@pnpm/global.packages 1100.0.12 → 1100.0.13

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @pnpm/global.packages
 
+## 1100.0.13
+
+### Patch Changes
+
+- Republished every package: the tarballs published by the v11.13.1 through v11.16.0 releases were missing most of their compiled files due to a packing bug [#13164](https://github.com/pnpm/pnpm/issues/13164).
+
+- Updated dependencies:
+  - @pnpm/bins.resolver@1100.0.11
+  - @pnpm/crypto.hash@1100.0.2
+  - @pnpm/pkg-manifest.reader@1100.0.12
+  - @pnpm/types@1101.6.0
+
 ## 1100.0.12
 
 ### Patch Changes

package/lib/cacheKey.d.ts

@@ -0,0 +1,4 @@
+export declare function createGlobalCacheKey(opts: {
+    aliases: string[];
+    registries: Record<string, string>;
+}): string;

package/lib/cacheKey.js

@@ -0,0 +1,9 @@
+import { createHexHash } from '@pnpm/crypto.hash';
+import { lexCompare } from '@pnpm/util.lex-comparator';
+export function createGlobalCacheKey(opts) {
+    const sortedAliases = [...opts.aliases].sort(lexCompare);
+    const sortedRegistries = Object.entries(opts.registries).sort(([k1], [k2]) => lexCompare(k1, k2));
+    const hashStr = JSON.stringify([sortedAliases, sortedRegistries]);
+    return createHexHash(hashStr);
+}
+//# sourceMappingURL=cacheKey.js.map

package/lib/globalPackageDir.d.ts

@@ -0,0 +1,3 @@
+export declare function getHashLink(globalDir: string, hash: string): string;
+export declare function resolveInstallDir(globalDir: string, hash: string): string | null;
+export declare function createInstallDir(globalDir: string): string;

package/lib/globalPackageDir.js

@@ -0,0 +1,44 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import util from 'node:util';
+export function getHashLink(globalDir, hash) {
+    return path.join(globalDir, hash);
+}
+export function resolveInstallDir(globalDir, hash) {
+    const linkPath = getHashLink(globalDir, hash);
+    try {
+        const stats = fs.lstatSync(linkPath);
+        if (!stats.isSymbolicLink())
+            return null;
+        return fs.realpathSync(linkPath);
+    }
+    catch (err) {
+        if (util.types.isNativeError(err) && 'code' in err && err.code === 'ENOENT') {
+            return null;
+        }
+        throw err;
+    }
+}
+export function createInstallDir(globalDir) {
+    // Ensure the parent exists, then create the per-group dir *exclusively*
+    // (no `recursive`, which would silently reuse an existing entry or follow
+    // a pre-existing symlink). The name adds random bytes on top of pid+time
+    // so it isn't predictable and can't collide within the same millisecond.
+    fs.mkdirSync(globalDir, { recursive: true });
+    for (let i = 0; i < 10; i++) {
+        const name = `${process.pid.toString(16)}-${Date.now().toString(16)}-${crypto.randomBytes(8).toString('hex')}`;
+        const dir = path.join(globalDir, name);
+        try {
+            fs.mkdirSync(dir);
+            return dir;
+        }
+        catch (err) {
+            if (util.types.isNativeError(err) && 'code' in err && err.code === 'EEXIST')
+                continue;
+            throw err;
+        }
+    }
+    throw new Error('Could not create a unique global install directory');
+}
+//# sourceMappingURL=globalPackageDir.js.map

package/lib/index.d.ts

@@ -0,0 +1,3 @@
+export { createGlobalCacheKey } from './cacheKey.js';
+export { createInstallDir, getHashLink, resolveInstallDir, } from './globalPackageDir.js';
+export { cleanOrphanedInstallDirs, findGlobalPackage, getGlobalPackageDetails, getInstalledBinNames, type GlobalPackageInfo, type InstalledGlobalPackage, isValidGlobalDependencyAlias, scanGlobalPackages, } from './scanGlobalPackages.js';

package/lib/scanGlobalPackages.d.ts

@@ -0,0 +1,17 @@
+import type { PackageManifest } from '@pnpm/types';
+export declare function isValidGlobalDependencyAlias(alias: string): boolean;
+export interface GlobalPackageInfo {
+    hash: string;
+    installDir: string;
+    dependencies: Record<string, string>;
+}
+export interface InstalledGlobalPackage {
+    alias: string;
+    version: string;
+    manifest: PackageManifest;
+}
+export declare function scanGlobalPackages(globalDir: string): GlobalPackageInfo[];
+export declare function findGlobalPackage(globalDir: string, alias: string): GlobalPackageInfo | null;
+export declare function getGlobalPackageDetails(info: GlobalPackageInfo): Promise<InstalledGlobalPackage[]>;
+export declare function cleanOrphanedInstallDirs(globalDir: string): void;
+export declare function getInstalledBinNames(info: GlobalPackageInfo): Promise<string[]>;

package/lib/scanGlobalPackages.js

@@ -0,0 +1,158 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import util from 'node:util';
+import { getBinsFromPackageManifest } from '@pnpm/bins.resolver';
+import { readPackageJsonFromDirRawSync, safeReadPackageJsonFromDir } from '@pnpm/pkg-manifest.reader';
+const RESERVED_ALIASES = new Set(['node_modules', 'favicon.ico']);
+const isUrlFriendly = (segment) => encodeURIComponent(segment) === segment;
+// A dependency alias from a global group's package.json becomes a directory
+// name under `node_modules` at every join site (list, conflict-check,
+// remove, update). A tampered manifest could use an alias like `../x` or an
+// absolute path to escape the install dir, so only valid npm package names
+// are trusted. This applies the same `validForOldPackages` rules that
+// `validate-npm-package-name` (and `@pnpm/fs.symlink-dependency`'s
+// `safeJoinModulesDir`) enforce — implemented inline to avoid adding a
+// dependency to this low-level package.
+export function isValidGlobalDependencyAlias(alias) {
+    if (alias.length === 0)
+        return false;
+    if (/^[._-]/.test(alias))
+        return false;
+    if (alias.trim() !== alias)
+        return false;
+    if (RESERVED_ALIASES.has(alias.toLowerCase()))
+        return false;
+    if (isUrlFriendly(alias))
+        return true;
+    const scoped = /^@([^/]+)\/([^/]+)$/.exec(alias);
+    if (scoped) {
+        const [, scope, name] = scoped;
+        return !name.startsWith('.') && isUrlFriendly(scope) && isUrlFriendly(name);
+    }
+    return false;
+}
+function pickValidDependencies(dependencies) {
+    const result = {};
+    for (const [alias, spec] of Object.entries(dependencies)) {
+        if (isValidGlobalDependencyAlias(alias)) {
+            result[alias] = spec;
+        }
+    }
+    return result;
+}
+export function scanGlobalPackages(globalDir) {
+    let entries;
+    try {
+        entries = fs.readdirSync(globalDir, { withFileTypes: true });
+    }
+    catch (err) {
+        if (util.types.isNativeError(err) && 'code' in err && err.code === 'ENOENT') {
+            return [];
+        }
+        throw err;
+    }
+    const result = [];
+    for (const entry of entries) {
+        // Hash entries are symlinks pointing to install dirs
+        if (!entry.isSymbolicLink())
+            continue;
+        const linkPath = path.join(globalDir, entry.name);
+        let installDir;
+        try {
+            installDir = fs.realpathSync(linkPath);
+        }
+        catch {
+            continue;
+        }
+        let pkgJson;
+        try {
+            pkgJson = readPackageJsonFromDirRawSync(installDir);
+        }
+        catch {
+            continue;
+        }
+        if (!pkgJson.dependencies)
+            continue;
+        const dependencies = pickValidDependencies(pkgJson.dependencies);
+        if (Object.keys(dependencies).length === 0)
+            continue;
+        result.push({
+            hash: entry.name,
+            installDir,
+            dependencies,
+        });
+    }
+    return result;
+}
+export function findGlobalPackage(globalDir, alias) {
+    const packages = scanGlobalPackages(globalDir);
+    return packages.find((pkg) => alias in pkg.dependencies) ?? null;
+}
+export async function getGlobalPackageDetails(info) {
+    const aliases = Object.keys(info.dependencies);
+    const installedPackages = await Promise.all(aliases.map(async (alias) => {
+        const manifest = await safeReadPackageJsonFromDir(path.join(info.installDir, 'node_modules', alias));
+        if (!manifest)
+            return null;
+        return { alias, version: manifest.version, manifest };
+    }));
+    return installedPackages.filter((pkg) => pkg !== null);
+}
+export function cleanOrphanedInstallDirs(globalDir) {
+    globalDir = path.resolve(globalDir);
+    let entries;
+    try {
+        entries = fs.readdirSync(globalDir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    // Collect real paths of all symlink targets
+    const referenced = new Set();
+    for (const entry of entries) {
+        if (!entry.isSymbolicLink())
+            continue;
+        try {
+            referenced.add(fs.realpathSync(path.join(globalDir, entry.name)));
+        }
+        catch { }
+    }
+    // Remove directories that no symlink points to.
+    // Skip recently-created dirs to avoid racing with a concurrent install
+    // that hasn't created its hash symlink yet.
+    const now = Date.now();
+    const SAFETY_WINDOW_MS = 5 * 60 * 1000;
+    for (const entry of entries) {
+        if (!entry.isDirectory())
+            continue;
+        const dirPath = path.join(globalDir, entry.name);
+        if (referenced.has(dirPath))
+            continue;
+        try {
+            const stat = fs.statSync(dirPath);
+            if (now - Math.max(stat.birthtimeMs, stat.ctimeMs) < SAFETY_WINDOW_MS)
+                continue;
+        }
+        catch {
+            continue;
+        }
+        fs.rmSync(dirPath, { recursive: true, force: true });
+    }
+}
+export async function getInstalledBinNames(info) {
+    const bins = new Set();
+    const aliases = Object.keys(info.dependencies);
+    const modulesDir = path.join(info.installDir, 'node_modules');
+    await Promise.all(aliases.map(async (alias) => {
+        const depDir = path.join(modulesDir, alias);
+        const manifest = await safeReadPackageJsonFromDir(depDir);
+        if (!manifest)
+            return;
+        const binsOfPkg = await getBinsFromPackageManifest(manifest, depDir);
+        for (const bin of binsOfPkg) {
+            bins.add(bin.name);
+        }
+    }));
+    return [...bins];
+}
+//# sourceMappingURL=scanGlobalPackages.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/global.packages",
-  "version": "1100.0.12",
+  "version": "1100.0.13",
   "description": "Utilities for managing isolated global packages",
   "keywords": [
     "pnpm",
@@ -28,14 +28,14 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/bins.resolver": "1100.0.10",
-    "@pnpm/crypto.hash": "1100.0.1",
-    "@pnpm/pkg-manifest.reader": "1100.0.11",
-    "@pnpm/types": "1101.5.0",
+    "@pnpm/bins.resolver": "1100.0.11",
+    "@pnpm/crypto.hash": "1100.0.2",
+    "@pnpm/pkg-manifest.reader": "1100.0.12",
+    "@pnpm/types": "1101.6.0",
     "@pnpm/util.lex-comparator": "^4.0.1"
   },
   "devDependencies": {
-    "@pnpm/global.packages": "1100.0.12"
+    "@pnpm/global.packages": "1100.0.13"
   },
   "engines": {
     "node": ">=22.13"