pnpm 12.8.2 → 12.9.1

package/CHANGELOG.md

@@ -1,5 +1,168 @@
 # pnpm
 
+## 12.9.1
+
+This release moves the WebContainer build into a separate `@pnpm/wasm` package, shrinks the `pnpm` package back to about 4 MB, and fixes `pnpm publish` with provenance from GitLab CI.
+
+### Patch Changes
+
+- The WebAssembly build for StackBlitz WebContainers now ships as a separate `@pnpm/wasm` package. The `pnpm` and `@pnpm/exe` packages no longer include it, which brings their unpacked size back from about 55 MB to about 4 MB. In a WebContainer, install `@pnpm/wasm` with npm to get the `pnpm` command.
+
+- `pnpm publish` with provenance from GitLab CI is no longer rejected by the npm registry with a 422 error. The provenance statement now includes the GitLab CI variables in `invocation.parameters`, as npm does [#16551](https://github.com/pnpm/pnpm/issues/16551).
+
+- `pnpm audit signatures` now uses the TLS settings of the redirect target when a registry redirects its signing-keys request, for example to registry.npmjs.org. A `cafile` scoped to a private registry no longer makes the redirected request fail [#16541](https://github.com/pnpm/pnpm/issues/16541).
+
+- Fixed `pnpm install --frozen-lockfile` rejecting an up-to-date lockfile when an injected workspace package uses a catalog entry in `peerDependencies` [#16557](https://github.com/pnpm/pnpm/issues/16557).
+
+- The `[<since>]` filter selector works again with Git 2.24 through 2.27 [#16561](https://github.com/pnpm/pnpm/issues/16561). With Git older than 2.24, the selector now fails with an error that names the required Git version.
+
+  It also detects changes in projects whose directory names contain non-ASCII characters. Such a change used to be credited to the parent project. `changedFilesIgnorePattern` and `testPattern` now match changed files whose names contain non-ASCII characters.
+
+- The `pnpm` executable is about 10% smaller. On macOS arm64 it went from 45.1 MB to 40.3 MB.
+
+- Sped up trust downgrade checks for packages with long release histories.
+
+- With `optimisticRepeatInstall: false`, `pnpm install` now runs the projects' own lifecycle scripts, such as `prepare`, even when `node_modules` is already up to date [#16545](https://github.com/pnpm/pnpm/issues/16545).
+
+- `pnpm self-update` now fails for Homebrew-installed pnpm and prints the `brew upgrade` command for the installed formula, such as `brew upgrade pnpm` or `brew upgrade pnpm@11`. It used to install a second copy of pnpm that the Homebrew one kept shadowing [#16547](https://github.com/pnpm/pnpm/issues/16547).
+
+## 12.9.0
+
+This release runs pnpm in StackBlitz WebContainers, adds a per-registry `networkConcurrency` setting, and records every installed project in the store. It also carries a security fix for `pnpm login`.
+
+### Minor Changes
+
+- pnpm now automatically uses WebAssembly in StackBlitz WebContainers, including when installation scripts are disabled. Native installations continue to use the native executable when installation scripts are enabled.
+
+- A `registries` entry can now set `networkConcurrency`, the most requests pnpm keeps in flight to that registry's origin. Requests to other registries keep the overall limit. The setting may live in `pnpm-workspace.yaml` or the global `config.yaml`.
+
+  ```yaml
+  registries:
+    https://npm.corp.example.com/:
+      scopes: ["@acme"]
+      networkConcurrency: 4
+  ```
+
+- `pnpm install` now records every project it installs in the store's `projects` directory, as a symlink to the project directory. A `--frozen-store` install without the global virtual store still records nothing. Only projects that used the global virtual store were recorded before [#6929](https://github.com/pnpm/pnpm/issues/6929).
+
+### Patch Changes
+
+- `pnpm login` no longer forwards credentials in its request body to another origin during redirects.
+
+#### Installing packages
+
+- Fixed `pnpm install` failing on Android with `ERR_PNPM_STORE_DIR_ACQUIRE_OPERATION_LOCK` [#16508](https://github.com/pnpm/pnpm/issues/16508).
+
+- `pnpm install --frozen-lockfile` again succeeds when a workspace project recorded in `pnpm-lock.yaml` has no directory, such as a project left out of a Docker build context. It still fails if the project's directory exists without a `package.json` [#16453](https://github.com/pnpm/pnpm/issues/16453).
+
+- `pnpm install --frozen-lockfile` no longer requires a `pnpm-lock.yaml` in a project that has no dependencies. It also succeeds when `pnpm-lock.yaml` records only the pinned pnpm version, as other commands write it when they run before the first install [#16477](https://github.com/pnpm/pnpm/issues/16477).
+
+- Fixed `pnpm install --frozen-lockfile` rejecting a fresh lockfile when an injected workspace dependency has an optional peer supplied by another workspace project [#16428](https://github.com/pnpm/pnpm/issues/16428).
+
+- With `nodeLinker: hoisted`, a filtered install now keeps the packages of the workspace projects an earlier install put in `node_modules`. This also covers the install that `pnpm --filter <selector> run` and `pnpm --filter <selector> exec` start before the command. Before, these installs removed every package that only the unselected projects needed [#16483](https://github.com/pnpm/pnpm/issues/16483).
+
+- `pnpm install` with `nodeLinker: hoisted` now refreshes directories supplied by custom fetchers when reinstalling. pnpm also keeps the symlinks inside those directories.
+
+- With `enableGlobalVirtualStore` on, scripts can run entry points that a CommonJS require hook loads again, such as `ts-node index.ts`. They failed with `ERR_UNKNOWN_FILE_EXTENSION` on Node.js versions without built-in TypeScript support [#16436](https://github.com/pnpm/pnpm/issues/16436).
+
+- pnpm now keeps each project's current lockfile and hidden hoisted dependencies in its own `node_modules/.pnpm` when `virtualStoreDir` points at a shared global virtual store. `--virtual-store-dir` now sets the global virtual store's location too [pnpm/tasks#47](https://github.com/pnpm/tasks/issues/47).
+
+- `pnpm clean` no longer deletes the project when `virtualStoreDir` or `globalVirtualStoreDir` is set to the project directory. It also leaves a directory outside the project alone when the setting reaches it through a symlink. It now removes a global virtual store that `globalVirtualStoreDir` places inside the project, as it does for `virtualStoreDir`.
+
+#### Optional dependencies
+
+- `pnpm install` no longer fails when a dependency of an optional dependency is missing from the registry. Like npm, pnpm now leaves out the nearest optional dependency above it, together with its subtree [#16511](https://github.com/pnpm/pnpm/issues/16511).
+
+- When an optional dependency fails to build, pnpm now removes its link from `node_modules`. A repeat `pnpm install` then reports "Already up to date" and no longer reruns the failing build [#16468](https://github.com/pnpm/pnpm/issues/16468).
+
+- `pnpm install` now prints a warning with the error when an optional dependency cannot be fetched and is skipped. The skipped package is no longer counted in the `Packages: +N` summary. The `pnpm:skipped-optional-dependency` log reports the skip with the `fetch_failure` reason [#16514](https://github.com/pnpm/pnpm/issues/16514).
+
+#### Resolving dependencies
+
+- Fixed `pnpm install` changing an unchanged project's direct dependency to a sibling workspace's pinned version when its dependency tree contains a cycle [#16417](https://github.com/pnpm/pnpm/issues/16417).
+
+- With `autoDedupe` enabled, downgrading a dependency in one workspace project now moves the other projects to that version when it satisfies their ranges. This also applies to a filtered `pnpm --filter <project> add` [#16432](https://github.com/pnpm/pnpm/issues/16432).
+
+- `pnpm install` and `pnpm dedupe` now move an optional peer to the version already in the dependency graph when no other package provides its locked version anymore. After a bump such as `vue` 3.5.40 to 3.5.43, the lockfile kept a second copy of `@vue/server-renderer` for `@vue/test-utils` [#16443](https://github.com/pnpm/pnpm/issues/16443).
+
+- `pnpm dedupe --check` no longer fails right after `pnpm install` when a project's optional peer is satisfied by a package another workspace project installs. `pnpm dedupe` now picks the same versions for that package's dependencies as `pnpm install` [#16447](https://github.com/pnpm/pnpm/issues/16447).
+
+- `pnpm install` no longer re-resolves an up-to-date lockfile on every run when a patched package is a peer in a peer cycle [#16418](https://github.com/pnpm/pnpm/issues/16418).
+
+- With `autoDedupe` enabled, `pnpm install --lockfile-only` no longer resolves the dependency graph again when nothing changed since an earlier `--lockfile-only` install deduplicated the lockfile. Such an install keeps the lockfile even if versions were published since it was written, or if only a setting such as `resolutionMode` changed. Run `pnpm dedupe` to apply such a change [#16458](https://github.com/pnpm/pnpm/issues/16458).
+
+#### Speed and network
+
+- A repeat `pnpm install` in a large workspace reports "Already up to date" faster [#16487](https://github.com/pnpm/pnpm/issues/16487).
+
+- Sped up dependency resolution of workspaces with many peer dependencies.
+
+- `pnpm install` sends fewer registry metadata requests when the lockfile already decides which version a range resolves to. This now also covers ranges that several locked versions satisfy when one of them outranks the others, and direct dependencies kept at their locked version. Packages that `minimumReleaseAgeExclude` lists without a version now reuse cached registry metadata the same way they do when `minimumReleaseAge` is not set [#16458](https://github.com/pnpm/pnpm/issues/16458).
+
+- pnpm no longer downloads every packument again on each install from a registry whose metadata responses forbid caching, such as `Cache-Control: no-store`. pnpm revalidates the cached metadata with a conditional request, so a registry that supports conditional requests answers with a 304 when the package has not changed [#16528](https://github.com/pnpm/pnpm/issues/16528).
+
+- Cached metadata for a package published within `minimumReleaseAge` is now revalidated with its ETag, so the npm registry can answer `304 Not Modified`. Before, the next install that checked the cache downloaded the whole document again [#16506](https://github.com/pnpm/pnpm/issues/16506).
+
+- A fetch timeout while other downloads from the same host are still running now lowers concurrency for that host to one connection. Retries of that request, and later downloads from that host, use the lower concurrency. Other hosts keep the configured concurrency [#12791](https://github.com/pnpm/pnpm/issues/12791).
+
+- Sped up `pnpm install --offline` when the version a range picks is not in the store. While it looks for a version the store holds, pnpm now reads only the versions the range admits [#16495](https://github.com/pnpm/pnpm/issues/16495).
+
+- `pnpm install --offline` now reuses config dependency tarballs that are already present in the store [pnpm/tasks#46](https://github.com/pnpm/tasks/issues/46).
+
+#### Running scripts
+
+- `pnpm -s <script>` runs the script again, with `-s` meaning `--sequential` as it does for `pnpm run -s <script>`. pnpm rejected it with "unexpected argument '-s' found" [#16446](https://github.com/pnpm/pnpm/issues/16446).
+
+- `pnpm run` and `pnpm exec` now warn and run the command when the install that `verifyDepsBeforeRun` starts fails. This lets scripts run in sandboxes where pnpm cannot install, such as containers with a read-only store or no network [#15173](https://github.com/pnpm/pnpm/issues/15173).
+
+- A filtered `pnpm run` or `pnpm exec` now finds dependencies out of date when a workspace dependency of a selected project has no `node_modules` directory, as after a filtered install. With `verifyDepsBeforeRun: install`, pnpm installs that dependency before running the command [pnpm/tasks#45](https://github.com/pnpm/tasks/issues/45).
+
+- Scripts run without a terminal no longer start a second `sh` each. One watchdog per pnpm command now ends every script's process group if pnpm is killed, so `pnpm -r run` across many projects starts half as many processes [#16489](https://github.com/pnpm/pnpm/issues/16489).
+
+- `Terminate batch job (Y/N)?` no longer appears after pressing Ctrl+C in a script started with `pnpm` from PowerShell or cmd on Windows [#16502](https://github.com/pnpm/pnpm/issues/16502).
+
+- `pnpm rebuild` and `pnpm approve-builds` refresh command launchers when a build changes a command's interpreter or replaces it with a native executable. Dependent packages' build scripts use the refreshed launchers.
+
+- When `pnpm run <script>` or `pnpm <script>` finds nothing to run and `--filter` follows the script name, the error now suggests putting the filter option before the script name [#4655](https://github.com/pnpm/pnpm/issues/4655).
+
+- Package-name filters now support `?` to match one character [#2817](https://github.com/pnpm/pnpm/issues/2817).
+
+#### The pinned pnpm and `pnpm self-update`
+
+- pnpm no longer downloads the project's pinned pnpm version again on every command when `nodeVersion` in `pnpm-workspace.yaml` names a different Node.js major than the `node` on `PATH`. Before, each of those commands took about a second longer and failed without network access [#16497](https://github.com/pnpm/pnpm/issues/16497).
+
+- Several `pnpm` commands started at once in a project that pins `packageManager` no longer fail with `The process cannot access the file because it is being used by another process` on Windows while the pinned pnpm is being installed.
+
+- pnpm can now switch to a `packageManager` version below 11 on x64 musl Linux, such as Alpine [#16467](https://github.com/pnpm/pnpm/issues/16467).
+
+- A `devEngines.packageManager` range no longer makes pnpm replace the version recorded in `pnpm-lock.yaml` with the running pnpm while the recorded version still satisfies the range. When pnpm does record a version, it records the running pnpm only if it meets `minimumReleaseAge`. Otherwise it records the newest version in the range that meets it, or the running pnpm if none does [#16431](https://github.com/pnpm/pnpm/issues/16431).
+
+- On Windows, `pnpm self-update` now replaces a `pnpm.exe` left in `PNPM_HOME` or in `PNPM_HOME\bin`. Windows ran that executable in place of the updated `pnpm.cmd` shim, so `pnpm --version` kept printing the old version after a successful update. If the executable was in `PNPM_HOME`, `self-update` now asks you to run `pnpm setup` [#9094](https://github.com/pnpm/pnpm/issues/9094).
+
+- `pnpm self-update` now checks that a version installed as the JavaScript `pnpm` can start before making it the global `pnpm`. If Node.js is missing, the update fails and the current `pnpm` stays in place.
+
+#### Other commands
+
+- `pnpm deploy` now finds patches and local dependencies when the target directory sits under a symlink, such as `/tmp` on macOS. It failed with `ERR_PNPM_PATCH_NOT_FOUND` [#16470](https://github.com/pnpm/pnpm/issues/16470).
+
+- `pnpm deploy --legacy` now resolves the deployed project's relative `file:`, `link:`, and path dependencies from the project's own directory [#16475](https://github.com/pnpm/pnpm/issues/16475).
+
+- `pnpm update --global` now removes hard-linked executables from `PNPM_HOME` when migrating packages from the old global layout [#16420](https://github.com/pnpm/pnpm/issues/16420).
+
+- `pnpm store prune` no longer fails on store index entries that pnpm 11 wrote for git-hosted packages without a `package.json`. Entries that still cannot be read are kept and counted in the prune summary.
+
+- `pnpm store prune` now aborts when an error other than a missing directory occurs while scanning project directories in the mark phase.
+
+- `pnpm config get` and `pnpm config list` now report a setting given on the command line with `--config.<name>=<value>`. Before, a value such as `--config.node-linker=hoisted` reached the install but was absent from the reported configuration [#16276](https://github.com/pnpm/pnpm/issues/16276).
+
+- `pnpm -r pkg get` now reports every selected project when several share a package name. Projects with the same name are keyed by their directory relative to the workspace root. Before, only one of them appeared in the output.
+
+- The install summary shows a `link:` dependency as `+ name <- path`, and the Node.js API's `hideLinkedPkgsDiff` reporter option leaves matching linked dependencies out of the summary.
+
+- The `--force` help text of `pnpm install` and `pnpm add` now says that `--force` keeps skipping optional dependencies built for other platforms. It points to `forceIgnoresPlatform` and the `--os`, `--cpu`, and `--libc` options for installing them [#16435](https://github.com/pnpm/pnpm/issues/16435).
+
+- The `homepage` field of the published `pnpm` package points to https://pnpm.io again.
+
 ## 12.8.2
 
 pnpm 12.8.2 fixes a startup crash on Linux ppc64le and `UnknownIssuer` errors on systems without CA certificates. `pnpm run` no longer installs before every script on CI when `autoDedupe` is enabled, and resolution and hoisted installs on macOS are faster.

package/bin/pnpm.mjs

@@ -38,6 +38,9 @@ const DOWNLOADED_BINARY = path.join(
 const GET_PNPM = new URL('../dist/node_modules/get-pnpm/lib/index.js', import.meta.url)
 const DEFAULT_REGISTRY = 'https://registry.npmjs.org'
 
+if ('webcontainer' in process.versions) {
+  fail('The pnpm package runs a native binary, which WebContainers cannot execute. Install @pnpm/wasm instead.')
+}
 run(await nativeBinary())
 
 function run (binary) {

package/bin/pnpx.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // Corepack's `pnpx` entry point; see ./pnpm.mjs. The native binary infers the
 // `dlx` subcommand from the name it was launched under, which does not survive
-// being spawned from here, so inject it the way the `pnpx` shell script does.
+// being spawned from here, so the Node entry point injects it.
 import process from 'node:process'
 
 process.argv = [...process.argv.slice(0, 2), 'dlx', ...process.argv.slice(2)]

package/dist/node_modules/.bin/get-pnpm

@@ -8,9 +8,8 @@
 # the shim before it reaches its target. Directories come from `${link%/*}`,
 # which needs no helper at all.
 #
-# Where no default path is compiled in, as on Nix, `command -p` searches PATH
-# instead, so the helpers run with node_modules and relative entries dropped from
-# PATH.
+# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
+# instead, with node_modules and relative entries dropped from it.
 caller_path_set=${PATH+set}
 caller_path=${PATH-}
 helper_path=
@@ -25,6 +24,11 @@ while [ -n "$rest" ]; do
 done
 # An empty PATH searches the current directory.
 PATH=${helper_path:-/}
+# A helper comes from PATH only when the default path lacks it and PATH has it.
+# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
+run_helper() {
+  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
+}
 link="$0"
 # `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
 # and stands for a file in the current directory.
@@ -35,13 +39,13 @@ esac
 hops=0
 while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
   hops=$((hops+1))
-  target=$(command -p readlink "$link")
+  target=$(run_helper readlink "$link")
   case "$target" in
     /*) link="$target" ;;
     *)  link="${link%/*}/$target" ;;
   esac
 done
-basedir=$(command -p printf '%s\n' "$link" | command -p sed -e 's,\\,/,g')
+basedir=$(run_helper printf '%s\n' "$link" | run_helper sed -e 's,\\,/,g')
 basedir="${basedir%/*}"
 basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
 basedir="$basedir_abs"
@@ -49,7 +53,7 @@ basedir_win="$basedir"
 exe=""
 msys=""
 
-case `command -p uname -a` in
+case `run_helper uname -a` in
   *CYGWIN*|*MINGW*|*MSYS*)
     if converted=$(command -p cygpath -w "$basedir" 2>/dev/null) && [ -n "$converted" ]; then
       basedir_win="$converted"

package/dist/node_modules/.bin/node-gyp

@@ -8,9 +8,8 @@
 # the shim before it reaches its target. Directories come from `${link%/*}`,
 # which needs no helper at all.
 #
-# Where no default path is compiled in, as on Nix, `command -p` searches PATH
-# instead, so the helpers run with node_modules and relative entries dropped from
-# PATH.
+# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
+# instead, with node_modules and relative entries dropped from it.
 caller_path_set=${PATH+set}
 caller_path=${PATH-}
 helper_path=
@@ -25,6 +24,11 @@ while [ -n "$rest" ]; do
 done
 # An empty PATH searches the current directory.
 PATH=${helper_path:-/}
+# A helper comes from PATH only when the default path lacks it and PATH has it.
+# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
+run_helper() {
+  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
+}
 link="$0"
 # `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
 # and stands for a file in the current directory.
@@ -35,13 +39,13 @@ esac
 hops=0
 while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
   hops=$((hops+1))
-  target=$(command -p readlink "$link")
+  target=$(run_helper readlink "$link")
   case "$target" in
     /*) link="$target" ;;
     *)  link="${link%/*}/$target" ;;
   esac
 done
-basedir=$(command -p printf '%s\n' "$link" | command -p sed -e 's,\\,/,g')
+basedir=$(run_helper printf '%s\n' "$link" | run_helper sed -e 's,\\,/,g')
 basedir="${basedir%/*}"
 basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
 basedir="$basedir_abs"
@@ -49,7 +53,7 @@ basedir_win="$basedir"
 exe=""
 msys=""
 
-case `command -p uname -a` in
+case `run_helper uname -a` in
   *CYGWIN*|*MINGW*|*MSYS*)
     if converted=$(command -p cygpath -w "$basedir" 2>/dev/null) && [ -n "$converted" ]; then
       basedir_win="$converted"

package/dist/node_modules/.bin/node-which

@@ -8,9 +8,8 @@
 # the shim before it reaches its target. Directories come from `${link%/*}`,
 # which needs no helper at all.
 #
-# Where no default path is compiled in, as on Nix, `command -p` searches PATH
-# instead, so the helpers run with node_modules and relative entries dropped from
-# PATH.
+# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
+# instead, with node_modules and relative entries dropped from it.
 caller_path_set=${PATH+set}
 caller_path=${PATH-}
 helper_path=
@@ -25,6 +24,11 @@ while [ -n "$rest" ]; do
 done
 # An empty PATH searches the current directory.
 PATH=${helper_path:-/}
+# A helper comes from PATH only when the default path lacks it and PATH has it.
+# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
+run_helper() {
+  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
+}
 link="$0"
 # `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
 # and stands for a file in the current directory.
@@ -35,13 +39,13 @@ esac
 hops=0
 while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
   hops=$((hops+1))
-  target=$(command -p readlink "$link")
+  target=$(run_helper readlink "$link")
   case "$target" in
     /*) link="$target" ;;
     *)  link="${link%/*}/$target" ;;
   esac
 done
-basedir=$(command -p printf '%s\n' "$link" | command -p sed -e 's,\\,/,g')
+basedir=$(run_helper printf '%s\n' "$link" | run_helper sed -e 's,\\,/,g')
 basedir="${basedir%/*}"
 basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
 basedir="$basedir_abs"
@@ -49,7 +53,7 @@ basedir_win="$basedir"
 exe=""
 msys=""
 
-case `command -p uname -a` in
+case `run_helper uname -a` in
   *CYGWIN*|*MINGW*|*MSYS*)
     if converted=$(command -p cygpath -w "$basedir" 2>/dev/null) && [ -n "$converted" ]; then
       basedir_win="$converted"

package/dist/node_modules/.bin/nopt

@@ -8,9 +8,8 @@
 # the shim before it reaches its target. Directories come from `${link%/*}`,
 # which needs no helper at all.
 #
-# Where no default path is compiled in, as on Nix, `command -p` searches PATH
-# instead, so the helpers run with node_modules and relative entries dropped from
-# PATH.
+# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
+# instead, with node_modules and relative entries dropped from it.
 caller_path_set=${PATH+set}
 caller_path=${PATH-}
 helper_path=
@@ -25,6 +24,11 @@ while [ -n "$rest" ]; do
 done
 # An empty PATH searches the current directory.
 PATH=${helper_path:-/}
+# A helper comes from PATH only when the default path lacks it and PATH has it.
+# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
+run_helper() {
+  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
+}
 link="$0"
 # `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
 # and stands for a file in the current directory.
@@ -35,13 +39,13 @@ esac
 hops=0
 while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
   hops=$((hops+1))
-  target=$(command -p readlink "$link")
+  target=$(run_helper readlink "$link")
   case "$target" in
     /*) link="$target" ;;
     *)  link="${link%/*}/$target" ;;
   esac
 done
-basedir=$(command -p printf '%s\n' "$link" | command -p sed -e 's,\\,/,g')
+basedir=$(run_helper printf '%s\n' "$link" | run_helper sed -e 's,\\,/,g')
 basedir="${basedir%/*}"
 basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
 basedir="$basedir_abs"
@@ -49,7 +53,7 @@ basedir_win="$basedir"
 exe=""
 msys=""
 
-case `command -p uname -a` in
+case `run_helper uname -a` in
   *CYGWIN*|*MINGW*|*MSYS*)
     if converted=$(command -p cygpath -w "$basedir" 2>/dev/null) && [ -n "$converted" ]; then
       basedir_win="$converted"

package/dist/node_modules/.bin/semver

@@ -8,9 +8,8 @@
 # the shim before it reaches its target. Directories come from `${link%/*}`,
 # which needs no helper at all.
 #
-# Where no default path is compiled in, as on Nix, `command -p` searches PATH
-# instead, so the helpers run with node_modules and relative entries dropped from
-# PATH.
+# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
+# instead, with node_modules and relative entries dropped from it.
 caller_path_set=${PATH+set}
 caller_path=${PATH-}
 helper_path=
@@ -25,6 +24,11 @@ while [ -n "$rest" ]; do
 done
 # An empty PATH searches the current directory.
 PATH=${helper_path:-/}
+# A helper comes from PATH only when the default path lacks it and PATH has it.
+# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
+run_helper() {
+  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
+}
 link="$0"
 # `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
 # and stands for a file in the current directory.
@@ -35,13 +39,13 @@ esac
 hops=0
 while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
   hops=$((hops+1))
-  target=$(command -p readlink "$link")
+  target=$(run_helper readlink "$link")
   case "$target" in
     /*) link="$target" ;;
     *)  link="${link%/*}/$target" ;;
   esac
 done
-basedir=$(command -p printf '%s\n' "$link" | command -p sed -e 's,\\,/,g')
+basedir=$(run_helper printf '%s\n' "$link" | run_helper sed -e 's,\\,/,g')
 basedir="${basedir%/*}"
 basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
 basedir="$basedir_abs"
@@ -49,7 +53,7 @@ basedir_win="$basedir"
 exe=""
 msys=""
 
-case `command -p uname -a` in
+case `run_helper uname -a` in
   *CYGWIN*|*MINGW*|*MSYS*)
     if converted=$(command -p cygpath -w "$basedir" 2>/dev/null) && [ -n "$converted" ]; then
       basedir_win="$converted"

package/dist/node_modules/.pnpm-workspace-state-v1.json

@@ -1,9 +1,9 @@
 {
-  "lastValidatedTimestamp": 1790728888790,
+  "lastValidatedTimestamp": 1791058509474,
   "projects": {
     "/home/runner/_work/pnpm/pnpm/pnpm/npm/pnpm/temp-deploy": {
       "name": "pacquet",
-      "version": "12.8.2",
+      "version": "12.9.1",
       "hasModulesDir": true
     }
   },
@@ -28,6 +28,7 @@
         "@commitlint/config-conventional": "^21.2.3",
         "@commitlint/prompt-cli": "^21.2.3",
         "@cyclonedx/cyclonedx-library": "10.3.0",
+        "@emnapi/wasi-threads": "1.2.1",
         "@eslint/js": "^10.0.1",
         "@inquirer/prompts": "^8.7.2",
         "@jest/globals": "30.4.1",
@@ -47,6 +48,7 @@
         "@reflink/reflink": "0.1.19",
         "@rushstack/worker-pool": "0.7.28",
         "@stylistic/eslint-plugin": "^5.10.0",
+        "@tybys/wasm-util": "0.10.4",
         "@types/adm-zip": "^0.5.8",
         "@types/archy": "0.0.36",
         "@types/cross-spawn": "^6.0.6",
@@ -94,6 +96,7 @@
         "@yarnpkg/fslib": "^3.1.5",
         "@yarnpkg/lockfile": "^1.1.0",
         "@yarnpkg/nm": "4.1.1",
+        "@yarnpkg/parsers": "3.1.0",
         "@yarnpkg/pnp": "^4.1.7",
         "@yarnpkg/shell": "4.1.3",
         "@zkochan/retry": "^0.2.0",
@@ -331,6 +334,7 @@
     "nodeLinker": "hoisted",
     "optional": true,
     "patchedDependencies": {
+      "@tybys/wasm-util@0.10.4": "../../../../__patches__/@tybys__wasm-util@0.10.4.patch",
       "graceful-fs@4.2.11": "../../../../__patches__/graceful-fs@4.2.11.patch",
       "normalize-registry-url@2.0.1": "../../../../__patches__/normalize-registry-url@2.0.1.patch"
     },

package/install.js

@@ -1,24 +1,7 @@
 #!/usr/bin/env node
-// Preinstall for the pnpm v12 wrapper (shared verbatim by `pnpm` and
-// `@pnpm/exe`): replace the shebang-less placeholder bins with the host's native
-// binary so `pnpm` runs directly, no Node startup per call. The placeholder must
-// stay shebang-less because pnpm 11 records its interpreter before installing
-// the native binary at the same path. npm's global Windows shims still target
-// the extensionless path after the `bin` rewrite, so postinstall asks npm to
-// regenerate them against `pnpm.exe`. A global install uses `npm rebuild
-// --global`. A project install passes the project prefix, because the
-// script's working directory is the installed package. Any other install,
-// such as `npm exec`, keeps its shims. When lifecycle scripts are blocked
-// (`--ignore-scripts`, pnpm/Bun default), the placeholder remains and runs pnpm
-// through Node.js wherever a shell reaches it (see the `pnpm` file).
-//
-// `pn`/`pnpx`/`pnx` are committed `#!/bin/sh` scripts on Unix (so only `pnpm` is
-// relinked); on Windows the native binary is hardlinked onto each and
-// self-detects its launch name to inject `dlx` (see `argv_with_alias_subcommand`
-// in the cli crate).
-//
-// Corepack runs no lifecycle scripts, so it never gets here; it enters through
-// `bin/pnpm.mjs` instead.
+// Native installs replace the Node entry points with the host binary. npm's
+// Windows shims must then be regenerated against pnpm.exe; Corepack and
+// installations that block lifecycle scripts keep the Node entry points.
 import console from 'node:console'
 import { spawnSync } from 'node:child_process'
 import fs from 'node:fs'
@@ -49,6 +32,11 @@ function setup () {
     return
   }
 
+  // The Node launchers stay in place there and point to `@pnpm/wasm`.
+  if ('webcontainer' in process.versions) {
+    return
+  }
+
   const candidates = getBinCandidates()
   if (candidates.length === 0) {
     fail(`pnpm does not ship a prebuilt binary for ${hostTarget()}.`)
@@ -75,7 +63,9 @@ function setup () {
     }
     rewriteBin(newBin)
   } else {
-    placeBinary(nativeBinary, path.join(wrapperDir, 'pnpm'), 0o755)
+    for (const name of BIN_NAMES) {
+      placeBinary(nativeBinary, path.join(wrapperDir, name), 0o755)
+    }
   }
 }
 

package/package.json

@@ -9,7 +9,7 @@
       "./dist/node_modules/node-gyp/gyp/gyp"
     ]
   },
-  "version": "12.8.2",
+  "version": "12.9.1",
   "description": "Fast, disk space efficient package manager",
   "keywords": [
     "pnpm",
@@ -46,20 +46,20 @@
     "THIRD-PARTY-NOTICES.md"
   ],
   "optionalDependencies": {
-    "@pnpm/exe.win32-x64": "12.8.2",
-    "@pnpm/exe.win32-arm64": "12.8.2",
-    "@pnpm/exe.darwin-x64": "12.8.2",
-    "@pnpm/exe.darwin-arm64": "12.8.2",
-    "@pnpm/exe.linux-x64": "12.8.2",
-    "@pnpm/exe.linux-arm64": "12.8.2",
-    "@pnpm/exe.linux-riscv64": "12.8.2",
-    "@pnpm/exe.linux-ppc64": "12.8.2",
-    "@pnpm/exe.linux-s390x": "12.8.2",
-    "@pnpm/exe.linux-x64-musl": "12.8.2",
-    "@pnpm/exe.linux-arm64-musl": "12.8.2",
-    "@pnpm/exe.freebsd-x64": "12.8.2",
-    "@pnpm/exe.android-arm64": "12.8.2",
-    "@pnpm/exe.android-x64": "12.8.2"
+    "@pnpm/exe.win32-x64": "12.9.1",
+    "@pnpm/exe.win32-arm64": "12.9.1",
+    "@pnpm/exe.darwin-x64": "12.9.1",
+    "@pnpm/exe.darwin-arm64": "12.9.1",
+    "@pnpm/exe.linux-x64": "12.9.1",
+    "@pnpm/exe.linux-arm64": "12.9.1",
+    "@pnpm/exe.linux-riscv64": "12.9.1",
+    "@pnpm/exe.linux-ppc64": "12.9.1",
+    "@pnpm/exe.linux-s390x": "12.9.1",
+    "@pnpm/exe.linux-x64-musl": "12.9.1",
+    "@pnpm/exe.linux-arm64-musl": "12.9.1",
+    "@pnpm/exe.freebsd-x64": "12.9.1",
+    "@pnpm/exe.android-arm64": "12.9.1",
+    "@pnpm/exe.android-x64": "12.9.1"
   },
   "scripts": {
     "preinstall": "node install.js",

package/pn

@@ -1,74 +1,2 @@
-#!/bin/sh
-# `pn` is `pnpm`. The pnpm it hands over to is the one installed alongside it,
-# found relative to this file: a `PATH` lookup would run whatever other pnpm
-# comes first there, and would find nothing at all when the directory holding
-# these bins is not on `PATH`.
-#
-# $0 is whatever shim or symlink `pn` was launched through, so walk to the file
-# itself first. The hop cap matches the kernel's ELOOP limit, so a cycle cannot
-# hang the script. Directories come from `${self%/*}` and `readlink` runs through
-# `command -p`, so the caller's `PATH` decides nothing here.
-#
-# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
-# instead, with node_modules and relative entries dropped from it.
-caller_path_set=${PATH+set}
-caller_path=${PATH-}
-helper_path=
-rest=$caller_path:
-while [ -n "$rest" ]; do
-  dir=${rest%%:*}
-  rest=${rest#*:}
-  case "$dir" in
-    */node_modules/*|*/node_modules) ;;
-    /*) helper_path=${helper_path:+$helper_path:}$dir ;;
-  esac
-done
-# An empty PATH searches the current directory.
-PATH=${helper_path:-/}
-# A helper comes from PATH only when the default path lacks it and PATH has it.
-# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
-run_helper() {
-  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
-}
-self=$0
-# MSYS and Cygwin can launch this with a native Windows path, which has no slash
-# for `${self%/*}` to strip. Only a drive letter or a UNC prefix marks one; a
-# backslash anywhere else is an ordinary character in a Unix file name, so the
-# path is left alone. The separators are swapped in the shell rather than through
-# `echo`, which mangles a `\t` or `\b` in a path under dash.
-case $self in
-  [A-Za-z]:\\*|\\\\*)
-    while :; do
-      case $self in
-        *\\*) self=${self%%\\*}/${self#*\\} ;;
-        *) break ;;
-      esac
-    done
-    ;;
-esac
-# `${self%/*}` needs a slash to strip. A bare name came from a `PATH` lookup and
-# stands for a file in the current directory.
-case $self in
-  */*) ;;
-  *) self=./$self ;;
-esac
-hops=0
-while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
-  hops=$((hops + 1))
-  link=$(run_helper readlink "$self")
-  case $link in
-    /*) self=$link ;;
-    *) self=${self%/*}/$link ;;
-  esac
-done
-if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
-# The walk has to end at a regular file. Running out of hops leaves $self a
-# symlink; a chain that changed under us can leave it dangling or a directory, and
-# a failed readlink leaves a trailing slash. Each case would take `pnpm` from the
-# wrong directory — the substitution this script exists to prevent.
-if [ -L "$self" ] || [ ! -f "$self" ]; then
-  echo "pn: could not resolve $0 to a regular file within 40 symlink hops." >&2
-  exit 1
-fi
-
-exec "${self%/*}/pnpm" "$@"
+#!/usr/bin/env node
+import './bin/pnpm.mjs'

package/pnpm

@@ -1,94 +1,2 @@
-# pnpm's native binary replaces this file during installation (see
-# ./install.js). Until then this hands over to ./bin/pnpm.mjs, which finds the
-# installed binary or downloads one and spawns it.
-#
-# Shebang-less on purpose, and therefore an `sh` script: a bin shim generated
-# from a shebang records that interpreter, and pnpm 11 generates the shim before
-# it puts the native binary at this path.
-#
-# Something has to retry this file under a shell, because the kernel answers
-# ENOEXEC for it. A bin shim and a shell both do, and so does glibc's `execvp`.
-# Apple's libc does not, so on macOS a program that spawns this path itself gets
-# ENOEXEC; Windows has neither and cannot reach it at all.
-if ! command -v node > /dev/null 2>&1; then
-  echo "pnpm's native binary was not installed, and there is no Node.js to run pnpm without it." >&2
-  echo "Reinstall pnpm with build scripts enabled (allow-list pnpm's build under pnpm or Bun, or drop --ignore-scripts)." >&2
-  exit 1
-fi
-
-if [ -t 2 ]; then
-  echo "pnpm is running through Node.js because the script that installs its native binary was skipped." >&2
-  echo "Reinstall pnpm with its build scripts allowed to run the binary directly." >&2
-fi
-
-# $0 is whatever shim or symlink pnpm was launched through; ./bin/pnpm.mjs is
-# found relative to this file. The hop cap matches the kernel's ELOOP limit, so
-# a cycle cannot hang the script.
-#
-# `readlink` runs through `command -p`, which searches the system default path,
-# and directories come from `${self%/*}`, which runs nothing at all. The caller's
-# PATH therefore decides only which `node` runs, which is what it is for.
-#
-# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
-# instead, with node_modules and relative entries dropped from it.
-caller_path_set=${PATH+set}
-caller_path=${PATH-}
-helper_path=
-rest=$caller_path:
-while [ -n "$rest" ]; do
-  dir=${rest%%:*}
-  rest=${rest#*:}
-  case "$dir" in
-    */node_modules/*|*/node_modules) ;;
-    /*) helper_path=${helper_path:+$helper_path:}$dir ;;
-  esac
-done
-# An empty PATH searches the current directory.
-PATH=${helper_path:-/}
-# A helper comes from PATH only when the default path lacks it and PATH has it.
-# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
-run_helper() {
-  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
-}
-self=$0
-# MSYS and Cygwin can launch this with a native Windows path, which has no slash
-# for `${self%/*}` to strip. Only a drive letter or a UNC prefix marks one; a
-# backslash anywhere else is an ordinary character in a Unix file name, so the
-# path is left alone. The separators are swapped in the shell rather than through
-# `echo`, which mangles a `\t` or `\b` in a path under dash.
-case $self in
-  [A-Za-z]:\\*|\\\\*)
-    while :; do
-      case $self in
-        *\\*) self=${self%%\\*}/${self#*\\} ;;
-        *) break ;;
-      esac
-    done
-    ;;
-esac
-# `${self%/*}` needs a slash to strip. A bare name came from a PATH lookup and
-# stands for a file in the current directory.
-case $self in
-  */*) ;;
-  *) self=./$self ;;
-esac
-hops=0
-while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
-  hops=$((hops + 1))
-  link=$(run_helper readlink "$self")
-  case $link in
-    /*) self=$link ;;
-    *) self=${self%/*}/$link ;;
-  esac
-done
-if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
-# The walk has to end at a regular file. Running out of hops leaves $self a
-# symlink; a chain that changed under us can leave it dangling or a directory, and
-# a failed readlink leaves a trailing slash. Each case would take `bin/pnpm.mjs`
-# from the wrong directory.
-if [ -L "$self" ] || [ ! -f "$self" ]; then
-  echo "pnpm: could not resolve $0 to a regular file within 40 symlink hops." >&2
-  exit 1
-fi
-
-exec node "${self%/*}/bin/pnpm.mjs" "$@"
+#!/usr/bin/env node
+import './bin/pnpm.mjs'

package/pnpx

@@ -1,74 +1,2 @@
-#!/bin/sh
-# `pnpx` is `pnpm dlx`. The pnpm it hands over to is the one installed alongside
-# it, found relative to this file: a `PATH` lookup would run whatever other pnpm
-# comes first there, and would find nothing at all when the directory holding
-# these bins is not on `PATH`.
-#
-# $0 is whatever shim or symlink `pnpx` was launched through, so walk to the file
-# itself first. The hop cap matches the kernel's ELOOP limit, so a cycle cannot
-# hang the script. Directories come from `${self%/*}` and `readlink` runs through
-# `command -p`, so the caller's `PATH` decides nothing here.
-#
-# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
-# instead, with node_modules and relative entries dropped from it.
-caller_path_set=${PATH+set}
-caller_path=${PATH-}
-helper_path=
-rest=$caller_path:
-while [ -n "$rest" ]; do
-  dir=${rest%%:*}
-  rest=${rest#*:}
-  case "$dir" in
-    */node_modules/*|*/node_modules) ;;
-    /*) helper_path=${helper_path:+$helper_path:}$dir ;;
-  esac
-done
-# An empty PATH searches the current directory.
-PATH=${helper_path:-/}
-# A helper comes from PATH only when the default path lacks it and PATH has it.
-# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
-run_helper() {
-  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
-}
-self=$0
-# MSYS and Cygwin can launch this with a native Windows path, which has no slash
-# for `${self%/*}` to strip. Only a drive letter or a UNC prefix marks one; a
-# backslash anywhere else is an ordinary character in a Unix file name, so the
-# path is left alone. The separators are swapped in the shell rather than through
-# `echo`, which mangles a `\t` or `\b` in a path under dash.
-case $self in
-  [A-Za-z]:\\*|\\\\*)
-    while :; do
-      case $self in
-        *\\*) self=${self%%\\*}/${self#*\\} ;;
-        *) break ;;
-      esac
-    done
-    ;;
-esac
-# `${self%/*}` needs a slash to strip. A bare name came from a `PATH` lookup and
-# stands for a file in the current directory.
-case $self in
-  */*) ;;
-  *) self=./$self ;;
-esac
-hops=0
-while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
-  hops=$((hops + 1))
-  link=$(run_helper readlink "$self")
-  case $link in
-    /*) self=$link ;;
-    *) self=${self%/*}/$link ;;
-  esac
-done
-if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
-# The walk has to end at a regular file. Running out of hops leaves $self a
-# symlink; a chain that changed under us can leave it dangling or a directory, and
-# a failed readlink leaves a trailing slash. Each case would take `pnpm` from the
-# wrong directory — the substitution this script exists to prevent.
-if [ -L "$self" ] || [ ! -f "$self" ]; then
-  echo "pnpx: could not resolve $0 to a regular file within 40 symlink hops." >&2
-  exit 1
-fi
-
-exec "${self%/*}/pnpm" dlx "$@"
+#!/usr/bin/env node
+import './bin/pnpx.mjs'

package/pnx

@@ -1,74 +1,2 @@
-#!/bin/sh
-# `pnx` is `pnpm dlx`. The pnpm it hands over to is the one installed alongside
-# it, found relative to this file: a `PATH` lookup would run whatever other pnpm
-# comes first there, and would find nothing at all when the directory holding
-# these bins is not on `PATH`.
-#
-# $0 is whatever shim or symlink `pnx` was launched through, so walk to the file
-# itself first. The hop cap matches the kernel's ELOOP limit, so a cycle cannot
-# hang the script. Directories come from `${self%/*}` and `readlink` runs through
-# `command -p`, so the caller's `PATH` decides nothing here.
-#
-# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
-# instead, with node_modules and relative entries dropped from it.
-caller_path_set=${PATH+set}
-caller_path=${PATH-}
-helper_path=
-rest=$caller_path:
-while [ -n "$rest" ]; do
-  dir=${rest%%:*}
-  rest=${rest#*:}
-  case "$dir" in
-    */node_modules/*|*/node_modules) ;;
-    /*) helper_path=${helper_path:+$helper_path:}$dir ;;
-  esac
-done
-# An empty PATH searches the current directory.
-PATH=${helper_path:-/}
-# A helper comes from PATH only when the default path lacks it and PATH has it.
-# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
-run_helper() {
-  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
-}
-self=$0
-# MSYS and Cygwin can launch this with a native Windows path, which has no slash
-# for `${self%/*}` to strip. Only a drive letter or a UNC prefix marks one; a
-# backslash anywhere else is an ordinary character in a Unix file name, so the
-# path is left alone. The separators are swapped in the shell rather than through
-# `echo`, which mangles a `\t` or `\b` in a path under dash.
-case $self in
-  [A-Za-z]:\\*|\\\\*)
-    while :; do
-      case $self in
-        *\\*) self=${self%%\\*}/${self#*\\} ;;
-        *) break ;;
-      esac
-    done
-    ;;
-esac
-# `${self%/*}` needs a slash to strip. A bare name came from a `PATH` lookup and
-# stands for a file in the current directory.
-case $self in
-  */*) ;;
-  *) self=./$self ;;
-esac
-hops=0
-while [ -L "$self" ] && [ "$hops" -lt 40 ]; do
-  hops=$((hops + 1))
-  link=$(run_helper readlink "$self")
-  case $link in
-    /*) self=$link ;;
-    *) self=${self%/*}/$link ;;
-  esac
-done
-if [ -n "$caller_path_set" ]; then PATH=$caller_path; else unset PATH; fi
-# The walk has to end at a regular file. Running out of hops leaves $self a
-# symlink; a chain that changed under us can leave it dangling or a directory, and
-# a failed readlink leaves a trailing slash. Each case would take `pnpm` from the
-# wrong directory — the substitution this script exists to prevent.
-if [ -L "$self" ] || [ ! -f "$self" ]; then
-  echo "pnx: could not resolve $0 to a regular file within 40 symlink hops." >&2
-  exit 1
-fi
-
-exec "${self%/*}/pnpm" dlx "$@"
+#!/usr/bin/env node
+import './bin/pnpx.mjs'