@pnpm/exec.lifecycle 1001.0.25

package/LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2015-2016 Rico Sta. Cruz and other contributors
+Copyright (c) 2016-2026 Zoltan Kochan and other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,50 @@
+# @pnpm/lifecycle
+
+> Package lifecycle hook runner
+
+<!--@shields('npm')-->
+[![npm version](https://img.shields.io/npm/v/@pnpm/lifecycle.svg)](https://www.npmjs.com/package/@pnpm/lifecycle)
+<!--/@-->
+
+## Installation
+
+```sh
+pnpm add @pnpm/logger @pnpm/lifecycle
+```
+
+## Usage
+
+```ts
+import runLifecycleHook, {runPostinstallHooks} from '@pnpm/lifecycle'
+
+const targetPkgRoot = path.resolve('node_modules/target-pkg')
+const pkg = require(path.join(targetPkgRoot, 'package.json'))
+
+// Run a specific hook
+await runLifecycleHook('preinstall', pkg, {
+  pkgId: 'target-pkg/1.0.0',
+  pkgRoot: targetPkgRoot,
+  rawConfig: {},
+  rootModulesDir: path.resolve('node_modules'),
+  unsafePerm: true,
+})
+
+// Run all install hooks
+await runPostinstallHooks({
+  pkgId: 'target-pkg/1.0.0',
+  pkgRoot: targetPkgRoot,
+  rawConfig: {},
+  rootModulesDir: path.resolve('node_modules'),
+  unsafePerm: true,
+})
+```
+
+## API
+
+### `runLifecycleHook(stage, packageManifest, opts): Promise<void>`
+
+### `runPostinstallHooks(opts): Promise<void>`
+
+## License
+
+MIT

package/lib/index.d.ts

@@ -0,0 +1,7 @@
+import { runLifecycleHook, type RunLifecycleHookOptions } from './runLifecycleHook.js';
+import { runLifecycleHooksConcurrently, type RunLifecycleHooksConcurrentlyOptions } from './runLifecycleHooksConcurrently.js';
+export declare function makeNodeRequireOption(modulePath: string): {
+    NODE_OPTIONS: string;
+};
+export { runLifecycleHook, type RunLifecycleHookOptions, runLifecycleHooksConcurrently, type RunLifecycleHooksConcurrentlyOptions, };
+export declare function runPostinstallHooks(opts: RunLifecycleHookOptions): Promise<boolean>;

package/lib/index.js

@@ -0,0 +1,28 @@
+import { safeReadPackageJsonFromDir } from '@pnpm/pkg-manifest.reader';
+import { runLifecycleHook } from './runLifecycleHook.js';
+import { runLifecycleHooksConcurrently } from './runLifecycleHooksConcurrently.js';
+export function makeNodeRequireOption(modulePath) {
+    let { NODE_OPTIONS } = process.env;
+    NODE_OPTIONS = `${NODE_OPTIONS ?? ''} --require=${modulePath}`.trim();
+    return { NODE_OPTIONS };
+}
+export { runLifecycleHook, runLifecycleHooksConcurrently, };
+export async function runPostinstallHooks(opts) {
+    const pkg = await safeReadPackageJsonFromDir(opts.pkgRoot);
+    if (pkg == null)
+        return false;
+    if (pkg.scripts == null) {
+        pkg.scripts = {};
+    }
+    if (pkg.scripts.preinstall) {
+        await runLifecycleHook('preinstall', pkg, opts);
+    }
+    const executedAnInstallScript = await runLifecycleHook('install', pkg, opts);
+    if (pkg.scripts.postinstall) {
+        await runLifecycleHook('postinstall', pkg, opts);
+    }
+    return pkg.scripts.preinstall != null ||
+        executedAnInstallScript ||
+        pkg.scripts.postinstall != null;
+}
+//# sourceMappingURL=index.js.map

package/lib/runLifecycleHook.d.ts

@@ -0,0 +1,19 @@
+import type { DependencyManifest, ProjectManifest } from '@pnpm/types';
+export interface RunLifecycleHookOptions {
+    args?: string[];
+    depPath: string;
+    extraBinPaths?: string[];
+    extraEnv?: Record<string, string>;
+    initCwd?: string;
+    optional?: boolean;
+    pkgRoot: string;
+    rawConfig: object;
+    rootModulesDir: string;
+    scriptShell?: string;
+    silent?: boolean;
+    scriptsPrependNodePath?: boolean | 'warn-only';
+    shellEmulator?: boolean;
+    stdio?: string;
+    unsafePerm: boolean;
+}
+export declare function runLifecycleHook(stage: string, manifest: ProjectManifest | DependencyManifest, opts: RunLifecycleHookOptions): Promise<boolean>;

package/lib/runLifecycleHook.js

@@ -0,0 +1,166 @@
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { lifecycleLogger } from '@pnpm/core-loggers';
+import { PnpmError } from '@pnpm/error';
+import { globalWarn } from '@pnpm/logger';
+import lifecycle from '@pnpm/npm-lifecycle';
+import isWindows from 'is-windows';
+import { join as shellQuote } from 'shlex';
+function noop() { } // eslint-disable-line:no-empty
+export async function runLifecycleHook(stage, manifest, opts) {
+    const optional = opts.optional === true;
+    // To remediate CVE_2024_27980, Node.js does not allow .bat or .cmd files to
+    // be spawned without the "shell: true" option.
+    //
+    // https://nodejs.org/api/child_process.html#spawning-bat-and-cmd-files-on-windows
+    //
+    // Unfortunately, setting spawn's shell option also causes arguments to be
+    // evaluated before they're passed to the shell, resulting in a surprising
+    // behavior difference only with .bat/.cmd files.
+    //
+    // Instead of showing a "spawn EINVAL" error, let's throw a clearer error that
+    // this isn't supported.
+    //
+    // If this behavior needs to be supported in the future, the arguments would
+    // need to be escaped before they're passed to the .bat/.cmd file. For
+    // example, scripts such as "echo %PATH%" should be passed verbatim rather
+    // than expanded. This is difficult to do correctly. Other open source tools
+    // (e.g. Rust) attempted and introduced bugs. The Rust blog has a good
+    // high-level explanation of the same security vulnerability Node.js patched.
+    //
+    // https://blog.rust-lang.org/2024/04/09/cve-2024-24576.html#overview
+    //
+    // Note that npm (as of version 10.5.0) doesn't support setting script-shell
+    // to a .bat or .cmd file either.
+    if (opts.scriptShell != null && typeof opts.scriptShell === 'string' && isWindowsBatchFile(opts.scriptShell)) {
+        throw new PnpmError('ERR_PNPM_INVALID_SCRIPT_SHELL_WINDOWS', 'Cannot spawn .bat or .cmd as a script shell.', {
+            hint: `\
+The pnpm-workspace.yaml scriptShell option was configured to a .bat or .cmd file. These cannot be used as a script shell reliably.
+
+Please unset the scriptShell option, or configure it to a .exe instead.
+`,
+        });
+    }
+    const m = { _id: getId(manifest), ...manifest };
+    m.scripts = { ...m.scripts };
+    switch (stage) {
+        case 'start':
+            if (!m.scripts.start) {
+                if (!existsSync('server.js')) {
+                    throw new PnpmError('NO_SCRIPT_OR_SERVER', 'Missing script start or file server.js');
+                }
+                m.scripts.start = 'node server.js';
+            }
+            break;
+        case 'install':
+            if (!m.scripts.install && !m.scripts.preinstall) {
+                checkBindingGyp(opts.pkgRoot, m.scripts);
+            }
+            break;
+    }
+    if (opts.args?.length && m.scripts?.[stage]) {
+        // It is impossible to quote a command line argument that contains newline for Windows cmd.
+        const escapedArgs = isWindows()
+            ? opts.args.map((arg) => JSON.stringify(arg)).join(' ')
+            : shellQuote(opts.args);
+        m.scripts[stage] = `${m.scripts[stage]} ${escapedArgs}`;
+    }
+    // This script is used to prevent the usage of npm or Yarn.
+    // It does nothing, when pnpm is used, so we may skip its execution.
+    if (m.scripts[stage] === 'npx only-allow pnpm' || !m.scripts[stage])
+        return false;
+    if (opts.stdio !== 'inherit') {
+        lifecycleLogger.debug({
+            depPath: opts.depPath,
+            optional,
+            script: m.scripts[stage],
+            stage,
+            wd: opts.pkgRoot,
+        });
+    }
+    const logLevel = (opts.stdio !== 'inherit' || opts.silent)
+        ? 'silent'
+        : undefined;
+    await lifecycle(m, stage, opts.pkgRoot, {
+        config: {
+            ...opts.rawConfig,
+            'frozen-lockfile': false,
+        },
+        dir: opts.rootModulesDir,
+        extraBinPaths: opts.extraBinPaths,
+        extraEnv: {
+            ...opts.extraEnv,
+            INIT_CWD: opts.initCwd ?? process.cwd(),
+            PNPM_SCRIPT_SRC_DIR: opts.pkgRoot,
+        },
+        log: {
+            clearProgress: noop,
+            info: noop,
+            level: logLevel,
+            pause: noop,
+            resume: noop,
+            showProgress: noop,
+            silly: npmLog,
+            verbose: npmLog,
+            warn: (...msg) => {
+                globalWarn(msg.join(' '));
+            },
+        },
+        runConcurrently: true,
+        scriptsPrependNodePath: opts.scriptsPrependNodePath,
+        scriptShell: opts.scriptShell,
+        shellEmulator: opts.shellEmulator,
+        stdio: opts.stdio ?? 'pipe',
+        unsafePerm: opts.unsafePerm,
+    });
+    return true;
+    function npmLog(prefix, logId, stdtype, line) {
+        switch (stdtype) {
+            case 'stdout':
+            case 'stderr':
+                lifecycleLogger.debug({
+                    depPath: opts.depPath,
+                    line: (line ?? 0).toString(),
+                    stage,
+                    stdio: stdtype,
+                    wd: opts.pkgRoot,
+                });
+                return;
+            case 'Returned: code:': {
+                if (opts.stdio === 'inherit') {
+                    // Preventing the pnpm reporter from overriding the project's script output
+                    return;
+                }
+                const code = line ?? 1;
+                lifecycleLogger.debug({
+                    depPath: opts.depPath,
+                    exitCode: code,
+                    optional,
+                    stage,
+                    wd: opts.pkgRoot,
+                });
+            }
+        }
+    }
+}
+/**
+ * Run node-gyp when binding.gyp is available. Only do this when there are no
+ * `install` and `preinstall` scripts (see `npm help scripts`).
+ */
+function checkBindingGyp(root, scripts) {
+    if (existsSync(path.join(root, 'binding.gyp'))) {
+        scripts.install = 'node-gyp rebuild';
+    }
+}
+function getId(manifest) {
+    return `${manifest.name ?? ''}@${manifest.version ?? ''}`;
+}
+function isWindowsBatchFile(scriptShell) {
+    // Node.js performs a similar check to determine whether it should throw
+    // EINVAL when spawning a .cmd/.bat file.
+    //
+    // https://github.com/nodejs/node/commit/6627222409#diff-1e725bfa950eda4d4b5c0c00a2bb6be3e5b83d819872a1adf2ef87c658273903
+    const scriptShellLower = scriptShell.toLowerCase();
+    return isWindows() && (scriptShellLower.endsWith('.cmd') || scriptShellLower.endsWith('.bat'));
+}
+//# sourceMappingURL=runLifecycleHook.js.map

package/lib/runLifecycleHooksConcurrently.d.ts

@@ -0,0 +1,18 @@
+import type { StoreController } from '@pnpm/store.controller-types';
+import type { ProjectManifest, ProjectRootDir } from '@pnpm/types';
+import { type RunLifecycleHookOptions } from './runLifecycleHook.js';
+export type RunLifecycleHooksConcurrentlyOptions = Omit<RunLifecycleHookOptions, 'depPath' | 'pkgRoot' | 'rootModulesDir'> & {
+    resolveSymlinksInInjectedDirs?: boolean;
+    storeController: StoreController;
+    extraNodePaths?: string[];
+    preferSymlinkedExecutables?: boolean;
+};
+export interface Importer {
+    buildIndex: number;
+    manifest: ProjectManifest;
+    rootDir: ProjectRootDir;
+    modulesDir: string;
+    stages?: string[];
+    targetDirs?: string[];
+}
+export declare function runLifecycleHooksConcurrently(stages: string[], importers: Importer[], childConcurrency: number, opts: RunLifecycleHooksConcurrentlyOptions): Promise<void>;

package/lib/runLifecycleHooksConcurrently.js

@@ -0,0 +1,84 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { linkBins } from '@pnpm/bins.linker';
+import { fetchFromDir } from '@pnpm/fetching.directory-fetcher';
+import { logger } from '@pnpm/logger';
+import { runGroups } from 'run-groups';
+import { runLifecycleHook } from './runLifecycleHook.js';
+export async function runLifecycleHooksConcurrently(stages, importers, childConcurrency, opts) {
+    const importersByBuildIndex = new Map();
+    for (const importer of importers) {
+        if (!importersByBuildIndex.has(importer.buildIndex)) {
+            importersByBuildIndex.set(importer.buildIndex, [importer]);
+        }
+        else {
+            importersByBuildIndex.get(importer.buildIndex).push(importer);
+        }
+    }
+    const sortedBuildIndexes = Array.from(importersByBuildIndex.keys()).sort((a, b) => a - b);
+    const groups = sortedBuildIndexes.map((buildIndex) => {
+        const importers = importersByBuildIndex.get(buildIndex);
+        return importers.map(({ manifest, modulesDir, rootDir, stages: importerStages, targetDirs }) => async () => {
+            // We are linking the bin files, in case they were created by lifecycle scripts of other workspace packages.
+            await linkBins(modulesDir, path.join(modulesDir, '.bin'), {
+                extraNodePaths: opts.extraNodePaths,
+                allowExoticManifests: true,
+                preferSymlinkedExecutables: opts.preferSymlinkedExecutables,
+                projectManifest: manifest,
+                warn: (message) => {
+                    logger.warn({ message, prefix: rootDir });
+                },
+            });
+            const runLifecycleHookOpts = {
+                ...opts,
+                depPath: rootDir,
+                pkgRoot: rootDir,
+                rootModulesDir: modulesDir,
+            };
+            let isBuilt = false;
+            for (const stage of (importerStages ?? stages)) {
+                if (await runLifecycleHook(stage, manifest, runLifecycleHookOpts)) { // eslint-disable-line no-await-in-loop
+                    isBuilt = true;
+                }
+            }
+            if (targetDirs == null || targetDirs.length === 0 || !isBuilt)
+                return;
+            const filesResponse = await fetchFromDir(rootDir, { resolveSymlinks: opts.resolveSymlinksInInjectedDirs });
+            await Promise.all(targetDirs.map(async (targetDir) => {
+                const targetModulesDir = path.join(targetDir, 'node_modules');
+                const newFilesMap = new Map(filesResponse.filesMap);
+                if (fs.existsSync(targetModulesDir)) {
+                    // If the target directory contains a node_modules directory
+                    // (it may happen when the hoisted node linker is used)
+                    // then we need to preserve this node_modules.
+                    // So we scan this node_modules directory and  pass it as part of the new package.
+                    await scanDir('node_modules', targetModulesDir, targetModulesDir, newFilesMap);
+                }
+                return opts.storeController.importPackage(targetDir, {
+                    filesResponse: {
+                        resolvedFrom: 'local-dir',
+                        ...filesResponse,
+                        filesMap: newFilesMap,
+                    },
+                    force: false,
+                });
+            }));
+        });
+    });
+    await runGroups(childConcurrency, groups);
+}
+async function scanDir(prefix, rootDir, currentDir, index) {
+    const files = await fs.promises.readdir(currentDir);
+    await Promise.all(files.map(async (file) => {
+        const fullPath = path.join(currentDir, file);
+        const stat = await fs.promises.stat(fullPath);
+        if (stat.isDirectory()) {
+            return scanDir(prefix, rootDir, fullPath, index);
+        }
+        if (stat.isFile()) {
+            const relativePath = path.relative(rootDir, fullPath);
+            index.set(path.join(prefix, relativePath), fullPath);
+        }
+    }));
+}
+//# sourceMappingURL=runLifecycleHooksConcurrently.js.map

package/package.json

@@ -0,0 +1,69 @@
+{
+  "name": "@pnpm/exec.lifecycle",
+  "version": "1001.0.25",
+  "description": "Package lifecycle hook runner",
+  "keywords": [
+    "pnpm",
+    "pnpm11",
+    "lifecycle",
+    "scripts"
+  ],
+  "license": "MIT",
+  "funding": "https://opencollective.com/pnpm",
+  "repository": "https://github.com/pnpm/pnpm/tree/main/exec/lifecycle",
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/exec/lifecycle#readme",
+  "bugs": {
+    "url": "https://github.com/pnpm/pnpm/issues"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": "./lib/index.js"
+  },
+  "files": [
+    "lib",
+    "!*.map"
+  ],
+  "dependencies": {
+    "@pnpm/npm-lifecycle": "^1001.0.0",
+    "is-windows": "^1.0.2",
+    "path-exists": "^5.0.0",
+    "run-groups": "^5.0.0",
+    "shlex": "^3.0.0",
+    "@pnpm/core-loggers": "1001.0.4",
+    "@pnpm/bins.linker": "1000.2.6",
+    "@pnpm/fetching.directory-fetcher": "1000.1.14",
+    "@pnpm/error": "1000.0.5",
+    "@pnpm/store.cafs-types": "1000.0.0",
+    "@pnpm/store.controller-types": "1004.1.0",
+    "@pnpm/types": "1000.9.0",
+    "@pnpm/pkg-manifest.reader": "1000.1.2"
+  },
+  "peerDependencies": {
+    "@pnpm/logger": ">=1001.0.0 <1002.0.0"
+  },
+  "devDependencies": {
+    "@types/is-windows": "^1.0.2",
+    "@zkochan/rimraf": "^4.0.0",
+    "load-json-file": "^7.0.1",
+    "@pnpm/prepare": "1000.0.4",
+    "@pnpm/exec.lifecycle": "1001.0.25",
+    "@pnpm/test-fixtures": "1000.0.0",
+    "@pnpm/test-ipc-server": "1000.0.0",
+    "@pnpm/logger": "1001.0.1"
+  },
+  "engines": {
+    "node": ">=22.13"
+  },
+  "jest": {
+    "preset": "@pnpm/jest-config"
+  },
+  "scripts": {
+    "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",
+    "_test": "cross-env NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest",
+    "test": "pnpm run compile && pnpm run _test",
+    "fix": "tslint -c tslint.json src/**/*.ts test/**/*.ts --fix",
+    "compile": "tsgo --build && pnpm run lint --fix"
+  }
+}