@pnpm/exe 12.8.1 → 12.9.0

package/dist/wasm/README.md

@@ -0,0 +1,140 @@
+# WebContainer runtime
+
+This runtime executes the pnpm v12 CLI as threaded WebAssembly inside StackBlitz
+WebContainers. The regular npm wrapper includes this runtime and `pnpm.wasm`
+under `dist/wasm` and selects it using `process.versions.webcontainer`. The
+standalone distribution is also available for testing builds before release.
+Implementation and validation are tracked in
+[pnpm/tasks#63](https://github.com/pnpm/tasks/issues/63).
+
+Native pnpm does not load this package. Native implementations remain selected
+at compile time.
+
+## Build and test
+
+From the repository root, with workspace dependencies installed:
+
+```sh
+rustup toolchain install nightly-2026-08-27 --profile minimal --target wasm32-wasip1-threads
+export WASI_SDK_PATH=/path/to/wasi-sdk-34.0
+export WABT_PATH=/path/to/wabt-1.0.42
+pnpm build:pnpm:wasm
+pnpm pack:pnpm:wasm
+node pnpm/wasm/stage.mjs
+pnpm build:wasm-runtime-probe
+pnpm --filter @pnpm-private/wasm-runtime test
+node pnpm/tasks/ecosystem-e2e/webcontainer/run.mjs --wasm-runtime target/wasm-runtime-probe/wasm32-wasip1-threads/debug/pnpm-wasm-runtime-probe.wasm
+```
+
+`stage.mjs` prepares the self-contained `pnpm/npm/pnpm/dist/wasm` payload for
+the regular npm wrapper. Release jobs restore it after the node-gyp payload.
+Native executable archives do not include the WASM payload. Normal native npm
+installations keep the direct native executable, without a runtime-selection
+check on each invocation.
+
+CI packs the regular wrapper with `pack-wrapper.mjs` and enforces a 20 MiB
+compressed size budget. The bundled runtime also increases native npm download
+size; it must be available before install scripts run for automatic WebContainer
+selection to work when those scripts are disabled.
+
+The full build uses the pinned nightly because `cap-primitives` requires unstable
+WASI filesystem APIs. Native builds retain the repository's stable toolchain.
+Download and extract [WASI SDK 34](https://github.com/WebAssembly/wasi-sdk/releases/tag/wasi-sdk-34)
+before setting `WASI_SDK_PATH`; the build checks its version and does not download
+a compiler. The SDK also builds bundled SQLite with threading enabled.
+Extract [WABT 1.0.42](https://github.com/WebAssembly/wabt/releases/tag/1.0.42)
+and set `WABT_PATH` to its directory containing `bin`. The build uses its validated
+WebAssembly text roundtrip to replace atomic waits with cancellable host imports.
+The runtime tests also use this toolchain.
+
+The browser test needs the Chromium installation described in the
+[ecosystem test guide](https://github.com/pnpm/pnpm/blob/main/pnpm/tasks/ecosystem-e2e/README.md#webcontainers).
+The Node tests require the freshly built probe; missing artifacts are errors.
+
+## Execution model
+
+The Node supervisor owns one WASI descriptor table, the filesystem permission
+adapter, network requests and child processes. Rust runs in workers sharing
+one WebAssembly memory. All workers use the supervisor's descriptor table,
+including when Tokio moves an open file between threads.
+
+The build exports `malloc`, `free`, `__tls_base` and `__wasm_init_tls` for the
+thread loader. The supervisor performs shared memory initialization; the main
+worker initializes its thread-local storage before calling `_start`.
+
+The `pnpm_atomic` imports provide cancellable atomic waits. WebContainer workers
+cannot terminate while parked in a WebAssembly atomic wait. The build rewrites
+only wait instructions; loads, stores, notifications and other atomics remain
+WebAssembly instructions. Host waits preserve guest deadlines and use bounded
+blocking intervals to observe cancellation without a lost wakeup.
+
+The `pnpm_host` imports start asynchronous operations and transfer responses.
+One Rust completion thread wakes pending futures. The supervisor retains result
+buffers until Rust reads or cancels them; it never retains pointers into guest
+memory. Each JSON request or response is limited to 1 MiB. Stream reads transfer
+at most 64 KiB of data at a time. HTTP uploads use a separate bounded stream,
+so package bodies can exceed the control-message limit. Dropping a request cancels it, and closing the
+runtime aborts outstanding operations before terminating the workers.
+
+The `pnpm_fs` imports supply operations WASI lacks: atomic creation with an
+explicit mode, descriptor-bound permission changes, and private lock
+directories. They use the same descriptor mapping as ordinary WASI calls.
+
+The runtime runs trusted pnpm code with the authority of its Node host. It
+preopens the host root; it is not a sandbox for arbitrary WASM modules. Inside
+WebContainers this is the container's virtual filesystem.
+
+## Current boundaries
+
+WebContainer's bundled npm applies package replacements through a private host
+integration. The standalone pnpm distribution does not depend on that API.
+Projects using native tools must select compatible WebAssembly packages through
+pnpm's existing overrides. For example, in `pnpm-workspace.yaml`:
+
+```yaml
+overrides:
+  esbuild: npm:esbuild-wasm@^0.27.0
+  rollup: npm:@rollup/wasm-node@^4.43.1
+```
+
+Match the replacement versions to the project's dependencies and commit the
+lockfile generated by `pnpm install`. This uses the normal resolver and integrity
+checks without implicitly substituting package contents.
+
+The browser controls HTTP protocol negotiation and connection pooling. Explicit
+custom TLS roots, client certificates, proxies, local addresses and DNS pinning
+are rejected by the WASM HTTP adapter. They are not silently ignored. Redirects
+remain controlled by the shared Rust network policy.
+
+Process cancellation enumerates descendants with the host's `/bin/ps` and
+signals them while the spawned parent is still owned. WebContainers do not
+support process-group signals or stable descendant identity handles. If a
+parent exits after a graceful signal while a descendant ignores that signal,
+the runtime cannot safely target the orphan during later escalation. It does
+not retain stale descendant PIDs. Runtime shutdown uses `SIGKILL` for live
+owned process trees.
+
+WebContainers do not reliably support numeric file descriptors in child-process
+stdio. File redirection therefore uses a pipe bridge, and waiting for the child
+also waits for the redirected output to finish writing. A background descendant
+that inherits redirected stdout or stderr keeps that wait pending until it closes
+the stream, even after the direct child exits. Background children should close
+or replace inherited redirected streams.
+
+WASM uses the `v11-wasm` store namespace; native pnpm keeps `v11`. The package
+file and index formats match, but live stores are isolated because the locking
+protocols differ. An explicit store path ending in `v11` also receives the
+`v11-wasm` suffix. Do not symlink the two namespaces together.
+
+SQLite uses a rollback journal and host process leases, because the WASI VFS
+cannot provide native advisory locking or WAL. Its [probe](https://github.com/pnpm/pnpm/blob/main/pnpm/tasks/ecosystem-e2e/webcontainer/sqlite-probe/README.md)
+and actual Rust store tests cover persistence, contention and crash recovery.
+
+WebContainers cannot restore changed installation metadata through a pinned
+directory handle. A failed mutation reports that automatic metadata rollback is
+unavailable; it does not write through an unsafe replacement directory. Automatic
+provenance signing is also unavailable and returns an explicit error.
+
+Compiling or passing the runtime probe does not establish that all pnpm commands
+work in WebContainers. The task tracks CLI integration, command coverage,
+packaging and native performance validation separately.

package/dist/wasm/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,42 @@
+# Third-Party Notices
+
+This product includes software derived from third-party sources. The
+components below, and their license terms, are listed here in satisfaction
+of those terms.
+
+## Yarn (`@yarnpkg/nm`, `@yarnpkg/extensions`)
+
+- Source: <https://github.com/yarnpkg/berry>
+- License: BSD 2-Clause
+
+The `nodeLinker: hoisted` layout is produced by a Rust port of the hoisting
+algorithm in `@yarnpkg/nm`, and the built-in package-compatibility database
+is a copy of the one in `@yarnpkg/extensions`.
+
+```text
+BSD 2-Clause License
+
+Copyright (c) 2016-present, Yarn Contributors.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+```

package/dist/wasm/host/atomic-waits.mjs

@@ -0,0 +1,43 @@
+import { createCancellationCheck } from './cancellation.mjs'
+
+// Cancellation can race the transition from checking its flag to waiting on guest memory.
+const WAIT_SLICE_MS = 100
+
+export function createAtomicWaits (memory, control, checkCancelled = createCancellationCheck(control)) {
+  const state = new Int32Array(control)
+  if (state.length < 2) throw new RangeError('Atomic wait control requires two i32 slots')
+  return {
+    wait32: (pointer, expected, timeout, offset) => wait(memory, state, pointer, expected, timeout, offset, 4, checkCancelled),
+    wait64: (pointer, expected, timeout, offset) => wait(memory, state, pointer, expected, timeout, offset, 8, checkCancelled),
+  }
+}
+
+export function cancelAtomicWaits (memory, control) {
+  const state = new Int32Array(control)
+  Atomics.store(state, 0, 1)
+  const address = Atomics.load(state, 1) >>> 0
+  if (address < memory.buffer.byteLength) Atomics.notify(new Int32Array(memory.buffer), address >>> 2)
+}
+
+function wait (memory, state, pointer, expected, timeout, offset, width, checkCancelled) {
+  const address = (pointer >>> 0) + (offset >>> 0)
+  if (address % width !== 0 || address + width > memory.buffer.byteLength) {
+    throw new WebAssembly.RuntimeError('Unaligned or out-of-bounds atomic wait')
+  }
+  const view = width === 4 ? new Int32Array(memory.buffer) : new BigInt64Array(memory.buffer)
+  const deadline = timeout < 0n ? Infinity : performance.now() + Number(timeout) / 1000000
+  Atomics.store(state, 1, address)
+  try {
+    while (true) {
+      checkCancelled()
+      const remaining = Math.max(0, deadline - performance.now())
+      const result = Atomics.wait(view, address / width, expected, Math.min(remaining, WAIT_SLICE_MS))
+      checkCancelled()
+      if (result === 'ok') return 0
+      if (result === 'not-equal') return 1
+      if (performance.now() >= deadline) return 2
+    }
+  } finally {
+    Atomics.store(state, 1, -1)
+  }
+}

package/dist/wasm/host/cancellation.mjs

@@ -0,0 +1,6 @@
+export function createCancellationCheck (control) {
+  const state = control && new Int32Array(control)
+  return () => {
+    if (state && Atomics.load(state, 0)) throw new WebAssembly.RuntimeError('WASM worker cancelled')
+  }
+}

package/dist/wasm/host/executable-mode.mjs

@@ -0,0 +1,8 @@
+export function hasExecutableMode (metadata) {
+  const user = process.getuid()
+  let permission = 0o1
+  if (user === 0) permission = 0o111
+  else if (metadata.uid === user) permission = 0o100
+  else if (metadata.gid === process.getgid() || process.getgroups().includes(metadata.gid)) permission = 0o10
+  return (metadata.mode & permission) !== 0
+}

package/dist/wasm/host/file-locks.mjs

@@ -0,0 +1,40 @@
+import { fstatSync } from 'node:fs'
+
+import { acquireFileLease } from './lock-registry.mjs'
+
+const busy = 6
+
+export function createFileLocks () {
+  const held = new Map()
+  function release (descriptor) {
+    const state = held.get(descriptor)
+    if (!state) return
+    held.delete(descriptor)
+    state.closed = true
+    state.lease?.release()
+  }
+  return {
+    tryLock (descriptor, exclusive) {
+      let state = held.get(descriptor)
+      if (!state) {
+        const metadata = fstatSync(descriptor, { bigint: true })
+        state = { identity: `${metadata.dev}:${metadata.ino}`, closed: false }
+        held.set(descriptor, state)
+      }
+      if (state.error) return 29
+      if (state.lease?.exclusive === exclusive) return 0
+      if (!state.pending) {
+        state.pending = true
+        acquireFileLease(state.identity, exclusive, state.lease).then(lease => {
+          if (state.closed) lease?.release()
+          else if (lease) state.lease = lease
+        }, error => { state.error = error }).finally(() => { state.pending = false })
+      }
+      return busy
+    },
+    release,
+    close () {
+      for (const descriptor of held.keys()) release(descriptor)
+    },
+  }
+}

package/dist/wasm/host/filesystem.mjs

@@ -0,0 +1,318 @@
+import fs from 'node:fs'
+import { Buffer } from 'node:buffer'
+import path from 'node:path'
+import process from 'node:process'
+import { TextDecoder } from 'node:util'
+
+import { WASI } from '@tybys/wasm-util'
+
+import { createFileLocks } from './file-locks.mjs'
+import { hasExecutableMode } from './executable-mode.mjs'
+import { createPoll } from './poll.mjs'
+import { errno } from './wasi-errno.mjs'
+
+const readRights = 2n | 4n | 16n | 32n | 2097152n
+const writeRights = readRights | 1n | 64n | 4194304n
+// Node does not expose Linux O_PATH through fs.constants.
+const linuxOPath = 0o10000000
+
+export function createWasiFilesystem (options, memory) {
+  const locks = createFileLocks()
+  const leases = createDescriptorLeases(locks)
+  const sqliteFiles = new Map()
+  const randomDevices = new Set()
+  const descriptors = new Map([[0, 0], [1, 1], [2, 2]])
+  const rootDescriptor = Object.keys(options.preopens ?? {}).indexOf('/') + 3
+  const state = { leases, sqliteFiles, randomDevices, descriptors, constructing: true, nextPreopen: 3 }
+  const wasi = new WASI({ ...options, fs: createFilesystemAdapter(state) })
+  const polling = createPoll(memory)
+  wasi.wasiImport.poll_oneoff = polling.poll
+  state.constructing = false
+  const open = trackPathOpens(wasi, state, memory)
+  trackAbsoluteSymlinks(wasi, state, { options, memory })
+  trackDescriptorChanges(wasi, descriptors)
+  function resolveDescriptor (descriptor) {
+    const native = descriptors.get(descriptor)
+    if (native == null) throw Object.assign(new Error('Unknown WASI file descriptor'), { code: 'EBADF' })
+    return native
+  }
+  const imports = createFilesystemImports({ memory, resolveDescriptor, open, rootDescriptor, options, locks, sqliteFiles })
+  return { wasi, imports, resolveDescriptor, cancelPending: polling.close, acquireDescriptor (descriptor) {
+    return leases.acquire(resolveDescriptor(descriptor))
+  }, close () {
+    polling.close()
+    for (const descriptor of descriptors.keys()) {
+      if (descriptor > 2) wasi.wasiImport.fd_close(descriptor)
+    }
+  } }
+}
+
+function trackPathOpens (wasi, state, memory) {
+  const originalOpen = wasi.wasiImport.path_open
+  function open (args, mode) {
+    state.opening = { mode, follow: (args[1] & 1) !== 0 }
+    try {
+      new DataView(memory.buffer).getUint32(args[8] >>> 0, true)
+      const result = originalOpen(...args)
+      if (result === 0) {
+        const descriptor = new DataView(memory.buffer).getUint32(args[8], true)
+        state.descriptors.set(descriptor, state.opening.descriptor)
+      }
+      return result
+    } catch (error) {
+      return errorNumber(error)
+    } finally {
+      state.opening = undefined
+    }
+  }
+  wasi.wasiImport.path_open = (...args) => open(args)
+  return open
+}
+
+function trackAbsoluteSymlinks (wasi, state, { options, memory }) {
+  const symlink = wasi.wasiImport.path_symlink
+  wasi.wasiImport.path_symlink = (target, length, descriptor, link, linkLength) => {
+    if (options.preopens?.['/'] !== '/' || new Uint8Array(memory.buffer)[target >>> 0] !== 47) {
+      return symlink(target, length, descriptor, link, linkLength)
+    }
+    try {
+      state.symlinkTarget = new TextDecoder('utf-8', { fatal: true }).decode(Uint8Array.from(new Uint8Array(memory.buffer, target >>> 0, length >>> 0)))
+      return symlink(target + 1, length - 1, descriptor, link, linkLength)
+    } catch (error) {
+      return errorNumber(error)
+    } finally {
+      state.symlinkTarget = undefined
+    }
+  }
+}
+
+function createFilesystemAdapter (state) {
+  const { leases, sqliteFiles, randomDevices, descriptors } = state
+  return {
+    ...fs,
+    closeSync (descriptor) {
+      randomDevices.delete(descriptor)
+      leases.close(descriptor)
+    },
+    readSync (descriptor, buffer, offset, length, position) {
+      if (!randomDevices.has(descriptor)) return fs.readSync(descriptor, buffer, offset, length, position)
+      // WebContainer random devices use WebCrypto, which rejects shared views.
+      const temporary = Buffer.alloc(Math.min(length, 65536))
+      const count = fs.readSync(descriptor, temporary, 0, temporary.length, position)
+      buffer.set(temporary.subarray(0, count), offset)
+      return count
+    },
+    openSync (file, flags, mode) {
+      if (state.opening && !state.opening.follow) flags |= fs.constants.O_NOFOLLOW
+      const database = sqliteFiles.get(file)
+      const sqliteMode = database ? fs.statSync(database).mode & 0o777 : undefined
+      const descriptor = fs.openSync(file, flags, state.opening?.mode ?? sqliteMode ?? mode)
+      if (file === '/dev/urandom' || file === '/dev/random') randomDevices.add(descriptor)
+      if (state.constructing) descriptors.set(state.nextPreopen++, descriptor)
+      else if (state.opening) state.opening.descriptor = descriptor
+      return descriptor
+    },
+    symlinkSync (target, file, ...args) {
+      fs.symlinkSync(state.symlinkTarget ?? target, file, ...args)
+    },
+    readlinkSync (file, ...args) {
+      const target = fs.readlinkSync(file, ...args)
+      return state.opening?.follow ? path.resolve(path.dirname(file), target) : target
+    },
+  }
+}
+
+function createDescriptorLeases (locks) {
+  const active = new Map()
+  function close (descriptor) {
+    const state = active.get(descriptor)
+    if (state) {
+      state.closed = true
+      return
+    }
+    fs.closeSync(descriptor)
+    locks.release(descriptor)
+  }
+  return { close, acquire (descriptor) {
+    let state = active.get(descriptor)
+    if (!state) {
+      state = { count: 0, closed: false }
+      active.set(descriptor, state)
+    }
+    state.count++
+    let released = false
+    return { fd: descriptor, release () {
+      if (released) return
+      released = true
+      if (--state.count !== 0) return
+      active.delete(descriptor)
+      if (state.closed) close(descriptor)
+    } }
+  } }
+}
+
+function trackDescriptorChanges (wasi, descriptors) {
+  const close = wasi.wasiImport.fd_close
+  wasi.wasiImport.fd_close = descriptor => {
+    if (!descriptors.has(descriptor)) return errno.EBADF
+    const result = close(descriptor)
+    if (result === 0) {
+      descriptors.delete(descriptor)
+    }
+    return result
+  }
+  const renumber = wasi.wasiImport.fd_renumber
+  wasi.wasiImport.fd_renumber = (source, destination) => {
+    if (!descriptors.has(source) || !descriptors.has(destination)) return errno.EBADF
+    const result = renumber(source, destination)
+    if (result === 0 && source !== destination) {
+      descriptors.set(destination, descriptors.get(source))
+      descriptors.delete(source)
+    }
+    return result
+  }
+}
+
+function createFilesystemImports ({ memory, resolveDescriptor, open, rootDescriptor, options, locks, sqliteFiles }) {
+  function guestPath (pointer, length) {
+    const value = new TextDecoder('utf-8', { fatal: true }).decode(Uint8Array.from(new Uint8Array(memory.buffer, pointer >>> 0, length >>> 0)))
+    if (!value.startsWith('/') || value.includes('\0')) throw Object.assign(new Error('Expected an absolute guest path'), { code: 'EINVAL' })
+    const root = options.preopens?.['/']
+    if (root !== '/') throw Object.assign(new Error('Filesystem extensions require the host root preopen'), { code: 'EACCES' })
+    return path.resolve(root, `.${value}`)
+  }
+  function descendantComponents (directory, template) {
+    const suffix = path.relative(template, directory)
+    if (!suffix || suffix === '..' || suffix.startsWith(`..${path.sep}`) || path.isAbsolute(suffix)) {
+      throw Object.assign(new Error('Permission target is not below its template'), { code: 'EINVAL' })
+    }
+    return suffix.split(path.sep)
+  }
+  return {
+    ...createOpenImports({ options, rootDescriptor, open }),
+    open_directory_nofollow_beneath (pointer, length, templatePointer, templateLength, output) {
+      try {
+        const directory = guestPath(pointer, length)
+        const template = guestPath(templatePointer, templateLength)
+        let current = template
+        for (const component of descendantComponents(directory, template)) {
+          current = path.join(current, component)
+          const metadata = fs.lstatSync(current)
+          if (metadata.isSymbolicLink()) return errno.ELOOP
+          if (!metadata.isDirectory()) return errno.ENOTDIR
+        }
+        return open([rootDescriptor, 0, pointer, length, 0, readRights, 0n, 4, output])
+      } catch (error) {
+        return errorNumber(error)
+      }
+    },
+    grant_directory_mode_beneath (pointer, length, templatePointer, templateLength, extra) {
+      if ('webcontainer' in process.versions) return errno.ENOTSUP
+      if (process.platform !== 'linux' || !fs.existsSync('/proc/self/fd')) return errno.ENOTSUP
+      if (extra < 0 || extra > 0o7777) return errno.EINVAL
+      try {
+        const directory = guestPath(pointer, length)
+        const template = guestPath(templatePointer, templateLength)
+        const components = descendantComponents(directory, template)
+        let descriptor = fs.openSync(template, linuxOPath | fs.constants.O_DIRECTORY)
+        try {
+          for (const component of components) {
+            const child = fs.openSync(`/proc/self/fd/${descriptor}/${component}`, linuxOPath | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW)
+            fs.closeSync(descriptor)
+            descriptor = child
+          }
+          const metadata = fs.fstatSync(descriptor)
+          if (metadata.uid !== process.getuid()) return errno.EACCES
+          const current = metadata.mode & 0o7777
+          if ((current | extra) !== current) fs.chmodSync(`/proc/self/fd/${descriptor}`, current | extra)
+          return 0
+        } finally {
+          fs.closeSync(descriptor)
+        }
+      } catch (error) {
+        return errorNumber(error)
+      }
+    },
+    try_lock (descriptor, exclusive) {
+      try { return locks.tryLock(resolveDescriptor(descriptor), exclusive !== 0) } catch (error) { return errorNumber(error) }
+    },
+    sqlite_register: checked((pointer, length, registered) => {
+      const database = guestPath(pointer, length)
+      for (const suffix of ['-journal', '-wal', '-shm']) {
+        const file = database + suffix
+        if (registered) sqliteFiles.set(file, database)
+        else sqliteFiles.delete(file)
+      }
+    }),
+    path_access_executable: checked((pointer, length) => executableAccess(guestPath(pointer, length))),
+    check_owner: checked(descriptor => {
+      if (fs.fstatSync(resolveDescriptor(descriptor)).uid !== process.getuid()) {
+        throw Object.assign(new Error('WASM SQLite stores must belong to the current user'), { code: 'EACCES' })
+      }
+    }),
+    fchmod: checked((descriptor, mode) => fs.fchmodSync(resolveDescriptor(descriptor), mode)),
+    fmode: checked((descriptor, output) => {
+      new DataView(memory.buffer).setUint32(output >>> 0, fs.fstatSync(resolveDescriptor(descriptor)).mode, true)
+    }),
+    lmode: checked((pointer, length, output) => {
+      new DataView(memory.buffer).setUint32(output >>> 0, fs.lstatSync(guestPath(pointer, length)).mode, true)
+    }),
+    umask () { return process.umask() },
+    uid () { return process.getuid() },
+    secure_directory: checked((pointer, length) => secureDirectory(guestPath(pointer, length))),
+  }
+}
+
+function executableAccess (file) {
+  fs.accessSync(file, fs.constants.X_OK)
+  // WebContainer accessSync ignores X_OK, although stat exposes permission bits.
+  if (!hasExecutableMode(fs.statSync(file))) {
+    throw Object.assign(new Error(`File is not executable: ${file}`), { code: 'EACCES' })
+  }
+}
+
+function secureDirectory (directory) {
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 })
+  const descriptor = fs.openSync(directory, fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW)
+  try {
+    const metadata = fs.fstatSync(descriptor)
+    if (metadata.uid !== process.getuid()) throw Object.assign(new Error('Lock directory has a different owner'), { code: 'EACCES' })
+    fs.fchmodSync(descriptor, 0o700)
+  } finally {
+    fs.closeSync(descriptor)
+  }
+}
+
+function createOpenImports ({ options, rootDescriptor, open }) {
+  return {
+    create_new (pointer, length, mode, output) {
+      if (mode < 0 || mode > 0o7777) return errno.EINVAL
+      if (options.preopens?.['/'] !== '/') return errno.EACCES
+      return open([rootDescriptor, 0, pointer, length, 1 | 4, writeRights, 0n, 0, output], mode)
+    },
+    open_nofollow (pointer, length, output) {
+      if (options.preopens?.['/'] !== '/') return errno.EACCES
+      return open([rootDescriptor, 0, pointer, length, 0, readRights, 0n, 4, output])
+    },
+    open_lock (pointer, length, output) {
+      if (options.preopens?.['/'] !== '/') return errno.EACCES
+      return open([rootDescriptor, 0, pointer, length, 0, writeRights, 0n, 4, output])
+    },
+  }
+}
+
+function checked (operation) {
+  return (...args) => {
+    try {
+      operation(...args)
+      return 0
+    } catch (error) {
+      return errorNumber(error)
+    }
+  }
+}
+
+function errorNumber (error) {
+  if (error instanceof RangeError) return errno.EFAULT
+  return errno[error.code] ?? errno.EIO
+}

package/dist/wasm/host/guest-imports.mjs

@@ -0,0 +1,45 @@
+import { RESPONSE_CAPACITY } from './protocol.mjs'
+import { waitForReply } from './wait-for-reply.mjs'
+
+export function createGuestImports (memory, postMessage, checkCancelled) {
+  const buffer = new SharedArrayBuffer(RESPONSE_CAPACITY + 12)
+  const header = new Int32Array(buffer, 0, 3)
+
+  function call (method, args) {
+    Atomics.store(header, 0, 0)
+    postMessage({ pnpmHostRpc: { method, args, buffer } })
+    waitForReply(header, 0, checkCancelled)
+    return Atomics.load(header, 1)
+  }
+
+  function view (pointer, length) {
+    return new Uint8Array(memory.buffer, pointer >>> 0, length >>> 0)
+  }
+
+  return {
+    operation_start (pointer, length) {
+      if ((length >>> 0) > RESPONSE_CAPACITY) return -2
+      const bytes = Uint8Array.from(view(pointer, length))
+      const request = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes))
+      return call('start', [request])
+    },
+    response_len (id) {
+      return call('length', [id])
+    },
+    response_read (id, pointer, length) {
+      const target = view(pointer, length)
+      const result = call('read', [id, target.length])
+      if (result >= 0) target.set(new Uint8Array(buffer, 12, Atomics.load(header, 2)))
+      return result
+    },
+    operation_cancel (id) {
+      call('cancel', [id])
+    },
+    resource_close (handle) {
+      return call('close-resource', [handle])
+    },
+    wait_completion () {
+      return call('wait', [])
+    },
+  }
+}