@clearlydev/nx-archweave 0.0.0-stage → 0.1.0

package/dist/generators/add-review/render.js

@@ -0,0 +1,96 @@
+/** Line-level LCS diff — small generated files, no diff library. */
+export function renderLineDiff(existing, generated) {
+    const a = existing.split('\n');
+    const b = generated.split('\n');
+    const m = a.length;
+    const n = b.length;
+    const lcs = Array.from({ length: m + 1 }, () => new Array(n + 1).fill(0));
+    for (let i = m - 1; i >= 0; i--) {
+        for (let j = n - 1; j >= 0; j--) {
+            lcs[i][j] = a[i] === b[j] ? lcs[i + 1][j + 1] + 1 : Math.max(lcs[i + 1][j], lcs[i][j + 1]);
+        }
+    }
+    const out = ['--- existing', '+++ generated'];
+    let i = 0;
+    let j = 0;
+    while (i < m && j < n) {
+        if (a[i] === b[j]) {
+            out.push(`  ${a[i]}`);
+            i++;
+            j++;
+        }
+        else if (lcs[i + 1][j] >= lcs[i][j + 1]) {
+            out.push(`- ${a[i]}`);
+            i++;
+        }
+        else {
+            out.push(`+ ${b[j]}`);
+            j++;
+        }
+    }
+    while (i < m)
+        out.push(`- ${a[i++]}`);
+    while (j < n)
+        out.push(`+ ${b[j++]}`);
+    return out.join('\n');
+}
+const WORKFLOW_ACTION_LINES = {
+    created: 'created',
+    overwritten: 'overwritten with the generated version (per --onConflict=overwrite)',
+    unchanged: 'unchanged (already matches the generated version)',
+    proposed: 'NOT written — differs from the generated version (merge proposal below)',
+    skipped: 'left as-is (per --onConflict=skip)',
+    alternate: 'generated alongside the existing file',
+    aborted: 'NOT written',
+};
+const CONFIG_ACTION_LINES = {
+    created: 'created with the review field',
+    updated: 'review field updated',
+    unchanged: 'review field unchanged',
+    'not-updated': 'NOT updated — kept consistent with the workflow file that is actually in effect',
+    aborted: 'NOT updated',
+};
+export function renderAddReviewReport(report) {
+    const lines = [];
+    if (report.packageManagerNote !== undefined) {
+        lines.push(`Note: ${report.packageManagerNote}`);
+    }
+    if (report.workflowAction === 'aborted') {
+        lines.push('add-review aborted — nothing was written.');
+        lines.push(`  toolkit.config.json: ${report.configError ?? 'unusable'}`);
+        lines.push('  Fix the config file manually, then rerun the generator.');
+        return lines.join('\n');
+    }
+    if (report.dryRun) {
+        lines.push('add-review dry-run — no files were written.');
+        lines.push('');
+        lines.push('Generated workflow YAML:');
+        lines.push(report.workflowYaml ?? '');
+        lines.push('');
+        lines.push('toolkit.config.json review field:');
+        lines.push(report.configSnippetJson ?? '');
+        lines.push('');
+        lines.push('Effective decision:');
+    }
+    lines.push(`  ${report.workflowPath}: ${WORKFLOW_ACTION_LINES[report.workflowAction]}`);
+    lines.push(`  toolkit.config.json: ${CONFIG_ACTION_LINES[report.configAction]}`);
+    if (report.workflowAction === 'proposed' && report.diff) {
+        lines.push('');
+        lines.push(report.diff);
+        lines.push('');
+        lines.push('To resolve, rerun with one of:');
+        lines.push('  --onConflict=overwrite            replace the existing file with the generated version');
+        lines.push('  --onConflict=skip                 keep the existing file');
+        lines.push('  --onConflict=alternate-filename   write the generated version alongside it');
+    }
+    if (report.workflowAction === 'alternate') {
+        lines.push('');
+        lines.push('  Review the generated file, then replace the main workflow file with it yourself;');
+        lines.push('  the config stays pointing at the workflow that is actually in effect until you do.');
+    }
+    lines.push('');
+    lines.push(`Note: the review workflow stays green-skipped until you register the ${report.requiredSecretName} secret.`);
+    lines.push('Note: this workflow runs with elevated permissions only after it is merged to the default branch —');
+    lines.push('merging is the first real validation.');
+    return lines.join('\n');
+}

package/dist/generators/allow-builds/generator.js

@@ -0,0 +1,436 @@
+// src/generators/allow-builds/generator.ts
+import { spawnSync } from "node:child_process";
+
+// ../shared/dist/lib/spawnable-command.js
+import { statSync } from "node:fs";
+import { win32 } from "node:path";
+function isFile(path) {
+  try {
+    return statSync(path).isFile();
+  } catch {
+    return false;
+  }
+}
+var DEFAULT_ENV = { platform: process.platform, env: process.env, isFile };
+function envValue(env, name) {
+  const key = Object.keys(env).find((candidate) => candidate.toUpperCase() === name);
+  return key === void 0 ? void 0 : env[key];
+}
+function resolveWindowsCommand(command, environment) {
+  const exts = (envValue(environment.env, "PATHEXT") ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
+  const candidates = (base) => win32.extname(base) !== "" ? [base] : exts.map((ext) => base + ext);
+  if (win32.isAbsolute(command) || /[\\/]/.test(command)) {
+    return candidates(command).find(environment.isFile);
+  }
+  const dirs = (envValue(environment.env, "PATH") ?? "").split(";").filter(Boolean);
+  for (const dir of dirs) {
+    const found = candidates(win32.join(dir, command)).find(environment.isFile);
+    if (found !== void 0)
+      return found;
+  }
+  return void 0;
+}
+var META_CHARS = /([()\][%!^"`<>&|;, *?])/g;
+var BIN_SHIM = /node_modules[\\/]\.bin[\\/][^\\/]+\.cmd$/i;
+function escapeCmdArgument(arg, doubleEscape = false) {
+  let quoted = arg.replace(/(\\*)"/g, '$1$1\\"');
+  quoted = quoted.replace(/(\\*)$/, "$1$1");
+  const escaped = `"${quoted}"`.replace(META_CHARS, "^$1");
+  return doubleEscape ? escaped.replace(META_CHARS, "^$1") : escaped;
+}
+function spawnableCommand(command, args, environment = DEFAULT_ENV) {
+  if (environment.platform !== "win32")
+    return { command, args: [...args] };
+  const resolved = resolveWindowsCommand(command, environment);
+  if (resolved === void 0 || !/\.(cmd|bat)$/i.test(resolved))
+    return { command, args: [...args] };
+  const doubleEscape = BIN_SHIM.test(resolved);
+  const line = [resolved.replace(META_CHARS, "^$1"), ...args.map((arg) => escapeCmdArgument(arg, doubleEscape))].join(" ");
+  return {
+    command: envValue(environment.env, "COMSPEC") ?? "cmd.exe",
+    args: ["/d", "/s", "/c", `"${line}"`],
+    windowsVerbatimArguments: true
+  };
+}
+
+// ../template-engine/dist/environment/package-manager.js
+var LOCKFILES = [
+  ["yarn", ["yarn.lock"]],
+  ["bun", ["bun.lock", "bun.lockb"]],
+  ["npm", ["package-lock.json"]]
+];
+function detectWorkspacePackageManager(exists, read = () => void 0) {
+  if (exists("pnpm-lock.yaml") || exists("pnpm-workspace.yaml"))
+    return "pnpm";
+  const found = LOCKFILES.filter(([, files]) => files.some((file) => exists(file))).map(([pm]) => pm);
+  if (found.length <= 1)
+    return found[0] ?? null;
+  const declared = /"packageManager"\s*:\s*"(npm|yarn|bun)@/.exec(read("package.json") ?? "")?.[1];
+  const named = found.find((pm) => pm === declared);
+  if (named)
+    return named;
+  return found.includes("npm") ? "npm" : found[0];
+}
+
+// ../template-engine/dist/pnpm/allow-builds.js
+var PENDING_PLACEHOLDER = "set this to true or false";
+function isPlainPackageName(name) {
+  return /^(?:@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*$/i.test(name);
+}
+function allowPackageBuilds(yamlText, names, options = {}) {
+  const bom = yamlText.startsWith("\uFEFF") ? "\uFEFF" : "";
+  const body = yamlText.slice(bom.length);
+  const eol = body.includes("\r\n") ? "\r\n" : "\n";
+  const unique = [...new Set(names)];
+  const listIsRead = options.pnpmMajor === void 0 || options.pnpmMajor < 11;
+  const result = edit(body.split(/\r?\n/), eol, unique, listIsRead);
+  return result.status === "updated" ? { ...result, text: `${bom}${result.text}` } : result;
+}
+function pnpmMajorFromModulesManifest(modulesYamlText) {
+  const match = /^\s*["']?packageManager["']?\s*:\s*["']?pnpm@(\d+)\./m.exec(modulesYamlText);
+  return match ? Number(match[1]) : void 0;
+}
+function edit(original, eol, names, listIsRead) {
+  const shape = checkDocumentShape(original);
+  if (shape !== void 0)
+    return { status: "unrecognized", reason: shape };
+  const lines = expandFlow(original, "allowBuilds");
+  if (typeof lines === "string")
+    return { status: "unrecognized", reason: lines };
+  const allowBuilds = findBlock(lines, "allowBuilds");
+  if (typeof allowBuilds === "string")
+    return { status: "unrecognized", reason: allowBuilds };
+  if (allowBuilds)
+    return editAllowBuilds(lines, eol, allowBuilds, names);
+  if (!listIsRead)
+    return appendAllowBuilds(original, eol, names);
+  const listLines = expandFlow(original, "onlyBuiltDependencies");
+  if (typeof listLines === "string")
+    return { status: "unrecognized", reason: listLines };
+  const onlyBuilt = findBlock(listLines, "onlyBuiltDependencies");
+  if (typeof onlyBuilt === "string")
+    return { status: "unrecognized", reason: onlyBuilt };
+  if (onlyBuilt)
+    return editOnlyBuilt(listLines, eol, onlyBuilt, names);
+  return appendAllowBuilds(original, eol, names);
+}
+function appendAllowBuilds(original, eol, names) {
+  const changes = names.map((name) => ({ name, previous: "absent" }));
+  const entries = names.map((name) => `  ${yamlPackageKey(name)}: true`);
+  const head = original[original.length - 1] === "" ? original.slice(0, -1) : original;
+  return { status: "updated", target: "allowBuilds", changes, text: [...head, "allowBuilds:", ...entries, ""].join(eol) };
+}
+function editAllowBuilds(lines, eol, block, names) {
+  const entries = [];
+  for (const index of block.entries) {
+    const match = /^(\s+)('([^']*)'|"([^"]*)"|([^\s'"#-]\S*?)):(?:\s+(.*))?$/.exec(lines[index]);
+    if (!match)
+      return { status: "unrecognized", reason: 'allowBuilds holds something other than "<package>: <value>" entries' };
+    entries.push({ index, indent: match[1], rawKey: match[2], key: match[3] ?? match[4] ?? match[5], ...splitValue(match[6] ?? "") });
+  }
+  const indent = entries[0]?.indent ?? "  ";
+  for (const name of names) {
+    if (entries.filter((entry) => entry.key === name).length > 1)
+      return { status: "unrecognized", reason: `allowBuilds lists ${name} more than once` };
+    const versioned = entries.find((entry) => entry.key.startsWith(`${name}@`) && classify(entry.value) !== "allowed");
+    if (versioned)
+      return { status: "unrecognized", reason: `allowBuilds has a version-specific entry for ${name} (${versioned.key}) that is not true` };
+  }
+  const next = [...lines];
+  const appended = [];
+  const changes = names.map((name) => {
+    const entry = entries.find((candidate) => candidate.key === name);
+    if (!entry) {
+      appended.push(`${indent}${yamlPackageKey(name)}: true`);
+      return { name, previous: "absent" };
+    }
+    const previous = classify(entry.value);
+    if (previous !== "allowed")
+      next[entry.index] = `${entry.indent}${entry.rawKey}: true${entry.comment ? ` ${entry.comment}` : ""}`;
+    return { name, previous };
+  });
+  if (changes.every((change) => change.previous === "allowed"))
+    return { status: "unchanged", target: "allowBuilds", changes };
+  next.splice(insertionPoint(block), 0, ...appended);
+  return { status: "updated", target: "allowBuilds", changes, text: next.join(eol) };
+}
+function editOnlyBuilt(lines, eol, block, names) {
+  const listed = /* @__PURE__ */ new Set();
+  for (const index of block.entries) {
+    const item = /^\s+-\s+(?:'([^']*)'|"([^"]*)"|([^\s#'"][^#]*?))\s*(?:#.*)?$/.exec(lines[index]);
+    const value = item ? item[1] ?? item[2] ?? item[3] : void 0;
+    if (value === void 0 || item?.[3] !== void 0 && /:(\s|$)/.test(value)) {
+      return { status: "unrecognized", reason: 'onlyBuiltDependencies holds something other than "- <package>" items' };
+    }
+    listed.add(value);
+  }
+  const indent = block.entries.length > 0 ? leadingSpace(lines[block.entries[0]]) : "  ";
+  const changes = names.map((name) => ({ name, previous: listed.has(name) ? "allowed" : "absent" }));
+  if (changes.every((change) => change.previous === "allowed")) {
+    return { status: "unchanged", target: "onlyBuiltDependencies", changes };
+  }
+  const next = [...lines];
+  const appended = changes.filter((change) => change.previous === "absent").map((change) => `${indent}- ${yamlPackageKey(change.name)}`);
+  next.splice(insertionPoint(block), 0, ...appended);
+  return { status: "updated", target: "onlyBuiltDependencies", changes, text: next.join(eol) };
+}
+function checkDocumentShape(lines) {
+  const content = lines.filter((line) => line.trim() !== "" && !/^\s*#/.test(line));
+  if (content.some((line) => /^(---|\.\.\.)(\s|$)/.test(line)))
+    return "the file has YAML document markers (--- / ...)";
+  const first = content[0];
+  if (first !== void 0 && !/^(?:'[^']*'|"[^"]*"|[^\s#'"?{[\]-][^:]*?)\s*:(?:\s|$)/.test(first)) {
+    return "the file is not a plain mapping with its keys at column 0";
+  }
+  return void 0;
+}
+function expandFlow(lines, key) {
+  const keyLine = topLevelKeyLine(key);
+  const index = lines.findIndex((line) => keyLine.test(line));
+  if (index === -1)
+    return lines;
+  const match = /^(.*?:)\s*([{[])(.*)([}\]])\s*(#.*)?$/.exec(lines[index]);
+  if (!match)
+    return lines;
+  const [, head, open, inner, close, comment] = match;
+  const isMap = key === "allowBuilds";
+  if (isMap && (open !== "{" || close !== "}") || !isMap && (open !== "[" || close !== "]")) {
+    return `${key} is a flow collection of the wrong kind`;
+  }
+  const items = inner.trim() === "" ? [] : inner.split(",").map((item) => item.trim());
+  const valid = isMap ? (item) => /^(?:'[^']*'|"[^"]*"|[^\s'"#-]\S*?):\s+[^{}[\],]+$/.test(item) : (item) => /^(?:'[^']*'|"[^"]*"|[^\s'"#{}[\],:-][^{}[\],:]*)$/.test(item);
+  if (items.some((item) => !valid(item)))
+    return `${key} is a flow collection this parser does not split`;
+  const block = items.map((item) => isMap ? `  ${item}` : `  - ${item}`);
+  return [...lines.slice(0, index), `${head}${comment ? ` ${comment}` : ""}`, ...block, ...lines.slice(index + 1)];
+}
+function topLevelKeyLine(key) {
+  return new RegExp(`^(['"]?)${key}\\1\\s*:(.*)$`);
+}
+function findBlock(lines, key) {
+  const keyLine = topLevelKeyLine(key);
+  const keyIndices = lines.flatMap((line, index) => keyLine.test(line) ? [index] : []);
+  const mentions = lines.filter((line) => !/^\s*#/.test(line) && new RegExp(`\\b${key}\\b`).test(line));
+  if (mentions.length > keyIndices.length)
+    return `${key} appears somewhere other than a top-level key`;
+  if (keyIndices.length === 0)
+    return void 0;
+  if (keyIndices.length > 1)
+    return `${key} appears more than once at the top level`;
+  const keyIndex = keyIndices[0];
+  const rest = (keyLine.exec(lines[keyIndex])?.[2] ?? "").replace(/\s+#.*$/, "").trim();
+  if (rest !== "")
+    return `${key} is not a block (found "${key}: ${rest}")`;
+  const entries = [];
+  for (let index = keyIndex + 1; index < lines.length; index++) {
+    const line = lines[index];
+    if (line.trim() === "" || /^\s*#/.test(line))
+      continue;
+    if (/^\S/.test(line)) {
+      if (line.startsWith("-"))
+        return `${key} uses a column-0 list`;
+      break;
+    }
+    entries.push(index);
+  }
+  if (entries.length > 0) {
+    const indent = leadingSpace(lines[entries[0]]);
+    if (entries.some((index) => leadingSpace(lines[index]) !== indent))
+      return `${key} has entries at more than one indentation`;
+  }
+  return { keyIndex, entries };
+}
+function insertionPoint(block) {
+  return (block.entries.length > 0 ? block.entries[block.entries.length - 1] : block.keyIndex) + 1;
+}
+function splitValue(raw) {
+  const match = /^('[^']*'|"[^"]*"|[^#]*?)\s*(#.*)?$/.exec(raw.trim());
+  return { value: match?.[1] ?? raw.trim(), comment: match?.[2] ?? "" };
+}
+function classify(value) {
+  if (/^(true|True|TRUE)$/.test(value))
+    return "allowed";
+  if (/^(false|False|FALSE)$/.test(value))
+    return "denied";
+  const unquoted = /^(['"])(.*)\1$/.exec(value)?.[2] ?? value;
+  if (unquoted === PENDING_PLACEHOLDER)
+    return "pending";
+  return "other";
+}
+function yamlPackageKey(name) {
+  return /^[a-z][a-z0-9._~-]*$/i.test(name) && !/^(true|false|null|yes|no|on|off|y|n)$/i.test(name) ? name : `'${name}'`;
+}
+function leadingSpace(line) {
+  return /^(\s*)/.exec(line)?.[1] ?? "";
+}
+function escapeRegExp(text) {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function missingFromLockfile(lockfileText, names) {
+  const installed = [];
+  let section = "";
+  for (const line of lockfileText.split(/\r?\n/)) {
+    if (/^\S/.test(line))
+      section = /^([A-Za-z]+):/.exec(line)?.[1] ?? "";
+    else if (section === "packages" || section === "snapshots")
+      installed.push(line);
+  }
+  const text = installed.join("\n");
+  return names.filter((name) => !new RegExp(`^ {2}(['"]?)/?${escapeRegExp(name)}@`, "m").test(text));
+}
+
+// src/generators/allow-builds/render.ts
+var ALLOW_BUILDS_LABEL = {
+  allowed: "already true",
+  denied: "false \u2192 true",
+  pending: "awaiting a decision \u2192 true",
+  other: "another value \u2192 true",
+  absent: "added (true)"
+};
+function renderAllowBuildsReport(report) {
+  const rebuild = `pnpm rebuild ${report.packages.join(" ")}`;
+  if (report.refused === void 0) {
+    const lines = [
+      `allow-builds \u2014 ${report.applied ? "applied" : "preview (nothing written)"}`,
+      "",
+      `pnpm-workspace.yaml \u203A ${report.target}`,
+      ...report.changes.map((change) => `  ${change.name}: ${label(report.target, change.previous)}`),
+      ""
+    ];
+    if (report.namesUnchecked) lines.push("The names were not checked: there is no pnpm-lock.yaml.", "");
+    if (report.applied) {
+      lines.push(`Running: ${rebuild}`);
+    } else {
+      lines.push(
+        `Then: ${rebuild}`,
+        "Allowing a build lets that package's install script run with your user's permissions.",
+        "",
+        `To apply: pnpm nx g @clearlydev/nx-archweave:allow-builds --packages=${report.packages.join(",")} --apply`
+      );
+    }
+    return lines.join("\n");
+  }
+  const head = "allow-builds \u2014 refused (nothing written)";
+  switch (report.refused) {
+    case "npm":
+      return [
+        head,
+        "This is an npm workspace: allow-builds edits pnpm settings only. npm runs dependency install scripts",
+        "itself unless ignore-scripts is set, so there is nothing to re-allow; npm 11 records an approval with",
+        `  npm install-scripts approve ${report.packages.join(" ")}`
+      ].join("\n");
+    case "yarn":
+      return [
+        head,
+        "This is a yarn workspace: allow-builds edits pnpm settings only. yarn classic runs dependency",
+        "install scripts itself; yarn berry runs them unless .yarnrc.yml sets enableScripts: false \u2014",
+        "remove that line (or set it to true) and run `yarn install` to let them run."
+      ].join("\n");
+    case "bun":
+      return [
+        head,
+        "This is a bun workspace: allow-builds edits pnpm settings only. bun blocks the install scripts of",
+        "dependencies outside its trusted list; `bun pm untrusted` lists the blocked ones, and",
+        `  bun pm trust ${report.packages.join(" ")}`,
+        "runs their scripts and records them in package.json trustedDependencies."
+      ].join("\n");
+    case "no-package-manager":
+      return [head, "There is no pnpm-lock.yaml or pnpm-workspace.yaml here \u2014 allow-builds edits pnpm settings only."].join("\n");
+    case "no-workspace-yaml":
+      return [
+        head,
+        "This pnpm project has no pnpm-workspace.yaml, where pnpm keeps its build decisions. Add one with",
+        "  allowBuilds:",
+        ...report.packages.map((name) => `    ${yamlPackageKey(name)}: true`),
+        `then run "${rebuild}".`
+      ].join("\n");
+    case "unknown-packages":
+      return [
+        head,
+        `These packages are not in pnpm-lock.yaml: ${report.unknown.join(", ")} \u2014 check the names; only an installed package has a build to run.`
+      ].join("\n");
+    case "unrecognized":
+      return [
+        head,
+        `pnpm-workspace.yaml is in a shape allow-builds does not edit: ${report.reason}.`,
+        `Instead, allow ${report.packages.join(", ")} in pnpm-workspace.yaml yourself \u2014 "<package>: true" under allowBuilds`,
+        `(pnpm 11; pnpm 10 from 10.28), or a "- <package>" item under onlyBuiltDependencies on older pnpm 10 \u2014 then run "${rebuild}".`
+      ].join("\n");
+  }
+}
+function label(target, previous) {
+  if (target === "allowBuilds") return ALLOW_BUILDS_LABEL[previous];
+  return previous === "allowed" ? "already listed" : "added to the list";
+}
+
+// src/generators/allow-builds/generator.ts
+var WORKSPACE_YAML = "pnpm-workspace.yaml";
+var LOCKFILE = "pnpm-lock.yaml";
+var MODULES_MANIFEST = "node_modules/.modules.yaml";
+var spawnPnpm = (args, cwd) => {
+  const spawnable = spawnableCommand("pnpm", args);
+  const result = spawnSync(spawnable.command, spawnable.args, {
+    cwd,
+    stdio: "inherit",
+    windowsVerbatimArguments: spawnable.windowsVerbatimArguments
+  });
+  return { status: result.status, error: result.error };
+};
+function runAllowBuilds(tree, options, deps = {}) {
+  const packages = [...new Set(options.packages.map((name) => name.trim()))];
+  const invalid = packages.filter((name) => !isPlainPackageName(name));
+  if (packages.length === 0 || invalid.length > 0) {
+    throw new Error(
+      `Expected npm package names (e.g. --packages=sharp,@swc/core)${invalid.length > 0 ? `; not a package name: ${invalid.map((name) => JSON.stringify(name)).join(", ")}` : ""}.`
+    );
+  }
+  const apply = (options.apply ?? false) && process.env["NX_DRY_RUN"] !== "true";
+  const pm = detectWorkspacePackageManager((path) => tree.exists(path), (path) => tree.read(path, "utf-8"));
+  if (pm === "npm") return { report: { packages, refused: "npm" } };
+  if (pm === "yarn") return { report: { packages, refused: "yarn" } };
+  if (pm === "bun") return { report: { packages, refused: "bun" } };
+  if (pm === null) return { report: { packages, refused: "no-package-manager" } };
+  const yaml = tree.read(WORKSPACE_YAML, "utf-8");
+  if (yaml === null) return { report: { packages, refused: "no-workspace-yaml" } };
+  const lockfile = tree.read(LOCKFILE, "utf-8");
+  const unknown = lockfile === null ? [] : missingFromLockfile(lockfile, packages);
+  if (unknown.length > 0) return { report: { packages, refused: "unknown-packages", unknown } };
+  const modules = tree.read(MODULES_MANIFEST, "utf-8");
+  const pnpmMajor = modules === null ? void 0 : pnpmMajorFromModulesManifest(modules);
+  const result = allowPackageBuilds(yaml, packages, { pnpmMajor });
+  if (result.status === "unrecognized") return { report: { packages, refused: "unrecognized", reason: result.reason } };
+  const report = {
+    packages,
+    target: result.target,
+    changes: result.changes,
+    applied: apply,
+    ...lockfile === null ? { namesUnchecked: true } : {}
+  };
+  if (!apply) return { report };
+  if (result.status === "updated") tree.write(WORKSPACE_YAML, result.text);
+  const exec = deps.exec ?? spawnPnpm;
+  const root = tree.root;
+  const callback = () => {
+    const args = ["rebuild", ...packages];
+    const command = `pnpm ${args.join(" ")}`;
+    const outcome = exec(args, root);
+    if (outcome.error) {
+      throw new Error(`"${command}" could not start: ${outcome.error.message}. ${WORKSPACE_YAML} already allows the build \u2014 run "${command}" yourself.`);
+    }
+    if (outcome.status !== 0) {
+      throw new Error(`"${command}" exited with ${outcome.status ?? "a signal"}. ${WORKSPACE_YAML} already allows the build \u2014 fix the cause above, then run "${command}" yourself.`);
+    }
+  };
+  return { report, callback };
+}
+async function allowBuildsGenerator(tree, options, deps = {}) {
+  const { report, callback } = runAllowBuilds(tree, options, deps);
+  console.log(renderAllowBuildsReport(report));
+  return callback;
+}
+var generator_default = allowBuildsGenerator;
+export {
+  allowBuildsGenerator,
+  generator_default as default,
+  runAllowBuilds
+};

package/dist/generators/allow-builds/render.js

@@ -0,0 +1,82 @@
+import { yamlPackageKey } from '@nx-archweave/template-engine';
+const ALLOW_BUILDS_LABEL = {
+    allowed: 'already true',
+    denied: 'false → true',
+    pending: 'awaiting a decision → true',
+    other: 'another value → true',
+    absent: 'added (true)',
+};
+export function renderAllowBuildsReport(report) {
+    const rebuild = `pnpm rebuild ${report.packages.join(' ')}`;
+    if (report.refused === undefined) {
+        const lines = [
+            `allow-builds — ${report.applied ? 'applied' : 'preview (nothing written)'}`,
+            '',
+            `pnpm-workspace.yaml › ${report.target}`,
+            ...report.changes.map((change) => `  ${change.name}: ${label(report.target, change.previous)}`),
+            '',
+        ];
+        if (report.namesUnchecked)
+            lines.push('The names were not checked: there is no pnpm-lock.yaml.', '');
+        if (report.applied) {
+            lines.push(`Running: ${rebuild}`);
+        }
+        else {
+            lines.push(`Then: ${rebuild}`, "Allowing a build lets that package's install script run with your user's permissions.", '', `To apply: pnpm nx g @clearlydev/nx-archweave:allow-builds --packages=${report.packages.join(',')} --apply`);
+        }
+        return lines.join('\n');
+    }
+    const head = 'allow-builds — refused (nothing written)';
+    switch (report.refused) {
+        case 'npm':
+            return [
+                head,
+                'This is an npm workspace: allow-builds edits pnpm settings only. npm runs dependency install scripts',
+                'itself unless ignore-scripts is set, so there is nothing to re-allow; npm 11 records an approval with',
+                `  npm install-scripts approve ${report.packages.join(' ')}`,
+            ].join('\n');
+        case 'yarn':
+            return [
+                head,
+                'This is a yarn workspace: allow-builds edits pnpm settings only. yarn classic runs dependency',
+                'install scripts itself; yarn berry runs them unless .yarnrc.yml sets enableScripts: false —',
+                'remove that line (or set it to true) and run `yarn install` to let them run.',
+            ].join('\n');
+        case 'bun':
+            return [
+                head,
+                'This is a bun workspace: allow-builds edits pnpm settings only. bun blocks the install scripts of',
+                'dependencies outside its trusted list; `bun pm untrusted` lists the blocked ones, and',
+                `  bun pm trust ${report.packages.join(' ')}`,
+                'runs their scripts and records them in package.json trustedDependencies.',
+            ].join('\n');
+        case 'no-package-manager':
+            return [head, 'There is no pnpm-lock.yaml or pnpm-workspace.yaml here — allow-builds edits pnpm settings only.'].join('\n');
+        case 'no-workspace-yaml':
+            return [
+                head,
+                'This pnpm project has no pnpm-workspace.yaml, where pnpm keeps its build decisions. Add one with',
+                '  allowBuilds:',
+                ...report.packages.map((name) => `    ${yamlPackageKey(name)}: true`),
+                `then run "${rebuild}".`,
+            ].join('\n');
+        case 'unknown-packages':
+            return [
+                head,
+                `These packages are not in pnpm-lock.yaml: ${report.unknown.join(', ')} — check the names; only an installed package has a build to run.`,
+            ].join('\n');
+        case 'unrecognized':
+            return [
+                head,
+                `pnpm-workspace.yaml is in a shape allow-builds does not edit: ${report.reason}.`,
+                `Instead, allow ${report.packages.join(', ')} in pnpm-workspace.yaml yourself — "<package>: true" under allowBuilds`,
+                `(pnpm 11; pnpm 10 from 10.28), or a "- <package>" item under onlyBuiltDependencies on older pnpm 10 — then run "${rebuild}".`,
+            ].join('\n');
+    }
+}
+function label(target, previous) {
+    if (target === 'allowBuilds')
+        return ALLOW_BUILDS_LABEL[previous];
+    // a list item is either there or not — denied / pending / other only exist in allowBuilds
+    return previous === 'allowed' ? 'already listed' : 'added to the list';
+}