@pnpm/exe 12.8.2 → 12.9.0

package/dist/wasm/host/network.mjs

@@ -0,0 +1,76 @@
+import { createStream } from './resources.mjs'
+
+export async function request (resources, options, signal) {
+  let url
+  try {
+    url = new URL(options.url)
+  } catch {
+    throw new TypeError('Invalid HTTP request URL')
+  }
+  if (url.username || url.password) throw new TypeError('HTTP URL credentials must be supplied as an Authorization header')
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+    throw new Error(`Unsupported HTTP protocol: ${url.protocol}`)
+  }
+  const controller = new AbortController()
+  const timeoutMs = options.timeoutMs ?? 60000
+  if (!Number.isInteger(timeoutMs) || timeoutMs < 1) throw new RangeError('Invalid HTTP timeout')
+  if (options.totalTimeoutMs != null && (!Number.isInteger(options.totalTimeoutMs) || options.totalTimeoutMs < 1)) {
+    throw new RangeError('Invalid HTTP total timeout')
+  }
+  const totalTimer = options.totalTimeoutMs == null ? null
+    : setTimeout(() => controller.abort(new Error('HTTP request deadline timed out')), options.totalTimeoutMs)
+  const timer = setTimeout(() => controller.abort(new Error('HTTP request timed out')), timeoutMs)
+  const pending = resources.add({ kind: 'request', close: () => controller.abort() })
+  try {
+    const body = options.bodyHandle == null ? options.body : resources.get(options.bodyHandle, 'upload').readable
+    const response = await fetch(url, {
+      method: options.method ?? 'GET',
+      headers: options.headers,
+      body,
+      ...(options.bodyHandle == null ? {} : { duplex: 'half' }),
+      redirect: 'manual',
+      signal: signal ? AbortSignal.any([controller.signal, signal]) : controller.signal,
+    })
+    const reader = response.body?.getReader()
+    const stream = createStream(
+      async () => {
+        const chunk = await readWithTimeout(reader, controller, timeoutMs)
+        if (chunk.done) clearTimeout(totalTimer)
+        return chunk
+      },
+      () => {
+        clearTimeout(totalTimer)
+        controller.abort()
+      },
+    )
+    signal?.throwIfAborted()
+    return {
+      handle: resources.add(stream),
+      status: response.status,
+      headers: decodedHeaders(response.headers),
+      url: response.url,
+    }
+  } catch (error) {
+    clearTimeout(totalTimer)
+    controller.abort()
+    throw error
+  } finally {
+    clearTimeout(timer)
+    resources.remove(pending)
+  }
+}
+
+function decodedHeaders (headers) {
+  const decoded = headers.get('content-encoding')?.split(',')
+    .every(encoding => ['gzip', 'deflate', 'br'].includes(encoding.trim().toLowerCase()))
+  return [...headers].filter(([name]) => !decoded || (name !== 'content-encoding' && name !== 'content-length'))
+}
+
+async function readWithTimeout (reader, controller, timeoutMs) {
+  const timer = setTimeout(() => controller.abort(new Error('HTTP response timed out')), timeoutMs)
+  try {
+    return await reader?.read() ?? { done: true }
+  } finally {
+    clearTimeout(timer)
+  }
+}

package/dist/wasm/host/operations.mjs

@@ -0,0 +1,67 @@
+import { request } from './network.mjs'
+import { endStdin, spawnProcess, tryWaitProcess, waitProcess, writeStdin } from './process.mjs'
+import { createResources } from './resources.mjs'
+import { createSignals } from './signals.mjs'
+import { spawnShell } from './shell.mjs'
+import { createUpload, writeUpload } from './upload.mjs'
+import { confirm, input, prompt } from './terminal.mjs'
+import { openTerminal, writeTerminal } from './terminal-session.mjs'
+import { password } from './terminal-password.mjs'
+
+export function createHostServices (configuration = {}) {
+  const resources = createResources()
+  const signals = createSignals(configuration.signalSource)
+  let closed = false
+  return {
+    async dispatch (message, options = {}) {
+      if (closed) throw new Error('WASM host services are closed')
+      options.signal?.throwIfAborted()
+      switch (message.operation) {
+      case 'network.request': return request(resources, message, options.signal)
+      case 'upload.create': return createUpload(resources)
+      case 'upload.write': return writeUpload(resources.get(message.handle, 'upload'), message.bytes)
+      case 'upload.end': return resources.get(message.handle, 'upload').writer.close()
+      case 'stream.read': return resources.get(message.handle, 'stream').read(message.maxBytes)
+      case 'resource.close': return resources.close(message.handle)
+      case 'process.spawn': return spawnProcess(resources, message, {
+        signal: options.signal, acquireDescriptor: configuration.acquireDescriptor,
+      })
+      case 'shell.spawn': return spawnShell(resources, message, {
+        signal: options.signal, acquireDescriptor: configuration.acquireDescriptor,
+      })
+      case 'process.write': return writeStdin(resources.get(message.handle, 'process'), message.bytes)
+      case 'process.endDetached':
+        resources.get(message.handle, 'process').child.stdin?.end()
+        return null
+      case 'process.closeStdin':
+        resources.get(message.handle, 'process').child.stdin?.destroy()
+        return null
+      case 'process.end': return endStdin(resources.get(message.handle, 'process'))
+      case 'process.wait': return waitProcess(resources.get(message.handle, 'process'))
+      case 'process.tryWait': return tryWaitProcess(resources.get(message.handle, 'process'))
+      case 'process.release':
+        resources.get(message.handle, 'process')
+        resources.remove(message.handle)
+        return null
+      case 'process.killPid':
+        return resources.findProcess(message.pid).kill(message.signal ?? 'SIGTERM')
+      case 'process.kill': return resources.get(message.handle, 'process').kill(message.signal ?? 'SIGTERM')
+      case 'signal.next': return signals.next(options)
+      case 'terminal.status': return { stdin: Boolean(process.stdin.isTTY), stdout: Boolean(process.stdout.isTTY), stderr: Boolean(process.stderr.isTTY) }
+      case 'terminal.open': return openTerminal(resources)
+      case 'terminal.readKey': return resources.get(message.handle, 'terminal').read(options.signal)
+      case 'terminal.write': return writeTerminal(resources.get(message.handle, 'terminal'), message.text)
+      case 'terminal.prompt': return prompt(message, options)
+      case 'terminal.confirm': return confirm(message, options)
+      case 'terminal.input': return input(message, options)
+      case 'terminal.password': return password(message, options)
+      default: throw new Error(`Unknown WASM host operation: ${message.operation}`)
+      }
+    },
+    async close () {
+      closed = true
+      signals.close()
+      await resources.closeAll()
+    },
+  }
+}

package/dist/wasm/host/poll.mjs

@@ -0,0 +1,74 @@
+import { performance } from 'node:perf_hooks'
+import { setTimeout } from 'node:timers/promises'
+
+import { errno } from './wasi-errno.mjs'
+
+const { AbortController } = globalThis
+
+// Clock polling must yield the supervisor so other guest threads, leases and
+// process termination remain responsive while a Rust thread sleeps.
+export function createPoll (memory) {
+  const controller = new AbortController()
+  return { close () { controller.abort() }, async poll (input, output, count, written) {
+    try {
+      if (!input || !output || !count || !written) return errno.EINVAL
+      const subscriptions = readSubscriptions(memory, input >>> 0, count >>> 0)
+      new Uint8Array(memory.buffer, output >>> 0, (count >>> 0) * 32)
+      new DataView(memory.buffer).setUint32(written >>> 0, 0, true)
+      const descriptors = subscriptions.filter(subscription => subscription.type !== 0)
+      if (descriptors.length) return writeEvents(memory, { output, written }, descriptors, errno.ENOSYS)
+      const first = subscriptions.reduce((earliest, entry) => entry.delay < earliest.delay ? entry : earliest)
+      await waitForClock(first.delay, controller.signal)
+      return writeEvents(memory, { output, written }, [first], 0)
+    } catch (error) {
+      if (error.name === 'AbortError') return errno.EINTR
+      if (error instanceof RangeError) return errno.EFAULT
+      if (error.code === 'EINVAL') return errno.EINVAL
+      throw error
+    }
+  } }
+}
+
+function readSubscriptions (memory, input, count) {
+  const view = new DataView(memory.buffer, input, count * 48)
+  return Array.from({ length: count }, (_, index) => {
+    const offset = index * 48
+    const type = view.getUint8(offset + 8)
+    if (type > 2) throw Object.assign(new Error('Invalid WASI subscription type'), { code: 'EINVAL' })
+    return { userdata: view.getBigUint64(offset, true), type, delay: type === 0 ? clockDelay(view, offset) : 0n }
+  })
+}
+
+function clockDelay (view, offset) {
+  const clock = view.getUint32(offset + 16, true)
+  const timeout = view.getBigUint64(offset + 24, true)
+  const flags = view.getUint16(offset + 40, true)
+  if (clock > 3 || flags > 1) throw Object.assign(new Error('Invalid WASI clock subscription'), { code: 'EINVAL' })
+  if (flags === 0) return timeout
+  // Match the clock epoch used by the injected WASI clock_time_get import.
+  const now = BigInt(Math.floor(clock === 0 ? Date.now() : performance.now())) * 1000000n
+  return timeout > now ? timeout - now : 0n
+}
+
+async function waitForClock (delay, signal) {
+  const deadline = performance.now() + Number(delay) / 1000000
+  let remaining = deadline - performance.now()
+  do {
+    // eslint-disable-next-line no-await-in-loop -- Recheck the deadline after early or maximum-length timers.
+    await setTimeout(Math.min(Math.ceil(Math.max(remaining, 0)), 2147483647), undefined, { signal })
+    remaining = deadline - performance.now()
+  } while (remaining > 0)
+}
+
+function writeEvents (memory, { output, written }, subscriptions, error) {
+  const view = new DataView(memory.buffer)
+  subscriptions.forEach((subscription, index) => {
+    const offset = (output >>> 0) + index * 32
+    new Uint8Array(memory.buffer, offset, 32).fill(0)
+    view.setBigUint64(offset, subscription.userdata, true)
+    view.setUint16(offset + 8, error, true)
+    view.setUint8(offset + 10, subscription.type)
+  })
+  view.setUint32(written >>> 0, subscriptions.length, true)
+  return 0
+}

package/dist/wasm/host/process-stdio.mjs

@@ -0,0 +1,41 @@
+import { createReadStream, createWriteStream } from 'node:fs'
+import { pipeline } from 'node:stream/promises'
+
+export function prepareStdio (options, acquireDescriptor) {
+  const redirects = new Map()
+  try {
+    const modes = ['stdin', 'stdout', 'stderr'].map((name, index) => {
+      const mode = options[name] ?? 'pipe'
+      if (mode && typeof mode === 'object' && Number.isInteger(mode.fd) && mode.fd >= 0) {
+        if (!acquireDescriptor) throw new Error('WASI descriptor leasing is unavailable')
+        const lease = acquireDescriptor(mode.fd)
+        if (!Number.isInteger(lease.fd) || lease.fd < 0) throw new Error(`Invalid WASI descriptor: ${mode.fd}`)
+        redirects.set(index, lease)
+        return 'pipe'
+      }
+      if (!['pipe', 'inherit', 'ignore'].includes(mode)) throw new Error(`Invalid stdio mode: ${mode}`)
+      return mode
+    })
+    return { modes, redirects, release: () => release(redirects) }
+  } catch (error) {
+    release(redirects)
+    throw error
+  }
+}
+
+export function bridgeDescriptors (child, redirects) {
+  return Promise.allSettled([...redirects].map(async ([index, lease]) => {
+    try {
+      if (index === 0) await pipeline(createReadStream(null, { fd: lease.fd, autoClose: false }), child.stdin)
+      else await pipeline(child.stdio[index], createWriteStream(null, { fd: lease.fd, autoClose: false }))
+    } catch (error) {
+      if (index !== 0 || !['EPIPE', 'ERR_STREAM_PREMATURE_CLOSE'].includes(error.code)) throw error
+    } finally {
+      lease.release()
+    }
+  })).then(results => results.find(result => result.status === 'rejected')?.reason)
+}
+
+function release (redirects) {
+  for (const lease of redirects.values()) lease.release()
+}

package/dist/wasm/host/process-tree.mjs

@@ -0,0 +1,54 @@
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+
+const executeFile = promisify(execFile)
+
+export async function killProcessTree (child, signal) {
+  if (!isRunning(child)) return false
+  let stdout
+  try {
+    ({ stdout } = await executeFile('/bin/ps', ['-eo', 'pid,ppid'], {
+      timeout: 2000, maxBuffer: 4 * 1024 * 1024, encoding: 'utf8',
+    }))
+  } catch (error) {
+    if (isRunning(child)) child.kill(signal)
+    throw error
+  }
+  if (!isRunning(child)) return false
+  const descendants = findDescendants(stdout, child.pid)
+  for (const pid of descendants.reverse()) signalProcess(pid, signal)
+  return child.kill(signal)
+}
+
+export function findDescendants (listing, parentPid) {
+  const children = new Map()
+  for (const line of listing.trim().split('\n').slice(1)) {
+    const [pid, parent] = line.trim().split(/\s+/).map(Number)
+    if (!Number.isInteger(pid) || pid < 1 || !Number.isInteger(parent) || parent < 0) continue
+    const siblings = children.get(parent) ?? []
+    siblings.push(pid)
+    children.set(parent, siblings)
+  }
+  const descendants = []
+  const visited = new Set([parentPid])
+  const pending = [...(children.get(parentPid) ?? [])]
+  for (const pid of pending) {
+    if (visited.has(pid)) continue
+    visited.add(pid)
+    descendants.push(pid)
+    pending.push(...(children.get(pid) ?? []))
+  }
+  return descendants
+}
+
+function isRunning (child) {
+  return child.pid !== undefined && child.exitCode === null && child.signalCode === null
+}
+
+function signalProcess (pid, signal) {
+  try {
+    process.kill(pid, signal)
+  } catch (error) {
+    if (error.code !== 'ESRCH') throw error
+  }
+}

package/dist/wasm/host/process.mjs

@@ -0,0 +1,126 @@
+import { spawn } from 'node:child_process'
+import { once } from 'node:events'
+import { constants } from 'node:os'
+
+import { killProcessTree } from './process-tree.mjs'
+import { createStream } from './resources.mjs'
+import { bridgeDescriptors, prepareStdio } from './process-stdio.mjs'
+
+export async function spawnProcess (resources, options, { signal, acquireDescriptor } = {}) {
+  const stdio = prepareStdio(options, acquireDescriptor)
+  const child = startProcess(options, stdio)
+  const processResource = trackProcess(child, bridgeDescriptors(child, stdio.redirects))
+  const abort = () => {
+    processResource.cancellation = processResource.close().then(() => signal.reason, error => error)
+  }
+  signal?.addEventListener('abort', abort, { once: true })
+  void processResource.completion.then(() => signal?.removeEventListener('abort', abort))
+  const handle = resources.add(processResource)
+  const stdout = addPipe(resources, stdio.redirects.has(1) ? null : child.stdout)
+  const stderr = addPipe(resources, stdio.redirects.has(2) ? null : child.stderr)
+  try {
+    await once(child, 'spawn')
+    signal?.throwIfAborted()
+  } catch (error) {
+    resources.remove(handle)
+    if (stdout !== null) resources.remove(stdout)
+    if (stderr !== null) resources.remove(stderr)
+    await processResource.close()
+    throw error
+  }
+  return {
+    handle,
+    pid: child.pid,
+    stdout,
+    stderr,
+  }
+}
+
+export async function writeStdin (resource, bytes) {
+  if (resource.inputError) throw resource.inputError
+  if (!(bytes instanceof Uint8Array)) throw new TypeError('Process input must be a Uint8Array')
+  if (!resource.child.stdin) throw new Error('Process stdin is not piped')
+  await new Promise((resolve, reject) => {
+    resource.child.stdin.write(bytes, error => error ? reject(error) : resolve())
+  })
+}
+
+export async function endStdin (resource) {
+  if (resource.inputError) throw resource.inputError
+  if (!resource.child.stdin) throw new Error('Process stdin is not piped')
+  await new Promise((resolve, reject) => {
+    resource.child.stdin.end(error => error ? reject(error) : resolve())
+  })
+}
+
+export async function waitProcess (resource) {
+  const result = await resource.completion
+  const cancellationError = await resource.cancellation
+  if (cancellationError) throw cancellationError
+  if (result.error) throw result.error
+  return result
+}
+
+export function tryWaitProcess (resource) {
+  if (resource.status?.error) throw resource.status.error
+  return resource.status
+}
+
+function addPipe (resources, pipe) {
+  if (!pipe) return null
+  const iterator = pipe[Symbol.asyncIterator]()
+  const next = () => iterator.next().then(result => ({ result }), error => ({ error }))
+  let pending = next()
+  return resources.add(createStream(async () => {
+    const settled = await pending
+    if (settled.error) throw settled.error
+    if (!settled.result.done) pending = next()
+    return settled.result
+  }, () => pipe.destroy()))
+}
+
+function startProcess (options, stdio) {
+  try {
+    return spawn(options.program, options.args ?? [], {
+      cwd: options.cwd, env: options.env, stdio: stdio.modes,
+    })
+  } catch (error) {
+    stdio.release()
+    throw error
+  }
+}
+
+function trackProcess (child, redirected) {
+  const completion = new Promise(resolve => {
+    child.once('error', error => resolve({ error }))
+    child.once('exit', (code, signal) => resolve(exitStatus(code, signal)))
+  }).then(async result => {
+    const error = result.error ?? await redirected
+    return error ? { error } : result
+  })
+  const resource = {
+    kind: 'process',
+    child,
+    completion,
+    kill: signal => killProcessTree(child, signal),
+    inputError: null,
+    status: null,
+    async close () {
+      try {
+        await killProcessTree(child, 'SIGKILL')
+      } finally {
+        child.stdin?.destroy()
+        child.stdout?.destroy()
+        child.stderr?.destroy()
+        await completion
+      }
+    },
+  }
+  child.stdin?.on('error', error => { resource.inputError = error })
+  void completion.then(result => { resource.status = result })
+  return resource
+}
+
+function exitStatus (code, signal) {
+  return { code, signal, signalNumber: signal === null ? null : constants.signals[signal] ?? null }
+}

package/dist/wasm/host/protocol.mjs

@@ -0,0 +1 @@
+export const RESPONSE_CAPACITY = 1024 * 1024

package/dist/wasm/host/resources.mjs

@@ -0,0 +1,76 @@
+export function createResources () {
+  const resources = new Map()
+  let nextHandle = 1
+  let closed = false
+  return {
+    add (resource) {
+      if (closed) throw new Error('WASM host resources are closed')
+      if (nextHandle > 0x7fffffff) throw new Error('WASM host resource handles exhausted')
+      const handle = nextHandle++
+      resources.set(handle, resource)
+      return handle
+    },
+    get (handle, kind) {
+      const resource = resources.get(handle)
+      if (!resource || resource.kind !== kind) throw new Error(`Invalid ${kind} handle: ${handle}`)
+      return resource
+    },
+    findProcess (pid) {
+      const resource = [...resources.values()].find(resource => resource.kind === 'process' && resource.child.pid === pid)
+      if (!resource) throw Object.assign(new Error(`No owned process with PID ${pid}`), { code: 'ESRCH' })
+      return resource
+    },
+    remove (handle) {
+      resources.delete(handle)
+    },
+    async close (handle) {
+      const resource = resources.get(handle)
+      if (!resource) throw new Error(`Invalid resource handle: ${handle}`)
+      resources.delete(handle)
+      await resource.close()
+    },
+    async closeAll () {
+      closed = true
+      const pending = [...resources.values()]
+      resources.clear()
+      const results = await Promise.allSettled(pending.map(resource => resource.close()))
+      const errors = results.filter(result => result.status === 'rejected').map(result => result.reason)
+      if (errors.length) throw new AggregateError(errors, 'Failed to close WASM host resources')
+    },
+  }
+}
+
+export function createStream (reader, cancel) {
+  let remainder = new Uint8Array()
+  let reading = false
+  let closed = false
+  return {
+    kind: 'stream',
+    async read (maxBytes = 65536) {
+      if (!Number.isInteger(maxBytes) || maxBytes < 1 || maxBytes > 65536) {
+        throw new RangeError('Stream read size must be between 1 and 65536')
+      }
+      if (reading) throw new Error('Concurrent reads of one stream are not supported')
+      if (closed) throw new Error('Stream is closed')
+      reading = true
+      try {
+        while (remainder.length === 0) {
+          // eslint-disable-next-line no-await-in-loop -- Empty chunks must be consumed before returning stream bytes.
+          const result = await reader()
+          if (result.done) return { bytes: new Uint8Array(), done: true }
+          remainder = result.value
+        }
+        const bytes = Uint8Array.from(remainder.subarray(0, maxBytes))
+        remainder = remainder.subarray(bytes.length)
+        return { bytes, done: false }
+      } finally {
+        reading = false
+      }
+    },
+    async close () {
+      closed = true
+      remainder = new Uint8Array()
+      await cancel()
+    },
+  }
+}

package/dist/wasm/host/shell-runner.mjs

@@ -0,0 +1,8 @@
+import { execute } from '@yarnpkg/shell'
+
+try {
+  process.exitCode = await execute(process.argv[2], process.argv.slice(3))
+} catch (error) {
+  console.error(error.message)
+  process.exitCode = 1
+}

package/dist/wasm/host/shell.mjs

@@ -0,0 +1,19 @@
+import { fileURLToPath } from 'node:url'
+
+import { parseShell } from '@yarnpkg/parsers'
+import { globUtils } from '@yarnpkg/shell'
+
+import { spawnProcess } from './process.mjs'
+
+export function spawnShell (resources, options, configuration) {
+  try {
+    parseShell(options.script, globUtils)
+  } catch (error) {
+    throw Object.assign(new Error(error.message, { cause: error }), { code: 'ESHELLPARSE' })
+  }
+  return spawnProcess(resources, {
+    ...options,
+    program: process.execPath,
+    args: [fileURLToPath(new URL('./shell-runner.mjs', import.meta.url)), options.script, ...(options.args ?? [])],
+  }, configuration)
+}

package/dist/wasm/host/signals.mjs

@@ -0,0 +1,49 @@
+export function createSignals (source = process) {
+  const queued = []
+  const waiters = []
+  let handlers
+  let closed = false
+
+  function subscribe () {
+    if (handlers) return
+    handlers = ['SIGINT', 'SIGTERM'].map(signal => {
+      const listener = () => {
+        const value = { signal, number: signal === 'SIGINT' ? 2 : 15 }
+        const waiter = waiters.shift()
+        if (waiter) waiter.resolve(value)
+        else queued.push(value)
+      }
+      source.on(signal, listener)
+      return [signal, listener]
+    })
+  }
+
+  return {
+    next ({ signal } = {}) {
+      if (closed) return Promise.reject(new Error('Signal subscription is closed'))
+      signal?.throwIfAborted()
+      subscribe()
+      if (queued.length) return Promise.resolve(queued.shift())
+      return new Promise((resolve, reject) => {
+        const abort = () => {
+          const index = waiters.indexOf(waiter)
+          if (index !== -1) waiters.splice(index, 1)
+          waiter.reject(signal.reason)
+        }
+        const finish = callback => value => {
+          signal?.removeEventListener('abort', abort)
+          callback(value)
+        }
+        const waiter = { resolve: finish(resolve), reject: finish(reject) }
+        waiters.push(waiter)
+        signal?.addEventListener('abort', abort, { once: true })
+      })
+    },
+    close () {
+      closed = true
+      for (const [signal, listener] of handlers ?? []) source.off(signal, listener)
+      for (const waiter of waiters.splice(0)) waiter.reject(new Error('Signal subscription is closed'))
+      queued.length = 0
+    },
+  }
+}

package/dist/wasm/host/terminal-input.mjs

@@ -0,0 +1,7 @@
+const activeInputs = new WeakSet()
+
+export function claimTerminalInput (input) {
+  if (activeInputs.has(input)) throw new Error('A terminal prompt is already active')
+  activeInputs.add(input)
+  return () => activeInputs.delete(input)
+}

package/dist/wasm/host/terminal-password.mjs

@@ -0,0 +1,32 @@
+import { createResources } from './resources.mjs'
+import { openTerminal, writeTerminal } from './terminal-session.mjs'
+
+export async function password (options, context = {}) {
+  if (typeof options.message !== 'string') throw new TypeError('Password prompt message must be a string')
+  context.signal?.throwIfAborted()
+  const resources = createResources()
+  try {
+    const { handle } = await openTerminal(resources, { ...context, output: context.output ?? process.stderr, maxQueuedKeys: 65536 })
+    const session = resources.get(handle, 'terminal')
+    await writeTerminal(session, `${options.message}: `)
+    return await readPassword(session, options.allowEmpty, context.signal)
+  } finally {
+    await resources.closeAll()
+  }
+}
+
+async function readPassword (session, allowEmpty, signal) {
+  const characters = []
+  while (true) {
+    // eslint-disable-next-line no-await-in-loop -- input must be consumed in key order
+    const key = await session.read(signal)
+    if (['ctrl-c', 'escape', 'eof'].includes(key.name)) throw Object.assign(new Error('Password input cancelled'), { code: 'EINTR' })
+    if (key.name === 'enter' && (allowEmpty || characters.length)) {
+      await writeTerminal(session, '\n') // eslint-disable-line no-await-in-loop -- newline is emitted only after accepting the complete password
+      return characters.join('')
+    }
+    if (key.name === 'backspace' || key.name === 'delete') characters.pop()
+    else if (key.character && Array.from(key.character).every(character => character >= ' ' && character !== '\x7f')) characters.push(key.character)
+    if (characters.length > 65536) throw new Error('Password input exceeds the terminal limit')
+  }
+}