@pnpm/exe 12.0.0-rc.0 → 12.0.0-rc.10

package/README.md

@@ -51,6 +51,15 @@ To quote the [Rush](https://rushjs.io/) team:
           </picture>
         </a>
       </td>
+      <td align="center" valign="middle">
+        <a href="https://notion.com/?utm_source=pnpm&utm_medium=readme" target="_blank" rel="noopener noreferrer">
+          <picture>
+            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/notion.svg" />
+            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/notion_light.svg" />
+            <img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion" />
+          </picture>
+        </a>
+      </td>
     </tr>
   </tbody>
 </table>
@@ -130,6 +139,9 @@ To quote the [Rush](https://rushjs.io/) team:
           </picture>
         </a>
       </td>
+      <td align="center" valign="middle">
+        <a href="https://latitude.so/?utm_source=pnpm&utm_medium=readme" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a>
+      </td>
     </tr>
   </tbody>
 </table>

package/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,42 @@
+# Third-Party Notices
+
+This product includes software derived from third-party sources. The
+components below, and their license terms, are listed here in satisfaction
+of those terms.
+
+## Yarn (`@yarnpkg/nm`, `@yarnpkg/extensions`)
+
+- Source: <https://github.com/yarnpkg/berry>
+- License: BSD 2-Clause
+
+The `nodeLinker: hoisted` layout is produced by a Rust port of the hoisting
+algorithm in `@yarnpkg/nm`, and the built-in package-compatibility database
+is a copy of the one in `@yarnpkg/extensions`.
+
+```text
+BSD 2-Clause License
+
+Copyright (c) 2016-present, Yarn Contributors.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+```

package/bin/pnpm.mjs

@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+// Corepack's entry point into pnpm. Corepack hardcodes `./bin/pnpm.mjs` and
+// `./bin/pnpx.mjs` for every pnpm >=11 (see its `config.json`) and loads them
+// into its own Node.js process, which a native executable cannot be loaded into.
+//
+// Nothing else runs this file: `package.json#bin` still points at the native
+// binary, so an ordinary `npm install -g pnpm` never pays for a Node.js startup.
+//
+// Corepack installs no dependencies and runs no lifecycle scripts, so the
+// `@pnpm/exe.<target>` package that carries the binary is absent and
+// `install.js` never ran. The binary is therefore downloaded on first use and
+// kept next to this wrapper — where the native binary also finds the `dist/`
+// payload it ships node-gyp in.
+//
+// The download itself is `get-pnpm`, the package behind https://get.pnpm.io,
+// which already knows how to verify one; it travels in that same `dist/`
+// payload. What is left here is Corepack's environment, which it does not know:
+// where to download from, what credentials to use, and whose signature to trust.
+import { Buffer } from 'node:buffer'
+import { spawnSync } from 'node:child_process'
+import console from 'node:console'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import process from 'node:process'
+import { URL } from 'node:url'
+import { readWrapperManifest, resolveInstalledBinary, wrapperDir } from '../native-binary.mjs'
+
+// Deliberately not the `pnpm` placeholder that `install.js` overwrites: a name
+// of its own is what tells a downloaded binary apart from the placeholder.
+const DOWNLOADED_BINARY = path.join(
+  wrapperDir,
+  process.platform === 'win32' ? 'pnpm-native.exe' : 'pnpm-native'
+)
+const GET_PNPM = new URL('../dist/node_modules/get-pnpm/lib/index.js', import.meta.url)
+const DEFAULT_REGISTRY = 'https://registry.npmjs.org'
+
+run(await nativeBinary())
+
+function run (binary) {
+  // Ctrl-C reaches the whole foreground process group, so the binary gets its
+  // own SIGINT; exiting here first would hand the terminal back while it is
+  // still shutting down.
+  process.on('SIGINT', () => {})
+
+  const result = spawnSync(binary, process.argv.slice(2), { stdio: 'inherit' })
+  if (result.error != null) {
+    fail(`Could not run the pnpm binary at ${binary}: ${result.error.message}`)
+  }
+  process.exitCode = result.signal == null
+    ? result.status ?? 1
+    : 128 + (os.constants.signals[result.signal] ?? 0)
+}
+
+async function nativeBinary () {
+  const installed = resolveInstalledBinary()
+  if (installed != null) {
+    return installed
+  }
+  // A plain file, not merely something at that path: what a previous run left
+  // is a file, and a directory there would be spawned as if it were a binary.
+  if (fs.lstatSync(DOWNLOADED_BINARY, { throwIfNoEntry: false })?.isFile() === true) {
+    return DOWNLOADED_BINARY
+  }
+
+  if (process.env.COREPACK_ENABLE_NETWORK === '0') {
+    fail('Network access is disabled by the environment, so the pnpm binary cannot be downloaded.')
+  }
+
+  const { version } = readWrapperManifest()
+  console.error(`Downloading the pnpm ${version} binary for ${process.platform}-${process.arch}...`)
+  const { downloadPnpmExecutable } = await import(GET_PNPM).catch((err) => {
+    fail(`This copy of the pnpm package is missing the downloader it needs: ${err.message}`)
+  })
+  try {
+    await downloadPnpmExecutable({
+      version,
+      registry: process.env.COREPACK_NPM_REGISTRY || DEFAULT_REGISTRY,
+      destPath: DOWNLOADED_BINARY,
+      headers: registryHeaders(),
+      ...signaturePolicy(),
+    })
+  } catch (err) {
+    fail(`Could not download the pnpm ${version} binary: ${err.message}`)
+  }
+  return DOWNLOADED_BINARY
+}
+
+/**
+ * Credentials for the registry, read the way Corepack reads its own. `get-pnpm`
+ * keeps them on that registry's origin, so a download host it names never
+ * receives them.
+ */
+function registryHeaders () {
+  const { COREPACK_NPM_TOKEN, COREPACK_NPM_USERNAME, COREPACK_NPM_PASSWORD } = process.env
+  if (COREPACK_NPM_TOKEN) {
+    return { authorization: `Bearer ${COREPACK_NPM_TOKEN}` }
+  }
+  if (COREPACK_NPM_USERNAME && COREPACK_NPM_PASSWORD) {
+    const credentials = Buffer.from(`${COREPACK_NPM_USERNAME}:${COREPACK_NPM_PASSWORD}`, 'utf8')
+    return { authorization: `Basic ${credentials.toString('base64')}` }
+  }
+  return undefined
+}
+
+/**
+ * Whose signature over the download to trust, following `COREPACK_INTEGRITY_KEYS`
+ * exactly as Corepack does: npm's own keys when it is unset, the keys it names
+ * when it holds a key set, and no signature check at all when it is `0` or
+ * empty — which is the state a registry that re-publishes packages, and
+ * therefore carries no npm signatures, already has to be in for Corepack to
+ * have installed this wrapper from it.
+ */
+function signaturePolicy () {
+  const configured = process.env.COREPACK_INTEGRITY_KEYS
+  if (configured == null) {
+    return {}
+  }
+  if (configured === '' || configured === '0') {
+    return { verifySignature: false }
+  }
+  let keys
+  try {
+    keys = JSON.parse(configured).npm
+  } catch (err) {
+    fail(`COREPACK_INTEGRITY_KEYS is not readable as JSON: ${err.message}`)
+  }
+  // An absent or malformed `npm` entry would otherwise be passed on as no keys
+  // at all, which falls back to npm's own — the opposite of what setting the
+  // variable asked for. An empty set is left alone: it names no key to trust,
+  // and Corepack reads it the same way, so every download is refused.
+  if (!Array.isArray(keys)) {
+    fail('COREPACK_INTEGRITY_KEYS holds no "npm" key set to verify the pnpm binary against.')
+  }
+  return { keys }
+}
+
+function fail (message) {
+  console.error(message)
+  process.exit(1)
+}

package/bin/pnpx.mjs

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+// Corepack's `pnpx` entry point; see ./pnpm.mjs. The native binary infers the
+// `dlx` subcommand from the name it was launched under, which does not survive
+// being spawned from here, so inject it the way the `pnpx` shell script does.
+import process from 'node:process'
+
+process.argv = [...process.argv.slice(0, 2), 'dlx', ...process.argv.slice(2)]
+
+await import('./pnpm.mjs')

package/dist/node_modules/.bin/get-pnpm

@@ -0,0 +1,50 @@
+#!/bin/sh
+# Resolve $0 through symlinks so basedir is the shim's real directory.
+# Cap hops at the kernel's ELOOP limit so a cycle cannot hang the shim.
+link="$0"
+hops=0
+while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
+  hops=$((hops+1))
+  target=$(readlink "$link")
+  case "$target" in
+    /*) link="$target" ;;
+    *)  link="$(dirname "$link")/$target" ;;
+  esac
+done
+basedir=$(dirname "$(echo "$link" | sed -e 's,\\,/,g')")
+basedir_win="$basedir"
+exe=""
+msys=""
+
+case `uname -a` in
+  *CYGWIN*|*MINGW*|*MSYS*)
+    if command -v cygpath > /dev/null 2>&1; then
+      basedir_win=`cygpath -w "$basedir"`
+    fi
+    exe=".exe"
+    msys="true"
+  ;;
+  *WSL2*)
+    if command -v wslpath > /dev/null 2>&1; then
+      basedir_win="$(wslpath -w "$basedir" 2> /dev/null)"
+      if [ $? -ne 0 ] || [ -z "$basedir_win" ]; then
+        basedir_win="$basedir"
+      else
+        exe=".exe"
+      fi
+    fi
+  ;;
+esac
+
+if [ -n "$exe" ] && [ -x "$basedir/node.exe" ]; then
+  exec "$basedir/node.exe"  "$basedir_win/../get-pnpm/bin/get-pnpm.js" "$@"
+elif [ -x "$basedir/node" ]; then
+  exec "$basedir/node"  "$basedir/../get-pnpm/bin/get-pnpm.js" "$@"
+elif command -v node >/dev/null 2>&1; then
+  exec node  "$basedir/../get-pnpm/bin/get-pnpm.js" "$@"
+elif [ -n "$exe" ] && command -v node.exe >/dev/null 2>&1; then
+  exec node.exe  "$basedir_win/../get-pnpm/bin/get-pnpm.js" "$@"
+else
+  exec node  "$basedir/../get-pnpm/bin/get-pnpm.js" "$@"
+fi
+# cmd-shim-target=/home/runner/_work/pnpm/pnpm/pnpm/npm/pnpm/temp-deploy/node_modules/get-pnpm/bin/get-pnpm.js

package/dist/node_modules/.bin/node-gyp

@@ -1,5 +1,17 @@
 #!/bin/sh
-basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
+# Resolve $0 through symlinks so basedir is the shim's real directory.
+# Cap hops at the kernel's ELOOP limit so a cycle cannot hang the shim.
+link="$0"
+hops=0
+while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
+  hops=$((hops+1))
+  target=$(readlink "$link")
+  case "$target" in
+    /*) link="$target" ;;
+    *)  link="$(dirname "$link")/$target" ;;
+  esac
+done
+basedir=$(dirname "$(echo "$link" | sed -e 's,\\,/,g')")
 basedir_win="$basedir"
 exe=""
 msys=""

package/dist/node_modules/.bin/node-which

@@ -1,5 +1,17 @@
 #!/bin/sh
-basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
+# Resolve $0 through symlinks so basedir is the shim's real directory.
+# Cap hops at the kernel's ELOOP limit so a cycle cannot hang the shim.
+link="$0"
+hops=0
+while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
+  hops=$((hops+1))
+  target=$(readlink "$link")
+  case "$target" in
+    /*) link="$target" ;;
+    *)  link="$(dirname "$link")/$target" ;;
+  esac
+done
+basedir=$(dirname "$(echo "$link" | sed -e 's,\\,/,g')")
 basedir_win="$basedir"
 exe=""
 msys=""

package/dist/node_modules/.bin/nopt

@@ -1,5 +1,17 @@
 #!/bin/sh
-basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
+# Resolve $0 through symlinks so basedir is the shim's real directory.
+# Cap hops at the kernel's ELOOP limit so a cycle cannot hang the shim.
+link="$0"
+hops=0
+while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
+  hops=$((hops+1))
+  target=$(readlink "$link")
+  case "$target" in
+    /*) link="$target" ;;
+    *)  link="$(dirname "$link")/$target" ;;
+  esac
+done
+basedir=$(dirname "$(echo "$link" | sed -e 's,\\,/,g')")
 basedir_win="$basedir"
 exe=""
 msys=""

package/dist/node_modules/.bin/semver

@@ -1,5 +1,17 @@
 #!/bin/sh
-basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
+# Resolve $0 through symlinks so basedir is the shim's real directory.
+# Cap hops at the kernel's ELOOP limit so a cycle cannot hang the shim.
+link="$0"
+hops=0
+while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
+  hops=$((hops+1))
+  target=$(readlink "$link")
+  case "$target" in
+    /*) link="$target" ;;
+    *)  link="$(dirname "$link")/$target" ;;
+  esac
+done
+basedir=$(dirname "$(echo "$link" | sed -e 's,\\,/,g')")
 basedir_win="$basedir"
 exe=""
 msys=""

package/dist/node_modules/.package-map.json

@@ -1 +1 @@
-{"packages":{".":{"url":"..","dependencies":{"node-gyp":"node-gyp","pacquet":"."}},"@isaacs/fs-minipass":{"url":"./@isaacs/fs-minipass","dependencies":{"@isaacs/fs-minipass":"@isaacs/fs-minipass","minipass":"minipass"}},"abbrev":{"url":"./abbrev","dependencies":{"abbrev":"abbrev"}},"chownr":{"url":"./chownr","dependencies":{"chownr":"chownr"}},"env-paths":{"url":"./env-paths","dependencies":{"env-paths":"env-paths"}},"exponential-backoff":{"url":"./exponential-backoff","dependencies":{"exponential-backoff":"exponential-backoff"}},"fdir":{"url":"./fdir","dependencies":{"fdir":"fdir","picomatch":"picomatch"}},"graceful-fs":{"url":"./graceful-fs","dependencies":{"graceful-fs":"graceful-fs"}},"isexe":{"url":"./isexe","dependencies":{"isexe":"isexe"}},"minipass":{"url":"./minipass","dependencies":{"minipass":"minipass"}},"minizlib":{"url":"./minizlib","dependencies":{"minipass":"minipass","minizlib":"minizlib"}},"node-gyp":{"url":"./node-gyp","dependencies":{"env-paths":"env-paths","exponential-backoff":"exponential-backoff","graceful-fs":"graceful-fs","node-gyp":"node-gyp","nopt":"nopt","proc-log":"proc-log","semver":"semver","tar":"tar","tinyglobby":"tinyglobby","undici":"undici","which":"which"}},"nopt":{"url":"./nopt","dependencies":{"abbrev":"abbrev","nopt":"nopt"}},"picomatch":{"url":"./picomatch","dependencies":{"picomatch":"picomatch"}},"proc-log":{"url":"./proc-log","dependencies":{"proc-log":"proc-log"}},"semver":{"url":"./semver","dependencies":{"semver":"semver"}},"tar":{"url":"./tar","dependencies":{"@isaacs/fs-minipass":"@isaacs/fs-minipass","chownr":"chownr","minipass":"minipass","minizlib":"minizlib","tar":"tar","yallist":"yallist"}},"tinyglobby":{"url":"./tinyglobby","dependencies":{"fdir":"fdir","picomatch":"picomatch","tinyglobby":"tinyglobby"}},"undici":{"url":"./undici","dependencies":{"undici":"undici"}},"which":{"url":"./which","dependencies":{"isexe":"isexe","which":"which"}},"yallist":{"url":"./yallist","dependencies":{"yallist":"yallist"}}}}
+{"packages":{".":{"url":"..","dependencies":{"get-pnpm":"get-pnpm","node-gyp":"node-gyp","pacquet":"."}},"@isaacs/fs-minipass":{"url":"./@isaacs/fs-minipass","dependencies":{"@isaacs/fs-minipass":"@isaacs/fs-minipass","minipass":"minipass"}},"abbrev":{"url":"./abbrev","dependencies":{"abbrev":"abbrev"}},"chownr":{"url":"./chownr","dependencies":{"chownr":"chownr"}},"env-paths":{"url":"./env-paths","dependencies":{"env-paths":"env-paths"}},"exponential-backoff":{"url":"./exponential-backoff","dependencies":{"exponential-backoff":"exponential-backoff"}},"fdir":{"url":"./fdir","dependencies":{"fdir":"fdir","picomatch":"picomatch"}},"get-pnpm":{"url":"./get-pnpm","dependencies":{"get-pnpm":"get-pnpm"}},"graceful-fs":{"url":"./graceful-fs","dependencies":{"graceful-fs":"graceful-fs"}},"isexe":{"url":"./isexe","dependencies":{"isexe":"isexe"}},"minipass":{"url":"./minipass","dependencies":{"minipass":"minipass"}},"minizlib":{"url":"./minizlib","dependencies":{"minipass":"minipass","minizlib":"minizlib"}},"node-gyp":{"url":"./node-gyp","dependencies":{"env-paths":"env-paths","exponential-backoff":"exponential-backoff","graceful-fs":"graceful-fs","node-gyp":"node-gyp","nopt":"nopt","proc-log":"proc-log","semver":"semver","tar":"tar","tinyglobby":"tinyglobby","undici":"undici","which":"which"}},"nopt":{"url":"./nopt","dependencies":{"abbrev":"abbrev","nopt":"nopt"}},"picomatch":{"url":"./picomatch","dependencies":{"picomatch":"picomatch"}},"proc-log":{"url":"./proc-log","dependencies":{"proc-log":"proc-log"}},"semver":{"url":"./semver","dependencies":{"semver":"semver"}},"tar":{"url":"./tar","dependencies":{"@isaacs/fs-minipass":"@isaacs/fs-minipass","chownr":"chownr","minipass":"minipass","minizlib":"minizlib","tar":"tar","yallist":"yallist"}},"tinyglobby":{"url":"./tinyglobby","dependencies":{"fdir":"fdir","picomatch":"picomatch","tinyglobby":"tinyglobby"}},"undici":{"url":"./undici","dependencies":{"undici":"undici"}},"which":{"url":"./which","dependencies":{"isexe":"isexe","which":"which"}},"yallist":{"url":"./yallist","dependencies":{"yallist":"yallist"}}}}

package/dist/node_modules/.pnpm-workspace-state-v1.json

@@ -1,9 +1,9 @@
 {
-  "lastValidatedTimestamp": 1785959121488,
+  "lastValidatedTimestamp": 1787583189427,
   "projects": {
     "/home/runner/_work/pnpm/pnpm/pnpm/npm/pnpm/temp-deploy": {
       "name": "pacquet",
-      "version": "12.0.0-rc.0"
+      "version": "12.0.0-rc.10"
     }
   },
   "pnpmfiles": [],
@@ -22,12 +22,12 @@
       "default": {
         "@babel/core": "^7.29.7",
         "@babel/plugin-transform-explicit-resource-management": "^7.29.7",
-        "@commitlint/cli": "^21.2.1",
-        "@commitlint/config-conventional": "^21.2.0",
-        "@commitlint/prompt-cli": "^21.2.0",
-        "@cyclonedx/cyclonedx-library": "10.1.0",
+        "@commitlint/cli": "^21.2.2",
+        "@commitlint/config-conventional": "^21.2.2",
+        "@commitlint/prompt-cli": "^21.2.2",
+        "@cyclonedx/cyclonedx-library": "10.2.0",
         "@eslint/js": "^10.0.1",
-        "@inquirer/prompts": "^8.5.2",
+        "@inquirer/prompts": "^8.6.0",
         "@jest/globals": "30.4.1",
         "@npm/types": "^2.1.0",
         "@openpgp/web-stream-tools": "0.3.1",
@@ -47,7 +47,7 @@
         "@pnpm/tabtab": "^0.5.4",
         "@pnpm/tgz-fixtures": "0.0.0",
         "@reflink/reflink": "0.1.19",
-        "@rushstack/worker-pool": "0.7.22",
+        "@rushstack/worker-pool": "0.7.25",
         "@stylistic/eslint-plugin": "^5.10.0",
         "@types/adm-zip": "^0.5.8",
         "@types/archy": "0.0.36",
@@ -86,14 +86,14 @@
         "@types/write-file-atomic": "^4.0.3",
         "@types/yarnpkg__lockfile": "^1.1.9",
         "@types/zkochan__table": "npm:@types/table@6.3.2",
-        "@typescript-eslint/utils": "^8.66.0",
+        "@typescript-eslint/utils": "^8.67.0",
         "@typescript/native-preview": "7.0.0-dev.20260707.2",
         "@yarnpkg/core": "4.9.1",
         "@yarnpkg/extensions": "2.0.7",
         "@yarnpkg/lockfile": "^1.1.0",
         "@yarnpkg/nm": "4.1.1",
         "@yarnpkg/pnp": "^4.1.7",
-        "@zkochan/cmd-shim": "^9.0.6",
+        "@zkochan/cmd-shim": "^9.0.7",
         "@zkochan/retry": "^0.2.0",
         "@zkochan/rimraf": "^4.0.0",
         "@zkochan/table": "^2.0.1",
@@ -127,12 +127,12 @@
         "dir-is-case-sensitive": "^3.0.0",
         "empathic": "^2.0.1",
         "encode-registry": "^3.0.1",
-        "esbuild": "^0.28.1",
+        "esbuild": "^0.28.2",
         "escape-string-regexp": "^5.0.0",
-        "eslint": "^10.8.0",
+        "eslint": "^10.9.0",
         "eslint-plugin-import-x": "^4.17.1",
-        "eslint-plugin-jest": "^29.16.0",
-        "eslint-plugin-n": "^18.2.2",
+        "eslint-plugin-jest": "^29.16.1",
+        "eslint-plugin-n": "^18.3.0",
         "eslint-plugin-promise": "^7.3.0",
         "eslint-plugin-regexp": "^3.1.1",
         "eslint-plugin-simple-import-sort": "^14.0.0",
@@ -142,14 +142,14 @@
         "fast-glob": "^3.3.3",
         "fs-extra": "^11.4.0",
         "fuse-native": "^2.2.6",
+        "get-pnpm": "^0.0.3",
         "get-port": "^7.2.0",
         "ghooks": "2.0.4",
         "graceful-fs": "^4.2.11",
-        "graceful-git": "^5.0.0",
         "graph-cycles": "3.0.0",
         "hosted-git-info": "npm:@pnpm/hosted-git-info@1.0.0",
         "https-proxy-server-express": "0.1.2",
-        "human-id": "^4.2.0",
+        "human-id": "^4.2.1",
         "husky": "^9.1.7",
         "hyperdrive-schemas": "^2.0.0",
         "ini": "6.0.0",
@@ -184,13 +184,12 @@
         "npm-packlist": "10.0.4",
         "npm-registry-fetch": "^19.0.0",
         "object-hash": "3.0.0",
-        "open": "^11.0.0",
+        "open": "^11.0.1",
         "openpgp": "^6.3.1",
         "p-defer": "^4.0.1",
         "p-every": "^2.0.0",
         "p-filter": "^4.1.0",
         "p-limit": "^7.3.1",
-        "p-map-values": "^0.1.0",
         "p-queue": "^9.3.3",
         "parse-json": "^8.3.0",
         "parse-npm-tarball-url": "^5.0.0",
@@ -248,8 +247,8 @@
         "tree-kill": "^1.2.2",
         "ts-jest-resolver": "2.0.1",
         "typescript": "6.0.3",
-        "typescript-eslint": "^8.66.0",
-        "undici": "^7.27.2",
+        "typescript-eslint": "^8.67.0",
+        "undici": "^7.29.0",
         "unified": "^11.0.5",
         "validate-npm-package-name": "7.0.2",
         "version-selector-type": "^3.0.0",
@@ -278,7 +277,47 @@
     "injectWorkspacePackages": false,
     "linkWorkspacePackages": false,
     "minimumReleaseAge": 1440,
+    "minimumReleaseAgeExclude": [
+      "@pnpm/*",
+      "@zkochan/*",
+      "better-path-resolve",
+      "can-link",
+      "can-write-to-dir",
+      "cmd-extension",
+      "comver-to-semver",
+      "dir-is-case-sensitive",
+      "@esbuild/*",
+      "glob@11.1.0",
+      "is-inner-link",
+      "is-subdir",
+      "make-empty-dir",
+      "normalize-registry-url",
+      "parse-npm-tarball-url@5.0.0",
+      "path-absolute",
+      "path-temp",
+      "pnpm",
+      "preferred-pm",
+      "promise-share",
+      "read-ini-file",
+      "read-yaml-file",
+      "realpath-missing",
+      "rename-overwrite",
+      "render-help",
+      "resolve-link-target",
+      "root-link-target",
+      "run-groups",
+      "safe-execa",
+      "safe-promise-defer",
+      "symlink-dir",
+      "which-pm",
+      "write-ini-file",
+      "write-json5-file",
+      "write-yaml-file",
+      "http-proxy-middleware@3.0.7",
+      "get-pnpm@0.0.3"
+    ],
     "minimumReleaseAgeIgnoreMissingTime": true,
+    "minimumReleaseAgeStrict": true,
     "nodeLinker": "hoisted",
     "optional": true,
     "patchedDependencies": {
@@ -288,6 +327,16 @@
     "peersSuffixMaxLength": 1000,
     "preferWorkspacePackages": false,
     "production": true,
-    "publicHoistPattern": []
+    "publicHoistPattern": [],
+    "trustPolicy": "no-downgrade",
+    "trustPolicyExclude": [
+      "@pnpm/*",
+      "@yarnpkg/libzip@3.2.2",
+      "pnpm",
+      "rxjs@7.8.2",
+      "tinyexec@1.2.2",
+      "undici-types@6.21.0"
+    ],
+    "trustPolicyIgnoreAfter": 10080
   }
 }

package/dist/node_modules/get-pnpm/bin/get-pnpm.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import { runCli } from '../lib/index.js'
+
+try {
+  process.exitCode = await runCli(process.argv.slice(2))
+} catch (err) {
+  // Anything can be thrown, and reading `.message` off a non-Error would either
+  // print `undefined` or throw again, burying the reason under a stack trace.
+  console.error(err instanceof Error ? err.message : String(err))
+  process.exitCode = 1
+}

package/dist/node_modules/get-pnpm/lib/downloadExecutable.js

@@ -0,0 +1,99 @@
+import { randomBytes } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { extractTarballMember } from './extractTarballMember.js';
+import { isMusl, platformPackageName } from './platformPackageName.js';
+import { downloadTarball, fetchVersionMeta, normalizeRegistry } from './registry.js';
+import { majorVersion } from './resolveVersion.js';
+import { sameFileContents } from './sameFileContents.js';
+import { verifyRegistrySignature } from './verifySignature.js';
+/** Name the executable is published under inside its platform package. */
+function executableName() {
+    return process.platform === 'win32' ? 'pnpm.exe' : 'pnpm';
+}
+/**
+ * Places the pnpm executable for this host at `destPath`, and nothing else.
+ *
+ * The narrow half of {@link downloadPnpm}, for a caller that already knows the
+ * exact version and already has whatever else it needs: no dist-tag lookup (so
+ * no packument download), no `dist/` tree, no directory to assemble. Corepack
+ * is the case it exists for — it unpacks the `pnpm` package itself but installs
+ * none of its dependencies, so the executable has to arrive separately.
+ *
+ * The download is checked against the checksum the registry published for it,
+ * and that checksum against npm's signature, exactly as {@link downloadPnpm}
+ * does; nothing is written to `destPath` until both pass. See
+ * {@link DownloadExecutableOptions.verifySignature} for the one waiver.
+ *
+ * Placement is atomic and tolerates losing a race: a concurrent call that got
+ * there first keeps its copy, since both placed the same verified bytes.
+ *
+ * @returns the package the executable came from.
+ */
+export async function downloadPnpmExecutable(opts) {
+    const { version, destPath } = opts;
+    const registry = normalizeRegistry(opts.registry);
+    const packageName = platformPackageName({
+        major: majorVersion(version),
+        platform: process.platform,
+        arch: process.arch,
+        musl: isMusl(),
+    });
+    const meta = await fetchVersionMeta(registry, packageName, version, opts.headers);
+    if (!meta.dist.integrity) {
+        throw new Error(`The npm registry published no checksum for ${packageName}@${version}, so it cannot be verified.`);
+    }
+    if (opts.verifySignature !== false) {
+        verifyRegistrySignature({
+            name: packageName,
+            version,
+            integrity: meta.dist.integrity,
+            signatures: meta.dist.signatures,
+            keys: opts.keys,
+        });
+    }
+    const scratch = `${destPath}.${randomBytes(6).toString('hex')}`;
+    const tarball = `${scratch}.tgz`;
+    const staged = `${scratch}.tmp`;
+    fs.mkdirSync(path.dirname(destPath), { recursive: true });
+    try {
+        await downloadTarball(meta, tarball, { registry, headers: opts.headers });
+        const member = `package/${executableName()}`;
+        if (!await extractTarballMember(tarball, member, staged, 0o755)) {
+            throw new Error(`The ${packageName}@${version} tarball contains no ${member}.`);
+        }
+        place(staged, destPath);
+    }
+    finally {
+        fs.rmSync(tarball, { force: true });
+        fs.rmSync(staged, { force: true });
+    }
+    return { packageName };
+}
+/**
+ * The codes Windows fails a rename with when the destination is held open —
+ * which is what a concurrent call executing the copy it just placed looks like.
+ * POSIX replaces the destination instead, so a failure there is a real one.
+ */
+const DESTINATION_IN_USE = new Set(['EPERM', 'EACCES', 'EBUSY']);
+/**
+ * Moves the verified executable into place, keeping the copy a concurrent call
+ * placed if that is what stops the rename.
+ *
+ * A lost race is not assumed from the failure alone: the copy already there has
+ * to hold the same bytes as the one just verified, or this call has no idea
+ * what it would be reporting success for. Anything else — no permission on the
+ * directory, a directory or an unrelated file at `destPath` — is a failure.
+ */
+function place(staged, destPath) {
+    try {
+        fs.renameSync(staged, destPath);
+    }
+    catch (err) {
+        const code = err.code ?? '';
+        if (!DESTINATION_IN_USE.has(code))
+            throw err;
+        if (!sameFileContents(staged, destPath))
+            throw err;
+    }
+}