@pnpm/exe 12.8.2 → 12.9.0

package/bin/pnpm.mjs

@@ -38,7 +38,11 @@ const DOWNLOADED_BINARY = path.join(
 const GET_PNPM = new URL('../dist/node_modules/get-pnpm/lib/index.js', import.meta.url)
 const DEFAULT_REGISTRY = 'https://registry.npmjs.org'
 
-run(await nativeBinary())
+if ('webcontainer' in process.versions) {
+  await import('../dist/wasm/pnpm.mjs')
+} else {
+  run(await nativeBinary())
+}
 
 function run (binary) {
   // Ctrl-C reaches the whole foreground process group, so the binary gets its

package/bin/pnpx.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // Corepack's `pnpx` entry point; see ./pnpm.mjs. The native binary infers the
 // `dlx` subcommand from the name it was launched under, which does not survive
-// being spawned from here, so inject it the way the `pnpx` shell script does.
+// being spawned from here, so the Node entry point injects it.
 import process from 'node:process'
 
 process.argv = [...process.argv.slice(0, 2), 'dlx', ...process.argv.slice(2)]

package/dist/node_modules/.pnpm-workspace-state-v1.json

@@ -1,9 +1,9 @@
 {
-  "lastValidatedTimestamp": 1790728888790,
+  "lastValidatedTimestamp": 1790977215579,
   "projects": {
     "/home/runner/_work/pnpm/pnpm/pnpm/npm/pnpm/temp-deploy": {
       "name": "pacquet",
-      "version": "12.8.2",
+      "version": "12.9.0",
       "hasModulesDir": true
     }
   },
@@ -28,6 +28,7 @@
         "@commitlint/config-conventional": "^21.2.3",
         "@commitlint/prompt-cli": "^21.2.3",
         "@cyclonedx/cyclonedx-library": "10.3.0",
+        "@emnapi/wasi-threads": "1.2.1",
         "@eslint/js": "^10.0.1",
         "@inquirer/prompts": "^8.7.2",
         "@jest/globals": "30.4.1",
@@ -47,6 +48,7 @@
         "@reflink/reflink": "0.1.19",
         "@rushstack/worker-pool": "0.7.28",
         "@stylistic/eslint-plugin": "^5.10.0",
+        "@tybys/wasm-util": "0.10.4",
         "@types/adm-zip": "^0.5.8",
         "@types/archy": "0.0.36",
         "@types/cross-spawn": "^6.0.6",
@@ -94,6 +96,7 @@
         "@yarnpkg/fslib": "^3.1.5",
         "@yarnpkg/lockfile": "^1.1.0",
         "@yarnpkg/nm": "4.1.1",
+        "@yarnpkg/parsers": "3.1.0",
         "@yarnpkg/pnp": "^4.1.7",
         "@yarnpkg/shell": "4.1.3",
         "@zkochan/retry": "^0.2.0",
@@ -331,6 +334,7 @@
     "nodeLinker": "hoisted",
     "optional": true,
     "patchedDependencies": {
+      "@tybys/wasm-util@0.10.4": "../../../../__patches__/@tybys__wasm-util@0.10.4.patch",
       "graceful-fs@4.2.11": "../../../../__patches__/graceful-fs@4.2.11.patch",
       "normalize-registry-url@2.0.1": "../../../../__patches__/normalize-registry-url@2.0.1.patch"
     },

package/dist/wasm/LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2015-2016 Rico Sta. Cruz and other contributors
+Copyright (c) 2016-2026 Zoltan Kochan and other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/wasm/README.md

@@ -0,0 +1,140 @@
+# WebContainer runtime
+
+This runtime executes the pnpm v12 CLI as threaded WebAssembly inside StackBlitz
+WebContainers. The regular npm wrapper includes this runtime and `pnpm.wasm`
+under `dist/wasm` and selects it using `process.versions.webcontainer`. The
+standalone distribution is also available for testing builds before release.
+Implementation and validation are tracked in
+[pnpm/tasks#63](https://github.com/pnpm/tasks/issues/63).
+
+Native pnpm does not load this package. Native implementations remain selected
+at compile time.
+
+## Build and test
+
+From the repository root, with workspace dependencies installed:
+
+```sh
+rustup toolchain install nightly-2026-08-27 --profile minimal --target wasm32-wasip1-threads
+export WASI_SDK_PATH=/path/to/wasi-sdk-34.0
+export WABT_PATH=/path/to/wabt-1.0.42
+pnpm build:pnpm:wasm
+pnpm pack:pnpm:wasm
+node pnpm/wasm/stage.mjs
+pnpm build:wasm-runtime-probe
+pnpm --filter @pnpm-private/wasm-runtime test
+node pnpm/tasks/ecosystem-e2e/webcontainer/run.mjs --wasm-runtime target/wasm-runtime-probe/wasm32-wasip1-threads/debug/pnpm-wasm-runtime-probe.wasm
+```
+
+`stage.mjs` prepares the self-contained `pnpm/npm/pnpm/dist/wasm` payload for
+the regular npm wrapper. Release jobs restore it after the node-gyp payload.
+Native executable archives do not include the WASM payload. Normal native npm
+installations keep the direct native executable, without a runtime-selection
+check on each invocation.
+
+CI packs the regular wrapper with `pack-wrapper.mjs` and enforces a 20 MiB
+compressed size budget. The bundled runtime also increases native npm download
+size; it must be available before install scripts run for automatic WebContainer
+selection to work when those scripts are disabled.
+
+The full build uses the pinned nightly because `cap-primitives` requires unstable
+WASI filesystem APIs. Native builds retain the repository's stable toolchain.
+Download and extract [WASI SDK 34](https://github.com/WebAssembly/wasi-sdk/releases/tag/wasi-sdk-34)
+before setting `WASI_SDK_PATH`; the build checks its version and does not download
+a compiler. The SDK also builds bundled SQLite with threading enabled.
+Extract [WABT 1.0.42](https://github.com/WebAssembly/wabt/releases/tag/1.0.42)
+and set `WABT_PATH` to its directory containing `bin`. The build uses its validated
+WebAssembly text roundtrip to replace atomic waits with cancellable host imports.
+The runtime tests also use this toolchain.
+
+The browser test needs the Chromium installation described in the
+[ecosystem test guide](https://github.com/pnpm/pnpm/blob/main/pnpm/tasks/ecosystem-e2e/README.md#webcontainers).
+The Node tests require the freshly built probe; missing artifacts are errors.
+
+## Execution model
+
+The Node supervisor owns one WASI descriptor table, the filesystem permission
+adapter, network requests and child processes. Rust runs in workers sharing
+one WebAssembly memory. All workers use the supervisor's descriptor table,
+including when Tokio moves an open file between threads.
+
+The build exports `malloc`, `free`, `__tls_base` and `__wasm_init_tls` for the
+thread loader. The supervisor performs shared memory initialization; the main
+worker initializes its thread-local storage before calling `_start`.
+
+The `pnpm_atomic` imports provide cancellable atomic waits. WebContainer workers
+cannot terminate while parked in a WebAssembly atomic wait. The build rewrites
+only wait instructions; loads, stores, notifications and other atomics remain
+WebAssembly instructions. Host waits preserve guest deadlines and use bounded
+blocking intervals to observe cancellation without a lost wakeup.
+
+The `pnpm_host` imports start asynchronous operations and transfer responses.
+One Rust completion thread wakes pending futures. The supervisor retains result
+buffers until Rust reads or cancels them; it never retains pointers into guest
+memory. Each JSON request or response is limited to 1 MiB. Stream reads transfer
+at most 64 KiB of data at a time. HTTP uploads use a separate bounded stream,
+so package bodies can exceed the control-message limit. Dropping a request cancels it, and closing the
+runtime aborts outstanding operations before terminating the workers.
+
+The `pnpm_fs` imports supply operations WASI lacks: atomic creation with an
+explicit mode, descriptor-bound permission changes, and private lock
+directories. They use the same descriptor mapping as ordinary WASI calls.
+
+The runtime runs trusted pnpm code with the authority of its Node host. It
+preopens the host root; it is not a sandbox for arbitrary WASM modules. Inside
+WebContainers this is the container's virtual filesystem.
+
+## Current boundaries
+
+WebContainer's bundled npm applies package replacements through a private host
+integration. The standalone pnpm distribution does not depend on that API.
+Projects using native tools must select compatible WebAssembly packages through
+pnpm's existing overrides. For example, in `pnpm-workspace.yaml`:
+
+```yaml
+overrides:
+  esbuild: npm:esbuild-wasm@^0.27.0
+  rollup: npm:@rollup/wasm-node@^4.43.1
+```
+
+Match the replacement versions to the project's dependencies and commit the
+lockfile generated by `pnpm install`. This uses the normal resolver and integrity
+checks without implicitly substituting package contents.
+
+The browser controls HTTP protocol negotiation and connection pooling. Explicit
+custom TLS roots, client certificates, proxies, local addresses and DNS pinning
+are rejected by the WASM HTTP adapter. They are not silently ignored. Redirects
+remain controlled by the shared Rust network policy.
+
+Process cancellation enumerates descendants with the host's `/bin/ps` and
+signals them while the spawned parent is still owned. WebContainers do not
+support process-group signals or stable descendant identity handles. If a
+parent exits after a graceful signal while a descendant ignores that signal,
+the runtime cannot safely target the orphan during later escalation. It does
+not retain stale descendant PIDs. Runtime shutdown uses `SIGKILL` for live
+owned process trees.
+
+WebContainers do not reliably support numeric file descriptors in child-process
+stdio. File redirection therefore uses a pipe bridge, and waiting for the child
+also waits for the redirected output to finish writing. A background descendant
+that inherits redirected stdout or stderr keeps that wait pending until it closes
+the stream, even after the direct child exits. Background children should close
+or replace inherited redirected streams.
+
+WASM uses the `v11-wasm` store namespace; native pnpm keeps `v11`. The package
+file and index formats match, but live stores are isolated because the locking
+protocols differ. An explicit store path ending in `v11` also receives the
+`v11-wasm` suffix. Do not symlink the two namespaces together.
+
+SQLite uses a rollback journal and host process leases, because the WASI VFS
+cannot provide native advisory locking or WAL. Its [probe](https://github.com/pnpm/pnpm/blob/main/pnpm/tasks/ecosystem-e2e/webcontainer/sqlite-probe/README.md)
+and actual Rust store tests cover persistence, contention and crash recovery.
+
+WebContainers cannot restore changed installation metadata through a pinned
+directory handle. A failed mutation reports that automatic metadata rollback is
+unavailable; it does not write through an unsafe replacement directory. Automatic
+provenance signing is also unavailable and returns an explicit error.
+
+Compiling or passing the runtime probe does not establish that all pnpm commands
+work in WebContainers. The task tracks CLI integration, command coverage,
+packaging and native performance validation separately.

package/dist/wasm/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,42 @@
+# Third-Party Notices
+
+This product includes software derived from third-party sources. The
+components below, and their license terms, are listed here in satisfaction
+of those terms.
+
+## Yarn (`@yarnpkg/nm`, `@yarnpkg/extensions`)
+
+- Source: <https://github.com/yarnpkg/berry>
+- License: BSD 2-Clause
+
+The `nodeLinker: hoisted` layout is produced by a Rust port of the hoisting
+algorithm in `@yarnpkg/nm`, and the built-in package-compatibility database
+is a copy of the one in `@yarnpkg/extensions`.
+
+```text
+BSD 2-Clause License
+
+Copyright (c) 2016-present, Yarn Contributors.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+```

package/dist/wasm/host/atomic-waits.mjs

@@ -0,0 +1,43 @@
+import { createCancellationCheck } from './cancellation.mjs'
+
+// Cancellation can race the transition from checking its flag to waiting on guest memory.
+const WAIT_SLICE_MS = 100
+
+export function createAtomicWaits (memory, control, checkCancelled = createCancellationCheck(control)) {
+  const state = new Int32Array(control)
+  if (state.length < 2) throw new RangeError('Atomic wait control requires two i32 slots')
+  return {
+    wait32: (pointer, expected, timeout, offset) => wait(memory, state, pointer, expected, timeout, offset, 4, checkCancelled),
+    wait64: (pointer, expected, timeout, offset) => wait(memory, state, pointer, expected, timeout, offset, 8, checkCancelled),
+  }
+}
+
+export function cancelAtomicWaits (memory, control) {
+  const state = new Int32Array(control)
+  Atomics.store(state, 0, 1)
+  const address = Atomics.load(state, 1) >>> 0
+  if (address < memory.buffer.byteLength) Atomics.notify(new Int32Array(memory.buffer), address >>> 2)
+}
+
+function wait (memory, state, pointer, expected, timeout, offset, width, checkCancelled) {
+  const address = (pointer >>> 0) + (offset >>> 0)
+  if (address % width !== 0 || address + width > memory.buffer.byteLength) {
+    throw new WebAssembly.RuntimeError('Unaligned or out-of-bounds atomic wait')
+  }
+  const view = width === 4 ? new Int32Array(memory.buffer) : new BigInt64Array(memory.buffer)
+  const deadline = timeout < 0n ? Infinity : performance.now() + Number(timeout) / 1000000
+  Atomics.store(state, 1, address)
+  try {
+    while (true) {
+      checkCancelled()
+      const remaining = Math.max(0, deadline - performance.now())
+      const result = Atomics.wait(view, address / width, expected, Math.min(remaining, WAIT_SLICE_MS))
+      checkCancelled()
+      if (result === 'ok') return 0
+      if (result === 'not-equal') return 1
+      if (performance.now() >= deadline) return 2
+    }
+  } finally {
+    Atomics.store(state, 1, -1)
+  }
+}

package/dist/wasm/host/cancellation.mjs

@@ -0,0 +1,6 @@
+export function createCancellationCheck (control) {
+  const state = control && new Int32Array(control)
+  return () => {
+    if (state && Atomics.load(state, 0)) throw new WebAssembly.RuntimeError('WASM worker cancelled')
+  }
+}

package/dist/wasm/host/executable-mode.mjs

@@ -0,0 +1,8 @@
+export function hasExecutableMode (metadata) {
+  const user = process.getuid()
+  let permission = 0o1
+  if (user === 0) permission = 0o111
+  else if (metadata.uid === user) permission = 0o100
+  else if (metadata.gid === process.getgid() || process.getgroups().includes(metadata.gid)) permission = 0o10
+  return (metadata.mode & permission) !== 0
+}

package/dist/wasm/host/file-locks.mjs

@@ -0,0 +1,40 @@
+import { fstatSync } from 'node:fs'
+
+import { acquireFileLease } from './lock-registry.mjs'
+
+const busy = 6
+
+export function createFileLocks () {
+  const held = new Map()
+  function release (descriptor) {
+    const state = held.get(descriptor)
+    if (!state) return
+    held.delete(descriptor)
+    state.closed = true
+    state.lease?.release()
+  }
+  return {
+    tryLock (descriptor, exclusive) {
+      let state = held.get(descriptor)
+      if (!state) {
+        const metadata = fstatSync(descriptor, { bigint: true })
+        state = { identity: `${metadata.dev}:${metadata.ino}`, closed: false }
+        held.set(descriptor, state)
+      }
+      if (state.error) return 29
+      if (state.lease?.exclusive === exclusive) return 0
+      if (!state.pending) {
+        state.pending = true
+        acquireFileLease(state.identity, exclusive, state.lease).then(lease => {
+          if (state.closed) lease?.release()
+          else if (lease) state.lease = lease
+        }, error => { state.error = error }).finally(() => { state.pending = false })
+      }
+      return busy
+    },
+    release,
+    close () {
+      for (const descriptor of held.keys()) release(descriptor)
+    },
+  }
+}