@mercury-fw/cli 0.28.0 → 0.28.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @mercury-fw/cli
 
+## 0.28.1
+
+### Patch Changes
+
+- ab52977: An app created with the Google Chat channel trusts `protobufjs` in `trustedDependencies`, so its install no longer reports that package's postinstall as blocked. The channel's README says to do the same when adding it by hand.
+  - @mercury-fw/core@0.28.1
+
 ## 0.28.0
 
 ### Minor Changes

package/dist/src/catalog.d.ts

@@ -22,6 +22,9 @@ export type CatalogEntry = {
     env: EnvVar[];
     formatter?: FormatterExample;
     credentials?: CliCredentials;
+    /** Dependencies whose install scripts Bun must run for this entry (Bun runs
+     * none it isn't told to trust), on top of a tool plugin's own package. */
+    trusts?: string[];
 };
 /** Where a tool plugin's CLI keeps its login: `folder` under the CLI user's
  * `~/.config`, and the env variable that carries that folder into the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mercury-fw/cli",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "type": "module",
   "license": "MIT",
   "repository": {
@@ -36,13 +36,13 @@
   "comment:shape": "The Mercury CLI (`mfw`). `mfw create <dir>` writes a new Mercury app from the template. The framework packages move in lockstep with it, so a new app gets them at the CLI's own version; plugins and channels at the registry's latest. The plugin and channel packages are devDependencies only for the catalog test. `main(argv)` is exported for create-mercury-agent.",
   "dependencies": {
     "@clack/prompts": "^1.8.1",
-    "@mercury-fw/core": "0.28.0",
+    "@mercury-fw/core": "0.28.1",
     "commander": "^15.0.0"
   },
   "devDependencies": {
-    "@mercury-fw/channel-google-chat": "0.1.1",
+    "@mercury-fw/channel-google-chat": "0.1.2",
     "@mercury-fw/channel-http": "0.1.0",
-    "@mercury-fw/formatter": "0.28.0",
+    "@mercury-fw/formatter": "0.28.1",
     "@mercury-fw/plugin-atlassian-admin": "0.1.0",
     "@mercury-fw/plugin-bitbucket": "0.1.0",
     "@mercury-fw/plugin-jira": "0.1.0",

package/src/catalog.ts

@@ -20,6 +20,9 @@ export type CatalogEntry = {
   env: EnvVar[];
   formatter?: FormatterExample;
   credentials?: CliCredentials;
+  /** Dependencies whose install scripts Bun must run for this entry (Bun runs
+   * none it isn't told to trust), on top of a tool plugin's own package. */
+  trusts?: string[];
 };
 
 /** Where a tool plugin's CLI keeps its login: `folder` under the CLI user's
@@ -41,6 +44,9 @@ export const CATALOG: CatalogEntry[] = [
     kind: "channel",
     package: "@mercury-fw/channel-google-chat",
     exportName: "googleChatChannel",
+    // Pulled in by @google-cloud/pubsub; its postinstall only checks how
+    // dependents spell its version range.
+    trusts: ["protobufjs"],
     env: [
       {
         name: "GOOGLE_CHAT_PUBSUB_SUBSCRIPTION",

package/src/render.ts

@@ -279,8 +279,9 @@ function renderPackageJson(
     // the framework the app depends on.
     devDependencies: { "@mercury-fw/cli": `^${cli}`, "@types/bun": "^1.4.0", typescript: "^6.0.3" },
   };
-  if (tools.length > 0) {
-    manifest.trustedDependencies = tools.map((t) => t.package).sort();
+  const trusted = [...new Set([...tools.map((t) => t.package), ...[...channels, ...tools].flatMap((e) => e.trusts ?? [])])];
+  if (trusted.length > 0) {
+    manifest.trustedDependencies = trusted.sort();
   }
   return `${JSON.stringify(manifest, null, 2)}\n`;
 }