_require__(14199));
+const yaml_1 = __nccwpck_require__(33483);
+const jsonParse_1 = __nccwpck_require__(99461);
+const readWorkspaceDependencyLocations = async (location, locationByName) => {
+    var _a, _b, _c;
+    try {
+        const pkg = JSON.parse(await (0, promises_1.readFile)((0, path_1.join)(location, "package.json"), "utf-8"));
+        const depNames = [
+            ...Object.keys((_a = pkg.dependencies) !== null && _a !== void 0 ? _a : {}),
+            ...Object.keys((_b = pkg.devDependencies) !== null && _b !== void 0 ? _b : {}),
+            ...Object.keys((_c = pkg.optionalDependencies) !== null && _c !== void 0 ? _c : {}),
+        ];
+        return [
+            ...new Set(depNames
+                .map((name) => locationByName.get(name))
+                .filter((l) => Boolean(l) && l !== location)),
+        ];
+    }
+    catch (_d) {
+        return [];
+    }
+};
+/**
+ * patch files referenced by `patchedDependencies` (pnpm-workspace.yaml
+ * or the root package.json's `pnpm` section) — they must travel into
+ * the docker build context, or the prod install fails to verify them
+ */
+const getPnpmPatchFiles = (root = ".") => {
+    var _a, _b, _c;
+    const patchedDependencies = {};
+    try {
+        const ws = (0, yaml_1.parse)((0, fs_1.readFileSync)((0, path_1.join)(root, "pnpm-workspace.yaml"), "utf-8"));
+        Object.assign(patchedDependencies, (_a = ws === null || ws === void 0 ? void 0 : ws.patchedDependencies) !== null && _a !== void 0 ? _a : {});
+    }
+    catch (_d) {
+        // no workspace file
+    }
+    try {
+        const pkg = JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(root, "package.json"), "utf-8"));
+        Object.assign(patchedDependencies, (_c = (_b = pkg === null || pkg === void 0 ? void 0 : pkg.pnpm) === null || _b === void 0 ? void 0 : _b.patchedDependencies) !== null && _c !== void 0 ? _c : {});
+    }
+    catch (_e) {
+        // no package.json
+    }
+    return [
+        ...new Set(Object.values(patchedDependencies)
+            .map((p) => (0, path_1.join)(root, p))
+            .filter((p) => (0, fs_1.existsSync)(p))),
+    ];
+};
+exports.getPnpmPatchFiles = getPnpmPatchFiles;
+/**
+ * list pnpm workspace projects in the same shape yarn berry reports them
+ * (locations relative to the project root, workspace dependencies as
+ * locations). Outside a pnpm workspace this returns [].
+ */
+// export for mocking
+exports.getPnpmWorkspaces = (0, memoizee_1.default)(async () => {
+    let output;
+    try {
+        output = (await (0, child_process_promise_1.exec)("pnpm m ls --json --depth -1")).stdout;
+    }
+    catch (_a) {
+        return [];
+    }
+    const projects = (0, jsonParse_1.jsonParseOrThrow)(output.trim() || "[]");
+    if (!Array.isArray(projects))
+        return [];
+    const withLocations = projects
+        .filter((p) => p.name && p.path)
+        .map((p) => ({
+        name: p.name,
+        location: (0, path_1.relative)(process.cwd(), p.path) || ".",
+    }));
+    const locationByName = new Map(withLocations.map((p) => [p.name, p.location]));
+    return Promise.all(withLocations.map(async ({ name, location }) => ({
+        name,
+        location,
+        workspaceDependencies: await readWorkspaceDependencyLocations(location, locationByName),
+        mismatchedWorkspaceDependencies: [],
+    })));
+}, { promise: true });
+//# sourceMappingURL=pnpmUtils.js.map
+
+/***/ }),
+
 /***/ 77257:
 /***/ ((__unused_webpack_module, exports) => {
 
@@ -10706,10 +11260,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getWorkspaceDependencies = exports.getWorkspaces = exports.getYarnVersion = void 0;
+exports.getWorkspaceDependencies = exports.getWorkspaces = void 0;
 const child_process_promise_1 = __nccwpck_require__(42242);
-const promises_1 = __nccwpck_require__(91943);
-const path_1 = __nccwpck_require__(16928);
 const memoizee_1 = __importDefault(__nccwpck_require__(14199));
 const jsonParse_1 = __nccwpck_require__(99461);
 const execOrFail = async (cmd, onFail) => {
@@ -10720,40 +11272,6 @@ const execOrFail = async (cmd, onFail) => {
         return onFail !== null && onFail !== void 0 ? onFail : null;
     }
 };
-const readPackageManagerVersion = async (dir) => {
-    var _a;
-    try {
-        const pkg = JSON.parse(await (0, promises_1.readFile)((0, path_1.join)(dir, "package.json"), "utf-8"));
-        const match = /^yarn@(.+)$/.exec(pkg.packageManager);
-        return (_a = match === null || match === void 0 ? void 0 : match[1]) !== null && _a !== void 0 ? _a : null;
-    }
-    catch (_b) {
-        return null;
-    }
-};
-const getGitRoot = async () => {
-    try {
-        return (await (0, child_process_promise_1.exec)("git rev-parse --show-toplevel")).stdout.trim();
-    }
-    catch (_a) {
-        return null;
-    }
-};
-// export for mocking
-exports.getYarnVersion = (0, memoizee_1.default)(async () => {
-    // Fast path: read from package.json packageManager field
-    const fromCwd = await readPackageManagerVersion(process.cwd());
-    if (fromCwd)
-        return fromCwd;
-    const gitRoot = await getGitRoot();
-    if (gitRoot && gitRoot !== process.cwd()) {
-        const fromGitRoot = await readPackageManagerVersion(gitRoot);
-        if (fromGitRoot)
-            return fromGitRoot;
-    }
-    // Fallback: invoke yarn CLI
-    return await execOrFail("yarn --version", "");
-}, { promise: true });
 // export for mocking
 exports.getWorkspaces = (0, memoizee_1.default)(async (isClassic) => {
     var _a, _b;
@@ -11404,7 +11922,7 @@ exports.createVerifyJobs = exports.VERIFY_JOB_NAME = void 0;
 const createArtifactsConfig_1 = __nccwpck_require__(24494);
 const cache_1 = __nccwpck_require__(21100);
 const constants_1 = __nccwpck_require__(97627);
-const yarn_1 = __nccwpck_require__(59874);
+const packageManagerInstall_1 = __nccwpck_require__(18600);
 const deploy_1 = __nccwpck_require__(19752);
 const runner_1 = __nccwpck_require__(71065);
 const utils_1 = __nccwpck_require__(24516);
@@ -11421,9 +11939,9 @@ const createVerifyJobs = async (context) => {
         return [];
     }
     const isNodeBuild = context.build.type !== "disabled" && context.build.buildType === "node";
-    const [yarnInstall, nodeCache] = isNodeBuild
+    const [packageManagerInstall, nodeCache] = isNodeBuild
         ? await Promise.all([
-            (0, yarn_1.getYarnInstall)(context),
+            (0, packageManagerInstall_1.getPackageManagerInstall)(context),
             (0, cache_1.getNodeCache)(context, "pull"),
         ])
         : [null, null];
@@ -11459,9 +11977,9 @@ const createVerifyJobs = async (context) => {
             },
             script: [
                 ...setupScript,
-                ...(yarnInstall ? (0, yarn_1.ensureNodeVersion)(context) : []),
+                ...(packageManagerInstall ? (0, packageManagerInstall_1.ensureNodeVersion)(context) : []),
                 `cd ${context.build.dir}`,
-                ...(yarnInstall !== null && yarnInstall !== void 0 ? yarnInstall : []),
+                ...(packageManagerInstall !== null && packageManagerInstall !== void 0 ? packageManagerInstall : []),
                 ...(0, utils_1.ensureArray)(verifyConfig.command),
             ],
             allow_failure: verifyConfig.allowFailure,