@pnpm/exe 12.0.0-rc.0 → 12.0.0-rc.10

package/dist/node_modules/get-pnpm/lib/extractTarball.js

@@ -0,0 +1,23 @@
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+/**
+ * Unpacks a package tarball into `dest`, leaving its `package/` root in place.
+ *
+ * Shells out to `tar`, which every supported host has: macOS and Linux ship it,
+ * and Windows has had bsdtar since Windows 10 1803. Member selection and
+ * `--strip-components` are avoided because busybox tar and bsdtar disagree
+ * about them.
+ */
+export function extractTarball(tarball, dest) {
+    fs.mkdirSync(dest, { recursive: true });
+    const { error, status, stderr } = spawnSync('tar', ['-xzf', tarball, '-C', dest], { encoding: 'utf8' });
+    if (error != null) {
+        if (error.code === 'ENOENT') {
+            throw new Error('This installer needs the `tar` command, which was not found on your PATH.');
+        }
+        throw error;
+    }
+    if (status !== 0) {
+        throw new Error(`Could not extract ${tarball}: ${stderr.trim()}`);
+    }
+}

package/dist/node_modules/get-pnpm/lib/extractTarballMember.js

@@ -0,0 +1,128 @@
+import { createReadStream, createWriteStream } from 'node:fs';
+import { pipeline } from 'node:stream/promises';
+import { createGunzip } from 'node:zlib';
+const BLOCK_SIZE = 512;
+/** Regular file, in both the old (`\0`) and the ustar (`0`) spelling. */
+const FILE_TYPES = new Set(['0', '\0']);
+/**
+ * Writes one file out of a package tarball to `dest`, and nothing else.
+ *
+ * Reads the archive in-process rather than shelling out to `tar` the way
+ * {@link extractTarball} does: a caller that wants a single executable, in an
+ * environment it does not control (a Corepack cache in a minimal image), should
+ * not need a `tar` on the PATH for it. Only regular files are considered, which
+ * is all an npm tarball holds beyond directories, and the parse stays streaming
+ * so the archive never lands in memory.
+ *
+ * `dest` is created exclusively — an existing file, or a symlink planted at
+ * that path, fails the write rather than being followed.
+ *
+ * @param tarball Path to the gzipped archive.
+ * @param memberPath Path of the wanted file inside it, e.g. `package/pnpm`.
+ * @param dest Path to write it to.
+ * @param mode Permissions for `dest`.
+ * @returns whether the member was there.
+ */
+export async function extractTarballMember(tarball, memberPath, dest, mode = 0o644) {
+    let found = false;
+    await pipeline(createReadStream(tarball), createGunzip(), async function (source) {
+        const reader = new BlockReader(source);
+        while (true) {
+            const header = await reader.read(BLOCK_SIZE);
+            // The archive ends with zero-filled blocks; one is enough to stop.
+            if (header == null || header[0] === 0)
+                return;
+            const entry = parseHeader(header);
+            if (FILE_TYPES.has(entry.type) && entry.path === memberPath) {
+                const written = await reader.pipe(entry.size, createWriteStream(dest, { flags: 'wx', mode }));
+                if (written !== entry.size) {
+                    throw new Error(`${tarball} ends after ${written} of the ${entry.size} bytes it declares for ${memberPath}.`);
+                }
+                found = true;
+                // The rest of the archive holds nothing this caller asked for, and
+                // the checksum that vouches for it was checked before any of it was
+                // read.
+                return;
+            }
+            await reader.skip(Math.ceil(entry.size / BLOCK_SIZE) * BLOCK_SIZE);
+        }
+    });
+    return found;
+}
+function parseHeader(header) {
+    const name = readString(header, 0, 100);
+    const prefix = readString(header, 345, 155);
+    return {
+        path: prefix === '' ? name : `${prefix}/${name}`,
+        size: parseInt(readString(header, 124, 12).trim() || '0', 8),
+        type: String.fromCharCode(header[156]),
+    };
+}
+function readString(header, start, length) {
+    const field = header.subarray(start, start + length);
+    const end = field.indexOf(0);
+    return field.toString('utf8', 0, end === -1 ? field.length : end);
+}
+class BlockReader {
+    #iterator;
+    #buffered = [];
+    #buffedBytes = 0;
+    #done = false;
+    constructor(source) {
+        this.#iterator = source[Symbol.asyncIterator]();
+    }
+    /** The next `size` bytes, or `null` once the stream ends. */
+    async read(size) {
+        if (!await this.#fill(size))
+            return null;
+        return this.#take(size);
+    }
+    async skip(size) {
+        let left = size;
+        while (left > 0) {
+            if (!await this.#fill(1))
+                return;
+            left -= this.#take(Math.min(left, this.#buffedBytes)).length;
+        }
+    }
+    /**
+     * Hands the next `size` bytes to `destination`, without collecting them.
+     *
+     * @returns how many bytes there were, which is fewer than `size` only when
+     * the stream ended early.
+     */
+    async pipe(size, destination) {
+        const self = this;
+        let left = size;
+        await pipeline(async function* () {
+            while (left > 0) {
+                if (!await self.#fill(1))
+                    return;
+                const chunk = self.#take(Math.min(left, self.#buffedBytes));
+                left -= chunk.length;
+                yield chunk;
+            }
+        }, destination);
+        return size - left;
+    }
+    /** Reads until at least `size` bytes are buffered, or the stream ends. */
+    async #fill(size) {
+        while (this.#buffedBytes < size && !this.#done) {
+            const { value, done } = await this.#iterator.next();
+            if (done === true) {
+                this.#done = true;
+            }
+            else {
+                this.#buffered.push(value);
+                this.#buffedBytes += value.length;
+            }
+        }
+        return this.#buffedBytes >= size;
+    }
+    #take(size) {
+        const joined = this.#buffered.length === 1 ? this.#buffered[0] : Buffer.concat(this.#buffered);
+        this.#buffered = joined.length > size ? [joined.subarray(size)] : [];
+        this.#buffedBytes = joined.length - size;
+        return joined.subarray(0, size);
+    }
+}

package/dist/node_modules/get-pnpm/lib/index.js

@@ -0,0 +1,208 @@
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { extractTarball } from './extractTarball.js';
+import { isMusl, platformPackageName } from './platformPackageName.js';
+import { downloadTarball, fetchPackument, fetchVersionMeta, registryFromEnv } from './registry.js';
+import { majorVersion, resolveVersion } from './resolveVersion.js';
+import { verifyRegistrySignature } from './verifySignature.js';
+export { downloadPnpmExecutable } from './downloadExecutable.js';
+export { extractTarballMember } from './extractTarballMember.js';
+export { isMusl, platformPackageName } from './platformPackageName.js';
+export { DEFAULT_REGISTRY, registryFromEnv } from './registry.js';
+export { majorVersion, resolveVersion } from './resolveVersion.js';
+export { verifyRegistrySignature } from './verifySignature.js';
+/**
+ * The package whose dist-tags name every pnpm release. `@pnpm/exe` carries the
+ * same versions today, but only `pnpm` is published from v12 onward, so its
+ * tags are the ones that cannot go stale.
+ */
+const CLI_PKG_NAME = 'pnpm';
+/** Holds the unpacked tarballs while the installation is assembled beside it. */
+const UNPACK_DIR = '.unpack';
+/** Where the `dist/` tree that ships beside the executable is published. */
+function wrapperPackageName(major) {
+    return major >= 12 ? CLI_PKG_NAME : '@pnpm/exe';
+}
+const USAGE = `Usage: npx get-pnpm [version]
+
+Installs pnpm as a standalone executable and adds it to your PATH.
+
+Arguments:
+  version            An exact version (11.20.0), a major (12), or a dist-tag
+                     (latest, next-12). Defaults to $PNPM_VERSION, then "latest".
+
+Environment variables:
+  PNPM_VERSION           Version to install when no argument is given.
+  PNPM_HOME              Directory to install pnpm into.
+  npm_config_registry    Registry to download pnpm from.
+`;
+export async function runCli(argv) {
+    const positional = [];
+    for (const arg of argv) {
+        if (arg === '--help' || arg === '-h') {
+            console.log(USAGE);
+            return 0;
+        }
+        if (arg.startsWith('-')) {
+            throw new Error(`Unknown option "${arg}".\n\n${USAGE}`);
+        }
+        positional.push(arg);
+    }
+    if (positional.length > 1) {
+        throw new Error(`Expected at most one version, got ${positional.length}.\n\n${USAGE}`);
+    }
+    return installPnpm({
+        versionSpec: positional[0] ?? process.env.PNPM_VERSION ?? 'latest',
+        registry: registryFromEnv(),
+    });
+}
+/**
+ * Downloads the pnpm executable and hands over to `pnpm setup`, which installs
+ * it globally and puts it on the PATH.
+ *
+ * Every download is checked against the checksum the registry published for it,
+ * and that checksum against npm's signature — see `verifyRegistrySignature`.
+ *
+ * The temporary directory is assembled to look like the release tarball that
+ * https://get.pnpm.io/install.sh downloads — the executable next to its `dist/`
+ * tree — because `pnpm setup` installs that directory as-is.
+ *
+ * @returns the exit code of `pnpm setup`.
+ */
+export async function installPnpm(opts) {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pnpm-install-'));
+    const removeTmpDir = () => {
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    };
+    // Registered for the duration of the call and no longer: this is also a
+    // library function, and handlers left behind would accumulate and outlive the
+    // directory they exist to clean up.
+    const signals = ['SIGINT', 'SIGTERM', 'SIGHUP'];
+    const onSignal = () => {
+        removeTmpDir();
+        process.exit(1);
+    };
+    for (const signal of signals) {
+        process.once(signal, onSignal);
+    }
+    try {
+        const { binPath } = await downloadPnpm({ ...opts, dest: tmpDir });
+        const { error, status } = spawnSync(binPath, ['setup', '--force'], { stdio: 'inherit' });
+        if (error != null)
+            throw error;
+        return status ?? 1;
+    }
+    finally {
+        for (const signal of signals) {
+            process.off(signal, onSignal);
+        }
+        removeTmpDir();
+    }
+}
+/**
+ * Downloads the pnpm executable into `dest`, laid out the way the release
+ * tarball lays it out — the executable next to the `dist/` tree it loads.
+ *
+ * Every download is checked against the checksum the registry published for it,
+ * and that checksum against npm's signature; see `verifyRegistrySignature`.
+ * Nothing outside `dest` is touched, so a caller that manages its own PATH — a
+ * CI action, say — can use this without the global install `installPnpm` does.
+ *
+ * @returns the version installed and the path to the executable.
+ */
+export async function downloadPnpm(opts) {
+    const packument = await fetchPackument(opts.registry, CLI_PKG_NAME);
+    const version = resolveVersion(packument, opts.versionSpec);
+    const major = majorVersion(version);
+    const platformPkgName = platformPackageName({
+        major,
+        platform: process.platform,
+        arch: process.arch,
+        musl: isMusl(),
+    });
+    const { dest } = opts;
+    fs.mkdirSync(dest, { recursive: true });
+    try {
+        console.log(`==> Downloading pnpm ${version}`);
+        const executable = process.platform === 'win32' ? 'pnpm.exe' : 'pnpm';
+        const fetchPackage = verifiedPackageFetcher({ dir: dest, registry: opts.registry, version, keys: opts.keys });
+        // Settled, not `all`: a rejection there would leave the other fetch writing
+        // into the directory the `finally` below is about to remove.
+        const [platformResult, wrapperResult] = await Promise.allSettled([
+            fetchPackage(platformPkgName),
+            // v11 was the first release to keep files next to the executable; up to
+            // v10 the executable is self-contained and ships no `dist/`.
+            major >= 11 ? fetchPackage(wrapperPackageName(major)) : Promise.resolve(undefined),
+        ]);
+        if (platformResult.status === 'rejected')
+            throw platformResult.reason;
+        if (wrapperResult.status === 'rejected')
+            throw wrapperResult.reason;
+        const platformPkg = platformResult.value;
+        const wrapperPkg = wrapperResult.value;
+        const binPath = path.join(dest, executable);
+        fs.renameSync(path.join(platformPkg.dir, executable), binPath);
+        fs.chmodSync(binPath, 0o755);
+        if (wrapperPkg != null) {
+            fs.rmSync(path.join(dest, 'dist'), { recursive: true, force: true });
+            fs.renameSync(path.join(wrapperPkg.dir, 'dist'), path.join(dest, 'dist'));
+            writeManifest({ dest, executable, version, wrapperDir: wrapperPkg.dir, major });
+        }
+        return { version, binPath };
+    }
+    finally {
+        // `pnpm setup` installs this directory as a package, so nothing may be left
+        // in it that does not belong in the installation.
+        fs.rmSync(path.join(dest, UNPACK_DIR), { recursive: true, force: true });
+    }
+}
+/**
+ * `pnpm setup` installs the directory as a package, writing a minimal manifest
+ * when there is none — which is what the release tarball relies on. That
+ * tarball bundles the runtime dependencies inside `dist/`; the registry copy
+ * declares them instead, so up to v11 they have to be declared here or the
+ * install silently loses them (`@reflink/reflink`, and with it copy-on-write
+ * cloning). From v12 the `dist/` tree is self-contained again, so the manifest
+ * `setup` writes is left to it.
+ */
+function writeManifest(opts) {
+    if (opts.major >= 12)
+        return;
+    const wrapper = JSON.parse(fs.readFileSync(path.join(opts.wrapperDir, 'package.json'), 'utf8'));
+    if (wrapper.dependencies == null)
+        return;
+    fs.writeFileSync(path.join(opts.dest, 'package.json'), JSON.stringify({
+        name: '@pnpm/exe',
+        version: opts.version,
+        type: 'module',
+        bin: { pnpm: opts.executable, pn: opts.executable },
+        dependencies: wrapper.dependencies,
+    }));
+}
+/** Downloads packages of one version into one directory, verifying each. */
+function verifiedPackageFetcher(opts) {
+    return async function fetchPackage(pkgName) {
+        const meta = await fetchVersionMeta(opts.registry, pkgName, opts.version);
+        if (!meta.dist.integrity) {
+            throw new Error(`The npm registry published no checksum for ${pkgName}@${opts.version}, so it cannot be verified.`);
+        }
+        verifyRegistrySignature({
+            name: pkgName,
+            version: opts.version,
+            integrity: meta.dist.integrity,
+            signatures: meta.dist.signatures,
+            keys: opts.keys,
+        });
+        // Unpack away from the directory being assembled: `pnpm` is both a package
+        // name and the name of the executable that ends up beside it.
+        const unpackDir = path.join(opts.dir, UNPACK_DIR, pkgName.replaceAll('/', '-'));
+        const tarball = `${unpackDir}.tgz`;
+        fs.mkdirSync(path.dirname(tarball), { recursive: true });
+        await downloadTarball(meta, tarball, { registry: opts.registry });
+        extractTarball(tarball, unpackDir);
+        fs.rmSync(tarball);
+        return { dir: path.join(unpackDir, 'package') };
+    };
+}

package/dist/node_modules/get-pnpm/lib/npmSigningKeys.js

@@ -0,0 +1,23 @@
+/* eslint-disable */
+// GENERATED — npm's public registry signing keys, mirrored from
+// https://registry.npmjs.org/-/npm/v1/keys
+//
+// Refresh with: node scripts/update-npm-keys.mjs --update
+// A scheduled workflow runs the check, so a rotation arrives as a pull request
+// rather than as a failed install.
+export const NPM_SIGNING_KEYS = [
+    {
+        "expires": null,
+        "keyid": "SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U",
+        "keytype": "ecdsa-sha2-nistp256",
+        "scheme": "ecdsa-sha2-nistp256",
+        "key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+HOKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g=="
+    },
+    {
+        "expires": "2025-01-29T00:00:00.000Z",
+        "keyid": "SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA",
+        "keytype": "ecdsa-sha2-nistp256",
+        "scheme": "ecdsa-sha2-nistp256",
+        "key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg=="
+    }
+];

package/dist/node_modules/get-pnpm/lib/platformPackageName.js

@@ -0,0 +1,60 @@
+/**
+ * Name of the npm package that carries the pnpm executable for `target`.
+ *
+ * pnpm ships the binary in a per-host package that `@pnpm/exe` lists as an
+ * optional dependency. The naming scheme changed with the Rust rewrite: v12
+ * publishes `@pnpm/exe.<process.platform>-<arch>[-musl]`, while v11 and older
+ * publish `@pnpm/<macos|win|linux|linuxstatic>-<arch>`.
+ *
+ * @throws if pnpm publishes no binary for the host — either because the
+ * architecture was never supported, or because of the v11-only Intel macOS gap.
+ */
+export function platformPackageName({ major, platform, arch, musl }) {
+    if (arch !== 'x64' && arch !== 'arm64') {
+        throw new Error('Sorry! pnpm currently only provides pre-built binaries for x86_64/arm64 architectures.');
+    }
+    if (platform !== 'darwin' && platform !== 'linux' && platform !== 'win32') {
+        throw new Error(`Sorry! pnpm does not provide a pre-built binary for ${platform}.`);
+    }
+    if (platform === 'darwin' && arch === 'x64' && major === 11) {
+        throw new Error(`pnpm v11 does not provide a working binary for Intel macOS (darwin-x64) due to an upstream Node.js SEA bug.
+
+Install pnpm a different way instead:
+  npx get-pnpm 12        # pnpm v12 ships an Intel macOS binary
+  npm install -g pnpm    # uses your system Node.js
+  brew install pnpm      # via Homebrew
+
+More context: https://github.com/pnpm/pnpm/issues/11423`);
+    }
+    const linuxMusl = platform === 'linux' && musl;
+    if (major >= 12) {
+        return `@pnpm/exe.${platform}-${arch}${linuxMusl ? '-musl' : ''}`;
+    }
+    return `@pnpm/${legacyOsSegment(platform, linuxMusl)}-${arch}`;
+}
+function legacyOsSegment(platform, isMusl) {
+    switch (platform) {
+        case 'darwin': return 'macos';
+        case 'win32': return 'win';
+        default: return isMusl ? 'linuxstatic' : 'linux';
+    }
+}
+/**
+ * Whether this host's libc is musl rather than glibc.
+ *
+ * Probed the way pnpm's own wrappers do it rather than through a dependency:
+ * glibc builds report a `glibcVersionRuntime`, musl builds leave it unset.
+ * Keeping this package dependency-free means `npx` fetches one thing before
+ * pnpm exists.
+ */
+export function isMusl() {
+    if (process.platform !== 'linux')
+        return false;
+    try {
+        const report = process.report?.getReport();
+        return report?.header != null && !report.header.glibcVersionRuntime;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/node_modules/get-pnpm/lib/registry.js

@@ -0,0 +1,120 @@
+import { createHash } from 'node:crypto';
+import { createWriteStream } from 'node:fs';
+import { pipeline } from 'node:stream/promises';
+const ABBREVIATED_PACKUMENT = 'application/vnd.npm.install-v1+json';
+export const DEFAULT_REGISTRY = 'https://registry.npmjs.org/';
+/** The registry npx/npm is configured with, so a mirror stays a mirror. */
+export function registryFromEnv() {
+    return normalizeRegistry(process.env.npm_config_registry ?? process.env.NPM_CONFIG_REGISTRY ?? DEFAULT_REGISTRY);
+}
+/**
+ * A registry URL that can be used as a base for a relative path.
+ *
+ * `new URL('pkg', 'https://mirror.example.com/npm')` drops the last segment,
+ * so a registry served from a subpath needs its trailing slash to survive.
+ */
+export function normalizeRegistry(registry) {
+    return registry.endsWith('/') ? registry : `${registry}/`;
+}
+// Node's fetch applies no timeout of its own: a registry that accepts the
+// connection and then stalls would hang the install with no output. Metadata is
+// small and quick; the tarball budget has to survive a slow connection carrying
+// a ~150 MB download.
+const METADATA_TIMEOUT_MS = 30_000;
+const TARBALL_TIMEOUT_MS = 15 * 60_000;
+export async function fetchPackument(registry, pkgName, headers) {
+    return fetchJson(new URL(pkgName, registry), ABBREVIATED_PACKUMENT, headers);
+}
+export async function fetchVersionMeta(registry, pkgName, version, headers) {
+    return fetchJson(new URL(`${pkgName}/${version}`, registry), 'application/json', headers);
+}
+/**
+ * Streams `meta.dist.tarball` to `dest`, verifying the checksum the registry
+ * published for it. A mismatch removes nothing — the caller discards the whole
+ * temporary directory.
+ *
+ * `registry` re-hosts a tarball URL that points at npm onto that registry, so a
+ * mirror that answered the metadata request serves the download too; `headers`
+ * travel only to the registry's own origin, never to a download host it names.
+ */
+export async function downloadTarball(meta, dest, opts = {}) {
+    const url = tarballUrl(meta, opts.registry);
+    const response = await request(url, undefined, TARBALL_TIMEOUT_MS, headersFor(url, opts));
+    const [algorithm, expected] = checksum(meta);
+    const hash = createHash(algorithm);
+    const body = response.body;
+    await pipeline(async function* () {
+        for await (const chunk of body) {
+            hash.update(chunk);
+            yield chunk;
+        }
+    }, createWriteStream(dest));
+    const actual = hash.digest('base64');
+    if (actual !== expected) {
+        throw new Error(`The download from ${url.href} does not match the checksum the npm registry published for it. Refusing to install.`);
+    }
+}
+/**
+ * Where to download `meta`'s tarball from.
+ *
+ * Registries that proxy npm hand back npm's own URL. Following it would leave
+ * the mirror the metadata came from — for an air-gapped one, it would not
+ * resolve at all — so the path is re-hosted onto `registry`. Matched by origin,
+ * so a host that merely starts with npm's is left alone.
+ */
+export function tarballUrl(meta, registry) {
+    const url = new URL(meta.dist.tarball);
+    if (registry == null || url.origin !== new URL(DEFAULT_REGISTRY).origin)
+        return url;
+    return new URL(`${url.pathname.replace(/^\//, '')}${url.search}`, normalizeRegistry(registry));
+}
+function headersFor(url, opts) {
+    if (opts.headers == null || opts.registry == null)
+        return undefined;
+    return url.origin === new URL(opts.registry).origin ? opts.headers : undefined;
+}
+/**
+ * The algorithm and digest to check a tarball against.
+ *
+ * `integrity` is an SRI string, which may hold several space-separated entries;
+ * the first is used. Only the digest that the registry signature covers is
+ * accepted — `shasum` is SHA-1, and a package without `integrity` has already
+ * been refused before any download starts.
+ */
+function checksum(meta) {
+    const entry = meta.dist.integrity?.trim().split(/\s+/)[0];
+    if (!entry) {
+        throw new Error(`The registry published no checksum for ${meta.dist.tarball}, so it cannot be verified.`);
+    }
+    const separator = entry.indexOf('-');
+    if (separator === -1) {
+        throw new Error(`The registry published an unreadable checksum for ${meta.dist.tarball}: ${entry}`);
+    }
+    return [entry.slice(0, separator), entry.slice(separator + 1)];
+}
+async function fetchJson(url, accept, headers) {
+    const response = await request(url, accept, METADATA_TIMEOUT_MS, headers);
+    return await response.json();
+}
+async function request(url, accept, timeoutMs, headers) {
+    let response;
+    try {
+        response = await fetch(url, {
+            signal: AbortSignal.timeout(timeoutMs),
+            headers: { ...headers, ...(accept ? { accept } : {}) },
+        });
+    }
+    catch (err) {
+        const reason = err.name === 'TimeoutError'
+            ? `timed out after ${Math.round(timeoutMs / 1000)}s`
+            : err.message;
+        throw new Error(`Could not reach ${url.href}: ${reason}`, { cause: err });
+    }
+    if (!response.ok) {
+        throw new Error(`Could not download ${url.href}: ${response.status} ${response.statusText}`);
+    }
+    if (response.body == null) {
+        throw new Error(`Empty response from ${url.href}`);
+    }
+    return response;
+}

package/dist/node_modules/get-pnpm/lib/resolveVersion.js

@@ -0,0 +1,36 @@
+/**
+ * Turns what the user asked for into a concrete pnpm version.
+ *
+ * `spec` may be a dist-tag (`latest`, `next-12`), an exact version (`11.20.0`,
+ * with an optional leading `v`), or a bare major (`12`), which picks that
+ * major's stable release and falls back to its prerelease lane.
+ *
+ * Dist-tags win over exact versions, matching `install.ps1`.
+ *
+ * @throws if `spec` matches neither a dist-tag nor a published version.
+ */
+export function resolveVersion(packument, spec) {
+    const distTags = packument['dist-tags'];
+    if (distTags[spec])
+        return distTags[spec];
+    const version = spec.startsWith('v') ? spec.slice(1) : spec;
+    if (packument.versions[version])
+        return version;
+    if (/^\d+$/.test(version)) {
+        const majorTag = distTags[`latest-${version}`] ?? distTags[`next-${version}`];
+        if (majorTag)
+            return majorTag;
+    }
+    throw new Error(`Sorry! pnpm version "${spec}" could not be found. Available tags: ${Object.keys(distTags).sort().join(', ')}`);
+}
+/** The major of an exact version, as the package layout depends on it. */
+export function majorVersion(version) {
+    const field = version.split('.')[0] ?? '';
+    // Digits only: `Number` reads '' as 0 and '0x10' as 16, and a caller-supplied
+    // version that means neither should say so here rather than fail later as a
+    // package name nobody publishes.
+    if (!/^\d+$/.test(field)) {
+        throw new Error(`Could not read a major version from "${version}".`);
+    }
+    return Number(field);
+}

package/dist/node_modules/get-pnpm/lib/sameFileContents.js

@@ -0,0 +1,45 @@
+import fs from 'node:fs';
+const CHUNK_SIZE = 64 * 1024;
+/**
+ * Whether two paths hold the same bytes.
+ *
+ * Compared rather than hashed: the answer is usually "no" at the first
+ * differing byte, and there is nothing to gain from reading further.
+ *
+ * `b` is the untrusted side — a path something else may hold — so anything
+ * other than a readable regular file of the same size is simply not the same
+ * file, rather than an error.
+ */
+export function sameFileContents(a, b) {
+    const sizeA = fs.statSync(a).size;
+    const statB = fs.lstatSync(b, { throwIfNoEntry: false });
+    if (statB?.isFile() !== true || statB.size !== sizeA)
+        return false;
+    let fdA;
+    let fdB;
+    try {
+        fdA = fs.openSync(a, 'r');
+        fdB = fs.openSync(b, 'r');
+        const bufferA = Buffer.alloc(CHUNK_SIZE);
+        const bufferB = Buffer.alloc(CHUNK_SIZE);
+        while (true) {
+            const readA = fs.readSync(fdA, bufferA, 0, CHUNK_SIZE, null);
+            const readB = fs.readSync(fdB, bufferB, 0, CHUNK_SIZE, null);
+            if (readA !== readB)
+                return false;
+            if (readA === 0)
+                return true;
+            if (!bufferA.subarray(0, readA).equals(bufferB.subarray(0, readB)))
+                return false;
+        }
+    }
+    catch {
+        return false;
+    }
+    finally {
+        if (fdA !== undefined)
+            fs.closeSync(fdA);
+        if (fdB !== undefined)
+            fs.closeSync(fdB);
+    }
+}