pnpm 12.9.0 → 12.9.1

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # pnpm
 
+## 12.9.1
+
+This release moves the WebContainer build into a separate `@pnpm/wasm` package, shrinks the `pnpm` package back to about 4 MB, and fixes `pnpm publish` with provenance from GitLab CI.
+
+### Patch Changes
+
+- The WebAssembly build for StackBlitz WebContainers now ships as a separate `@pnpm/wasm` package. The `pnpm` and `@pnpm/exe` packages no longer include it, which brings their unpacked size back from about 55 MB to about 4 MB. In a WebContainer, install `@pnpm/wasm` with npm to get the `pnpm` command.
+
+- `pnpm publish` with provenance from GitLab CI is no longer rejected by the npm registry with a 422 error. The provenance statement now includes the GitLab CI variables in `invocation.parameters`, as npm does [#16551](https://github.com/pnpm/pnpm/issues/16551).
+
+- `pnpm audit signatures` now uses the TLS settings of the redirect target when a registry redirects its signing-keys request, for example to registry.npmjs.org. A `cafile` scoped to a private registry no longer makes the redirected request fail [#16541](https://github.com/pnpm/pnpm/issues/16541).
+
+- Fixed `pnpm install --frozen-lockfile` rejecting an up-to-date lockfile when an injected workspace package uses a catalog entry in `peerDependencies` [#16557](https://github.com/pnpm/pnpm/issues/16557).
+
+- The `[<since>]` filter selector works again with Git 2.24 through 2.27 [#16561](https://github.com/pnpm/pnpm/issues/16561). With Git older than 2.24, the selector now fails with an error that names the required Git version.
+
+  It also detects changes in projects whose directory names contain non-ASCII characters. Such a change used to be credited to the parent project. `changedFilesIgnorePattern` and `testPattern` now match changed files whose names contain non-ASCII characters.
+
+- The `pnpm` executable is about 10% smaller. On macOS arm64 it went from 45.1 MB to 40.3 MB.
+
+- Sped up trust downgrade checks for packages with long release histories.
+
+- With `optimisticRepeatInstall: false`, `pnpm install` now runs the projects' own lifecycle scripts, such as `prepare`, even when `node_modules` is already up to date [#16545](https://github.com/pnpm/pnpm/issues/16545).
+
+- `pnpm self-update` now fails for Homebrew-installed pnpm and prints the `brew upgrade` command for the installed formula, such as `brew upgrade pnpm` or `brew upgrade pnpm@11`. It used to install a second copy of pnpm that the Homebrew one kept shadowing [#16547](https://github.com/pnpm/pnpm/issues/16547).
+
 ## 12.9.0
 
 This release runs pnpm in StackBlitz WebContainers, adds a per-registry `networkConcurrency` setting, and records every installed project in the store. It also carries a security fix for `pnpm login`.

package/bin/pnpm.mjs

@@ -39,10 +39,9 @@ const GET_PNPM = new URL('../dist/node_modules/get-pnpm/lib/index.js', import.me
 const DEFAULT_REGISTRY = 'https://registry.npmjs.org'
 
 if ('webcontainer' in process.versions) {
-  await import('../dist/wasm/pnpm.mjs')
-} else {
-  run(await nativeBinary())
+  fail('The pnpm package runs a native binary, which WebContainers cannot execute. Install @pnpm/wasm instead.')
 }
+run(await nativeBinary())
 
 function run (binary) {
   // Ctrl-C reaches the whole foreground process group, so the binary gets its

package/dist/node_modules/.bin/get-pnpm

@@ -8,9 +8,8 @@
 # the shim before it reaches its target. Directories come from `${link%/*}`,
 # which needs no helper at all.
 #
-# Where no default path is compiled in, as on Nix, `command -p` searches PATH
-# instead, so the helpers run with node_modules and relative entries dropped from
-# PATH.
+# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
+# instead, with node_modules and relative entries dropped from it.
 caller_path_set=${PATH+set}
 caller_path=${PATH-}
 helper_path=
@@ -25,6 +24,11 @@ while [ -n "$rest" ]; do
 done
 # An empty PATH searches the current directory.
 PATH=${helper_path:-/}
+# A helper comes from PATH only when the default path lacks it and PATH has it.
+# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
+run_helper() {
+  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
+}
 link="$0"
 # `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
 # and stands for a file in the current directory.
@@ -35,13 +39,13 @@ esac
 hops=0
 while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
   hops=$((hops+1))
-  target=$(command -p readlink "$link")
+  target=$(run_helper readlink "$link")
   case "$target" in
     /*) link="$target" ;;
     *)  link="${link%/*}/$target" ;;
   esac
 done
-basedir=$(command -p printf '%s\n' "$link" | command -p sed -e 's,\\,/,g')
+basedir=$(run_helper printf '%s\n' "$link" | run_helper sed -e 's,\\,/,g')
 basedir="${basedir%/*}"
 basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
 basedir="$basedir_abs"
@@ -49,7 +53,7 @@ basedir_win="$basedir"
 exe=""
 msys=""
 
-case `command -p uname -a` in
+case `run_helper uname -a` in
   *CYGWIN*|*MINGW*|*MSYS*)
     if converted=$(command -p cygpath -w "$basedir" 2>/dev/null) && [ -n "$converted" ]; then
       basedir_win="$converted"

package/dist/node_modules/.bin/node-gyp

@@ -8,9 +8,8 @@
 # the shim before it reaches its target. Directories come from `${link%/*}`,
 # which needs no helper at all.
 #
-# Where no default path is compiled in, as on Nix, `command -p` searches PATH
-# instead, so the helpers run with node_modules and relative entries dropped from
-# PATH.
+# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
+# instead, with node_modules and relative entries dropped from it.
 caller_path_set=${PATH+set}
 caller_path=${PATH-}
 helper_path=
@@ -25,6 +24,11 @@ while [ -n "$rest" ]; do
 done
 # An empty PATH searches the current directory.
 PATH=${helper_path:-/}
+# A helper comes from PATH only when the default path lacks it and PATH has it.
+# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
+run_helper() {
+  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
+}
 link="$0"
 # `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
 # and stands for a file in the current directory.
@@ -35,13 +39,13 @@ esac
 hops=0
 while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
   hops=$((hops+1))
-  target=$(command -p readlink "$link")
+  target=$(run_helper readlink "$link")
   case "$target" in
     /*) link="$target" ;;
     *)  link="${link%/*}/$target" ;;
   esac
 done
-basedir=$(command -p printf '%s\n' "$link" | command -p sed -e 's,\\,/,g')
+basedir=$(run_helper printf '%s\n' "$link" | run_helper sed -e 's,\\,/,g')
 basedir="${basedir%/*}"
 basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
 basedir="$basedir_abs"
@@ -49,7 +53,7 @@ basedir_win="$basedir"
 exe=""
 msys=""
 
-case `command -p uname -a` in
+case `run_helper uname -a` in
   *CYGWIN*|*MINGW*|*MSYS*)
     if converted=$(command -p cygpath -w "$basedir" 2>/dev/null) && [ -n "$converted" ]; then
       basedir_win="$converted"

package/dist/node_modules/.bin/node-which

@@ -8,9 +8,8 @@
 # the shim before it reaches its target. Directories come from `${link%/*}`,
 # which needs no helper at all.
 #
-# Where no default path is compiled in, as on Nix, `command -p` searches PATH
-# instead, so the helpers run with node_modules and relative entries dropped from
-# PATH.
+# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
+# instead, with node_modules and relative entries dropped from it.
 caller_path_set=${PATH+set}
 caller_path=${PATH-}
 helper_path=
@@ -25,6 +24,11 @@ while [ -n "$rest" ]; do
 done
 # An empty PATH searches the current directory.
 PATH=${helper_path:-/}
+# A helper comes from PATH only when the default path lacks it and PATH has it.
+# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
+run_helper() {
+  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
+}
 link="$0"
 # `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
 # and stands for a file in the current directory.
@@ -35,13 +39,13 @@ esac
 hops=0
 while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
   hops=$((hops+1))
-  target=$(command -p readlink "$link")
+  target=$(run_helper readlink "$link")
   case "$target" in
     /*) link="$target" ;;
     *)  link="${link%/*}/$target" ;;
   esac
 done
-basedir=$(command -p printf '%s\n' "$link" | command -p sed -e 's,\\,/,g')
+basedir=$(run_helper printf '%s\n' "$link" | run_helper sed -e 's,\\,/,g')
 basedir="${basedir%/*}"
 basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
 basedir="$basedir_abs"
@@ -49,7 +53,7 @@ basedir_win="$basedir"
 exe=""
 msys=""
 
-case `command -p uname -a` in
+case `run_helper uname -a` in
   *CYGWIN*|*MINGW*|*MSYS*)
     if converted=$(command -p cygpath -w "$basedir" 2>/dev/null) && [ -n "$converted" ]; then
       basedir_win="$converted"

package/dist/node_modules/.bin/nopt

@@ -8,9 +8,8 @@
 # the shim before it reaches its target. Directories come from `${link%/*}`,
 # which needs no helper at all.
 #
-# Where no default path is compiled in, as on Nix, `command -p` searches PATH
-# instead, so the helpers run with node_modules and relative entries dropped from
-# PATH.
+# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
+# instead, with node_modules and relative entries dropped from it.
 caller_path_set=${PATH+set}
 caller_path=${PATH-}
 helper_path=
@@ -25,6 +24,11 @@ while [ -n "$rest" ]; do
 done
 # An empty PATH searches the current directory.
 PATH=${helper_path:-/}
+# A helper comes from PATH only when the default path lacks it and PATH has it.
+# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
+run_helper() {
+  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
+}
 link="$0"
 # `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
 # and stands for a file in the current directory.
@@ -35,13 +39,13 @@ esac
 hops=0
 while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
   hops=$((hops+1))
-  target=$(command -p readlink "$link")
+  target=$(run_helper readlink "$link")
   case "$target" in
     /*) link="$target" ;;
     *)  link="${link%/*}/$target" ;;
   esac
 done
-basedir=$(command -p printf '%s\n' "$link" | command -p sed -e 's,\\,/,g')
+basedir=$(run_helper printf '%s\n' "$link" | run_helper sed -e 's,\\,/,g')
 basedir="${basedir%/*}"
 basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
 basedir="$basedir_abs"
@@ -49,7 +53,7 @@ basedir_win="$basedir"
 exe=""
 msys=""
 
-case `command -p uname -a` in
+case `run_helper uname -a` in
   *CYGWIN*|*MINGW*|*MSYS*)
     if converted=$(command -p cygpath -w "$basedir" 2>/dev/null) && [ -n "$converted" ]; then
       basedir_win="$converted"

package/dist/node_modules/.bin/semver

@@ -8,9 +8,8 @@
 # the shim before it reaches its target. Directories come from `${link%/*}`,
 # which needs no helper at all.
 #
-# Where no default path is compiled in, as on Nix, `command -p` searches PATH
-# instead, so the helpers run with node_modules and relative entries dropped from
-# PATH.
+# A helper the default path lacks, as in a Nix build sandbox, comes from PATH
+# instead, with node_modules and relative entries dropped from it.
 caller_path_set=${PATH+set}
 caller_path=${PATH-}
 helper_path=
@@ -25,6 +24,11 @@ while [ -n "$rest" ]; do
 done
 # An empty PATH searches the current directory.
 PATH=${helper_path:-/}
+# A helper comes from PATH only when the default path lacks it and PATH has it.
+# The bash 3.2 that macOS ships as sh answers `command -p -v` from PATH.
+run_helper() {
+  if command -p -v "$1" >/dev/null 2>&1 || ! command -v "$1" >/dev/null 2>&1; then command -p "$@"; else command "$@"; fi
+}
 link="$0"
 # `${link%/*}` needs a separator to strip. A bare name came from a PATH lookup
 # and stands for a file in the current directory.
@@ -35,13 +39,13 @@ esac
 hops=0
 while [ -L "$link" ] && [ "$hops" -lt 40 ]; do
   hops=$((hops+1))
-  target=$(command -p readlink "$link")
+  target=$(run_helper readlink "$link")
   case "$target" in
     /*) link="$target" ;;
     *)  link="${link%/*}/$target" ;;
   esac
 done
-basedir=$(command -p printf '%s\n' "$link" | command -p sed -e 's,\\,/,g')
+basedir=$(run_helper printf '%s\n' "$link" | run_helper sed -e 's,\\,/,g')
 basedir="${basedir%/*}"
 basedir_abs=$(CDPATH= cd -P -- "$basedir" && pwd -P) || exit $?
 basedir="$basedir_abs"
@@ -49,7 +53,7 @@ basedir_win="$basedir"
 exe=""
 msys=""
 
-case `command -p uname -a` in
+case `run_helper uname -a` in
   *CYGWIN*|*MINGW*|*MSYS*)
     if converted=$(command -p cygpath -w "$basedir" 2>/dev/null) && [ -n "$converted" ]; then
       basedir_win="$converted"

package/dist/node_modules/.pnpm-workspace-state-v1.json

@@ -1,9 +1,9 @@
 {
-  "lastValidatedTimestamp": 1790977215579,
+  "lastValidatedTimestamp": 1791058509474,
   "projects": {
     "/home/runner/_work/pnpm/pnpm/pnpm/npm/pnpm/temp-deploy": {
       "name": "pacquet",
-      "version": "12.9.0",
+      "version": "12.9.1",
       "hasModulesDir": true
     }
   },

package/install.js

@@ -32,8 +32,8 @@ function setup () {
     return
   }
 
+  // The Node launchers stay in place there and point to `@pnpm/wasm`.
   if ('webcontainer' in process.versions) {
-    validateWebContainerRuntime()
     return
   }
 
@@ -69,13 +69,6 @@ function setup () {
   }
 }
 
-function validateWebContainerRuntime () {
-  const runtime = path.join(wrapperDir, 'dist', 'wasm', 'pnpm.wasm')
-  if (!fs.statSync(runtime, { throwIfNoEntry: false })?.isFile()) {
-    fail('The pnpm package is missing its bundled WebContainer runtime. Reinstall pnpm.')
-  }
-}
-
 /**
  * Atomically place `nativeBinary` at `destPath` (hard link, falling back to a
  * copy across filesystems, via a temp file + rename). Exits the process on

package/package.json

@@ -9,7 +9,7 @@
       "./dist/node_modules/node-gyp/gyp/gyp"
     ]
   },
-  "version": "12.9.0",
+  "version": "12.9.1",
   "description": "Fast, disk space efficient package manager",
   "keywords": [
     "pnpm",
@@ -46,20 +46,20 @@
     "THIRD-PARTY-NOTICES.md"
   ],
   "optionalDependencies": {
-    "@pnpm/exe.win32-x64": "12.9.0",
-    "@pnpm/exe.win32-arm64": "12.9.0",
-    "@pnpm/exe.darwin-x64": "12.9.0",
-    "@pnpm/exe.darwin-arm64": "12.9.0",
-    "@pnpm/exe.linux-x64": "12.9.0",
-    "@pnpm/exe.linux-arm64": "12.9.0",
-    "@pnpm/exe.linux-riscv64": "12.9.0",
-    "@pnpm/exe.linux-ppc64": "12.9.0",
-    "@pnpm/exe.linux-s390x": "12.9.0",
-    "@pnpm/exe.linux-x64-musl": "12.9.0",
-    "@pnpm/exe.linux-arm64-musl": "12.9.0",
-    "@pnpm/exe.freebsd-x64": "12.9.0",
-    "@pnpm/exe.android-arm64": "12.9.0",
-    "@pnpm/exe.android-x64": "12.9.0"
+    "@pnpm/exe.win32-x64": "12.9.1",
+    "@pnpm/exe.win32-arm64": "12.9.1",
+    "@pnpm/exe.darwin-x64": "12.9.1",
+    "@pnpm/exe.darwin-arm64": "12.9.1",
+    "@pnpm/exe.linux-x64": "12.9.1",
+    "@pnpm/exe.linux-arm64": "12.9.1",
+    "@pnpm/exe.linux-riscv64": "12.9.1",
+    "@pnpm/exe.linux-ppc64": "12.9.1",
+    "@pnpm/exe.linux-s390x": "12.9.1",
+    "@pnpm/exe.linux-x64-musl": "12.9.1",
+    "@pnpm/exe.linux-arm64-musl": "12.9.1",
+    "@pnpm/exe.freebsd-x64": "12.9.1",
+    "@pnpm/exe.android-arm64": "12.9.1",
+    "@pnpm/exe.android-x64": "12.9.1"
   },
   "scripts": {
     "preinstall": "node install.js",

package/dist/wasm/LICENSE

@@ -1,22 +0,0 @@
-The MIT License (MIT)
-
-Copyright (c) 2015-2016 Rico Sta. Cruz and other contributors
-Copyright (c) 2016-2026 Zoltan Kochan and other contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/dist/wasm/README.md

@@ -1,140 +0,0 @@
-# WebContainer runtime
-
-This runtime executes the pnpm v12 CLI as threaded WebAssembly inside StackBlitz
-WebContainers. The regular npm wrapper includes this runtime and `pnpm.wasm`
-under `dist/wasm` and selects it using `process.versions.webcontainer`. The
-standalone distribution is also available for testing builds before release.
-Implementation and validation are tracked in
-[pnpm/tasks#63](https://github.com/pnpm/tasks/issues/63).
-
-Native pnpm does not load this package. Native implementations remain selected
-at compile time.
-
-## Build and test
-
-From the repository root, with workspace dependencies installed:
-
-```sh
-rustup toolchain install nightly-2026-08-27 --profile minimal --target wasm32-wasip1-threads
-export WASI_SDK_PATH=/path/to/wasi-sdk-34.0
-export WABT_PATH=/path/to/wabt-1.0.42
-pnpm build:pnpm:wasm
-pnpm pack:pnpm:wasm
-node pnpm/wasm/stage.mjs
-pnpm build:wasm-runtime-probe
-pnpm --filter @pnpm-private/wasm-runtime test
-node pnpm/tasks/ecosystem-e2e/webcontainer/run.mjs --wasm-runtime target/wasm-runtime-probe/wasm32-wasip1-threads/debug/pnpm-wasm-runtime-probe.wasm
-```
-
-`stage.mjs` prepares the self-contained `pnpm/npm/pnpm/dist/wasm` payload for
-the regular npm wrapper. Release jobs restore it after the node-gyp payload.
-Native executable archives do not include the WASM payload. Normal native npm
-installations keep the direct native executable, without a runtime-selection
-check on each invocation.
-
-CI packs the regular wrapper with `pack-wrapper.mjs` and enforces a 20 MiB
-compressed size budget. The bundled runtime also increases native npm download
-size; it must be available before install scripts run for automatic WebContainer
-selection to work when those scripts are disabled.
-
-The full build uses the pinned nightly because `cap-primitives` requires unstable
-WASI filesystem APIs. Native builds retain the repository's stable toolchain.
-Download and extract [WASI SDK 34](https://github.com/WebAssembly/wasi-sdk/releases/tag/wasi-sdk-34)
-before setting `WASI_SDK_PATH`; the build checks its version and does not download
-a compiler. The SDK also builds bundled SQLite with threading enabled.
-Extract [WABT 1.0.42](https://github.com/WebAssembly/wabt/releases/tag/1.0.42)
-and set `WABT_PATH` to its directory containing `bin`. The build uses its validated
-WebAssembly text roundtrip to replace atomic waits with cancellable host imports.
-The runtime tests also use this toolchain.
-
-The browser test needs the Chromium installation described in the
-[ecosystem test guide](https://github.com/pnpm/pnpm/blob/main/pnpm/tasks/ecosystem-e2e/README.md#webcontainers).
-The Node tests require the freshly built probe; missing artifacts are errors.
-
-## Execution model
-
-The Node supervisor owns one WASI descriptor table, the filesystem permission
-adapter, network requests and child processes. Rust runs in workers sharing
-one WebAssembly memory. All workers use the supervisor's descriptor table,
-including when Tokio moves an open file between threads.
-
-The build exports `malloc`, `free`, `__tls_base` and `__wasm_init_tls` for the
-thread loader. The supervisor performs shared memory initialization; the main
-worker initializes its thread-local storage before calling `_start`.
-
-The `pnpm_atomic` imports provide cancellable atomic waits. WebContainer workers
-cannot terminate while parked in a WebAssembly atomic wait. The build rewrites
-only wait instructions; loads, stores, notifications and other atomics remain
-WebAssembly instructions. Host waits preserve guest deadlines and use bounded
-blocking intervals to observe cancellation without a lost wakeup.
-
-The `pnpm_host` imports start asynchronous operations and transfer responses.
-One Rust completion thread wakes pending futures. The supervisor retains result
-buffers until Rust reads or cancels them; it never retains pointers into guest
-memory. Each JSON request or response is limited to 1 MiB. Stream reads transfer
-at most 64 KiB of data at a time. HTTP uploads use a separate bounded stream,
-so package bodies can exceed the control-message limit. Dropping a request cancels it, and closing the
-runtime aborts outstanding operations before terminating the workers.
-
-The `pnpm_fs` imports supply operations WASI lacks: atomic creation with an
-explicit mode, descriptor-bound permission changes, and private lock
-directories. They use the same descriptor mapping as ordinary WASI calls.
-
-The runtime runs trusted pnpm code with the authority of its Node host. It
-preopens the host root; it is not a sandbox for arbitrary WASM modules. Inside
-WebContainers this is the container's virtual filesystem.
-
-## Current boundaries
-
-WebContainer's bundled npm applies package replacements through a private host
-integration. The standalone pnpm distribution does not depend on that API.
-Projects using native tools must select compatible WebAssembly packages through
-pnpm's existing overrides. For example, in `pnpm-workspace.yaml`:
-
-```yaml
-overrides:
-  esbuild: npm:esbuild-wasm@^0.27.0
-  rollup: npm:@rollup/wasm-node@^4.43.1
-```
-
-Match the replacement versions to the project's dependencies and commit the
-lockfile generated by `pnpm install`. This uses the normal resolver and integrity
-checks without implicitly substituting package contents.
-
-The browser controls HTTP protocol negotiation and connection pooling. Explicit
-custom TLS roots, client certificates, proxies, local addresses and DNS pinning
-are rejected by the WASM HTTP adapter. They are not silently ignored. Redirects
-remain controlled by the shared Rust network policy.
-
-Process cancellation enumerates descendants with the host's `/bin/ps` and
-signals them while the spawned parent is still owned. WebContainers do not
-support process-group signals or stable descendant identity handles. If a
-parent exits after a graceful signal while a descendant ignores that signal,
-the runtime cannot safely target the orphan during later escalation. It does
-not retain stale descendant PIDs. Runtime shutdown uses `SIGKILL` for live
-owned process trees.
-
-WebContainers do not reliably support numeric file descriptors in child-process
-stdio. File redirection therefore uses a pipe bridge, and waiting for the child
-also waits for the redirected output to finish writing. A background descendant
-that inherits redirected stdout or stderr keeps that wait pending until it closes
-the stream, even after the direct child exits. Background children should close
-or replace inherited redirected streams.
-
-WASM uses the `v11-wasm` store namespace; native pnpm keeps `v11`. The package
-file and index formats match, but live stores are isolated because the locking
-protocols differ. An explicit store path ending in `v11` also receives the
-`v11-wasm` suffix. Do not symlink the two namespaces together.
-
-SQLite uses a rollback journal and host process leases, because the WASI VFS
-cannot provide native advisory locking or WAL. Its [probe](https://github.com/pnpm/pnpm/blob/main/pnpm/tasks/ecosystem-e2e/webcontainer/sqlite-probe/README.md)
-and actual Rust store tests cover persistence, contention and crash recovery.
-
-WebContainers cannot restore changed installation metadata through a pinned
-directory handle. A failed mutation reports that automatic metadata rollback is
-unavailable; it does not write through an unsafe replacement directory. Automatic
-provenance signing is also unavailable and returns an explicit error.
-
-Compiling or passing the runtime probe does not establish that all pnpm commands
-work in WebContainers. The task tracks CLI integration, command coverage,
-packaging and native performance validation separately.

package/dist/wasm/THIRD-PARTY-NOTICES.md

@@ -1,42 +0,0 @@
-# Third-Party Notices
-
-This product includes software derived from third-party sources. The
-components below, and their license terms, are listed here in satisfaction
-of those terms.
-
-## Yarn (`@yarnpkg/nm`, `@yarnpkg/extensions`)
-
-- Source: <https://github.com/yarnpkg/berry>
-- License: BSD 2-Clause
-
-The `nodeLinker: hoisted` layout is produced by a Rust port of the hoisting
-algorithm in `@yarnpkg/nm`, and the built-in package-compatibility database
-is a copy of the one in `@yarnpkg/extensions`.
-
-```text
-BSD 2-Clause License
-
-Copyright (c) 2016-present, Yarn Contributors.
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-1. Redistributions of source code must retain the above copyright notice, this
-   list of conditions and the following disclaimer.
-
-2. Redistributions in binary form must reproduce the above copyright notice,
-   this list of conditions and the following disclaimer in the documentation
-   and/or other materials provided with the distribution.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-```

package/dist/wasm/host/atomic-waits.mjs

@@ -1,43 +0,0 @@
-import { createCancellationCheck } from './cancellation.mjs'
-
-// Cancellation can race the transition from checking its flag to waiting on guest memory.
-const WAIT_SLICE_MS = 100
-
-export function createAtomicWaits (memory, control, checkCancelled = createCancellationCheck(control)) {
-  const state = new Int32Array(control)
-  if (state.length < 2) throw new RangeError('Atomic wait control requires two i32 slots')
-  return {
-    wait32: (pointer, expected, timeout, offset) => wait(memory, state, pointer, expected, timeout, offset, 4, checkCancelled),
-    wait64: (pointer, expected, timeout, offset) => wait(memory, state, pointer, expected, timeout, offset, 8, checkCancelled),
-  }
-}
-
-export function cancelAtomicWaits (memory, control) {
-  const state = new Int32Array(control)
-  Atomics.store(state, 0, 1)
-  const address = Atomics.load(state, 1) >>> 0
-  if (address < memory.buffer.byteLength) Atomics.notify(new Int32Array(memory.buffer), address >>> 2)
-}
-
-function wait (memory, state, pointer, expected, timeout, offset, width, checkCancelled) {
-  const address = (pointer >>> 0) + (offset >>> 0)
-  if (address % width !== 0 || address + width > memory.buffer.byteLength) {
-    throw new WebAssembly.RuntimeError('Unaligned or out-of-bounds atomic wait')
-  }
-  const view = width === 4 ? new Int32Array(memory.buffer) : new BigInt64Array(memory.buffer)
-  const deadline = timeout < 0n ? Infinity : performance.now() + Number(timeout) / 1000000
-  Atomics.store(state, 1, address)
-  try {
-    while (true) {
-      checkCancelled()
-      const remaining = Math.max(0, deadline - performance.now())
-      const result = Atomics.wait(view, address / width, expected, Math.min(remaining, WAIT_SLICE_MS))
-      checkCancelled()
-      if (result === 'ok') return 0
-      if (result === 'not-equal') return 1
-      if (performance.now() >= deadline) return 2
-    }
-  } finally {
-    Atomics.store(state, 1, -1)
-  }
-}

package/dist/wasm/host/cancellation.mjs

@@ -1,6 +0,0 @@
-export function createCancellationCheck (control) {
-  const state = control && new Int32Array(control)
-  return () => {
-    if (state && Atomics.load(state, 0)) throw new WebAssembly.RuntimeError('WASM worker cancelled')
-  }
-}

package/dist/wasm/host/executable-mode.mjs

@@ -1,8 +0,0 @@
-export function hasExecutableMode (metadata) {
-  const user = process.getuid()
-  let permission = 0o1
-  if (user === 0) permission = 0o111
-  else if (metadata.uid === user) permission = 0o100
-  else if (metadata.gid === process.getgid() || process.getgroups().includes(metadata.gid)) permission = 0o10
-  return (metadata.mode & permission) !== 0
-}