@pnpm/releasing.commands 1100.6.4 → 1100.7.1

package/lib/pack-app/packApp.js

@@ -0,0 +1,558 @@
+import fs from 'node:fs';
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { docsUrl } from '@pnpm/cli.utils';
+import { getNodeMirror, parseNodeSpecifier, resolveNodeVersion, } from '@pnpm/engine.runtime.node-resolver';
+import { PnpmError } from '@pnpm/error';
+import { runPnpmCli } from '@pnpm/exec.pnpm-cli-runner';
+import { createFetchFromRegistry } from '@pnpm/network.fetch';
+import { familySync } from 'detect-libc';
+import { safeExeca as execa } from 'execa';
+import { renderHelp } from 'render-help';
+/** Minimum Node.js version that supports `node --build-sea`. */
+const MIN_BUILDER_VERSION = { major: 25, minor: 5 };
+// Target OS names match `process.platform`. That keeps the CLI surface
+// consistent with pnpm's own `--os` flag (which also takes platform constants)
+// and with `supportedArchitectures.os` in pnpm-workspace.yaml.
+const SUPPORTED_OS = ['linux', 'darwin', 'win32'];
+const SUPPORTED_TARGETS = 'linux-x64, linux-x64-musl, linux-arm64, linux-arm64-musl, darwin-x64, darwin-arm64, win32-x64, win32-arm64';
+export const commandNames = ['pack-app'];
+export function rcOptionsTypes() {
+    return {};
+}
+export function cliOptionsTypes() {
+    return {
+        entry: String,
+        target: [String, Array],
+        runtime: String,
+        'output-dir': String,
+        'output-name': String,
+    };
+}
+export const shorthands = {
+    t: '--target',
+    o: '--output-dir',
+};
+export function help() {
+    return renderHelp({
+        description: 'Pack a CommonJS entry file into a standalone executable for one or more target platforms.\n\n' +
+            'The executable embeds a Node.js binary via the Node.js Single Executable Applications API.\n' +
+            `Requires Node.js v${MIN_BUILDER_VERSION.major}.${MIN_BUILDER_VERSION.minor}+ to perform ` +
+            'the injection. SEA blobs are not compatible across Node.js minor releases, so the ' +
+            'builder Node.js must match the embedded runtime version exactly. The running Node.js ' +
+            'is used when it already matches; otherwise a host-arch Node.js of the embedded runtime ' +
+            'version is downloaded automatically.\n\n' +
+            'Defaults for --entry, --target, --runtime, --output-dir, and --output-name can be ' +
+            'set in the package.json under "pnpm.app". CLI flags override the config; --target entirely ' +
+            'replaces the configured list so you can narrow it at invocation time.',
+        url: docsUrl('pack-app'),
+        usages: [
+            'pnpm pack-app --entry dist/index.cjs --target linux-x64 --target win32-x64',
+            `pnpm pack-app --entry dist/index.cjs --target linux-x64-musl --runtime node@${MIN_BUILDER_VERSION.major}`,
+        ],
+        descriptionLists: [
+            {
+                title: 'Options',
+                list: [
+                    {
+                        description: 'Path to the CJS entry file to embed in the executable',
+                        name: '--entry',
+                    },
+                    {
+                        description: `Target to build for. May be specified multiple times. Supported: ${SUPPORTED_TARGETS}`,
+                        name: '--target',
+                        shortAlias: '-t',
+                    },
+                    {
+                        description: 'Runtime to embed in the output executables, as a "<name>@<version>" spec ' +
+                            `(e.g. "node@${MIN_BUILDER_VERSION.major}", "node@${MIN_BUILDER_VERSION.major}.${MIN_BUILDER_VERSION.minor}.0"). ` +
+                            `Only "node" is supported today, and the version must be >= v${MIN_BUILDER_VERSION.major}.${MIN_BUILDER_VERSION.minor} (the minimum that supports --build-sea). ` +
+                            'Defaults to the running Node.js version.',
+                        name: '--runtime',
+                    },
+                    {
+                        description: 'Output directory for the built executables. Defaults to "dist-app".',
+                        name: '--output-dir',
+                        shortAlias: '-o',
+                    },
+                    {
+                        description: 'Name for the output executable (without extension). Defaults to the unscoped package name.',
+                        name: '--output-name',
+                    },
+                ],
+            },
+        ],
+    });
+}
+export async function handler(opts, params) {
+    // pnpm.app in package.json supplies defaults for every flag. CLI flags win,
+    // but `--target` entirely replaces the config list (additive merging would
+    // prevent narrowing from the CLI). See ProjectAppConfig below for the shape.
+    const project = await readProjectAppConfig(opts.dir);
+    const entryPath = opts.entry ?? params[0] ?? project.app?.entry;
+    if (!entryPath) {
+        throw new PnpmError('PACK_APP_MISSING_ENTRY', '"pnpm pack-app" requires a CJS entry file — pass --entry <path> or set "pnpm.app.entry" in package.json.');
+    }
+    // `entry` may come from a repo-controlled package.json, so reject absolute
+    // paths and `..` traversal before touching the filesystem: the entry's
+    // contents get embedded into the produced executable, so an escaping path
+    // could exfiltrate a host file (e.g. an SSH key) into a distributable binary.
+    if (pathEscapesProject(entryPath)) {
+        throw new PnpmError('PACK_APP_ENTRY_OUTSIDE_PROJECT', `The entry path "${entryPath}" resolves outside the project directory.`, { hint: 'The entry must be a relative path inside the project directory, not an absolute path or one that escapes via "..".' });
+    }
+    const resolvedEntry = path.resolve(opts.dir, entryPath);
+    let entryStat;
+    try {
+        entryStat = fs.statSync(resolvedEntry);
+    }
+    catch {
+        throw new PnpmError('PACK_APP_ENTRY_NOT_FOUND', `Entry file not found: ${resolvedEntry}`);
+    }
+    if (!entryStat.isFile()) {
+        throw new PnpmError('PACK_APP_ENTRY_NOT_FILE', `Entry path must be a regular file: ${resolvedEntry}`);
+    }
+    // Defense in depth against a same-name symlink that points out of the
+    // project: resolve symlinks and require the real path to stay within the
+    // (also symlink-resolved) project directory.
+    if (!isWithinDir(resolvedEntry, opts.dir)) {
+        throw new PnpmError('PACK_APP_ENTRY_OUTSIDE_PROJECT', `The entry path "${entryPath}" resolves outside the project directory.`, { hint: 'The entry must be a relative path inside the project directory, not an absolute path or one that escapes via "..".' });
+    }
+    const cliTargets = opts.target == null
+        ? undefined
+        : Array.isArray(opts.target) ? opts.target : [opts.target];
+    const rawTargets = cliTargets ?? project.app?.targets ?? [];
+    if (rawTargets.length === 0) {
+        throw new PnpmError('PACK_APP_MISSING_TARGET', `"pnpm pack-app" requires at least one target — pass --target <triplet> or set "pnpm.app.targets" in package.json. Supported: ${SUPPORTED_TARGETS}`);
+    }
+    const targets = rawTargets.map(parseTarget);
+    // Parse the runtime before output-name derivation and any network work so
+    // that a malformed --runtime fails fast with a clear error instead of being
+    // masked by later problems (missing package.json name, registry lookup, etc.).
+    const runtimeSpec = opts.runtime ?? project.app?.runtime ?? `node@${process.version.slice(1)}`;
+    const { version: requestedNodeSpec } = parseRuntime(runtimeSpec);
+    // `outputDir` is likewise repo-controllable; reject absolute paths and `..`
+    // traversal so build artifacts cannot be written outside the project directory.
+    const outputDirRaw = opts.outputDir ?? project.app?.outputDir ?? 'dist-app';
+    if (pathEscapesProject(outputDirRaw)) {
+        throw new PnpmError('PACK_APP_OUTPUT_DIR_OUTSIDE_PROJECT', `The output directory "${outputDirRaw}" resolves outside the project directory.`, { hint: 'The output directory must be a relative path inside the project directory, not an absolute path or one that escapes via "..".' });
+    }
+    const outputDir = path.resolve(opts.dir, outputDirRaw);
+    await mkdir(outputDir, { recursive: true });
+    // Defense in depth against a symlinked output directory that points out of
+    // the project: the lexical check above can't see through a symlink, so
+    // re-check containment once the real path exists.
+    if (!isWithinDir(outputDir, opts.dir)) {
+        throw new PnpmError('PACK_APP_OUTPUT_DIR_OUTSIDE_PROJECT', `The output directory "${outputDirRaw}" resolves outside the project directory.`, { hint: 'The output directory must be a relative path inside the project directory, not an absolute path or one that escapes via "..".' });
+    }
+    const outputName = validateOutputName(opts.outputName ?? project.app?.outputName ?? deriveOutputNameFromPackage(project, opts.dir));
+    // Reject a pre-existing symlink (or any non-regular file) at any target's
+    // final output path before downloading anything: a repo could commit
+    // `dist-app/<target>/<name>` as a symlink pointing outside the project, and
+    // `node --build-sea` would follow it to overwrite an arbitrary file. The
+    // directory containment checks above do not cover the leaf file.
+    for (const target of targets) {
+        rejectNonRegularOutputFile(path.join(outputDir, target.raw, outputFileName(outputName, target.platform)));
+    }
+    const fetch = createFetchFromRegistry(opts);
+    const buildRoot = path.join(opts.pnpmHomeDir, 'pack-app');
+    // Resolve the embedded target version first so the builder can be pinned to
+    // the same version. SEA blobs carry no version header and the serialized
+    // format has changed across Node.js minor releases (e.g. v25.7 added a
+    // ModuleFormat byte for ESM entry points), so a blob produced by a builder
+    // of a different version than the embedded runtime will fail deserialization
+    // at startup with an opaque native assertion.
+    const resolvedTargetVersion = await resolveVersion(fetch, requestedNodeSpec, opts.nodeDownloadMirrors);
+    const builderBin = await resolveBuilderBinary({
+        buildRoot,
+        targetVersion: resolvedTargetVersion,
+    });
+    const results = [];
+    for (const target of targets) {
+        // eslint-disable-next-line no-await-in-loop
+        const embeddedNodeBin = await ensureNodeRuntime({
+            buildRoot,
+            version: resolvedTargetVersion,
+            platform: target.platform,
+            arch: target.arch,
+            libc: target.libc,
+        });
+        const targetOutputDir = path.join(outputDir, target.raw);
+        // eslint-disable-next-line no-await-in-loop
+        await mkdir(targetOutputDir, { recursive: true });
+        // A repo could symlink `dist-app/<target>` out of the project even when
+        // `dist-app` itself is contained; re-check the real path before any
+        // binary is written into it.
+        if (!isWithinDir(targetOutputDir, opts.dir)) {
+            throw new PnpmError('PACK_APP_OUTPUT_DIR_OUTSIDE_PROJECT', `The output directory "${targetOutputDir}" resolves outside the project directory.`, { hint: 'The output directory must be a relative path inside the project directory, not an absolute path or one that escapes via "..".' });
+        }
+        const outputFile = path.join(targetOutputDir, outputFileName(outputName, target.platform));
+        // Re-check the leaf path right before the build in case it became a
+        // symlink after the upfront pass.
+        rejectNonRegularOutputFile(outputFile);
+        const seaConfig = {
+            main: resolvedEntry,
+            output: outputFile,
+            executable: embeddedNodeBin,
+            disableExperimentalSEAWarning: true,
+            useCodeCache: false,
+            useSnapshot: false,
+        };
+        // Write the SEA config into a fresh, unpredictable temp directory (0700
+        // by default) rather than a predictable path under os.tmpdir(). Avoids
+        // TOCTOU/symlink attacks on multi-user systems.
+        // eslint-disable-next-line no-await-in-loop
+        const tmpConfigDir = await mkdtemp(path.join(os.tmpdir(), 'pnpm-pack-app-'));
+        const configPath = path.join(tmpConfigDir, 'sea-config.json');
+        // eslint-disable-next-line no-await-in-loop
+        await writeFile(configPath, JSON.stringify(seaConfig, null, 2), { flag: 'wx' });
+        try {
+            // eslint-disable-next-line no-await-in-loop
+            await execa(builderBin, ['--build-sea', configPath], { stdio: 'inherit' });
+        }
+        finally {
+            // eslint-disable-next-line no-await-in-loop
+            await rm(tmpConfigDir, { recursive: true, force: true }).catch(() => { });
+        }
+        // eslint-disable-next-line no-await-in-loop
+        await adHocSignMacBinary(target, outputFile, opts.dir);
+        results.push(`  ${target.raw}: ${outputFile} (Node.js ${resolvedTargetVersion})`);
+    }
+    return `Built ${targets.length} executable${targets.length === 1 ? '' : 's'}:\n${results.join('\n')}`;
+}
+/**
+ * Returns a Node.js binary that supports `--build-sea` AND produces a SEA
+ * blob the embedded runtime can deserialize. The second constraint forces the
+ * builder to match the target runtime version exactly: blobs are versioned by
+ * the writer's internal struct layout with no header, and Node bumps that
+ * layout in minor releases (e.g. v25.7 added a ModuleFormat byte for ESM
+ * entries), so a cross-version blob crashes at startup.
+ *
+ * Prefers the running interpreter when it already matches the target version;
+ * otherwise downloads the target version for the host platform.
+ */
+async function resolveBuilderBinary(ctx) {
+    if (runningNodeCanBuildSea() && process.version === `v${ctx.targetVersion}`) {
+        return process.execPath;
+    }
+    if (!builderVersionCanBuildSea(ctx.targetVersion)) {
+        throw new PnpmError('PACK_APP_RUNTIME_TOO_OLD', `The embedded runtime "node@${ctx.targetVersion}" is older than Node.js v${MIN_BUILDER_VERSION.major}.${MIN_BUILDER_VERSION.minor}, which is the minimum version that supports --build-sea.`, { hint: `Pass --runtime node@${MIN_BUILDER_VERSION.major}.${MIN_BUILDER_VERSION.minor}.0 (or newer) or set "pnpm.app.runtime" in package.json.` });
+    }
+    return ensureNodeRuntime({
+        buildRoot: ctx.buildRoot,
+        version: ctx.targetVersion,
+        platform: process.platform,
+        arch: process.arch,
+        // Pin libc to the host's. Otherwise a caller that had set
+        // supportedArchitectures.libc=musl in their config would cause the
+        // glibc host to download a musl Node that it cannot execute.
+        libc: hostLinuxLibc(),
+    });
+}
+function hostLinuxLibc() {
+    if (process.platform !== 'linux')
+        return undefined;
+    const family = familySync();
+    return family === 'musl' ? 'musl' : 'glibc';
+}
+function runningNodeCanBuildSea() {
+    return builderVersionCanBuildSea(process.version.slice(1));
+}
+function builderVersionCanBuildSea(version) {
+    const [majorStr, minorStr] = version.split('.');
+    const major = Number(majorStr);
+    const minor = Number(minorStr);
+    return (major > MIN_BUILDER_VERSION.major ||
+        (major === MIN_BUILDER_VERSION.major && minor >= MIN_BUILDER_VERSION.minor));
+}
+/**
+ * Fetches a Node.js runtime into a dedicated per-target directory under the
+ * pnpm home, reusing the cached binary if already present. Actual files are
+ * hardlinked from pnpm's content-addressable store, so repeated calls are
+ * cheap and `pnpm store prune` can reclaim them.
+ */
+async function ensureNodeRuntime(opts) {
+    // Linux variants always need a libc pin (glibc or musl) so that variant
+    // selection is deterministic and doesn't depend on the host's detected
+    // libc or the user's supportedArchitectures.libc config.
+    const libc = opts.platform === 'linux' ? opts.libc ?? 'glibc' : opts.libc;
+    const targetId = [opts.platform, opts.arch, libc].filter(Boolean).join('-');
+    const installDir = path.join(opts.buildRoot, `${targetId}-${opts.version}`);
+    const nodeDir = path.join(installDir, 'node_modules', 'node');
+    const binaryPath = nodeBinaryPath(nodeDir, opts.platform);
+    if (fs.existsSync(binaryPath))
+        return binaryPath;
+    await mkdir(installDir, { recursive: true });
+    await writeFile(path.join(installDir, 'package.json'), `${JSON.stringify({ name: `pnpm-pack-app-${targetId}`, private: true }, null, 2)}\n`);
+    // Flags that select the target variant must come before the positional
+    // package spec; otherwise `pnpm add` silently installs the host variant.
+    const args = [
+        'add',
+        '--ignore-scripts',
+        '--ignore-workspace',
+        `--os=${opts.platform}`,
+        `--cpu=${opts.arch}`,
+    ];
+    if (libc != null) {
+        args.push(`--libc=${libc}`);
+    }
+    args.push(`node@runtime:${opts.version}`);
+    runPnpmCli(args, { cwd: installDir });
+    if (!fs.existsSync(binaryPath)) {
+        throw new PnpmError('PACK_APP_NODE_BINARY_MISSING', `Expected Node.js binary at ${binaryPath} after installing node@runtime:${opts.version}, but it was not found.`);
+    }
+    return binaryPath;
+}
+function nodeBinaryPath(nodeDir, platform) {
+    return platform === 'win32'
+        ? path.join(nodeDir, 'node.exe')
+        : path.join(nodeDir, 'bin', 'node');
+}
+async function resolveVersion(fetch, specifier, nodeDownloadMirrors) {
+    const { releaseChannel, versionSpecifier } = parseNodeSpecifier(specifier);
+    const nodeMirrorBaseUrl = getNodeMirror(nodeDownloadMirrors, releaseChannel);
+    const version = await resolveNodeVersion(fetch, versionSpecifier, nodeMirrorBaseUrl);
+    if (!version) {
+        throw new PnpmError('PACK_APP_NODE_VERSION_NOT_FOUND', `Could not find a Node.js version that satisfies "${specifier}"`);
+    }
+    return version;
+}
+// Parsed triplet must match this shape exactly. We anchor and constrain each
+// segment so that inputs like `linux-x64-musl-../../outside` are rejected
+// outright — otherwise `target.raw` would later flow into path.join for the
+// output directory and could escape it.
+const TARGET_PATTERN = /^(linux|darwin|win32)-(x64|arm64)(?:-(musl))?$/;
+function parseTarget(raw) {
+    const match = TARGET_PATTERN.exec(raw);
+    if (!match) {
+        throw new PnpmError('PACK_APP_INVALID_TARGET', `Invalid target: "${raw}". Expected format: <os>-<arch>[-<libc>] where <os> is ${SUPPORTED_OS.join('|')}, <arch> is x64|arm64, optional <libc> is musl (linux only).`);
+    }
+    const [, platform, arch, libc] = match;
+    if (libc === 'musl' && platform !== 'linux') {
+        throw new PnpmError('PACK_APP_INVALID_TARGET', `The "musl" libc suffix is only valid for linux targets (got "${raw}").`);
+    }
+    return { raw, platform, arch, libc: libc || undefined };
+}
+// Runtime spec is "<name>@<version>". Only "node" is supported today; the
+// prefix is kept so future runtimes (bun, deno) can share the same flag
+// without a breaking change. Reading the runtime name rather than a bare
+// version also avoids shadowing pnpm's global `node-version` rc setting,
+// whose value would otherwise leak into Config['nodeVersion'] and override
+// `pnpm.app.runtime`.
+const SUPPORTED_RUNTIMES = ['node'];
+const RUNTIME_PATTERN = /^(node)@(.+)$/;
+function parseRuntime(spec) {
+    const match = RUNTIME_PATTERN.exec(spec);
+    if (!match) {
+        throw new PnpmError('PACK_APP_INVALID_RUNTIME', `Invalid runtime "${spec}". Expected format: <name>@<version> (supported runtimes: ${SUPPORTED_RUNTIMES.join(', ')}; e.g. "node@${MIN_BUILDER_VERSION.major}.${MIN_BUILDER_VERSION.minor}.0").`);
+    }
+    return { name: match[1], version: match[2] };
+}
+// Characters that Win32 rejects in filenames, plus NUL. Path separators are
+// checked separately via `path.basename` so the message is crisp.
+const INVALID_FILENAME_CHARS = /[<>:"|?*\0]/;
+// Win32 reserved device names (case-insensitive, with or without an extension).
+const RESERVED_WINDOWS_NAME = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\..*)?$/i;
+// Reject anything that would let the output escape its target directory, or
+// that would fail filesystem-level validation on any supported host. This
+// surfaces problems at `pack-app` invocation time instead of letting them
+// blow up later in `writeFile(outputFile, …)`.
+function validateOutputName(name) {
+    if (name !== path.basename(name) ||
+        name === '' || name === '.' || name === '..' ||
+        name.includes('/') || name.includes('\\') ||
+        INVALID_FILENAME_CHARS.test(name) ||
+        RESERVED_WINDOWS_NAME.test(name) ||
+        /[. ]$/.test(name)) {
+        throw new PnpmError('PACK_APP_INVALID_OUTPUT_NAME', `Invalid --output-name "${name}". The name must be a plain filename without path separators, Windows-reserved names (e.g. CON, NUL), characters like <>:"|?* or NUL, and must not end in a dot or space.`);
+    }
+    return name;
+}
+// A narrow reader just for this command. Using readProjectManifest from
+// @pnpm/cli.utils would pull in the installable/engine checks, which are
+// irrelevant here: pack-app doesn't need the current project to be installable
+// under the running Node, just to have a package.json with optional settings.
+async function readProjectAppConfig(dir) {
+    let raw;
+    try {
+        raw = await readFile(path.join(dir, 'package.json'), 'utf8');
+    }
+    catch {
+        return {};
+    }
+    let manifest;
+    try {
+        manifest = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new PnpmError('PACK_APP_INVALID_PACKAGE_JSON', `Failed to parse ${path.join(dir, 'package.json')}: ${err.message}`);
+    }
+    if (!isObject(manifest))
+        return {};
+    const name = typeof manifest.name === 'string' && manifest.name !== '' ? manifest.name : undefined;
+    const pnpmField = isObject(manifest.pnpm) ? manifest.pnpm : undefined;
+    const appField = pnpmField && isObject(pnpmField.app) ? pnpmField.app : undefined;
+    if (!appField)
+        return { name };
+    return { name, app: validateAppConfig(appField) };
+}
+function validateAppConfig(raw) {
+    const known = new Set(['entry', 'targets', 'runtime', 'outputDir', 'outputName']);
+    for (const key of Object.keys(raw)) {
+        if (!known.has(key)) {
+            throw new PnpmError('PACK_APP_INVALID_CONFIG', `Unknown "pnpm.app.${key}" setting in package.json. Allowed keys: ${Array.from(known).join(', ')}.`);
+        }
+    }
+    const config = {};
+    if (raw.entry != null) {
+        if (typeof raw.entry !== 'string') {
+            throw new PnpmError('PACK_APP_INVALID_CONFIG', '"pnpm.app.entry" must be a string.');
+        }
+        config.entry = raw.entry;
+    }
+    if (raw.targets != null) {
+        if (!Array.isArray(raw.targets) || !raw.targets.every((t) => typeof t === 'string')) {
+            throw new PnpmError('PACK_APP_INVALID_CONFIG', '"pnpm.app.targets" must be an array of strings.');
+        }
+        config.targets = raw.targets;
+    }
+    if (raw.runtime != null) {
+        if (typeof raw.runtime !== 'string') {
+            throw new PnpmError('PACK_APP_INVALID_CONFIG', '"pnpm.app.runtime" must be a string.');
+        }
+        config.runtime = raw.runtime;
+    }
+    if (raw.outputDir != null) {
+        if (typeof raw.outputDir !== 'string') {
+            throw new PnpmError('PACK_APP_INVALID_CONFIG', '"pnpm.app.outputDir" must be a string.');
+        }
+        config.outputDir = raw.outputDir;
+    }
+    if (raw.outputName != null) {
+        if (typeof raw.outputName !== 'string') {
+            throw new PnpmError('PACK_APP_INVALID_CONFIG', '"pnpm.app.outputName" must be a string.');
+        }
+        config.outputName = raw.outputName;
+    }
+    return config;
+}
+function deriveOutputNameFromPackage(project, dir) {
+    if (!project.name) {
+        throw new PnpmError('PACK_APP_NO_OUTPUT_NAME', `Could not determine the output name: package.json in ${dir} has no "name" field.`, { hint: 'Pass --output-name <name> or set "pnpm.app.outputName" in package.json.' });
+    }
+    // Strip @scope/ prefix from scoped packages so the binary name is a plain
+    // filename instead of "scope/name". The second validateOutputName() pass
+    // downstream rejects any leftover path separators.
+    return project.name.replace(/^@[^/]+\//, '');
+}
+function isObject(value) {
+    return value != null && typeof value === 'object' && !Array.isArray(value);
+}
+// `entry` and `outputDir` can come from a repo-controlled package.json, so a
+// malicious repo must not be able to read/write outside the project via an
+// absolute path or `..` traversal. An absolute path replaces the base on join;
+// a `..` segment climbs out. Checked lexically before any filesystem access so
+// the failure is fast and side-effect-free.
+function pathEscapesProject(rawPath) {
+    // `path.parse().root` is non-empty for any host-rooted form: a POSIX
+    // absolute path (`/x`), and on Windows also the drive-relative (`C:x`) and
+    // root-relative (`\x`) forms that `path.isAbsolute()` reports as relative
+    // yet still resolve outside the project. Platform-specific, matching the
+    // pacquet port (which rejects `Component::RootDir` / `Component::Prefix`).
+    if (path.parse(rawPath).root !== '')
+        return true;
+    return rawPath.split(/[/\\]/).includes('..');
+}
+// Defense in depth beyond `pathEscapesProject`: resolve symlinks and require
+// the real target to stay inside the (also symlink-resolved) project dir, so a
+// same-name symlink pointing out of the project is caught even though the
+// lexical join looked contained. Fails closed on any realpath error.
+function isWithinDir(target, dir) {
+    let realDir;
+    let realTarget;
+    try {
+        realDir = fs.realpathSync(dir);
+        realTarget = fs.realpathSync(target);
+    }
+    catch {
+        return false;
+    }
+    const rel = path.relative(realDir, realTarget);
+    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+}
+// The on-disk file name of the produced executable for a target: a bare name
+// on POSIX, suffixed with `.exe` on Windows.
+function outputFileName(outputName, platform) {
+    return platform === 'win32' ? `${outputName}.exe` : outputName;
+}
+// Refuse to write to `outputFile` when it already exists and is not a regular
+// file — most importantly a symlink, which `node --build-sea` would follow to
+// overwrite a file outside the project. `lstatSync` does not traverse the final
+// component, so a symlink reports `isFile() === false`. A missing path is fine.
+function rejectNonRegularOutputFile(outputFile) {
+    const existing = fs.lstatSync(outputFile, { throwIfNoEntry: false });
+    if (existing && !existing.isFile()) {
+        throw new PnpmError('PACK_APP_OUTPUT_FILE_NOT_REGULAR', `The output file "${outputFile}" already exists and is not a regular file (e.g. a symlink); refusing to write through it.`, { hint: 'Remove the existing path, or choose a different --output-name or --output-dir.' });
+    }
+}
+/**
+ * SEA injection invalidates the existing code signature on macOS binaries, so
+ * the output must be re-signed. Native macOS hosts use `codesign`; Linux hosts
+ * cross-signing a darwin target use `ldid`. Windows hosts have no readily
+ * available ad-hoc signer, so we refuse to produce an unsigned output silently
+ * and tell the user to re-sign on macOS or Linux.
+ */
+async function adHocSignMacBinary(target, outputFile, dir) {
+    if (target.platform !== 'darwin')
+        return;
+    if (process.platform === 'darwin') {
+        // `codesign` is a macOS system tool; spawn it by absolute path so a
+        // repo-controlled `node_modules/.bin/codesign` on PATH can't be run in its
+        // place.
+        await execa('/usr/bin/codesign', ['--sign', '-', outputFile], { stdio: 'inherit' });
+        return;
+    }
+    if (process.platform === 'linux') {
+        const ldid = resolveTrustedSigner('ldid', dir, outputFile);
+        try {
+            await execa(ldid, ['-S', outputFile], { stdio: 'inherit' });
+        }
+        catch {
+            throw new PnpmError('PACK_APP_MACOS_SIGN_FAILED', `Cross-compiled macOS binary at ${outputFile} could not be ad-hoc signed with "ldid".`, { hint: 'Install ldid (https://github.com/ProcursusTeam/ldid) or re-sign the binary on macOS with "codesign --sign - <file>".' });
+        }
+        return;
+    }
+    throw new PnpmError('PACK_APP_MACOS_SIGN_UNSUPPORTED_HOST', `Cannot ad-hoc sign the macOS binary at ${outputFile} on a ${process.platform} host.`, { hint: 'Build macOS targets on a macOS or Linux host, or re-sign the produced binary yourself with "codesign --sign -" on macOS.' });
+}
+// Resolve an external signer (`ldid`) to an absolute path via PATH, skipping
+// any match that resolves inside the project directory — a repo could ship
+// `node_modules/.bin/ldid` and, if that directory is on the developer's PATH,
+// get an attacker-controlled binary executed when packaging a darwin target.
+// Returns the first match outside the project, or throws PACK_APP_MACOS_SIGN_FAILED.
+function resolveTrustedSigner(name, dir, outputFile) {
+    for (const entry of (process.env.PATH ?? '').split(path.delimiter)) {
+        if (entry === '')
+            continue;
+        const candidate = path.join(entry, name);
+        let stat;
+        try {
+            stat = fs.statSync(candidate);
+        }
+        catch {
+            continue;
+        }
+        if (!stat.isFile())
+            continue;
+        if (isWithinDir(candidate, dir))
+            continue;
+        try {
+            fs.accessSync(candidate, fs.constants.X_OK);
+        }
+        catch {
+            continue;
+        }
+        return candidate;
+    }
+    throw new PnpmError('PACK_APP_MACOS_SIGN_FAILED', `Cross-compiled macOS binary at ${outputFile} could not be ad-hoc signed with "ldid".`, { hint: 'Install ldid (https://github.com/ProcursusTeam/ldid) or re-sign the binary on macOS with "codesign --sign - <file>".' });
+}
+//# sourceMappingURL=packApp.js.map

package/lib/publish/FailedToPublishError.d.ts

@@ -0,0 +1,22 @@
+import { PnpmError } from '@pnpm/error';
+import type { PackResult } from './pack.js';
+interface PublishErrorProperties<Pack> {
+    readonly pack: Pack;
+    readonly status: number;
+    readonly statusText: string;
+    readonly text: string;
+}
+export declare class FailedToPublishError<Pack extends Pick<PackResult, 'publishedManifest'>> extends PnpmError implements PublishErrorProperties<Pack> {
+    readonly pack: Pack;
+    readonly status: number;
+    readonly statusText: string;
+    readonly text: string;
+    constructor(opts: PublishErrorProperties<Pack>);
+}
+export declare function createFailedToPublishError<Pack extends Pick<PackResult, 'publishedManifest'>>(pack: Pack, fetchResponse: FetchResponse): Promise<FailedToPublishError<Pack>>;
+interface FetchResponse {
+    readonly status: number;
+    readonly statusText: string;
+    readonly text: (this: FetchResponse) => string | Promise<string>;
+}
+export {};

package/lib/publish/FailedToPublishError.js

@@ -0,0 +1,40 @@
+import { PnpmError } from '@pnpm/error';
+export class FailedToPublishError extends PnpmError {
+    pack;
+    status;
+    statusText;
+    text;
+    constructor(opts) {
+        const { pack, status, statusText, text } = opts;
+        const { name, version } = pack.publishedManifest;
+        const statusDisplay = statusText ? `${status} ${statusText}` : status;
+        const trimmedText = text.trim();
+        let message = `Failed to publish package ${name}@${version} (status ${statusDisplay})`;
+        if (trimmedText.includes('\n')) {
+            message += '\nDetails:\n';
+            for (const line of text.trimEnd().split('\n')) {
+                message += `    ${line}\n`;
+            }
+        }
+        else if (trimmedText) {
+            message += `: ${trimmedText}`;
+        }
+        super('FAILED_TO_PUBLISH', message);
+        this.pack = pack;
+        this.status = status;
+        this.statusText = statusText;
+        this.text = text;
+    }
+}
+export async function createFailedToPublishError(pack, fetchResponse) {
+    const { status, statusText } = fetchResponse;
+    let text;
+    try {
+        text = await fetchResponse.text();
+    }
+    catch {
+        text = '';
+    }
+    return new FailedToPublishError({ pack, status, statusText, text });
+}
+//# sourceMappingURL=FailedToPublishError.js.map

package/lib/publish/batchPublish.d.ts

@@ -0,0 +1,20 @@
+import type { Config, ConfigContext } from '@pnpm/config.reader';
+import type { Project } from '@pnpm/types';
+import { type PublishSummary } from '../tarball/publishSummary.js';
+import type { PublishRecursiveOpts } from './recursivePublish.js';
+export declare const BATCH_PUBLISH_ENDPOINT = "/-/pnpm/v1/publish";
+export type BatchPublishOptions = PublishRecursiveOpts & Pick<Config, 'embedReadme' | 'ignoreScripts' | 'nodeLinker' | 'packGzipLevel' | 'skipManifestObfuscation'> & Partial<Pick<ConfigContext, 'hooks'>>;
+/**
+ * Publish all {@link pkgs} by sending a single `PUT /-/pnpm/v1/publish` request per target
+ * registry, instead of one request per package. The endpoint is not part of the standard npm
+ * registry API — the registry has to implement it explicitly (pnpr does), so this whole code
+ * path is opt-in via the `--batch` flag.
+ *
+ * Every package is packed (and its `prepublishOnly`/`prepublish` scripts run) before anything
+ * is sent, so a package that fails to pack aborts the publish before any package reaches the
+ * registry. The `publish`/`postpublish` scripts run only after the requests succeeded.
+ *
+ * @param pkgs packages to publish, already filtered (no private packages, no already-published
+ *   versions) and in dependency order.
+ */
+export declare function batchPublishPackages(pkgs: Project[], opts: BatchPublishOptions): Promise<PublishSummary[]>;