@servicetitan/install 36.3.0 → 36.4.0

package/dist/package-manager/npm-package-manager.d.ts

@@ -3,6 +3,8 @@ import type { DeclaredVersionQuery, InstallArgs, ResolvedVersionQuery } from './
 import { PackageManager } from './package-manager';
 interface NpmLockFileEntry {
     version?: string;
+    resolved?: string;
+    link?: boolean;
     dependencies?: Record<string, string>;
     peerDependencies?: Record<string, string>;
 }
@@ -22,6 +24,8 @@ export declare class NpmPackageManager extends PackageManager<NpmLockFile> {
      * to the hoisted root entry. `workspacePackage` is the package's relative
      * path from the repo root; the empty string `''` denotes the root
      * workspace package itself, matching npm's own lockfile key convention.
+     * Follows link entries to the resolved workspace package, so callers see
+     * the workspace package's own metadata rather than the symlink stub.
      */
     private findEntry;
     private runRebuild;

package/dist/package-manager/npm-package-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"npm-package-manager.d.ts","sourceRoot":"","sources":["../../src/package-manager/npm-package-manager.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,UAAU,EAA+B,MAAM,UAAU,CAAC;AACzE,OAAO,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAQnD,UAAU,gBAAgB;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC/C;AAED,qBAAa,iBAAkB,SAAQ,cAAc,CAAC,WAAW,CAAC;IAC9D,QAAQ,CAAC,OAAO,SAAS;IACzB,QAAQ,CAAC,YAAY,uBAAuB;IAE5C,UAAU;IAIV,kBAAkB,CAAC,EACf,gBAAgB,EAChB,UAAU,EACV,UAAU,GACb,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAK5C,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAI9F,eAAe,CAAC,IAAI,GAAE,WAAgB,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IA6DlF,SAAS,CAAC,aAAa,IAAI,WAAW,GAAG,SAAS;IAQlD;;;;;OAKG;IACH,OAAO,CAAC,SAAS;IAcjB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,qBAAqB;CAOhC"}
+{"version":3,"file":"npm-package-manager.d.ts","sourceRoot":"","sources":["../../src/package-manager/npm-package-manager.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,UAAU,EAA+B,MAAM,UAAU,CAAC;AACzE,OAAO,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAQnD,UAAU,gBAAgB;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC/C;AAED,qBAAa,iBAAkB,SAAQ,cAAc,CAAC,WAAW,CAAC;IAC9D,QAAQ,CAAC,OAAO,SAAS;IACzB,QAAQ,CAAC,YAAY,uBAAuB;IAE5C,UAAU;IAIV,kBAAkB,CAAC,EACf,gBAAgB,EAChB,UAAU,EACV,UAAU,GACb,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAK5C,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAI9F,eAAe,CAAC,IAAI,GAAE,WAAgB,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IAuDlF,SAAS,CAAC,aAAa,IAAI,WAAW,GAAG,SAAS;IAYlD;;;;;;;OAOG;IACH,OAAO,CAAC,SAAS;IAiBjB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,qBAAqB;CAOhC"}

package/dist/package-manager/npm-package-manager.js

@@ -32,7 +32,7 @@ function _interop_require_default(obj) {
 }
 class NpmPackageManager extends _packagemanager.PackageManager {
     clearCache() {
-        (0, _utils.runCommand)('npm', [
+        (0, _utils.runCommand)(this.command, [
             'cache',
             'clear',
             '--force'
@@ -56,14 +56,11 @@ class NpmPackageManager extends _packagemanager.PackageManager {
     }
     installPackages(args = {}, options) {
         var _args_allowScripts;
-        /*
-         * The `true` fallback allows projects a grace period to identify and
-         * allowlist trusted scripts. Remove the fallback when the grace period expires.
-         */ const allowScripts = (0, _utils1.resolveAllowScripts)((_args_allowScripts = args.allowScripts) !== null && _args_allowScripts !== void 0 ? _args_allowScripts : true);
+        const allowScripts = (0, _utils1.resolveAllowScripts)((_args_allowScripts = args.allowScripts) !== null && _args_allowScripts !== void 0 ? _args_allowScripts : []);
         if (!args.quiet) {
             (0, _utils1.logAllowedScripts)(allowScripts);
         }
-        (0, _utils.runCommand)('npm', [
+        (0, _utils.runCommand)(this.command, [
             (0, _utils.isCI)() ? 'ci' : 'i',
             '--audit=false',
             '--fund=false',
@@ -92,9 +89,7 @@ class NpmPackageManager extends _packagemanager.PackageManager {
              * scripts they should add to --allow-scripts. Skip when the user
              * explicitly opted out (`false`); they made an informed choice.
              */ if (allowScripts !== false) {
-                (0, _utils.warnUntrustedInstallScripts)(Array.isArray(allowScripts) ? allowScripts : _utils1.DEFAULT_ALLOWED_SCRIPTS, this.lockFileName, {
-                    force: true
-                });
+                (0, _utils.warnUntrustedInstallScripts)(Array.isArray(allowScripts) ? allowScripts : _utils1.DEFAULT_ALLOWED_SCRIPTS);
             }
             /*
              * When allowScripts is `true`, npm already ran project postinstall.
@@ -108,8 +103,12 @@ class NpmPackageManager extends _packagemanager.PackageManager {
         }
     }
     parseLockFile() {
+        const lockFilePath = this.getLockFilePath();
+        if (!lockFilePath) {
+            return undefined;
+        }
         try {
-            return JSON.parse(_fs.default.readFileSync(this.lockFileName, 'utf-8'));
+            return JSON.parse(_fs.default.readFileSync(lockFilePath, 'utf-8'));
         } catch (unused) {
             return undefined;
         }
@@ -119,15 +118,21 @@ class NpmPackageManager extends _packagemanager.PackageManager {
      * to the hoisted root entry. `workspacePackage` is the package's relative
      * path from the repo root; the empty string `''` denotes the root
      * workspace package itself, matching npm's own lockfile key convention.
+     * Follows link entries to the resolved workspace package, so callers see
+     * the workspace package's own metadata rather than the symlink stub.
      */ findEntry({ workspacePackage, package: packageName }) {
         var _ref;
         var _this_getLockFile;
         const packages = (_this_getLockFile = this.getLockFile()) === null || _this_getLockFile === void 0 ? void 0 : _this_getLockFile.packages;
-        return (_ref = packages === null || packages === void 0 ? void 0 : packages[`${workspacePackage}/node_modules/${packageName}`]) !== null && _ref !== void 0 ? _ref : packages === null || packages === void 0 ? void 0 : packages[`node_modules/${packageName}`];
+        const entry = (_ref = packages === null || packages === void 0 ? void 0 : packages[`${workspacePackage}/node_modules/${packageName}`]) !== null && _ref !== void 0 ? _ref : packages === null || packages === void 0 ? void 0 : packages[`node_modules/${packageName}`];
+        if ((entry === null || entry === void 0 ? void 0 : entry.link) && entry.resolved) {
+            return packages === null || packages === void 0 ? void 0 : packages[entry.resolved];
+        }
+        return entry;
     }
     runRebuild(scripts) {
         try {
-            (0, _utils.runCommand)('npm', [
+            (0, _utils.runCommand)(this.command, [
                 'rebuild',
                 ...scripts
             ]);
@@ -138,7 +143,7 @@ class NpmPackageManager extends _packagemanager.PackageManager {
     }
     runProjectPostinstall(options) {
         try {
-            (0, _utils.runCommand)('npm', [
+            (0, _utils.runCommand)(this.command, [
                 'run',
                 'postinstall',
                 '--if-present'

package/dist/package-manager/npm-package-manager.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/package-manager/npm-package-manager.ts"],"sourcesContent":["/* eslint-disable no-console */\nimport fs from 'fs';\nimport { isCI, runCommand, warnUntrustedInstallScripts } from '../utils';\nimport type { DeclaredVersionQuery, InstallArgs, ResolvedVersionQuery } from './package-manager';\nimport { PackageManager } from './package-manager';\nimport {\n    DEFAULT_ALLOWED_SCRIPTS,\n    logAllowedScripts,\n    resolveAllowScripts,\n    shouldIgnoreScripts,\n} from './utils';\n\ninterface NpmLockFileEntry {\n    version?: string;\n    dependencies?: Record<string, string>;\n    peerDependencies?: Record<string, string>;\n}\n\nexport interface NpmLockFile {\n    packages?: Record<string, NpmLockFileEntry>;\n}\n\nexport class NpmPackageManager extends PackageManager<NpmLockFile> {\n    readonly command = 'npm';\n    readonly lockFileName = 'package-lock.json';\n\n    clearCache() {\n        runCommand('npm', ['cache', 'clear', '--force']);\n    }\n\n    getDeclaredVersion({\n        workspacePackage,\n        declaredBy,\n        dependency,\n    }: DeclaredVersionQuery): string | undefined {\n        const entry = this.findEntry({ workspacePackage, package: declaredBy });\n        return entry?.dependencies?.[dependency] ?? entry?.peerDependencies?.[dependency];\n    }\n\n    getResolvedVersion({ workspacePackage, dependency }: ResolvedVersionQuery): string | undefined {\n        return this.findEntry({ workspacePackage, package: dependency })?.version;\n    }\n\n    installPackages(args: InstallArgs = {}, options?: Parameters<typeof runCommand>[2]) {\n        /*\n         * The `true` fallback allows projects a grace period to identify and\n         * allowlist trusted scripts. Remove the fallback when the grace period expires.\n         */\n        const allowScripts = resolveAllowScripts(args.allowScripts ?? true);\n\n        if (!args.quiet) {\n            logAllowedScripts(allowScripts);\n        }\n\n        runCommand(\n            'npm',\n            [\n                isCI() ? 'ci' : 'i',\n                '--audit=false',\n                '--fund=false',\n                '--legacy-peer-deps',\n                ...(shouldIgnoreScripts(allowScripts) ? ['--ignore-scripts'] : []),\n                ...(args.fix ? ['--package-lock-only', '--prefer-dedupe'] : []),\n            ],\n            options\n        );\n\n        try {\n            if (args.fix) {\n                return;\n            }\n            /*\n             * Rebuild applies when allowScripts is an explicit list:\n             * `true` means npm install already ran every script, `false`\n             * means the user opted out.\n             */\n            if (Array.isArray(allowScripts)) {\n                this.runRebuild(allowScripts);\n            }\n            /*\n             * Warn against the effective allowlist so teams can see which\n             * scripts they should add to --allow-scripts. Skip when the user\n             * explicitly opted out (`false`); they made an informed choice.\n             */\n            if (allowScripts !== false) {\n                warnUntrustedInstallScripts(\n                    Array.isArray(allowScripts) ? allowScripts : DEFAULT_ALLOWED_SCRIPTS,\n                    this.lockFileName,\n                    { force: true }\n                );\n            }\n            /*\n             * When allowScripts is `true`, npm already ran project postinstall.\n             * In other cases, we run it manually. Note, `false` only ignores\n             * package scripts, the project postinstall is always trusted.\n             */\n            if (allowScripts !== true) {\n                this.runProjectPostinstall(options);\n            }\n        } finally {\n            this.reset();\n        }\n    }\n\n    protected parseLockFile(): NpmLockFile | undefined {\n        try {\n            return JSON.parse(fs.readFileSync(this.lockFileName, 'utf-8'));\n        } catch {\n            return undefined;\n        }\n    }\n\n    /**\n     * Looks up a lockfile entry for the given workspace package, falling back\n     * to the hoisted root entry. `workspacePackage` is the package's relative\n     * path from the repo root; the empty string `''` denotes the root\n     * workspace package itself, matching npm's own lockfile key convention.\n     */\n    private findEntry({\n        workspacePackage,\n        package: packageName,\n    }: {\n        workspacePackage: string;\n        package: string;\n    }): NpmLockFileEntry | undefined {\n        const packages = this.getLockFile()?.packages;\n        return (\n            packages?.[`${workspacePackage}/node_modules/${packageName}`] ??\n            packages?.[`node_modules/${packageName}`]\n        );\n    }\n\n    private runRebuild(scripts: string[]) {\n        try {\n            runCommand('npm', ['rebuild', ...scripts]);\n        } catch {\n            console.error(`Failed to run allowed scripts: ${scripts.join(', ')}`);\n            process.exitCode = 1;\n        }\n    }\n\n    private runProjectPostinstall(options?: Parameters<typeof runCommand>[2]) {\n        try {\n            runCommand('npm', ['run', 'postinstall', '--if-present'], options);\n        } catch {\n            process.exitCode = 1;\n        }\n    }\n}\n"],"names":["NpmPackageManager","PackageManager","clearCache","runCommand","getDeclaredVersion","workspacePackage","declaredBy","dependency","entry","findEntry","package","dependencies","peerDependencies","getResolvedVersion","version","installPackages","args","options","allowScripts","resolveAllowScripts","quiet","logAllowedScripts","isCI","shouldIgnoreScripts","fix","Array","isArray","runRebuild","warnUntrustedInstallScripts","DEFAULT_ALLOWED_SCRIPTS","lockFileName","force","runProjectPostinstall","reset","parseLockFile","JSON","parse","fs","readFileSync","undefined","packageName","packages","getLockFile","scripts","console","error","join","process","exitCode","command"],"mappings":"AAAA,6BAA6B;;;;+BAsBhBA;;;eAAAA;;;2DArBE;uBAC+C;gCAE/B;wBAMxB;;;;;;;;;;;;;;;;;;;AAYA,MAAMA,0BAA0BC,8BAAc;IAIjDC,aAAa;QACTC,IAAAA,iBAAU,EAAC,OAAO;YAAC;YAAS;YAAS;SAAU;IACnD;IAEAC,mBAAmB,EACfC,gBAAgB,EAChBC,UAAU,EACVC,UAAU,EACS,EAAsB;;YAElCC,qBAAqCA;QAD5C,MAAMA,QAAQ,IAAI,CAACC,SAAS,CAAC;YAAEJ;YAAkBK,SAASJ;QAAW;QACrE,eAAOE,kBAAAA,6BAAAA,sBAAAA,MAAOG,YAAY,cAAnBH,0CAAAA,mBAAqB,CAACD,WAAW,uCAAIC,kBAAAA,6BAAAA,0BAAAA,MAAOI,gBAAgB,cAAvBJ,8CAAAA,uBAAyB,CAACD,WAAW;IACrF;IAEAM,mBAAmB,EAAER,gBAAgB,EAAEE,UAAU,EAAwB,EAAsB;YACpF;QAAP,QAAO,kBAAA,IAAI,CAACE,SAAS,CAAC;YAAEJ;YAAkBK,SAASH;QAAW,gBAAvD,sCAAA,gBAA2DO,OAAO;IAC7E;IAEAC,gBAAgBC,OAAoB,CAAC,CAAC,EAAEC,OAA0C,EAAE;YAKvCD;QAJzC;;;SAGC,GACD,MAAME,eAAeC,IAAAA,2BAAmB,GAACH,qBAAAA,KAAKE,YAAY,cAAjBF,gCAAAA,qBAAqB;QAE9D,IAAI,CAACA,KAAKI,KAAK,EAAE;YACbC,IAAAA,yBAAiB,EAACH;QACtB;QAEAf,IAAAA,iBAAU,EACN,OACA;YACImB,IAAAA,WAAI,MAAK,OAAO;YAChB;YACA;YACA;eACIC,IAAAA,2BAAmB,EAACL,gBAAgB;gBAAC;aAAmB,GAAG,EAAE;eAC7DF,KAAKQ,GAAG,GAAG;gBAAC;gBAAuB;aAAkB,GAAG,EAAE;SACjE,EACDP;QAGJ,IAAI;YACA,IAAID,KAAKQ,GAAG,EAAE;gBACV;YACJ;YACA;;;;aAIC,GACD,IAAIC,MAAMC,OAAO,CAACR,eAAe;gBAC7B,IAAI,CAACS,UAAU,CAACT;YACpB;YACA;;;;aAIC,GACD,IAAIA,iBAAiB,OAAO;gBACxBU,IAAAA,kCAA2B,EACvBH,MAAMC,OAAO,CAACR,gBAAgBA,eAAeW,+BAAuB,EACpE,IAAI,CAACC,YAAY,EACjB;oBAAEC,OAAO;gBAAK;YAEtB;YACA;;;;aAIC,GACD,IAAIb,iBAAiB,MAAM;gBACvB,IAAI,CAACc,qBAAqB,CAACf;YAC/B;QACJ,SAAU;YACN,IAAI,CAACgB,KAAK;QACd;IACJ;IAEUC,gBAAyC;QAC/C,IAAI;YACA,OAAOC,KAAKC,KAAK,CAACC,WAAE,CAACC,YAAY,CAAC,IAAI,CAACR,YAAY,EAAE;QACzD,EAAE,eAAM;YACJ,OAAOS;QACX;IACJ;IAEA;;;;;KAKC,GACD,AAAQ9B,UAAU,EACdJ,gBAAgB,EAChBK,SAAS8B,WAAW,EAIvB,EAAgC;;YACZ;QAAjB,MAAMC,YAAW,oBAAA,IAAI,CAACC,WAAW,gBAAhB,wCAAA,kBAAoBD,QAAQ;QAC7C,eACIA,qBAAAA,+BAAAA,QAAU,CAAC,GAAGpC,iBAAiB,cAAc,EAAEmC,aAAa,CAAC,uCAC7DC,qBAAAA,+BAAAA,QAAU,CAAC,CAAC,aAAa,EAAED,aAAa,CAAC;IAEjD;IAEQb,WAAWgB,OAAiB,EAAE;QAClC,IAAI;YACAxC,IAAAA,iBAAU,EAAC,OAAO;gBAAC;mBAAcwC;aAAQ;QAC7C,EAAE,eAAM;YACJC,QAAQC,KAAK,CAAC,CAAC,+BAA+B,EAAEF,QAAQG,IAAI,CAAC,OAAO;YACpEC,QAAQC,QAAQ,GAAG;QACvB;IACJ;IAEQhB,sBAAsBf,OAA0C,EAAE;QACtE,IAAI;YACAd,IAAAA,iBAAU,EAAC,OAAO;gBAAC;gBAAO;gBAAe;aAAe,EAAEc;QAC9D,EAAE,eAAM;YACJ8B,QAAQC,QAAQ,GAAG;QACvB;IACJ;;QA7HG,gBACH,uBAASC,WAAU,QACnB,uBAASnB,gBAAe;;AA4H5B"}
+{"version":3,"sources":["../../src/package-manager/npm-package-manager.ts"],"sourcesContent":["/* eslint-disable no-console */\nimport fs from 'fs';\nimport { isCI, runCommand, warnUntrustedInstallScripts } from '../utils';\nimport type { DeclaredVersionQuery, InstallArgs, ResolvedVersionQuery } from './package-manager';\nimport { PackageManager } from './package-manager';\nimport {\n    DEFAULT_ALLOWED_SCRIPTS,\n    logAllowedScripts,\n    resolveAllowScripts,\n    shouldIgnoreScripts,\n} from './utils';\n\ninterface NpmLockFileEntry {\n    version?: string;\n    resolved?: string;\n    link?: boolean;\n    dependencies?: Record<string, string>;\n    peerDependencies?: Record<string, string>;\n}\n\nexport interface NpmLockFile {\n    packages?: Record<string, NpmLockFileEntry>;\n}\n\nexport class NpmPackageManager extends PackageManager<NpmLockFile> {\n    readonly command = 'npm';\n    readonly lockFileName = 'package-lock.json';\n\n    clearCache() {\n        runCommand(this.command, ['cache', 'clear', '--force']);\n    }\n\n    getDeclaredVersion({\n        workspacePackage,\n        declaredBy,\n        dependency,\n    }: DeclaredVersionQuery): string | undefined {\n        const entry = this.findEntry({ workspacePackage, package: declaredBy });\n        return entry?.dependencies?.[dependency] ?? entry?.peerDependencies?.[dependency];\n    }\n\n    getResolvedVersion({ workspacePackage, dependency }: ResolvedVersionQuery): string | undefined {\n        return this.findEntry({ workspacePackage, package: dependency })?.version;\n    }\n\n    installPackages(args: InstallArgs = {}, options?: Parameters<typeof runCommand>[2]) {\n        const allowScripts = resolveAllowScripts(args.allowScripts ?? []);\n\n        if (!args.quiet) {\n            logAllowedScripts(allowScripts);\n        }\n\n        runCommand(\n            this.command,\n            [\n                isCI() ? 'ci' : 'i',\n                '--audit=false',\n                '--fund=false',\n                '--legacy-peer-deps',\n                ...(shouldIgnoreScripts(allowScripts) ? ['--ignore-scripts'] : []),\n                ...(args.fix ? ['--package-lock-only', '--prefer-dedupe'] : []),\n            ],\n            options\n        );\n\n        try {\n            if (args.fix) {\n                return;\n            }\n            /*\n             * Rebuild applies when allowScripts is an explicit list:\n             * `true` means npm install already ran every script, `false`\n             * means the user opted out.\n             */\n            if (Array.isArray(allowScripts)) {\n                this.runRebuild(allowScripts);\n            }\n            /*\n             * Warn against the effective allowlist so teams can see which\n             * scripts they should add to --allow-scripts. Skip when the user\n             * explicitly opted out (`false`); they made an informed choice.\n             */\n            if (allowScripts !== false) {\n                warnUntrustedInstallScripts(\n                    Array.isArray(allowScripts) ? allowScripts : DEFAULT_ALLOWED_SCRIPTS\n                );\n            }\n            /*\n             * When allowScripts is `true`, npm already ran project postinstall.\n             * In other cases, we run it manually. Note, `false` only ignores\n             * package scripts, the project postinstall is always trusted.\n             */\n            if (allowScripts !== true) {\n                this.runProjectPostinstall(options);\n            }\n        } finally {\n            this.reset();\n        }\n    }\n\n    protected parseLockFile(): NpmLockFile | undefined {\n        const lockFilePath = this.getLockFilePath();\n        if (!lockFilePath) {\n            return undefined;\n        }\n        try {\n            return JSON.parse(fs.readFileSync(lockFilePath, 'utf-8'));\n        } catch {\n            return undefined;\n        }\n    }\n\n    /**\n     * Looks up a lockfile entry for the given workspace package, falling back\n     * to the hoisted root entry. `workspacePackage` is the package's relative\n     * path from the repo root; the empty string `''` denotes the root\n     * workspace package itself, matching npm's own lockfile key convention.\n     * Follows link entries to the resolved workspace package, so callers see\n     * the workspace package's own metadata rather than the symlink stub.\n     */\n    private findEntry({\n        workspacePackage,\n        package: packageName,\n    }: {\n        workspacePackage: string;\n        package: string;\n    }): NpmLockFileEntry | undefined {\n        const packages = this.getLockFile()?.packages;\n        const entry =\n            packages?.[`${workspacePackage}/node_modules/${packageName}`] ??\n            packages?.[`node_modules/${packageName}`];\n        if (entry?.link && entry.resolved) {\n            return packages?.[entry.resolved];\n        }\n        return entry;\n    }\n\n    private runRebuild(scripts: string[]) {\n        try {\n            runCommand(this.command, ['rebuild', ...scripts]);\n        } catch {\n            console.error(`Failed to run allowed scripts: ${scripts.join(', ')}`);\n            process.exitCode = 1;\n        }\n    }\n\n    private runProjectPostinstall(options?: Parameters<typeof runCommand>[2]) {\n        try {\n            runCommand(this.command, ['run', 'postinstall', '--if-present'], options);\n        } catch {\n            process.exitCode = 1;\n        }\n    }\n}\n"],"names":["NpmPackageManager","PackageManager","clearCache","runCommand","command","getDeclaredVersion","workspacePackage","declaredBy","dependency","entry","findEntry","package","dependencies","peerDependencies","getResolvedVersion","version","installPackages","args","options","allowScripts","resolveAllowScripts","quiet","logAllowedScripts","isCI","shouldIgnoreScripts","fix","Array","isArray","runRebuild","warnUntrustedInstallScripts","DEFAULT_ALLOWED_SCRIPTS","runProjectPostinstall","reset","parseLockFile","lockFilePath","getLockFilePath","undefined","JSON","parse","fs","readFileSync","packageName","packages","getLockFile","link","resolved","scripts","console","error","join","process","exitCode","lockFileName"],"mappings":"AAAA,6BAA6B;;;;+BAwBhBA;;;eAAAA;;;2DAvBE;uBAC+C;gCAE/B;wBAMxB;;;;;;;;;;;;;;;;;;;AAcA,MAAMA,0BAA0BC,8BAAc;IAIjDC,aAAa;QACTC,IAAAA,iBAAU,EAAC,IAAI,CAACC,OAAO,EAAE;YAAC;YAAS;YAAS;SAAU;IAC1D;IAEAC,mBAAmB,EACfC,gBAAgB,EAChBC,UAAU,EACVC,UAAU,EACS,EAAsB;;YAElCC,qBAAqCA;QAD5C,MAAMA,QAAQ,IAAI,CAACC,SAAS,CAAC;YAAEJ;YAAkBK,SAASJ;QAAW;QACrE,eAAOE,kBAAAA,6BAAAA,sBAAAA,MAAOG,YAAY,cAAnBH,0CAAAA,mBAAqB,CAACD,WAAW,uCAAIC,kBAAAA,6BAAAA,0BAAAA,MAAOI,gBAAgB,cAAvBJ,8CAAAA,uBAAyB,CAACD,WAAW;IACrF;IAEAM,mBAAmB,EAAER,gBAAgB,EAAEE,UAAU,EAAwB,EAAsB;YACpF;QAAP,QAAO,kBAAA,IAAI,CAACE,SAAS,CAAC;YAAEJ;YAAkBK,SAASH;QAAW,gBAAvD,sCAAA,gBAA2DO,OAAO;IAC7E;IAEAC,gBAAgBC,OAAoB,CAAC,CAAC,EAAEC,OAA0C,EAAE;YACvCD;QAAzC,MAAME,eAAeC,IAAAA,2BAAmB,GAACH,qBAAAA,KAAKE,YAAY,cAAjBF,gCAAAA,qBAAqB,EAAE;QAEhE,IAAI,CAACA,KAAKI,KAAK,EAAE;YACbC,IAAAA,yBAAiB,EAACH;QACtB;QAEAhB,IAAAA,iBAAU,EACN,IAAI,CAACC,OAAO,EACZ;YACImB,IAAAA,WAAI,MAAK,OAAO;YAChB;YACA;YACA;eACIC,IAAAA,2BAAmB,EAACL,gBAAgB;gBAAC;aAAmB,GAAG,EAAE;eAC7DF,KAAKQ,GAAG,GAAG;gBAAC;gBAAuB;aAAkB,GAAG,EAAE;SACjE,EACDP;QAGJ,IAAI;YACA,IAAID,KAAKQ,GAAG,EAAE;gBACV;YACJ;YACA;;;;aAIC,GACD,IAAIC,MAAMC,OAAO,CAACR,eAAe;gBAC7B,IAAI,CAACS,UAAU,CAACT;YACpB;YACA;;;;aAIC,GACD,IAAIA,iBAAiB,OAAO;gBACxBU,IAAAA,kCAA2B,EACvBH,MAAMC,OAAO,CAACR,gBAAgBA,eAAeW,+BAAuB;YAE5E;YACA;;;;aAIC,GACD,IAAIX,iBAAiB,MAAM;gBACvB,IAAI,CAACY,qBAAqB,CAACb;YAC/B;QACJ,SAAU;YACN,IAAI,CAACc,KAAK;QACd;IACJ;IAEUC,gBAAyC;QAC/C,MAAMC,eAAe,IAAI,CAACC,eAAe;QACzC,IAAI,CAACD,cAAc;YACf,OAAOE;QACX;QACA,IAAI;YACA,OAAOC,KAAKC,KAAK,CAACC,WAAE,CAACC,YAAY,CAACN,cAAc;QACpD,EAAE,eAAM;YACJ,OAAOE;QACX;IACJ;IAEA;;;;;;;KAOC,GACD,AAAQ1B,UAAU,EACdJ,gBAAgB,EAChBK,SAAS8B,WAAW,EAIvB,EAAgC;;YACZ;QAAjB,MAAMC,YAAW,oBAAA,IAAI,CAACC,WAAW,gBAAhB,wCAAA,kBAAoBD,QAAQ;QAC7C,MAAMjC,gBACFiC,qBAAAA,+BAAAA,QAAU,CAAC,GAAGpC,iBAAiB,cAAc,EAAEmC,aAAa,CAAC,uCAC7DC,qBAAAA,+BAAAA,QAAU,CAAC,CAAC,aAAa,EAAED,aAAa,CAAC;QAC7C,IAAIhC,CAAAA,kBAAAA,4BAAAA,MAAOmC,IAAI,KAAInC,MAAMoC,QAAQ,EAAE;YAC/B,OAAOH,qBAAAA,+BAAAA,QAAU,CAACjC,MAAMoC,QAAQ,CAAC;QACrC;QACA,OAAOpC;IACX;IAEQmB,WAAWkB,OAAiB,EAAE;QAClC,IAAI;YACA3C,IAAAA,iBAAU,EAAC,IAAI,CAACC,OAAO,EAAE;gBAAC;mBAAc0C;aAAQ;QACpD,EAAE,eAAM;YACJC,QAAQC,KAAK,CAAC,CAAC,+BAA+B,EAAEF,QAAQG,IAAI,CAAC,OAAO;YACpEC,QAAQC,QAAQ,GAAG;QACvB;IACJ;IAEQpB,sBAAsBb,OAA0C,EAAE;QACtE,IAAI;YACAf,IAAAA,iBAAU,EAAC,IAAI,CAACC,OAAO,EAAE;gBAAC;gBAAO;gBAAe;aAAe,EAAEc;QACrE,EAAE,eAAM;YACJgC,QAAQC,QAAQ,GAAG;QACvB;IACJ;;QAhIG,gBACH,uBAAS/C,WAAU,QACnB,uBAASgD,gBAAe;;AA+H5B"}

package/dist/package-manager/package-manager.d.ts

@@ -19,8 +19,16 @@ export declare abstract class PackageManager<LockFile = unknown> {
     abstract readonly command: string;
     abstract readonly lockFileName: string;
     hasValidLockFile(): boolean;
+    getLockFilePath(): string | undefined;
+    /**
+     * Returns the lockfile key for a package given its absolute or
+     * cwd-relative directory. Both npm and pnpm key their lockfile entries
+     * by the package's path relative to the workspace root.
+     */
+    getWorkspacePackage(packageDir?: string): string;
     protected getLockFile(): LockFile | undefined;
     protected reset(): void;
+    protected get rootWorkspacePackage(): string;
     abstract clearCache(): void;
     abstract getDeclaredVersion(query: DeclaredVersionQuery): string | undefined;
     abstract getResolvedVersion(query: ResolvedVersionQuery): string | undefined;

package/dist/package-manager/package-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"package-manager.d.ts","sourceRoot":"","sources":["../../src/package-manager/package-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEtC,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC;AAEnD,MAAM,WAAW,WAAW;IACxB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACjC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACjC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,8BAAsB,cAAc,CAAC,QAAQ,GAAG,OAAO;;IACnD,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAKvC,gBAAgB,IAAI,OAAO;IAI3B,SAAS,CAAC,WAAW,IAAI,QAAQ,GAAG,SAAS;IAQ7C,SAAS,CAAC,KAAK;IAKf,QAAQ,CAAC,UAAU,IAAI,IAAI;IAC3B,QAAQ,CAAC,kBAAkB,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAC5E,QAAQ,CAAC,kBAAkB,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAC5E,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI;IAE9F,SAAS,CAAC,QAAQ,CAAC,aAAa,IAAI,QAAQ,GAAG,SAAS;CAC3D"}
+{"version":3,"file":"package-manager.d.ts","sourceRoot":"","sources":["../../src/package-manager/package-manager.ts"],"names":[],"mappings":"AAEA,OAAO,EAAU,UAAU,EAAE,MAAM,UAAU,CAAC;AAE9C,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC;AAEnD,MAAM,WAAW,WAAW;IACxB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACjC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACjC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,8BAAsB,cAAc,CAAC,QAAQ,GAAG,OAAO;;IACnD,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAOvC,gBAAgB,IAAI,OAAO;IAI3B,eAAe,IAAI,MAAM,GAAG,SAAS;IAWrC;;;;OAIG;IACH,mBAAmB,CAAC,UAAU,SAAgB,GAAG,MAAM;IAYvD,SAAS,CAAC,WAAW,IAAI,QAAQ,GAAG,SAAS;IAQ7C,SAAS,CAAC,KAAK;IAOf,SAAS,KAAK,oBAAoB,IAAI,MAAM,CAE3C;IAED,QAAQ,CAAC,UAAU,IAAI,IAAI;IAC3B,QAAQ,CAAC,kBAAkB,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAC5E,QAAQ,CAAC,kBAAkB,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAC5E,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI;IAE9F,SAAS,CAAC,QAAQ,CAAC,aAAa,IAAI,QAAQ,GAAG,SAAS;CAC3D"}

package/dist/package-manager/package-manager.js

@@ -8,6 +8,9 @@ Object.defineProperty(exports, "PackageManager", {
         return PackageManager;
     }
 });
+const _fs = /*#__PURE__*/ _interop_require_default(require("fs"));
+const _nodepath = /*#__PURE__*/ _interop_require_default(require("node:path"));
+const _utils = require("../utils");
 function _check_private_redeclaration(obj, privateCollection) {
     if (privateCollection.has(obj)) {
         throw new TypeError("Cannot initialize the same private elements twice on an object");
@@ -48,11 +51,38 @@ function _class_private_field_set(receiver, privateMap, value) {
     _class_apply_descriptor_set(receiver, descriptor, value);
     return value;
 }
-var _lockFile = /*#__PURE__*/ new WeakMap(), _lockFileLoaded = /*#__PURE__*/ new WeakMap();
+function _interop_require_default(obj) {
+    return obj && obj.__esModule ? obj : {
+        default: obj
+    };
+}
+var _lockFile = /*#__PURE__*/ new WeakMap(), _lockFileLoaded = /*#__PURE__*/ new WeakMap(), _lockFilePath = /*#__PURE__*/ new WeakMap(), _lockFilePathLoaded = /*#__PURE__*/ new WeakMap();
 class PackageManager {
     hasValidLockFile() {
         return this.getLockFile() !== undefined;
     }
+    getLockFilePath() {
+        if (!_class_private_field_get(this, _lockFilePathLoaded)) {
+            _class_private_field_set(this, _lockFilePath, (0, _utils.findUp)((directory)=>{
+                const candidate = _nodepath.default.join(directory, this.lockFileName);
+                return _fs.default.existsSync(candidate) ? candidate : undefined;
+            }));
+            _class_private_field_set(this, _lockFilePathLoaded, true);
+        }
+        return _class_private_field_get(this, _lockFilePath);
+    }
+    /**
+     * Returns the lockfile key for a package given its absolute or
+     * cwd-relative directory. Both npm and pnpm key their lockfile entries
+     * by the package's path relative to the workspace root.
+     */ getWorkspacePackage(packageDir = process.cwd()) {
+        const lockFilePath = this.getLockFilePath();
+        if (!lockFilePath) {
+            return this.rootWorkspacePackage;
+        }
+        const relative = _nodepath.default.relative(_nodepath.default.dirname(lockFilePath), _nodepath.default.resolve(packageDir)).split(_nodepath.default.sep).join('/');
+        return relative === '' ? this.rootWorkspacePackage : relative;
+    }
     getLockFile() {
         if (!_class_private_field_get(this, _lockFileLoaded)) {
             _class_private_field_set(this, _lockFile, this.parseLockFile());
@@ -63,6 +93,11 @@ class PackageManager {
     reset() {
         _class_private_field_set(this, _lockFile, undefined);
         _class_private_field_set(this, _lockFileLoaded, false);
+        _class_private_field_set(this, _lockFilePath, undefined);
+        _class_private_field_set(this, _lockFilePathLoaded, false);
+    }
+    get rootWorkspacePackage() {
+        return '';
     }
     constructor(){
         _class_private_field_init(this, _lockFile, {
@@ -73,6 +108,14 @@ class PackageManager {
             writable: true,
             value: false
         });
+        _class_private_field_init(this, _lockFilePath, {
+            writable: true,
+            value: void 0
+        });
+        _class_private_field_init(this, _lockFilePathLoaded, {
+            writable: true,
+            value: false
+        });
     }
 }
 

package/dist/package-manager/package-manager.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/package-manager/package-manager.ts"],"sourcesContent":["import { runCommand } from '../utils';\n\nexport type AllowScripts = true | false | string[];\n\nexport interface InstallArgs {\n    allowScripts?: AllowScripts;\n    fix?: boolean;\n    quiet?: boolean;\n}\n\nexport interface DeclaredVersionQuery {\n    workspacePackage: string;\n    declaredBy: string;\n    dependency: string;\n}\n\nexport interface ResolvedVersionQuery {\n    workspacePackage: string;\n    dependency: string;\n}\n\nexport abstract class PackageManager<LockFile = unknown> {\n    abstract readonly command: string;\n    abstract readonly lockFileName: string;\n\n    #lockFile: LockFile | undefined;\n    #lockFileLoaded = false;\n\n    hasValidLockFile(): boolean {\n        return this.getLockFile() !== undefined;\n    }\n\n    protected getLockFile(): LockFile | undefined {\n        if (!this.#lockFileLoaded) {\n            this.#lockFile = this.parseLockFile();\n            this.#lockFileLoaded = true;\n        }\n        return this.#lockFile;\n    }\n\n    protected reset() {\n        this.#lockFile = undefined;\n        this.#lockFileLoaded = false;\n    }\n\n    abstract clearCache(): void;\n    abstract getDeclaredVersion(query: DeclaredVersionQuery): string | undefined;\n    abstract getResolvedVersion(query: ResolvedVersionQuery): string | undefined;\n    abstract installPackages(args?: InstallArgs, options?: Parameters<typeof runCommand>[2]): void;\n\n    protected abstract parseLockFile(): LockFile | undefined;\n}\n"],"names":["PackageManager","hasValidLockFile","getLockFile","undefined","parseLockFile","reset"],"mappings":";;;;+BAqBsBA;;;eAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAIlB,yCACA;AALG,MAAeA;IAOlBC,mBAA4B;QACxB,OAAO,IAAI,CAACC,WAAW,OAAOC;IAClC;IAEUD,cAAoC;QAC1C,IAAI,0BAAC,IAAI,EAAC,kBAAiB;2CAClB,WAAY,IAAI,CAACE,aAAa;2CAC9B,iBAAkB;QAC3B;QACA,gCAAO,IAAI,EAAC;IAChB;IAEUC,QAAQ;uCACT,WAAYF;uCACZ,iBAAkB;IAC3B;;QAlBA,gCAAA;;mBAAA,KAAA;;QACA,gCAAA;;mBAAkB;;;AAyBtB"}
+{"version":3,"sources":["../../src/package-manager/package-manager.ts"],"sourcesContent":["import fs from 'fs';\nimport path from 'node:path';\nimport { findUp, runCommand } from '../utils';\n\nexport type AllowScripts = true | false | string[];\n\nexport interface InstallArgs {\n    allowScripts?: AllowScripts;\n    fix?: boolean;\n    quiet?: boolean;\n}\n\nexport interface DeclaredVersionQuery {\n    workspacePackage: string;\n    declaredBy: string;\n    dependency: string;\n}\n\nexport interface ResolvedVersionQuery {\n    workspacePackage: string;\n    dependency: string;\n}\n\nexport abstract class PackageManager<LockFile = unknown> {\n    abstract readonly command: string;\n    abstract readonly lockFileName: string;\n\n    #lockFile: LockFile | undefined;\n    #lockFileLoaded = false;\n    #lockFilePath: string | undefined;\n    #lockFilePathLoaded = false;\n\n    hasValidLockFile(): boolean {\n        return this.getLockFile() !== undefined;\n    }\n\n    getLockFilePath(): string | undefined {\n        if (!this.#lockFilePathLoaded) {\n            this.#lockFilePath = findUp(directory => {\n                const candidate = path.join(directory, this.lockFileName);\n                return fs.existsSync(candidate) ? candidate : undefined;\n            });\n            this.#lockFilePathLoaded = true;\n        }\n        return this.#lockFilePath;\n    }\n\n    /**\n     * Returns the lockfile key for a package given its absolute or\n     * cwd-relative directory. Both npm and pnpm key their lockfile entries\n     * by the package's path relative to the workspace root.\n     */\n    getWorkspacePackage(packageDir = process.cwd()): string {\n        const lockFilePath = this.getLockFilePath();\n        if (!lockFilePath) {\n            return this.rootWorkspacePackage;\n        }\n        const relative = path\n            .relative(path.dirname(lockFilePath), path.resolve(packageDir))\n            .split(path.sep)\n            .join('/');\n        return relative === '' ? this.rootWorkspacePackage : relative;\n    }\n\n    protected getLockFile(): LockFile | undefined {\n        if (!this.#lockFileLoaded) {\n            this.#lockFile = this.parseLockFile();\n            this.#lockFileLoaded = true;\n        }\n        return this.#lockFile;\n    }\n\n    protected reset() {\n        this.#lockFile = undefined;\n        this.#lockFileLoaded = false;\n        this.#lockFilePath = undefined;\n        this.#lockFilePathLoaded = false;\n    }\n\n    protected get rootWorkspacePackage(): string {\n        return '';\n    }\n\n    abstract clearCache(): void;\n    abstract getDeclaredVersion(query: DeclaredVersionQuery): string | undefined;\n    abstract getResolvedVersion(query: ResolvedVersionQuery): string | undefined;\n    abstract installPackages(args?: InstallArgs, options?: Parameters<typeof runCommand>[2]): void;\n\n    protected abstract parseLockFile(): LockFile | undefined;\n}\n"],"names":["PackageManager","hasValidLockFile","getLockFile","undefined","getLockFilePath","findUp","directory","candidate","path","join","lockFileName","fs","existsSync","getWorkspacePackage","packageDir","process","cwd","lockFilePath","rootWorkspacePackage","relative","dirname","resolve","split","sep","parseLockFile","reset"],"mappings":";;;;+BAuBsBA;;;eAAAA;;;2DAvBP;iEACE;uBACkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAyB/B,yCACA,+CACA,6CACA;AAPG,MAAeA;IASlBC,mBAA4B;QACxB,OAAO,IAAI,CAACC,WAAW,OAAOC;IAClC;IAEAC,kBAAsC;QAClC,IAAI,0BAAC,IAAI,EAAC,sBAAqB;2CACtB,eAAgBC,IAAAA,aAAM,EAACC,CAAAA;gBACxB,MAAMC,YAAYC,iBAAI,CAACC,IAAI,CAACH,WAAW,IAAI,CAACI,YAAY;gBACxD,OAAOC,WAAE,CAACC,UAAU,CAACL,aAAaA,YAAYJ;YAClD;2CACK,qBAAsB;QAC/B;QACA,gCAAO,IAAI,EAAC;IAChB;IAEA;;;;KAIC,GACDU,oBAAoBC,aAAaC,QAAQC,GAAG,EAAE,EAAU;QACpD,MAAMC,eAAe,IAAI,CAACb,eAAe;QACzC,IAAI,CAACa,cAAc;YACf,OAAO,IAAI,CAACC,oBAAoB;QACpC;QACA,MAAMC,WAAWX,iBAAI,CAChBW,QAAQ,CAACX,iBAAI,CAACY,OAAO,CAACH,eAAeT,iBAAI,CAACa,OAAO,CAACP,aAClDQ,KAAK,CAACd,iBAAI,CAACe,GAAG,EACdd,IAAI,CAAC;QACV,OAAOU,aAAa,KAAK,IAAI,CAACD,oBAAoB,GAAGC;IACzD;IAEUjB,cAAoC;QAC1C,IAAI,0BAAC,IAAI,EAAC,kBAAiB;2CAClB,WAAY,IAAI,CAACsB,aAAa;2CAC9B,iBAAkB;QAC3B;QACA,gCAAO,IAAI,EAAC;IAChB;IAEUC,QAAQ;uCACT,WAAYtB;uCACZ,iBAAkB;uCAClB,eAAgBA;uCAChB,qBAAsB;IAC/B;IAEA,IAAce,uBAA+B;QACzC,OAAO;IACX;;QAtDA,gCAAA;;mBAAA,KAAA;;QACA,gCAAA;;mBAAkB;;QAClB,gCAAA;;mBAAA,KAAA;;QACA,gCAAA;;mBAAsB;;;AA2D1B"}

package/dist/package-manager/pnpm-package-manager.d.ts

@@ -21,6 +21,7 @@ export interface PnpmLockFile {
 export declare class PnpmPackageManager extends PackageManager<PnpmLockFile> {
     readonly command = "pnpm";
     readonly lockFileName = "pnpm-lock.yaml";
+    protected get rootWorkspacePackage(): string;
     clearCache(): void;
     getDeclaredVersion({ workspacePackage, declaredBy, dependency, }: DeclaredVersionQuery): string | undefined;
     getResolvedVersion({ workspacePackage, dependency }: ResolvedVersionQuery): string | undefined;

package/dist/package-manager/pnpm-package-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pnpm-package-manager.d.ts","sourceRoot":"","sources":["../../src/package-manager/pnpm-package-manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAQ,UAAU,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,UAAU,iBAAiB;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,YAAY;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACpD,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAC5D;AAED,UAAU,YAAY;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,YAAY;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CAC5C;AAED,qBAAa,kBAAmB,SAAQ,cAAc,CAAC,YAAY,CAAC;IAChE,QAAQ,CAAC,OAAO,UAAU;IAC1B,QAAQ,CAAC,YAAY,oBAAoB;IAEzC,UAAU;IAIV,kBAAkB,CAAC,EACf,gBAAgB,EAChB,UAAU,EACV,UAAU,GACb,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAS5C,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAI9F,eAAe,CAAC,IAAI,GAAE,WAAgB,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IAgBlF,SAAS,CAAC,aAAa,IAAI,YAAY,GAAG,SAAS;IAanD,OAAO,CAAC,cAAc;CAQzB"}
+{"version":3,"file":"pnpm-package-manager.d.ts","sourceRoot":"","sources":["../../src/package-manager/pnpm-package-manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAQ,UAAU,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,UAAU,iBAAiB;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,YAAY;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACpD,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAC5D;AAED,UAAU,YAAY;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,YAAY;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CAC5C;AAED,qBAAa,kBAAmB,SAAQ,cAAc,CAAC,YAAY,CAAC;IAChE,QAAQ,CAAC,OAAO,UAAU;IAC1B,QAAQ,CAAC,YAAY,oBAAoB;IAEzC,cAAuB,oBAAoB,IAAI,MAAM,CAEpD;IAED,UAAU;IAIV,kBAAkB,CAAC,EACf,gBAAgB,EAChB,UAAU,EACV,UAAU,GACb,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAS5C,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAI9F,eAAe,CAAC,IAAI,GAAE,WAAgB,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IAgBlF,SAAS,CAAC,aAAa,IAAI,YAAY,GAAG,SAAS;IAiBnD,OAAO,CAAC,cAAc;CAQzB"}

package/dist/package-manager/pnpm-package-manager.js

@@ -30,8 +30,11 @@ function _interop_require_default(obj) {
     };
 }
 class PnpmPackageManager extends _packagemanager.PackageManager {
+    get rootWorkspacePackage() {
+        return '.';
+    }
     clearCache() {
-        (0, _utils.runCommand)('pnpm', [
+        (0, _utils.runCommand)(this.command, [
             'store',
             'prune'
         ]);
@@ -51,7 +54,7 @@ class PnpmPackageManager extends _packagemanager.PackageManager {
     }
     installPackages(args = {}, options) {
         try {
-            (0, _utils.runCommand)('pnpm', [
+            (0, _utils.runCommand)(this.command, [
                 'install',
                 ...(0, _utils.isCI)() ? [
                     '--frozen-lockfile'
@@ -65,12 +68,16 @@ class PnpmPackageManager extends _packagemanager.PackageManager {
         }
     }
     parseLockFile() {
+        const lockFilePath = this.getLockFilePath();
+        if (!lockFilePath) {
+            return undefined;
+        }
         /*
          * js-yaml is an optional peer; let MODULE_NOT_FOUND surface so a caller
          * missing the dep gets a clear error instead of silent `undefined`.
          */ const yaml = require('js-yaml');
         try {
-            return yaml.load(_fs.default.readFileSync(this.lockFileName, 'utf-8'));
+            return yaml.load(_fs.default.readFileSync(lockFilePath, 'utf-8'));
         } catch (unused) {
             return undefined;
         }

package/dist/package-manager/pnpm-package-manager.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/package-manager/pnpm-package-manager.ts"],"sourcesContent":["import fs from 'fs';\nimport { isCI, runCommand } from '../utils';\nimport type { DeclaredVersionQuery, InstallArgs, ResolvedVersionQuery } from './package-manager';\nimport { PackageManager } from './package-manager';\n\ninterface PnpmImporterEntry {\n    specifier: string;\n    version: string;\n}\n\ninterface PnpmImporter {\n    dependencies?: Record<string, PnpmImporterEntry>;\n    devDependencies?: Record<string, PnpmImporterEntry>;\n    optionalDependencies?: Record<string, PnpmImporterEntry>;\n}\n\ninterface PnpmSnapshot {\n    dependencies?: Record<string, string>;\n    peerDependencies?: Record<string, string>;\n}\n\nexport interface PnpmLockFile {\n    importers?: Record<string, PnpmImporter>;\n    snapshots?: Record<string, PnpmSnapshot>;\n}\n\nexport class PnpmPackageManager extends PackageManager<PnpmLockFile> {\n    readonly command = 'pnpm';\n    readonly lockFileName = 'pnpm-lock.yaml';\n\n    clearCache() {\n        runCommand('pnpm', ['store', 'prune']);\n    }\n\n    getDeclaredVersion({\n        workspacePackage,\n        declaredBy,\n        dependency,\n    }: DeclaredVersionQuery): string | undefined {\n        const declaredByVersion = this.resolveVersion(workspacePackage, declaredBy);\n        if (!declaredByVersion) {\n            return undefined;\n        }\n        const snapshot = this.getLockFile()?.snapshots?.[`${declaredBy}@${declaredByVersion}`];\n        return snapshot?.dependencies?.[dependency] ?? snapshot?.peerDependencies?.[dependency];\n    }\n\n    getResolvedVersion({ workspacePackage, dependency }: ResolvedVersionQuery): string | undefined {\n        return this.resolveVersion(workspacePackage, dependency);\n    }\n\n    installPackages(args: InstallArgs = {}, options?: Parameters<typeof runCommand>[2]) {\n        try {\n            runCommand(\n                'pnpm',\n                [\n                    'install',\n                    ...(isCI() ? ['--frozen-lockfile'] : []),\n                    ...(args.fix ? ['--lockfile-only'] : []),\n                ],\n                options\n            );\n        } finally {\n            this.reset();\n        }\n    }\n\n    protected parseLockFile(): PnpmLockFile | undefined {\n        /*\n         * js-yaml is an optional peer; let MODULE_NOT_FOUND surface so a caller\n         * missing the dep gets a clear error instead of silent `undefined`.\n         */\n        const yaml = require('js-yaml');\n        try {\n            return yaml.load(fs.readFileSync(this.lockFileName, 'utf-8'));\n        } catch {\n            return undefined;\n        }\n    }\n\n    private resolveVersion(workspacePackage: string, dependency: string): string | undefined {\n        const importer = this.getLockFile()?.importers?.[workspacePackage];\n        const entry =\n            importer?.dependencies?.[dependency] ??\n            importer?.devDependencies?.[dependency] ??\n            importer?.optionalDependencies?.[dependency];\n        return entry ? stripPeerDependencySuffix(entry.version) : undefined;\n    }\n}\n\nfunction stripPeerDependencySuffix(version: string): string {\n    // e.g., \"1.2.3(react@18.2.0)(react-dom@18.2.0)\" → \"1.2.3\"\n    return version.split('(')[0];\n}\n"],"names":["PnpmPackageManager","PackageManager","clearCache","runCommand","getDeclaredVersion","workspacePackage","declaredBy","dependency","snapshot","declaredByVersion","resolveVersion","undefined","getLockFile","snapshots","dependencies","peerDependencies","getResolvedVersion","installPackages","args","options","isCI","fix","reset","parseLockFile","yaml","require","load","fs","readFileSync","lockFileName","importer","importers","entry","devDependencies","optionalDependencies","stripPeerDependencySuffix","version","command","split"],"mappings":";;;;+BA0BaA;;;eAAAA;;;2DA1BE;uBACkB;gCAEF;;;;;;;;;;;;;;;;;;;AAuBxB,MAAMA,2BAA2BC,8BAAc;IAIlDC,aAAa;QACTC,IAAAA,iBAAU,EAAC,QAAQ;YAAC;YAAS;SAAQ;IACzC;IAEAC,mBAAmB,EACfC,gBAAgB,EAChBC,UAAU,EACVC,UAAU,EACS,EAAsB;;YAKxB,6BAAA,mBACVC,wBAAwCA;QAL/C,MAAMC,oBAAoB,IAAI,CAACC,cAAc,CAACL,kBAAkBC;QAChE,IAAI,CAACG,mBAAmB;YACpB,OAAOE;QACX;QACA,MAAMH,YAAW,oBAAA,IAAI,CAACI,WAAW,gBAAhB,yCAAA,8BAAA,kBAAoBC,SAAS,cAA7B,kDAAA,2BAA+B,CAAC,GAAGP,WAAW,CAAC,EAAEG,mBAAmB,CAAC;QACtF,eAAOD,qBAAAA,gCAAAA,yBAAAA,SAAUM,YAAY,cAAtBN,6CAAAA,sBAAwB,CAACD,WAAW,uCAAIC,qBAAAA,gCAAAA,6BAAAA,SAAUO,gBAAgB,cAA1BP,iDAAAA,0BAA4B,CAACD,WAAW;IAC3F;IAEAS,mBAAmB,EAAEX,gBAAgB,EAAEE,UAAU,EAAwB,EAAsB;QAC3F,OAAO,IAAI,CAACG,cAAc,CAACL,kBAAkBE;IACjD;IAEAU,gBAAgBC,OAAoB,CAAC,CAAC,EAAEC,OAA0C,EAAE;QAChF,IAAI;YACAhB,IAAAA,iBAAU,EACN,QACA;gBACI;mBACIiB,IAAAA,WAAI,MAAK;oBAAC;iBAAoB,GAAG,EAAE;mBACnCF,KAAKG,GAAG,GAAG;oBAAC;iBAAkB,GAAG,EAAE;aAC1C,EACDF;QAER,SAAU;YACN,IAAI,CAACG,KAAK;QACd;IACJ;IAEUC,gBAA0C;QAChD;;;SAGC,GACD,MAAMC,OAAOC,QAAQ;QACrB,IAAI;YACA,OAAOD,KAAKE,IAAI,CAACC,WAAE,CAACC,YAAY,CAAC,IAAI,CAACC,YAAY,EAAE;QACxD,EAAE,eAAM;YACJ,OAAOlB;QACX;IACJ;IAEQD,eAAeL,gBAAwB,EAAEE,UAAkB,EAAsB;YAGjFuB;YAFa,6BAAA,mBAEbA,wBACAA,2BACAA;QAJJ,MAAMA,YAAW,oBAAA,IAAI,CAAClB,WAAW,gBAAhB,yCAAA,8BAAA,kBAAoBmB,SAAS,cAA7B,kDAAA,2BAA+B,CAAC1B,iBAAiB;QAClE,MAAM2B,SACFF,gBAAAA,qBAAAA,gCAAAA,yBAAAA,SAAUhB,YAAY,cAAtBgB,6CAAAA,sBAAwB,CAACvB,WAAW,yCACpCuB,qBAAAA,gCAAAA,4BAAAA,SAAUG,eAAe,cAAzBH,gDAAAA,yBAA2B,CAACvB,WAAW,cADvCuB,kBAAAA,OAEAA,qBAAAA,gCAAAA,iCAAAA,SAAUI,oBAAoB,cAA9BJ,qDAAAA,8BAAgC,CAACvB,WAAW;QAChD,OAAOyB,QAAQG,0BAA0BH,MAAMI,OAAO,IAAIzB;IAC9D;;QA7DG,gBACH,uBAAS0B,WAAU,SACnB,uBAASR,gBAAe;;AA4D5B;AAEA,SAASM,0BAA0BC,OAAe;IAC9C,0DAA0D;IAC1D,OAAOA,QAAQE,KAAK,CAAC,IAAI,CAAC,EAAE;AAChC"}
+{"version":3,"sources":["../../src/package-manager/pnpm-package-manager.ts"],"sourcesContent":["import fs from 'fs';\nimport { isCI, runCommand } from '../utils';\nimport type { DeclaredVersionQuery, InstallArgs, ResolvedVersionQuery } from './package-manager';\nimport { PackageManager } from './package-manager';\n\ninterface PnpmImporterEntry {\n    specifier: string;\n    version: string;\n}\n\ninterface PnpmImporter {\n    dependencies?: Record<string, PnpmImporterEntry>;\n    devDependencies?: Record<string, PnpmImporterEntry>;\n    optionalDependencies?: Record<string, PnpmImporterEntry>;\n}\n\ninterface PnpmSnapshot {\n    dependencies?: Record<string, string>;\n    peerDependencies?: Record<string, string>;\n}\n\nexport interface PnpmLockFile {\n    importers?: Record<string, PnpmImporter>;\n    snapshots?: Record<string, PnpmSnapshot>;\n}\n\nexport class PnpmPackageManager extends PackageManager<PnpmLockFile> {\n    readonly command = 'pnpm';\n    readonly lockFileName = 'pnpm-lock.yaml';\n\n    protected override get rootWorkspacePackage(): string {\n        return '.';\n    }\n\n    clearCache() {\n        runCommand(this.command, ['store', 'prune']);\n    }\n\n    getDeclaredVersion({\n        workspacePackage,\n        declaredBy,\n        dependency,\n    }: DeclaredVersionQuery): string | undefined {\n        const declaredByVersion = this.resolveVersion(workspacePackage, declaredBy);\n        if (!declaredByVersion) {\n            return undefined;\n        }\n        const snapshot = this.getLockFile()?.snapshots?.[`${declaredBy}@${declaredByVersion}`];\n        return snapshot?.dependencies?.[dependency] ?? snapshot?.peerDependencies?.[dependency];\n    }\n\n    getResolvedVersion({ workspacePackage, dependency }: ResolvedVersionQuery): string | undefined {\n        return this.resolveVersion(workspacePackage, dependency);\n    }\n\n    installPackages(args: InstallArgs = {}, options?: Parameters<typeof runCommand>[2]) {\n        try {\n            runCommand(\n                this.command,\n                [\n                    'install',\n                    ...(isCI() ? ['--frozen-lockfile'] : []),\n                    ...(args.fix ? ['--lockfile-only'] : []),\n                ],\n                options\n            );\n        } finally {\n            this.reset();\n        }\n    }\n\n    protected parseLockFile(): PnpmLockFile | undefined {\n        const lockFilePath = this.getLockFilePath();\n        if (!lockFilePath) {\n            return undefined;\n        }\n        /*\n         * js-yaml is an optional peer; let MODULE_NOT_FOUND surface so a caller\n         * missing the dep gets a clear error instead of silent `undefined`.\n         */\n        const yaml = require('js-yaml');\n        try {\n            return yaml.load(fs.readFileSync(lockFilePath, 'utf-8'));\n        } catch {\n            return undefined;\n        }\n    }\n\n    private resolveVersion(workspacePackage: string, dependency: string): string | undefined {\n        const importer = this.getLockFile()?.importers?.[workspacePackage];\n        const entry =\n            importer?.dependencies?.[dependency] ??\n            importer?.devDependencies?.[dependency] ??\n            importer?.optionalDependencies?.[dependency];\n        return entry ? stripPeerDependencySuffix(entry.version) : undefined;\n    }\n}\n\nfunction stripPeerDependencySuffix(version: string): string {\n    // e.g., \"1.2.3(react@18.2.0)(react-dom@18.2.0)\" → \"1.2.3\"\n    return version.split('(')[0];\n}\n"],"names":["PnpmPackageManager","PackageManager","rootWorkspacePackage","clearCache","runCommand","command","getDeclaredVersion","workspacePackage","declaredBy","dependency","snapshot","declaredByVersion","resolveVersion","undefined","getLockFile","snapshots","dependencies","peerDependencies","getResolvedVersion","installPackages","args","options","isCI","fix","reset","parseLockFile","lockFilePath","getLockFilePath","yaml","require","load","fs","readFileSync","importer","importers","entry","devDependencies","optionalDependencies","stripPeerDependencySuffix","version","lockFileName","split"],"mappings":";;;;+BA0BaA;;;eAAAA;;;2DA1BE;uBACkB;gCAEF;;;;;;;;;;;;;;;;;;;AAuBxB,MAAMA,2BAA2BC,8BAAc;IAIlD,IAAuBC,uBAA+B;QAClD,OAAO;IACX;IAEAC,aAAa;QACTC,IAAAA,iBAAU,EAAC,IAAI,CAACC,OAAO,EAAE;YAAC;YAAS;SAAQ;IAC/C;IAEAC,mBAAmB,EACfC,gBAAgB,EAChBC,UAAU,EACVC,UAAU,EACS,EAAsB;;YAKxB,6BAAA,mBACVC,wBAAwCA;QAL/C,MAAMC,oBAAoB,IAAI,CAACC,cAAc,CAACL,kBAAkBC;QAChE,IAAI,CAACG,mBAAmB;YACpB,OAAOE;QACX;QACA,MAAMH,YAAW,oBAAA,IAAI,CAACI,WAAW,gBAAhB,yCAAA,8BAAA,kBAAoBC,SAAS,cAA7B,kDAAA,2BAA+B,CAAC,GAAGP,WAAW,CAAC,EAAEG,mBAAmB,CAAC;QACtF,eAAOD,qBAAAA,gCAAAA,yBAAAA,SAAUM,YAAY,cAAtBN,6CAAAA,sBAAwB,CAACD,WAAW,uCAAIC,qBAAAA,gCAAAA,6BAAAA,SAAUO,gBAAgB,cAA1BP,iDAAAA,0BAA4B,CAACD,WAAW;IAC3F;IAEAS,mBAAmB,EAAEX,gBAAgB,EAAEE,UAAU,EAAwB,EAAsB;QAC3F,OAAO,IAAI,CAACG,cAAc,CAACL,kBAAkBE;IACjD;IAEAU,gBAAgBC,OAAoB,CAAC,CAAC,EAAEC,OAA0C,EAAE;QAChF,IAAI;YACAjB,IAAAA,iBAAU,EACN,IAAI,CAACC,OAAO,EACZ;gBACI;mBACIiB,IAAAA,WAAI,MAAK;oBAAC;iBAAoB,GAAG,EAAE;mBACnCF,KAAKG,GAAG,GAAG;oBAAC;iBAAkB,GAAG,EAAE;aAC1C,EACDF;QAER,SAAU;YACN,IAAI,CAACG,KAAK;QACd;IACJ;IAEUC,gBAA0C;QAChD,MAAMC,eAAe,IAAI,CAACC,eAAe;QACzC,IAAI,CAACD,cAAc;YACf,OAAOb;QACX;QACA;;;SAGC,GACD,MAAMe,OAAOC,QAAQ;QACrB,IAAI;YACA,OAAOD,KAAKE,IAAI,CAACC,WAAE,CAACC,YAAY,CAACN,cAAc;QACnD,EAAE,eAAM;YACJ,OAAOb;QACX;IACJ;IAEQD,eAAeL,gBAAwB,EAAEE,UAAkB,EAAsB;YAGjFwB;YAFa,6BAAA,mBAEbA,wBACAA,2BACAA;QAJJ,MAAMA,YAAW,oBAAA,IAAI,CAACnB,WAAW,gBAAhB,yCAAA,8BAAA,kBAAoBoB,SAAS,cAA7B,kDAAA,2BAA+B,CAAC3B,iBAAiB;QAClE,MAAM4B,SACFF,gBAAAA,qBAAAA,gCAAAA,yBAAAA,SAAUjB,YAAY,cAAtBiB,6CAAAA,sBAAwB,CAACxB,WAAW,yCACpCwB,qBAAAA,gCAAAA,4BAAAA,SAAUG,eAAe,cAAzBH,gDAAAA,yBAA2B,CAACxB,WAAW,cADvCwB,kBAAAA,OAEAA,qBAAAA,gCAAAA,iCAAAA,SAAUI,oBAAoB,cAA9BJ,qDAAAA,8BAAgC,CAACxB,WAAW;QAChD,OAAO0B,QAAQG,0BAA0BH,MAAMI,OAAO,IAAI1B;IAC9D;;QArEG,gBACH,uBAASR,WAAU,SACnB,uBAASmC,gBAAe;;AAoE5B;AAEA,SAASF,0BAA0BC,OAAe;IAC9C,0DAA0D;IAC1D,OAAOA,QAAQE,KAAK,CAAC,IAAI,CAAC,EAAE;AAChC"}

package/dist/utils/get-packages-with-install-scripts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-packages-with-install-scripts.d.ts","sourceRoot":"","sources":["../../src/utils/get-packages-with-install-scripts.ts"],"names":[],"mappings":"AAEA,UAAU,iBAAiB;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACnB;AAMD,wBAAgB,6BAA6B,IAAI,iBAAiB,EAAE,CAWnE"}
+{"version":3,"file":"get-packages-with-install-scripts.d.ts","sourceRoot":"","sources":["../../src/utils/get-packages-with-install-scripts.ts"],"names":[],"mappings":"AAEA,UAAU,iBAAiB;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACnB;AAWD,wBAAgB,6BAA6B,IAAI,iBAAiB,EAAE,CAWnE"}

package/dist/utils/get-packages-with-install-scripts.js

@@ -9,11 +9,15 @@ Object.defineProperty(exports, "getPackagesWithInstallScripts", {
     }
 });
 const _os = require("./os");
-const SELECTORS = [
+/*
+ * Keep this selector free of whitespace. On Windows npm runs through a shell (npm.CMD) and
+ * execFileSync passes args unquoted, so a space would split the selector at the shell and npm
+ * query would receive a truncated, invalid selector.
+ */ const SELECTORS = [
     'preinstall',
     'install',
     'postinstall'
-].map((script)=>`:attr(scripts, [${script}])`).join(', ');
+].map((script)=>`:attr(scripts,[${script}])`).join(',');
 function getPackagesWithInstallScripts() {
     try {
         const result = (0, _os.runCommand)('npm', [

package/dist/utils/get-packages-with-install-scripts.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/get-packages-with-install-scripts.ts"],"sourcesContent":["import { runCommand } from './os';\n\ninterface PackageWithScript {\n    location: string;\n    name: string;\n    version: string;\n}\n\nconst SELECTORS = ['preinstall', 'install', 'postinstall']\n    .map(script => `:attr(scripts, [${script}])`)\n    .join(', ');\n\nexport function getPackagesWithInstallScripts(): PackageWithScript[] {\n    try {\n        const result = runCommand('npm', ['query', SELECTORS, '--json']);\n        return JSON.parse(result).map(({ location, name, version }: PackageWithScript) => ({\n            location,\n            name,\n            version,\n        }));\n    } catch {\n        return [];\n    }\n}\n"],"names":["getPackagesWithInstallScripts","SELECTORS","map","script","join","result","runCommand","JSON","parse","location","name","version"],"mappings":";;;;+BAYgBA;;;eAAAA;;;oBAZW;AAQ3B,MAAMC,YAAY;IAAC;IAAc;IAAW;CAAc,CACrDC,GAAG,CAACC,CAAAA,SAAU,CAAC,gBAAgB,EAAEA,OAAO,EAAE,CAAC,EAC3CC,IAAI,CAAC;AAEH,SAASJ;IACZ,IAAI;QACA,MAAMK,SAASC,IAAAA,cAAU,EAAC,OAAO;YAAC;YAASL;YAAW;SAAS;QAC/D,OAAOM,KAAKC,KAAK,CAACH,QAAQH,GAAG,CAAC,CAAC,EAAEO,QAAQ,EAAEC,IAAI,EAAEC,OAAO,EAAqB,GAAM,CAAA;gBAC/EF;gBACAC;gBACAC;YACJ,CAAA;IACJ,EAAE,eAAM;QACJ,OAAO,EAAE;IACb;AACJ"}
+{"version":3,"sources":["../../src/utils/get-packages-with-install-scripts.ts"],"sourcesContent":["import { runCommand } from './os';\n\ninterface PackageWithScript {\n    location: string;\n    name: string;\n    version: string;\n}\n\n/*\n * Keep this selector free of whitespace. On Windows npm runs through a shell (npm.CMD) and\n * execFileSync passes args unquoted, so a space would split the selector at the shell and npm\n * query would receive a truncated, invalid selector.\n */\nconst SELECTORS = ['preinstall', 'install', 'postinstall']\n    .map(script => `:attr(scripts,[${script}])`)\n    .join(',');\n\nexport function getPackagesWithInstallScripts(): PackageWithScript[] {\n    try {\n        const result = runCommand('npm', ['query', SELECTORS, '--json']);\n        return JSON.parse(result).map(({ location, name, version }: PackageWithScript) => ({\n            location,\n            name,\n            version,\n        }));\n    } catch {\n        return [];\n    }\n}\n"],"names":["getPackagesWithInstallScripts","SELECTORS","map","script","join","result","runCommand","JSON","parse","location","name","version"],"mappings":";;;;+BAiBgBA;;;eAAAA;;;oBAjBW;AAQ3B;;;;CAIC,GACD,MAAMC,YAAY;IAAC;IAAc;IAAW;CAAc,CACrDC,GAAG,CAACC,CAAAA,SAAU,CAAC,eAAe,EAAEA,OAAO,EAAE,CAAC,EAC1CC,IAAI,CAAC;AAEH,SAASJ;IACZ,IAAI;QACA,MAAMK,SAASC,IAAAA,cAAU,EAAC,OAAO;YAAC;YAASL;YAAW;SAAS;QAC/D,OAAOM,KAAKC,KAAK,CAACH,QAAQH,GAAG,CAAC,CAAC,EAAEO,QAAQ,EAAEC,IAAI,EAAEC,OAAO,EAAqB,GAAM,CAAA;gBAC/EF;gBACAC;gBACAC;YACJ,CAAA;IACJ,EAAE,eAAM;QACJ,OAAO,EAAE;IACb;AACJ"}

package/dist/utils/index.d.ts

@@ -4,7 +4,6 @@ export * from './find-up';
 export * from './get-packages-with-install-scripts';
 export * from './get-version';
 export * from './git';
-export * from './has-lockfile-changed';
 export * from './npm';
 export * from './os';
 export * from './read-json';

package/dist/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,MAAM,CAAC;AACrB,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,qCAAqC,CAAC;AACpD,cAAc,eAAe,CAAC;AAC9B,cAAc,OAAO,CAAC;AACtB,cAAc,wBAAwB,CAAC;AACvC,cAAc,OAAO,CAAC;AACtB,cAAc,MAAM,CAAC;AACrB,cAAc,aAAa,CAAC;AAC5B,cAAc,kCAAkC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,MAAM,CAAC;AACrB,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,qCAAqC,CAAC;AACpD,cAAc,eAAe,CAAC;AAC9B,cAAc,OAAO,CAAC;AACtB,cAAc,OAAO,CAAC;AACtB,cAAc,MAAM,CAAC;AACrB,cAAc,aAAa,CAAC;AAC5B,cAAc,kCAAkC,CAAC"}

package/dist/utils/index.js

@@ -8,7 +8,6 @@ _export_star(require("./find-up"), exports);
 _export_star(require("./get-packages-with-install-scripts"), exports);
 _export_star(require("./get-version"), exports);
 _export_star(require("./git"), exports);
-_export_star(require("./has-lockfile-changed"), exports);
 _export_star(require("./npm"), exports);
 _export_star(require("./os"), exports);
 _export_star(require("./read-json"), exports);

package/dist/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/index.ts"],"sourcesContent":["export * from './ci';\nexport * from './debug';\nexport * from './find-up';\nexport * from './get-packages-with-install-scripts';\nexport * from './get-version';\nexport * from './git';\nexport * from './has-lockfile-changed';\nexport * from './npm';\nexport * from './os';\nexport * from './read-json';\nexport * from './warn-untrusted-install-scripts';\n"],"names":[],"mappings":";;;;qBAAc;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA"}
+{"version":3,"sources":["../../src/utils/index.ts"],"sourcesContent":["export * from './ci';\nexport * from './debug';\nexport * from './find-up';\nexport * from './get-packages-with-install-scripts';\nexport * from './get-version';\nexport * from './git';\nexport * from './npm';\nexport * from './os';\nexport * from './read-json';\nexport * from './warn-untrusted-install-scripts';\n"],"names":[],"mappings":";;;;qBAAc;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA"}

package/dist/utils/warn-untrusted-install-scripts.d.ts

@@ -1,6 +1,2 @@
-interface Options {
-    force?: boolean;
-}
-export declare function warnUntrustedInstallScripts(allowedScripts: string[], lockFileName: string, { force }?: Options): void;
-export {};
+export declare function warnUntrustedInstallScripts(allowedScripts: string[]): void;
 //# sourceMappingURL=warn-untrusted-install-scripts.d.ts.map

package/dist/utils/warn-untrusted-install-scripts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"warn-untrusted-install-scripts.d.ts","sourceRoot":"","sources":["../../src/utils/warn-untrusted-install-scripts.ts"],"names":[],"mappings":"AAuBA,UAAU,OAAO;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,2BAA2B,CACvC,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EACpB,EAAE,KAAK,EAAE,GAAE,OAAY,QAyB1B"}
+{"version":3,"file":"warn-untrusted-install-scripts.d.ts","sourceRoot":"","sources":["../../src/utils/warn-untrusted-install-scripts.ts"],"names":[],"mappings":"AAsBA,wBAAgB,2BAA2B,CAAC,cAAc,EAAE,MAAM,EAAE,QAmBnE"}

package/dist/utils/warn-untrusted-install-scripts.js

@@ -9,7 +9,6 @@ Object.defineProperty(exports, "warnUntrustedInstallScripts", {
     }
 });
 const _getpackageswithinstallscripts = require("./get-packages-with-install-scripts");
-const _haslockfilechanged = require("./has-lockfile-changed");
 // These packages have scripts, but don't need them to function correctly.
 const IGNORE = [
     '@parcel/watcher',
@@ -27,10 +26,7 @@ const IGNORE = [
     'tree-sitter-json',
     'unrs-resolver'
 ];
-function warnUntrustedInstallScripts(allowedScripts, lockFileName, { force } = {}) {
-    if (!force && !(0, _haslockfilechanged.hasLockfileChanged)(lockFileName)) {
-        return;
-    }
+function warnUntrustedInstallScripts(allowedScripts) {
     const packages = (0, _getpackageswithinstallscripts.getPackagesWithInstallScripts)();
     const trustedOrIgnored = new Set([
         ...allowedScripts,
@@ -45,7 +41,6 @@ function warnUntrustedInstallScripts(allowedScripts, lockFileName, { force } = {
     const list = untrusted.map(({ name, version })=>`  - ${name}@${version}`).join('\n');
     console.warn([
         'WARNING: The following packages have untrusted install scripts.',
-        'A future release will block them by default.',
         'Review and add trusted packages to --allow-scripts:',
         list
     ].join('\n'));

package/dist/utils/warn-untrusted-install-scripts.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/warn-untrusted-install-scripts.ts"],"sourcesContent":["/* eslint-disable no-console */\nimport { getPackagesWithInstallScripts } from './get-packages-with-install-scripts';\nimport { hasLockfileChanged } from './has-lockfile-changed';\n\n// These packages have scripts, but don't need them to function correctly.\n\nconst IGNORE = [\n    '@parcel/watcher', // Installs platform-specific binary via optionalDependencies, install script is a legacy fallback\n    '@progress/kendo-licensing', // Validates Kendo UI license key, not needed for functionality\n    '@scarf/scarf', // Sends anonymous analytics/telemetry to Scarf, usage-tracking mechanism with no functional purpose\n    '@swc/core', // Installs platform-specific binary via optionalDependencies, postinstall is a legacy fallback\n    '@tree-sitter-grammars/tree-sitter-yaml', // Ships prebuilds for all supported targets via node-gyp-build, install script is a source-compile fallback\n    '@vaadin/vaadin-usage-statistics', // Toggles Vaadin's development-time telemetry, no effect on functionality\n    'contentful', // v9 printed a message announcing that v10 was available, no functional purpose\n    'core-js-pure', // Prints a donation/sponsorship banner to the console, no functional purpose\n    'core-js', // Prints a donation/sponsorship banner to the console, no functional purpose\n    'es5-ext', // Displays politically motivated message targeted at Russian developers, no effect on functionality\n    'esbuild', // Installs platform-specific binary via optionalDependencies, postinstall is a legacy fallback\n    'less', // Installs Playwright browsers for Less's own test suite\n    'tree-sitter-json', // Ships prebuilds for all supported targets via node-gyp-build, install script is a source-compile fallback\n    'unrs-resolver', // Installs platform-specific binary via optionalDependencies, postinstall is a legacy fallback\n];\n\ninterface Options {\n    force?: boolean;\n}\n\nexport function warnUntrustedInstallScripts(\n    allowedScripts: string[],\n    lockFileName: string,\n    { force }: Options = {}\n) {\n    if (!force && !hasLockfileChanged(lockFileName)) {\n        return;\n    }\n\n    const packages = getPackagesWithInstallScripts();\n    const trustedOrIgnored = new Set([...allowedScripts, ...IGNORE]);\n    const untrusted = packages.filter(({ location, name }) => {\n        return !!location && !trustedOrIgnored.has(name);\n    });\n\n    if (untrusted.length === 0) {\n        return;\n    }\n\n    const list = untrusted.map(({ name, version }) => `  - ${name}@${version}`).join('\\n');\n    console.warn(\n        [\n            'WARNING: The following packages have untrusted install scripts.',\n            'A future release will block them by default.',\n            'Review and add trusted packages to --allow-scripts:',\n            list,\n        ].join('\\n')\n    );\n}\n"],"names":["warnUntrustedInstallScripts","IGNORE","allowedScripts","lockFileName","force","hasLockfileChanged","packages","getPackagesWithInstallScripts","trustedOrIgnored","Set","untrusted","filter","location","name","has","length","list","map","version","join","console","warn"],"mappings":"AAAA,6BAA6B;;;;+BA2BbA;;;eAAAA;;;+CA1B8B;oCACX;AAEnC,0EAA0E;AAE1E,MAAMC,SAAS;IACX;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACH;AAMM,SAASD,4BACZE,cAAwB,EACxBC,YAAoB,EACpB,EAAEC,KAAK,EAAW,GAAG,CAAC,CAAC;IAEvB,IAAI,CAACA,SAAS,CAACC,IAAAA,sCAAkB,EAACF,eAAe;QAC7C;IACJ;IAEA,MAAMG,WAAWC,IAAAA,4DAA6B;IAC9C,MAAMC,mBAAmB,IAAIC,IAAI;WAAIP;WAAmBD;KAAO;IAC/D,MAAMS,YAAYJ,SAASK,MAAM,CAAC,CAAC,EAAEC,QAAQ,EAAEC,IAAI,EAAE;QACjD,OAAO,CAAC,CAACD,YAAY,CAACJ,iBAAiBM,GAAG,CAACD;IAC/C;IAEA,IAAIH,UAAUK,MAAM,KAAK,GAAG;QACxB;IACJ;IAEA,MAAMC,OAAON,UAAUO,GAAG,CAAC,CAAC,EAAEJ,IAAI,EAAEK,OAAO,EAAE,GAAK,CAAC,IAAI,EAAEL,KAAK,CAAC,EAAEK,SAAS,EAAEC,IAAI,CAAC;IACjFC,QAAQC,IAAI,CACR;QACI;QACA;QACA;QACAL;KACH,CAACG,IAAI,CAAC;AAEf"}
+{"version":3,"sources":["../../src/utils/warn-untrusted-install-scripts.ts"],"sourcesContent":["/* eslint-disable no-console */\nimport { getPackagesWithInstallScripts } from './get-packages-with-install-scripts';\n\n// These packages have scripts, but don't need them to function correctly.\n\nconst IGNORE = [\n    '@parcel/watcher', // Installs platform-specific binary via optionalDependencies, install script is a legacy fallback\n    '@progress/kendo-licensing', // Validates Kendo UI license key, not needed for functionality\n    '@scarf/scarf', // Sends anonymous analytics/telemetry to Scarf, usage-tracking mechanism with no functional purpose\n    '@swc/core', // Installs platform-specific binary via optionalDependencies, postinstall is a legacy fallback\n    '@tree-sitter-grammars/tree-sitter-yaml', // Ships prebuilds for all supported targets via node-gyp-build, install script is a source-compile fallback\n    '@vaadin/vaadin-usage-statistics', // Toggles Vaadin's development-time telemetry, no effect on functionality\n    'contentful', // v9 printed a message announcing that v10 was available, no functional purpose\n    'core-js-pure', // Prints a donation/sponsorship banner to the console, no functional purpose\n    'core-js', // Prints a donation/sponsorship banner to the console, no functional purpose\n    'es5-ext', // Displays politically motivated message targeted at Russian developers, no effect on functionality\n    'esbuild', // Installs platform-specific binary via optionalDependencies, postinstall is a legacy fallback\n    'less', // Installs Playwright browsers for Less's own test suite\n    'tree-sitter-json', // Ships prebuilds for all supported targets via node-gyp-build, install script is a source-compile fallback\n    'unrs-resolver', // Installs platform-specific binary via optionalDependencies, postinstall is a legacy fallback\n];\n\nexport function warnUntrustedInstallScripts(allowedScripts: string[]) {\n    const packages = getPackagesWithInstallScripts();\n    const trustedOrIgnored = new Set([...allowedScripts, ...IGNORE]);\n    const untrusted = packages.filter(({ location, name }) => {\n        return !!location && !trustedOrIgnored.has(name);\n    });\n\n    if (untrusted.length === 0) {\n        return;\n    }\n\n    const list = untrusted.map(({ name, version }) => `  - ${name}@${version}`).join('\\n');\n    console.warn(\n        [\n            'WARNING: The following packages have untrusted install scripts.',\n            'Review and add trusted packages to --allow-scripts:',\n            list,\n        ].join('\\n')\n    );\n}\n"],"names":["warnUntrustedInstallScripts","IGNORE","allowedScripts","packages","getPackagesWithInstallScripts","trustedOrIgnored","Set","untrusted","filter","location","name","has","length","list","map","version","join","console","warn"],"mappings":"AAAA,6BAA6B;;;;+BAsBbA;;;eAAAA;;;+CArB8B;AAE9C,0EAA0E;AAE1E,MAAMC,SAAS;IACX;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACH;AAEM,SAASD,4BAA4BE,cAAwB;IAChE,MAAMC,WAAWC,IAAAA,4DAA6B;IAC9C,MAAMC,mBAAmB,IAAIC,IAAI;WAAIJ;WAAmBD;KAAO;IAC/D,MAAMM,YAAYJ,SAASK,MAAM,CAAC,CAAC,EAAEC,QAAQ,EAAEC,IAAI,EAAE;QACjD,OAAO,CAAC,CAACD,YAAY,CAACJ,iBAAiBM,GAAG,CAACD;IAC/C;IAEA,IAAIH,UAAUK,MAAM,KAAK,GAAG;QACxB;IACJ;IAEA,MAAMC,OAAON,UAAUO,GAAG,CAAC,CAAC,EAAEJ,IAAI,EAAEK,OAAO,EAAE,GAAK,CAAC,IAAI,EAAEL,KAAK,CAAC,EAAEK,SAAS,EAAEC,IAAI,CAAC;IACjFC,QAAQC,IAAI,CACR;QACI;QACA;QACAL;KACH,CAACG,IAAI,CAAC;AAEf"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@servicetitan/install",
-    "version": "36.3.0",
+    "version": "36.4.0",
     "description": "Lightweight wrapper around npm install that configures access to private packages",
     "homepage": "https://docs.st.dev/docs/frontend/uikit/install",
     "repository": {
@@ -30,7 +30,7 @@
         "webpack": false
     },
     "peerDependencies": {
-        "js-yaml": "~4.1.1"
+        "js-yaml": "~4.2.0"
     },
     "peerDependenciesMeta": {
         "js-yaml": {
@@ -40,5 +40,5 @@
     "devDependencies": {
         "ts-node": "~10.9.2"
     },
-    "gitHead": "5c664540fe1fa530da3b311b28941e2fb26c6cff"
+    "gitHead": "8beab9ae3a70ce381e8cd53f2de8691640e96c6e"
 }

package/src/package-manager/npm-package-manager.ts

@@ -12,6 +12,8 @@ import {
 
 interface NpmLockFileEntry {
     version?: string;
+    resolved?: string;
+    link?: boolean;
     dependencies?: Record<string, string>;
     peerDependencies?: Record<string, string>;
 }
@@ -25,7 +27,7 @@ export class NpmPackageManager extends PackageManager<NpmLockFile> {
     readonly lockFileName = 'package-lock.json';
 
     clearCache() {
-        runCommand('npm', ['cache', 'clear', '--force']);
+        runCommand(this.command, ['cache', 'clear', '--force']);
     }
 
     getDeclaredVersion({
@@ -42,18 +44,14 @@ export class NpmPackageManager extends PackageManager<NpmLockFile> {
     }
 
     installPackages(args: InstallArgs = {}, options?: Parameters<typeof runCommand>[2]) {
-        /*
-         * The `true` fallback allows projects a grace period to identify and
-         * allowlist trusted scripts. Remove the fallback when the grace period expires.
-         */
-        const allowScripts = resolveAllowScripts(args.allowScripts ?? true);
+        const allowScripts = resolveAllowScripts(args.allowScripts ?? []);
 
         if (!args.quiet) {
             logAllowedScripts(allowScripts);
         }
 
         runCommand(
-            'npm',
+            this.command,
             [
                 isCI() ? 'ci' : 'i',
                 '--audit=false',
@@ -84,9 +82,7 @@ export class NpmPackageManager extends PackageManager<NpmLockFile> {
              */
             if (allowScripts !== false) {
                 warnUntrustedInstallScripts(
-                    Array.isArray(allowScripts) ? allowScripts : DEFAULT_ALLOWED_SCRIPTS,
-                    this.lockFileName,
-                    { force: true }
+                    Array.isArray(allowScripts) ? allowScripts : DEFAULT_ALLOWED_SCRIPTS
                 );
             }
             /*
@@ -103,8 +99,12 @@ export class NpmPackageManager extends PackageManager<NpmLockFile> {
     }
 
     protected parseLockFile(): NpmLockFile | undefined {
+        const lockFilePath = this.getLockFilePath();
+        if (!lockFilePath) {
+            return undefined;
+        }
         try {
-            return JSON.parse(fs.readFileSync(this.lockFileName, 'utf-8'));
+            return JSON.parse(fs.readFileSync(lockFilePath, 'utf-8'));
         } catch {
             return undefined;
         }
@@ -115,6 +115,8 @@ export class NpmPackageManager extends PackageManager<NpmLockFile> {
      * to the hoisted root entry. `workspacePackage` is the package's relative
      * path from the repo root; the empty string `''` denotes the root
      * workspace package itself, matching npm's own lockfile key convention.
+     * Follows link entries to the resolved workspace package, so callers see
+     * the workspace package's own metadata rather than the symlink stub.
      */
     private findEntry({
         workspacePackage,
@@ -124,15 +126,18 @@ export class NpmPackageManager extends PackageManager<NpmLockFile> {
         package: string;
     }): NpmLockFileEntry | undefined {
         const packages = this.getLockFile()?.packages;
-        return (
+        const entry =
             packages?.[`${workspacePackage}/node_modules/${packageName}`] ??
-            packages?.[`node_modules/${packageName}`]
-        );
+            packages?.[`node_modules/${packageName}`];
+        if (entry?.link && entry.resolved) {
+            return packages?.[entry.resolved];
+        }
+        return entry;
     }
 
     private runRebuild(scripts: string[]) {
         try {
-            runCommand('npm', ['rebuild', ...scripts]);
+            runCommand(this.command, ['rebuild', ...scripts]);
         } catch {
             console.error(`Failed to run allowed scripts: ${scripts.join(', ')}`);
             process.exitCode = 1;
@@ -141,7 +146,7 @@ export class NpmPackageManager extends PackageManager<NpmLockFile> {
 
     private runProjectPostinstall(options?: Parameters<typeof runCommand>[2]) {
         try {
-            runCommand('npm', ['run', 'postinstall', '--if-present'], options);
+            runCommand(this.command, ['run', 'postinstall', '--if-present'], options);
         } catch {
             process.exitCode = 1;
         }

package/src/package-manager/package-manager.ts

@@ -1,4 +1,6 @@
-import { runCommand } from '../utils';
+import fs from 'fs';
+import path from 'node:path';
+import { findUp, runCommand } from '../utils';
 
 export type AllowScripts = true | false | string[];
 
@@ -25,11 +27,41 @@ export abstract class PackageManager<LockFile = unknown> {
 
     #lockFile: LockFile | undefined;
     #lockFileLoaded = false;
+    #lockFilePath: string | undefined;
+    #lockFilePathLoaded = false;
 
     hasValidLockFile(): boolean {
         return this.getLockFile() !== undefined;
     }
 
+    getLockFilePath(): string | undefined {
+        if (!this.#lockFilePathLoaded) {
+            this.#lockFilePath = findUp(directory => {
+                const candidate = path.join(directory, this.lockFileName);
+                return fs.existsSync(candidate) ? candidate : undefined;
+            });
+            this.#lockFilePathLoaded = true;
+        }
+        return this.#lockFilePath;
+    }
+
+    /**
+     * Returns the lockfile key for a package given its absolute or
+     * cwd-relative directory. Both npm and pnpm key their lockfile entries
+     * by the package's path relative to the workspace root.
+     */
+    getWorkspacePackage(packageDir = process.cwd()): string {
+        const lockFilePath = this.getLockFilePath();
+        if (!lockFilePath) {
+            return this.rootWorkspacePackage;
+        }
+        const relative = path
+            .relative(path.dirname(lockFilePath), path.resolve(packageDir))
+            .split(path.sep)
+            .join('/');
+        return relative === '' ? this.rootWorkspacePackage : relative;
+    }
+
     protected getLockFile(): LockFile | undefined {
         if (!this.#lockFileLoaded) {
             this.#lockFile = this.parseLockFile();
@@ -41,6 +73,12 @@ export abstract class PackageManager<LockFile = unknown> {
     protected reset() {
         this.#lockFile = undefined;
         this.#lockFileLoaded = false;
+        this.#lockFilePath = undefined;
+        this.#lockFilePathLoaded = false;
+    }
+
+    protected get rootWorkspacePackage(): string {
+        return '';
     }
 
     abstract clearCache(): void;

package/src/package-manager/pnpm-package-manager.ts

@@ -28,8 +28,12 @@ export class PnpmPackageManager extends PackageManager<PnpmLockFile> {
     readonly command = 'pnpm';
     readonly lockFileName = 'pnpm-lock.yaml';
 
+    protected override get rootWorkspacePackage(): string {
+        return '.';
+    }
+
     clearCache() {
-        runCommand('pnpm', ['store', 'prune']);
+        runCommand(this.command, ['store', 'prune']);
     }
 
     getDeclaredVersion({
@@ -52,7 +56,7 @@ export class PnpmPackageManager extends PackageManager<PnpmLockFile> {
     installPackages(args: InstallArgs = {}, options?: Parameters<typeof runCommand>[2]) {
         try {
             runCommand(
-                'pnpm',
+                this.command,
                 [
                     'install',
                     ...(isCI() ? ['--frozen-lockfile'] : []),
@@ -66,13 +70,17 @@ export class PnpmPackageManager extends PackageManager<PnpmLockFile> {
     }
 
     protected parseLockFile(): PnpmLockFile | undefined {
+        const lockFilePath = this.getLockFilePath();
+        if (!lockFilePath) {
+            return undefined;
+        }
         /*
          * js-yaml is an optional peer; let MODULE_NOT_FOUND surface so a caller
          * missing the dep gets a clear error instead of silent `undefined`.
          */
         const yaml = require('js-yaml');
         try {
-            return yaml.load(fs.readFileSync(this.lockFileName, 'utf-8'));
+            return yaml.load(fs.readFileSync(lockFilePath, 'utf-8'));
         } catch {
             return undefined;
         }

package/src/utils/get-packages-with-install-scripts.ts

@@ -6,9 +6,14 @@ interface PackageWithScript {
     version: string;
 }
 
+/*
+ * Keep this selector free of whitespace. On Windows npm runs through a shell (npm.CMD) and
+ * execFileSync passes args unquoted, so a space would split the selector at the shell and npm
+ * query would receive a truncated, invalid selector.
+ */
 const SELECTORS = ['preinstall', 'install', 'postinstall']
-    .map(script => `:attr(scripts, [${script}])`)
-    .join(', ');
+    .map(script => `:attr(scripts,[${script}])`)
+    .join(',');
 
 export function getPackagesWithInstallScripts(): PackageWithScript[] {
     try {

package/src/utils/index.ts

@@ -4,7 +4,6 @@ export * from './find-up';
 export * from './get-packages-with-install-scripts';
 export * from './get-version';
 export * from './git';
-export * from './has-lockfile-changed';
 export * from './npm';
 export * from './os';
 export * from './read-json';

package/src/utils/warn-untrusted-install-scripts.ts

@@ -1,6 +1,5 @@
 /* eslint-disable no-console */
 import { getPackagesWithInstallScripts } from './get-packages-with-install-scripts';
-import { hasLockfileChanged } from './has-lockfile-changed';
 
 // These packages have scripts, but don't need them to function correctly.
 
@@ -21,19 +20,7 @@ const IGNORE = [
     'unrs-resolver', // Installs platform-specific binary via optionalDependencies, postinstall is a legacy fallback
 ];
 
-interface Options {
-    force?: boolean;
-}
-
-export function warnUntrustedInstallScripts(
-    allowedScripts: string[],
-    lockFileName: string,
-    { force }: Options = {}
-) {
-    if (!force && !hasLockfileChanged(lockFileName)) {
-        return;
-    }
-
+export function warnUntrustedInstallScripts(allowedScripts: string[]) {
     const packages = getPackagesWithInstallScripts();
     const trustedOrIgnored = new Set([...allowedScripts, ...IGNORE]);
     const untrusted = packages.filter(({ location, name }) => {
@@ -48,7 +35,6 @@ export function warnUntrustedInstallScripts(
     console.warn(
         [
             'WARNING: The following packages have untrusted install scripts.',
-            'A future release will block them by default.',
             'Review and add trusted packages to --allow-scripts:',
             list,
         ].join('\n')

package/dist/utils/has-lockfile-changed.d.ts

@@ -1,2 +0,0 @@
-export declare function hasLockfileChanged(lockFileName: string): boolean;
-//# sourceMappingURL=has-lockfile-changed.d.ts.map

package/dist/utils/has-lockfile-changed.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"has-lockfile-changed.d.ts","sourceRoot":"","sources":["../../src/utils/has-lockfile-changed.ts"],"names":[],"mappings":"AAEA,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,WAOtD"}

package/dist/utils/has-lockfile-changed.js

@@ -1,27 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "hasLockfileChanged", {
-    enumerable: true,
-    get: function() {
-        return hasLockfileChanged;
-    }
-});
-const _os = require("./os");
-function hasLockfileChanged(lockFileName) {
-    try {
-        const result = (0, _os.runCommand)('git', [
-            'diff',
-            '--name-only',
-            'HEAD',
-            '--',
-            lockFileName
-        ]);
-        return result.trim().length > 0;
-    } catch (unused) {
-        return true;
-    }
-}
-
-//# sourceMappingURL=has-lockfile-changed.js.map

package/dist/utils/has-lockfile-changed.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/utils/has-lockfile-changed.ts"],"sourcesContent":["import { runCommand } from './os';\n\nexport function hasLockfileChanged(lockFileName: string) {\n    try {\n        const result = runCommand('git', ['diff', '--name-only', 'HEAD', '--', lockFileName]);\n        return result.trim().length > 0;\n    } catch {\n        return true;\n    }\n}\n"],"names":["hasLockfileChanged","lockFileName","result","runCommand","trim","length"],"mappings":";;;;+BAEgBA;;;eAAAA;;;oBAFW;AAEpB,SAASA,mBAAmBC,YAAoB;IACnD,IAAI;QACA,MAAMC,SAASC,IAAAA,cAAU,EAAC,OAAO;YAAC;YAAQ;YAAe;YAAQ;YAAMF;SAAa;QACpF,OAAOC,OAAOE,IAAI,GAAGC,MAAM,GAAG;IAClC,EAAE,eAAM;QACJ,OAAO;IACX;AACJ"}

package/src/utils/has-lockfile-changed.ts

@@ -1,10 +0,0 @@
-import { runCommand } from './os';
-
-export function hasLockfileChanged(lockFileName: string) {
-    try {
-        const result = runCommand('git', ['diff', '--name-only', 'HEAD', '--', lockFileName]);
-        return result.trim().length > 0;
-    } catch {
-        return true;
-    }
-}