@pnpm/building.policy 1100.0.7 → 1100.0.9

package/lib/index.d.ts

@@ -4,3 +4,9 @@ export declare function createAllowBuildFunction(opts: {
     dangerouslyAllowAllBuilds?: boolean;
     allowBuilds?: Record<string, boolean | string>;
 }): undefined | AllowBuild;
+/**
+ * The `allowBuilds` key under which an ignored build should be approved:
+ * the package name for registry packages, the peer-suffix-free depPath for
+ * git/tarball artifacts, whose name alone must not approve builds.
+ */
+export declare function allowBuildKeyFromIgnoredBuild(depPath: DepPath): string;

package/lib/index.js

@@ -1,37 +1,62 @@
 import { expandPackageVersionSpecs } from '@pnpm/config.version-policy';
 import * as dp from '@pnpm/deps.path';
 export function isBuildExplicitlyDisallowed(depPath, allowBuild) {
-    if (!allowBuild)
-        return false;
-    const { name, version } = dp.parse(depPath);
-    if (!name || !version)
-        return false;
-    return allowBuild(name, version) === false;
+    return allowBuild?.(depPath) === false;
 }
 export function createAllowBuildFunction(opts) {
     if (opts.dangerouslyAllowAllBuilds)
         return () => true;
     if (opts.allowBuilds != null) {
-        const allowedBuilds = new Set();
-        const disallowedBuilds = new Set();
+        const allowedPackageBuilds = new Set();
+        const disallowedPackageBuilds = new Set();
+        const allowedDepPathBuilds = new Set();
+        const disallowedDepPathBuilds = new Set();
         for (const [pkg, value] of Object.entries(opts.allowBuilds)) {
             switch (value) {
                 case true:
-                    allowedBuilds.add(pkg);
+                    addAllowBuildRule(pkg, {
+                        depPaths: allowedDepPathBuilds,
+                        packageSpecs: allowedPackageBuilds,
+                    });
                     break;
                 case false:
-                    disallowedBuilds.add(pkg);
+                    addAllowBuildRule(pkg, {
+                        depPaths: disallowedDepPathBuilds,
+                        packageSpecs: disallowedPackageBuilds,
+                    });
                     break;
             }
         }
-        const expandedAllowed = expandPackageVersionSpecs(Array.from(allowedBuilds));
-        const expandedDisallowed = expandPackageVersionSpecs(Array.from(disallowedBuilds));
-        return (pkgName, version) => {
-            const pkgWithVersion = `${pkgName}@${version}`;
-            if (expandedDisallowed.has(pkgName) || expandedDisallowed.has(pkgWithVersion)) {
+        const expandedAllowed = expandPackageVersionSpecs(Array.from(allowedPackageBuilds));
+        const expandedDisallowed = expandPackageVersionSpecs(Array.from(disallowedPackageBuilds));
+        return (depPath, context) => {
+            const pkgIdWithPatchHash = dp.getPkgIdWithPatchHash(depPath);
+            if (disallowedDepPathBuilds.has(pkgIdWithPatchHash)) {
+                return false;
+            }
+            const { name, version, nonSemverVersion } = dp.parse(depPath);
+            const nameAtVersion = name != null && version != null ? `${name}@${version}` : undefined;
+            if ((name != null && expandedDisallowed.has(name)) ||
+                (nameAtVersion != null && expandedDisallowed.has(nameAtVersion))) {
                 return false;
             }
-            if (expandedAllowed.has(pkgName) || expandedAllowed.has(pkgWithVersion)) {
+            if (allowedDepPathBuilds.has(pkgIdWithPatchHash)) {
+                return true;
+            }
+            // Package-name rules require a trusted package identity. A
+            // registry-style depPath (name@semver) is the trust signal: the
+            // lockfile verification gate rejects lockfiles where such a key is
+            // backed by a non-registry resolution, so by the time scripts can
+            // run, the shape proves the artifact came from a registry. The
+            // override exists for callers that must evaluate name rules under
+            // legacy semantics (e.g. comparing against a policy recorded before
+            // identity trust existed).
+            const trustPackageIdentity = context?.trustPackageIdentity ??
+                (name != null && version != null && nonSemverVersion == null);
+            if (!trustPackageIdentity)
+                return undefined;
+            if ((name != null && expandedAllowed.has(name)) ||
+                (nameAtVersion != null && expandedAllowed.has(nameAtVersion))) {
                 return true;
             }
             return undefined;
@@ -39,4 +64,39 @@ export function createAllowBuildFunction(opts) {
     }
     return undefined;
 }
+/**
+ * The `allowBuilds` key under which an ignored build should be approved:
+ * the package name for registry packages, the peer-suffix-free depPath for
+ * git/tarball artifacts, whose name alone must not approve builds.
+ */
+export function allowBuildKeyFromIgnoredBuild(depPath) {
+    const pkgIdWithPatchHash = dp.getPkgIdWithPatchHash(depPath);
+    const parsed = dp.parse(pkgIdWithPatchHash);
+    if (parsed.nonSemverVersion != null || parsed.name == null)
+        return pkgIdWithPatchHash;
+    return parsed.name;
+}
+function addAllowBuildRule(pkg, target) {
+    if (isDepPathAllowBuildKey(pkg)) {
+        target.depPaths.add(dp.removePeersSuffix(pkg));
+    }
+    else {
+        target.packageSpecs.add(pkg);
+    }
+}
+function isDepPathAllowBuildKey(pkg) {
+    if (dp.removePeersSuffix(pkg) !== pkg)
+        return true;
+    if (pkg.includes('||'))
+        return false;
+    const parsed = dp.parse(pkg);
+    if (parsed.nonSemverVersion != null)
+        return isSourceLikeDepPathVersion(parsed.nonSemverVersion);
+    if (parsed.name != null || pkg.startsWith('@'))
+        return false;
+    return pkg.includes('/') || pkg.includes(':');
+}
+function isSourceLikeDepPathVersion(version) {
+    return version.includes(':') || version.includes('/') || version.includes('#');
+}
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/building.policy",
-  "version": "1100.0.7",
+  "version": "1100.0.9",
   "description": "Create a function for filtering out dependencies that are not allowed to be built",
   "keywords": [
     "pnpm",
@@ -8,7 +8,10 @@
   ],
   "license": "MIT",
   "funding": "https://opencollective.com/pnpm",
-  "repository": "https://github.com/pnpm/pnpm/tree/main/building/policy",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/pnpm/pnpm/tree/main/building/policy"
+  },
   "homepage": "https://github.com/pnpm/pnpm/tree/main/building/policy#readme",
   "bugs": {
     "url": "https://github.com/pnpm/pnpm/issues"
@@ -24,13 +27,13 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/deps.path": "1100.0.5",
-    "@pnpm/types": "1101.2.0",
-    "@pnpm/config.version-policy": "1100.1.2"
+    "@pnpm/deps.path": "1100.0.7",
+    "@pnpm/types": "1101.3.1",
+    "@pnpm/config.version-policy": "1100.1.4"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
-    "@pnpm/building.policy": "1100.0.7"
+    "@pnpm/building.policy": "1100.0.9"
   },
   "engines": {
     "node": ">=22.13"