@servicetitan/install 36.2.0 → 36.3.1

package/dist/package-manager/npm-package-manager.d.ts

@@ -3,6 +3,8 @@ import type { DeclaredVersionQuery, InstallArgs, ResolvedVersionQuery } from './
 import { PackageManager } from './package-manager';
 interface NpmLockFileEntry {
     version?: string;
+    resolved?: string;
+    link?: boolean;
     dependencies?: Record<string, string>;
     peerDependencies?: Record<string, string>;
 }
@@ -22,6 +24,8 @@ export declare class NpmPackageManager extends PackageManager<NpmLockFile> {
      * to the hoisted root entry. `workspacePackage` is the package's relative
      * path from the repo root; the empty string `''` denotes the root
      * workspace package itself, matching npm's own lockfile key convention.
+     * Follows link entries to the resolved workspace package, so callers see
+     * the workspace package's own metadata rather than the symlink stub.
      */
     private findEntry;
     private runRebuild;

package/dist/package-manager/npm-package-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"npm-package-manager.d.ts","sourceRoot":"","sources":["../../src/package-manager/npm-package-manager.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,UAAU,EAA+B,MAAM,UAAU,CAAC;AACzE,OAAO,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAQnD,UAAU,gBAAgB;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC/C;AAED,qBAAa,iBAAkB,SAAQ,cAAc,CAAC,WAAW,CAAC;IAC9D,QAAQ,CAAC,OAAO,SAAS;IACzB,QAAQ,CAAC,YAAY,uBAAuB;IAE5C,UAAU;IAIV,kBAAkB,CAAC,EACf,gBAAgB,EAChB,UAAU,EACV,UAAU,GACb,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAK5C,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAI9F,eAAe,CAAC,IAAI,GAAE,WAAgB,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IA6DlF,SAAS,CAAC,aAAa,IAAI,WAAW,GAAG,SAAS;IAQlD;;;;;OAKG;IACH,OAAO,CAAC,SAAS;IAcjB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,qBAAqB;CAOhC"}
+{"version":3,"file":"npm-package-manager.d.ts","sourceRoot":"","sources":["../../src/package-manager/npm-package-manager.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,UAAU,EAA+B,MAAM,UAAU,CAAC;AACzE,OAAO,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAQnD,UAAU,gBAAgB;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC/C;AAED,qBAAa,iBAAkB,SAAQ,cAAc,CAAC,WAAW,CAAC;IAC9D,QAAQ,CAAC,OAAO,SAAS;IACzB,QAAQ,CAAC,YAAY,uBAAuB;IAE5C,UAAU;IAIV,kBAAkB,CAAC,EACf,gBAAgB,EAChB,UAAU,EACV,UAAU,GACb,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAK5C,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAI9F,eAAe,CAAC,IAAI,GAAE,WAAgB,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IA6DlF,SAAS,CAAC,aAAa,IAAI,WAAW,GAAG,SAAS;IAYlD;;;;;;;OAOG;IACH,OAAO,CAAC,SAAS;IAiBjB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,qBAAqB;CAOhC"}

package/dist/package-manager/npm-package-manager.js

@@ -32,7 +32,7 @@ function _interop_require_default(obj) {
 }
 class NpmPackageManager extends _packagemanager.PackageManager {
     clearCache() {
-        (0, _utils.runCommand)('npm', [
+        (0, _utils.runCommand)(this.command, [
             'cache',
             'clear',
             '--force'
@@ -63,7 +63,7 @@ class NpmPackageManager extends _packagemanager.PackageManager {
         if (!args.quiet) {
             (0, _utils1.logAllowedScripts)(allowScripts);
         }
-        (0, _utils.runCommand)('npm', [
+        (0, _utils.runCommand)(this.command, [
             (0, _utils.isCI)() ? 'ci' : 'i',
             '--audit=false',
             '--fund=false',
@@ -108,8 +108,12 @@ class NpmPackageManager extends _packagemanager.PackageManager {
         }
     }
     parseLockFile() {
+        const lockFilePath = this.findLockFilePath();
+        if (!lockFilePath) {
+            return undefined;
+        }
         try {
-            return JSON.parse(_fs.default.readFileSync(this.lockFileName, 'utf-8'));
+            return JSON.parse(_fs.default.readFileSync(lockFilePath, 'utf-8'));
         } catch (unused) {
             return undefined;
         }
@@ -119,15 +123,21 @@ class NpmPackageManager extends _packagemanager.PackageManager {
      * to the hoisted root entry. `workspacePackage` is the package's relative
      * path from the repo root; the empty string `''` denotes the root
      * workspace package itself, matching npm's own lockfile key convention.
+     * Follows link entries to the resolved workspace package, so callers see
+     * the workspace package's own metadata rather than the symlink stub.
      */ findEntry({ workspacePackage, package: packageName }) {
         var _ref;
         var _this_getLockFile;
         const packages = (_this_getLockFile = this.getLockFile()) === null || _this_getLockFile === void 0 ? void 0 : _this_getLockFile.packages;
-        return (_ref = packages === null || packages === void 0 ? void 0 : packages[`${workspacePackage}/node_modules/${packageName}`]) !== null && _ref !== void 0 ? _ref : packages === null || packages === void 0 ? void 0 : packages[`node_modules/${packageName}`];
+        const entry = (_ref = packages === null || packages === void 0 ? void 0 : packages[`${workspacePackage}/node_modules/${packageName}`]) !== null && _ref !== void 0 ? _ref : packages === null || packages === void 0 ? void 0 : packages[`node_modules/${packageName}`];
+        if ((entry === null || entry === void 0 ? void 0 : entry.link) && entry.resolved) {
+            return packages === null || packages === void 0 ? void 0 : packages[entry.resolved];
+        }
+        return entry;
     }
     runRebuild(scripts) {
         try {
-            (0, _utils.runCommand)('npm', [
+            (0, _utils.runCommand)(this.command, [
                 'rebuild',
                 ...scripts
             ]);
@@ -138,7 +148,7 @@ class NpmPackageManager extends _packagemanager.PackageManager {
     }
     runProjectPostinstall(options) {
         try {
-            (0, _utils.runCommand)('npm', [
+            (0, _utils.runCommand)(this.command, [
                 'run',
                 'postinstall',
                 '--if-present'

package/dist/package-manager/npm-package-manager.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/package-manager/npm-package-manager.ts"],"sourcesContent":["/* eslint-disable no-console */\nimport fs from 'fs';\nimport { isCI, runCommand, warnUntrustedInstallScripts } from '../utils';\nimport type { DeclaredVersionQuery, InstallArgs, ResolvedVersionQuery } from './package-manager';\nimport { PackageManager } from './package-manager';\nimport {\n    DEFAULT_ALLOWED_SCRIPTS,\n    logAllowedScripts,\n    resolveAllowScripts,\n    shouldIgnoreScripts,\n} from './utils';\n\ninterface NpmLockFileEntry {\n    version?: string;\n    dependencies?: Record<string, string>;\n    peerDependencies?: Record<string, string>;\n}\n\nexport interface NpmLockFile {\n    packages?: Record<string, NpmLockFileEntry>;\n}\n\nexport class NpmPackageManager extends PackageManager<NpmLockFile> {\n    readonly command = 'npm';\n    readonly lockFileName = 'package-lock.json';\n\n    clearCache() {\n        runCommand('npm', ['cache', 'clear', '--force']);\n    }\n\n    getDeclaredVersion({\n        workspacePackage,\n        declaredBy,\n        dependency,\n    }: DeclaredVersionQuery): string | undefined {\n        const entry = this.findEntry({ workspacePackage, package: declaredBy });\n        return entry?.dependencies?.[dependency] ?? entry?.peerDependencies?.[dependency];\n    }\n\n    getResolvedVersion({ workspacePackage, dependency }: ResolvedVersionQuery): string | undefined {\n        return this.findEntry({ workspacePackage, package: dependency })?.version;\n    }\n\n    installPackages(args: InstallArgs = {}, options?: Parameters<typeof runCommand>[2]) {\n        /*\n         * The `true` fallback allows projects a grace period to identify and\n         * allowlist trusted scripts. Remove the fallback when the grace period expires.\n         */\n        const allowScripts = resolveAllowScripts(args.allowScripts ?? true);\n\n        if (!args.quiet) {\n            logAllowedScripts(allowScripts);\n        }\n\n        runCommand(\n            'npm',\n            [\n                isCI() ? 'ci' : 'i',\n                '--audit=false',\n                '--fund=false',\n                '--legacy-peer-deps',\n                ...(shouldIgnoreScripts(allowScripts) ? ['--ignore-scripts'] : []),\n                ...(args.fix ? ['--package-lock-only', '--prefer-dedupe'] : []),\n            ],\n            options\n        );\n\n        try {\n            if (args.fix) {\n                return;\n            }\n            /*\n             * Rebuild applies when allowScripts is an explicit list:\n             * `true` means npm install already ran every script, `false`\n             * means the user opted out.\n             */\n            if (Array.isArray(allowScripts)) {\n                this.runRebuild(allowScripts);\n            }\n            /*\n             * Warn against the effective allowlist so teams can see which\n             * scripts they should add to --allow-scripts. Skip when the user\n             * explicitly opted out (`false`); they made an informed choice.\n             */\n            if (allowScripts !== false) {\n                warnUntrustedInstallScripts(\n                    Array.isArray(allowScripts) ? allowScripts : DEFAULT_ALLOWED_SCRIPTS,\n                    this.lockFileName,\n                    { force: true }\n                );\n            }\n            /*\n             * When allowScripts is `true`, npm already ran project postinstall.\n             * In other cases, we run it manually. Note, `false` only ignores\n             * package scripts, the project postinstall is always trusted.\n             */\n            if (allowScripts !== true) {\n                this.runProjectPostinstall(options);\n            }\n        } finally {\n            this.reset();\n        }\n    }\n\n    protected parseLockFile(): NpmLockFile | undefined {\n        try {\n            return JSON.parse(fs.readFileSync(this.lockFileName, 'utf-8'));\n        } catch {\n            return undefined;\n        }\n    }\n\n    /**\n     * Looks up a lockfile entry for the given workspace package, falling back\n     * to the hoisted root entry. `workspacePackage` is the package's relative\n     * path from the repo root; the empty string `''` denotes the root\n     * workspace package itself, matching npm's own lockfile key convention.\n     */\n    private findEntry({\n        workspacePackage,\n        package: packageName,\n    }: {\n        workspacePackage: string;\n        package: string;\n    }): NpmLockFileEntry | undefined {\n        const packages = this.getLockFile()?.packages;\n        return (\n            packages?.[`${workspacePackage}/node_modules/${packageName}`] ??\n            packages?.[`node_modules/${packageName}`]\n        );\n    }\n\n    private runRebuild(scripts: string[]) {\n        try {\n            runCommand('npm', ['rebuild', ...scripts]);\n        } catch {\n            console.error(`Failed to run allowed scripts: ${scripts.join(', ')}`);\n            process.exitCode = 1;\n        }\n    }\n\n    private runProjectPostinstall(options?: Parameters<typeof runCommand>[2]) {\n        try {\n            runCommand('npm', ['run', 'postinstall', '--if-present'], options);\n        } catch {\n            process.exitCode = 1;\n        }\n    }\n}\n"],"names":["NpmPackageManager","PackageManager","clearCache","runCommand","getDeclaredVersion","workspacePackage","declaredBy","dependency","entry","findEntry","package","dependencies","peerDependencies","getResolvedVersion","version","installPackages","args","options","allowScripts","resolveAllowScripts","quiet","logAllowedScripts","isCI","shouldIgnoreScripts","fix","Array","isArray","runRebuild","warnUntrustedInstallScripts","DEFAULT_ALLOWED_SCRIPTS","lockFileName","force","runProjectPostinstall","reset","parseLockFile","JSON","parse","fs","readFileSync","undefined","packageName","packages","getLockFile","scripts","console","error","join","process","exitCode","command"],"mappings":"AAAA,6BAA6B;;;;+BAsBhBA;;;eAAAA;;;2DArBE;uBAC+C;gCAE/B;wBAMxB;;;;;;;;;;;;;;;;;;;AAYA,MAAMA,0BAA0BC,8BAAc;IAIjDC,aAAa;QACTC,IAAAA,iBAAU,EAAC,OAAO;YAAC;YAAS;YAAS;SAAU;IACnD;IAEAC,mBAAmB,EACfC,gBAAgB,EAChBC,UAAU,EACVC,UAAU,EACS,EAAsB;;YAElCC,qBAAqCA;QAD5C,MAAMA,QAAQ,IAAI,CAACC,SAAS,CAAC;YAAEJ;YAAkBK,SAASJ;QAAW;QACrE,eAAOE,kBAAAA,6BAAAA,sBAAAA,MAAOG,YAAY,cAAnBH,0CAAAA,mBAAqB,CAACD,WAAW,uCAAIC,kBAAAA,6BAAAA,0BAAAA,MAAOI,gBAAgB,cAAvBJ,8CAAAA,uBAAyB,CAACD,WAAW;IACrF;IAEAM,mBAAmB,EAAER,gBAAgB,EAAEE,UAAU,EAAwB,EAAsB;YACpF;QAAP,QAAO,kBAAA,IAAI,CAACE,SAAS,CAAC;YAAEJ;YAAkBK,SAASH;QAAW,gBAAvD,sCAAA,gBAA2DO,OAAO;IAC7E;IAEAC,gBAAgBC,OAAoB,CAAC,CAAC,EAAEC,OAA0C,EAAE;YAKvCD;QAJzC;;;SAGC,GACD,MAAME,eAAeC,IAAAA,2BAAmB,GAACH,qBAAAA,KAAKE,YAAY,cAAjBF,gCAAAA,qBAAqB;QAE9D,IAAI,CAACA,KAAKI,KAAK,EAAE;YACbC,IAAAA,yBAAiB,EAACH;QACtB;QAEAf,IAAAA,iBAAU,EACN,OACA;YACImB,IAAAA,WAAI,MAAK,OAAO;YAChB;YACA;YACA;eACIC,IAAAA,2BAAmB,EAACL,gBAAgB;gBAAC;aAAmB,GAAG,EAAE;eAC7DF,KAAKQ,GAAG,GAAG;gBAAC;gBAAuB;aAAkB,GAAG,EAAE;SACjE,EACDP;QAGJ,IAAI;YACA,IAAID,KAAKQ,GAAG,EAAE;gBACV;YACJ;YACA;;;;aAIC,GACD,IAAIC,MAAMC,OAAO,CAACR,eAAe;gBAC7B,IAAI,CAACS,UAAU,CAACT;YACpB;YACA;;;;aAIC,GACD,IAAIA,iBAAiB,OAAO;gBACxBU,IAAAA,kCAA2B,EACvBH,MAAMC,OAAO,CAACR,gBAAgBA,eAAeW,+BAAuB,EACpE,IAAI,CAACC,YAAY,EACjB;oBAAEC,OAAO;gBAAK;YAEtB;YACA;;;;aAIC,GACD,IAAIb,iBAAiB,MAAM;gBACvB,IAAI,CAACc,qBAAqB,CAACf;YAC/B;QACJ,SAAU;YACN,IAAI,CAACgB,KAAK;QACd;IACJ;IAEUC,gBAAyC;QAC/C,IAAI;YACA,OAAOC,KAAKC,KAAK,CAACC,WAAE,CAACC,YAAY,CAAC,IAAI,CAACR,YAAY,EAAE;QACzD,EAAE,eAAM;YACJ,OAAOS;QACX;IACJ;IAEA;;;;;KAKC,GACD,AAAQ9B,UAAU,EACdJ,gBAAgB,EAChBK,SAAS8B,WAAW,EAIvB,EAAgC;;YACZ;QAAjB,MAAMC,YAAW,oBAAA,IAAI,CAACC,WAAW,gBAAhB,wCAAA,kBAAoBD,QAAQ;QAC7C,eACIA,qBAAAA,+BAAAA,QAAU,CAAC,GAAGpC,iBAAiB,cAAc,EAAEmC,aAAa,CAAC,uCAC7DC,qBAAAA,+BAAAA,QAAU,CAAC,CAAC,aAAa,EAAED,aAAa,CAAC;IAEjD;IAEQb,WAAWgB,OAAiB,EAAE;QAClC,IAAI;YACAxC,IAAAA,iBAAU,EAAC,OAAO;gBAAC;mBAAcwC;aAAQ;QAC7C,EAAE,eAAM;YACJC,QAAQC,KAAK,CAAC,CAAC,+BAA+B,EAAEF,QAAQG,IAAI,CAAC,OAAO;YACpEC,QAAQC,QAAQ,GAAG;QACvB;IACJ;IAEQhB,sBAAsBf,OAA0C,EAAE;QACtE,IAAI;YACAd,IAAAA,iBAAU,EAAC,OAAO;gBAAC;gBAAO;gBAAe;aAAe,EAAEc;QAC9D,EAAE,eAAM;YACJ8B,QAAQC,QAAQ,GAAG;QACvB;IACJ;;QA7HG,gBACH,uBAASC,WAAU,QACnB,uBAASnB,gBAAe;;AA4H5B"}
+{"version":3,"sources":["../../src/package-manager/npm-package-manager.ts"],"sourcesContent":["/* eslint-disable no-console */\nimport fs from 'fs';\nimport { isCI, runCommand, warnUntrustedInstallScripts } from '../utils';\nimport type { DeclaredVersionQuery, InstallArgs, ResolvedVersionQuery } from './package-manager';\nimport { PackageManager } from './package-manager';\nimport {\n    DEFAULT_ALLOWED_SCRIPTS,\n    logAllowedScripts,\n    resolveAllowScripts,\n    shouldIgnoreScripts,\n} from './utils';\n\ninterface NpmLockFileEntry {\n    version?: string;\n    resolved?: string;\n    link?: boolean;\n    dependencies?: Record<string, string>;\n    peerDependencies?: Record<string, string>;\n}\n\nexport interface NpmLockFile {\n    packages?: Record<string, NpmLockFileEntry>;\n}\n\nexport class NpmPackageManager extends PackageManager<NpmLockFile> {\n    readonly command = 'npm';\n    readonly lockFileName = 'package-lock.json';\n\n    clearCache() {\n        runCommand(this.command, ['cache', 'clear', '--force']);\n    }\n\n    getDeclaredVersion({\n        workspacePackage,\n        declaredBy,\n        dependency,\n    }: DeclaredVersionQuery): string | undefined {\n        const entry = this.findEntry({ workspacePackage, package: declaredBy });\n        return entry?.dependencies?.[dependency] ?? entry?.peerDependencies?.[dependency];\n    }\n\n    getResolvedVersion({ workspacePackage, dependency }: ResolvedVersionQuery): string | undefined {\n        return this.findEntry({ workspacePackage, package: dependency })?.version;\n    }\n\n    installPackages(args: InstallArgs = {}, options?: Parameters<typeof runCommand>[2]) {\n        /*\n         * The `true` fallback allows projects a grace period to identify and\n         * allowlist trusted scripts. Remove the fallback when the grace period expires.\n         */\n        const allowScripts = resolveAllowScripts(args.allowScripts ?? true);\n\n        if (!args.quiet) {\n            logAllowedScripts(allowScripts);\n        }\n\n        runCommand(\n            this.command,\n            [\n                isCI() ? 'ci' : 'i',\n                '--audit=false',\n                '--fund=false',\n                '--legacy-peer-deps',\n                ...(shouldIgnoreScripts(allowScripts) ? ['--ignore-scripts'] : []),\n                ...(args.fix ? ['--package-lock-only', '--prefer-dedupe'] : []),\n            ],\n            options\n        );\n\n        try {\n            if (args.fix) {\n                return;\n            }\n            /*\n             * Rebuild applies when allowScripts is an explicit list:\n             * `true` means npm install already ran every script, `false`\n             * means the user opted out.\n             */\n            if (Array.isArray(allowScripts)) {\n                this.runRebuild(allowScripts);\n            }\n            /*\n             * Warn against the effective allowlist so teams can see which\n             * scripts they should add to --allow-scripts. Skip when the user\n             * explicitly opted out (`false`); they made an informed choice.\n             */\n            if (allowScripts !== false) {\n                warnUntrustedInstallScripts(\n                    Array.isArray(allowScripts) ? allowScripts : DEFAULT_ALLOWED_SCRIPTS,\n                    this.lockFileName,\n                    { force: true }\n                );\n            }\n            /*\n             * When allowScripts is `true`, npm already ran project postinstall.\n             * In other cases, we run it manually. Note, `false` only ignores\n             * package scripts, the project postinstall is always trusted.\n             */\n            if (allowScripts !== true) {\n                this.runProjectPostinstall(options);\n            }\n        } finally {\n            this.reset();\n        }\n    }\n\n    protected parseLockFile(): NpmLockFile | undefined {\n        const lockFilePath = this.findLockFilePath();\n        if (!lockFilePath) {\n            return undefined;\n        }\n        try {\n            return JSON.parse(fs.readFileSync(lockFilePath, 'utf-8'));\n        } catch {\n            return undefined;\n        }\n    }\n\n    /**\n     * Looks up a lockfile entry for the given workspace package, falling back\n     * to the hoisted root entry. `workspacePackage` is the package's relative\n     * path from the repo root; the empty string `''` denotes the root\n     * workspace package itself, matching npm's own lockfile key convention.\n     * Follows link entries to the resolved workspace package, so callers see\n     * the workspace package's own metadata rather than the symlink stub.\n     */\n    private findEntry({\n        workspacePackage,\n        package: packageName,\n    }: {\n        workspacePackage: string;\n        package: string;\n    }): NpmLockFileEntry | undefined {\n        const packages = this.getLockFile()?.packages;\n        const entry =\n            packages?.[`${workspacePackage}/node_modules/${packageName}`] ??\n            packages?.[`node_modules/${packageName}`];\n        if (entry?.link && entry.resolved) {\n            return packages?.[entry.resolved];\n        }\n        return entry;\n    }\n\n    private runRebuild(scripts: string[]) {\n        try {\n            runCommand(this.command, ['rebuild', ...scripts]);\n        } catch {\n            console.error(`Failed to run allowed scripts: ${scripts.join(', ')}`);\n            process.exitCode = 1;\n        }\n    }\n\n    private runProjectPostinstall(options?: Parameters<typeof runCommand>[2]) {\n        try {\n            runCommand(this.command, ['run', 'postinstall', '--if-present'], options);\n        } catch {\n            process.exitCode = 1;\n        }\n    }\n}\n"],"names":["NpmPackageManager","PackageManager","clearCache","runCommand","command","getDeclaredVersion","workspacePackage","declaredBy","dependency","entry","findEntry","package","dependencies","peerDependencies","getResolvedVersion","version","installPackages","args","options","allowScripts","resolveAllowScripts","quiet","logAllowedScripts","isCI","shouldIgnoreScripts","fix","Array","isArray","runRebuild","warnUntrustedInstallScripts","DEFAULT_ALLOWED_SCRIPTS","lockFileName","force","runProjectPostinstall","reset","parseLockFile","lockFilePath","findLockFilePath","undefined","JSON","parse","fs","readFileSync","packageName","packages","getLockFile","link","resolved","scripts","console","error","join","process","exitCode"],"mappings":"AAAA,6BAA6B;;;;+BAwBhBA;;;eAAAA;;;2DAvBE;uBAC+C;gCAE/B;wBAMxB;;;;;;;;;;;;;;;;;;;AAcA,MAAMA,0BAA0BC,8BAAc;IAIjDC,aAAa;QACTC,IAAAA,iBAAU,EAAC,IAAI,CAACC,OAAO,EAAE;YAAC;YAAS;YAAS;SAAU;IAC1D;IAEAC,mBAAmB,EACfC,gBAAgB,EAChBC,UAAU,EACVC,UAAU,EACS,EAAsB;;YAElCC,qBAAqCA;QAD5C,MAAMA,QAAQ,IAAI,CAACC,SAAS,CAAC;YAAEJ;YAAkBK,SAASJ;QAAW;QACrE,eAAOE,kBAAAA,6BAAAA,sBAAAA,MAAOG,YAAY,cAAnBH,0CAAAA,mBAAqB,CAACD,WAAW,uCAAIC,kBAAAA,6BAAAA,0BAAAA,MAAOI,gBAAgB,cAAvBJ,8CAAAA,uBAAyB,CAACD,WAAW;IACrF;IAEAM,mBAAmB,EAAER,gBAAgB,EAAEE,UAAU,EAAwB,EAAsB;YACpF;QAAP,QAAO,kBAAA,IAAI,CAACE,SAAS,CAAC;YAAEJ;YAAkBK,SAASH;QAAW,gBAAvD,sCAAA,gBAA2DO,OAAO;IAC7E;IAEAC,gBAAgBC,OAAoB,CAAC,CAAC,EAAEC,OAA0C,EAAE;YAKvCD;QAJzC;;;SAGC,GACD,MAAME,eAAeC,IAAAA,2BAAmB,GAACH,qBAAAA,KAAKE,YAAY,cAAjBF,gCAAAA,qBAAqB;QAE9D,IAAI,CAACA,KAAKI,KAAK,EAAE;YACbC,IAAAA,yBAAiB,EAACH;QACtB;QAEAhB,IAAAA,iBAAU,EACN,IAAI,CAACC,OAAO,EACZ;YACImB,IAAAA,WAAI,MAAK,OAAO;YAChB;YACA;YACA;eACIC,IAAAA,2BAAmB,EAACL,gBAAgB;gBAAC;aAAmB,GAAG,EAAE;eAC7DF,KAAKQ,GAAG,GAAG;gBAAC;gBAAuB;aAAkB,GAAG,EAAE;SACjE,EACDP;QAGJ,IAAI;YACA,IAAID,KAAKQ,GAAG,EAAE;gBACV;YACJ;YACA;;;;aAIC,GACD,IAAIC,MAAMC,OAAO,CAACR,eAAe;gBAC7B,IAAI,CAACS,UAAU,CAACT;YACpB;YACA;;;;aAIC,GACD,IAAIA,iBAAiB,OAAO;gBACxBU,IAAAA,kCAA2B,EACvBH,MAAMC,OAAO,CAACR,gBAAgBA,eAAeW,+BAAuB,EACpE,IAAI,CAACC,YAAY,EACjB;oBAAEC,OAAO;gBAAK;YAEtB;YACA;;;;aAIC,GACD,IAAIb,iBAAiB,MAAM;gBACvB,IAAI,CAACc,qBAAqB,CAACf;YAC/B;QACJ,SAAU;YACN,IAAI,CAACgB,KAAK;QACd;IACJ;IAEUC,gBAAyC;QAC/C,MAAMC,eAAe,IAAI,CAACC,gBAAgB;QAC1C,IAAI,CAACD,cAAc;YACf,OAAOE;QACX;QACA,IAAI;YACA,OAAOC,KAAKC,KAAK,CAACC,WAAE,CAACC,YAAY,CAACN,cAAc;QACpD,EAAE,eAAM;YACJ,OAAOE;QACX;IACJ;IAEA;;;;;;;KAOC,GACD,AAAQ5B,UAAU,EACdJ,gBAAgB,EAChBK,SAASgC,WAAW,EAIvB,EAAgC;;YACZ;QAAjB,MAAMC,YAAW,oBAAA,IAAI,CAACC,WAAW,gBAAhB,wCAAA,kBAAoBD,QAAQ;QAC7C,MAAMnC,gBACFmC,qBAAAA,+BAAAA,QAAU,CAAC,GAAGtC,iBAAiB,cAAc,EAAEqC,aAAa,CAAC,uCAC7DC,qBAAAA,+BAAAA,QAAU,CAAC,CAAC,aAAa,EAAED,aAAa,CAAC;QAC7C,IAAIlC,CAAAA,kBAAAA,4BAAAA,MAAOqC,IAAI,KAAIrC,MAAMsC,QAAQ,EAAE;YAC/B,OAAOH,qBAAAA,+BAAAA,QAAU,CAACnC,MAAMsC,QAAQ,CAAC;QACrC;QACA,OAAOtC;IACX;IAEQmB,WAAWoB,OAAiB,EAAE;QAClC,IAAI;YACA7C,IAAAA,iBAAU,EAAC,IAAI,CAACC,OAAO,EAAE;gBAAC;mBAAc4C;aAAQ;QACpD,EAAE,eAAM;YACJC,QAAQC,KAAK,CAAC,CAAC,+BAA+B,EAAEF,QAAQG,IAAI,CAAC,OAAO;YACpEC,QAAQC,QAAQ,GAAG;QACvB;IACJ;IAEQpB,sBAAsBf,OAA0C,EAAE;QACtE,IAAI;YACAf,IAAAA,iBAAU,EAAC,IAAI,CAACC,OAAO,EAAE;gBAAC;gBAAO;gBAAe;aAAe,EAAEc;QACrE,EAAE,eAAM;YACJkC,QAAQC,QAAQ,GAAG;QACvB;IACJ;;QAtIG,gBACH,uBAASjD,WAAU,QACnB,uBAAS2B,gBAAe;;AAqI5B"}

package/dist/package-manager/package-manager.d.ts

@@ -19,8 +19,16 @@ export declare abstract class PackageManager<LockFile = unknown> {
     abstract readonly command: string;
     abstract readonly lockFileName: string;
     hasValidLockFile(): boolean;
+    /**
+     * Returns the lockfile key for a package given its absolute or
+     * cwd-relative directory. Both npm and pnpm key their lockfile entries
+     * by the package's path relative to the workspace root.
+     */
+    getWorkspacePackage(packageDir?: string): string;
     protected getLockFile(): LockFile | undefined;
     protected reset(): void;
+    protected findLockFilePath(): string | undefined;
+    protected get rootWorkspacePackage(): string;
     abstract clearCache(): void;
     abstract getDeclaredVersion(query: DeclaredVersionQuery): string | undefined;
     abstract getResolvedVersion(query: ResolvedVersionQuery): string | undefined;

package/dist/package-manager/package-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"package-manager.d.ts","sourceRoot":"","sources":["../../src/package-manager/package-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEtC,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC;AAEnD,MAAM,WAAW,WAAW;IACxB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACjC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACjC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,8BAAsB,cAAc,CAAC,QAAQ,GAAG,OAAO;;IACnD,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAKvC,gBAAgB,IAAI,OAAO;IAI3B,SAAS,CAAC,WAAW,IAAI,QAAQ,GAAG,SAAS;IAQ7C,SAAS,CAAC,KAAK;IAKf,QAAQ,CAAC,UAAU,IAAI,IAAI;IAC3B,QAAQ,CAAC,kBAAkB,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAC5E,QAAQ,CAAC,kBAAkB,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAC5E,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI;IAE9F,SAAS,CAAC,QAAQ,CAAC,aAAa,IAAI,QAAQ,GAAG,SAAS;CAC3D"}
+{"version":3,"file":"package-manager.d.ts","sourceRoot":"","sources":["../../src/package-manager/package-manager.ts"],"names":[],"mappings":"AAEA,OAAO,EAAU,UAAU,EAAE,MAAM,UAAU,CAAC;AAE9C,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC;AAEnD,MAAM,WAAW,WAAW;IACxB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACjC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACjC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,8BAAsB,cAAc,CAAC,QAAQ,GAAG,OAAO;;IACnD,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAKvC,gBAAgB,IAAI,OAAO;IAI3B;;;;OAIG;IACH,mBAAmB,CAAC,UAAU,SAAgB,GAAG,MAAM;IAYvD,SAAS,CAAC,WAAW,IAAI,QAAQ,GAAG,SAAS;IAQ7C,SAAS,CAAC,KAAK;IAKf,SAAS,CAAC,gBAAgB,IAAI,MAAM,GAAG,SAAS;IAOhD,SAAS,KAAK,oBAAoB,IAAI,MAAM,CAE3C;IAED,QAAQ,CAAC,UAAU,IAAI,IAAI;IAC3B,QAAQ,CAAC,kBAAkB,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAC5E,QAAQ,CAAC,kBAAkB,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAC5E,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI;IAE9F,SAAS,CAAC,QAAQ,CAAC,aAAa,IAAI,QAAQ,GAAG,SAAS;CAC3D"}

package/dist/package-manager/package-manager.js

@@ -8,6 +8,9 @@ Object.defineProperty(exports, "PackageManager", {
         return PackageManager;
     }
 });
+const _nodefs = /*#__PURE__*/ _interop_require_default(require("node:fs"));
+const _nodepath = /*#__PURE__*/ _interop_require_default(require("node:path"));
+const _utils = require("../utils");
 function _check_private_redeclaration(obj, privateCollection) {
     if (privateCollection.has(obj)) {
         throw new TypeError("Cannot initialize the same private elements twice on an object");
@@ -48,11 +51,28 @@ function _class_private_field_set(receiver, privateMap, value) {
     _class_apply_descriptor_set(receiver, descriptor, value);
     return value;
 }
+function _interop_require_default(obj) {
+    return obj && obj.__esModule ? obj : {
+        default: obj
+    };
+}
 var _lockFile = /*#__PURE__*/ new WeakMap(), _lockFileLoaded = /*#__PURE__*/ new WeakMap();
 class PackageManager {
     hasValidLockFile() {
         return this.getLockFile() !== undefined;
     }
+    /**
+     * Returns the lockfile key for a package given its absolute or
+     * cwd-relative directory. Both npm and pnpm key their lockfile entries
+     * by the package's path relative to the workspace root.
+     */ getWorkspacePackage(packageDir = process.cwd()) {
+        const lockFilePath = this.findLockFilePath();
+        if (!lockFilePath) {
+            return this.rootWorkspacePackage;
+        }
+        const relative = _nodepath.default.relative(_nodepath.default.dirname(lockFilePath), _nodepath.default.resolve(packageDir)).split(_nodepath.default.sep).join('/');
+        return relative === '' ? this.rootWorkspacePackage : relative;
+    }
     getLockFile() {
         if (!_class_private_field_get(this, _lockFileLoaded)) {
             _class_private_field_set(this, _lockFile, this.parseLockFile());
@@ -64,6 +84,15 @@ class PackageManager {
         _class_private_field_set(this, _lockFile, undefined);
         _class_private_field_set(this, _lockFileLoaded, false);
     }
+    findLockFilePath() {
+        return (0, _utils.findUp)((directory)=>{
+            const candidate = _nodepath.default.join(directory, this.lockFileName);
+            return _nodefs.default.existsSync(candidate) ? candidate : undefined;
+        });
+    }
+    get rootWorkspacePackage() {
+        return '';
+    }
     constructor(){
         _class_private_field_init(this, _lockFile, {
             writable: true,

package/dist/package-manager/package-manager.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/package-manager/package-manager.ts"],"sourcesContent":["import { runCommand } from '../utils';\n\nexport type AllowScripts = true | false | string[];\n\nexport interface InstallArgs {\n    allowScripts?: AllowScripts;\n    fix?: boolean;\n    quiet?: boolean;\n}\n\nexport interface DeclaredVersionQuery {\n    workspacePackage: string;\n    declaredBy: string;\n    dependency: string;\n}\n\nexport interface ResolvedVersionQuery {\n    workspacePackage: string;\n    dependency: string;\n}\n\nexport abstract class PackageManager<LockFile = unknown> {\n    abstract readonly command: string;\n    abstract readonly lockFileName: string;\n\n    #lockFile: LockFile | undefined;\n    #lockFileLoaded = false;\n\n    hasValidLockFile(): boolean {\n        return this.getLockFile() !== undefined;\n    }\n\n    protected getLockFile(): LockFile | undefined {\n        if (!this.#lockFileLoaded) {\n            this.#lockFile = this.parseLockFile();\n            this.#lockFileLoaded = true;\n        }\n        return this.#lockFile;\n    }\n\n    protected reset() {\n        this.#lockFile = undefined;\n        this.#lockFileLoaded = false;\n    }\n\n    abstract clearCache(): void;\n    abstract getDeclaredVersion(query: DeclaredVersionQuery): string | undefined;\n    abstract getResolvedVersion(query: ResolvedVersionQuery): string | undefined;\n    abstract installPackages(args?: InstallArgs, options?: Parameters<typeof runCommand>[2]): void;\n\n    protected abstract parseLockFile(): LockFile | undefined;\n}\n"],"names":["PackageManager","hasValidLockFile","getLockFile","undefined","parseLockFile","reset"],"mappings":";;;;+BAqBsBA;;;eAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAIlB,yCACA;AALG,MAAeA;IAOlBC,mBAA4B;QACxB,OAAO,IAAI,CAACC,WAAW,OAAOC;IAClC;IAEUD,cAAoC;QAC1C,IAAI,0BAAC,IAAI,EAAC,kBAAiB;2CAClB,WAAY,IAAI,CAACE,aAAa;2CAC9B,iBAAkB;QAC3B;QACA,gCAAO,IAAI,EAAC;IAChB;IAEUC,QAAQ;uCACT,WAAYF;uCACZ,iBAAkB;IAC3B;;QAlBA,gCAAA;;mBAAA,KAAA;;QACA,gCAAA;;mBAAkB;;;AAyBtB"}
+{"version":3,"sources":["../../src/package-manager/package-manager.ts"],"sourcesContent":["import fs from 'node:fs';\nimport path from 'node:path';\nimport { findUp, runCommand } from '../utils';\n\nexport type AllowScripts = true | false | string[];\n\nexport interface InstallArgs {\n    allowScripts?: AllowScripts;\n    fix?: boolean;\n    quiet?: boolean;\n}\n\nexport interface DeclaredVersionQuery {\n    workspacePackage: string;\n    declaredBy: string;\n    dependency: string;\n}\n\nexport interface ResolvedVersionQuery {\n    workspacePackage: string;\n    dependency: string;\n}\n\nexport abstract class PackageManager<LockFile = unknown> {\n    abstract readonly command: string;\n    abstract readonly lockFileName: string;\n\n    #lockFile: LockFile | undefined;\n    #lockFileLoaded = false;\n\n    hasValidLockFile(): boolean {\n        return this.getLockFile() !== undefined;\n    }\n\n    /**\n     * Returns the lockfile key for a package given its absolute or\n     * cwd-relative directory. Both npm and pnpm key their lockfile entries\n     * by the package's path relative to the workspace root.\n     */\n    getWorkspacePackage(packageDir = process.cwd()): string {\n        const lockFilePath = this.findLockFilePath();\n        if (!lockFilePath) {\n            return this.rootWorkspacePackage;\n        }\n        const relative = path\n            .relative(path.dirname(lockFilePath), path.resolve(packageDir))\n            .split(path.sep)\n            .join('/');\n        return relative === '' ? this.rootWorkspacePackage : relative;\n    }\n\n    protected getLockFile(): LockFile | undefined {\n        if (!this.#lockFileLoaded) {\n            this.#lockFile = this.parseLockFile();\n            this.#lockFileLoaded = true;\n        }\n        return this.#lockFile;\n    }\n\n    protected reset() {\n        this.#lockFile = undefined;\n        this.#lockFileLoaded = false;\n    }\n\n    protected findLockFilePath(): string | undefined {\n        return findUp(directory => {\n            const candidate = path.join(directory, this.lockFileName);\n            return fs.existsSync(candidate) ? candidate : undefined;\n        });\n    }\n\n    protected get rootWorkspacePackage(): string {\n        return '';\n    }\n\n    abstract clearCache(): void;\n    abstract getDeclaredVersion(query: DeclaredVersionQuery): string | undefined;\n    abstract getResolvedVersion(query: ResolvedVersionQuery): string | undefined;\n    abstract installPackages(args?: InstallArgs, options?: Parameters<typeof runCommand>[2]): void;\n\n    protected abstract parseLockFile(): LockFile | undefined;\n}\n"],"names":["PackageManager","hasValidLockFile","getLockFile","undefined","getWorkspacePackage","packageDir","process","cwd","lockFilePath","findLockFilePath","rootWorkspacePackage","relative","path","dirname","resolve","split","sep","join","parseLockFile","reset","findUp","directory","candidate","lockFileName","fs","existsSync"],"mappings":";;;;+BAuBsBA;;;eAAAA;;;+DAvBP;iEACE;uBACkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAyB/B,yCACA;AALG,MAAeA;IAOlBC,mBAA4B;QACxB,OAAO,IAAI,CAACC,WAAW,OAAOC;IAClC;IAEA;;;;KAIC,GACDC,oBAAoBC,aAAaC,QAAQC,GAAG,EAAE,EAAU;QACpD,MAAMC,eAAe,IAAI,CAACC,gBAAgB;QAC1C,IAAI,CAACD,cAAc;YACf,OAAO,IAAI,CAACE,oBAAoB;QACpC;QACA,MAAMC,WAAWC,iBAAI,CAChBD,QAAQ,CAACC,iBAAI,CAACC,OAAO,CAACL,eAAeI,iBAAI,CAACE,OAAO,CAACT,aAClDU,KAAK,CAACH,iBAAI,CAACI,GAAG,EACdC,IAAI,CAAC;QACV,OAAON,aAAa,KAAK,IAAI,CAACD,oBAAoB,GAAGC;IACzD;IAEUT,cAAoC;QAC1C,IAAI,0BAAC,IAAI,EAAC,kBAAiB;2CAClB,WAAY,IAAI,CAACgB,aAAa;2CAC9B,iBAAkB;QAC3B;QACA,gCAAO,IAAI,EAAC;IAChB;IAEUC,QAAQ;uCACT,WAAYhB;uCACZ,iBAAkB;IAC3B;IAEUM,mBAAuC;QAC7C,OAAOW,IAAAA,aAAM,EAACC,CAAAA;YACV,MAAMC,YAAYV,iBAAI,CAACK,IAAI,CAACI,WAAW,IAAI,CAACE,YAAY;YACxD,OAAOC,eAAE,CAACC,UAAU,CAACH,aAAaA,YAAYnB;QAClD;IACJ;IAEA,IAAcO,uBAA+B;QACzC,OAAO;IACX;;QA9CA,gCAAA;;mBAAA,KAAA;;QACA,gCAAA;;mBAAkB;;;AAqDtB"}

package/dist/package-manager/pnpm-package-manager.d.ts

@@ -21,6 +21,7 @@ export interface PnpmLockFile {
 export declare class PnpmPackageManager extends PackageManager<PnpmLockFile> {
     readonly command = "pnpm";
     readonly lockFileName = "pnpm-lock.yaml";
+    protected get rootWorkspacePackage(): string;
     clearCache(): void;
     getDeclaredVersion({ workspacePackage, declaredBy, dependency, }: DeclaredVersionQuery): string | undefined;
     getResolvedVersion({ workspacePackage, dependency }: ResolvedVersionQuery): string | undefined;

package/dist/package-manager/pnpm-package-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pnpm-package-manager.d.ts","sourceRoot":"","sources":["../../src/package-manager/pnpm-package-manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAQ,UAAU,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,UAAU,iBAAiB;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,YAAY;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACpD,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAC5D;AAED,UAAU,YAAY;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,YAAY;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CAC5C;AAED,qBAAa,kBAAmB,SAAQ,cAAc,CAAC,YAAY,CAAC;IAChE,QAAQ,CAAC,OAAO,UAAU;IAC1B,QAAQ,CAAC,YAAY,oBAAoB;IAEzC,UAAU;IAIV,kBAAkB,CAAC,EACf,gBAAgB,EAChB,UAAU,EACV,UAAU,GACb,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAS5C,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAI9F,eAAe,CAAC,IAAI,GAAE,WAAgB,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IAgBlF,SAAS,CAAC,aAAa,IAAI,YAAY,GAAG,SAAS;IAanD,OAAO,CAAC,cAAc;CAQzB"}
+{"version":3,"file":"pnpm-package-manager.d.ts","sourceRoot":"","sources":["../../src/package-manager/pnpm-package-manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAQ,UAAU,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,UAAU,iBAAiB;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,YAAY;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACpD,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAC5D;AAED,UAAU,YAAY;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,YAAY;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CAC5C;AAED,qBAAa,kBAAmB,SAAQ,cAAc,CAAC,YAAY,CAAC;IAChE,QAAQ,CAAC,OAAO,UAAU;IAC1B,QAAQ,CAAC,YAAY,oBAAoB;IAEzC,cAAuB,oBAAoB,IAAI,MAAM,CAEpD;IAED,UAAU;IAIV,kBAAkB,CAAC,EACf,gBAAgB,EAChB,UAAU,EACV,UAAU,GACb,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAS5C,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAI9F,eAAe,CAAC,IAAI,GAAE,WAAgB,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IAgBlF,SAAS,CAAC,aAAa,IAAI,YAAY,GAAG,SAAS;IAiBnD,OAAO,CAAC,cAAc;CAQzB"}

package/dist/package-manager/pnpm-package-manager.js

@@ -30,8 +30,11 @@ function _interop_require_default(obj) {
     };
 }
 class PnpmPackageManager extends _packagemanager.PackageManager {
+    get rootWorkspacePackage() {
+        return '.';
+    }
     clearCache() {
-        (0, _utils.runCommand)('pnpm', [
+        (0, _utils.runCommand)(this.command, [
             'store',
             'prune'
         ]);
@@ -51,7 +54,7 @@ class PnpmPackageManager extends _packagemanager.PackageManager {
     }
     installPackages(args = {}, options) {
         try {
-            (0, _utils.runCommand)('pnpm', [
+            (0, _utils.runCommand)(this.command, [
                 'install',
                 ...(0, _utils.isCI)() ? [
                     '--frozen-lockfile'
@@ -65,12 +68,16 @@ class PnpmPackageManager extends _packagemanager.PackageManager {
         }
     }
     parseLockFile() {
+        const lockFilePath = this.findLockFilePath();
+        if (!lockFilePath) {
+            return undefined;
+        }
         /*
          * js-yaml is an optional peer; let MODULE_NOT_FOUND surface so a caller
          * missing the dep gets a clear error instead of silent `undefined`.
          */ const yaml = require('js-yaml');
         try {
-            return yaml.load(_fs.default.readFileSync(this.lockFileName, 'utf-8'));
+            return yaml.load(_fs.default.readFileSync(lockFilePath, 'utf-8'));
         } catch (unused) {
             return undefined;
         }

package/dist/package-manager/pnpm-package-manager.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/package-manager/pnpm-package-manager.ts"],"sourcesContent":["import fs from 'fs';\nimport { isCI, runCommand } from '../utils';\nimport type { DeclaredVersionQuery, InstallArgs, ResolvedVersionQuery } from './package-manager';\nimport { PackageManager } from './package-manager';\n\ninterface PnpmImporterEntry {\n    specifier: string;\n    version: string;\n}\n\ninterface PnpmImporter {\n    dependencies?: Record<string, PnpmImporterEntry>;\n    devDependencies?: Record<string, PnpmImporterEntry>;\n    optionalDependencies?: Record<string, PnpmImporterEntry>;\n}\n\ninterface PnpmSnapshot {\n    dependencies?: Record<string, string>;\n    peerDependencies?: Record<string, string>;\n}\n\nexport interface PnpmLockFile {\n    importers?: Record<string, PnpmImporter>;\n    snapshots?: Record<string, PnpmSnapshot>;\n}\n\nexport class PnpmPackageManager extends PackageManager<PnpmLockFile> {\n    readonly command = 'pnpm';\n    readonly lockFileName = 'pnpm-lock.yaml';\n\n    clearCache() {\n        runCommand('pnpm', ['store', 'prune']);\n    }\n\n    getDeclaredVersion({\n        workspacePackage,\n        declaredBy,\n        dependency,\n    }: DeclaredVersionQuery): string | undefined {\n        const declaredByVersion = this.resolveVersion(workspacePackage, declaredBy);\n        if (!declaredByVersion) {\n            return undefined;\n        }\n        const snapshot = this.getLockFile()?.snapshots?.[`${declaredBy}@${declaredByVersion}`];\n        return snapshot?.dependencies?.[dependency] ?? snapshot?.peerDependencies?.[dependency];\n    }\n\n    getResolvedVersion({ workspacePackage, dependency }: ResolvedVersionQuery): string | undefined {\n        return this.resolveVersion(workspacePackage, dependency);\n    }\n\n    installPackages(args: InstallArgs = {}, options?: Parameters<typeof runCommand>[2]) {\n        try {\n            runCommand(\n                'pnpm',\n                [\n                    'install',\n                    ...(isCI() ? ['--frozen-lockfile'] : []),\n                    ...(args.fix ? ['--lockfile-only'] : []),\n                ],\n                options\n            );\n        } finally {\n            this.reset();\n        }\n    }\n\n    protected parseLockFile(): PnpmLockFile | undefined {\n        /*\n         * js-yaml is an optional peer; let MODULE_NOT_FOUND surface so a caller\n         * missing the dep gets a clear error instead of silent `undefined`.\n         */\n        const yaml = require('js-yaml');\n        try {\n            return yaml.load(fs.readFileSync(this.lockFileName, 'utf-8'));\n        } catch {\n            return undefined;\n        }\n    }\n\n    private resolveVersion(workspacePackage: string, dependency: string): string | undefined {\n        const importer = this.getLockFile()?.importers?.[workspacePackage];\n        const entry =\n            importer?.dependencies?.[dependency] ??\n            importer?.devDependencies?.[dependency] ??\n            importer?.optionalDependencies?.[dependency];\n        return entry ? stripPeerDependencySuffix(entry.version) : undefined;\n    }\n}\n\nfunction stripPeerDependencySuffix(version: string): string {\n    // e.g., \"1.2.3(react@18.2.0)(react-dom@18.2.0)\" → \"1.2.3\"\n    return version.split('(')[0];\n}\n"],"names":["PnpmPackageManager","PackageManager","clearCache","runCommand","getDeclaredVersion","workspacePackage","declaredBy","dependency","snapshot","declaredByVersion","resolveVersion","undefined","getLockFile","snapshots","dependencies","peerDependencies","getResolvedVersion","installPackages","args","options","isCI","fix","reset","parseLockFile","yaml","require","load","fs","readFileSync","lockFileName","importer","importers","entry","devDependencies","optionalDependencies","stripPeerDependencySuffix","version","command","split"],"mappings":";;;;+BA0BaA;;;eAAAA;;;2DA1BE;uBACkB;gCAEF;;;;;;;;;;;;;;;;;;;AAuBxB,MAAMA,2BAA2BC,8BAAc;IAIlDC,aAAa;QACTC,IAAAA,iBAAU,EAAC,QAAQ;YAAC;YAAS;SAAQ;IACzC;IAEAC,mBAAmB,EACfC,gBAAgB,EAChBC,UAAU,EACVC,UAAU,EACS,EAAsB;;YAKxB,6BAAA,mBACVC,wBAAwCA;QAL/C,MAAMC,oBAAoB,IAAI,CAACC,cAAc,CAACL,kBAAkBC;QAChE,IAAI,CAACG,mBAAmB;YACpB,OAAOE;QACX;QACA,MAAMH,YAAW,oBAAA,IAAI,CAACI,WAAW,gBAAhB,yCAAA,8BAAA,kBAAoBC,SAAS,cAA7B,kDAAA,2BAA+B,CAAC,GAAGP,WAAW,CAAC,EAAEG,mBAAmB,CAAC;QACtF,eAAOD,qBAAAA,gCAAAA,yBAAAA,SAAUM,YAAY,cAAtBN,6CAAAA,sBAAwB,CAACD,WAAW,uCAAIC,qBAAAA,gCAAAA,6BAAAA,SAAUO,gBAAgB,cAA1BP,iDAAAA,0BAA4B,CAACD,WAAW;IAC3F;IAEAS,mBAAmB,EAAEX,gBAAgB,EAAEE,UAAU,EAAwB,EAAsB;QAC3F,OAAO,IAAI,CAACG,cAAc,CAACL,kBAAkBE;IACjD;IAEAU,gBAAgBC,OAAoB,CAAC,CAAC,EAAEC,OAA0C,EAAE;QAChF,IAAI;YACAhB,IAAAA,iBAAU,EACN,QACA;gBACI;mBACIiB,IAAAA,WAAI,MAAK;oBAAC;iBAAoB,GAAG,EAAE;mBACnCF,KAAKG,GAAG,GAAG;oBAAC;iBAAkB,GAAG,EAAE;aAC1C,EACDF;QAER,SAAU;YACN,IAAI,CAACG,KAAK;QACd;IACJ;IAEUC,gBAA0C;QAChD;;;SAGC,GACD,MAAMC,OAAOC,QAAQ;QACrB,IAAI;YACA,OAAOD,KAAKE,IAAI,CAACC,WAAE,CAACC,YAAY,CAAC,IAAI,CAACC,YAAY,EAAE;QACxD,EAAE,eAAM;YACJ,OAAOlB;QACX;IACJ;IAEQD,eAAeL,gBAAwB,EAAEE,UAAkB,EAAsB;YAGjFuB;YAFa,6BAAA,mBAEbA,wBACAA,2BACAA;QAJJ,MAAMA,YAAW,oBAAA,IAAI,CAAClB,WAAW,gBAAhB,yCAAA,8BAAA,kBAAoBmB,SAAS,cAA7B,kDAAA,2BAA+B,CAAC1B,iBAAiB;QAClE,MAAM2B,SACFF,gBAAAA,qBAAAA,gCAAAA,yBAAAA,SAAUhB,YAAY,cAAtBgB,6CAAAA,sBAAwB,CAACvB,WAAW,yCACpCuB,qBAAAA,gCAAAA,4BAAAA,SAAUG,eAAe,cAAzBH,gDAAAA,yBAA2B,CAACvB,WAAW,cADvCuB,kBAAAA,OAEAA,qBAAAA,gCAAAA,iCAAAA,SAAUI,oBAAoB,cAA9BJ,qDAAAA,8BAAgC,CAACvB,WAAW;QAChD,OAAOyB,QAAQG,0BAA0BH,MAAMI,OAAO,IAAIzB;IAC9D;;QA7DG,gBACH,uBAAS0B,WAAU,SACnB,uBAASR,gBAAe;;AA4D5B;AAEA,SAASM,0BAA0BC,OAAe;IAC9C,0DAA0D;IAC1D,OAAOA,QAAQE,KAAK,CAAC,IAAI,CAAC,EAAE;AAChC"}
+{"version":3,"sources":["../../src/package-manager/pnpm-package-manager.ts"],"sourcesContent":["import fs from 'fs';\nimport { isCI, runCommand } from '../utils';\nimport type { DeclaredVersionQuery, InstallArgs, ResolvedVersionQuery } from './package-manager';\nimport { PackageManager } from './package-manager';\n\ninterface PnpmImporterEntry {\n    specifier: string;\n    version: string;\n}\n\ninterface PnpmImporter {\n    dependencies?: Record<string, PnpmImporterEntry>;\n    devDependencies?: Record<string, PnpmImporterEntry>;\n    optionalDependencies?: Record<string, PnpmImporterEntry>;\n}\n\ninterface PnpmSnapshot {\n    dependencies?: Record<string, string>;\n    peerDependencies?: Record<string, string>;\n}\n\nexport interface PnpmLockFile {\n    importers?: Record<string, PnpmImporter>;\n    snapshots?: Record<string, PnpmSnapshot>;\n}\n\nexport class PnpmPackageManager extends PackageManager<PnpmLockFile> {\n    readonly command = 'pnpm';\n    readonly lockFileName = 'pnpm-lock.yaml';\n\n    protected override get rootWorkspacePackage(): string {\n        return '.';\n    }\n\n    clearCache() {\n        runCommand(this.command, ['store', 'prune']);\n    }\n\n    getDeclaredVersion({\n        workspacePackage,\n        declaredBy,\n        dependency,\n    }: DeclaredVersionQuery): string | undefined {\n        const declaredByVersion = this.resolveVersion(workspacePackage, declaredBy);\n        if (!declaredByVersion) {\n            return undefined;\n        }\n        const snapshot = this.getLockFile()?.snapshots?.[`${declaredBy}@${declaredByVersion}`];\n        return snapshot?.dependencies?.[dependency] ?? snapshot?.peerDependencies?.[dependency];\n    }\n\n    getResolvedVersion({ workspacePackage, dependency }: ResolvedVersionQuery): string | undefined {\n        return this.resolveVersion(workspacePackage, dependency);\n    }\n\n    installPackages(args: InstallArgs = {}, options?: Parameters<typeof runCommand>[2]) {\n        try {\n            runCommand(\n                this.command,\n                [\n                    'install',\n                    ...(isCI() ? ['--frozen-lockfile'] : []),\n                    ...(args.fix ? ['--lockfile-only'] : []),\n                ],\n                options\n            );\n        } finally {\n            this.reset();\n        }\n    }\n\n    protected parseLockFile(): PnpmLockFile | undefined {\n        const lockFilePath = this.findLockFilePath();\n        if (!lockFilePath) {\n            return undefined;\n        }\n        /*\n         * js-yaml is an optional peer; let MODULE_NOT_FOUND surface so a caller\n         * missing the dep gets a clear error instead of silent `undefined`.\n         */\n        const yaml = require('js-yaml');\n        try {\n            return yaml.load(fs.readFileSync(lockFilePath, 'utf-8'));\n        } catch {\n            return undefined;\n        }\n    }\n\n    private resolveVersion(workspacePackage: string, dependency: string): string | undefined {\n        const importer = this.getLockFile()?.importers?.[workspacePackage];\n        const entry =\n            importer?.dependencies?.[dependency] ??\n            importer?.devDependencies?.[dependency] ??\n            importer?.optionalDependencies?.[dependency];\n        return entry ? stripPeerDependencySuffix(entry.version) : undefined;\n    }\n}\n\nfunction stripPeerDependencySuffix(version: string): string {\n    // e.g., \"1.2.3(react@18.2.0)(react-dom@18.2.0)\" → \"1.2.3\"\n    return version.split('(')[0];\n}\n"],"names":["PnpmPackageManager","PackageManager","rootWorkspacePackage","clearCache","runCommand","command","getDeclaredVersion","workspacePackage","declaredBy","dependency","snapshot","declaredByVersion","resolveVersion","undefined","getLockFile","snapshots","dependencies","peerDependencies","getResolvedVersion","installPackages","args","options","isCI","fix","reset","parseLockFile","lockFilePath","findLockFilePath","yaml","require","load","fs","readFileSync","importer","importers","entry","devDependencies","optionalDependencies","stripPeerDependencySuffix","version","lockFileName","split"],"mappings":";;;;+BA0BaA;;;eAAAA;;;2DA1BE;uBACkB;gCAEF;;;;;;;;;;;;;;;;;;;AAuBxB,MAAMA,2BAA2BC,8BAAc;IAIlD,IAAuBC,uBAA+B;QAClD,OAAO;IACX;IAEAC,aAAa;QACTC,IAAAA,iBAAU,EAAC,IAAI,CAACC,OAAO,EAAE;YAAC;YAAS;SAAQ;IAC/C;IAEAC,mBAAmB,EACfC,gBAAgB,EAChBC,UAAU,EACVC,UAAU,EACS,EAAsB;;YAKxB,6BAAA,mBACVC,wBAAwCA;QAL/C,MAAMC,oBAAoB,IAAI,CAACC,cAAc,CAACL,kBAAkBC;QAChE,IAAI,CAACG,mBAAmB;YACpB,OAAOE;QACX;QACA,MAAMH,YAAW,oBAAA,IAAI,CAACI,WAAW,gBAAhB,yCAAA,8BAAA,kBAAoBC,SAAS,cAA7B,kDAAA,2BAA+B,CAAC,GAAGP,WAAW,CAAC,EAAEG,mBAAmB,CAAC;QACtF,eAAOD,qBAAAA,gCAAAA,yBAAAA,SAAUM,YAAY,cAAtBN,6CAAAA,sBAAwB,CAACD,WAAW,uCAAIC,qBAAAA,gCAAAA,6BAAAA,SAAUO,gBAAgB,cAA1BP,iDAAAA,0BAA4B,CAACD,WAAW;IAC3F;IAEAS,mBAAmB,EAAEX,gBAAgB,EAAEE,UAAU,EAAwB,EAAsB;QAC3F,OAAO,IAAI,CAACG,cAAc,CAACL,kBAAkBE;IACjD;IAEAU,gBAAgBC,OAAoB,CAAC,CAAC,EAAEC,OAA0C,EAAE;QAChF,IAAI;YACAjB,IAAAA,iBAAU,EACN,IAAI,CAACC,OAAO,EACZ;gBACI;mBACIiB,IAAAA,WAAI,MAAK;oBAAC;iBAAoB,GAAG,EAAE;mBACnCF,KAAKG,GAAG,GAAG;oBAAC;iBAAkB,GAAG,EAAE;aAC1C,EACDF;QAER,SAAU;YACN,IAAI,CAACG,KAAK;QACd;IACJ;IAEUC,gBAA0C;QAChD,MAAMC,eAAe,IAAI,CAACC,gBAAgB;QAC1C,IAAI,CAACD,cAAc;YACf,OAAOb;QACX;QACA;;;SAGC,GACD,MAAMe,OAAOC,QAAQ;QACrB,IAAI;YACA,OAAOD,KAAKE,IAAI,CAACC,WAAE,CAACC,YAAY,CAACN,cAAc;QACnD,EAAE,eAAM;YACJ,OAAOb;QACX;IACJ;IAEQD,eAAeL,gBAAwB,EAAEE,UAAkB,EAAsB;YAGjFwB;YAFa,6BAAA,mBAEbA,wBACAA,2BACAA;QAJJ,MAAMA,YAAW,oBAAA,IAAI,CAACnB,WAAW,gBAAhB,yCAAA,8BAAA,kBAAoBoB,SAAS,cAA7B,kDAAA,2BAA+B,CAAC3B,iBAAiB;QAClE,MAAM4B,SACFF,gBAAAA,qBAAAA,gCAAAA,yBAAAA,SAAUjB,YAAY,cAAtBiB,6CAAAA,sBAAwB,CAACxB,WAAW,yCACpCwB,qBAAAA,gCAAAA,4BAAAA,SAAUG,eAAe,cAAzBH,gDAAAA,yBAA2B,CAACxB,WAAW,cADvCwB,kBAAAA,OAEAA,qBAAAA,gCAAAA,iCAAAA,SAAUI,oBAAoB,cAA9BJ,qDAAAA,8BAAgC,CAACxB,WAAW;QAChD,OAAO0B,QAAQG,0BAA0BH,MAAMI,OAAO,IAAI1B;IAC9D;;QArEG,gBACH,uBAASR,WAAU,SACnB,uBAASmC,gBAAe;;AAoE5B;AAEA,SAASF,0BAA0BC,OAAe;IAC9C,0DAA0D;IAC1D,OAAOA,QAAQE,KAAK,CAAC,IAAI,CAAC,EAAE;AAChC"}

package/dist/package-manager/utils/resolve-allow-scripts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-allow-scripts.d.ts","sourceRoot":"","sources":["../../../src/package-manager/utils/resolve-allow-scripts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,eAAO,MAAM,uBAAuB,UAAoD,CAAC;AAEzF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,GAAG,YAAY,CAKrE"}
+{"version":3,"file":"resolve-allow-scripts.d.ts","sourceRoot":"","sources":["../../../src/package-manager/utils/resolve-allow-scripts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,eAAO,MAAM,uBAAuB,UAMnC,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,GAAG,YAAY,CAKrE"}

package/dist/package-manager/utils/resolve-allow-scripts.js

@@ -21,7 +21,8 @@ const DEFAULT_ALLOWED_SCRIPTS = [
     '@servicetitan/startup',
     'cypress',
     'msw',
-    'nx'
+    'nx',
+    'tree-sitter'
 ];
 function resolveAllowScripts(value) {
     if (value === true || value === false) {

package/dist/package-manager/utils/resolve-allow-scripts.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/package-manager/utils/resolve-allow-scripts.ts"],"sourcesContent":["import type { AllowScripts } from '../package-manager';\nimport { parseAllowScripts } from './parse-allow-scripts';\n\nexport const DEFAULT_ALLOWED_SCRIPTS = ['@servicetitan/startup', 'cypress', 'msw', 'nx'];\n\nexport function resolveAllowScripts(value: AllowScripts): AllowScripts {\n    if (value === true || value === false) {\n        return value;\n    }\n    return [...DEFAULT_ALLOWED_SCRIPTS, ...parseAllowScripts(value)];\n}\n"],"names":["DEFAULT_ALLOWED_SCRIPTS","resolveAllowScripts","value","parseAllowScripts"],"mappings":";;;;;;;;;;;QAGaA;eAAAA;;QAEGC;eAAAA;;;mCAJkB;AAE3B,MAAMD,0BAA0B;IAAC;IAAyB;IAAW;IAAO;CAAK;AAEjF,SAASC,oBAAoBC,KAAmB;IACnD,IAAIA,UAAU,QAAQA,UAAU,OAAO;QACnC,OAAOA;IACX;IACA,OAAO;WAAIF;WAA4BG,IAAAA,oCAAiB,EAACD;KAAO;AACpE"}
+{"version":3,"sources":["../../../src/package-manager/utils/resolve-allow-scripts.ts"],"sourcesContent":["import type { AllowScripts } from '../package-manager';\nimport { parseAllowScripts } from './parse-allow-scripts';\n\nexport const DEFAULT_ALLOWED_SCRIPTS = [\n    '@servicetitan/startup',\n    'cypress',\n    'msw',\n    'nx',\n    'tree-sitter',\n];\n\nexport function resolveAllowScripts(value: AllowScripts): AllowScripts {\n    if (value === true || value === false) {\n        return value;\n    }\n    return [...DEFAULT_ALLOWED_SCRIPTS, ...parseAllowScripts(value)];\n}\n"],"names":["DEFAULT_ALLOWED_SCRIPTS","resolveAllowScripts","value","parseAllowScripts"],"mappings":";;;;;;;;;;;QAGaA;eAAAA;;QAQGC;eAAAA;;;mCAVkB;AAE3B,MAAMD,0BAA0B;IACnC;IACA;IACA;IACA;IACA;CACH;AAEM,SAASC,oBAAoBC,KAAmB;IACnD,IAAIA,UAAU,QAAQA,UAAU,OAAO;QACnC,OAAOA;IACX;IACA,OAAO;WAAIF;WAA4BG,IAAAA,oCAAiB,EAACD;KAAO;AACpE"}

package/dist/utils/warn-untrusted-install-scripts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"warn-untrusted-install-scripts.d.ts","sourceRoot":"","sources":["../../src/utils/warn-untrusted-install-scripts.ts"],"names":[],"mappings":"AAqBA,UAAU,OAAO;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,2BAA2B,CACvC,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EACpB,EAAE,KAAK,EAAE,GAAE,OAAY,QAyB1B"}
+{"version":3,"file":"warn-untrusted-install-scripts.d.ts","sourceRoot":"","sources":["../../src/utils/warn-untrusted-install-scripts.ts"],"names":[],"mappings":"AAuBA,UAAU,OAAO;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,2BAA2B,CACvC,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EACpB,EAAE,KAAK,EAAE,GAAE,OAAY,QAyB1B"}

package/dist/utils/warn-untrusted-install-scripts.js

@@ -16,6 +16,7 @@ const IGNORE = [
     '@progress/kendo-licensing',
     '@scarf/scarf',
     '@swc/core',
+    '@tree-sitter-grammars/tree-sitter-yaml',
     '@vaadin/vaadin-usage-statistics',
     'contentful',
     'core-js-pure',
@@ -23,6 +24,7 @@ const IGNORE = [
     'es5-ext',
     'esbuild',
     'less',
+    'tree-sitter-json',
     'unrs-resolver'
 ];
 function warnUntrustedInstallScripts(allowedScripts, lockFileName, { force } = {}) {

package/dist/utils/warn-untrusted-install-scripts.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/warn-untrusted-install-scripts.ts"],"sourcesContent":["/* eslint-disable no-console */\nimport { getPackagesWithInstallScripts } from './get-packages-with-install-scripts';\nimport { hasLockfileChanged } from './has-lockfile-changed';\n\n// These packages have scripts, but don't need them to function correctly.\n\nconst IGNORE = [\n    '@parcel/watcher', // Installs platform-specific binary via optionalDependencies, install script is a legacy fallback\n    '@progress/kendo-licensing', // Validates Kendo UI license key, not needed for functionality\n    '@scarf/scarf', // Sends anonymous analytics/telemetry to Scarf, usage-tracking mechanism with no functional purpose\n    '@swc/core', // Installs platform-specific binary via optionalDependencies, postinstall is a legacy fallback\n    '@vaadin/vaadin-usage-statistics', // Toggles Vaadin's development-time telemetry, no effect on functionality\n    'contentful', // v9 printed a message announcing that v10 was available, no functional purpose\n    'core-js-pure', // Prints a donation/sponsorship banner to the console, no functional purpose\n    'core-js', // Prints a donation/sponsorship banner to the console, no functional purpose\n    'es5-ext', // Displays politically motivated message targeted at Russian developers, no effect on functionality\n    'esbuild', // Installs platform-specific binary via optionalDependencies, postinstall is a legacy fallback\n    'less', // Installs Playwright browsers for Less's own test suite\n    'unrs-resolver', // Installs platform-specific binary via optionalDependencies, postinstall is a legacy fallback\n];\n\ninterface Options {\n    force?: boolean;\n}\n\nexport function warnUntrustedInstallScripts(\n    allowedScripts: string[],\n    lockFileName: string,\n    { force }: Options = {}\n) {\n    if (!force && !hasLockfileChanged(lockFileName)) {\n        return;\n    }\n\n    const packages = getPackagesWithInstallScripts();\n    const trustedOrIgnored = new Set([...allowedScripts, ...IGNORE]);\n    const untrusted = packages.filter(({ location, name }) => {\n        return !!location && !trustedOrIgnored.has(name);\n    });\n\n    if (untrusted.length === 0) {\n        return;\n    }\n\n    const list = untrusted.map(({ name, version }) => `  - ${name}@${version}`).join('\\n');\n    console.warn(\n        [\n            'WARNING: The following packages have untrusted install scripts.',\n            'A future release will block them by default.',\n            'Review and add trusted packages to --allow-scripts:',\n            list,\n        ].join('\\n')\n    );\n}\n"],"names":["warnUntrustedInstallScripts","IGNORE","allowedScripts","lockFileName","force","hasLockfileChanged","packages","getPackagesWithInstallScripts","trustedOrIgnored","Set","untrusted","filter","location","name","has","length","list","map","version","join","console","warn"],"mappings":"AAAA,6BAA6B;;;;+BAyBbA;;;eAAAA;;;+CAxB8B;oCACX;AAEnC,0EAA0E;AAE1E,MAAMC,SAAS;IACX;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACH;AAMM,SAASD,4BACZE,cAAwB,EACxBC,YAAoB,EACpB,EAAEC,KAAK,EAAW,GAAG,CAAC,CAAC;IAEvB,IAAI,CAACA,SAAS,CAACC,IAAAA,sCAAkB,EAACF,eAAe;QAC7C;IACJ;IAEA,MAAMG,WAAWC,IAAAA,4DAA6B;IAC9C,MAAMC,mBAAmB,IAAIC,IAAI;WAAIP;WAAmBD;KAAO;IAC/D,MAAMS,YAAYJ,SAASK,MAAM,CAAC,CAAC,EAAEC,QAAQ,EAAEC,IAAI,EAAE;QACjD,OAAO,CAAC,CAACD,YAAY,CAACJ,iBAAiBM,GAAG,CAACD;IAC/C;IAEA,IAAIH,UAAUK,MAAM,KAAK,GAAG;QACxB;IACJ;IAEA,MAAMC,OAAON,UAAUO,GAAG,CAAC,CAAC,EAAEJ,IAAI,EAAEK,OAAO,EAAE,GAAK,CAAC,IAAI,EAAEL,KAAK,CAAC,EAAEK,SAAS,EAAEC,IAAI,CAAC;IACjFC,QAAQC,IAAI,CACR;QACI;QACA;QACA;QACAL;KACH,CAACG,IAAI,CAAC;AAEf"}
+{"version":3,"sources":["../../src/utils/warn-untrusted-install-scripts.ts"],"sourcesContent":["/* eslint-disable no-console */\nimport { getPackagesWithInstallScripts } from './get-packages-with-install-scripts';\nimport { hasLockfileChanged } from './has-lockfile-changed';\n\n// These packages have scripts, but don't need them to function correctly.\n\nconst IGNORE = [\n    '@parcel/watcher', // Installs platform-specific binary via optionalDependencies, install script is a legacy fallback\n    '@progress/kendo-licensing', // Validates Kendo UI license key, not needed for functionality\n    '@scarf/scarf', // Sends anonymous analytics/telemetry to Scarf, usage-tracking mechanism with no functional purpose\n    '@swc/core', // Installs platform-specific binary via optionalDependencies, postinstall is a legacy fallback\n    '@tree-sitter-grammars/tree-sitter-yaml', // Ships prebuilds for all supported targets via node-gyp-build, install script is a source-compile fallback\n    '@vaadin/vaadin-usage-statistics', // Toggles Vaadin's development-time telemetry, no effect on functionality\n    'contentful', // v9 printed a message announcing that v10 was available, no functional purpose\n    'core-js-pure', // Prints a donation/sponsorship banner to the console, no functional purpose\n    'core-js', // Prints a donation/sponsorship banner to the console, no functional purpose\n    'es5-ext', // Displays politically motivated message targeted at Russian developers, no effect on functionality\n    'esbuild', // Installs platform-specific binary via optionalDependencies, postinstall is a legacy fallback\n    'less', // Installs Playwright browsers for Less's own test suite\n    'tree-sitter-json', // Ships prebuilds for all supported targets via node-gyp-build, install script is a source-compile fallback\n    'unrs-resolver', // Installs platform-specific binary via optionalDependencies, postinstall is a legacy fallback\n];\n\ninterface Options {\n    force?: boolean;\n}\n\nexport function warnUntrustedInstallScripts(\n    allowedScripts: string[],\n    lockFileName: string,\n    { force }: Options = {}\n) {\n    if (!force && !hasLockfileChanged(lockFileName)) {\n        return;\n    }\n\n    const packages = getPackagesWithInstallScripts();\n    const trustedOrIgnored = new Set([...allowedScripts, ...IGNORE]);\n    const untrusted = packages.filter(({ location, name }) => {\n        return !!location && !trustedOrIgnored.has(name);\n    });\n\n    if (untrusted.length === 0) {\n        return;\n    }\n\n    const list = untrusted.map(({ name, version }) => `  - ${name}@${version}`).join('\\n');\n    console.warn(\n        [\n            'WARNING: The following packages have untrusted install scripts.',\n            'A future release will block them by default.',\n            'Review and add trusted packages to --allow-scripts:',\n            list,\n        ].join('\\n')\n    );\n}\n"],"names":["warnUntrustedInstallScripts","IGNORE","allowedScripts","lockFileName","force","hasLockfileChanged","packages","getPackagesWithInstallScripts","trustedOrIgnored","Set","untrusted","filter","location","name","has","length","list","map","version","join","console","warn"],"mappings":"AAAA,6BAA6B;;;;+BA2BbA;;;eAAAA;;;+CA1B8B;oCACX;AAEnC,0EAA0E;AAE1E,MAAMC,SAAS;IACX;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACH;AAMM,SAASD,4BACZE,cAAwB,EACxBC,YAAoB,EACpB,EAAEC,KAAK,EAAW,GAAG,CAAC,CAAC;IAEvB,IAAI,CAACA,SAAS,CAACC,IAAAA,sCAAkB,EAACF,eAAe;QAC7C;IACJ;IAEA,MAAMG,WAAWC,IAAAA,4DAA6B;IAC9C,MAAMC,mBAAmB,IAAIC,IAAI;WAAIP;WAAmBD;KAAO;IAC/D,MAAMS,YAAYJ,SAASK,MAAM,CAAC,CAAC,EAAEC,QAAQ,EAAEC,IAAI,EAAE;QACjD,OAAO,CAAC,CAACD,YAAY,CAACJ,iBAAiBM,GAAG,CAACD;IAC/C;IAEA,IAAIH,UAAUK,MAAM,KAAK,GAAG;QACxB;IACJ;IAEA,MAAMC,OAAON,UAAUO,GAAG,CAAC,CAAC,EAAEJ,IAAI,EAAEK,OAAO,EAAE,GAAK,CAAC,IAAI,EAAEL,KAAK,CAAC,EAAEK,SAAS,EAAEC,IAAI,CAAC;IACjFC,QAAQC,IAAI,CACR;QACI;QACA;QACA;QACAL;KACH,CAACG,IAAI,CAAC;AAEf"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@servicetitan/install",
-    "version": "36.2.0",
+    "version": "36.3.1",
     "description": "Lightweight wrapper around npm install that configures access to private packages",
     "homepage": "https://docs.st.dev/docs/frontend/uikit/install",
     "repository": {
@@ -40,5 +40,5 @@
     "devDependencies": {
         "ts-node": "~10.9.2"
     },
-    "gitHead": "87254b2caf60b20eb46c33b40ffb4dd05ad3e0f7"
+    "gitHead": "93a049ba1e5cb737afb7bc95c06020736bc61a38"
 }

package/src/package-manager/npm-package-manager.ts

@@ -12,6 +12,8 @@ import {
 
 interface NpmLockFileEntry {
     version?: string;
+    resolved?: string;
+    link?: boolean;
     dependencies?: Record<string, string>;
     peerDependencies?: Record<string, string>;
 }
@@ -25,7 +27,7 @@ export class NpmPackageManager extends PackageManager<NpmLockFile> {
     readonly lockFileName = 'package-lock.json';
 
     clearCache() {
-        runCommand('npm', ['cache', 'clear', '--force']);
+        runCommand(this.command, ['cache', 'clear', '--force']);
     }
 
     getDeclaredVersion({
@@ -53,7 +55,7 @@ export class NpmPackageManager extends PackageManager<NpmLockFile> {
         }
 
         runCommand(
-            'npm',
+            this.command,
             [
                 isCI() ? 'ci' : 'i',
                 '--audit=false',
@@ -103,8 +105,12 @@ export class NpmPackageManager extends PackageManager<NpmLockFile> {
     }
 
     protected parseLockFile(): NpmLockFile | undefined {
+        const lockFilePath = this.findLockFilePath();
+        if (!lockFilePath) {
+            return undefined;
+        }
         try {
-            return JSON.parse(fs.readFileSync(this.lockFileName, 'utf-8'));
+            return JSON.parse(fs.readFileSync(lockFilePath, 'utf-8'));
         } catch {
             return undefined;
         }
@@ -115,6 +121,8 @@ export class NpmPackageManager extends PackageManager<NpmLockFile> {
      * to the hoisted root entry. `workspacePackage` is the package's relative
      * path from the repo root; the empty string `''` denotes the root
      * workspace package itself, matching npm's own lockfile key convention.
+     * Follows link entries to the resolved workspace package, so callers see
+     * the workspace package's own metadata rather than the symlink stub.
      */
     private findEntry({
         workspacePackage,
@@ -124,15 +132,18 @@ export class NpmPackageManager extends PackageManager<NpmLockFile> {
         package: string;
     }): NpmLockFileEntry | undefined {
         const packages = this.getLockFile()?.packages;
-        return (
+        const entry =
             packages?.[`${workspacePackage}/node_modules/${packageName}`] ??
-            packages?.[`node_modules/${packageName}`]
-        );
+            packages?.[`node_modules/${packageName}`];
+        if (entry?.link && entry.resolved) {
+            return packages?.[entry.resolved];
+        }
+        return entry;
     }
 
     private runRebuild(scripts: string[]) {
         try {
-            runCommand('npm', ['rebuild', ...scripts]);
+            runCommand(this.command, ['rebuild', ...scripts]);
         } catch {
             console.error(`Failed to run allowed scripts: ${scripts.join(', ')}`);
             process.exitCode = 1;
@@ -141,7 +152,7 @@ export class NpmPackageManager extends PackageManager<NpmLockFile> {
 
     private runProjectPostinstall(options?: Parameters<typeof runCommand>[2]) {
         try {
-            runCommand('npm', ['run', 'postinstall', '--if-present'], options);
+            runCommand(this.command, ['run', 'postinstall', '--if-present'], options);
         } catch {
             process.exitCode = 1;
         }

package/src/package-manager/package-manager.ts

@@ -1,4 +1,6 @@
-import { runCommand } from '../utils';
+import fs from 'node:fs';
+import path from 'node:path';
+import { findUp, runCommand } from '../utils';
 
 export type AllowScripts = true | false | string[];
 
@@ -30,6 +32,23 @@ export abstract class PackageManager<LockFile = unknown> {
         return this.getLockFile() !== undefined;
     }
 
+    /**
+     * Returns the lockfile key for a package given its absolute or
+     * cwd-relative directory. Both npm and pnpm key their lockfile entries
+     * by the package's path relative to the workspace root.
+     */
+    getWorkspacePackage(packageDir = process.cwd()): string {
+        const lockFilePath = this.findLockFilePath();
+        if (!lockFilePath) {
+            return this.rootWorkspacePackage;
+        }
+        const relative = path
+            .relative(path.dirname(lockFilePath), path.resolve(packageDir))
+            .split(path.sep)
+            .join('/');
+        return relative === '' ? this.rootWorkspacePackage : relative;
+    }
+
     protected getLockFile(): LockFile | undefined {
         if (!this.#lockFileLoaded) {
             this.#lockFile = this.parseLockFile();
@@ -43,6 +62,17 @@ export abstract class PackageManager<LockFile = unknown> {
         this.#lockFileLoaded = false;
     }
 
+    protected findLockFilePath(): string | undefined {
+        return findUp(directory => {
+            const candidate = path.join(directory, this.lockFileName);
+            return fs.existsSync(candidate) ? candidate : undefined;
+        });
+    }
+
+    protected get rootWorkspacePackage(): string {
+        return '';
+    }
+
     abstract clearCache(): void;
     abstract getDeclaredVersion(query: DeclaredVersionQuery): string | undefined;
     abstract getResolvedVersion(query: ResolvedVersionQuery): string | undefined;

package/src/package-manager/pnpm-package-manager.ts

@@ -28,8 +28,12 @@ export class PnpmPackageManager extends PackageManager<PnpmLockFile> {
     readonly command = 'pnpm';
     readonly lockFileName = 'pnpm-lock.yaml';
 
+    protected override get rootWorkspacePackage(): string {
+        return '.';
+    }
+
     clearCache() {
-        runCommand('pnpm', ['store', 'prune']);
+        runCommand(this.command, ['store', 'prune']);
     }
 
     getDeclaredVersion({
@@ -52,7 +56,7 @@ export class PnpmPackageManager extends PackageManager<PnpmLockFile> {
     installPackages(args: InstallArgs = {}, options?: Parameters<typeof runCommand>[2]) {
         try {
             runCommand(
-                'pnpm',
+                this.command,
                 [
                     'install',
                     ...(isCI() ? ['--frozen-lockfile'] : []),
@@ -66,13 +70,17 @@ export class PnpmPackageManager extends PackageManager<PnpmLockFile> {
     }
 
     protected parseLockFile(): PnpmLockFile | undefined {
+        const lockFilePath = this.findLockFilePath();
+        if (!lockFilePath) {
+            return undefined;
+        }
         /*
          * js-yaml is an optional peer; let MODULE_NOT_FOUND surface so a caller
          * missing the dep gets a clear error instead of silent `undefined`.
          */
         const yaml = require('js-yaml');
         try {
-            return yaml.load(fs.readFileSync(this.lockFileName, 'utf-8'));
+            return yaml.load(fs.readFileSync(lockFilePath, 'utf-8'));
         } catch {
             return undefined;
         }

package/src/package-manager/utils/resolve-allow-scripts.ts

@@ -1,7 +1,13 @@
 import type { AllowScripts } from '../package-manager';
 import { parseAllowScripts } from './parse-allow-scripts';
 
-export const DEFAULT_ALLOWED_SCRIPTS = ['@servicetitan/startup', 'cypress', 'msw', 'nx'];
+export const DEFAULT_ALLOWED_SCRIPTS = [
+    '@servicetitan/startup',
+    'cypress',
+    'msw',
+    'nx',
+    'tree-sitter',
+];
 
 export function resolveAllowScripts(value: AllowScripts): AllowScripts {
     if (value === true || value === false) {

package/src/utils/warn-untrusted-install-scripts.ts

@@ -9,6 +9,7 @@ const IGNORE = [
     '@progress/kendo-licensing', // Validates Kendo UI license key, not needed for functionality
     '@scarf/scarf', // Sends anonymous analytics/telemetry to Scarf, usage-tracking mechanism with no functional purpose
     '@swc/core', // Installs platform-specific binary via optionalDependencies, postinstall is a legacy fallback
+    '@tree-sitter-grammars/tree-sitter-yaml', // Ships prebuilds for all supported targets via node-gyp-build, install script is a source-compile fallback
     '@vaadin/vaadin-usage-statistics', // Toggles Vaadin's development-time telemetry, no effect on functionality
     'contentful', // v9 printed a message announcing that v10 was available, no functional purpose
     'core-js-pure', // Prints a donation/sponsorship banner to the console, no functional purpose
@@ -16,6 +17,7 @@ const IGNORE = [
     'es5-ext', // Displays politically motivated message targeted at Russian developers, no effect on functionality
     'esbuild', // Installs platform-specific binary via optionalDependencies, postinstall is a legacy fallback
     'less', // Installs Playwright browsers for Less's own test suite
+    'tree-sitter-json', // Ships prebuilds for all supported targets via node-gyp-build, install script is a source-compile fallback
     'unrs-resolver', // Installs platform-specific binary via optionalDependencies, postinstall is a legacy fallback
 ];