@pnpm/exe 12.9.0 → 12.10.0

package/pnpx

@@ -1,2 +1,76 @@
-#!/usr/bin/env node
-import './bin/pnpx.mjs'
+# Shebang-less for the reason ./pnpm gives: install.js puts the native binary
+# at this path too.
+#
+# `pnpx` is `pnpm dlx`. The pnpm it hands over to is the one installed alongside
+# it, found relative to this file: a `PATH` lookup would run whatever other pnpm
+# comes first there, and would find nothing at all when the directory holding
+# these bins is not on `PATH`.
+#
+# $0 is whatever shim or symlink `pnpx` was launched through, so walk to the file
+# itself first. The hop cap matches the kernel's ELOOP limit, so a cycle cannot
+# hang the script. Directories come from `${self%/*}` and `readlink` runs through
+# `command -p`, so the caller's `PATH` decides nothing here.
+#
+# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
+# instead, with node_modules and relative entries dropped from it.
+caller_path_set=${PATH+set}
+caller_path=${PATH-}
+helper_path=
+rest=$caller_path:
+while [ -n "$rest" ]; do
+  dir=${rest%%:*}
+  rest=${rest#*:}
+  case "$dir" in
+    */node_modules/*|*/node_modules) ;;
+    /*) helper_path=${helper_path:+$helper_path:}$dir ;;
+  esac
+done
+# An empty PATH searches the current directory.
+PATH=${helper_path:-/}
+# A helper comes from PATH only when the default path lacks it and PATH has it.
+# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
+run_helper() {
+  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
+}
+self=$0
+# MSYS and Cygwin can launch this with a native Windows path, which has no slash
+# for `${self%/*}` to strip. Only a drive letter or a UNC prefix marks one; a
+# backslash anywhere else is an ordinary character in a Unix file name, so the
+# path is left alone. The separators are swapped in the shell rather than through
+# `echo`, which mangles a `\t` or `\b` in a path under dash.
+case $self in
+  [A-Za-z]:\\*|\\\\*)
+    while :; do
+      case $self in
+        *\\*) self=${self%%\\*}/${self#*\\} ;;
+        *) break ;;
+      esac
+    done
+    ;;
+esac
+# `${self%/*}` needs a slash to strip. A bare name came from a `PATH` lookup and
+# stands for a file in the current directory.
+case $self in
+  */*) ;;
+  *) self=./$self ;;
+esac
+hops=0
+while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
+  hops=$((hops + 1))
+  link=$(run_helper readlink "$self")
+  case $link in
+    /*) self=$link ;;
+    *) self=${self%/*}/$link ;;
+  esac
+done
+if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
+# The walk has to end at a regular file. Running out of hops leaves $self a
+# symlink; a chain that changed under us can leave it dangling or a directory, and
+# a failed readlink leaves a trailing slash. Each case would take `pnpm` from the
+# wrong directory — the substitution this script exists to prevent.
+if [ -L "$self" ] || [ ! -f "$self" ]; then
+  echo "pnpx: could not resolve $0 to a regular file within 40 symlink hops." >&2
+  exit 1
+fi
+
+exec "${self%/*}/pnpm" dlx "$@"

package/pnx

@@ -1,2 +1,76 @@
-#!/usr/bin/env node
-import './bin/pnpx.mjs'
+# Shebang-less for the reason ./pnpm gives: install.js puts the native binary
+# at this path too.
+#
+# `pnx` is `pnpm dlx`. The pnpm it hands over to is the one installed alongside
+# it, found relative to this file: a `PATH` lookup would run whatever other pnpm
+# comes first there, and would find nothing at all when the directory holding
+# these bins is not on `PATH`.
+#
+# $0 is whatever shim or symlink `pnx` was launched through, so walk to the file
+# itself first. The hop cap matches the kernel's ELOOP limit, so a cycle cannot
+# hang the script. Directories come from `${self%/*}` and `readlink` runs through
+# `command -p`, so the caller's `PATH` decides nothing here.
+#
+# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
+# instead, with node_modules and relative entries dropped from it.
+caller_path_set=${PATH+set}
+caller_path=${PATH-}
+helper_path=
+rest=$caller_path:
+while [ -n "$rest" ]; do
+  dir=${rest%%:*}
+  rest=${rest#*:}
+  case "$dir" in
+    */node_modules/*|*/node_modules) ;;
+    /*) helper_path=${helper_path:+$helper_path:}$dir ;;
+  esac
+done
+# An empty PATH searches the current directory.
+PATH=${helper_path:-/}
+# A helper comes from PATH only when the default path lacks it and PATH has it.
+# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
+run_helper() {
+  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
+}
+self=$0
+# MSYS and Cygwin can launch this with a native Windows path, which has no slash
+# for `${self%/*}` to strip. Only a drive letter or a UNC prefix marks one; a
+# backslash anywhere else is an ordinary character in a Unix file name, so the
+# path is left alone. The separators are swapped in the shell rather than through
+# `echo`, which mangles a `\t` or `\b` in a path under dash.
+case $self in
+  [A-Za-z]:\\*|\\\\*)
+    while :; do
+      case $self in
+        *\\*) self=${self%%\\*}/${self#*\\} ;;
+        *) break ;;
+      esac
+    done
+    ;;
+esac
+# `${self%/*}` needs a slash to strip. A bare name came from a `PATH` lookup and
+# stands for a file in the current directory.
+case $self in
+  */*) ;;
+  *) self=./$self ;;
+esac
+hops=0
+while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
+  hops=$((hops + 1))
+  link=$(run_helper readlink "$self")
+  case $link in
+    /*) self=$link ;;
+    *) self=${self%/*}/$link ;;
+  esac
+done
+if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
+# The walk has to end at a regular file. Running out of hops leaves $self a
+# symlink; a chain that changed under us can leave it dangling or a directory, and
+# a failed readlink leaves a trailing slash. Each case would take `pnpm` from the
+# wrong directory — the substitution this script exists to prevent.
+if [ -L "$self" ] || [ ! -f "$self" ]; then
+  echo "pnx: could not resolve $0 to a regular file within 40 symlink hops." >&2
+  exit 1
+fi
+
+exec "${self%/*}/pnpm" dlx "$@"

package/dist/wasm/LICENSE

@@ -1,22 +0,0 @@
-The MIT License (MIT)
-
-Copyright (c) 2015-2016 Rico Sta. Cruz and other contributors
-Copyright (c) 2016-2026 Zoltan Kochan and other contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/dist/wasm/README.md

@@ -1,140 +0,0 @@
-# WebContainer runtime
-
-This runtime executes the pnpm v12 CLI as threaded WebAssembly inside StackBlitz
-WebContainers. The regular npm wrapper includes this runtime and `pnpm.wasm`
-under `dist/wasm` and selects it using `process.versions.webcontainer`. The
-standalone distribution is also available for testing builds before release.
-Implementation and validation are tracked in
-[pnpm/tasks#63](https://github.com/pnpm/tasks/issues/63).
-
-Native pnpm does not load this package. Native implementations remain selected
-at compile time.
-
-## Build and test
-
-From the repository root, with workspace dependencies installed:
-
-```sh
-rustup toolchain install nightly-2026-08-27 --profile minimal --target wasm32-wasip1-threads
-export WASI_SDK_PATH=/path/to/wasi-sdk-34.0
-export WABT_PATH=/path/to/wabt-1.0.42
-pnpm build:pnpm:wasm
-pnpm pack:pnpm:wasm
-node pnpm/wasm/stage.mjs
-pnpm build:wasm-runtime-probe
-pnpm --filter @pnpm-private/wasm-runtime test
-node pnpm/tasks/ecosystem-e2e/webcontainer/run.mjs --wasm-runtime target/wasm-runtime-probe/wasm32-wasip1-threads/debug/pnpm-wasm-runtime-probe.wasm
-```
-
-`stage.mjs` prepares the self-contained `pnpm/npm/pnpm/dist/wasm` payload for
-the regular npm wrapper. Release jobs restore it after the node-gyp payload.
-Native executable archives do not include the WASM payload. Normal native npm
-installations keep the direct native executable, without a runtime-selection
-check on each invocation.
-
-CI packs the regular wrapper with `pack-wrapper.mjs` and enforces a 20 MiB
-compressed size budget. The bundled runtime also increases native npm download
-size; it must be available before install scripts run for automatic WebContainer
-selection to work when those scripts are disabled.
-
-The full build uses the pinned nightly because `cap-primitives` requires unstable
-WASI filesystem APIs. Native builds retain the repository's stable toolchain.
-Download and extract [WASI SDK 34](https://github.com/WebAssembly/wasi-sdk/releases/tag/wasi-sdk-34)
-before setting `WASI_SDK_PATH`; the build checks its version and does not download
-a compiler. The SDK also builds bundled SQLite with threading enabled.
-Extract [WABT 1.0.42](https://github.com/WebAssembly/wabt/releases/tag/1.0.42)
-and set `WABT_PATH` to its directory containing `bin`. The build uses its validated
-WebAssembly text roundtrip to replace atomic waits with cancellable host imports.
-The runtime tests also use this toolchain.
-
-The browser test needs the Chromium installation described in the
-[ecosystem test guide](https://github.com/pnpm/pnpm/blob/main/pnpm/tasks/ecosystem-e2e/README.md#webcontainers).
-The Node tests require the freshly built probe; missing artifacts are errors.
-
-## Execution model
-
-The Node supervisor owns one WASI descriptor table, the filesystem permission
-adapter, network requests and child processes. Rust runs in workers sharing
-one WebAssembly memory. All workers use the supervisor's descriptor table,
-including when Tokio moves an open file between threads.
-
-The build exports `malloc`, `free`, `__tls_base` and `__wasm_init_tls` for the
-thread loader. The supervisor performs shared memory initialization; the main
-worker initializes its thread-local storage before calling `_start`.
-
-The `pnpm_atomic` imports provide cancellable atomic waits. WebContainer workers
-cannot terminate while parked in a WebAssembly atomic wait. The build rewrites
-only wait instructions; loads, stores, notifications and other atomics remain
-WebAssembly instructions. Host waits preserve guest deadlines and use bounded
-blocking intervals to observe cancellation without a lost wakeup.
-
-The `pnpm_host` imports start asynchronous operations and transfer responses.
-One Rust completion thread wakes pending futures. The supervisor retains result
-buffers until Rust reads or cancels them; it never retains pointers into guest
-memory. Each JSON request or response is limited to 1 MiB. Stream reads transfer
-at most 64 KiB of data at a time. HTTP uploads use a separate bounded stream,
-so package bodies can exceed the control-message limit. Dropping a request cancels it, and closing the
-runtime aborts outstanding operations before terminating the workers.
-
-The `pnpm_fs` imports supply operations WASI lacks: atomic creation with an
-explicit mode, descriptor-bound permission changes, and private lock
-directories. They use the same descriptor mapping as ordinary WASI calls.
-
-The runtime runs trusted pnpm code with the authority of its Node host. It
-preopens the host root; it is not a sandbox for arbitrary WASM modules. Inside
-WebContainers this is the container's virtual filesystem.
-
-## Current boundaries
-
-WebContainer's bundled npm applies package replacements through a private host
-integration. The standalone pnpm distribution does not depend on that API.
-Projects using native tools must select compatible WebAssembly packages through
-pnpm's existing overrides. For example, in `pnpm-workspace.yaml`:
-
-```yaml
-overrides:
-  esbuild: npm:esbuild-wasm@^0.27.0
-  rollup: npm:@rollup/wasm-node@^4.43.1
-```
-
-Match the replacement versions to the project's dependencies and commit the
-lockfile generated by `pnpm install`. This uses the normal resolver and integrity
-checks without implicitly substituting package contents.
-
-The browser controls HTTP protocol negotiation and connection pooling. Explicit
-custom TLS roots, client certificates, proxies, local addresses and DNS pinning
-are rejected by the WASM HTTP adapter. They are not silently ignored. Redirects
-remain controlled by the shared Rust network policy.
-
-Process cancellation enumerates descendants with the host's `/bin/ps` and
-signals them while the spawned parent is still owned. WebContainers do not
-support process-group signals or stable descendant identity handles. If a
-parent exits after a graceful signal while a descendant ignores that signal,
-the runtime cannot safely target the orphan during later escalation. It does
-not retain stale descendant PIDs. Runtime shutdown uses `SIGKILL` for live
-owned process trees.
-
-WebContainers do not reliably support numeric file descriptors in child-process
-stdio. File redirection therefore uses a pipe bridge, and waiting for the child
-also waits for the redirected output to finish writing. A background descendant
-that inherits redirected stdout or stderr keeps that wait pending until it closes
-the stream, even after the direct child exits. Background children should close
-or replace inherited redirected streams.
-
-WASM uses the `v11-wasm` store namespace; native pnpm keeps `v11`. The package
-file and index formats match, but live stores are isolated because the locking
-protocols differ. An explicit store path ending in `v11` also receives the
-`v11-wasm` suffix. Do not symlink the two namespaces together.
-
-SQLite uses a rollback journal and host process leases, because the WASI VFS
-cannot provide native advisory locking or WAL. Its [probe](https://github.com/pnpm/pnpm/blob/main/pnpm/tasks/ecosystem-e2e/webcontainer/sqlite-probe/README.md)
-and actual Rust store tests cover persistence, contention and crash recovery.
-
-WebContainers cannot restore changed installation metadata through a pinned
-directory handle. A failed mutation reports that automatic metadata rollback is
-unavailable; it does not write through an unsafe replacement directory. Automatic
-provenance signing is also unavailable and returns an explicit error.
-
-Compiling or passing the runtime probe does not establish that all pnpm commands
-work in WebContainers. The task tracks CLI integration, command coverage,
-packaging and native performance validation separately.

package/dist/wasm/THIRD-PARTY-NOTICES.md

@@ -1,42 +0,0 @@
-# Third-Party Notices
-
-This product includes software derived from third-party sources. The
-components below, and their license terms, are listed here in satisfaction
-of those terms.
-
-## Yarn (`@yarnpkg/nm`, `@yarnpkg/extensions`)
-
-- Source: <https://github.com/yarnpkg/berry>
-- License: BSD 2-Clause
-
-The `nodeLinker: hoisted` layout is produced by a Rust port of the hoisting
-algorithm in `@yarnpkg/nm`, and the built-in package-compatibility database
-is a copy of the one in `@yarnpkg/extensions`.
-
-```text
-BSD 2-Clause License
-
-Copyright (c) 2016-present, Yarn Contributors.
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-1. Redistributions of source code must retain the above copyright notice, this
-   list of conditions and the following disclaimer.
-
-2. Redistributions in binary form must reproduce the above copyright notice,
-   this list of conditions and the following disclaimer in the documentation
-   and/or other materials provided with the distribution.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-```

package/dist/wasm/host/atomic-waits.mjs

@@ -1,43 +0,0 @@
-import { createCancellationCheck } from './cancellation.mjs'
-
-// Cancellation can race the transition from checking its flag to waiting on guest memory.
-const WAIT_SLICE_MS = 100
-
-export function createAtomicWaits (memory, control, checkCancelled = createCancellationCheck(control)) {
-  const state = new Int32Array(control)
-  if (state.length < 2) throw new RangeError('Atomic wait control requires two i32 slots')
-  return {
-    wait32: (pointer, expected, timeout, offset) => wait(memory, state, pointer, expected, timeout, offset, 4, checkCancelled),
-    wait64: (pointer, expected, timeout, offset) => wait(memory, state, pointer, expected, timeout, offset, 8, checkCancelled),
-  }
-}
-
-export function cancelAtomicWaits (memory, control) {
-  const state = new Int32Array(control)
-  Atomics.store(state, 0, 1)
-  const address = Atomics.load(state, 1) >>> 0
-  if (address < memory.buffer.byteLength) Atomics.notify(new Int32Array(memory.buffer), address >>> 2)
-}
-
-function wait (memory, state, pointer, expected, timeout, offset, width, checkCancelled) {
-  const address = (pointer >>> 0) + (offset >>> 0)
-  if (address % width !== 0 || address + width > memory.buffer.byteLength) {
-    throw new WebAssembly.RuntimeError('Unaligned or out-of-bounds atomic wait')
-  }
-  const view = width === 4 ? new Int32Array(memory.buffer) : new BigInt64Array(memory.buffer)
-  const deadline = timeout < 0n ? Infinity : performance.now() + Number(timeout) / 1000000
-  Atomics.store(state, 1, address)
-  try {
-    while (true) {
-      checkCancelled()
-      const remaining = Math.max(0, deadline - performance.now())
-      const result = Atomics.wait(view, address / width, expected, Math.min(remaining, WAIT_SLICE_MS))
-      checkCancelled()
-      if (result === 'ok') return 0
-      if (result === 'not-equal') return 1
-      if (performance.now() >= deadline) return 2
-    }
-  } finally {
-    Atomics.store(state, 1, -1)
-  }
-}

package/dist/wasm/host/cancellation.mjs

@@ -1,6 +0,0 @@
-export function createCancellationCheck (control) {
-  const state = control && new Int32Array(control)
-  return () => {
-    if (state && Atomics.load(state, 0)) throw new WebAssembly.RuntimeError('WASM worker cancelled')
-  }
-}

package/dist/wasm/host/executable-mode.mjs

@@ -1,8 +0,0 @@
-export function hasExecutableMode (metadata) {
-  const user = process.getuid()
-  let permission = 0o1
-  if (user === 0) permission = 0o111
-  else if (metadata.uid === user) permission = 0o100
-  else if (metadata.gid === process.getgid() || process.getgroups().includes(metadata.gid)) permission = 0o10
-  return (metadata.mode & permission) !== 0
-}

package/dist/wasm/host/file-locks.mjs

@@ -1,40 +0,0 @@
-import { fstatSync } from 'node:fs'
-
-import { acquireFileLease } from './lock-registry.mjs'
-
-const busy = 6
-
-export function createFileLocks () {
-  const held = new Map()
-  function release (descriptor) {
-    const state = held.get(descriptor)
-    if (!state) return
-    held.delete(descriptor)
-    state.closed = true
-    state.lease?.release()
-  }
-  return {
-    tryLock (descriptor, exclusive) {
-      let state = held.get(descriptor)
-      if (!state) {
-        const metadata = fstatSync(descriptor, { bigint: true })
-        state = { identity: `${metadata.dev}:${metadata.ino}`, closed: false }
-        held.set(descriptor, state)
-      }
-      if (state.error) return 29
-      if (state.lease?.exclusive === exclusive) return 0
-      if (!state.pending) {
-        state.pending = true
-        acquireFileLease(state.identity, exclusive, state.lease).then(lease => {
-          if (state.closed) lease?.release()
-          else if (lease) state.lease = lease
-        }, error => { state.error = error }).finally(() => { state.pending = false })
-      }
-      return busy
-    },
-    release,
-    close () {
-      for (const descriptor of held.keys()) release(descriptor)
-    },
-  }
-}