pnpm 12.8.1 → 12.9.0

package/dist/node_modules/undici/lib/dispatcher/client-h2.js

@@ -1,6 +1,7 @@
 'use strict'
 
 const assert = require('node:assert')
+const { errorMonitor } = require('node:events')
 const { pipeline } = require('node:stream')
 const util = require('../core/util.js')
 const {
@@ -77,6 +78,15 @@ function parseH2Headers (headers) {
   return result
 }
 
+/**
+ * @param {import('node:http2').IncomingHttpHeaders} headers
+ * @returns {Buffer[]}
+ */
+function parseH2ResponseHeaders (headers) {
+  const { [HTTP2_HEADER_STATUS]: _statusCode, ...realHeaders } = headers
+  return parseH2Headers(realHeaders)
+}
+
 async function connectH2 (client, socket) {
   client[kSocket] = socket
 
@@ -297,22 +307,32 @@ function writeH2 (client, request) {
   headers[HTTP2_HEADER_AUTHORITY] = host || `${hostname}${port ? `:${port}` : ''}`
   headers[HTTP2_HEADER_METHOD] = method
 
-  const abort = (err) => {
-    if (request.aborted || request.completed) {
+  /**
+   * @param {Error} [error]
+   */
+  const abort = (error) => {
+    if (request.aborted) {
+      return
+    }
+
+    if (request.completed) {
+      if (method === 'CONNECT' && stream != null) {
+        util.destroy(stream, error || new RequestAbortedError())
+      }
       return
     }
 
-    err = err || new RequestAbortedError()
+    error = error || new RequestAbortedError()
 
-    util.errorRequest(client, request, err)
+    util.errorRequest(client, request, error)
 
     if (stream != null) {
-      util.destroy(stream, err)
+      util.destroy(stream, error)
     }
 
     // We do not destroy the socket as we can continue using the session
     // the stream get's destroyed and the session remains to create new streams
-    util.destroy(body, err)
+    util.destroy(body, error)
     client[kQueue][client[kRunningIdx]++] = null
     client[kResume]()
   }
@@ -331,25 +351,57 @@ function writeH2 (client, request) {
 
   if (method === 'CONNECT') {
     session.ref()
-    // We are already connected, streams are pending, first request
-    // will create a new stream. We trigger a request to create the stream and wait until
-    // `ready` event is triggered
     // We disabled endStream to allow the user to write to the stream
     stream = session.request(headers, { endStream: false, signal })
+    let upgradeResponseFinished = false
+
+    /**
+     * @param {import('node:http2').IncomingHttpHeaders} headers
+     */
+    const onResponse = (headers) => {
+      upgradeResponseFinished = true
+      stream.off(errorMonitor, onUpgradeError)
+      request.onUpgradeResponse(Number(headers[HTTP2_HEADER_STATUS]), headers, parseH2ResponseHeaders)
+    }
 
-    if (stream.id && !stream.pending) {
-      request.onUpgrade(null, null, stream)
-      ++session[kOpenStreams]
-      client[kQueue][client[kRunningIdx]++] = null
-    } else {
-      stream.once('ready', () => {
+    /**
+     * @param {Error} error
+     */
+    const onUpgradeError = (error) => {
+      upgradeResponseFinished = true
+      stream.off('response', onResponse)
+      request.onUpgradeError(error)
+    }
+
+    const onReady = () => {
+      try {
         request.onUpgrade(null, null, stream)
-        ++session[kOpenStreams]
-        client[kQueue][client[kRunningIdx]++] = null
-      })
+      } catch (error) {
+        stream.off('response', onResponse)
+        abort(error)
+        return
+      }
+
+      if (request.aborted) {
+        return
+      }
+
+      stream.off('error', abort)
+      stream.once(errorMonitor, onUpgradeError)
+      client[kQueue][client[kRunningIdx]++] = null
     }
 
+    stream.once('response', onResponse)
+    stream.once('error', abort)
+    ++session[kOpenStreams]
+    onReady()
+
     stream.once('close', () => {
+      if (!upgradeResponseFinished && request.completed) {
+        stream.off('response', onResponse)
+        stream.off(errorMonitor, onUpgradeError)
+        request.onUpgradeError(new InformationalError(`HTTP/2: "stream error" received - code ${stream.rstCode}`))
+      }
       session[kOpenStreams] -= 1
       if (session[kOpenStreams] === 0) session.unref()
     })

package/dist/node_modules/undici/lib/handler/retry-handler.js

@@ -205,7 +205,10 @@ class RetryHandler {
     this.retryCount += 1
 
     if (statusCode >= 300) {
-      if (this.retryOpts.statusCodes.includes(statusCode) === false) {
+      // Only expose a response if no earlier attempt has reached the caller.
+      // Otherwise abort this attempt so the error settles the existing body
+      // instead of replacing it with a new response.
+      if (!this.headersSent && this.retryOpts.statusCodes.includes(statusCode) === false) {
         this.headersSent = true
         this.checkpointResponseEnd(headers, resume)
         return this.handler.onHeaders(

package/dist/node_modules/undici/package.json

@@ -1,6 +1,6 @@
 {
   "name": "undici",
-  "version": "6.28.1",
+  "version": "6.29.0",
   "description": "An HTTP/1.1 client, written from scratch for Node.js",
   "homepage": "https://undici.nodejs.org",
   "bugs": {

package/dist/wasm/LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2015-2016 Rico Sta. Cruz and other contributors
+Copyright (c) 2016-2026 Zoltan Kochan and other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/wasm/README.md

@@ -0,0 +1,140 @@
+# WebContainer runtime
+
+This runtime executes the pnpm v12 CLI as threaded WebAssembly inside StackBlitz
+WebContainers. The regular npm wrapper includes this runtime and `pnpm.wasm`
+under `dist/wasm` and selects it using `process.versions.webcontainer`. The
+standalone distribution is also available for testing builds before release.
+Implementation and validation are tracked in
+[pnpm/tasks#63](https://github.com/pnpm/tasks/issues/63).
+
+Native pnpm does not load this package. Native implementations remain selected
+at compile time.
+
+## Build and test
+
+From the repository root, with workspace dependencies installed:
+
+```sh
+rustup toolchain install nightly-2026-08-27 --profile minimal --target wasm32-wasip1-threads
+export WASI_SDK_PATH=/path/to/wasi-sdk-34.0
+export WABT_PATH=/path/to/wabt-1.0.42
+pnpm build:pnpm:wasm
+pnpm pack:pnpm:wasm
+node pnpm/wasm/stage.mjs
+pnpm build:wasm-runtime-probe
+pnpm --filter @pnpm-private/wasm-runtime test
+node pnpm/tasks/ecosystem-e2e/webcontainer/run.mjs --wasm-runtime target/wasm-runtime-probe/wasm32-wasip1-threads/debug/pnpm-wasm-runtime-probe.wasm
+```
+
+`stage.mjs` prepares the self-contained `pnpm/npm/pnpm/dist/wasm` payload for
+the regular npm wrapper. Release jobs restore it after the node-gyp payload.
+Native executable archives do not include the WASM payload. Normal native npm
+installations keep the direct native executable, without a runtime-selection
+check on each invocation.
+
+CI packs the regular wrapper with `pack-wrapper.mjs` and enforces a 20 MiB
+compressed size budget. The bundled runtime also increases native npm download
+size; it must be available before install scripts run for automatic WebContainer
+selection to work when those scripts are disabled.
+
+The full build uses the pinned nightly because `cap-primitives` requires unstable
+WASI filesystem APIs. Native builds retain the repository's stable toolchain.
+Download and extract [WASI SDK 34](https://github.com/WebAssembly/wasi-sdk/releases/tag/wasi-sdk-34)
+before setting `WASI_SDK_PATH`; the build checks its version and does not download
+a compiler. The SDK also builds bundled SQLite with threading enabled.
+Extract [WABT 1.0.42](https://github.com/WebAssembly/wabt/releases/tag/1.0.42)
+and set `WABT_PATH` to its directory containing `bin`. The build uses its validated
+WebAssembly text roundtrip to replace atomic waits with cancellable host imports.
+The runtime tests also use this toolchain.
+
+The browser test needs the Chromium installation described in the
+[ecosystem test guide](https://github.com/pnpm/pnpm/blob/main/pnpm/tasks/ecosystem-e2e/README.md#webcontainers).
+The Node tests require the freshly built probe; missing artifacts are errors.
+
+## Execution model
+
+The Node supervisor owns one WASI descriptor table, the filesystem permission
+adapter, network requests and child processes. Rust runs in workers sharing
+one WebAssembly memory. All workers use the supervisor's descriptor table,
+including when Tokio moves an open file between threads.
+
+The build exports `malloc`, `free`, `__tls_base` and `__wasm_init_tls` for the
+thread loader. The supervisor performs shared memory initialization; the main
+worker initializes its thread-local storage before calling `_start`.
+
+The `pnpm_atomic` imports provide cancellable atomic waits. WebContainer workers
+cannot terminate while parked in a WebAssembly atomic wait. The build rewrites
+only wait instructions; loads, stores, notifications and other atomics remain
+WebAssembly instructions. Host waits preserve guest deadlines and use bounded
+blocking intervals to observe cancellation without a lost wakeup.
+
+The `pnpm_host` imports start asynchronous operations and transfer responses.
+One Rust completion thread wakes pending futures. The supervisor retains result
+buffers until Rust reads or cancels them; it never retains pointers into guest
+memory. Each JSON request or response is limited to 1 MiB. Stream reads transfer
+at most 64 KiB of data at a time. HTTP uploads use a separate bounded stream,
+so package bodies can exceed the control-message limit. Dropping a request cancels it, and closing the
+runtime aborts outstanding operations before terminating the workers.
+
+The `pnpm_fs` imports supply operations WASI lacks: atomic creation with an
+explicit mode, descriptor-bound permission changes, and private lock
+directories. They use the same descriptor mapping as ordinary WASI calls.
+
+The runtime runs trusted pnpm code with the authority of its Node host. It
+preopens the host root; it is not a sandbox for arbitrary WASM modules. Inside
+WebContainers this is the container's virtual filesystem.
+
+## Current boundaries
+
+WebContainer's bundled npm applies package replacements through a private host
+integration. The standalone pnpm distribution does not depend on that API.
+Projects using native tools must select compatible WebAssembly packages through
+pnpm's existing overrides. For example, in `pnpm-workspace.yaml`:
+
+```yaml
+overrides:
+  esbuild: npm:esbuild-wasm@^0.27.0
+  rollup: npm:@rollup/wasm-node@^4.43.1
+```
+
+Match the replacement versions to the project's dependencies and commit the
+lockfile generated by `pnpm install`. This uses the normal resolver and integrity
+checks without implicitly substituting package contents.
+
+The browser controls HTTP protocol negotiation and connection pooling. Explicit
+custom TLS roots, client certificates, proxies, local addresses and DNS pinning
+are rejected by the WASM HTTP adapter. They are not silently ignored. Redirects
+remain controlled by the shared Rust network policy.
+
+Process cancellation enumerates descendants with the host's `/bin/ps` and
+signals them while the spawned parent is still owned. WebContainers do not
+support process-group signals or stable descendant identity handles. If a
+parent exits after a graceful signal while a descendant ignores that signal,
+the runtime cannot safely target the orphan during later escalation. It does
+not retain stale descendant PIDs. Runtime shutdown uses `SIGKILL` for live
+owned process trees.
+
+WebContainers do not reliably support numeric file descriptors in child-process
+stdio. File redirection therefore uses a pipe bridge, and waiting for the child
+also waits for the redirected output to finish writing. A background descendant
+that inherits redirected stdout or stderr keeps that wait pending until it closes
+the stream, even after the direct child exits. Background children should close
+or replace inherited redirected streams.
+
+WASM uses the `v11-wasm` store namespace; native pnpm keeps `v11`. The package
+file and index formats match, but live stores are isolated because the locking
+protocols differ. An explicit store path ending in `v11` also receives the
+`v11-wasm` suffix. Do not symlink the two namespaces together.
+
+SQLite uses a rollback journal and host process leases, because the WASI VFS
+cannot provide native advisory locking or WAL. Its [probe](https://github.com/pnpm/pnpm/blob/main/pnpm/tasks/ecosystem-e2e/webcontainer/sqlite-probe/README.md)
+and actual Rust store tests cover persistence, contention and crash recovery.
+
+WebContainers cannot restore changed installation metadata through a pinned
+directory handle. A failed mutation reports that automatic metadata rollback is
+unavailable; it does not write through an unsafe replacement directory. Automatic
+provenance signing is also unavailable and returns an explicit error.
+
+Compiling or passing the runtime probe does not establish that all pnpm commands
+work in WebContainers. The task tracks CLI integration, command coverage,
+packaging and native performance validation separately.

package/dist/wasm/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,42 @@
+# Third-Party Notices
+
+This product includes software derived from third-party sources. The
+components below, and their license terms, are listed here in satisfaction
+of those terms.
+
+## Yarn (`@yarnpkg/nm`, `@yarnpkg/extensions`)
+
+- Source: <https://github.com/yarnpkg/berry>
+- License: BSD 2-Clause
+
+The `nodeLinker: hoisted` layout is produced by a Rust port of the hoisting
+algorithm in `@yarnpkg/nm`, and the built-in package-compatibility database
+is a copy of the one in `@yarnpkg/extensions`.
+
+```text
+BSD 2-Clause License
+
+Copyright (c) 2016-present, Yarn Contributors.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+```

package/dist/wasm/host/atomic-waits.mjs

@@ -0,0 +1,43 @@
+import { createCancellationCheck } from './cancellation.mjs'
+
+// Cancellation can race the transition from checking its flag to waiting on guest memory.
+const WAIT_SLICE_MS = 100
+
+export function createAtomicWaits (memory, control, checkCancelled = createCancellationCheck(control)) {
+  const state = new Int32Array(control)
+  if (state.length < 2) throw new RangeError('Atomic wait control requires two i32 slots')
+  return {
+    wait32: (pointer, expected, timeout, offset) => wait(memory, state, pointer, expected, timeout, offset, 4, checkCancelled),
+    wait64: (pointer, expected, timeout, offset) => wait(memory, state, pointer, expected, timeout, offset, 8, checkCancelled),
+  }
+}
+
+export function cancelAtomicWaits (memory, control) {
+  const state = new Int32Array(control)
+  Atomics.store(state, 0, 1)
+  const address = Atomics.load(state, 1) >>> 0
+  if (address < memory.buffer.byteLength) Atomics.notify(new Int32Array(memory.buffer), address >>> 2)
+}
+
+function wait (memory, state, pointer, expected, timeout, offset, width, checkCancelled) {
+  const address = (pointer >>> 0) + (offset >>> 0)
+  if (address % width !== 0 || address + width > memory.buffer.byteLength) {
+    throw new WebAssembly.RuntimeError('Unaligned or out-of-bounds atomic wait')
+  }
+  const view = width === 4 ? new Int32Array(memory.buffer) : new BigInt64Array(memory.buffer)
+  const deadline = timeout < 0n ? Infinity : performance.now() + Number(timeout) / 1000000
+  Atomics.store(state, 1, address)
+  try {
+    while (true) {
+      checkCancelled()
+      const remaining = Math.max(0, deadline - performance.now())
+      const result = Atomics.wait(view, address / width, expected, Math.min(remaining, WAIT_SLICE_MS))
+      checkCancelled()
+      if (result === 'ok') return 0
+      if (result === 'not-equal') return 1
+      if (performance.now() >= deadline) return 2
+    }
+  } finally {
+    Atomics.store(state, 1, -1)
+  }
+}

package/dist/wasm/host/cancellation.mjs

@@ -0,0 +1,6 @@
+export function createCancellationCheck (control) {
+  const state = control && new Int32Array(control)
+  return () => {
+    if (state && Atomics.load(state, 0)) throw new WebAssembly.RuntimeError('WASM worker cancelled')
+  }
+}

package/dist/wasm/host/executable-mode.mjs

@@ -0,0 +1,8 @@
+export function hasExecutableMode (metadata) {
+  const user = process.getuid()
+  let permission = 0o1
+  if (user === 0) permission = 0o111
+  else if (metadata.uid === user) permission = 0o100
+  else if (metadata.gid === process.getgid() || process.getgroups().includes(metadata.gid)) permission = 0o10
+  return (metadata.mode & permission) !== 0
+}

package/dist/wasm/host/file-locks.mjs

@@ -0,0 +1,40 @@
+import { fstatSync } from 'node:fs'
+
+import { acquireFileLease } from './lock-registry.mjs'
+
+const busy = 6
+
+export function createFileLocks () {
+  const held = new Map()
+  function release (descriptor) {
+    const state = held.get(descriptor)
+    if (!state) return
+    held.delete(descriptor)
+    state.closed = true
+    state.lease?.release()
+  }
+  return {
+    tryLock (descriptor, exclusive) {
+      let state = held.get(descriptor)
+      if (!state) {
+        const metadata = fstatSync(descriptor, { bigint: true })
+        state = { identity: `${metadata.dev}:${metadata.ino}`, closed: false }
+        held.set(descriptor, state)
+      }
+      if (state.error) return 29
+      if (state.lease?.exclusive === exclusive) return 0
+      if (!state.pending) {
+        state.pending = true
+        acquireFileLease(state.identity, exclusive, state.lease).then(lease => {
+          if (state.closed) lease?.release()
+          else if (lease) state.lease = lease
+        }, error => { state.error = error }).finally(() => { state.pending = false })
+      }
+      return busy
+    },
+    release,
+    close () {
+      for (const descriptor of held.keys()) release(descriptor)
+    },
+  }
+}