pnpm 11.9.0 → 12.0.0-alpha.0

package/LICENSE

@@ -1,7 +1,7 @@
 The MIT License (MIT)
 
 Copyright (c) 2015-2016 Rico Sta. Cruz and other contributors
-Copyright (c) 2016-2025 Zoltan Kochan and other contributors
+Copyright (c) 2016-2026 Zoltan Kochan and other contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/install.js

@@ -0,0 +1,175 @@
+#!/usr/bin/env node
+// Preinstall for the pnpm v12 wrapper (shared verbatim by `pnpm` and
+// `@pnpm/exe`): replace the shebang-less placeholder bins with the host's native
+// binary so `pnpm` runs directly, no Node startup per call. A placeholder (not a
+// Node launcher) is required because the Windows shim is generated from the bin
+// file and npm won't re-read package.json after preinstall; the tradeoff is no
+// fallback when build scripts are blocked (`--ignore-scripts`, pnpm/Bun default).
+//
+// `pn`/`pnpx`/`pnx` are committed `#!/bin/sh` scripts on Unix (so only `pnpm` is
+// relinked); on Windows the native binary is hardlinked onto each and
+// self-detects its launch name to inject `dlx` (see `argv_with_alias_subcommand`
+// in the cli crate).
+import console from 'node:console'
+import fs from 'node:fs'
+import { createRequire } from 'node:module'
+import path from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+
+const require = createRequire(import.meta.url)
+const ownDir = path.dirname(fileURLToPath(import.meta.url))
+const { platform, arch } = process
+
+const PLATFORMS = {
+  win32: {
+    x64: '@pnpm/exe.win32-x64/pnpm.exe',
+    arm64: '@pnpm/exe.win32-arm64/pnpm.exe',
+  },
+  darwin: {
+    x64: '@pnpm/exe.darwin-x64/pnpm',
+    arm64: '@pnpm/exe.darwin-arm64/pnpm',
+  },
+  linux: {
+    x64: {
+      glibc: '@pnpm/exe.linux-x64/pnpm',
+      musl: '@pnpm/exe.linux-x64-musl/pnpm',
+    },
+    arm64: {
+      glibc: '@pnpm/exe.linux-arm64/pnpm',
+      musl: '@pnpm/exe.linux-arm64-musl/pnpm',
+    },
+  },
+}
+
+const BIN_NAMES = ['pnpm', 'pn', 'pnpx', 'pnx']
+
+setup()
+
+function setup () {
+  const candidates = getBinCandidates()
+  if (candidates.length === 0) {
+    fail(`pnpm does not ship a prebuilt binary for ${platform}-${arch}.`)
+  }
+
+  // Use whichever platform package the package manager installed: it already
+  // filtered by `os`/`cpu`/`libc`, more reliable than re-deriving the host.
+  let nativeBinary
+  for (const target of candidates) {
+    try {
+      nativeBinary = require.resolve(target)
+      break
+    } catch {}
+  }
+  if (nativeBinary == null) {
+    const pkgName = candidates[0].split('/').slice(0, 2).join('/')
+    fail(
+      `The "${pkgName}" package is not installed, so pnpm has no native binary to run.\n` +
+      'If your package manager skipped optional dependencies or blocked build scripts, ' +
+      'enable them and reinstall.'
+    )
+  }
+
+  if (platform === 'win32') {
+    const newBin = {}
+    for (const name of BIN_NAMES) {
+      // The existing shim points at the no-ext file, so it must become the
+      // binary; the `.exe` twin + bin rewrite are for shims generated later.
+      placeBinary(nativeBinary, path.join(ownDir, `${name}.exe`))
+      placeBinary(nativeBinary, path.join(ownDir, name))
+      newBin[name] = `${name}.exe`
+    }
+    rewriteBin(newBin)
+  } else {
+    placeBinary(nativeBinary, path.join(ownDir, 'pnpm'), 0o755)
+  }
+}
+
+/**
+ * Atomically place `nativeBinary` at `destPath` (hard link, falling back to a
+ * copy across filesystems, via a temp file + rename). Exits the process on
+ * failure — without the binary there is no working `pnpm`.
+ *
+ * @param {string} nativeBinary Absolute path to the resolved native binary.
+ * @param {string} destPath Absolute path to create.
+ * @param {number} [mode] chmod for the copy path only; a hard link shares the
+ *   source inode (the shared store blob under pnpm), so its mode must not change.
+ */
+function placeBinary (nativeBinary, destPath, mode) {
+  const tempPath = `${destPath}.pnpm-tmp`
+  try {
+    fs.rmSync(tempPath, { force: true })
+    let linked = false
+    try {
+      fs.linkSync(nativeBinary, tempPath)
+      linked = true
+    } catch {
+      fs.copyFileSync(nativeBinary, tempPath)
+    }
+    if (!linked && mode != null) {
+      fs.chmodSync(tempPath, mode)
+    }
+    fs.renameSync(tempPath, destPath)
+  } catch (err) {
+    try {
+      fs.rmSync(tempPath, { force: true })
+    } catch {}
+    fail(`Could not install the pnpm binary at ${destPath}: ${err.message}`)
+  }
+}
+
+function rewriteBin (binMap) {
+  const pkgJsonPath = path.join(ownDir, 'package.json')
+  // Temp file + rename, not in-place: package.json is hard-linked from the store.
+  const tempPath = `${pkgJsonPath}.pnpm-tmp`
+  try {
+    const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf8'))
+    pkg.bin = binMap
+    fs.writeFileSync(tempPath, JSON.stringify(pkg, null, 2))
+    fs.renameSync(tempPath, pkgJsonPath)
+  } catch {
+    try {
+      fs.rmSync(tempPath, { force: true })
+    } catch {}
+  }
+}
+
+function fail (message) {
+  console.error(message)
+  process.exit(1)
+}
+
+/**
+ * Native binary specifiers to try, most-preferred first; empty when the host is
+ * unsupported. The linux glibc/musl pair is ordered by detected libc, which
+ * only decides the winner when both are installed (e.g. `npm install --force`).
+ *
+ * @returns {string[]}
+ */
+function getBinCandidates () {
+  const platformEntry = PLATFORMS?.[platform]?.[arch]
+
+  if (platformEntry == null) {
+    return []
+  }
+  if (typeof platformEntry === 'string') {
+    return [platformEntry]
+  }
+
+  const order = detectLinuxLibc() === 'musl' ? ['musl', 'glibc'] : ['glibc', 'musl']
+  return order.map((libc) => platformEntry[libc])
+}
+
+function detectLinuxLibc () {
+  if (platform !== 'linux') {
+    return null
+  }
+
+  // glibc builds set `glibcVersionRuntime`; musl leaves it unset. Guarded —
+  // `process.report` may be unavailable, leaving ordering to the default.
+  try {
+    return process.report?.getReport().header.glibcVersionRuntime ? 'glibc' : 'musl'
+  } catch {
+    return null
+  }
+}

package/package.json

@@ -1,88 +1,48 @@
 {
   "name": "pnpm",
-  "version": "11.9.0",
-  "description": "Fast, disk space efficient package manager",
+  "description": "Fast, disk space efficient package manager — the Rust port of pnpm (alpha, not production-ready)",
   "keywords": [
     "pnpm",
-    "pnpm11",
-    "dependencies",
-    "dependency manager",
-    "efficient",
-    "fast",
-    "hardlinks",
-    "install",
-    "installer",
-    "link",
-    "lockfile",
-    "modules",
-    "monorepo",
-    "multi-package",
-    "npm",
     "package manager",
-    "package.json",
-    "packages",
-    "prune",
-    "rapid",
-    "remove",
-    "shrinkwrap",
-    "symlinks",
-    "uninstall",
-    "workspace"
+    "rust"
   ],
   "license": "MIT",
-  "funding": "https://opencollective.com/pnpm",
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/pacquet",
+  "bugs": "https://github.com/pnpm/pnpm/issues",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/pnpm/pnpm.git",
-    "directory": "pnpm11/pnpm"
+    "url": "https://github.com/pnpm/pnpm",
+    "directory": "pacquet/npm/pnpm"
   },
-  "homepage": "https://pnpm.io",
-  "bugs": {
-    "url": "https://github.com/pnpm/pnpm/issues"
+  "bin": {
+    "pnpm": "pnpm",
+    "pn": "pn",
+    "pnpx": "pnpx",
+    "pnx": "pnx"
   },
   "type": "module",
-  "main": "bin/pnpm.mjs",
-  "exports": {
-    ".": "./package.json"
+  "engines": {
+    "node": ">=18.*"
   },
   "files": [
-    "dist",
-    "!dist/**/*.map",
-    "bin"
+    "pnpm",
+    "pn",
+    "pnpx",
+    "pnx",
+    "install.js"
   ],
-  "bin": {
-    "pnpm": "bin/pnpm.mjs",
-    "pnpx": "bin/pnpx.mjs",
-    "pn": "bin/pnpm.mjs",
-    "pnx": "bin/pnpx.mjs"
-  },
-  "directories": {
-    "test": "test"
-  },
-  "unpkg": "dist/pnpm.mjs",
-  "engines": {
-    "node": ">=22.13"
-  },
-  "jest": {
-    "collectCoverage": false,
-    "preset": "@pnpm/jest-config/with-registry"
-  },
-  "preferGlobal": true,
-  "publishConfig": {
-    "tag": "next-11",
-    "executableFiles": [
-      "./dist/node-gyp-bin/node-gyp",
-      "./dist/node-gyp-bin/node-gyp.cmd",
-      "./dist/node_modules/node-gyp/bin/node-gyp.js"
-    ]
+  "version": "12.0.0-alpha.0",
+  "optionalDependencies": {
+    "@pnpm/exe.win32-x64": "12.0.0-alpha.0",
+    "@pnpm/exe.win32-arm64": "12.0.0-alpha.0",
+    "@pnpm/exe.darwin-x64": "12.0.0-alpha.0",
+    "@pnpm/exe.darwin-arm64": "12.0.0-alpha.0",
+    "@pnpm/exe.linux-x64": "12.0.0-alpha.0",
+    "@pnpm/exe.linux-arm64": "12.0.0-alpha.0",
+    "@pnpm/exe.linux-x64-musl": "12.0.0-alpha.0",
+    "@pnpm/exe.linux-arm64-musl": "12.0.0-alpha.0"
   },
   "scripts": {
-    "bundle": "pnx node@runtime:24.6.0 bundle.ts",
-    "start": "tsgo --watch",
-    "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",
-    "pretest:e2e": "rimraf node_modules/.bin/pnpm",
-    "test": "pn compile && pn .test",
-    "compile": "tsgo --build && pn lint --fix && rimraf dist bin/nodes && pn bundle && shx cp -r node-gyp-bin dist/node-gyp-bin && shx cp -r node_modules/@pnpm/tabtab/lib/templates dist/templates && shx cp -r node_modules/ps-list/vendor dist/vendor && shx cp pnpmrc dist/pnpmrc",
-    ".test": "cross-env NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest"
+    "preinstall": "node install.js"
   }
 }

package/pn

@@ -0,0 +1,2 @@
+#!/bin/sh
+exec pnpm "$@"

package/pnpm

@@ -0,0 +1,4 @@
+This is a placeholder. pnpm's native binary replaces this file during
+installation (see ./install.js). If you are reading this, the install/build
+script did not run — reinstall with build scripts enabled (e.g. allow-list
+pnpm's build under pnpm or Bun, or drop --ignore-scripts).

package/pnpx

@@ -0,0 +1,2 @@
+#!/bin/sh
+exec pnpm dlx "$@"

package/pnx

@@ -0,0 +1,2 @@
+#!/bin/sh
+exec pnpm dlx "$@"

package/bin/pnpm.cjs

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-// CommonJS shim for compatibility with older Corepack versions
-import('./pnpm.mjs')

package/bin/pnpm.mjs

@@ -1,36 +0,0 @@
-#!/usr/bin/env node
-const [major, minor] = process.version.slice(1).split('.')
-const COMPATIBILITY_PAGE = `Visit https://r.pnpm.io/comp to see the list of past pnpm versions with respective Node.js version support.`
-
-// We don't use the semver library here because:
-//  1. it is already bundled to dist/pnpm.mjs, so we would load it twice
-//  2. we want this file to support potentially older Node.js versions than what semver supports
-if (major == 20) {
-  console.warn(`warn: This version of pnpm requires at least Node.js v22.13
-warn: The current version of Node.js is ${process.version}
-warn: ${COMPATIBILITY_PAGE}`)
-} else if (major < 22 || major == 22 && minor < 13) {
-  console.error(`ERROR: This version of pnpm requires at least Node.js v22.13
-The current version of Node.js is ${process.version}
-${COMPATIBILITY_PAGE}`)
-  process.exit(1)
-}
-
-import * as module from 'module'
-
-// We need to load v8-compile-cache.js separately in order to have effect
-try {
-  module.enableCompileCache?.()
-} catch {
-  // We don't have/need to care about v8-compile-cache failed
-}
-
-global['pnpm__startedAt'] = Date.now()
-
-// Use dynamic import so the Node.js version check above runs first; a static
-// import would be hoisted and parse the bundle before the check, crashing on
-// older Node.js versions that don't recognize newer syntax in bundled deps.
-await import('../dist/pnpm.mjs')
-
-// if you want to debug at your local env, you can use this
-// require('../lib/pnpm')

package/bin/pnpx.cjs

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-// CommonJS shim for compatibility with older Corepack versions
-import('./pnpx.mjs')

package/bin/pnpx.mjs

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-
-process.argv = [...process.argv.slice(0, 2), 'dlx', ...process.argv.slice(2)]
-
-await import('./pnpm.mjs')

package/dist/node-gyp-bin/node-gyp

@@ -1,6 +0,0 @@
-#!/usr/bin/env sh
-if [ "x$npm_config_node_gyp" = "x" ]; then
-  node "`dirname "$0"`/../node_modules/node-gyp/bin/node-gyp.js" "$@"
-else
-  "$npm_config_node_gyp" "$@"
-fi

package/dist/node-gyp-bin/node-gyp.cmd

@@ -1,5 +0,0 @@
-if not defined npm_config_node_gyp (
-  node "%~dp0\..\node_modules\node-gyp\bin\node-gyp.js" %*
-) else (
-  node "%npm_config_node_gyp%" %*
-)

package/dist/node_modules/.package-map.json

@@ -1 +0,0 @@
-{"packages":{".":{"url":"..","dependencies":{"@isaacs/fs-minipass":"@isaacs/fs-minipass","@reflink/reflink":"@reflink/reflink","@reflink/reflink-darwin-arm64":"@reflink/reflink-darwin-arm64","@reflink/reflink-darwin-x64":"@reflink/reflink-darwin-x64","@reflink/reflink-win32-arm64-msvc":"@reflink/reflink-win32-arm64-msvc","@reflink/reflink-win32-x64-msvc":"@reflink/reflink-win32-x64-msvc","abbrev":"abbrev","chownr":"chownr","env-paths":"env-paths","exponential-backoff":"exponential-backoff","fdir":"fdir","graceful-fs":"graceful-fs","isexe":"isexe","minipass":"minipass","minizlib":"minizlib","node-gyp":"node-gyp","nopt":"nopt","picomatch":"picomatch","pnpm":".","proc-log":"proc-log","semver":"semver","tar":"tar","tinyglobby":"tinyglobby","undici":"undici","v8-compile-cache":"v8-compile-cache","which":"which","yallist":"yallist"}},"@isaacs/fs-minipass":{"url":"./@isaacs/fs-minipass","dependencies":{"@isaacs/fs-minipass":"@isaacs/fs-minipass","minipass":"minipass"}},"@reflink/reflink":{"url":"./@reflink/reflink","dependencies":{"@reflink/reflink":"@reflink/reflink","@reflink/reflink-darwin-arm64":"@reflink/reflink-darwin-arm64","@reflink/reflink-darwin-x64":"@reflink/reflink-darwin-x64","@reflink/reflink-win32-arm64-msvc":"@reflink/reflink-win32-arm64-msvc","@reflink/reflink-win32-x64-msvc":"@reflink/reflink-win32-x64-msvc"}},"@reflink/reflink-darwin-arm64":{"url":"./@reflink/reflink-darwin-arm64","dependencies":{"@reflink/reflink-darwin-arm64":"@reflink/reflink-darwin-arm64"}},"@reflink/reflink-darwin-x64":{"url":"./@reflink/reflink-darwin-x64","dependencies":{"@reflink/reflink-darwin-x64":"@reflink/reflink-darwin-x64"}},"@reflink/reflink-win32-arm64-msvc":{"url":"./@reflink/reflink-win32-arm64-msvc","dependencies":{"@reflink/reflink-win32-arm64-msvc":"@reflink/reflink-win32-arm64-msvc"}},"@reflink/reflink-win32-x64-msvc":{"url":"./@reflink/reflink-win32-x64-msvc","dependencies":{"@reflink/reflink-win32-x64-msvc":"@reflink/reflink-win32-x64-msvc"}},"abbrev":{"url":"./abbrev","dependencies":{"abbrev":"abbrev"}},"chownr":{"url":"./chownr","dependencies":{"chownr":"chownr"}},"env-paths":{"url":"./env-paths","dependencies":{"env-paths":"env-paths"}},"exponential-backoff":{"url":"./exponential-backoff","dependencies":{"exponential-backoff":"exponential-backoff"}},"fdir":{"url":"./fdir","dependencies":{"fdir":"fdir","picomatch":"picomatch"}},"graceful-fs":{"url":"./graceful-fs","dependencies":{"graceful-fs":"graceful-fs"}},"isexe":{"url":"./isexe","dependencies":{"isexe":"isexe"}},"minipass":{"url":"./minipass","dependencies":{"minipass":"minipass"}},"minizlib":{"url":"./minizlib","dependencies":{"minipass":"minipass","minizlib":"minizlib"}},"node-gyp":{"url":"./node-gyp","dependencies":{"env-paths":"env-paths","exponential-backoff":"exponential-backoff","graceful-fs":"graceful-fs","node-gyp":"node-gyp","nopt":"nopt","proc-log":"proc-log","semver":"semver","tar":"tar","tinyglobby":"tinyglobby","undici":"undici","which":"which"}},"nopt":{"url":"./nopt","dependencies":{"abbrev":"abbrev","nopt":"nopt"}},"picomatch":{"url":"./picomatch","dependencies":{"picomatch":"picomatch"}},"proc-log":{"url":"./proc-log","dependencies":{"proc-log":"proc-log"}},"semver":{"url":"./semver","dependencies":{"semver":"semver"}},"tar":{"url":"./tar","dependencies":{"@isaacs/fs-minipass":"@isaacs/fs-minipass","chownr":"chownr","minipass":"minipass","minizlib":"minizlib","tar":"tar","yallist":"yallist"}},"tinyglobby":{"url":"./tinyglobby","dependencies":{"fdir":"fdir","picomatch":"picomatch","tinyglobby":"tinyglobby"}},"undici":{"url":"./undici","dependencies":{"undici":"undici"}},"v8-compile-cache":{"url":"./v8-compile-cache","dependencies":{"v8-compile-cache":"v8-compile-cache"}},"which":{"url":"./which","dependencies":{"isexe":"isexe","which":"which"}},"yallist":{"url":"./yallist","dependencies":{"yallist":"yallist"}}}}

package/dist/node_modules/@isaacs/fs-minipass/LICENSE

@@ -1,15 +0,0 @@
-The ISC License
-
-Copyright (c) Isaac Z. Schlueter and Contributors
-
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.