@gtkx/cli 1.1.0 → 1.2.1

package/src/deploy/notices/text.ts

@@ -0,0 +1,42 @@
+import { readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const LICENSE_FILE = /^(?:licen[cs]e|copying|notice)(?:[-._].*)?$/i;
+const COPYRIGHT_LINE = /^(?:Copyright\b|©)/;
+const MAX_COPYRIGHT_LINES = 20;
+const MORE_COPYRIGHT = "and the other holders named in the license text";
+
+const readLicenseText = (path: string): string | null => {
+    try {
+        return readFileSync(path, "utf8").trimEnd();
+    } catch {
+        return null;
+    }
+};
+
+const licenseFilesIn = (dir: string): string[] =>
+    readdirSync(dir, { withFileTypes: true })
+        .filter((entry) => entry.isFile() && LICENSE_FILE.test(entry.name))
+        .map((entry) => entry.name)
+        .toSorted((left, right) => left.localeCompare(right));
+
+const licenseTextIn = (dir: string): string | null => {
+    const texts = licenseFilesIn(dir)
+        .map((name) => readLicenseText(join(dir, name)))
+        .filter((text) => text !== null);
+
+    return texts.length === 0 ? null : texts.join("\n\n");
+};
+
+const copyrightLines = (text: string | null): string[] => {
+    const found = (text ?? "")
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => COPYRIGHT_LINE.test(line));
+
+    const unique = [...new Set(found)];
+
+    return unique.length > MAX_COPYRIGHT_LINES ? [...unique.slice(0, MAX_COPYRIGHT_LINES), MORE_COPYRIGHT] : unique;
+};
+
+export { copyrightLines, licenseTextIn, readLicenseText };

package/src/deploy/payload/copy-tree.ts

@@ -7,6 +7,7 @@ const EXECUTABLE_MODE = 0o755;
 const READABLE_MODE = 0o644;
 const EXECUTABLE_SUFFIXES = [".node", ".so"];
 const MODE_MASK = 0o7777;
+const EXECUTE_MASK = 0o111;
 
 const modeFor = (rel: string): number => {
     const name = rel.split("/").at(-1) ?? rel;
@@ -44,8 +45,11 @@ const writeInto = (root: string, rel: string, contents: string, mode = READABLE_
 
 const sourceMode = (path: string): number => statSync(path).mode & MODE_MASK;
 
+const executableModeFor = (path: string): number =>
+    (sourceMode(path) & EXECUTE_MASK) === 0 ? READABLE_MODE : EXECUTABLE_MODE;
+
 const copyTree = (root: string, relBase: string, sourceDir: string): StagedFile[] =>
     listFilesRecursive(sourceDir)
         .map((file) => copyInto(root, join(relBase, file.rel), file.absPath, sourceMode(file.absPath)));
 
-export { copyInto, copyTree, EXECUTABLE_MODE, writeInto };
+export { copyInto, copyTree, EXECUTABLE_MODE, executableModeFor, writeInto };

package/src/deploy/payload/stage.ts

@@ -1,13 +1,15 @@
 import { sortStringsBy } from "@gtkx/utils";
 import { existsSync, rmSync } from "node:fs";
 import { join, resolve } from "node:path";
-import type { DeploySettings, DeployTargetName, NodeRuntime, StagedFile } from "../types.js";
+import type { DeploySettings, DeployTargetName, NodeRuntime, NoticeSection, StagedFile } from "../types.js";
 import { listFilesRecursive } from "../../internal/list-files.js";
+import { BUNDLED_PACKAGES_FILENAME } from "../../vite-plugins/bundled-packages.js";
 import { BUNDLE_FILENAME } from "../../vite-plugins/esm-extension.js";
 import { renderCopyright } from "../freedesktop/copyright.js";
 import { renderDbusService } from "../freedesktop/dbus-service.js";
 import { renderDesktopEntry } from "../freedesktop/desktop-entry.js";
-import { copyInto, EXECUTABLE_MODE, writeInto } from "./copy-tree.js";
+import { renderNotices } from "../notices/render.js";
+import { copyInto, EXECUTABLE_MODE, executableModeFor, writeInto } from "./copy-tree.js";
 import { stageIcons } from "./icons.js";
 import { NODE_FILENAME, renderLauncher } from "./launcher.js";
 import { stageSchemas } from "./schemas.js";
@@ -25,6 +27,8 @@ type StagedMetadata = {
 };
 
 const DIST_ICONS_DIR = "icons";
+const NOTICES_FILENAME = "THIRD-PARTY-NOTICES";
+const NODE_LICENSE_FILENAME = "LICENSE";
 const SHARE_APPLICATIONS = "share/applications";
 const SHARE_METAINFO = "share/metainfo";
 const SHARE_MIME_PACKAGES = "share/mime/packages";
@@ -40,7 +44,14 @@ const PREFIX_FOR: Record<DeployTargetName, string> = {
 };
 
 const libDirFor = (settings: DeploySettings): string => `lib/${settings.binaryName}`;
+const licenseDirFor = (settings: DeploySettings): string => `${SHARE_LICENSES}/${settings.binaryName}`;
+const licenseDestination = (settings: DeploySettings): string => `${licenseDirFor(settings)}/LICENSE`;
+const noticesDestination = (settings: DeploySettings): string => `${licenseDirFor(settings)}/${NOTICES_FILENAME}`;
 const isIconAsset = (rel: string): boolean => rel === DIST_ICONS_DIR || rel.startsWith(`${DIST_ICONS_DIR}/`);
+const isBuildMetadata = (rel: string): boolean => rel === BUNDLED_PACKAGES_FILENAME;
+
+const nodeLicenseDestination = (settings: DeploySettings): string =>
+    `${licenseDirFor(settings)}/${NODE_FILENAME}/${NODE_LICENSE_FILENAME}`;
 
 const stageRuntimeFiles = (settings: DeploySettings, root: string): StagedFile[] => {
     const dist = settings.paths.dist;
@@ -50,7 +61,7 @@ const stageRuntimeFiles = (settings: DeploySettings, root: string): StagedFile[]
     }
 
     return listFilesRecursive(dist)
-        .filter((file) => !isIconAsset(file.rel))
+        .filter((file) => !isIconAsset(file.rel) && !isBuildMetadata(file.rel))
         .map((file) => copyInto(root, join(libDirFor(settings), file.rel), file.absPath));
 };
 
@@ -66,8 +77,11 @@ const stageMetadata = (settings: DeploySettings, root: string, metadata: StagedM
 ];
 
 const stageExtraFiles = (settings: DeploySettings, root: string): StagedFile[] =>
-    Object.entries(settings.extraFiles).map(([destination, source]) =>
-        copyInto(root, destination, resolve(settings.paths.root, source)));
+    settings.extraFiles.map((file) => {
+        const source = resolve(settings.paths.root, file.source);
+
+        return copyInto(root, file.destination, source, file.mode ?? executableModeFor(source));
+    });
 
 const byRelativePath = (files: StagedFile[]): StagedFile[] => {
     const latest: Map<string, StagedFile> = new Map();
@@ -114,7 +128,7 @@ const stageActivation = (settings: DeploySettings, root: string, target: DeployT
     )];
 };
 
-const stageOverlay = (settings: DeploySettings, target: DeployTargetName): StagedFile[] => {
+const stageOverlay = (settings: DeploySettings, target: DeployTargetName, notices: NoticeSection[]): StagedFile[] => {
     const root = join(settings.paths.overlay, target);
     rmSync(root, { recursive: true, force: true, maxRetries: 5 });
     const licenseFile = settings.paths.licenseFile;
@@ -123,23 +137,33 @@ const stageOverlay = (settings: DeploySettings, target: DeployTargetName): Stage
     if (target === "deb") {
         return [
             ...activation,
-            writeInto(root, join(SHARE_DOC, settings.binaryName, "copyright"), renderCopyright(settings)),
+            writeInto(root, join(SHARE_DOC, settings.binaryName, "copyright"), renderCopyright(settings, notices)),
         ];
     }
 
     return [
         ...activation,
-        ...(licenseFile === null
-            ? []
-            : [copyInto(root, join(SHARE_LICENSES, settings.binaryName, "LICENSE"), licenseFile)]),
+        ...(licenseFile === null ? [] : [copyInto(root, licenseDestination(settings), licenseFile)]),
+        writeInto(root, noticesDestination(settings), renderNotices(settings, notices)),
     ];
 };
 
-const stageOverlays = (settings: DeploySettings): Record<DeployTargetName, StagedFile[]> => ({
-    appimage: stageOverlay(settings, "appimage"),
-    deb: stageOverlay(settings, "deb"),
-    flatpak: stageOverlay(settings, "flatpak"),
-    rpm: stageOverlay(settings, "rpm"),
+const stageOverlays = (
+    settings: DeploySettings,
+    notices: NoticeSection[],
+): Record<DeployTargetName, StagedFile[]> => ({
+    appimage: stageOverlay(settings, "appimage", notices),
+    deb: stageOverlay(settings, "deb", notices),
+    flatpak: stageOverlay(settings, "flatpak", notices),
+    rpm: stageOverlay(settings, "rpm", notices),
 });
 
-export { type StagedMetadata, stageOverlays, stagePayload };
+export {
+    licenseDestination,
+    nodeLicenseDestination,
+    NOTICES_FILENAME,
+    noticesDestination,
+    type StagedMetadata,
+    stageOverlays,
+    stagePayload,
+};

package/src/deploy/run-deploy.ts

@@ -17,16 +17,20 @@ import { renderMetainfo } from "./freedesktop/metainfo.js";
 import { renderMimePackage } from "./freedesktop/mime-package.js";
 import { validateDesktopEntry, validateMetainfo } from "./freedesktop/validate.js";
 import { resolveNodeRuntime } from "./node-runtime/index.js";
+import { collectNotices } from "./notices/collect.js";
 import { type StagedMetadata, stageOverlays, stagePayload } from "./payload/stage.js";
 import { DEFAULT_TARGETS, parseTargetList, targetsFor } from "./registry.js";
 import { resolveDeploySettings } from "./settings/index.js";
 import { readPackageManifest } from "./settings/package-manifest.js";
 import { missingDeployError } from "./settings/starter.js";
+import { finishArgsFor, hasDisplaySocket } from "./targets/flatpak-manifest.js";
+import { detectPackageManager } from "./targets/flatpak-sources.js";
 import {
     APPSTREAMCLI,
     assertTools,
     DESKTOP_FILE_VALIDATE,
     FLATPAK_NODE_GENERATOR,
+    FLATPAK_NODE_GENERATOR_PNPM,
     probeTools,
     STRIP,
     TAR,
@@ -76,10 +80,19 @@ const validateMetadata = (settings: DeploySettings, metadata: StagedMetadata, ar
     info("Validated the desktop entry and the metainfo");
 };
 
-const warnMissingNetwork = (settings: DeploySettings): void => {
-    const finishArgs = settings.deploy.flatpak?.finishArgs;
+const warnMissingDisplay = (settings: DeploySettings, finishArgs: string[]): void => {
+    if (hasDisplaySocket(finishArgs)) {
+        return;
+    }
+
+    warn(
+        `The flatpak permissions grant no display socket, so ${settings.name} will start without a window. ` +
+        "Grant one through `deploy.flatpak.finishArgs`, such as `--socket=wayland`.",
+    );
+};
 
-    if (finishArgs === undefined || finishArgs.includes(NETWORK_ARG)) {
+const warnMissingNetwork = (settings: DeploySettings, finishArgs: string[]): void => {
+    if (settings.deploy.flatpak?.finishArgs === undefined || finishArgs.includes(NETWORK_ARG)) {
         return;
     }
 
@@ -90,10 +103,24 @@ const warnMissingNetwork = (settings: DeploySettings): void => {
     warn(`This app declares ${WEBKIT_LIBRARY} but its flatpak permissions omit ${NETWORK_ARG}, so pages will not load`);
 };
 
+const warnFlatpakPermissions = (targets: DeployTarget[], settings: DeploySettings): void => {
+    if (targets.every((target) => target.name !== "flatpak")) {
+        return;
+    }
+
+    const finishArgs = finishArgsFor(settings);
+    warnMissingDisplay(settings, finishArgs);
+    warnMissingNetwork(settings, finishArgs);
+};
+
 const sourceModeTools = (targets: DeployTarget[], settings: DeploySettings): DeployTool[] => {
     const isFlatpakSource = settings.deploy.flatpak?.mode === "source";
 
-    return isFlatpakSource && targets.some((target) => target.name === "flatpak") ? [FLATPAK_NODE_GENERATOR] : [];
+    if (!isFlatpakSource || targets.every((target) => target.name !== "flatpak")) {
+        return [];
+    }
+
+    return detectPackageManager(settings) === "pnpm" ? [FLATPAK_NODE_GENERATOR_PNPM] : [FLATPAK_NODE_GENERATOR];
 };
 
 const isNodeRequired = (targets: DeployTarget[], settings: DeploySettings): boolean =>
@@ -119,7 +146,7 @@ const preflight = (targets: DeployTarget[], settings: DeploySettings, shouldPrin
     const report = probeTools([...required, ...packagerTools]);
     assertTools(report);
     warnMissingOptional(report);
-    warnMissingNetwork(settings);
+    warnFlatpakPermissions(targets, settings);
 };
 
 const resolveTargetNames = (options: DeployOptions, settings: DeploySettings): string[] => {
@@ -159,8 +186,9 @@ const buildPayload = async (
 
     const stage = stagePayload({ settings, node, metadata });
     info(`Staged ${String(stage.length)} files into ${displayPath(settings, settings.paths.stage)}`);
+    const notices = collectNotices({ settings, node });
 
-    return { settings, node, stage, overlays: stageOverlays(settings) };
+    return { settings, node, stage, notices, overlays: stageOverlays(settings, notices) };
 };
 
 const renderTargetManifests = (

package/src/deploy/settings/extra-files.ts

@@ -0,0 +1,21 @@
+import type { DeployConfig, DeployExtraFile } from "../types.js";
+
+type ExtraFiles = NonNullable<DeployConfig["extraFiles"]>;
+type ExtraFileEntry = NonNullable<ExtraFiles[string]>;
+
+const OCTAL_RADIX = 8;
+
+const resolveExtraFile = (destination: string, entry: ExtraFileEntry): DeployExtraFile => {
+    if (typeof entry === "string") {
+        return { destination, source: entry, mode: null };
+    }
+
+    const mode = entry.mode === undefined ? null : Number.parseInt(entry.mode, OCTAL_RADIX);
+
+    return { destination, source: entry.source, mode };
+};
+
+const resolveExtraFiles = (deploy: DeployConfig): DeployExtraFile[] =>
+    Object.entries(deploy.extraFiles ?? {}).map(([destination, entry]) => resolveExtraFile(destination, entry));
+
+export { resolveExtraFiles };

package/src/deploy/settings/index.ts

@@ -9,6 +9,7 @@ import type {
 } from "../types.js";
 import { resolveArch } from "./arch.js";
 import { resolveExecToken, resolveFileAssociations, resolveMimeTypes } from "./exec.js";
+import { resolveExtraFiles } from "./extra-files.js";
 import {
     type IdentityRequest,
     resolveBinaryName,
@@ -177,7 +178,7 @@ const resolveDeploySettings = (request: SettingsRequest): DeploySettings => {
         ...identitySlice(core),
         ...metadataSlice(request.root, core),
         ...desktopSlice(deploy),
-        extraFiles: deploy.extraFiles ?? {},
+        extraFiles: resolveExtraFiles(deploy),
         versions: core.versions,
         arch: resolveArch(),
         paths: resolvePaths({ root: request.root, deploy, outDirOverride: request.outDirOverride }),

package/src/deploy/settings/package-manifest.ts

@@ -13,6 +13,8 @@ type PackageManifest = {
     description: string | null;
     license: string | null;
     homepage: string | null;
+    repository: string | null;
+    packageManager: string | null;
     author: ManifestAuthor;
 };
 
@@ -28,6 +30,14 @@ const parseAuthorString = (author: string): ManifestAuthor => {
     return { name: optionalString(groups?.name), email: optionalString(groups?.email) };
 };
 
+const parseRepository = (repository: unknown): string | null => {
+    if (isRecord(repository)) {
+        return optionalString(repository.url);
+    }
+
+    return optionalString(repository);
+};
+
 const parseAuthor = (author: unknown): ManifestAuthor => {
     if (typeof author === "string") {
         return parseAuthorString(author);
@@ -59,6 +69,8 @@ const readPackageManifest = (root: string): PackageManifest => {
         description: optionalString(manifest.description),
         license: optionalString(manifest.license),
         homepage: optionalString(manifest.homepage),
+        repository: parseRepository(manifest.repository),
+        packageManager: optionalString(manifest.packageManager),
         author: parseAuthor(manifest.author),
     };
 };

package/src/deploy/settings/paths.ts

@@ -112,4 +112,4 @@ const resolvePaths = (request: PathsRequest): DeployPaths => {
     };
 };
 
-export { resolvePaths };
+export { isInside, resolvePaths };

package/src/deploy/targets/flatpak-manifest.ts

@@ -12,10 +12,76 @@ const DEFAULT_RUNTIME_VERSION = "50";
 const DEFAULT_SDK = "org.gnome.Sdk";
 const DEFAULT_FINISH_ARGS = ["--share=ipc", "--socket=wayland", "--socket=fallback-x11", "--device=dri"];
 const DEFAULT_CLEANUP = ["/include", "/share/pkgconfig", "*.la", "*.a"];
+const DISPLAY_SOCKETS = ["fallback-x11", "wayland", "x11"];
+const SOCKET_ARG = "--socket=";
+const NO_SOCKET_ARG = "--nosocket=";
+
+const NEGATED_ARGS: [string, string][] = [
+    ["--device=", "--nodevice="],
+    ["--share=", "--unshare="],
+    [SOCKET_ARG, NO_SOCKET_ARG],
+];
 
 const branchFor = (settings: DeploySettings): string => settings.deploy.flatpak?.branch ?? DEFAULT_BRANCH;
 const isSourceMode = (settings: DeploySettings): boolean => settings.deploy.flatpak?.mode === "source";
 
+const negationFor = (arg: string): string | null => {
+    const negated = NEGATED_ARGS.find(([prefix]) => arg.startsWith(prefix));
+
+    if (negated === undefined) {
+        return null;
+    }
+
+    const [prefix, negation] = negated;
+
+    return `${negation}${arg.slice(prefix.length)}`;
+};
+
+const mergeArgs = (defaults: string[], overrides: string[]): string[] => {
+    const kept = defaults.filter((arg) => {
+        const negation = negationFor(arg);
+
+        return negation === null || !overrides.includes(negation);
+    });
+
+    return [...new Set([...kept, ...overrides])];
+};
+
+const finishArgsFor = (settings: DeploySettings): string[] =>
+    mergeArgs(DEFAULT_FINISH_ARGS, settings.deploy.flatpak?.finishArgs ?? []);
+
+const cleanupFor = (settings: DeploySettings): string[] => {
+    const cleanup = settings.deploy.flatpak?.cleanup;
+
+    if (cleanup === undefined) {
+        return DEFAULT_CLEANUP;
+    }
+
+    return cleanup.length === 0 ? [] : mergeArgs(DEFAULT_CLEANUP, cleanup);
+};
+
+const grantedSockets = (args: string[]): Set<string> => {
+    const granted: Set<string> = new Set();
+
+    for (const arg of args) {
+        if (arg.startsWith(SOCKET_ARG)) {
+            granted.add(arg.slice(SOCKET_ARG.length));
+        }
+
+        if (arg.startsWith(NO_SOCKET_ARG)) {
+            granted.delete(arg.slice(NO_SOCKET_ARG.length));
+        }
+    }
+
+    return granted;
+};
+
+const hasDisplaySocket = (args: string[]): boolean => {
+    const granted = grantedSockets(args);
+
+    return DISPLAY_SOCKETS.some((socket) => granted.has(socket));
+};
+
 const sdkExtensionsFor = (settings: DeploySettings): string[] => {
     const flatpak = settings.deploy.flatpak ?? {};
     const nodeExtension = isSourceMode(settings) ? [nodeExtensionFor(settings)] : [];
@@ -46,16 +112,15 @@ const runtimeKeys = (settings: DeploySettings): FlatpakManifest => {
 
 const renderFlatpakManifest = (payload: DeployPayload): FlatpakManifest => {
     const settings = payload.settings;
-    const flatpak = settings.deploy.flatpak ?? {};
 
     return {
         id: settings.applicationId,
         ...runtimeKeys(settings),
         command: settings.binaryName,
-        "finish-args": flatpak.finishArgs ?? DEFAULT_FINISH_ARGS,
-        cleanup: flatpak.cleanup ?? DEFAULT_CLEANUP,
+        "finish-args": finishArgsFor(settings),
+        cleanup: cleanupFor(settings),
         modules: modulesFor(payload),
     };
 };
 
-export { branchFor, renderFlatpakManifest };
+export { branchFor, finishArgsFor, hasDisplaySocket, renderFlatpakManifest };

package/src/deploy/targets/flatpak-pnpm.ts

@@ -0,0 +1,115 @@
+import type { DeploySettings } from "../types.js";
+import type { FlatpakModule } from "./flatpak-prebuilt.js";
+import { readPackageManifest } from "../settings/package-manifest.js";
+
+type PnpmPin = {
+    version: string;
+    major: number;
+    minor: number;
+    sha512: string;
+};
+
+const PNPM_VERSION = "11.21.0";
+const PNPM_MAJOR = 11;
+const PNPM_MINOR = 21;
+
+const PNPM_SHA512 = "521705bce689924eac72f5a3587122f362689ef6571e55ba80076fd637c11132ecffada26" +
+    "fad4ea79c485bfddbfd3d5a2a5b05805a77e893de71ec8a6cca3bb1";
+
+const PNPM_DIR = "flatpak-pnpm";
+const PNPM_COMMAND = "pnpm";
+const PNPM_PREFIX = "pnpm@";
+const PNPM_TARBALL_URL = "https://registry.npmjs.org/pnpm/-/pnpm-";
+const PNPM_INSTALL = "pnpm install --offline --frozen-lockfile";
+const TRUST_LOCKFILE = "--trust-lockfile";
+const STORE_V10 = "v10";
+const STORE_V11 = "v11";
+const STORE_V10_MAJOR = 10;
+const STORE_V11_MAJOR = 11;
+const TRUST_LOCKFILE_MINOR = 3;
+
+const DEFAULT_PIN: PnpmPin = {
+    version: PNPM_VERSION,
+    major: PNPM_MAJOR,
+    minor: PNPM_MINOR,
+    sha512: PNPM_SHA512,
+};
+
+const PNPM_PIN_FIELD =
+    /^pnpm@(?<version>(?<major>\d+)\.(?<minor>\d+)\.\d+)\+sha512\.(?<sha512>[\da-f]{128})$/;
+
+const pinFromGroups = (groups: Record<string, string | undefined>): PnpmPin | null => {
+    const { major, minor, sha512, version } = groups;
+
+    if (major === undefined || minor === undefined || sha512 === undefined || version === undefined) {
+        return null;
+    }
+
+    return { version, major: Number(major), minor: Number(minor), sha512 };
+};
+
+const isSupportedPin = (pin: PnpmPin): boolean =>
+    pin.major === STORE_V10_MAJOR || (pin.major === STORE_V11_MAJOR && pin.minor >= TRUST_LOCKFILE_MINOR);
+
+const resolvePnpmPin = (settings: DeploySettings): PnpmPin => {
+    const field = readPackageManifest(settings.paths.root).packageManager;
+
+    if (field === null) {
+        return DEFAULT_PIN;
+    }
+
+    if (!field.startsWith(PNPM_PREFIX)) {
+        throw new Error(
+            `Cannot vendor pnpm for the Flathub sandbox: "packageManager" is "${field}" but the offline install ` +
+            "resolves from a pnpm lockfile. Run `corepack use pnpm@<version>` to pin it to pnpm, or point " +
+            "`deploy.flatpak.packageManager` at the manager whose lockfile the build should install from.",
+        );
+    }
+
+    const pin = pinFromGroups(PNPM_PIN_FIELD.exec(field)?.groups ?? {});
+
+    if (pin === null) {
+        throw new Error(
+            `Cannot vendor pnpm for the Flathub sandbox: "packageManager" is "${field}", which carries no sha512 ` +
+            "integrity digest, and every source in a Flathub build has to be hash-pinned. Run " +
+            "`corepack use pnpm@<version>` to rewrite it with its digest.",
+        );
+    }
+
+    if (!isSupportedPin(pin)) {
+        throw new Error(
+            `Cannot vendor pnpm ${pin.version} for the Flathub sandbox: the offline install runs on pnpm 10, or on ` +
+            "pnpm 11 from 11.3.0 on, where `--trust-lockfile` exists. Earlier pnpm 11 releases reach the registry " +
+            'during the supply-chain check and the sandbox has no network. Pin "packageManager" to one of those.',
+        );
+    }
+
+    return pin;
+};
+
+const pnpmPathFor = (moduleDir: string): string => `${moduleDir}/${PNPM_DIR}`;
+
+const pnpmSources = (pin: PnpmPin, moduleDir: string): FlatpakModule[] => [
+    { type: "archive", url: `${PNPM_TARBALL_URL}${pin.version}.tgz`, sha512: pin.sha512, dest: PNPM_DIR },
+    {
+        type: "script",
+        dest: PNPM_DIR,
+        "dest-filename": PNPM_COMMAND,
+        commands: [`exec node ${pnpmPathFor(moduleDir)}/bin/pnpm.cjs "$@"`],
+    },
+];
+
+const pnpmInstallCommand = (pin: PnpmPin): string =>
+    pin.major === STORE_V11_MAJOR ? `${PNPM_INSTALL} ${TRUST_LOCKFILE}` : PNPM_INSTALL;
+
+const pnpmStoreVersionFor = (pin: PnpmPin): string =>
+    pin.major === STORE_V10_MAJOR ? STORE_V10 : STORE_V11;
+
+export {
+    pnpmInstallCommand,
+    pnpmPathFor,
+    type PnpmPin,
+    pnpmSources,
+    pnpmStoreVersionFor,
+    resolvePnpmPin,
+};