pnpm 12.14.0 → 12.16.0

package/dist/node_modules/confbox/dist/yaml.mjs

@@ -0,0 +1 @@
+import{getFormat as e,storeFormat as t,stripBOM as n}from"./_chunks/_format.mjs";import{YAMLException as r,dump as i,load as a}from"./_chunks/libs/js-yaml.mjs";function o(e,r){let i=a(n(e),r);return t(e,i,r),i}function s(t,n){let r=e(t,{preserveIndentation:!1}),a=typeof r.indent==`string`?r.indent.length:r.indent,o=i(t,{indent:a,...n});return r.whitespace.start+o.trim()+r.whitespace.end}export{r as YAMLException,o as parseYAML,s as stringifyYAML};

package/dist/node_modules/confbox/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "confbox",
+  "version": "0.3.1",
+  "description": "Compact YAML, TOML, JSONC, JSON5 and INI parser and serializer",
+  "keywords": [
+    "config",
+    "ini",
+    "json5",
+    "jsonc",
+    "toml",
+    "unjs",
+    "yaml"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "unjs/confbox"
+  },
+  "files": [
+    "dist"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "types": "./dist/index.d.mts",
+  "exports": {
+    ".": "./dist/index.mjs",
+    "./ini": "./dist/ini.mjs",
+    "./json": "./dist/json.mjs",
+    "./json5": "./dist/json5.mjs",
+    "./jsonc": "./dist/jsonc.mjs",
+    "./toml": "./dist/toml.mjs",
+    "./yaml": "./dist/yaml.mjs"
+  },
+  "devDependencies": {
+    "@types/ini": "^4.1.1",
+    "@types/node": "^26",
+    "@vitest/coverage-v8": "^4.1.11",
+    "automd": "^0.4.3",
+    "changelogen": "^0.6.2",
+    "detect-indent": "^7.0.2",
+    "ini": "^7.0.0",
+    "jiti": "^2.7.0",
+    "js-toml": "^2.0.1",
+    "js-yaml": "^5.4.1",
+    "json5": "^2.2.3",
+    "jsonc-parser": "^3.3.1",
+    "mitata": "^1.0.34",
+    "obuild": "^0.4.39",
+    "oxfmt": ">=0.66.0",
+    "oxlint": "^1.81.0",
+    "smol-toml": "^1.8.0",
+    "strip-json-comments": "^5.0.1",
+    "toml": "^5.0.0",
+    "typescript": "^7",
+    "vitest": "^4.1.11",
+    "yaml": "^2.9.0"
+  },
+  "scripts": {
+    "build": "obuild",
+    "dev": "vitest dev --coverage",
+    "bench": "pnpm build && node test/bench.mjs",
+    "lint": "oxlint && oxfmt --check src test",
+    "lint:fix": "oxlint --fix && oxfmt src test",
+    "release": "pnpm test && pnpm build && changelogen --release && pnpm publish && git push --follow-tags",
+    "test": "pnpm lint && pnpm test:types && vitest run --coverage",
+    "test:types": "tsc --noEmit --skipLibCheck"
+  }
+}

package/dist/node_modules/get-pnpm/lib/corepack.js

@@ -0,0 +1,79 @@
+import { pnpmProxyConfig, pnpmRegistryConfig } from './pnpmConfig.js';
+import { DEFAULT_REGISTRY } from './registry.js';
+/**
+ * The options for `downloadPnpmExecutable` that download pnpm where
+ * Corepack would, verified the way Corepack verifies it.
+ *
+ * - `COREPACK_NPM_REGISTRY` names the registry. Otherwise `pnpmRegistryConfig`
+ *   reads pnpm's config.
+ * - `COREPACK_NPM_TOKEN`, or `COREPACK_NPM_USERNAME` with
+ *   `COREPACK_NPM_PASSWORD`, are the credentials for Corepack's registry, and
+ *   for the npm registry when pnpm's config holds none for it.
+ * - `COREPACK_INTEGRITY_KEYS` follows Corepack. Unset, npm's own keys are
+ *   trusted. A key set trusts its `npm` keys. `0` or empty skips the signature
+ *   check, which a registry that re-publishes packages without npm's
+ *   signatures already needs for Corepack to have installed pnpm from it.
+ * - The project `.npmrc` is read only while the signature is checked; see
+ *   `PnpmRegistryConfigOptions.readProjectNpmrc`.
+ * - `pnpmProxyConfig` reads the proxy from pnpm's config, whichever registry
+ *   is used.
+ *
+ * @throws if `COREPACK_ENABLE_NETWORK` is `0`, or `COREPACK_INTEGRITY_KEYS`
+ * holds no `npm` key set.
+ */
+export function corepackDownloadOptions(opts = {}) {
+    const env = opts.env ?? process.env;
+    if (env.COREPACK_ENABLE_NETWORK === '0') {
+        throw new Error('Network access is disabled by the environment, so the pnpm binary cannot be downloaded.');
+    }
+    const signature = signaturePolicy(env.COREPACK_INTEGRITY_KEYS);
+    return {
+        ...registryAccess({ ...opts, env, readProjectNpmrc: signature.verifySignature !== false }),
+        proxy: pnpmProxyConfig({ env, homeDir: opts.homeDir }),
+        ...signature,
+    };
+}
+function registryAccess(opts) {
+    const corepackRegistry = opts.env.COREPACK_NPM_REGISTRY;
+    if (corepackRegistry) {
+        return withHeaders({ registry: corepackRegistry }, corepackHeaders(opts.env));
+    }
+    const config = pnpmRegistryConfig(opts);
+    if (config.headers == null && new URL(config.registry).origin === new URL(DEFAULT_REGISTRY).origin) {
+        return withHeaders(config, corepackHeaders(opts.env));
+    }
+    return config;
+}
+function withHeaders(config, headers) {
+    return headers == null ? config : { ...config, headers };
+}
+function corepackHeaders(env) {
+    const { COREPACK_NPM_TOKEN, COREPACK_NPM_USERNAME, COREPACK_NPM_PASSWORD } = env;
+    if (COREPACK_NPM_TOKEN) {
+        return { authorization: `Bearer ${COREPACK_NPM_TOKEN}` };
+    }
+    if (COREPACK_NPM_USERNAME && COREPACK_NPM_PASSWORD) {
+        return { authorization: `Basic ${Buffer.from(`${COREPACK_NPM_USERNAME}:${COREPACK_NPM_PASSWORD}`).toString('base64')}` };
+    }
+    return undefined;
+}
+function signaturePolicy(configured) {
+    if (configured == null)
+        return {};
+    if (configured === '' || configured === '0')
+        return { verifySignature: false };
+    let keys;
+    try {
+        keys = JSON.parse(configured)?.npm;
+    }
+    catch (err) {
+        throw new Error(`COREPACK_INTEGRITY_KEYS is not readable as JSON: ${err.message}`, { cause: err });
+    }
+    // Passing no keys would fall back to npm's own, the opposite of what setting
+    // the variable asked for. An empty set names no key to trust, and Corepack
+    // reads it the same way, so every download is refused.
+    if (!Array.isArray(keys)) {
+        throw new Error('COREPACK_INTEGRITY_KEYS holds no "npm" key set to verify the pnpm binary against.');
+    }
+    return { keys: keys };
+}

package/dist/node_modules/get-pnpm/lib/downloadExecutable.js

@@ -3,7 +3,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { extractTarballMember } from './extractTarballMember.js';
 import { isMusl, platformPackageName } from './platformPackageName.js';
-import { downloadTarball, fetchVersionMeta, normalizeRegistry, useProxyFromEnv } from './registry.js';
+import { downloadTarball, fetchSignatures, fetchVersionMeta, normalizeRegistry, useCertificateAuthorities, useProxyFromEnv } from './registry.js';
 import { majorVersion } from './resolveVersion.js';
 import { sameFileContents } from './sameFileContents.js';
 import { verifyRegistrySignature } from './verifySignature.js';
@@ -38,9 +38,15 @@ export async function downloadPnpmExecutable(opts) {
         arch: process.arch,
         musl: isMusl(),
     });
-    const restoreProxy = useProxyFromEnv();
+    const restoreProxy = useProxyFromEnv(opts.proxy);
     try {
-        return await fetchExecutable({ ...opts, registry, packageName });
+        const restoreCertificates = useCertificateAuthorities(opts.ca);
+        try {
+            return await fetchExecutable({ ...opts, registry, packageName });
+        }
+        finally {
+            restoreCertificates();
+        }
     }
     finally {
         restoreProxy();
@@ -57,7 +63,7 @@ async function fetchExecutable(opts) {
             name: packageName,
             version,
             integrity: meta.dist.integrity,
-            signatures: meta.dist.signatures,
+            signatures: await fetchSignatures(meta, { registry, pkgName: packageName, version, headers: opts.headers }),
             keys: opts.keys,
         });
     }

package/dist/node_modules/get-pnpm/lib/extractTarballMember.js

@@ -27,28 +27,38 @@ export async function extractTarballMember(tarball, memberPath, dest, mode = 0o6
     let found = false;
     await pipeline(createReadStream(tarball), createGunzip(), async function (source) {
         const reader = new BlockReader(source);
-        while (true) {
-            const header = await reader.read(BLOCK_SIZE);
-            // The archive ends with zero-filled blocks; one is enough to stop.
-            if (header == null || header[0] === 0)
-                return;
-            const entry = parseHeader(header);
-            if (FILE_TYPES.has(entry.type) && entry.path === memberPath) {
-                const written = await reader.pipe(entry.size, createWriteStream(dest, { flags: 'wx', mode }));
-                if (written !== entry.size) {
-                    throw new Error(`${tarball} ends after ${written} of the ${entry.size} bytes it declares for ${memberPath}.`);
-                }
-                found = true;
-                // The rest of the archive holds nothing this caller asked for, and
-                // the checksum that vouches for it was checked before any of it was
-                // read.
-                return;
-            }
-            await reader.skip(Math.ceil(entry.size / BLOCK_SIZE) * BLOCK_SIZE);
+        const entry = await seekMember(reader, memberPath);
+        if (entry == null)
+            return;
+        const written = await reader.pipe(entry.size, createWriteStream(dest, { flags: 'wx', mode }));
+        if (written !== entry.size) {
+            throw new Error(`${tarball} ends after ${written} of the ${entry.size} bytes it declares for ${memberPath}.`);
         }
+        found = true;
+        // The rest of the archive holds nothing this caller asked for, and the
+        // checksum that vouches for it was checked before any of it was read.
     });
     return found;
 }
+/**
+ * Reads up to the content of the regular file at `memberPath`.
+ *
+ * @returns its header, or `null` when the archive has no such file.
+ */
+async function seekMember(reader, memberPath) {
+    while (true) {
+        // eslint-disable-next-line no-await-in-loop -- a tar archive can only be walked one entry after another
+        const header = await reader.read(BLOCK_SIZE);
+        // The archive ends with zero-filled blocks; one is enough to stop.
+        if (header == null || header[0] === 0)
+            return null;
+        const entry = parseHeader(header);
+        if (FILE_TYPES.has(entry.type) && entry.path === memberPath)
+            return entry;
+        // eslint-disable-next-line no-await-in-loop -- a tar archive can only be walked one entry after another
+        await reader.skip(Math.ceil(entry.size / BLOCK_SIZE) * BLOCK_SIZE);
+    }
+}
 function parseHeader(header) {
     const name = readString(header, 0, 100);
     const prefix = readString(header, 345, 155);
@@ -78,11 +88,8 @@ class BlockReader {
         return this.#take(size);
     }
     async skip(size) {
-        let left = size;
-        while (left > 0) {
-            if (!await this.#fill(1))
-                return;
-            left -= this.#take(Math.min(left, this.#buffedBytes)).length;
+        for await (const _chunk of this.#chunks({ left: size })) {
+            // Discarded.
         }
     }
     /**
@@ -92,22 +99,25 @@ class BlockReader {
      * the stream ended early.
      */
     async pipe(size, destination) {
-        const self = this;
-        let left = size;
-        await pipeline(async function* () {
-            while (left > 0) {
-                if (!await self.#fill(1))
-                    return;
-                const chunk = self.#take(Math.min(left, self.#buffedBytes));
-                left -= chunk.length;
-                yield chunk;
-            }
-        }, destination);
-        return size - left;
+        const progress = { left: size };
+        await pipeline(this.#chunks(progress), destination);
+        return size - progress.left;
+    }
+    /** The next `progress.left` bytes, counting them down as they are yielded. */
+    async *#chunks(progress) {
+        while (progress.left > 0) {
+            // eslint-disable-next-line no-await-in-loop -- the stream is read in order, one chunk at a time
+            if (!await this.#fill(1))
+                return;
+            const chunk = this.#take(Math.min(progress.left, this.#buffedBytes));
+            progress.left -= chunk.length;
+            yield chunk;
+        }
     }
     /** Reads until at least `size` bytes are buffered, or the stream ends. */
     async #fill(size) {
         while (this.#buffedBytes < size && !this.#done) {
+            // eslint-disable-next-line no-await-in-loop -- the stream is read in order, one chunk at a time
             const { value, done } = await this.#iterator.next();
             if (done === true) {
                 this.#done = true;

package/dist/node_modules/get-pnpm/lib/index.js

@@ -1,220 +1,4 @@
-import { spawnSync } from 'node:child_process';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { extractTarball } from './extractTarball.js';
-import { isMusl, platformPackageName } from './platformPackageName.js';
-import { downloadTarball, fetchPackument, fetchVersionMeta, registryFromEnv, useProxyFromEnv } from './registry.js';
-import { majorVersion, resolveVersion } from './resolveVersion.js';
-import { verifyRegistrySignature } from './verifySignature.js';
+export { corepackDownloadOptions } from './corepack.js';
 export { downloadPnpmExecutable } from './downloadExecutable.js';
-export { extractTarballMember } from './extractTarballMember.js';
-export { isMusl, platformPackageName } from './platformPackageName.js';
-export { DEFAULT_REGISTRY, registryFromEnv, useProxyFromEnv } from './registry.js';
-export { majorVersion, resolveVersion } from './resolveVersion.js';
-export { verifyRegistrySignature } from './verifySignature.js';
-/**
- * The package whose dist-tags name every pnpm release. `@pnpm/exe` carries the
- * same versions today, but only `pnpm` is published from v12 onward, so its
- * tags are the ones that cannot go stale.
- */
-const CLI_PKG_NAME = 'pnpm';
-/** Holds the unpacked tarballs while the installation is assembled beside it. */
-const UNPACK_DIR = '.unpack';
-/** Where the `dist/` tree that ships beside the executable is published. */
-function wrapperPackageName(major) {
-    return major >= 12 ? CLI_PKG_NAME : '@pnpm/exe';
-}
-const USAGE = `Usage: npx get-pnpm [version]
-
-Installs pnpm as a standalone executable and adds it to your PATH.
-
-Arguments:
-  version            An exact version (11.20.0), a major (12), or a dist-tag
-                     (latest, next-12). Defaults to $PNPM_VERSION, then "latest".
-
-Environment variables:
-  PNPM_VERSION           Version to install when no argument is given.
-  PNPM_HOME              Directory to install pnpm into.
-  npm_config_registry    Registry to download pnpm from.
-  HTTPS_PROXY            Proxy to download through (HTTP_PROXY for an http://
-                         registry); NO_PROXY names hosts to reach directly.
-                         Node 24.14 or later.
-`;
-export async function runCli(argv) {
-    const positional = [];
-    for (const arg of argv) {
-        if (arg === '--help' || arg === '-h') {
-            console.log(USAGE);
-            return 0;
-        }
-        if (arg.startsWith('-')) {
-            throw new Error(`Unknown option "${arg}".\n\n${USAGE}`);
-        }
-        positional.push(arg);
-    }
-    if (positional.length > 1) {
-        throw new Error(`Expected at most one version, got ${positional.length}.\n\n${USAGE}`);
-    }
-    return installPnpm({
-        versionSpec: positional[0] ?? process.env.PNPM_VERSION ?? 'latest',
-        registry: registryFromEnv(),
-    });
-}
-/**
- * Downloads the pnpm executable and hands over to `pnpm setup`, which installs
- * it globally and puts it on the PATH.
- *
- * Every download is checked against the checksum the registry published for it,
- * and that checksum against npm's signature — see `verifyRegistrySignature`.
- *
- * The temporary directory is assembled to look like the release tarball that
- * https://get.pnpm.io/install.sh downloads — the executable next to its `dist/`
- * tree — because `pnpm setup` installs that directory as-is.
- *
- * @returns the exit code of `pnpm setup`.
- */
-export async function installPnpm(opts) {
-    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pnpm-install-'));
-    const removeTmpDir = () => {
-        fs.rmSync(tmpDir, { recursive: true, force: true });
-    };
-    // Registered for the duration of the call and no longer: this is also a
-    // library function, and handlers left behind would accumulate and outlive the
-    // directory they exist to clean up.
-    const signals = ['SIGINT', 'SIGTERM', 'SIGHUP'];
-    const onSignal = () => {
-        removeTmpDir();
-        process.exit(1);
-    };
-    for (const signal of signals) {
-        process.once(signal, onSignal);
-    }
-    try {
-        const { binPath } = await downloadPnpm({ ...opts, dest: tmpDir });
-        const { error, status } = spawnSync(binPath, ['setup', '--force'], { stdio: 'inherit' });
-        if (error != null)
-            throw error;
-        return status ?? 1;
-    }
-    finally {
-        for (const signal of signals) {
-            process.off(signal, onSignal);
-        }
-        removeTmpDir();
-    }
-}
-/**
- * Downloads the pnpm executable into `dest`, laid out the way the release
- * tarball lays it out — the executable next to the `dist/` tree it loads.
- *
- * Every download is checked against the checksum the registry published for it,
- * and that checksum against npm's signature; see `verifyRegistrySignature`.
- * Nothing outside `dest` is touched, so a caller that manages its own PATH — a
- * CI action, say — can use this without the global install `installPnpm` does.
- *
- * @returns the version installed and the path to the executable.
- */
-export async function downloadPnpm(opts) {
-    const restoreProxy = useProxyFromEnv();
-    try {
-        return await fetchPnpm(opts);
-    }
-    finally {
-        restoreProxy();
-    }
-}
-async function fetchPnpm(opts) {
-    const packument = await fetchPackument(opts.registry, CLI_PKG_NAME);
-    const version = resolveVersion(packument, opts.versionSpec);
-    const major = majorVersion(version);
-    const platformPkgName = platformPackageName({
-        major,
-        platform: process.platform,
-        arch: process.arch,
-        musl: isMusl(),
-    });
-    const { dest } = opts;
-    fs.mkdirSync(dest, { recursive: true });
-    try {
-        console.log(`==> Downloading pnpm ${version}`);
-        const executable = process.platform === 'win32' ? 'pnpm.exe' : 'pnpm';
-        const fetchPackage = verifiedPackageFetcher({ dir: dest, registry: opts.registry, version, keys: opts.keys });
-        // Settled, not `all`: a rejection there would leave the other fetch writing
-        // into the directory the `finally` below is about to remove.
-        const [platformResult, wrapperResult] = await Promise.allSettled([
-            fetchPackage(platformPkgName),
-            // v11 was the first release to keep files next to the executable; up to
-            // v10 the executable is self-contained and ships no `dist/`.
-            major >= 11 ? fetchPackage(wrapperPackageName(major)) : Promise.resolve(undefined),
-        ]);
-        if (platformResult.status === 'rejected')
-            throw platformResult.reason;
-        if (wrapperResult.status === 'rejected')
-            throw wrapperResult.reason;
-        const platformPkg = platformResult.value;
-        const wrapperPkg = wrapperResult.value;
-        const binPath = path.join(dest, executable);
-        fs.renameSync(path.join(platformPkg.dir, executable), binPath);
-        fs.chmodSync(binPath, 0o755);
-        if (wrapperPkg != null) {
-            fs.rmSync(path.join(dest, 'dist'), { recursive: true, force: true });
-            fs.renameSync(path.join(wrapperPkg.dir, 'dist'), path.join(dest, 'dist'));
-            writeManifest({ dest, executable, version, wrapperDir: wrapperPkg.dir, major });
-        }
-        return { version, binPath };
-    }
-    finally {
-        // `pnpm setup` installs this directory as a package, so nothing may be left
-        // in it that does not belong in the installation.
-        fs.rmSync(path.join(dest, UNPACK_DIR), { recursive: true, force: true });
-    }
-}
-/**
- * `pnpm setup` installs the directory as a package, writing a minimal manifest
- * when there is none — which is what the release tarball relies on. That
- * tarball bundles the runtime dependencies inside `dist/`; the registry copy
- * declares them instead, so up to v11 they have to be declared here or the
- * install silently loses them (`@reflink/reflink`, and with it copy-on-write
- * cloning). From v12 the `dist/` tree is self-contained again, so the manifest
- * `setup` writes is left to it.
- */
-function writeManifest(opts) {
-    if (opts.major >= 12)
-        return;
-    const wrapper = JSON.parse(fs.readFileSync(path.join(opts.wrapperDir, 'package.json'), 'utf8'));
-    if (wrapper.dependencies == null)
-        return;
-    fs.writeFileSync(path.join(opts.dest, 'package.json'), JSON.stringify({
-        name: '@pnpm/exe',
-        version: opts.version,
-        type: 'module',
-        bin: { pnpm: opts.executable, pn: opts.executable },
-        dependencies: wrapper.dependencies,
-    }));
-}
-/** Downloads packages of one version into one directory, verifying each. */
-function verifiedPackageFetcher(opts) {
-    return async function fetchPackage(pkgName) {
-        const meta = await fetchVersionMeta(opts.registry, pkgName, opts.version);
-        if (!meta.dist.integrity) {
-            throw new Error(`The npm registry published no checksum for ${pkgName}@${opts.version}, so it cannot be verified.`);
-        }
-        verifyRegistrySignature({
-            name: pkgName,
-            version: opts.version,
-            integrity: meta.dist.integrity,
-            signatures: meta.dist.signatures,
-            keys: opts.keys,
-        });
-        // Unpack away from the directory being assembled: `pnpm` is both a package
-        // name and the name of the executable that ends up beside it.
-        const unpackDir = path.join(opts.dir, UNPACK_DIR, pkgName.replaceAll('/', '-'));
-        const tarball = `${unpackDir}.tgz`;
-        fs.mkdirSync(path.dirname(tarball), { recursive: true });
-        await downloadTarball(meta, tarball, { registry: opts.registry });
-        extractTarball(tarball, unpackDir);
-        fs.rmSync(tarball);
-        return { dir: path.join(unpackDir, 'package') };
-    };
-}
+export { downloadPnpm, runCli } from './install.js';
+export { readProjectPin } from './projectPin.js';