@pnpm/exec.prepare-package 1000.0.26

package/LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2015-2016 Rico Sta. Cruz and other contributors
+Copyright (c) 2016-2026 Zoltan Kochan and other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,15 @@
+# @pnpm/prepare-package
+
+> Prepares a Git-hosted package
+
+[![npm version](https://img.shields.io/npm/v/@pnpm/prepare-package.svg)](https://www.npmjs.com/package/@pnpm/prepare-package)
+
+## Installation
+
+```sh
+pnpm add @pnpm/prepare-package
+```
+
+## License
+
+MIT

package/lib/index.d.ts

@@ -0,0 +1,11 @@
+import type { AllowBuild } from '@pnpm/types';
+export interface PreparePackageOptions {
+    allowBuild?: AllowBuild;
+    ignoreScripts?: boolean;
+    rawConfig: Record<string, unknown>;
+    unsafePerm?: boolean;
+}
+export declare function preparePackage(opts: PreparePackageOptions, gitRootDir: string, subDir: string): Promise<{
+    shouldBeBuilt: boolean;
+    pkgDir: string;
+}>;

package/lib/index.js

@@ -0,0 +1,98 @@
+import assert from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import util from 'node:util';
+import { PnpmError } from '@pnpm/error';
+import { runLifecycleHook } from '@pnpm/exec.lifecycle';
+import { safeReadPackageJsonFromDir } from '@pnpm/pkg-manifest.reader';
+import { rimraf } from '@zkochan/rimraf';
+import { preferredPM } from 'preferred-pm';
+import { omit } from 'ramda';
+// We don't run prepublishOnly to prepare the dependency.
+// This might be counterintuitive as prepublishOnly is where a lot of packages put their build scripts.
+// However, neither npm nor Yarn run prepublishOnly of git-hosted dependencies (checked on npm v10 and Yarn v3).
+const PREPUBLISH_SCRIPTS = [
+    'prepublish',
+    'prepack',
+    'publish',
+];
+export async function preparePackage(opts, gitRootDir, subDir) {
+    const pkgDir = safeJoinPath(gitRootDir, subDir);
+    const manifest = await safeReadPackageJsonFromDir(pkgDir);
+    if (manifest?.scripts == null || !packageShouldBeBuilt(manifest, pkgDir))
+        return { shouldBeBuilt: false, pkgDir };
+    if (opts.ignoreScripts)
+        return { shouldBeBuilt: true, pkgDir };
+    // Check if the package is allowed to run build scripts
+    // If allowBuild is undefined or returns false, block the build
+    if (!opts.allowBuild?.(manifest.name, manifest.version)) {
+        throw new PnpmError('GIT_DEP_PREPARE_NOT_ALLOWED', `The git-hosted package "${manifest.name}@${manifest.version}" needs to execute build scripts but is not in the "allowBuilds" allowlist.`, {
+            hint: `Add the package to "allowBuilds" in your project's pnpm-workspace.yaml to allow it to run scripts. For example:
+allowBuilds:
+  ${manifest.name}: true`,
+        });
+    }
+    const pm = (await preferredPM(gitRootDir))?.name ?? 'npm';
+    const execOpts = {
+        depPath: `${manifest.name}@${manifest.version}`,
+        pkgRoot: pkgDir,
+        // We can't prepare a package without running its lifecycle scripts.
+        // An alternative solution could be to throw an exception.
+        rawConfig: omit(['ignore-scripts'], opts.rawConfig),
+        rootModulesDir: pkgDir, // We don't need this property but there is currently no way to not set it.
+        unsafePerm: Boolean(opts.unsafePerm),
+    };
+    try {
+        const installScriptName = `${pm}-install`;
+        manifest.scripts[installScriptName] = `${pm} install`;
+        await runLifecycleHook(installScriptName, manifest, execOpts);
+        for (const scriptName of PREPUBLISH_SCRIPTS) {
+            if (manifest.scripts[scriptName] == null || manifest.scripts[scriptName] === '')
+                continue;
+            let newScriptName;
+            if (pm !== 'pnpm') {
+                newScriptName = `${pm}-run-${scriptName}`;
+                manifest.scripts[newScriptName] = `${pm} run ${scriptName}`;
+            }
+            else {
+                newScriptName = scriptName;
+            }
+            // eslint-disable-next-line no-await-in-loop
+            await runLifecycleHook(newScriptName, manifest, execOpts);
+        }
+    }
+    catch (err) {
+        assert(util.types.isNativeError(err));
+        Object.assign(err, {
+            code: 'ERR_PNPM_PREPARE_PACKAGE',
+        });
+        throw err;
+    }
+    await rimraf(path.join(pkgDir, 'node_modules'));
+    return { shouldBeBuilt: true, pkgDir };
+}
+function packageShouldBeBuilt(manifest, pkgDir) {
+    if (manifest.scripts == null)
+        return false;
+    const scripts = manifest.scripts;
+    if (scripts.prepare != null && scripts.prepare !== '')
+        return true;
+    const hasPrepublishScript = PREPUBLISH_SCRIPTS.some((scriptName) => scripts[scriptName] != null && scripts[scriptName] !== '');
+    if (!hasPrepublishScript)
+        return false;
+    const mainFile = manifest.main ?? 'index.js';
+    return !fs.existsSync(path.join(pkgDir, mainFile));
+}
+function safeJoinPath(root, sub) {
+    const joined = path.join(root, sub);
+    // prevent the dir traversal attack
+    const relative = path.relative(root, joined);
+    if (relative.startsWith('..')) {
+        throw new PnpmError('INVALID_PATH', `Path "${sub}" should be a sub directory`);
+    }
+    if (!fs.existsSync(joined) || !fs.lstatSync(joined).isDirectory()) {
+        throw new PnpmError('INVALID_PATH', `Path "${sub}" is not a directory`);
+    }
+    return joined;
+}
+//# sourceMappingURL=index.js.map

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "@pnpm/exec.prepare-package",
+  "version": "1000.0.26",
+  "description": "Prepares a Git-hosted package",
+  "keywords": [
+    "pnpm",
+    "pnpm11"
+  ],
+  "license": "MIT",
+  "funding": "https://opencollective.com/pnpm",
+  "repository": "https://github.com/pnpm/pnpm/tree/main/exec/prepare-package",
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/exec/prepare-package#readme",
+  "bugs": {
+    "url": "https://github.com/pnpm/pnpm/issues"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": "./lib/index.js"
+  },
+  "files": [
+    "lib",
+    "!*.map"
+  ],
+  "dependencies": {
+    "@zkochan/rimraf": "^4.0.0",
+    "execa": "npm:safe-execa@0.3.0",
+    "preferred-pm": "^5.0.0",
+    "ramda": "npm:@pnpm/ramda@0.28.1",
+    "@pnpm/error": "1000.0.5",
+    "@pnpm/exec.lifecycle": "1001.0.25",
+    "@pnpm/types": "1000.9.0",
+    "@pnpm/pkg-manifest.reader": "1000.1.2"
+  },
+  "devDependencies": {
+    "@types/ramda": "0.29.12",
+    "load-json-file": "^7.0.1",
+    "@pnpm/exec.prepare-package": "1000.0.26",
+    "@pnpm/prepare": "1000.0.4",
+    "@pnpm/test-fixtures": "1000.0.0",
+    "@pnpm/test-ipc-server": "1000.0.0"
+  },
+  "engines": {
+    "node": ">=22.13"
+  },
+  "jest": {
+    "preset": "@pnpm/jest-config"
+  },
+  "scripts": {
+    "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",
+    "test": "pnpm run compile && pnpm run _test",
+    "compile": "tsgo --build && pnpm run lint --fix",
+    "_test": "cross-env NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest"
+  }
+}