@pnpm/engine.pm.commands 1101.1.25 → 1101.2.1

package/lib/index.d.ts

@@ -1,5 +1,5 @@
 export { selfUpdate } from './self-updater/index.js';
-export { exePlatformPkgDirName, exePlatformPkgDirNameNext, installPnpm, installPnpmToStore, linkExePlatformBinary } from './self-updater/installPnpm.js';
+export { exePlatformPkgDirName, exePlatformPkgDirNameNext, installPnpm, installPnpmToStore, linkExePlatformBinary, pnpmPackageNameToInstall } from './self-updater/installPnpm.js';
 export { verifyPnpmEngineIdentity, type VerifyPnpmEngineIdentityOptions } from './self-updater/verifyPnpmEngineIdentity.js';
 export { setup } from './setup/index.js';
 export { withCmd } from './with/index.js';

package/lib/index.js

@@ -1,5 +1,5 @@
 export { selfUpdate } from './self-updater/index.js';
-export { exePlatformPkgDirName, exePlatformPkgDirNameNext, installPnpm, installPnpmToStore, linkExePlatformBinary } from './self-updater/installPnpm.js';
+export { exePlatformPkgDirName, exePlatformPkgDirNameNext, installPnpm, installPnpmToStore, linkExePlatformBinary, pnpmPackageNameToInstall } from './self-updater/installPnpm.js';
 export { verifyPnpmEngineIdentity } from './self-updater/verifyPnpmEngineIdentity.js';
 export { setup } from './setup/index.js';
 export { withCmd } from './with/index.js';

package/lib/self-updater/installPnpm.d.ts

@@ -3,6 +3,13 @@ import type { EnvLockfile } from '@pnpm/lockfile.types';
 import { type StoreController } from '@pnpm/store.controller';
 import type { Registries } from '@pnpm/types';
 import { type VerifyPnpmEngineIdentityOptions } from './verifyPnpmEngineIdentity.js';
+/**
+ * Package name to install for a switch to `pnpmVersion`. From v12 the unscoped
+ * `pnpm` is itself the native exe (equal content to `@pnpm/exe`), so v12+ always
+ * converges on `pnpm`, even from a SEA `@pnpm/exe` build. Earlier majors keep
+ * `pnpm` (JS) and `@pnpm/exe` (SEA) distinct, preserving the running identity.
+ */
+export declare function pnpmPackageNameToInstall(pnpmVersion: string): string;
 export interface InstallPnpmResult {
     binDir: string;
     baseDir: string;
@@ -52,10 +59,14 @@ export declare function installPnpmToStore(pnpmVersion: string, opts: {
  */
 export declare function exePlatformPkgDirName(platform: NodeJS.Platform, arch: string, libcFamily: string | null): string;
 /**
- * Future scope-local directory name of the `@pnpm/exe` platform package, under
- * the `exe.<platform>-<arch>[-musl]` scheme that matches the workspace
- * directory layout. `linkExePlatformBinary` checks this as a fallback so a
- * future rename of the published packages works without touching this logic.
+ * Scope-local directory name of the platform package under the
+ * `exe.<platform>-<arch>[-musl]` scheme, i.e. the published package
+ * `@pnpm/exe.<platform>-<arch>[-musl]`. pnpm v12 (the Rust port) ships its
+ * native binaries under exactly this convention, so `linkExePlatformBinary`
+ * relinks a v12 install with no v12-specific logic. `@pnpm/exe` (the
+ * TypeScript SEA build) is expected to adopt the same scheme in a future
+ * release, which is why the legacy `@pnpm/<os>-<arch>` name is still checked
+ * first as a fallback.
  */
 export declare function exePlatformPkgDirNameNext(platform: NodeJS.Platform, arch: string, libcFamily: string | null): string;
-export declare function linkExePlatformBinary(installDir: string): void;
+export declare function linkExePlatformBinary(installDir: string, wrapperPkgName?: string): void;

package/lib/self-updater/installPnpm.js

@@ -10,21 +10,35 @@ import { cleanOrphanedInstallDirs, createGlobalCacheKey, createInstallDir, findG
 import { headlessInstall } from '@pnpm/installing.deps-restorer';
 import { registerProject } from '@pnpm/store.controller';
 import { familySync } from 'detect-libc';
+import semver from 'semver';
 import { symlinkDir } from 'symlink-dir';
 import { verifyPnpmEngineIdentity } from './verifyPnpmEngineIdentity.js';
-// @pnpm/exe has platform-specific binaries, so its GVS hash must
-// include ENGINE_NAME for correct per-platform resolution.
-const PNPM_ALLOW_BUILDS = { '@pnpm/exe': true };
+// Both pnpm wrappers (`@pnpm/exe`, unscoped `pnpm`) carry platform-specific
+// binaries; marking them buildable puts ENGINE_NAME in the GVS hash so each
+// platform resolves to its own entry instead of colliding.
+const PNPM_ALLOW_BUILDS = { '@pnpm/exe': true, 'pnpm': true };
+/**
+ * Package name to install for a switch to `pnpmVersion`. From v12 the unscoped
+ * `pnpm` is itself the native exe (equal content to `@pnpm/exe`), so v12+ always
+ * converges on `pnpm`, even from a SEA `@pnpm/exe` build. Earlier majors keep
+ * `pnpm` (JS) and `@pnpm/exe` (SEA) distinct, preserving the running identity.
+ */
+export function pnpmPackageNameToInstall(pnpmVersion) {
+    const parsed = semver.parse(pnpmVersion, { loose: true });
+    if (parsed != null && parsed.major >= 12)
+        return 'pnpm';
+    return getCurrentPackageName();
+}
 /**
  * Installs pnpm to the global packages directory (for self-update).
  * Creates an entry in globalPkgDir that is visible to `pnpm ls -g`.
  */
 export async function installPnpm(pnpmVersion, opts) {
-    const currentPkgName = getCurrentPackageName();
+    const pkgName = pnpmPackageNameToInstall(pnpmVersion);
     const wantedLockfile = opts.envLockfile
-        ? buildLockfileFromEnvLockfile(opts.envLockfile, currentPkgName, pnpmVersion)
+        ? buildLockfileFromEnvLockfile(opts.envLockfile, pkgName, pnpmVersion)
         : undefined;
-    const result = await installPnpmToGlobalDir(opts, currentPkgName, pnpmVersion, wantedLockfile);
+    const result = await installPnpmToGlobalDir(opts, pkgName, pnpmVersion, wantedLockfile);
     return {
         alreadyExisted: result.alreadyExisted,
         baseDir: result.installDir,
@@ -37,12 +51,12 @@ export async function installPnpm(pnpmVersion, opts) {
  * Returns the bin directory where the pnpm binary can be found.
  */
 export async function installPnpmToStore(pnpmVersion, opts) {
-    const currentPkgName = getCurrentPackageName();
-    const wantedLockfile = buildLockfileFromEnvLockfile(opts.envLockfile, currentPkgName, pnpmVersion);
+    const pkgName = pnpmPackageNameToInstall(pnpmVersion);
+    const wantedLockfile = buildLockfileFromEnvLockfile(opts.envLockfile, pkgName, pnpmVersion);
     const globalVirtualStoreDir = path.join(opts.storeDir, 'links');
     // Compute the GVS hash for the pnpm package to find its path
-    const pnpmGvsPath = findPnpmGvsPath(wantedLockfile, currentPkgName, globalVirtualStoreDir, PNPM_ALLOW_BUILDS);
-    const pnpmPkgDir = path.join(pnpmGvsPath, 'node_modules', currentPkgName);
+    const pnpmGvsPath = findPnpmGvsPath(wantedLockfile, pkgName, globalVirtualStoreDir, PNPM_ALLOW_BUILDS);
+    const pnpmPkgDir = path.join(pnpmGvsPath, 'node_modules', pkgName);
     const binDir = path.join(pnpmGvsPath, 'bin');
     // Check if already installed in the GVS
     if (fs.existsSync(path.join(pnpmPkgDir, 'package.json'))) {
@@ -69,7 +83,7 @@ export async function installPnpmToStore(pnpmVersion, opts) {
             packageManager: opts.packageManager,
         });
         // Now the GVS should be populated — create bins alongside the GVS entry
-        linkExePlatformBinary(pnpmGvsPath);
+        linkExePlatformBinary(pnpmGvsPath, pkgName);
         await linkBins(path.join(pnpmGvsPath, 'node_modules'), binDir, { warn: noop });
         return { binDir };
     }
@@ -143,7 +157,7 @@ async function installPnpmToGlobalDir(opts, pkgName, version, wantedLockfile) {
         else {
             await installFromResolution(installDir, opts, [`${pkgName}@${version}`]);
         }
-        linkExePlatformBinary(installDir);
+        linkExePlatformBinary(installDir, pkgName);
         await linkBins(path.join(installDir, 'node_modules'), binDir, { warn: noop });
         // Create hash symlink for the global packages system
         const pkgJson = JSON.parse(fs.readFileSync(path.join(installDir, 'package.json'), 'utf8'));
@@ -258,42 +272,46 @@ function legacyOsSegment(platform, libcFamily) {
     }
 }
 /**
- * Future scope-local directory name of the `@pnpm/exe` platform package, under
- * the `exe.<platform>-<arch>[-musl]` scheme that matches the workspace
- * directory layout. `linkExePlatformBinary` checks this as a fallback so a
- * future rename of the published packages works without touching this logic.
+ * Scope-local directory name of the platform package under the
+ * `exe.<platform>-<arch>[-musl]` scheme, i.e. the published package
+ * `@pnpm/exe.<platform>-<arch>[-musl]`. pnpm v12 (the Rust port) ships its
+ * native binaries under exactly this convention, so `linkExePlatformBinary`
+ * relinks a v12 install with no v12-specific logic. `@pnpm/exe` (the
+ * TypeScript SEA build) is expected to adopt the same scheme in a future
+ * release, which is why the legacy `@pnpm/<os>-<arch>` name is still checked
+ * first as a fallback.
  */
 export function exePlatformPkgDirNameNext(platform, arch, libcFamily) {
     const normalizedArch = platform === 'win32' && arch === 'ia32' ? 'x86' : arch;
     const libcSuffix = platform === 'linux' && libcFamily === 'musl' ? '-musl' : '';
     return `exe.${platform}-${normalizedArch}${libcSuffix}`;
 }
-// @pnpm/exe bundles Node.js via optional platform-specific packages
-// (e.g. @pnpm/macos-arm64, @pnpm/linuxstatic-x64; or, after a future rename,
-// @pnpm/exe.darwin-arm64, @pnpm/exe.linux-x64-musl). Its postinstall script
-// links the correct binary into the @pnpm/exe package dir. Since scripts are
-// disabled during install (to support systems without Node.js), we replicate
-// that linking here, checking both naming schemes so self-update works across
-// the rename.
-export function linkExePlatformBinary(installDir) {
-    const exePkgDir = path.join(installDir, 'node_modules', '@pnpm', 'exe');
-    if (!fs.existsSync(exePkgDir))
+// The wrapper's preinstall links the platform binary into the wrapper dir, but
+// scripts are disabled during pnpm's own installs, so replicate it here — trying
+// the legacy and the newer `exe.<target>` platform-package names.
+export function linkExePlatformBinary(installDir, wrapperPkgName = '@pnpm/exe') {
+    const wrapperDir = path.join(installDir, 'node_modules', ...wrapperPkgName.split('/'));
+    if (!fs.existsSync(wrapperDir))
         return;
-    // In pnpm's symlinked node_modules layout, the platform package is not hoisted
-    // to the top-level node_modules. It's a dependency of @pnpm/exe and lives as a
-    // sibling in the virtual store. Resolve through the @pnpm/exe symlink to find it.
-    const exeRealDir = fs.realpathSync(exePkgDir);
     const platform = process.platform;
     const arch = process.arch;
     const libcFamily = familySync();
     const executable = platform === 'win32' ? 'pnpm.exe' : 'pnpm';
+    // Resolve the platform binary by its explicit adjacent path in the real
+    // virtual store, not via Node resolution: a `node_modules` walk could be
+    // shadowed by a higher-precedence `@pnpm/<dirName>` in a repo-controlled
+    // `store-dir`. `@pnpm/exe`'s parent is already `@pnpm`; `pnpm` descends into it.
+    const wrapperRealDir = fs.realpathSync(wrapperDir);
+    const scopeDir = wrapperPkgName.startsWith('@')
+        ? path.dirname(wrapperRealDir)
+        : path.join(path.dirname(wrapperRealDir), '@pnpm');
     const candidateDirNames = [
         exePlatformPkgDirName(platform, arch, libcFamily),
         exePlatformPkgDirNameNext(platform, arch, libcFamily),
     ];
     let src;
     for (const dirName of candidateDirNames) {
-        const candidate = path.join(path.dirname(exeRealDir), dirName, executable);
+        const candidate = path.join(scopeDir, dirName, executable);
         if (fs.existsSync(candidate)) {
             src = candidate;
             break;
@@ -301,27 +319,40 @@ export function linkExePlatformBinary(installDir) {
     }
     if (src == null)
         return;
-    const dest = path.join(exePkgDir, executable);
+    const dest = path.join(wrapperDir, executable);
     forceLink(src, dest);
     if (platform === 'win32') {
-        // Aliases (pn / pnpx / pnx) need to be .exe hardlinks of the SEA binary,
+        // Aliases (pn / pnpx / pnx) need to be .exe hardlinks of the native binary,
         // not the .cmd wrappers we ship in the tarball. cmd-shim's Bash shim for
         // a .cmd target wraps it in `exec cmd /C ...`, and MSYS2 / Git Bash
         // mangles `/C` into a Windows path — cmd.exe then falls into interactive
         // mode and prints its banner instead of running the alias. .exe sources
-        // sidestep cmd-shim's wrapper. The SEA binary detects which name it was
+        // sidestep cmd-shim's wrapper. The native binary detects which name it was
         // launched as via process.execPath and prepends `dlx` for pnpx / pnx.
         // See https://github.com/pnpm/pnpm/issues/11486.
         for (const alias of ['pn', 'pnpx', 'pnx']) {
-            forceLink(src, path.join(exePkgDir, `${alias}.exe`));
+            forceLink(src, path.join(wrapperDir, `${alias}.exe`));
+        }
+        const wrapperPkgJsonPath = path.join(wrapperDir, 'package.json');
+        const wrapperPkg = JSON.parse(fs.readFileSync(wrapperPkgJsonPath, 'utf8'));
+        wrapperPkg.bin.pnpm = 'pnpm.exe';
+        wrapperPkg.bin.pn = 'pn.exe';
+        wrapperPkg.bin.pnpx = 'pnpx.exe';
+        wrapperPkg.bin.pnx = 'pnx.exe';
+        // Temp file + rename, not in-place: package.json is hard-linked from the
+        // content-addressable store, so writing in place would mutate the shared blob.
+        const tempPkgJsonPath = `${wrapperPkgJsonPath}.pnpm-tmp`;
+        try {
+            fs.writeFileSync(tempPkgJsonPath, JSON.stringify(wrapperPkg, null, 2));
+            fs.renameSync(tempPkgJsonPath, wrapperPkgJsonPath);
+        }
+        catch (err) {
+            try {
+                fs.rmSync(tempPkgJsonPath, { force: true });
+            }
+            catch { }
+            throw err;
         }
-        const exePkgJsonPath = path.join(exePkgDir, 'package.json');
-        const exePkg = JSON.parse(fs.readFileSync(exePkgJsonPath, 'utf8'));
-        exePkg.bin.pnpm = 'pnpm.exe';
-        exePkg.bin.pn = 'pn.exe';
-        exePkg.bin.pnpx = 'pnpx.exe';
-        exePkg.bin.pnx = 'pnx.exe';
-        fs.writeFileSync(exePkgJsonPath, JSON.stringify(exePkg, null, 2));
     }
 }
 function forceLink(src, dest) {

package/lib/self-updater/selfUpdate.js

@@ -4,7 +4,7 @@ import { linkBins } from '@pnpm/bins.linker';
 import { isExecutedByCorepack, packageManager } from '@pnpm/cli.meta';
 import { docsUrl } from '@pnpm/cli.utils';
 import { parsePackageManager, shouldPersistLockfile, types as allTypes } from '@pnpm/config.reader';
-import { getPublishedByPolicy } from '@pnpm/config.version-policy';
+import { createPackageVersionPolicyOrThrow, getPublishedByPolicy } from '@pnpm/config.version-policy';
 import { PnpmError } from '@pnpm/error';
 import { createResolver, makeResolutionStrict } from '@pnpm/installing.client';
 import { resolvePackageManagerIntegrities } from '@pnpm/installing.env-installer';
@@ -52,9 +52,20 @@ export async function handler(opts, params) {
         throw new PnpmError('CANT_SELF_UPDATE_IN_COREPACK', 'You should update pnpm with corepack');
     }
     globalInfo('Checking for updates...');
+    // Resolve the engine version exactly as a regular install would. The
+    // no-downgrade trust check reads per-version trust evidence (`_npmUser` /
+    // `dist.attestations`) that abbreviated metadata never carries — so it
+    // always needs full metadata, regardless of `registrySupportsTimeField`
+    // (which only concerns the `time` field). Time-based resolution needs
+    // only `time`. `minimumReleaseAge` is handled by the resolver's on-demand
+    // abbreviated→full upgrade, so it isn't requested up front here.
+    const fullMetadata = (opts.trustPolicy === 'no-downgrade' ||
+        (opts.resolutionMode === 'time-based' && !opts.registrySupportsTimeField));
     const { resolve: baseResolve } = createResolver({
         ...opts,
         configByUri: opts.configByUri,
+        fullMetadata,
+        filterMetadata: fullMetadata,
         ignoreMissingTimeField: opts.minimumReleaseAgeIgnoreMissingTime,
     });
     // self-update has nowhere to "defer to" either — wrap the resolver
@@ -81,6 +92,15 @@ export async function handler(opts, params) {
         projectDir: opts.dir,
         publishedBy,
         publishedByExclude,
+        // Unlike `dlx` (whose real install re-resolves through the store
+        // controller), this `resolve` is self-update's only version selection,
+        // so the trust policy has to be passed here for the no-downgrade check
+        // to run.
+        trustPolicy: opts.trustPolicy,
+        trustPolicyExclude: opts.trustPolicyExclude
+            ? createPackageVersionPolicyOrThrow(opts.trustPolicyExclude, 'trustPolicyExclude')
+            : undefined,
+        trustPolicyIgnoreAfter: opts.trustPolicyIgnoreAfter,
     });
     if (!resolution?.manifest) {
         throw new PnpmError('CANNOT_RESOLVE_PNPM', `Cannot find "${bareSpecifier}" version of pnpm`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/engine.pm.commands",
-  "version": "1101.1.25",
+  "version": "1101.2.1",
   "description": "pnpm commands for self-updating and setting up pnpm",
   "keywords": [
     "pnpm",
@@ -36,29 +36,29 @@
     "semver": "^7.8.4",
     "symlink-dir": "^10.0.1",
     "@pnpm/bins.linker": "1100.0.16",
-    "@pnpm/config.reader": "1101.10.1",
+    "@pnpm/building.policy": "1100.0.12",
+    "@pnpm/cli.meta": "1100.0.8",
     "@pnpm/cli.utils": "1101.0.13",
     "@pnpm/config.pick-registry-for-package": "1100.0.9",
-    "@pnpm/deps.graph-hasher": "1100.2.6",
-    "@pnpm/cli.meta": "1100.0.8",
+    "@pnpm/config.reader": "1101.11.1",
+    "@pnpm/config.version-policy": "1100.1.6",
+    "@pnpm/deps.graph-hasher": "1100.2.8",
     "@pnpm/deps.security.signatures": "1101.2.3",
+    "@pnpm/global.packages": "1100.0.10",
+    "@pnpm/global.commands": "1100.0.32",
     "@pnpm/error": "1100.0.1",
-    "@pnpm/global.packages": "1100.0.9",
-    "@pnpm/installing.client": "1100.2.10",
-    "@pnpm/global.commands": "1100.0.30",
-    "@pnpm/lockfile.fs": "1100.1.7",
-    "@pnpm/installing.deps-restorer": "1102.1.1",
-    "@pnpm/installing.env-installer": "1102.0.2",
-    "@pnpm/lockfile.types": "1100.0.12",
+    "@pnpm/installing.env-installer": "1102.0.4",
+    "@pnpm/lockfile.fs": "1100.1.9",
+    "@pnpm/installing.deps-restorer": "1102.1.3",
+    "@pnpm/lockfile.types": "1100.0.13",
+    "@pnpm/resolving.npm-resolver": "1102.1.2",
     "@pnpm/shell.path": "1100.0.1",
-    "@pnpm/building.policy": "1100.0.11",
     "@pnpm/network.auth-header": "1101.1.3",
-    "@pnpm/store.controller": "1102.0.2",
-    "@pnpm/config.version-policy": "1100.1.6",
-    "@pnpm/resolving.npm-resolver": "1102.1.0",
-    "@pnpm/store.connection-manager": "1100.3.2",
+    "@pnpm/store.connection-manager": "1100.3.4",
     "@pnpm/types": "1101.3.2",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.14"
+    "@pnpm/workspace.project-manifest-reader": "1100.0.14",
+    "@pnpm/store.controller": "1102.0.3",
+    "@pnpm/installing.client": "1100.2.12"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0"
@@ -69,11 +69,11 @@
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/engine.pm.commands": "1101.1.25",
     "@pnpm/error": "1100.0.1",
-    "@pnpm/prepare": "1100.0.17",
-    "@pnpm/testing.mock-agent": "1101.0.4",
-    "@pnpm/logger": "1100.0.0"
+    "@pnpm/logger": "1100.0.0",
+    "@pnpm/engine.pm.commands": "1101.2.1",
+    "@pnpm/prepare": "1100.0.18",
+    "@pnpm/testing.mock-agent": "1101.0.4"
   },
   "engines": {
     "node": ">=22.13"