pnpm 12.15.0 → 12.16.1

package/dist/node_modules/get-pnpm/lib/install.js

@@ -0,0 +1,293 @@
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { extractTarball } from './extractTarball.js';
+import { registryConfigFromEnv } from './npmConfig.js';
+import { isMusl, platformPackageName } from './platformPackageName.js';
+import { readProjectPin } from './projectPin.js';
+import { downloadTarball, fetchPackument, fetchSignatures, fetchVersionMeta, useCertificateAuthorities, useProxyFromEnv } from './registry.js';
+import { majorVersion, resolveVersion } from './resolveVersion.js';
+import { findShadowingPnpm, pnpmHomeDir, renderShadowingPnpmWarning } from './shadowingPnpm.js';
+import { renderUndoHint } from './undoHint.js';
+import { verifyRegistrySignature } from './verifySignature.js';
+/**
+ * The package whose dist-tags name every pnpm release. `@pnpm/exe` carries the
+ * same versions today, but only `pnpm` is published from v12 onward, so its
+ * tags are the ones that cannot go stale.
+ */
+const CLI_PKG_NAME = 'pnpm';
+/** Holds the unpacked tarballs while the installation is assembled beside it. */
+const UNPACK_DIR = '.unpack';
+/** Where the `dist/` tree that ships beside the executable is published. */
+function wrapperPackageName(major) {
+    return major >= 12 ? CLI_PKG_NAME : '@pnpm/exe';
+}
+const USAGE = `Usage: npx get-pnpm [version]
+
+Installs pnpm as a standalone executable and adds it to your PATH.
+
+Arguments:
+  version            An exact version (11.20.0), a major (12), a semver range
+                     (^12.1.0), or a dist-tag (latest, next-12). Defaults to
+                     $PNPM_VERSION, then the version the project in the current
+                     directory pins, then "latest".
+
+                     The project's pin is read from devEngines.packageManager
+                     or packageManager in its manifest, or the workspace
+                     root's for a workspace project, the way pnpm reads it. A
+                     range resolves to the version pnpm-lock.yaml records
+                     while that is still in range.
+
+Environment variables:
+  PNPM_VERSION           Version to install when no argument is given.
+  PNPM_HOME              Directory to install pnpm into.
+  npm_config_registry    Registry to download pnpm from.
+  npm_config_*:_authToken
+                         Registry-scoped bearer token. Project, user, and
+                         global .npmrc auth tokens are also read.
+  npm_config_ca, npm_config_cafile
+                         CA certificates to trust for the registry, besides
+                         Node.js's own. Project, user, and global .npmrc ca,
+                         ca[], and cafile settings, top-level or scoped to the
+                         registry, are also read. Node 22.19/24.5 or later.
+  HTTPS_PROXY            Proxy to download through (HTTP_PROXY for an http://
+                         registry); NO_PROXY names hosts to reach directly.
+                         Node 24.14 or later.
+`;
+export async function runCli(argv) {
+    const positional = [];
+    for (const arg of argv) {
+        if (arg === '--help' || arg === '-h') {
+            console.log(USAGE);
+            return 0;
+        }
+        if (arg.startsWith('-')) {
+            throw new Error(`Unknown option "${arg}".\n\n${USAGE}`);
+        }
+        positional.push(arg);
+    }
+    if (positional.length > 1) {
+        throw new Error(`Expected at most one version, got ${positional.length}.\n\n${USAGE}`);
+    }
+    const registryConfig = registryConfigFromEnv();
+    return installPnpm({
+        versionSpec: positional[0] ?? process.env.PNPM_VERSION ?? projectVersionSpec(process.cwd()) ?? 'latest',
+        ...registryConfig,
+    });
+}
+/** The version `readProjectPin` finds for `dir`, saying where it comes from. */
+function projectVersionSpec(dir) {
+    const pin = readProjectPin(dir);
+    if (pin == null)
+        return undefined;
+    const locked = pin.lockedVersion == null ? '' : `, locked to ${pin.lockedVersion} in pnpm-lock.yaml`;
+    console.log(`==> ${pin.manifestPath} pins pnpm ${pin.spec} in ${pin.field}${locked}`);
+    return pin.lockedVersion ?? pin.spec;
+}
+/**
+ * Downloads the pnpm executable and hands over to `pnpm setup`, which installs
+ * it globally and puts it on the PATH.
+ *
+ * Every download is checked against the checksum the registry published for it,
+ * and that checksum against npm's signature — see `verifyRegistrySignature`.
+ *
+ * The temporary directory is assembled to look like the release tarball that
+ * https://get.pnpm.io/install.sh downloads — the executable next to its `dist/`
+ * tree — because `pnpm setup` installs that directory as-is.
+ *
+ * @returns the exit code of `pnpm setup`.
+ */
+export async function installPnpm(opts) {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pnpm-install-'));
+    const removeTmpDir = () => {
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    };
+    // Registered for the duration of the call and no longer: this is also a
+    // library function, and handlers left behind would accumulate and outlive the
+    // directory they exist to clean up.
+    const signals = ['SIGINT', 'SIGTERM', 'SIGHUP'];
+    const onSignal = () => {
+        removeTmpDir();
+        // eslint-disable-next-line n/no-process-exit -- a signal listener replaces the default handling, which would have ended the process
+        process.exit(1);
+    };
+    for (const signal of signals) {
+        process.once(signal, onSignal);
+    }
+    try {
+        const { binPath } = await downloadPnpm({ ...opts, dest: tmpDir });
+        const { error, status } = spawnSync(binPath, ['setup', '--force'], { stdio: 'inherit' });
+        if (error != null)
+            throw error;
+        if (status === 0) {
+            console.log(renderUndoHint(pnpmHomeDir()));
+            warnIfPnpmIsShadowed();
+        }
+        return status ?? 1;
+    }
+    finally {
+        for (const signal of signals) {
+            process.off(signal, onSignal);
+        }
+        removeTmpDir();
+    }
+}
+/**
+ * Says so when the pnpm `pnpm setup` just installed is not the one PATH
+ * resolves, or the success above is the last thing the person reads before
+ * `pnpm --version` prints the old version again.
+ */
+function warnIfPnpmIsShadowed() {
+    const pnpmHome = pnpmHomeDir();
+    const shadowing = findShadowingPnpm(pnpmHome, { pathEnv: readPathEnv(process.env) });
+    if (shadowing != null) {
+        console.error(renderShadowingPnpmWarning(shadowing, pnpmHome));
+    }
+}
+/** Windows spells the variable `Path`, and the environment is case-insensitive there. */
+function readPathEnv(env) {
+    if (process.platform !== 'win32')
+        return env.PATH;
+    const key = Object.keys(env).find((name) => name.toUpperCase() === 'PATH');
+    return key != null ? env[key] : undefined;
+}
+/**
+ * Downloads the pnpm executable into `dest`, laid out the way the release
+ * tarball lays it out — the executable next to the `dist/` tree it loads.
+ *
+ * Every download is checked against the checksum the registry published for it,
+ * and that checksum against npm's signature; see `verifyRegistrySignature`.
+ * Nothing outside `dest` is touched, so a caller that manages its own PATH — a
+ * CI action, say — can use this without the global install `installPnpm` does.
+ *
+ * @returns the version installed and the path to the executable.
+ */
+export async function downloadPnpm(opts) {
+    const restoreProxy = useProxyFromEnv();
+    try {
+        const restoreCertificates = useCertificateAuthorities(opts.ca);
+        try {
+            return await fetchPnpm(opts);
+        }
+        finally {
+            restoreCertificates();
+        }
+    }
+    finally {
+        restoreProxy();
+    }
+}
+async function fetchPnpm(opts) {
+    const packument = await fetchPackument(opts.registry, CLI_PKG_NAME, opts.headers, opts.authPath);
+    const version = resolveVersion(packument, opts.versionSpec);
+    const major = majorVersion(version);
+    const platformPkgName = platformPackageName({
+        major,
+        platform: process.platform,
+        arch: process.arch,
+        musl: isMusl(),
+    });
+    const { dest } = opts;
+    fs.mkdirSync(dest, { recursive: true });
+    try {
+        console.log(`==> Downloading pnpm ${version}`);
+        const executable = process.platform === 'win32' ? 'pnpm.exe' : 'pnpm';
+        const fetchPackage = verifiedPackageFetcher({
+            dir: dest,
+            registry: opts.registry,
+            version,
+            authPath: opts.authPath,
+            headers: opts.headers,
+            keys: opts.keys,
+        });
+        const { platformPkg, wrapperPkg } = await fetchPackages(fetchPackage, platformPkgName, major);
+        const binPath = path.join(dest, executable);
+        fs.renameSync(path.join(platformPkg.dir, executable), binPath);
+        fs.chmodSync(binPath, 0o755);
+        if (wrapperPkg != null) {
+            fs.rmSync(path.join(dest, 'dist'), { recursive: true, force: true });
+            fs.renameSync(path.join(wrapperPkg.dir, 'dist'), path.join(dest, 'dist'));
+            writeManifest({ dest, executable, version, wrapperDir: wrapperPkg.dir, major });
+        }
+        return { version, binPath };
+    }
+    finally {
+        // `pnpm setup` installs this directory as a package, so nothing may be left
+        // in it that does not belong in the installation.
+        fs.rmSync(path.join(dest, UNPACK_DIR), { recursive: true, force: true });
+    }
+}
+async function fetchPackages(fetchPackage, platformPkgName, major) {
+    // Settled, not `all`: a rejection there would leave the other fetch writing
+    // into the directory the caller is about to remove.
+    const [platformResult, wrapperResult] = await Promise.allSettled([
+        fetchPackage(platformPkgName),
+        // v11 was the first release to keep files next to the executable; up to
+        // v10 the executable is self-contained and ships no `dist/`.
+        major >= 11 ? fetchPackage(wrapperPackageName(major)) : Promise.resolve(undefined),
+    ]);
+    if (platformResult.status === 'rejected')
+        throw platformResult.reason;
+    if (wrapperResult.status === 'rejected')
+        throw wrapperResult.reason;
+    return { platformPkg: platformResult.value, wrapperPkg: wrapperResult.value };
+}
+/**
+ * `pnpm setup` installs the directory as a package, writing a minimal manifest
+ * when there is none — which is what the release tarball relies on. That
+ * tarball bundles the runtime dependencies inside `dist/`; the registry copy
+ * declares them instead, so up to v11 they have to be declared here or the
+ * install silently loses them (`@reflink/reflink`, and with it copy-on-write
+ * cloning). From v12 the `dist/` tree is self-contained again, so the manifest
+ * `setup` writes is left to it.
+ */
+function writeManifest(opts) {
+    if (opts.major >= 12)
+        return;
+    const wrapper = JSON.parse(fs.readFileSync(path.join(opts.wrapperDir, 'package.json'), 'utf8'));
+    if (wrapper.dependencies == null)
+        return;
+    fs.writeFileSync(path.join(opts.dest, 'package.json'), JSON.stringify({
+        name: '@pnpm/exe',
+        version: opts.version,
+        type: 'module',
+        bin: { pnpm: opts.executable, pn: opts.executable },
+        dependencies: wrapper.dependencies,
+    }));
+}
+/** Downloads packages of one version into one directory, verifying each. */
+function verifiedPackageFetcher(opts) {
+    return async function fetchPackage(pkgName) {
+        const meta = await fetchVersionMeta(opts.registry, pkgName, opts.version, opts.headers, opts.authPath);
+        if (!meta.dist.integrity) {
+            throw new Error(`The npm registry published no checksum for ${pkgName}@${opts.version}, so it cannot be verified.`);
+        }
+        verifyRegistrySignature({
+            name: pkgName,
+            version: opts.version,
+            integrity: meta.dist.integrity,
+            signatures: await fetchSignatures(meta, {
+                registry: opts.registry,
+                pkgName,
+                version: opts.version,
+                headers: opts.headers,
+                headersPath: opts.authPath,
+            }),
+            keys: opts.keys,
+        });
+        // Unpack away from the directory being assembled: `pnpm` is both a package
+        // name and the name of the executable that ends up beside it.
+        const unpackDir = path.join(opts.dir, UNPACK_DIR, pkgName.replaceAll('/', '-'));
+        const tarball = `${unpackDir}.tgz`;
+        fs.mkdirSync(path.dirname(tarball), { recursive: true });
+        await downloadTarball(meta, tarball, {
+            registry: opts.registry,
+            headers: opts.headers,
+            headersPath: opts.authPath,
+        });
+        extractTarball(tarball, unpackDir);
+        fs.rmSync(tarball);
+        return { dir: path.join(unpackDir, 'package') };
+    };
+}

package/dist/node_modules/get-pnpm/lib/npmConfig.js

@@ -0,0 +1,280 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { DEFAULT_REGISTRY, isUrlSecureForCredentials, normalizeRegistry } from './registry.js';
+export function registryConfigFromEnv(opts = {}) {
+    const env = opts.env ?? process.env;
+    const cwd = opts.cwd ?? process.cwd();
+    const rawRegistry = env.npm_config_registry ?? env.NPM_CONFIG_REGISTRY ?? DEFAULT_REGISTRY;
+    const embedded = registryAndEmbeddedAuth(rawRegistry);
+    const registry = embedded.registry;
+    // Highest precedence first, as npm layers them.
+    const sources = [
+        envSource(env, cwd),
+        ...[
+            ...projectNpmrcs(cwd, env),
+            userNpmrc(opts, env),
+            globalNpmrc(opts, env),
+        ].map((candidate) => readNpmrc(candidate, env)),
+    ];
+    const ca = certificateAuthorities(registry, sources);
+    const auth = embedded.headers != null ? embedded : tokenAuth(registry, sources);
+    return { ...auth, ...(ca.length > 0 ? { ca } : {}) };
+}
+function tokenAuth(registry, sources) {
+    if (!isUrlSecureForCredentials(new URL(registry)))
+        return { registry };
+    const token = mostSpecificToken(sources.map((source) => tokenForRegistry(registry, source.entries)));
+    return token == null
+        ? { registry }
+        : {
+            registry,
+            authPath: token.pathname,
+            headers: { authorization: `Bearer ${token.token}` },
+        };
+}
+function registryAndEmbeddedAuth(rawRegistry) {
+    const url = new URL(normalizeRegistry(rawRegistry));
+    if (!url.username && !url.password)
+        return { registry: url.href };
+    const username = decodeURIComponent(url.username);
+    const password = decodeURIComponent(url.password);
+    url.username = '';
+    url.password = '';
+    return {
+        registry: url.href,
+        authPath: normalizedPath(url.pathname),
+        headers: {
+            authorization: `Basic ${Buffer.from(`${username}:${password}`).toString('base64')}`,
+        },
+    };
+}
+/**
+ * The `npm_config_*` variables. npm sets them for the programs it runs, a
+ * `ca` array joined into one value.
+ */
+function envSource(env, cwd) {
+    const entries = [];
+    for (const [name, value] of Object.entries(env)) {
+        if (value == null || !name.toLowerCase().startsWith('npm_config_'))
+            continue;
+        const key = name.slice('npm_config_'.length);
+        // npm's own names are lowercase; only a URL-scoped key keeps its case.
+        entries.push([key.startsWith('//') ? key : key.toLowerCase(), value]);
+    }
+    return { dir: cwd, entries };
+}
+function readNpmrc(npmrc, env) {
+    const dir = path.dirname(npmrc.path);
+    const text = readNpmrcText(npmrc);
+    if (text == null)
+        return { dir, entries: [] };
+    const entries = [];
+    for (const rawLine of text.split(/\r?\n/)) {
+        const entry = parseNpmrcLine(rawLine.trim(), env);
+        if (entry != null)
+            entries.push(entry);
+    }
+    return { dir, entries };
+}
+/** The text of `npmrc`, or `undefined` when there is none to read. */
+function readNpmrcText(npmrc) {
+    try {
+        return fs.readFileSync(npmrc.path, 'utf8');
+    }
+    catch (err) {
+        if (isErrno(err, 'ENOENT'))
+            return undefined;
+        if (npmrc.ignoreUnreadable && isUnreadableNpmrcError(err))
+            return undefined;
+        throw err;
+    }
+}
+function parseNpmrcLine(line, env) {
+    if (!line || line.startsWith('#') || line.startsWith(';'))
+        return undefined;
+    const separator = line.indexOf('=');
+    if (separator === -1)
+        return undefined;
+    const key = line.slice(0, separator).trim();
+    const value = expandEnv(stripQuotes(line.slice(separator + 1).trim()), env);
+    return value == null ? undefined : [key, value];
+}
+function tokenForRegistry(registry, entries) {
+    const registryUrl = new URL(registry);
+    let best;
+    for (const [key, token] of entries) {
+        if (token === '')
+            continue;
+        const scope = authTokenScope(key, registryUrl.protocol);
+        if (scope == null || !scopeCovers(scope, registryUrl))
+            continue;
+        // A longer prefix wins; at equal length, the later entry does.
+        if (best == null || scope.pathname.length >= best.pathname.length) {
+            best = { pathname: scope.pathname, token };
+        }
+    }
+    return best;
+}
+function mostSpecificToken(candidates) {
+    let best;
+    for (const candidate of candidates) {
+        if (candidate == null)
+            continue;
+        if (best == null || candidate.pathname.length > best.pathname.length)
+            best = candidate;
+    }
+    return best;
+}
+function authTokenScope(key, protocol) {
+    return registryScope(key, ':_authtoken', protocol);
+}
+/**
+ * The CA certificates the config adds for `registry`: those of the
+ * highest-precedence source that sets a top-level `ca`, `ca[]`, or `cafile`,
+ * and those scoped to the longest `//host/path/` prefix of `registry`. A
+ * `cafile` that cannot be read adds nothing, as in pnpm.
+ */
+export function certificateAuthorities(registry, sources) {
+    const topLevel = sources.find((source) => source.entries.some(([key]) => CA_SETTINGS.includes(key)));
+    const settings = (topLevel?.entries ?? [])
+        .filter(([key]) => CA_SETTINGS.includes(key))
+        .map(([setting, value]) => ({ dir: topLevel.dir, setting, value }));
+    settings.push(...scopedCaSettings(registry, sources));
+    return settings.flatMap(({ dir, setting, value }) => pemCertificates(setting === 'cafile' ? readCaFile(path.resolve(dir, value)) : value.replaceAll('\\n', '\n')));
+}
+const CA_SETTINGS = ['ca', 'ca[]', 'cafile'];
+/** A longer prefix wins; at equal length, the higher-precedence source does. */
+function scopedCaSettings(registry, sources) {
+    const registryUrl = new URL(registry);
+    const scoped = sources.flatMap((source, sourceIndex) => source.entries.flatMap(([key, value]) => {
+        const scope = value === '' ? undefined : caSettingScope(key, registryUrl);
+        return scope == null ? [] : [{ sourceIndex, dir: source.dir, value, ...scope }];
+    }));
+    const longest = Math.max(...scoped.map(({ pathname }) => pathname.length));
+    const winner = scoped.find(({ pathname }) => pathname.length === longest);
+    return scoped.filter(({ sourceIndex, pathname }) => sourceIndex === winner?.sourceIndex && pathname.length === longest);
+}
+/** The CA setting `key` scopes to a prefix of `registryUrl`, if it is one. */
+function caSettingScope(key, registryUrl) {
+    for (const setting of CA_SETTINGS) {
+        const scope = registryScope(key, `:${setting}`, registryUrl.protocol);
+        if (scope == null)
+            continue;
+        return scopeCovers(scope, registryUrl) ? { pathname: scope.pathname, setting } : undefined;
+    }
+    return undefined;
+}
+function scopeCovers(scope, registryUrl) {
+    return scope.host === registryUrl.host.toLowerCase() && registryUrl.pathname.startsWith(scope.pathname);
+}
+function readCaFile(file) {
+    try {
+        return fs.readFileSync(file, 'utf8');
+    }
+    catch {
+        return '';
+    }
+}
+function pemCertificates(text) {
+    return text.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g) ?? [];
+}
+function registryScope(key, suffix, protocol) {
+    const lower = key.toLowerCase();
+    if (!lower.endsWith(suffix))
+        return undefined;
+    const rawScope = key.slice(0, -suffix.length);
+    if (!rawScope.startsWith('//'))
+        return undefined;
+    try {
+        const url = new URL(`${protocol}${rawScope}`);
+        return {
+            host: url.host.toLowerCase(),
+            pathname: normalizedPath(url.pathname),
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+function projectNpmrcs(cwd, env) {
+    const configured = env.npm_config_local_prefix ?? env.NPM_CONFIG_LOCAL_PREFIX;
+    if (configured != null) {
+        return [{ path: path.join(configured, '.npmrc'), ignoreUnreadable: false }];
+    }
+    const current = path.resolve(cwd);
+    const root = findProjectRoot(current);
+    const paths = [path.join(current, '.npmrc')];
+    if (root !== current)
+        paths.push(path.join(root, '.npmrc'));
+    return paths.map((npmrcPath) => ({ path: npmrcPath, ignoreUnreadable: true }));
+}
+function findProjectRoot(cwd) {
+    const start = path.resolve(cwd);
+    let current = start;
+    while (true) {
+        if (fs.existsSync(path.join(current, 'package.json')))
+            return current;
+        const parent = path.dirname(current);
+        if (parent === current)
+            return start;
+        current = parent;
+    }
+}
+function userNpmrc(opts, env) {
+    const configured = env.npm_config_userconfig ?? env.NPM_CONFIG_USERCONFIG;
+    return configured != null
+        ? { path: configured, ignoreUnreadable: false }
+        : { path: path.join(npmHomeDir(opts, env), '.npmrc'), ignoreUnreadable: true };
+}
+function globalNpmrc(opts, env) {
+    const configured = env.npm_config_globalconfig ?? env.NPM_CONFIG_GLOBALCONFIG;
+    if (configured != null)
+        return { path: configured, ignoreUnreadable: false };
+    const platform = opts.platform ?? process.platform;
+    const homeDir = npmHomeDir(opts, env);
+    const prefix = env.npm_config_prefix ??
+        env.NPM_CONFIG_PREFIX ??
+        (platform === 'win32'
+            ? path.join(env.APPDATA ?? path.join(homeDir, 'AppData', 'Roaming'), 'npm')
+            : path.dirname(path.dirname(opts.execPath ?? process.execPath)));
+    return { path: path.join(prefix, 'etc', 'npmrc'), ignoreUnreadable: true };
+}
+function npmHomeDir(opts, env) {
+    if (opts.homeDir != null)
+        return opts.homeDir;
+    const platform = opts.platform ?? process.platform;
+    if (platform === 'win32')
+        return env.USERPROFILE ?? env.HOME ?? os.homedir();
+    return env.HOME ?? os.homedir();
+}
+function normalizedPath(pathname) {
+    return pathname.endsWith('/') ? pathname : `${pathname}/`;
+}
+export function stripQuotes(value) {
+    if (value.length < 2)
+        return value;
+    const first = value[0];
+    const last = value[value.length - 1];
+    return (first === last && (first === '"' || first === "'")) ? value.slice(1, -1) : value;
+}
+function expandEnv(value, env) {
+    let missing = false;
+    // `${NAME?}` is npm's spelling for "empty when unset"; a bare `${NAME}` that
+    // is unset drops the entry rather than sending the placeholder as a token.
+    const expanded = value.replace(/\$\{([^${}?]+)(\?)?\}/g, (_match, name, optional) => {
+        const resolved = env[name];
+        if (resolved != null)
+            return resolved;
+        if (optional == null)
+            missing = true;
+        return '';
+    });
+    return missing ? undefined : expanded;
+}
+function isUnreadableNpmrcError(err) {
+    return ['EACCES', 'EISDIR', 'EPERM'].some((code) => isErrno(err, code));
+}
+function isErrno(err, code) {
+    return err instanceof Error && 'code' in err && err.code === code;
+}

package/dist/node_modules/get-pnpm/lib/npmSigningKeys.js

@@ -1,10 +1,6 @@
 /* eslint-disable */
-// GENERATED — npm's public registry signing keys, mirrored from
-// https://registry.npmjs.org/-/npm/v1/keys
-//
-// Refresh with: node scripts/update-npm-keys.mjs --update
-// A scheduled workflow runs the check, so a rotation arrives as a pull request
-// rather than as a failed install.
+// GENERATED from .config/npm-signing-keys.json by the meta-updater. Refresh the
+// keys with `pnpm update:npm-signing-keys`, then `pnpm update-manifests`.
 export const NPM_SIGNING_KEYS = [
     {
         "expires": null,

package/dist/node_modules/get-pnpm/lib/platformPackageName.js

@@ -27,6 +27,16 @@ export function platformPackageName({ major, platform, arch, musl }) {
 
   npx get-pnpm 12`);
     }
+    assertBinaryIsPublished({ major, platform, arch });
+    const linuxMusl = platform === 'linux' && musl;
+    if (major >= 12) {
+        return `@pnpm/exe.${platform}-${arch}${linuxMusl ? '-musl' : ''}`;
+    }
+    return `@pnpm/${legacyOsSegment(platform, linuxMusl)}-${arch}`;
+}
+/** Throws for the hosts outside v12's own targets that a release leaves out. */
+function assertBinaryIsPublished({ major, platform, arch }) {
+    const target = `${platform}-${arch}`;
     if ((arch !== 'x64' && arch !== 'arm64') ||
         (platform !== 'darwin' && platform !== 'linux' && platform !== 'win32')) {
         throw new Error(`Sorry! pnpm does not provide a pre-built binary for ${target}.`);
@@ -41,11 +51,6 @@ Install pnpm a different way instead:
 
 More context: https://github.com/pnpm/pnpm/issues/11423`);
     }
-    const linuxMusl = platform === 'linux' && musl;
-    if (major >= 12) {
-        return `@pnpm/exe.${platform}-${arch}${linuxMusl ? '-musl' : ''}`;
-    }
-    return `@pnpm/${legacyOsSegment(platform, linuxMusl)}-${arch}`;
 }
 function legacyOsSegment(platform, isMusl) {
     switch (platform) {
@@ -59,8 +64,7 @@ function legacyOsSegment(platform, isMusl) {
  *
  * Probed the way pnpm's own wrappers do it rather than through a dependency:
  * glibc builds report a `glibcVersionRuntime`, musl builds leave it unset.
- * Keeping this package dependency-free means `npx` fetches one thing before
- * pnpm exists.
+ * Every dependency is one more package `npx` fetches before pnpm exists.
  */
 export function isMusl() {
     if (process.platform !== 'linux')