@servicetitan/install 38.0.0 → 38.2.0

package/dist/cli/install.js

@@ -19,15 +19,12 @@ function _check_private_redeclaration(obj, privateCollection) {
     }
 }
 function _class_apply_descriptor_get(receiver, descriptor) {
-    if (descriptor.get) {
-        return descriptor.get.call(receiver);
-    }
+    if (descriptor.get) return descriptor.get.call(receiver);
     return descriptor.value;
 }
 function _class_apply_descriptor_set(receiver, descriptor, value) {
-    if (descriptor.set) {
-        descriptor.set.call(receiver, value);
-    } else {
+    if (descriptor.set) descriptor.set.call(receiver, value);
+    else {
         if (!descriptor.writable) {
             throw new TypeError("attempted to set read only private field");
         }
@@ -35,9 +32,7 @@ function _class_apply_descriptor_set(receiver, descriptor, value) {
     }
 }
 function _class_extract_field_descriptor(receiver, privateMap, action) {
-    if (!privateMap.has(receiver)) {
-        throw new TypeError("attempted to " + action + " private field on non-instance");
-    }
+    if (!privateMap.has(receiver)) throw new TypeError("attempted to " + action + " private field on non-instance");
     return privateMap.get(receiver);
 }
 function _class_private_field_get(receiver, privateMap) {
@@ -61,9 +56,7 @@ function _define_property(obj, key, value) {
             configurable: true,
             writable: true
         });
-    } else {
-        obj[key] = value;
-    }
+    } else obj[key] = value;
     return obj;
 }
 function _interop_require_default(obj) {

package/dist/cli/install.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/cli/install.ts"],"sourcesContent":["/* eslint-disable no-console */\nimport fs from 'fs';\nimport os from 'os';\nimport path from 'path';\nimport type { AllowScripts } from '../package-manager';\nimport { getPackageManager, PackageManager } from '../package-manager';\nimport { debug, getVersion, gitCloneRepo, isCI, npmWhoAmI, readJson, runCommand } from '../utils';\n\nconst REPO_NAME = 'frontend-dev-config';\nconst AUTH_TOKEN_KEY = '//registry.npmjs.org/:_authToken';\nconst AUTH_TOKEN_REGEX = /^\\/\\/registry\\.npmjs\\.org\\/:_authToken=\\s*(?<authToken>.+)/m;\nconst ENVIRONMENT_VARIABLE_REGEX = /\\${(?<environmentVariable>[^}]+)}/;\n\nexport interface Args {\n    allowScripts?: AllowScripts;\n    fix?: boolean;\n    quiet?: boolean;\n    token?: boolean;\n}\n\nexport class Install {\n    args: Args;\n    #packageManager: PackageManager | undefined;\n\n    constructor(args: Args) {\n        this.args = args;\n    }\n\n    execute() {\n        this.log(`install cli v${getVersion()}`);\n\n        const env = this.configureNpmToken();\n        this.installPackages(env);\n    }\n\n    private configureNpmToken() {\n        if (isCI() || this.args.fix || this.args.token === false) {\n            return;\n        }\n\n        this.log('Configuring NPM token ...');\n\n        if (this.args.token !== true) {\n            if (npmWhoAmI() === 'st-team') {\n                return;\n            }\n        }\n\n        const token = this.fetchNpmToken();\n        if (!token) {\n            return;\n        }\n\n        runCommand('npm', ['config', 'set', `${AUTH_TOKEN_KEY}=${token}`]);\n\n        if (!fs.existsSync('.npmrc')) {\n            return;\n        }\n\n        const npmrc = fs.readFileSync('.npmrc', 'utf-8');\n        const { authToken } = AUTH_TOKEN_REGEX.exec(npmrc)?.groups ?? {};\n        debug({ authToken });\n        if (!authToken) {\n            return;\n        }\n\n        const { environmentVariable } = ENVIRONMENT_VARIABLE_REGEX.exec(authToken)?.groups ?? {};\n        debug({ environmentVariable });\n        if (environmentVariable) {\n            return { [environmentVariable]: token };\n        }\n\n        runCommand('npm', ['config', 'delete', '--location=project', AUTH_TOKEN_KEY]);\n    }\n\n    private fetchNpmToken() {\n        const tempDirPath = fs.mkdtempSync(path.join(os.tmpdir(), 'st-install-'));\n        try {\n            if (!gitCloneRepo({ destination: tempDirPath, name: REPO_NAME })) {\n                throw new Error(`could not clone servicetitan/${REPO_NAME}`);\n            }\n\n            const npmJson = readJson(path.join(tempDirPath, '.npm.json'));\n            debug('install:fetch-npm-token', { npmJson });\n\n            if (!((npmJson && typeof npmJson === 'object') || Array.isArray(npmJson))) {\n                throw new Error('.npm.json is not an object');\n            }\n\n            const { readOnlyToken: authToken } = npmJson;\n            if (!authToken) {\n                throw new Error('.npm.json does not contain auth token');\n            }\n\n            if (typeof authToken !== 'string') {\n                throw new Error('.npm.json auth token is not a string');\n            }\n\n            return Buffer.from(authToken, 'base64').toString('utf-8');\n        } catch (e) {\n            console.warn(String(e));\n        } finally {\n            try {\n                fs.rmSync(tempDirPath, { recursive: true, force: true });\n            } catch {\n                // ignore\n            }\n        }\n    }\n\n    private installPackages(env?: Record<string, string>) {\n        if (this.args.token) {\n            return;\n        }\n\n        this.log(`Running ${this.packageManager.command} install`);\n\n        this.packageManager.installPackages(this.args, { env, stdio: 'inherit' });\n    }\n\n    private get packageManager() {\n        return (this.#packageManager ??= getPackageManager());\n    }\n\n    private log(message: string) {\n        if (!this.args.quiet) {\n            console.log(message);\n        }\n    }\n}\n"],"names":["Install","REPO_NAME","AUTH_TOKEN_KEY","AUTH_TOKEN_REGEX","ENVIRONMENT_VARIABLE_REGEX","execute","log","getVersion","env","configureNpmToken","installPackages","isCI","args","fix","token","npmWhoAmI","fetchNpmToken","runCommand","fs","existsSync","npmrc","readFileSync","authToken","exec","groups","debug","environmentVariable","tempDirPath","mkdtempSync","path","join","os","tmpdir","gitCloneRepo","destination","name","Error","npmJson","readJson","Array","isArray","readOnlyToken","Buffer","from","toString","e","console","warn","String","rmSync","recursive","force","packageManager","command","stdio","getPackageManager","message","quiet"],"mappings":"AAAA,6BAA6B;;;;+BAoBhBA;;;eAAAA;;;2DAnBE;2DACA;6DACE;gCAEiC;uBACqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEvF,MAAMC,YAAY;AAClB,MAAMC,iBAAiB;AACvB,MAAMC,mBAAmB;AACzB,MAAMC,6BAA6B;IAW/B;AAFG,MAAMJ;IAQTK,UAAU;QACN,IAAI,CAACC,GAAG,CAAC,CAAC,aAAa,EAAEC,IAAAA,iBAAU,KAAI;QAEvC,MAAMC,MAAM,IAAI,CAACC,iBAAiB;QAClC,IAAI,CAACC,eAAe,CAACF;IACzB;IAEQC,oBAAoB;;YAyBFN,wBAMUC;QA9BhC,IAAIO,IAAAA,WAAI,OAAM,IAAI,CAACC,IAAI,CAACC,GAAG,IAAI,IAAI,CAACD,IAAI,CAACE,KAAK,KAAK,OAAO;YACtD;QACJ;QAEA,IAAI,CAACR,GAAG,CAAC;QAET,IAAI,IAAI,CAACM,IAAI,CAACE,KAAK,KAAK,MAAM;YAC1B,IAAIC,IAAAA,gBAAS,QAAO,WAAW;gBAC3B;YACJ;QACJ;QAEA,MAAMD,QAAQ,IAAI,CAACE,aAAa;QAChC,IAAI,CAACF,OAAO;YACR;QACJ;QAEAG,IAAAA,iBAAU,EAAC,OAAO;YAAC;YAAU;YAAO,GAAGf,eAAe,CAAC,EAAEY,OAAO;SAAC;QAEjE,IAAI,CAACI,WAAE,CAACC,UAAU,CAAC,WAAW;YAC1B;QACJ;QAEA,MAAMC,QAAQF,WAAE,CAACG,YAAY,CAAC,UAAU;QACxC,MAAM,EAAEC,SAAS,EAAE,YAAGnB,yBAAAA,iBAAiBoB,IAAI,CAACH,oBAAtBjB,6CAAAA,uBAA8BqB,MAAM,uCAAI,CAAC;QAC/DC,IAAAA,YAAK,EAAC;YAAEH;QAAU;QAClB,IAAI,CAACA,WAAW;YACZ;QACJ;QAEA,MAAM,EAAEI,mBAAmB,EAAE,aAAGtB,mCAAAA,2BAA2BmB,IAAI,CAACD,wBAAhClB,uDAAAA,iCAA4CoB,MAAM,yCAAI,CAAC;QACvFC,IAAAA,YAAK,EAAC;YAAEC;QAAoB;QAC5B,IAAIA,qBAAqB;YACrB,OAAO;gBAAE,CAACA,oBAAoB,EAAEZ;YAAM;QAC1C;QAEAG,IAAAA,iBAAU,EAAC,OAAO;YAAC;YAAU;YAAU;YAAsBf;SAAe;IAChF;IAEQc,gBAAgB;QACpB,MAAMW,cAAcT,WAAE,CAACU,WAAW,CAACC,aAAI,CAACC,IAAI,CAACC,WAAE,CAACC,MAAM,IAAI;QAC1D,IAAI;YACA,IAAI,CAACC,IAAAA,mBAAY,EAAC;gBAAEC,aAAaP;gBAAaQ,MAAMlC;YAAU,IAAI;gBAC9D,MAAM,IAAImC,MAAM,CAAC,6BAA6B,EAAEnC,WAAW;YAC/D;YAEA,MAAMoC,UAAUC,IAAAA,eAAQ,EAACT,aAAI,CAACC,IAAI,CAACH,aAAa;YAChDF,IAAAA,YAAK,EAAC,2BAA2B;gBAAEY;YAAQ;YAE3C,IAAI,CAAE,CAAA,AAACA,WAAW,OAAOA,YAAY,YAAaE,MAAMC,OAAO,CAACH,QAAO,GAAI;gBACvE,MAAM,IAAID,MAAM;YACpB;YAEA,MAAM,EAAEK,eAAenB,SAAS,EAAE,GAAGe;YACrC,IAAI,CAACf,WAAW;gBACZ,MAAM,IAAIc,MAAM;YACpB;YAEA,IAAI,OAAOd,cAAc,UAAU;gBAC/B,MAAM,IAAIc,MAAM;YACpB;YAEA,OAAOM,OAAOC,IAAI,CAACrB,WAAW,UAAUsB,QAAQ,CAAC;QACrD,EAAE,OAAOC,GAAG;YACRC,QAAQC,IAAI,CAACC,OAAOH;QACxB,SAAU;YACN,IAAI;gBACA3B,WAAE,CAAC+B,MAAM,CAACtB,aAAa;oBAAEuB,WAAW;oBAAMC,OAAO;gBAAK;YAC1D,EAAE,eAAM;YACJ,SAAS;YACb;QACJ;IACJ;IAEQzC,gBAAgBF,GAA4B,EAAE;QAClD,IAAI,IAAI,CAACI,IAAI,CAACE,KAAK,EAAE;YACjB;QACJ;QAEA,IAAI,CAACR,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC8C,cAAc,CAACC,OAAO,CAAC,QAAQ,CAAC;QAEzD,IAAI,CAACD,cAAc,CAAC1C,eAAe,CAAC,IAAI,CAACE,IAAI,EAAE;YAAEJ;YAAK8C,OAAO;QAAU;IAC3E;IAEA,IAAYF,iBAAiB;;QACzB,sCAAa,uEAAL,IAAI,EAAC,iGAAoBG,IAAAA,iCAAiB;IACtD;IAEQjD,IAAIkD,OAAe,EAAE;QACzB,IAAI,CAAC,IAAI,CAAC5C,IAAI,CAAC6C,KAAK,EAAE;YAClBX,QAAQxC,GAAG,CAACkD;QAChB;IACJ;IAxGA,YAAY5C,IAAU,CAAE;QAHxBA,uBAAAA,QAAAA,KAAAA;QACA,gCAAA;;mBAAA,KAAA;;QAGI,IAAI,CAACA,IAAI,GAAGA;IAChB;AAuGJ"}
+{"version":3,"sources":["../../src/cli/install.ts"],"sourcesContent":["/* eslint-disable no-console */\nimport fs from 'fs';\nimport os from 'os';\nimport path from 'path';\nimport type { AllowScripts } from '../package-manager';\nimport { getPackageManager, PackageManager } from '../package-manager';\nimport { debug, getVersion, gitCloneRepo, isCI, npmWhoAmI, readJson, runCommand } from '../utils';\n\nconst REPO_NAME = 'frontend-dev-config';\nconst AUTH_TOKEN_KEY = '//registry.npmjs.org/:_authToken';\nconst AUTH_TOKEN_REGEX = /^\\/\\/registry\\.npmjs\\.org\\/:_authToken=\\s*(?<authToken>.+)/m;\nconst ENVIRONMENT_VARIABLE_REGEX = /\\${(?<environmentVariable>[^}]+)}/;\n\nexport interface Args {\n    allowScripts?: AllowScripts;\n    fix?: boolean;\n    quiet?: boolean;\n    token?: boolean;\n}\n\nexport class Install {\n    args: Args;\n    #packageManager: PackageManager | undefined;\n\n    constructor(args: Args) {\n        this.args = args;\n    }\n\n    execute() {\n        this.log(`install cli v${getVersion()}`);\n\n        const env = this.configureNpmToken();\n        this.installPackages(env);\n    }\n\n    private configureNpmToken() {\n        if (isCI() || this.args.fix || this.args.token === false) {\n            return;\n        }\n\n        this.log('Configuring NPM token ...');\n\n        if (this.args.token !== true) {\n            if (npmWhoAmI() === 'st-team') {\n                return;\n            }\n        }\n\n        const token = this.fetchNpmToken();\n        if (!token) {\n            return;\n        }\n\n        runCommand('npm', ['config', 'set', `${AUTH_TOKEN_KEY}=${token}`]);\n\n        if (!fs.existsSync('.npmrc')) {\n            return;\n        }\n\n        const npmrc = fs.readFileSync('.npmrc', 'utf-8');\n        const { authToken } = AUTH_TOKEN_REGEX.exec(npmrc)?.groups ?? {};\n        debug({ authToken });\n        if (!authToken) {\n            return;\n        }\n\n        const { environmentVariable } = ENVIRONMENT_VARIABLE_REGEX.exec(authToken)?.groups ?? {};\n        debug({ environmentVariable });\n        if (environmentVariable) {\n            return { [environmentVariable]: token };\n        }\n\n        runCommand('npm', ['config', 'delete', '--location=project', AUTH_TOKEN_KEY]);\n    }\n\n    private fetchNpmToken() {\n        const tempDirPath = fs.mkdtempSync(path.join(os.tmpdir(), 'st-install-'));\n        try {\n            if (!gitCloneRepo({ destination: tempDirPath, name: REPO_NAME })) {\n                throw new Error(`could not clone servicetitan/${REPO_NAME}`);\n            }\n\n            const npmJson = readJson(path.join(tempDirPath, '.npm.json'));\n            debug('install:fetch-npm-token', { npmJson });\n\n            if (!((npmJson && typeof npmJson === 'object') || Array.isArray(npmJson))) {\n                throw new Error('.npm.json is not an object');\n            }\n\n            const { readOnlyToken: authToken } = npmJson;\n            if (!authToken) {\n                throw new Error('.npm.json does not contain auth token');\n            }\n\n            if (typeof authToken !== 'string') {\n                throw new Error('.npm.json auth token is not a string');\n            }\n\n            return Buffer.from(authToken, 'base64').toString('utf-8');\n        } catch (e) {\n            console.warn(String(e));\n        } finally {\n            try {\n                fs.rmSync(tempDirPath, { recursive: true, force: true });\n            } catch {\n                // ignore\n            }\n        }\n    }\n\n    private installPackages(env?: Record<string, string>) {\n        if (this.args.token) {\n            return;\n        }\n\n        this.log(`Running ${this.packageManager.command} install`);\n\n        this.packageManager.installPackages(this.args, { env, stdio: 'inherit' });\n    }\n\n    private get packageManager() {\n        return (this.#packageManager ??= getPackageManager());\n    }\n\n    private log(message: string) {\n        if (!this.args.quiet) {\n            console.log(message);\n        }\n    }\n}\n"],"names":["Install","REPO_NAME","AUTH_TOKEN_KEY","AUTH_TOKEN_REGEX","ENVIRONMENT_VARIABLE_REGEX","execute","log","getVersion","env","configureNpmToken","installPackages","isCI","args","fix","token","npmWhoAmI","fetchNpmToken","runCommand","fs","existsSync","npmrc","readFileSync","authToken","exec","groups","debug","environmentVariable","tempDirPath","mkdtempSync","path","join","os","tmpdir","gitCloneRepo","destination","name","Error","npmJson","readJson","Array","isArray","readOnlyToken","Buffer","from","toString","e","console","warn","String","rmSync","recursive","force","packageManager","command","stdio","getPackageManager","message","quiet"],"mappings":"AAAA,6BAA6B;;;;+BAoBhBA;;;eAAAA;;;2DAnBE;2DACA;6DACE;gCAEiC;uBACqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEvF,MAAMC,YAAY;AAClB,MAAMC,iBAAiB;AACvB,MAAMC,mBAAmB;AACzB,MAAMC,6BAA6B;IAW/B;AAFG,MAAMJ;IAQTK,UAAU;QACN,IAAI,CAACC,GAAG,CAAC,CAAC,aAAa,EAAEC,IAAAA,iBAAU,KAAI;QAEvC,MAAMC,MAAM,IAAI,CAACC,iBAAiB;QAClC,IAAI,CAACC,eAAe,CAACF;IACzB;IAEQC,oBAAoB;;YAyBFN,wBAMUC;QA9BhC,IAAIO,IAAAA,WAAI,OAAM,IAAI,CAACC,IAAI,CAACC,GAAG,IAAI,IAAI,CAACD,IAAI,CAACE,KAAK,KAAK,OAAO;YACtD;QACJ;QAEA,IAAI,CAACR,GAAG,CAAC;QAET,IAAI,IAAI,CAACM,IAAI,CAACE,KAAK,KAAK,MAAM;YAC1B,IAAIC,IAAAA,gBAAS,QAAO,WAAW;gBAC3B;YACJ;QACJ;QAEA,MAAMD,QAAQ,IAAI,CAACE,aAAa;QAChC,IAAI,CAACF,OAAO;YACR;QACJ;QAEAG,IAAAA,iBAAU,EAAC,OAAO;YAAC;YAAU;YAAO,GAAGf,eAAe,CAAC,EAAEY,OAAO;SAAC;QAEjE,IAAI,CAACI,WAAE,CAACC,UAAU,CAAC,WAAW;YAC1B;QACJ;QAEA,MAAMC,QAAQF,WAAE,CAACG,YAAY,CAAC,UAAU;QACxC,MAAM,EAAEC,SAAS,EAAE,YAAGnB,yBAAAA,iBAAiBoB,IAAI,CAACH,oBAAtBjB,6CAAAA,uBAA8BqB,MAAM,uCAAI,CAAC;QAC/DC,IAAAA,YAAK,EAAC;YAAEH;QAAU;QAClB,IAAI,CAACA,WAAW;YACZ;QACJ;QAEA,MAAM,EAAEI,mBAAmB,EAAE,aAAGtB,mCAAAA,2BAA2BmB,IAAI,CAACD,wBAAhClB,uDAAAA,iCAA4CoB,MAAM,yCAAI,CAAC;QACvFC,IAAAA,YAAK,EAAC;YAAEC;QAAoB;QAC5B,IAAIA,qBAAqB;YACrB,OAAO;gBAAE,CAACA,oBAAoB,EAAEZ;YAAM;QAC1C;QAEAG,IAAAA,iBAAU,EAAC,OAAO;YAAC;YAAU;YAAU;YAAsBf;SAAe;IAChF;IAEQc,gBAAgB;QACpB,MAAMW,cAAcT,WAAE,CAACU,WAAW,CAACC,aAAI,CAACC,IAAI,CAACC,WAAE,CAACC,MAAM,IAAI;QAC1D,IAAI;YACA,IAAI,CAACC,IAAAA,mBAAY,EAAC;gBAAEC,aAAaP;gBAAaQ,MAAMlC;YAAU,IAAI;gBAC9D,MAAM,IAAImC,MAAM,CAAC,6BAA6B,EAAEnC,WAAW;YAC/D;YAEA,MAAMoC,UAAUC,IAAAA,eAAQ,EAACT,aAAI,CAACC,IAAI,CAACH,aAAa;YAChDF,IAAAA,YAAK,EAAC,2BAA2B;gBAAEY;YAAQ;YAE3C,IAAI,CAAE,CAAA,AAACA,WAAW,OAAOA,YAAY,YAAaE,MAAMC,OAAO,CAACH,QAAO,GAAI;gBACvE,MAAM,IAAID,MAAM;YACpB;YAEA,MAAM,EAAEK,eAAenB,SAAS,EAAE,GAAGe;YACrC,IAAI,CAACf,WAAW;gBACZ,MAAM,IAAIc,MAAM;YACpB;YAEA,IAAI,OAAOd,cAAc,UAAU;gBAC/B,MAAM,IAAIc,MAAM;YACpB;YAEA,OAAOM,OAAOC,IAAI,CAACrB,WAAW,UAAUsB,QAAQ,CAAC;QACrD,EAAE,OAAOC,GAAG;YACRC,QAAQC,IAAI,CAACC,OAAOH;QACxB,SAAU;YACN,IAAI;gBACA3B,WAAE,CAAC+B,MAAM,CAACtB,aAAa;oBAAEuB,WAAW;oBAAMC,OAAO;gBAAK;YAC1D,EAAE,eAAM;YACJ,SAAS;YACb;QACJ;IACJ;IAEQzC,gBAAgBF,GAA4B,EAAE;QAClD,IAAI,IAAI,CAACI,IAAI,CAACE,KAAK,EAAE;YACjB;QACJ;QAEA,IAAI,CAACR,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC8C,cAAc,CAACC,OAAO,CAAC,QAAQ,CAAC;QAEzD,IAAI,CAACD,cAAc,CAAC1C,eAAe,CAAC,IAAI,CAACE,IAAI,EAAE;YAAEJ;YAAK8C,OAAO;QAAU;IAC3E;IAEA,IAAYF,iBAAiB;;QACzB,sCAAa,uEAAL,IAAI,EAAC,iGAAoBG,IAAAA,iCAAiB;IACtD;IAEQjD,IAAIkD,OAAe,EAAE;QACzB,IAAI,CAAC,IAAI,CAAC5C,IAAI,CAAC6C,KAAK,EAAE;YAClBX,QAAQxC,GAAG,CAACkD;QAChB;IACJ;IAxGA,YAAY5C,IAAU,CAAE;QAHxBA,uBAAAA,QAAAA,KAAAA;QACA,gCAAA;;mBAAA,KAAA;;QAGI,IAAI,CAACA,IAAI,GAAGA;IAChB;AAuGJ"}

package/dist/package-manager/get-package-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-package-manager.d.ts","sourceRoot":"","sources":["../../src/package-manager/get-package-manager.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD,wBAAgB,iBAAiB,IAAI,cAAc,CAUlD"}
+{"version":3,"file":"get-package-manager.d.ts","sourceRoot":"","sources":["../../src/package-manager/get-package-manager.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD,wBAAgB,iBAAiB,IAAI,cAAc,CAUlD"}

package/dist/package-manager/get-package-manager.js

@@ -8,18 +8,13 @@ Object.defineProperty(exports, "getPackageManager", {
         return getPackageManager;
     }
 });
-const _fs = /*#__PURE__*/ _interop_require_default(require("fs"));
-const _path = /*#__PURE__*/ _interop_require_default(require("path"));
 const _utils = require("../utils");
 const _npmpackagemanager = require("./npm-package-manager");
 const _pnpmpackagemanager = require("./pnpm-package-manager");
-function _interop_require_default(obj) {
-    return obj && obj.__esModule ? obj : {
-        default: obj
-    };
-}
 function getPackageManager() {
-    const name = readPackageManagerName();
+    var _ref;
+    var _getWorkspaceRootPackageJson_cli, _getWorkspaceRootPackageJson;
+    const name = (_ref = (_getWorkspaceRootPackageJson = (0, _utils.getWorkspaceRootPackageJson)()) === null || _getWorkspaceRootPackageJson === void 0 ? void 0 : (_getWorkspaceRootPackageJson_cli = _getWorkspaceRootPackageJson.cli) === null || _getWorkspaceRootPackageJson_cli === void 0 ? void 0 : _getWorkspaceRootPackageJson_cli.packageManager) !== null && _ref !== void 0 ? _ref : 'npm';
     switch(name){
         case 'npm':
             return new _npmpackagemanager.NpmPackageManager();
@@ -29,26 +24,5 @@ function getPackageManager() {
             throw new Error(`Unsupported package manager: ${name}`);
     }
 }
-function readPackageManagerName() {
-    var _findWorkspaceRoot, _ref;
-    var _packageJson_cli;
-    const root = (_findWorkspaceRoot = findWorkspaceRoot()) !== null && _findWorkspaceRoot !== void 0 ? _findWorkspaceRoot : _path.default.resolve('./');
-    const packageJson = (0, _utils.readJsonSafe)(_path.default.join(root, 'package.json'));
-    return (_ref = packageJson === null || packageJson === void 0 ? void 0 : (_packageJson_cli = packageJson.cli) === null || _packageJson_cli === void 0 ? void 0 : _packageJson_cli.packageManager) !== null && _ref !== void 0 ? _ref : 'npm';
-}
-function findWorkspaceRoot() {
-    return (0, _utils.findUp)((directory)=>{
-        var _readJsonSafe, _readJsonSafe1;
-        if ((_readJsonSafe = (0, _utils.readJsonSafe)(_path.default.join(directory, 'package.json'))) === null || _readJsonSafe === void 0 ? void 0 : _readJsonSafe.workspaces) {
-            return directory;
-        }
-        if (_fs.default.existsSync(_path.default.join(directory, 'pnpm-workspace.yaml'))) {
-            return directory;
-        }
-        if ((_readJsonSafe1 = (0, _utils.readJsonSafe)(_path.default.join(directory, 'lerna.json'))) === null || _readJsonSafe1 === void 0 ? void 0 : _readJsonSafe1.packages) {
-            return directory;
-        }
-    });
-}
 
 //# sourceMappingURL=get-package-manager.js.map

package/dist/package-manager/get-package-manager.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/package-manager/get-package-manager.ts"],"sourcesContent":["import fs from 'fs';\nimport path from 'path';\nimport { findUp, readJsonSafe } from '../utils';\nimport { NpmPackageManager } from './npm-package-manager';\nimport type { PackageManager } from './package-manager';\nimport { PnpmPackageManager } from './pnpm-package-manager';\n\nexport function getPackageManager(): PackageManager {\n    const name = readPackageManagerName();\n    switch (name) {\n        case 'npm':\n            return new NpmPackageManager();\n        case 'pnpm':\n            return new PnpmPackageManager();\n        default:\n            throw new Error(`Unsupported package manager: ${name}`);\n    }\n}\n\nfunction readPackageManagerName(): string {\n    const root = findWorkspaceRoot() ?? path.resolve('./');\n    const packageJson = readJsonSafe<{ cli?: { packageManager?: string } }>(\n        path.join(root, 'package.json')\n    );\n    return packageJson?.cli?.packageManager ?? 'npm';\n}\n\nfunction findWorkspaceRoot(): string | undefined {\n    return findUp(directory => {\n        if (\n            readJsonSafe<{ workspaces?: unknown }>(path.join(directory, 'package.json'))?.workspaces\n        ) {\n            return directory;\n        }\n        if (fs.existsSync(path.join(directory, 'pnpm-workspace.yaml'))) {\n            return directory;\n        }\n        if (readJsonSafe<{ packages?: unknown }>(path.join(directory, 'lerna.json'))?.packages) {\n            return directory;\n        }\n    });\n}\n"],"names":["getPackageManager","name","readPackageManagerName","NpmPackageManager","PnpmPackageManager","Error","findWorkspaceRoot","packageJson","root","path","resolve","readJsonSafe","join","cli","packageManager","findUp","directory","workspaces","fs","existsSync","packages"],"mappings":";;;;+BAOgBA;;;eAAAA;;;2DAPD;6DACE;uBACoB;mCACH;oCAEC;;;;;;AAE5B,SAASA;IACZ,MAAMC,OAAOC;IACb,OAAQD;QACJ,KAAK;YACD,OAAO,IAAIE,oCAAiB;QAChC,KAAK;YACD,OAAO,IAAIC,sCAAkB;QACjC;YACI,MAAM,IAAIC,MAAM,CAAC,6BAA6B,EAAEJ,MAAM;IAC9D;AACJ;AAEA,SAASC;QACQI;QAINC;IAJP,MAAMC,QAAOF,qBAAAA,iCAAAA,gCAAAA,qBAAuBG,aAAI,CAACC,OAAO,CAAC;IACjD,MAAMH,cAAcI,IAAAA,mBAAY,EAC5BF,aAAI,CAACG,IAAI,CAACJ,MAAM;IAEpB,eAAOD,wBAAAA,mCAAAA,mBAAAA,YAAaM,GAAG,cAAhBN,uCAAAA,iBAAkBO,cAAc,uCAAI;AAC/C;AAEA,SAASR;IACL,OAAOS,IAAAA,aAAM,EAACC,CAAAA;YAENL,eAOAA;QARJ,KACIA,gBAAAA,IAAAA,mBAAY,EAA2BF,aAAI,CAACG,IAAI,CAACI,WAAW,8BAA5DL,oCAAAA,cAA8EM,UAAU,EAC1F;YACE,OAAOD;QACX;QACA,IAAIE,WAAE,CAACC,UAAU,CAACV,aAAI,CAACG,IAAI,CAACI,WAAW,yBAAyB;YAC5D,OAAOA;QACX;QACA,KAAIL,iBAAAA,IAAAA,mBAAY,EAAyBF,aAAI,CAACG,IAAI,CAACI,WAAW,4BAA1DL,qCAAAA,eAA0ES,QAAQ,EAAE;YACpF,OAAOJ;QACX;IACJ;AACJ"}
+{"version":3,"sources":["../../src/package-manager/get-package-manager.ts"],"sourcesContent":["import { getWorkspaceRootPackageJson } from '../utils';\nimport { NpmPackageManager } from './npm-package-manager';\nimport type { PackageManager } from './package-manager';\nimport { PnpmPackageManager } from './pnpm-package-manager';\n\nexport function getPackageManager(): PackageManager {\n    const name = getWorkspaceRootPackageJson()?.cli?.packageManager ?? 'npm';\n    switch (name) {\n        case 'npm':\n            return new NpmPackageManager();\n        case 'pnpm':\n            return new PnpmPackageManager();\n        default:\n            throw new Error(`Unsupported package manager: ${name}`);\n    }\n}\n"],"names":["getPackageManager","getWorkspaceRootPackageJson","name","cli","packageManager","NpmPackageManager","PnpmPackageManager","Error"],"mappings":";;;;+BAKgBA;;;eAAAA;;;uBAL4B;mCACV;oCAEC;AAE5B,SAASA;;QACCC,kCAAAA;IAAb,MAAMC,gBAAOD,+BAAAA,IAAAA,kCAA2B,iBAA3BA,oDAAAA,mCAAAA,6BAA+BE,GAAG,cAAlCF,uDAAAA,iCAAoCG,cAAc,uCAAI;IACnE,OAAQF;QACJ,KAAK;YACD,OAAO,IAAIG,oCAAiB;QAChC,KAAK;YACD,OAAO,IAAIC,sCAAkB;QACjC;YACI,MAAM,IAAIC,MAAM,CAAC,6BAA6B,EAAEL,MAAM;IAC9D;AACJ"}

package/dist/package-manager/npm-package-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"npm-package-manager.d.ts","sourceRoot":"","sources":["../../src/package-manager/npm-package-manager.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,UAAU,EAA+B,MAAM,UAAU,CAAC;AACzE,OAAO,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAQnD,UAAU,gBAAgB;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC/C;AAED,qBAAa,iBAAkB,SAAQ,cAAc,CAAC,WAAW,CAAC;IAC9D,QAAQ,CAAC,OAAO,SAAS;IACzB,QAAQ,CAAC,YAAY,uBAAuB;IAE5C,UAAU;IAIV,kBAAkB,CAAC,EACf,gBAAgB,EAChB,UAAU,EACV,UAAU,GACb,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAK5C,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAI9F,eAAe,CAAC,IAAI,GAAE,WAAgB,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IAuDlF,SAAS,CAAC,aAAa,IAAI,WAAW,GAAG,SAAS;IAYlD;;;;;;;OAOG;IACH,OAAO,CAAC,SAAS;IAiBjB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,qBAAqB;CAOhC"}
+{"version":3,"file":"npm-package-manager.d.ts","sourceRoot":"","sources":["../../src/package-manager/npm-package-manager.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,UAAU,EAA+B,MAAM,UAAU,CAAC;AACzE,OAAO,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAQnD,UAAU,gBAAgB;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC/C;AAED,qBAAa,iBAAkB,SAAQ,cAAc,CAAC,WAAW,CAAC;IAC9D,QAAQ,CAAC,OAAO,SAAS;IACzB,QAAQ,CAAC,YAAY,uBAAuB;IAE5C,UAAU;IAIV,kBAAkB,CAAC,EACf,gBAAgB,EAChB,UAAU,EACV,UAAU,GACb,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAK5C,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAI9F,eAAe,CAAC,IAAI,GAAE,WAAgB,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IAwDlF,SAAS,CAAC,aAAa,IAAI,WAAW,GAAG,SAAS;IAYlD;;;;;;;OAOG;IACH,OAAO,CAAC,SAAS;IAiBjB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,qBAAqB;CAOhC"}

package/dist/package-manager/npm-package-manager.js

@@ -20,9 +20,7 @@ function _define_property(obj, key, value) {
             configurable: true,
             writable: true
         });
-    } else {
-        obj[key] = value;
-    }
+    } else obj[key] = value;
     return obj;
 }
 function _interop_require_default(obj) {
@@ -56,16 +54,17 @@ class NpmPackageManager extends _packagemanager.PackageManager {
     }
     installPackages(args = {}, options) {
         var _args_allowScripts;
-        const allowScripts = (0, _utils1.resolveAllowScripts)((_args_allowScripts = args.allowScripts) !== null && _args_allowScripts !== void 0 ? _args_allowScripts : []);
+        const builtInAllowlist = (0, _utils1.usesStartup)() ? _utils1.DEFAULT_ALLOWED_SCRIPTS : [];
+        const allowScripts = (0, _utils1.resolveAllowScripts)((_args_allowScripts = args.allowScripts) !== null && _args_allowScripts !== void 0 ? _args_allowScripts : [], builtInAllowlist);
         if (!args.quiet) {
-            (0, _utils1.logAllowedScripts)(allowScripts);
+            (0, _utils1.logAllowedScripts)(allowScripts, builtInAllowlist);
         }
         (0, _utils.runCommand)(this.command, [
             (0, _utils.isCI)() ? 'ci' : 'i',
             '--audit=false',
             '--fund=false',
             '--legacy-peer-deps',
-            ...(0, _utils1.shouldIgnoreScripts)(allowScripts) ? [
+            ...allowScripts !== true ? [
                 '--ignore-scripts'
             ] : [],
             ...args.fix ? [
@@ -78,10 +77,10 @@ class NpmPackageManager extends _packagemanager.PackageManager {
                 return;
             }
             /*
-             * Rebuild applies when allowScripts is an explicit list:
+             * Rebuild applies when allowScripts is a non-empty explicit list:
              * `true` means npm install already ran every script, `false`
              * means the user opted out.
-             */ if (Array.isArray(allowScripts)) {
+             */ if (Array.isArray(allowScripts) && allowScripts.length > 0) {
                 this.runRebuild(allowScripts);
             }
             /*
@@ -89,7 +88,7 @@ class NpmPackageManager extends _packagemanager.PackageManager {
              * scripts they should add to --allow-scripts. Skip when the user
              * explicitly opted out (`false`); they made an informed choice.
              */ if (allowScripts !== false) {
-                (0, _utils.warnUntrustedInstallScripts)(Array.isArray(allowScripts) ? allowScripts : _utils1.DEFAULT_ALLOWED_SCRIPTS);
+                (0, _utils.warnUntrustedInstallScripts)(Array.isArray(allowScripts) ? allowScripts : builtInAllowlist);
             }
             /*
              * When allowScripts is `true`, npm already ran project postinstall.

package/dist/package-manager/npm-package-manager.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/package-manager/npm-package-manager.ts"],"sourcesContent":["/* eslint-disable no-console */\nimport fs from 'fs';\nimport { isCI, runCommand, warnUntrustedInstallScripts } from '../utils';\nimport type { DeclaredVersionQuery, InstallArgs, ResolvedVersionQuery } from './package-manager';\nimport { PackageManager } from './package-manager';\nimport {\n    DEFAULT_ALLOWED_SCRIPTS,\n    logAllowedScripts,\n    resolveAllowScripts,\n    shouldIgnoreScripts,\n} from './utils';\n\ninterface NpmLockFileEntry {\n    version?: string;\n    resolved?: string;\n    link?: boolean;\n    dependencies?: Record<string, string>;\n    peerDependencies?: Record<string, string>;\n}\n\nexport interface NpmLockFile {\n    packages?: Record<string, NpmLockFileEntry>;\n}\n\nexport class NpmPackageManager extends PackageManager<NpmLockFile> {\n    readonly command = 'npm';\n    readonly lockFileName = 'package-lock.json';\n\n    clearCache() {\n        runCommand(this.command, ['cache', 'clear', '--force']);\n    }\n\n    getDeclaredVersion({\n        workspacePackage,\n        declaredBy,\n        dependency,\n    }: DeclaredVersionQuery): string | undefined {\n        const entry = this.findEntry({ workspacePackage, package: declaredBy });\n        return entry?.dependencies?.[dependency] ?? entry?.peerDependencies?.[dependency];\n    }\n\n    getResolvedVersion({ workspacePackage, dependency }: ResolvedVersionQuery): string | undefined {\n        return this.findEntry({ workspacePackage, package: dependency })?.version;\n    }\n\n    installPackages(args: InstallArgs = {}, options?: Parameters<typeof runCommand>[2]) {\n        const allowScripts = resolveAllowScripts(args.allowScripts ?? []);\n\n        if (!args.quiet) {\n            logAllowedScripts(allowScripts);\n        }\n\n        runCommand(\n            this.command,\n            [\n                isCI() ? 'ci' : 'i',\n                '--audit=false',\n                '--fund=false',\n                '--legacy-peer-deps',\n                ...(shouldIgnoreScripts(allowScripts) ? ['--ignore-scripts'] : []),\n                ...(args.fix ? ['--package-lock-only', '--prefer-dedupe'] : []),\n            ],\n            options\n        );\n\n        try {\n            if (args.fix) {\n                return;\n            }\n            /*\n             * Rebuild applies when allowScripts is an explicit list:\n             * `true` means npm install already ran every script, `false`\n             * means the user opted out.\n             */\n            if (Array.isArray(allowScripts)) {\n                this.runRebuild(allowScripts);\n            }\n            /*\n             * Warn against the effective allowlist so teams can see which\n             * scripts they should add to --allow-scripts. Skip when the user\n             * explicitly opted out (`false`); they made an informed choice.\n             */\n            if (allowScripts !== false) {\n                warnUntrustedInstallScripts(\n                    Array.isArray(allowScripts) ? allowScripts : DEFAULT_ALLOWED_SCRIPTS\n                );\n            }\n            /*\n             * When allowScripts is `true`, npm already ran project postinstall.\n             * In other cases, we run it manually. Note, `false` only ignores\n             * package scripts, the project postinstall is always trusted.\n             */\n            if (allowScripts !== true) {\n                this.runProjectPostinstall(options);\n            }\n        } finally {\n            this.reset();\n        }\n    }\n\n    protected parseLockFile(): NpmLockFile | undefined {\n        const lockFilePath = this.getLockFilePath();\n        if (!lockFilePath) {\n            return undefined;\n        }\n        try {\n            return JSON.parse(fs.readFileSync(lockFilePath, 'utf-8'));\n        } catch {\n            return undefined;\n        }\n    }\n\n    /**\n     * Looks up a lockfile entry for the given workspace package, falling back\n     * to the hoisted root entry. `workspacePackage` is the package's relative\n     * path from the repo root; the empty string `''` denotes the root\n     * workspace package itself, matching npm's own lockfile key convention.\n     * Follows link entries to the resolved workspace package, so callers see\n     * the workspace package's own metadata rather than the symlink stub.\n     */\n    private findEntry({\n        workspacePackage,\n        package: packageName,\n    }: {\n        workspacePackage: string;\n        package: string;\n    }): NpmLockFileEntry | undefined {\n        const packages = this.getLockFile()?.packages;\n        const entry =\n            packages?.[`${workspacePackage}/node_modules/${packageName}`] ??\n            packages?.[`node_modules/${packageName}`];\n        if (entry?.link && entry.resolved) {\n            return packages?.[entry.resolved];\n        }\n        return entry;\n    }\n\n    private runRebuild(scripts: string[]) {\n        try {\n            runCommand(this.command, ['rebuild', ...scripts]);\n        } catch {\n            console.error(`Failed to run allowed scripts: ${scripts.join(', ')}`);\n            process.exitCode = 1;\n        }\n    }\n\n    private runProjectPostinstall(options?: Parameters<typeof runCommand>[2]) {\n        try {\n            runCommand(this.command, ['run', 'postinstall', '--if-present'], options);\n        } catch {\n            process.exitCode = 1;\n        }\n    }\n}\n"],"names":["NpmPackageManager","PackageManager","clearCache","runCommand","command","getDeclaredVersion","workspacePackage","declaredBy","dependency","entry","findEntry","package","dependencies","peerDependencies","getResolvedVersion","version","installPackages","args","options","allowScripts","resolveAllowScripts","quiet","logAllowedScripts","isCI","shouldIgnoreScripts","fix","Array","isArray","runRebuild","warnUntrustedInstallScripts","DEFAULT_ALLOWED_SCRIPTS","runProjectPostinstall","reset","parseLockFile","lockFilePath","getLockFilePath","undefined","JSON","parse","fs","readFileSync","packageName","packages","getLockFile","link","resolved","scripts","console","error","join","process","exitCode","lockFileName"],"mappings":"AAAA,6BAA6B;;;;+BAwBhBA;;;eAAAA;;;2DAvBE;uBAC+C;gCAE/B;wBAMxB;;;;;;;;;;;;;;;;;;;AAcA,MAAMA,0BAA0BC,8BAAc;IAIjDC,aAAa;QACTC,IAAAA,iBAAU,EAAC,IAAI,CAACC,OAAO,EAAE;YAAC;YAAS;YAAS;SAAU;IAC1D;IAEAC,mBAAmB,EACfC,gBAAgB,EAChBC,UAAU,EACVC,UAAU,EACS,EAAsB;;YAElCC,qBAAqCA;QAD5C,MAAMA,QAAQ,IAAI,CAACC,SAAS,CAAC;YAAEJ;YAAkBK,SAASJ;QAAW;QACrE,eAAOE,kBAAAA,6BAAAA,sBAAAA,MAAOG,YAAY,cAAnBH,0CAAAA,mBAAqB,CAACD,WAAW,uCAAIC,kBAAAA,6BAAAA,0BAAAA,MAAOI,gBAAgB,cAAvBJ,8CAAAA,uBAAyB,CAACD,WAAW;IACrF;IAEAM,mBAAmB,EAAER,gBAAgB,EAAEE,UAAU,EAAwB,EAAsB;YACpF;QAAP,QAAO,kBAAA,IAAI,CAACE,SAAS,CAAC;YAAEJ;YAAkBK,SAASH;QAAW,gBAAvD,sCAAA,gBAA2DO,OAAO;IAC7E;IAEAC,gBAAgBC,OAAoB,CAAC,CAAC,EAAEC,OAA0C,EAAE;YACvCD;QAAzC,MAAME,eAAeC,IAAAA,2BAAmB,GAACH,qBAAAA,KAAKE,YAAY,cAAjBF,gCAAAA,qBAAqB,EAAE;QAEhE,IAAI,CAACA,KAAKI,KAAK,EAAE;YACbC,IAAAA,yBAAiB,EAACH;QACtB;QAEAhB,IAAAA,iBAAU,EACN,IAAI,CAACC,OAAO,EACZ;YACImB,IAAAA,WAAI,MAAK,OAAO;YAChB;YACA;YACA;eACIC,IAAAA,2BAAmB,EAACL,gBAAgB;gBAAC;aAAmB,GAAG,EAAE;eAC7DF,KAAKQ,GAAG,GAAG;gBAAC;gBAAuB;aAAkB,GAAG,EAAE;SACjE,EACDP;QAGJ,IAAI;YACA,IAAID,KAAKQ,GAAG,EAAE;gBACV;YACJ;YACA;;;;aAIC,GACD,IAAIC,MAAMC,OAAO,CAACR,eAAe;gBAC7B,IAAI,CAACS,UAAU,CAACT;YACpB;YACA;;;;aAIC,GACD,IAAIA,iBAAiB,OAAO;gBACxBU,IAAAA,kCAA2B,EACvBH,MAAMC,OAAO,CAACR,gBAAgBA,eAAeW,+BAAuB;YAE5E;YACA;;;;aAIC,GACD,IAAIX,iBAAiB,MAAM;gBACvB,IAAI,CAACY,qBAAqB,CAACb;YAC/B;QACJ,SAAU;YACN,IAAI,CAACc,KAAK;QACd;IACJ;IAEUC,gBAAyC;QAC/C,MAAMC,eAAe,IAAI,CAACC,eAAe;QACzC,IAAI,CAACD,cAAc;YACf,OAAOE;QACX;QACA,IAAI;YACA,OAAOC,KAAKC,KAAK,CAACC,WAAE,CAACC,YAAY,CAACN,cAAc;QACpD,EAAE,eAAM;YACJ,OAAOE;QACX;IACJ;IAEA;;;;;;;KAOC,GACD,AAAQ1B,UAAU,EACdJ,gBAAgB,EAChBK,SAAS8B,WAAW,EAIvB,EAAgC;;YACZ;QAAjB,MAAMC,YAAW,oBAAA,IAAI,CAACC,WAAW,gBAAhB,wCAAA,kBAAoBD,QAAQ;QAC7C,MAAMjC,gBACFiC,qBAAAA,+BAAAA,QAAU,CAAC,GAAGpC,iBAAiB,cAAc,EAAEmC,aAAa,CAAC,uCAC7DC,qBAAAA,+BAAAA,QAAU,CAAC,CAAC,aAAa,EAAED,aAAa,CAAC;QAC7C,IAAIhC,CAAAA,kBAAAA,4BAAAA,MAAOmC,IAAI,KAAInC,MAAMoC,QAAQ,EAAE;YAC/B,OAAOH,qBAAAA,+BAAAA,QAAU,CAACjC,MAAMoC,QAAQ,CAAC;QACrC;QACA,OAAOpC;IACX;IAEQmB,WAAWkB,OAAiB,EAAE;QAClC,IAAI;YACA3C,IAAAA,iBAAU,EAAC,IAAI,CAACC,OAAO,EAAE;gBAAC;mBAAc0C;aAAQ;QACpD,EAAE,eAAM;YACJC,QAAQC,KAAK,CAAC,CAAC,+BAA+B,EAAEF,QAAQG,IAAI,CAAC,OAAO;YACpEC,QAAQC,QAAQ,GAAG;QACvB;IACJ;IAEQpB,sBAAsBb,OAA0C,EAAE;QACtE,IAAI;YACAf,IAAAA,iBAAU,EAAC,IAAI,CAACC,OAAO,EAAE;gBAAC;gBAAO;gBAAe;aAAe,EAAEc;QACrE,EAAE,eAAM;YACJgC,QAAQC,QAAQ,GAAG;QACvB;IACJ;;QAhIG,gBACH,uBAAS/C,WAAU,QACnB,uBAASgD,gBAAe;;AA+H5B"}
+{"version":3,"sources":["../../src/package-manager/npm-package-manager.ts"],"sourcesContent":["/* eslint-disable no-console */\nimport fs from 'fs';\nimport { isCI, runCommand, warnUntrustedInstallScripts } from '../utils';\nimport type { DeclaredVersionQuery, InstallArgs, ResolvedVersionQuery } from './package-manager';\nimport { PackageManager } from './package-manager';\nimport {\n    DEFAULT_ALLOWED_SCRIPTS,\n    logAllowedScripts,\n    resolveAllowScripts,\n    usesStartup,\n} from './utils';\n\ninterface NpmLockFileEntry {\n    version?: string;\n    resolved?: string;\n    link?: boolean;\n    dependencies?: Record<string, string>;\n    peerDependencies?: Record<string, string>;\n}\n\nexport interface NpmLockFile {\n    packages?: Record<string, NpmLockFileEntry>;\n}\n\nexport class NpmPackageManager extends PackageManager<NpmLockFile> {\n    readonly command = 'npm';\n    readonly lockFileName = 'package-lock.json';\n\n    clearCache() {\n        runCommand(this.command, ['cache', 'clear', '--force']);\n    }\n\n    getDeclaredVersion({\n        workspacePackage,\n        declaredBy,\n        dependency,\n    }: DeclaredVersionQuery): string | undefined {\n        const entry = this.findEntry({ workspacePackage, package: declaredBy });\n        return entry?.dependencies?.[dependency] ?? entry?.peerDependencies?.[dependency];\n    }\n\n    getResolvedVersion({ workspacePackage, dependency }: ResolvedVersionQuery): string | undefined {\n        return this.findEntry({ workspacePackage, package: dependency })?.version;\n    }\n\n    installPackages(args: InstallArgs = {}, options?: Parameters<typeof runCommand>[2]) {\n        const builtInAllowlist = usesStartup() ? DEFAULT_ALLOWED_SCRIPTS : [];\n        const allowScripts = resolveAllowScripts(args.allowScripts ?? [], builtInAllowlist);\n\n        if (!args.quiet) {\n            logAllowedScripts(allowScripts, builtInAllowlist);\n        }\n\n        runCommand(\n            this.command,\n            [\n                isCI() ? 'ci' : 'i',\n                '--audit=false',\n                '--fund=false',\n                '--legacy-peer-deps',\n                ...(allowScripts !== true ? ['--ignore-scripts'] : []),\n                ...(args.fix ? ['--package-lock-only', '--prefer-dedupe'] : []),\n            ],\n            options\n        );\n\n        try {\n            if (args.fix) {\n                return;\n            }\n            /*\n             * Rebuild applies when allowScripts is a non-empty explicit list:\n             * `true` means npm install already ran every script, `false`\n             * means the user opted out.\n             */\n            if (Array.isArray(allowScripts) && allowScripts.length > 0) {\n                this.runRebuild(allowScripts);\n            }\n            /*\n             * Warn against the effective allowlist so teams can see which\n             * scripts they should add to --allow-scripts. Skip when the user\n             * explicitly opted out (`false`); they made an informed choice.\n             */\n            if (allowScripts !== false) {\n                warnUntrustedInstallScripts(\n                    Array.isArray(allowScripts) ? allowScripts : builtInAllowlist\n                );\n            }\n            /*\n             * When allowScripts is `true`, npm already ran project postinstall.\n             * In other cases, we run it manually. Note, `false` only ignores\n             * package scripts, the project postinstall is always trusted.\n             */\n            if (allowScripts !== true) {\n                this.runProjectPostinstall(options);\n            }\n        } finally {\n            this.reset();\n        }\n    }\n\n    protected parseLockFile(): NpmLockFile | undefined {\n        const lockFilePath = this.getLockFilePath();\n        if (!lockFilePath) {\n            return undefined;\n        }\n        try {\n            return JSON.parse(fs.readFileSync(lockFilePath, 'utf-8'));\n        } catch {\n            return undefined;\n        }\n    }\n\n    /**\n     * Looks up a lockfile entry for the given workspace package, falling back\n     * to the hoisted root entry. `workspacePackage` is the package's relative\n     * path from the repo root; the empty string `''` denotes the root\n     * workspace package itself, matching npm's own lockfile key convention.\n     * Follows link entries to the resolved workspace package, so callers see\n     * the workspace package's own metadata rather than the symlink stub.\n     */\n    private findEntry({\n        workspacePackage,\n        package: packageName,\n    }: {\n        workspacePackage: string;\n        package: string;\n    }): NpmLockFileEntry | undefined {\n        const packages = this.getLockFile()?.packages;\n        const entry =\n            packages?.[`${workspacePackage}/node_modules/${packageName}`] ??\n            packages?.[`node_modules/${packageName}`];\n        if (entry?.link && entry.resolved) {\n            return packages?.[entry.resolved];\n        }\n        return entry;\n    }\n\n    private runRebuild(scripts: string[]) {\n        try {\n            runCommand(this.command, ['rebuild', ...scripts]);\n        } catch {\n            console.error(`Failed to run allowed scripts: ${scripts.join(', ')}`);\n            process.exitCode = 1;\n        }\n    }\n\n    private runProjectPostinstall(options?: Parameters<typeof runCommand>[2]) {\n        try {\n            runCommand(this.command, ['run', 'postinstall', '--if-present'], options);\n        } catch {\n            process.exitCode = 1;\n        }\n    }\n}\n"],"names":["NpmPackageManager","PackageManager","clearCache","runCommand","command","getDeclaredVersion","workspacePackage","declaredBy","dependency","entry","findEntry","package","dependencies","peerDependencies","getResolvedVersion","version","installPackages","args","options","builtInAllowlist","usesStartup","DEFAULT_ALLOWED_SCRIPTS","allowScripts","resolveAllowScripts","quiet","logAllowedScripts","isCI","fix","Array","isArray","length","runRebuild","warnUntrustedInstallScripts","runProjectPostinstall","reset","parseLockFile","lockFilePath","getLockFilePath","undefined","JSON","parse","fs","readFileSync","packageName","packages","getLockFile","link","resolved","scripts","console","error","join","process","exitCode","lockFileName"],"mappings":"AAAA,6BAA6B;;;;+BAwBhBA;;;eAAAA;;;2DAvBE;uBAC+C;gCAE/B;wBAMxB;;;;;;;;;;;;;;;;;AAcA,MAAMA,0BAA0BC,8BAAc;IAIjDC,aAAa;QACTC,IAAAA,iBAAU,EAAC,IAAI,CAACC,OAAO,EAAE;YAAC;YAAS;YAAS;SAAU;IAC1D;IAEAC,mBAAmB,EACfC,gBAAgB,EAChBC,UAAU,EACVC,UAAU,EACS,EAAsB;;YAElCC,qBAAqCA;QAD5C,MAAMA,QAAQ,IAAI,CAACC,SAAS,CAAC;YAAEJ;YAAkBK,SAASJ;QAAW;QACrE,eAAOE,kBAAAA,6BAAAA,sBAAAA,MAAOG,YAAY,cAAnBH,0CAAAA,mBAAqB,CAACD,WAAW,uCAAIC,kBAAAA,6BAAAA,0BAAAA,MAAOI,gBAAgB,cAAvBJ,8CAAAA,uBAAyB,CAACD,WAAW;IACrF;IAEAM,mBAAmB,EAAER,gBAAgB,EAAEE,UAAU,EAAwB,EAAsB;YACpF;QAAP,QAAO,kBAAA,IAAI,CAACE,SAAS,CAAC;YAAEJ;YAAkBK,SAASH;QAAW,gBAAvD,sCAAA,gBAA2DO,OAAO;IAC7E;IAEAC,gBAAgBC,OAAoB,CAAC,CAAC,EAAEC,OAA0C,EAAE;YAEvCD;QADzC,MAAME,mBAAmBC,IAAAA,mBAAW,MAAKC,+BAAuB,GAAG,EAAE;QACrE,MAAMC,eAAeC,IAAAA,2BAAmB,GAACN,qBAAAA,KAAKK,YAAY,cAAjBL,gCAAAA,qBAAqB,EAAE,EAAEE;QAElE,IAAI,CAACF,KAAKO,KAAK,EAAE;YACbC,IAAAA,yBAAiB,EAACH,cAAcH;QACpC;QAEAhB,IAAAA,iBAAU,EACN,IAAI,CAACC,OAAO,EACZ;YACIsB,IAAAA,WAAI,MAAK,OAAO;YAChB;YACA;YACA;eACIJ,iBAAiB,OAAO;gBAAC;aAAmB,GAAG,EAAE;eACjDL,KAAKU,GAAG,GAAG;gBAAC;gBAAuB;aAAkB,GAAG,EAAE;SACjE,EACDT;QAGJ,IAAI;YACA,IAAID,KAAKU,GAAG,EAAE;gBACV;YACJ;YACA;;;;aAIC,GACD,IAAIC,MAAMC,OAAO,CAACP,iBAAiBA,aAAaQ,MAAM,GAAG,GAAG;gBACxD,IAAI,CAACC,UAAU,CAACT;YACpB;YACA;;;;aAIC,GACD,IAAIA,iBAAiB,OAAO;gBACxBU,IAAAA,kCAA2B,EACvBJ,MAAMC,OAAO,CAACP,gBAAgBA,eAAeH;YAErD;YACA;;;;aAIC,GACD,IAAIG,iBAAiB,MAAM;gBACvB,IAAI,CAACW,qBAAqB,CAACf;YAC/B;QACJ,SAAU;YACN,IAAI,CAACgB,KAAK;QACd;IACJ;IAEUC,gBAAyC;QAC/C,MAAMC,eAAe,IAAI,CAACC,eAAe;QACzC,IAAI,CAACD,cAAc;YACf,OAAOE;QACX;QACA,IAAI;YACA,OAAOC,KAAKC,KAAK,CAACC,WAAE,CAACC,YAAY,CAACN,cAAc;QACpD,EAAE,eAAM;YACJ,OAAOE;QACX;IACJ;IAEA;;;;;;;KAOC,GACD,AAAQ5B,UAAU,EACdJ,gBAAgB,EAChBK,SAASgC,WAAW,EAIvB,EAAgC;;YACZ;QAAjB,MAAMC,YAAW,oBAAA,IAAI,CAACC,WAAW,gBAAhB,wCAAA,kBAAoBD,QAAQ;QAC7C,MAAMnC,gBACFmC,qBAAAA,+BAAAA,QAAU,CAAC,GAAGtC,iBAAiB,cAAc,EAAEqC,aAAa,CAAC,uCAC7DC,qBAAAA,+BAAAA,QAAU,CAAC,CAAC,aAAa,EAAED,aAAa,CAAC;QAC7C,IAAIlC,CAAAA,kBAAAA,4BAAAA,MAAOqC,IAAI,KAAIrC,MAAMsC,QAAQ,EAAE;YAC/B,OAAOH,qBAAAA,+BAAAA,QAAU,CAACnC,MAAMsC,QAAQ,CAAC;QACrC;QACA,OAAOtC;IACX;IAEQsB,WAAWiB,OAAiB,EAAE;QAClC,IAAI;YACA7C,IAAAA,iBAAU,EAAC,IAAI,CAACC,OAAO,EAAE;gBAAC;mBAAc4C;aAAQ;QACpD,EAAE,eAAM;YACJC,QAAQC,KAAK,CAAC,CAAC,+BAA+B,EAAEF,QAAQG,IAAI,CAAC,OAAO;YACpEC,QAAQC,QAAQ,GAAG;QACvB;IACJ;IAEQpB,sBAAsBf,OAA0C,EAAE;QACtE,IAAI;YACAf,IAAAA,iBAAU,EAAC,IAAI,CAACC,OAAO,EAAE;gBAAC;gBAAO;gBAAe;aAAe,EAAEc;QACrE,EAAE,eAAM;YACJkC,QAAQC,QAAQ,GAAG;QACvB;IACJ;;QAjIG,gBACH,uBAASjD,WAAU,QACnB,uBAASkD,gBAAe;;AAgI5B"}

package/dist/package-manager/package-manager.js

@@ -17,15 +17,12 @@ function _check_private_redeclaration(obj, privateCollection) {
     }
 }
 function _class_apply_descriptor_get(receiver, descriptor) {
-    if (descriptor.get) {
-        return descriptor.get.call(receiver);
-    }
+    if (descriptor.get) return descriptor.get.call(receiver);
     return descriptor.value;
 }
 function _class_apply_descriptor_set(receiver, descriptor, value) {
-    if (descriptor.set) {
-        descriptor.set.call(receiver, value);
-    } else {
+    if (descriptor.set) descriptor.set.call(receiver, value);
+    else {
         if (!descriptor.writable) {
             throw new TypeError("attempted to set read only private field");
         }
@@ -33,9 +30,7 @@ function _class_apply_descriptor_set(receiver, descriptor, value) {
     }
 }
 function _class_extract_field_descriptor(receiver, privateMap, action) {
-    if (!privateMap.has(receiver)) {
-        throw new TypeError("attempted to " + action + " private field on non-instance");
-    }
+    if (!privateMap.has(receiver)) throw new TypeError("attempted to " + action + " private field on non-instance");
     return privateMap.get(receiver);
 }
 function _class_private_field_get(receiver, privateMap) {

package/dist/package-manager/package-manager.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/package-manager/package-manager.ts"],"sourcesContent":["import fs from 'fs';\nimport path from 'node:path';\nimport { findUp, runCommand } from '../utils';\n\nexport type AllowScripts = true | false | string[];\n\nexport interface InstallArgs {\n    allowScripts?: AllowScripts;\n    fix?: boolean;\n    quiet?: boolean;\n}\n\nexport interface DeclaredVersionQuery {\n    workspacePackage: string;\n    declaredBy: string;\n    dependency: string;\n}\n\nexport interface ResolvedVersionQuery {\n    workspacePackage: string;\n    dependency: string;\n}\n\nexport abstract class PackageManager<LockFile = unknown> {\n    abstract readonly command: string;\n    abstract readonly lockFileName: string;\n\n    #lockFile: LockFile | undefined;\n    #lockFileLoaded = false;\n    #lockFilePath: string | undefined;\n    #lockFilePathLoaded = false;\n\n    hasValidLockFile(): boolean {\n        return this.getLockFile() !== undefined;\n    }\n\n    getLockFilePath(): string | undefined {\n        if (!this.#lockFilePathLoaded) {\n            this.#lockFilePath = findUp(directory => {\n                const candidate = path.join(directory, this.lockFileName);\n                return fs.existsSync(candidate) ? candidate : undefined;\n            });\n            this.#lockFilePathLoaded = true;\n        }\n        return this.#lockFilePath;\n    }\n\n    /**\n     * Returns the lockfile key for a package given its absolute or\n     * cwd-relative directory. Both npm and pnpm key their lockfile entries\n     * by the package's path relative to the workspace root.\n     */\n    getWorkspacePackage(packageDir = process.cwd()): string {\n        const lockFilePath = this.getLockFilePath();\n        if (!lockFilePath) {\n            return this.rootWorkspacePackage;\n        }\n        const relative = path\n            .relative(path.dirname(lockFilePath), path.resolve(packageDir))\n            .split(path.sep)\n            .join('/');\n        return relative === '' ? this.rootWorkspacePackage : relative;\n    }\n\n    protected getLockFile(): LockFile | undefined {\n        if (!this.#lockFileLoaded) {\n            this.#lockFile = this.parseLockFile();\n            this.#lockFileLoaded = true;\n        }\n        return this.#lockFile;\n    }\n\n    protected reset() {\n        this.#lockFile = undefined;\n        this.#lockFileLoaded = false;\n        this.#lockFilePath = undefined;\n        this.#lockFilePathLoaded = false;\n    }\n\n    protected get rootWorkspacePackage(): string {\n        return '';\n    }\n\n    abstract clearCache(): void;\n    abstract getDeclaredVersion(query: DeclaredVersionQuery): string | undefined;\n    abstract getResolvedVersion(query: ResolvedVersionQuery): string | undefined;\n    abstract installPackages(args?: InstallArgs, options?: Parameters<typeof runCommand>[2]): void;\n\n    protected abstract parseLockFile(): LockFile | undefined;\n}\n"],"names":["PackageManager","hasValidLockFile","getLockFile","undefined","getLockFilePath","findUp","directory","candidate","path","join","lockFileName","fs","existsSync","getWorkspacePackage","packageDir","process","cwd","lockFilePath","rootWorkspacePackage","relative","dirname","resolve","split","sep","parseLockFile","reset"],"mappings":";;;;+BAuBsBA;;;eAAAA;;;2DAvBP;iEACE;uBACkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAyB/B,yCACA,+CACA,6CACA;AAPG,MAAeA;IASlBC,mBAA4B;QACxB,OAAO,IAAI,CAACC,WAAW,OAAOC;IAClC;IAEAC,kBAAsC;QAClC,IAAI,0BAAC,IAAI,EAAC,sBAAqB;2CACtB,eAAgBC,IAAAA,aAAM,EAACC,CAAAA;gBACxB,MAAMC,YAAYC,iBAAI,CAACC,IAAI,CAACH,WAAW,IAAI,CAACI,YAAY;gBACxD,OAAOC,WAAE,CAACC,UAAU,CAACL,aAAaA,YAAYJ;YAClD;2CACK,qBAAsB;QAC/B;QACA,gCAAO,IAAI,EAAC;IAChB;IAEA;;;;KAIC,GACDU,oBAAoBC,aAAaC,QAAQC,GAAG,EAAE,EAAU;QACpD,MAAMC,eAAe,IAAI,CAACb,eAAe;QACzC,IAAI,CAACa,cAAc;YACf,OAAO,IAAI,CAACC,oBAAoB;QACpC;QACA,MAAMC,WAAWX,iBAAI,CAChBW,QAAQ,CAACX,iBAAI,CAACY,OAAO,CAACH,eAAeT,iBAAI,CAACa,OAAO,CAACP,aAClDQ,KAAK,CAACd,iBAAI,CAACe,GAAG,EACdd,IAAI,CAAC;QACV,OAAOU,aAAa,KAAK,IAAI,CAACD,oBAAoB,GAAGC;IACzD;IAEUjB,cAAoC;QAC1C,IAAI,0BAAC,IAAI,EAAC,kBAAiB;2CAClB,WAAY,IAAI,CAACsB,aAAa;2CAC9B,iBAAkB;QAC3B;QACA,gCAAO,IAAI,EAAC;IAChB;IAEUC,QAAQ;uCACT,WAAYtB;uCACZ,iBAAkB;uCAClB,eAAgBA;uCAChB,qBAAsB;IAC/B;IAEA,IAAce,uBAA+B;QACzC,OAAO;IACX;;QAtDA,gCAAA;;mBAAA,KAAA;;QACA,gCAAA;;mBAAkB;;QAClB,gCAAA;;mBAAA,KAAA;;QACA,gCAAA;;mBAAsB;;;AA2D1B"}
+{"version":3,"sources":["../../src/package-manager/package-manager.ts"],"sourcesContent":["import fs from 'fs';\nimport path from 'node:path';\nimport { findUp, runCommand } from '../utils';\n\nexport type AllowScripts = true | false | string[];\n\nexport interface InstallArgs {\n    allowScripts?: AllowScripts;\n    fix?: boolean;\n    quiet?: boolean;\n}\n\nexport interface DeclaredVersionQuery {\n    workspacePackage: string;\n    declaredBy: string;\n    dependency: string;\n}\n\nexport interface ResolvedVersionQuery {\n    workspacePackage: string;\n    dependency: string;\n}\n\nexport abstract class PackageManager<LockFile = unknown> {\n    abstract readonly command: string;\n    abstract readonly lockFileName: string;\n\n    #lockFile: LockFile | undefined;\n    #lockFileLoaded = false;\n    #lockFilePath: string | undefined;\n    #lockFilePathLoaded = false;\n\n    hasValidLockFile(): boolean {\n        return this.getLockFile() !== undefined;\n    }\n\n    getLockFilePath(): string | undefined {\n        if (!this.#lockFilePathLoaded) {\n            this.#lockFilePath = findUp(directory => {\n                const candidate = path.join(directory, this.lockFileName);\n                return fs.existsSync(candidate) ? candidate : undefined;\n            });\n            this.#lockFilePathLoaded = true;\n        }\n        return this.#lockFilePath;\n    }\n\n    /**\n     * Returns the lockfile key for a package given its absolute or\n     * cwd-relative directory. Both npm and pnpm key their lockfile entries\n     * by the package's path relative to the workspace root.\n     */\n    getWorkspacePackage(packageDir = process.cwd()): string {\n        const lockFilePath = this.getLockFilePath();\n        if (!lockFilePath) {\n            return this.rootWorkspacePackage;\n        }\n        const relative = path\n            .relative(path.dirname(lockFilePath), path.resolve(packageDir))\n            .split(path.sep)\n            .join('/');\n        return relative === '' ? this.rootWorkspacePackage : relative;\n    }\n\n    protected getLockFile(): LockFile | undefined {\n        if (!this.#lockFileLoaded) {\n            this.#lockFile = this.parseLockFile();\n            this.#lockFileLoaded = true;\n        }\n        return this.#lockFile;\n    }\n\n    protected reset() {\n        this.#lockFile = undefined;\n        this.#lockFileLoaded = false;\n        this.#lockFilePath = undefined;\n        this.#lockFilePathLoaded = false;\n    }\n\n    protected get rootWorkspacePackage(): string {\n        return '';\n    }\n\n    abstract clearCache(): void;\n    abstract getDeclaredVersion(query: DeclaredVersionQuery): string | undefined;\n    abstract getResolvedVersion(query: ResolvedVersionQuery): string | undefined;\n    abstract installPackages(args?: InstallArgs, options?: Parameters<typeof runCommand>[2]): void;\n\n    protected abstract parseLockFile(): LockFile | undefined;\n}\n"],"names":["PackageManager","hasValidLockFile","getLockFile","undefined","getLockFilePath","findUp","directory","candidate","path","join","lockFileName","fs","existsSync","getWorkspacePackage","packageDir","process","cwd","lockFilePath","rootWorkspacePackage","relative","dirname","resolve","split","sep","parseLockFile","reset"],"mappings":";;;;+BAuBsBA;;;eAAAA;;;2DAvBP;iEACE;uBACkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAyB/B,yCACA,+CACA,6CACA;AAPG,MAAeA;IASlBC,mBAA4B;QACxB,OAAO,IAAI,CAACC,WAAW,OAAOC;IAClC;IAEAC,kBAAsC;QAClC,IAAI,0BAAC,IAAI,EAAC,sBAAqB;2CACtB,eAAgBC,IAAAA,aAAM,EAACC,CAAAA;gBACxB,MAAMC,YAAYC,iBAAI,CAACC,IAAI,CAACH,WAAW,IAAI,CAACI,YAAY;gBACxD,OAAOC,WAAE,CAACC,UAAU,CAACL,aAAaA,YAAYJ;YAClD;2CACK,qBAAsB;QAC/B;QACA,gCAAO,IAAI,EAAC;IAChB;IAEA;;;;KAIC,GACDU,oBAAoBC,aAAaC,QAAQC,GAAG,EAAE,EAAU;QACpD,MAAMC,eAAe,IAAI,CAACb,eAAe;QACzC,IAAI,CAACa,cAAc;YACf,OAAO,IAAI,CAACC,oBAAoB;QACpC;QACA,MAAMC,WAAWX,iBAAI,CAChBW,QAAQ,CAACX,iBAAI,CAACY,OAAO,CAACH,eAAeT,iBAAI,CAACa,OAAO,CAACP,aAClDQ,KAAK,CAACd,iBAAI,CAACe,GAAG,EACdd,IAAI,CAAC;QACV,OAAOU,aAAa,KAAK,IAAI,CAACD,oBAAoB,GAAGC;IACzD;IAEUjB,cAAoC;QAC1C,IAAI,0BAAC,IAAI,EAAC,kBAAiB;2CAClB,WAAY,IAAI,CAACsB,aAAa;2CAC9B,iBAAkB;QAC3B;QACA,gCAAO,IAAI,EAAC;IAChB;IAEUC,QAAQ;uCACT,WAAYtB;uCACZ,iBAAkB;uCAClB,eAAgBA;uCAChB,qBAAsB;IAC/B;IAEA,IAAce,uBAA+B;QACzC,OAAO;IACX;;QAtDA,gCAAA;;mBAAA,KAAA;;QACA,gCAAA;;mBAAkB;;QAClB,gCAAA;;mBAAA,KAAA;;QACA,gCAAA;;mBAAsB;;;AA2D1B"}

package/dist/package-manager/pnpm-package-manager.js

@@ -19,9 +19,7 @@ function _define_property(obj, key, value) {
             configurable: true,
             writable: true
         });
-    } else {
-        obj[key] = value;
-    }
+    } else obj[key] = value;
     return obj;
 }
 function _interop_require_default(obj) {

package/dist/package-manager/pnpm-package-manager.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/package-manager/pnpm-package-manager.ts"],"sourcesContent":["import fs from 'fs';\nimport { isCI, runCommand } from '../utils';\nimport type { DeclaredVersionQuery, InstallArgs, ResolvedVersionQuery } from './package-manager';\nimport { PackageManager } from './package-manager';\n\ninterface PnpmImporterEntry {\n    specifier: string;\n    version: string;\n}\n\ninterface PnpmImporter {\n    dependencies?: Record<string, PnpmImporterEntry>;\n    devDependencies?: Record<string, PnpmImporterEntry>;\n    optionalDependencies?: Record<string, PnpmImporterEntry>;\n}\n\ninterface PnpmSnapshot {\n    dependencies?: Record<string, string>;\n    peerDependencies?: Record<string, string>;\n}\n\nexport interface PnpmLockFile {\n    importers?: Record<string, PnpmImporter>;\n    snapshots?: Record<string, PnpmSnapshot>;\n}\n\nexport class PnpmPackageManager extends PackageManager<PnpmLockFile> {\n    readonly command = 'pnpm';\n    readonly lockFileName = 'pnpm-lock.yaml';\n\n    protected override get rootWorkspacePackage(): string {\n        return '.';\n    }\n\n    clearCache() {\n        runCommand(this.command, ['store', 'prune']);\n    }\n\n    getDeclaredVersion({\n        workspacePackage,\n        declaredBy,\n        dependency,\n    }: DeclaredVersionQuery): string | undefined {\n        const declaredByVersion = this.resolveVersion(workspacePackage, declaredBy);\n        if (!declaredByVersion) {\n            return undefined;\n        }\n        const snapshot = this.getLockFile()?.snapshots?.[`${declaredBy}@${declaredByVersion}`];\n        return snapshot?.dependencies?.[dependency] ?? snapshot?.peerDependencies?.[dependency];\n    }\n\n    getResolvedVersion({ workspacePackage, dependency }: ResolvedVersionQuery): string | undefined {\n        return this.resolveVersion(workspacePackage, dependency);\n    }\n\n    installPackages(args: InstallArgs = {}, options?: Parameters<typeof runCommand>[2]) {\n        try {\n            runCommand(\n                this.command,\n                [\n                    'install',\n                    ...(isCI() ? ['--frozen-lockfile'] : []),\n                    ...(args.fix ? ['--lockfile-only'] : []),\n                ],\n                options\n            );\n        } finally {\n            this.reset();\n        }\n    }\n\n    protected parseLockFile(): PnpmLockFile | undefined {\n        const lockFilePath = this.getLockFilePath();\n        if (!lockFilePath) {\n            return undefined;\n        }\n        /*\n         * js-yaml is an optional peer; let MODULE_NOT_FOUND surface so a caller\n         * missing the dep gets a clear error instead of silent `undefined`.\n         */\n        const yaml = require('js-yaml');\n        try {\n            return yaml.load(fs.readFileSync(lockFilePath, 'utf-8'));\n        } catch {\n            return undefined;\n        }\n    }\n\n    private resolveVersion(workspacePackage: string, dependency: string): string | undefined {\n        const importer = this.getLockFile()?.importers?.[workspacePackage];\n        const entry =\n            importer?.dependencies?.[dependency] ??\n            importer?.devDependencies?.[dependency] ??\n            importer?.optionalDependencies?.[dependency];\n        return entry ? stripPeerDependencySuffix(entry.version) : undefined;\n    }\n}\n\nfunction stripPeerDependencySuffix(version: string): string {\n    // e.g., \"1.2.3(react@18.2.0)(react-dom@18.2.0)\" → \"1.2.3\"\n    return version.split('(')[0];\n}\n"],"names":["PnpmPackageManager","PackageManager","rootWorkspacePackage","clearCache","runCommand","command","getDeclaredVersion","workspacePackage","declaredBy","dependency","snapshot","declaredByVersion","resolveVersion","undefined","getLockFile","snapshots","dependencies","peerDependencies","getResolvedVersion","installPackages","args","options","isCI","fix","reset","parseLockFile","lockFilePath","getLockFilePath","yaml","require","load","fs","readFileSync","importer","importers","entry","devDependencies","optionalDependencies","stripPeerDependencySuffix","version","lockFileName","split"],"mappings":";;;;+BA0BaA;;;eAAAA;;;2DA1BE;uBACkB;gCAEF;;;;;;;;;;;;;;;;;;;AAuBxB,MAAMA,2BAA2BC,8BAAc;IAIlD,IAAuBC,uBAA+B;QAClD,OAAO;IACX;IAEAC,aAAa;QACTC,IAAAA,iBAAU,EAAC,IAAI,CAACC,OAAO,EAAE;YAAC;YAAS;SAAQ;IAC/C;IAEAC,mBAAmB,EACfC,gBAAgB,EAChBC,UAAU,EACVC,UAAU,EACS,EAAsB;;YAKxB,6BAAA,mBACVC,wBAAwCA;QAL/C,MAAMC,oBAAoB,IAAI,CAACC,cAAc,CAACL,kBAAkBC;QAChE,IAAI,CAACG,mBAAmB;YACpB,OAAOE;QACX;QACA,MAAMH,YAAW,oBAAA,IAAI,CAACI,WAAW,gBAAhB,yCAAA,8BAAA,kBAAoBC,SAAS,cAA7B,kDAAA,2BAA+B,CAAC,GAAGP,WAAW,CAAC,EAAEG,mBAAmB,CAAC;QACtF,eAAOD,qBAAAA,gCAAAA,yBAAAA,SAAUM,YAAY,cAAtBN,6CAAAA,sBAAwB,CAACD,WAAW,uCAAIC,qBAAAA,gCAAAA,6BAAAA,SAAUO,gBAAgB,cAA1BP,iDAAAA,0BAA4B,CAACD,WAAW;IAC3F;IAEAS,mBAAmB,EAAEX,gBAAgB,EAAEE,UAAU,EAAwB,EAAsB;QAC3F,OAAO,IAAI,CAACG,cAAc,CAACL,kBAAkBE;IACjD;IAEAU,gBAAgBC,OAAoB,CAAC,CAAC,EAAEC,OAA0C,EAAE;QAChF,IAAI;YACAjB,IAAAA,iBAAU,EACN,IAAI,CAACC,OAAO,EACZ;gBACI;mBACIiB,IAAAA,WAAI,MAAK;oBAAC;iBAAoB,GAAG,EAAE;mBACnCF,KAAKG,GAAG,GAAG;oBAAC;iBAAkB,GAAG,EAAE;aAC1C,EACDF;QAER,SAAU;YACN,IAAI,CAACG,KAAK;QACd;IACJ;IAEUC,gBAA0C;QAChD,MAAMC,eAAe,IAAI,CAACC,eAAe;QACzC,IAAI,CAACD,cAAc;YACf,OAAOb;QACX;QACA;;;SAGC,GACD,MAAMe,OAAOC,QAAQ;QACrB,IAAI;YACA,OAAOD,KAAKE,IAAI,CAACC,WAAE,CAACC,YAAY,CAACN,cAAc;QACnD,EAAE,eAAM;YACJ,OAAOb;QACX;IACJ;IAEQD,eAAeL,gBAAwB,EAAEE,UAAkB,EAAsB;YAGjFwB;YAFa,6BAAA,mBAEbA,wBACAA,2BACAA;QAJJ,MAAMA,YAAW,oBAAA,IAAI,CAACnB,WAAW,gBAAhB,yCAAA,8BAAA,kBAAoBoB,SAAS,cAA7B,kDAAA,2BAA+B,CAAC3B,iBAAiB;QAClE,MAAM4B,SACFF,gBAAAA,qBAAAA,gCAAAA,yBAAAA,SAAUjB,YAAY,cAAtBiB,6CAAAA,sBAAwB,CAACxB,WAAW,yCACpCwB,qBAAAA,gCAAAA,4BAAAA,SAAUG,eAAe,cAAzBH,gDAAAA,yBAA2B,CAACxB,WAAW,cADvCwB,kBAAAA,OAEAA,qBAAAA,gCAAAA,iCAAAA,SAAUI,oBAAoB,cAA9BJ,qDAAAA,8BAAgC,CAACxB,WAAW;QAChD,OAAO0B,QAAQG,0BAA0BH,MAAMI,OAAO,IAAI1B;IAC9D;;QArEG,gBACH,uBAASR,WAAU,SACnB,uBAASmC,gBAAe;;AAoE5B;AAEA,SAASF,0BAA0BC,OAAe;IAC9C,0DAA0D;IAC1D,OAAOA,QAAQE,KAAK,CAAC,IAAI,CAAC,EAAE;AAChC"}
+{"version":3,"sources":["../../src/package-manager/pnpm-package-manager.ts"],"sourcesContent":["import fs from 'fs';\nimport { isCI, runCommand } from '../utils';\nimport type { DeclaredVersionQuery, InstallArgs, ResolvedVersionQuery } from './package-manager';\nimport { PackageManager } from './package-manager';\n\ninterface PnpmImporterEntry {\n    specifier: string;\n    version: string;\n}\n\ninterface PnpmImporter {\n    dependencies?: Record<string, PnpmImporterEntry>;\n    devDependencies?: Record<string, PnpmImporterEntry>;\n    optionalDependencies?: Record<string, PnpmImporterEntry>;\n}\n\ninterface PnpmSnapshot {\n    dependencies?: Record<string, string>;\n    peerDependencies?: Record<string, string>;\n}\n\nexport interface PnpmLockFile {\n    importers?: Record<string, PnpmImporter>;\n    snapshots?: Record<string, PnpmSnapshot>;\n}\n\nexport class PnpmPackageManager extends PackageManager<PnpmLockFile> {\n    readonly command = 'pnpm';\n    readonly lockFileName = 'pnpm-lock.yaml';\n\n    protected override get rootWorkspacePackage(): string {\n        return '.';\n    }\n\n    clearCache() {\n        runCommand(this.command, ['store', 'prune']);\n    }\n\n    getDeclaredVersion({\n        workspacePackage,\n        declaredBy,\n        dependency,\n    }: DeclaredVersionQuery): string | undefined {\n        const declaredByVersion = this.resolveVersion(workspacePackage, declaredBy);\n        if (!declaredByVersion) {\n            return undefined;\n        }\n        const snapshot = this.getLockFile()?.snapshots?.[`${declaredBy}@${declaredByVersion}`];\n        return snapshot?.dependencies?.[dependency] ?? snapshot?.peerDependencies?.[dependency];\n    }\n\n    getResolvedVersion({ workspacePackage, dependency }: ResolvedVersionQuery): string | undefined {\n        return this.resolveVersion(workspacePackage, dependency);\n    }\n\n    installPackages(args: InstallArgs = {}, options?: Parameters<typeof runCommand>[2]) {\n        try {\n            runCommand(\n                this.command,\n                [\n                    'install',\n                    ...(isCI() ? ['--frozen-lockfile'] : []),\n                    ...(args.fix ? ['--lockfile-only'] : []),\n                ],\n                options\n            );\n        } finally {\n            this.reset();\n        }\n    }\n\n    protected parseLockFile(): PnpmLockFile | undefined {\n        const lockFilePath = this.getLockFilePath();\n        if (!lockFilePath) {\n            return undefined;\n        }\n        /*\n         * js-yaml is an optional peer; let MODULE_NOT_FOUND surface so a caller\n         * missing the dep gets a clear error instead of silent `undefined`.\n         */\n        const yaml = require('js-yaml');\n        try {\n            return yaml.load(fs.readFileSync(lockFilePath, 'utf-8'));\n        } catch {\n            return undefined;\n        }\n    }\n\n    private resolveVersion(workspacePackage: string, dependency: string): string | undefined {\n        const importer = this.getLockFile()?.importers?.[workspacePackage];\n        const entry =\n            importer?.dependencies?.[dependency] ??\n            importer?.devDependencies?.[dependency] ??\n            importer?.optionalDependencies?.[dependency];\n        return entry ? stripPeerDependencySuffix(entry.version) : undefined;\n    }\n}\n\nfunction stripPeerDependencySuffix(version: string): string {\n    // e.g., \"1.2.3(react@18.2.0)(react-dom@18.2.0)\" → \"1.2.3\"\n    return version.split('(')[0];\n}\n"],"names":["PnpmPackageManager","PackageManager","rootWorkspacePackage","clearCache","runCommand","command","getDeclaredVersion","workspacePackage","declaredBy","dependency","snapshot","declaredByVersion","resolveVersion","undefined","getLockFile","snapshots","dependencies","peerDependencies","getResolvedVersion","installPackages","args","options","isCI","fix","reset","parseLockFile","lockFilePath","getLockFilePath","yaml","require","load","fs","readFileSync","importer","importers","entry","devDependencies","optionalDependencies","stripPeerDependencySuffix","version","lockFileName","split"],"mappings":";;;;+BA0BaA;;;eAAAA;;;2DA1BE;uBACkB;gCAEF;;;;;;;;;;;;;;;;;AAuBxB,MAAMA,2BAA2BC,8BAAc;IAIlD,IAAuBC,uBAA+B;QAClD,OAAO;IACX;IAEAC,aAAa;QACTC,IAAAA,iBAAU,EAAC,IAAI,CAACC,OAAO,EAAE;YAAC;YAAS;SAAQ;IAC/C;IAEAC,mBAAmB,EACfC,gBAAgB,EAChBC,UAAU,EACVC,UAAU,EACS,EAAsB;;YAKxB,6BAAA,mBACVC,wBAAwCA;QAL/C,MAAMC,oBAAoB,IAAI,CAACC,cAAc,CAACL,kBAAkBC;QAChE,IAAI,CAACG,mBAAmB;YACpB,OAAOE;QACX;QACA,MAAMH,YAAW,oBAAA,IAAI,CAACI,WAAW,gBAAhB,yCAAA,8BAAA,kBAAoBC,SAAS,cAA7B,kDAAA,2BAA+B,CAAC,GAAGP,WAAW,CAAC,EAAEG,mBAAmB,CAAC;QACtF,eAAOD,qBAAAA,gCAAAA,yBAAAA,SAAUM,YAAY,cAAtBN,6CAAAA,sBAAwB,CAACD,WAAW,uCAAIC,qBAAAA,gCAAAA,6BAAAA,SAAUO,gBAAgB,cAA1BP,iDAAAA,0BAA4B,CAACD,WAAW;IAC3F;IAEAS,mBAAmB,EAAEX,gBAAgB,EAAEE,UAAU,EAAwB,EAAsB;QAC3F,OAAO,IAAI,CAACG,cAAc,CAACL,kBAAkBE;IACjD;IAEAU,gBAAgBC,OAAoB,CAAC,CAAC,EAAEC,OAA0C,EAAE;QAChF,IAAI;YACAjB,IAAAA,iBAAU,EACN,IAAI,CAACC,OAAO,EACZ;gBACI;mBACIiB,IAAAA,WAAI,MAAK;oBAAC;iBAAoB,GAAG,EAAE;mBACnCF,KAAKG,GAAG,GAAG;oBAAC;iBAAkB,GAAG,EAAE;aAC1C,EACDF;QAER,SAAU;YACN,IAAI,CAACG,KAAK;QACd;IACJ;IAEUC,gBAA0C;QAChD,MAAMC,eAAe,IAAI,CAACC,eAAe;QACzC,IAAI,CAACD,cAAc;YACf,OAAOb;QACX;QACA;;;SAGC,GACD,MAAMe,OAAOC,QAAQ;QACrB,IAAI;YACA,OAAOD,KAAKE,IAAI,CAACC,WAAE,CAACC,YAAY,CAACN,cAAc;QACnD,EAAE,eAAM;YACJ,OAAOb;QACX;IACJ;IAEQD,eAAeL,gBAAwB,EAAEE,UAAkB,EAAsB;YAGjFwB;YAFa,6BAAA,mBAEbA,wBACAA,2BACAA;QAJJ,MAAMA,YAAW,oBAAA,IAAI,CAACnB,WAAW,gBAAhB,yCAAA,8BAAA,kBAAoBoB,SAAS,cAA7B,kDAAA,2BAA+B,CAAC3B,iBAAiB;QAClE,MAAM4B,SACFF,gBAAAA,qBAAAA,gCAAAA,yBAAAA,SAAUjB,YAAY,cAAtBiB,6CAAAA,sBAAwB,CAACxB,WAAW,yCACpCwB,qBAAAA,gCAAAA,4BAAAA,SAAUG,eAAe,cAAzBH,gDAAAA,yBAA2B,CAACxB,WAAW,cADvCwB,kBAAAA,OAEAA,qBAAAA,gCAAAA,iCAAAA,SAAUI,oBAAoB,cAA9BJ,qDAAAA,8BAAgC,CAACxB,WAAW;QAChD,OAAO0B,QAAQG,0BAA0BH,MAAMI,OAAO,IAAI1B;IAC9D;;QArEG,gBACH,uBAASR,WAAU,SACnB,uBAASmC,gBAAe;;AAoE5B;AAEA,SAASF,0BAA0BC,OAAe;IAC9C,0DAA0D;IAC1D,OAAOA,QAAQE,KAAK,CAAC,IAAI,CAAC,EAAE;AAChC"}

package/dist/package-manager/utils/index.d.ts

@@ -1,5 +1,5 @@
 export * from './log-allowed-scripts';
 export * from './parse-allow-scripts';
 export * from './resolve-allow-scripts';
-export * from './should-ignore-scripts';
+export * from './uses-startup';
 //# sourceMappingURL=index.d.ts.map

package/dist/package-manager/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/package-manager/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/package-manager/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,gBAAgB,CAAC"}

package/dist/package-manager/utils/index.js

@@ -5,7 +5,7 @@ Object.defineProperty(exports, "__esModule", {
 _export_star(require("./log-allowed-scripts"), exports);
 _export_star(require("./parse-allow-scripts"), exports);
 _export_star(require("./resolve-allow-scripts"), exports);
-_export_star(require("./should-ignore-scripts"), exports);
+_export_star(require("./uses-startup"), exports);
 function _export_star(from, to) {
     Object.keys(from).forEach(function(k) {
         if (k !== "default" && !Object.prototype.hasOwnProperty.call(to, k)) {

package/dist/package-manager/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/package-manager/utils/index.ts"],"sourcesContent":["export * from './log-allowed-scripts';\nexport * from './parse-allow-scripts';\nexport * from './resolve-allow-scripts';\nexport * from './should-ignore-scripts';\n"],"names":[],"mappings":";;;;qBAAc;qBACA;qBACA;qBACA"}
+{"version":3,"sources":["../../../src/package-manager/utils/index.ts"],"sourcesContent":["export * from './log-allowed-scripts';\nexport * from './parse-allow-scripts';\nexport * from './resolve-allow-scripts';\nexport * from './uses-startup';\n"],"names":[],"mappings":";;;;qBAAc;qBACA;qBACA;qBACA"}

package/dist/package-manager/utils/log-allowed-scripts.d.ts

@@ -1,3 +1,3 @@
 import type { AllowScripts } from '../package-manager';
-export declare function logAllowedScripts(allowScripts: AllowScripts): void;
+export declare function logAllowedScripts(allowScripts: AllowScripts, builtInAllowlist: string[]): void;
 //# sourceMappingURL=log-allowed-scripts.d.ts.map

package/dist/package-manager/utils/log-allowed-scripts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"log-allowed-scripts.d.ts","sourceRoot":"","sources":["../../../src/package-manager/utils/log-allowed-scripts.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,YAAY,QAY3D"}
+{"version":3,"file":"log-allowed-scripts.d.ts","sourceRoot":"","sources":["../../../src/package-manager/utils/log-allowed-scripts.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAgBvF"}

package/dist/package-manager/utils/log-allowed-scripts.js

@@ -8,8 +8,7 @@ Object.defineProperty(exports, "logAllowedScripts", {
         return logAllowedScripts;
     }
 });
-const _resolveallowscripts = require("./resolve-allow-scripts");
-function logAllowedScripts(allowScripts) {
+function logAllowedScripts(allowScripts, builtInAllowlist) {
     if (allowScripts === true) {
         console.log('Allowing all install scripts');
         return;
@@ -17,10 +16,12 @@ function logAllowedScripts(allowScripts) {
     if (allowScripts === false) {
         return;
     }
-    const extras = allowScripts.filter((s)=>!_resolveallowscripts.DEFAULT_ALLOWED_SCRIPTS.includes(s));
-    if (extras.length) {
-        console.log(`Allowing additional install scripts: ${extras.join(', ')}`);
+    const extras = allowScripts.filter((s)=>!builtInAllowlist.includes(s));
+    if (!extras.length) {
+        return;
     }
+    const label = builtInAllowlist.length ? 'Allowing additional install scripts' : 'Allowing install scripts';
+    console.log(`${label}: ${extras.join(', ')}`);
 }
 
 //# sourceMappingURL=log-allowed-scripts.js.map

package/dist/package-manager/utils/log-allowed-scripts.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/package-manager/utils/log-allowed-scripts.ts"],"sourcesContent":["/* eslint-disable no-console */\nimport type { AllowScripts } from '../package-manager';\nimport { DEFAULT_ALLOWED_SCRIPTS } from './resolve-allow-scripts';\n\nexport function logAllowedScripts(allowScripts: AllowScripts) {\n    if (allowScripts === true) {\n        console.log('Allowing all install scripts');\n        return;\n    }\n    if (allowScripts === false) {\n        return;\n    }\n    const extras = allowScripts.filter(s => !DEFAULT_ALLOWED_SCRIPTS.includes(s));\n    if (extras.length) {\n        console.log(`Allowing additional install scripts: ${extras.join(', ')}`);\n    }\n}\n"],"names":["logAllowedScripts","allowScripts","console","log","extras","filter","s","DEFAULT_ALLOWED_SCRIPTS","includes","length","join"],"mappings":"AAAA,6BAA6B;;;;+BAIbA;;;eAAAA;;;qCAFwB;AAEjC,SAASA,kBAAkBC,YAA0B;IACxD,IAAIA,iBAAiB,MAAM;QACvBC,QAAQC,GAAG,CAAC;QACZ;IACJ;IACA,IAAIF,iBAAiB,OAAO;QACxB;IACJ;IACA,MAAMG,SAASH,aAAaI,MAAM,CAACC,CAAAA,IAAK,CAACC,4CAAuB,CAACC,QAAQ,CAACF;IAC1E,IAAIF,OAAOK,MAAM,EAAE;QACfP,QAAQC,GAAG,CAAC,CAAC,qCAAqC,EAAEC,OAAOM,IAAI,CAAC,OAAO;IAC3E;AACJ"}
+{"version":3,"sources":["../../../src/package-manager/utils/log-allowed-scripts.ts"],"sourcesContent":["/* eslint-disable no-console */\nimport type { AllowScripts } from '../package-manager';\n\nexport function logAllowedScripts(allowScripts: AllowScripts, builtInAllowlist: string[]) {\n    if (allowScripts === true) {\n        console.log('Allowing all install scripts');\n        return;\n    }\n    if (allowScripts === false) {\n        return;\n    }\n    const extras = allowScripts.filter(s => !builtInAllowlist.includes(s));\n    if (!extras.length) {\n        return;\n    }\n    const label = builtInAllowlist.length\n        ? 'Allowing additional install scripts'\n        : 'Allowing install scripts';\n    console.log(`${label}: ${extras.join(', ')}`);\n}\n"],"names":["logAllowedScripts","allowScripts","builtInAllowlist","console","log","extras","filter","s","includes","length","label","join"],"mappings":"AAAA,6BAA6B;;;;+BAGbA;;;eAAAA;;;AAAT,SAASA,kBAAkBC,YAA0B,EAAEC,gBAA0B;IACpF,IAAID,iBAAiB,MAAM;QACvBE,QAAQC,GAAG,CAAC;QACZ;IACJ;IACA,IAAIH,iBAAiB,OAAO;QACxB;IACJ;IACA,MAAMI,SAASJ,aAAaK,MAAM,CAACC,CAAAA,IAAK,CAACL,iBAAiBM,QAAQ,CAACD;IACnE,IAAI,CAACF,OAAOI,MAAM,EAAE;QAChB;IACJ;IACA,MAAMC,QAAQR,iBAAiBO,MAAM,GAC/B,wCACA;IACNN,QAAQC,GAAG,CAAC,GAAGM,MAAM,EAAE,EAAEL,OAAOM,IAAI,CAAC,OAAO;AAChD"}

package/dist/package-manager/utils/resolve-allow-scripts.d.ts

@@ -1,4 +1,4 @@
 import type { AllowScripts } from '../package-manager';
 export declare const DEFAULT_ALLOWED_SCRIPTS: string[];
-export declare function resolveAllowScripts(value: AllowScripts): AllowScripts;
+export declare function resolveAllowScripts(value: AllowScripts, builtInAllowlist: string[]): AllowScripts;
 //# sourceMappingURL=resolve-allow-scripts.d.ts.map

package/dist/package-manager/utils/resolve-allow-scripts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-allow-scripts.d.ts","sourceRoot":"","sources":["../../../src/package-manager/utils/resolve-allow-scripts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,eAAO,MAAM,uBAAuB,UAMnC,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,GAAG,YAAY,CAKrE"}
+{"version":3,"file":"resolve-allow-scripts.d.ts","sourceRoot":"","sources":["../../../src/package-manager/utils/resolve-allow-scripts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,eAAO,MAAM,uBAAuB,UAMnC,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,YAAY,CAKjG"}

package/dist/package-manager/utils/resolve-allow-scripts.js

@@ -24,12 +24,12 @@ const DEFAULT_ALLOWED_SCRIPTS = [
     'nx',
     'tree-sitter'
 ];
-function resolveAllowScripts(value) {
+function resolveAllowScripts(value, builtInAllowlist) {
     if (value === true || value === false) {
         return value;
     }
     return [
-        ...DEFAULT_ALLOWED_SCRIPTS,
+        ...builtInAllowlist,
         ...(0, _parseallowscripts.parseAllowScripts)(value)
     ];
 }

package/dist/package-manager/utils/resolve-allow-scripts.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/package-manager/utils/resolve-allow-scripts.ts"],"sourcesContent":["import type { AllowScripts } from '../package-manager';\nimport { parseAllowScripts } from './parse-allow-scripts';\n\nexport const DEFAULT_ALLOWED_SCRIPTS = [\n    '@servicetitan/startup',\n    'cypress',\n    'msw',\n    'nx',\n    'tree-sitter',\n];\n\nexport function resolveAllowScripts(value: AllowScripts): AllowScripts {\n    if (value === true || value === false) {\n        return value;\n    }\n    return [...DEFAULT_ALLOWED_SCRIPTS, ...parseAllowScripts(value)];\n}\n"],"names":["DEFAULT_ALLOWED_SCRIPTS","resolveAllowScripts","value","parseAllowScripts"],"mappings":";;;;;;;;;;;QAGaA;eAAAA;;QAQGC;eAAAA;;;mCAVkB;AAE3B,MAAMD,0BAA0B;IACnC;IACA;IACA;IACA;IACA;CACH;AAEM,SAASC,oBAAoBC,KAAmB;IACnD,IAAIA,UAAU,QAAQA,UAAU,OAAO;QACnC,OAAOA;IACX;IACA,OAAO;WAAIF;WAA4BG,IAAAA,oCAAiB,EAACD;KAAO;AACpE"}
+{"version":3,"sources":["../../../src/package-manager/utils/resolve-allow-scripts.ts"],"sourcesContent":["import type { AllowScripts } from '../package-manager';\nimport { parseAllowScripts } from './parse-allow-scripts';\n\nexport const DEFAULT_ALLOWED_SCRIPTS = [\n    '@servicetitan/startup',\n    'cypress',\n    'msw',\n    'nx',\n    'tree-sitter',\n];\n\nexport function resolveAllowScripts(value: AllowScripts, builtInAllowlist: string[]): AllowScripts {\n    if (value === true || value === false) {\n        return value;\n    }\n    return [...builtInAllowlist, ...parseAllowScripts(value)];\n}\n"],"names":["DEFAULT_ALLOWED_SCRIPTS","resolveAllowScripts","value","builtInAllowlist","parseAllowScripts"],"mappings":";;;;;;;;;;;QAGaA;eAAAA;;QAQGC;eAAAA;;;mCAVkB;AAE3B,MAAMD,0BAA0B;IACnC;IACA;IACA;IACA;IACA;CACH;AAEM,SAASC,oBAAoBC,KAAmB,EAAEC,gBAA0B;IAC/E,IAAID,UAAU,QAAQA,UAAU,OAAO;QACnC,OAAOA;IACX;IACA,OAAO;WAAIC;WAAqBC,IAAAA,oCAAiB,EAACF;KAAO;AAC7D"}

package/dist/package-manager/utils/uses-startup.d.ts

@@ -0,0 +1,2 @@
+export declare function usesStartup(): boolean;
+//# sourceMappingURL=uses-startup.d.ts.map

package/dist/package-manager/utils/uses-startup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"uses-startup.d.ts","sourceRoot":"","sources":["../../../src/package-manager/utils/uses-startup.ts"],"names":[],"mappings":"AAIA,wBAAgB,WAAW,IAAI,OAAO,CAOrC"}

package/dist/package-manager/utils/uses-startup.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "usesStartup", {
+    enumerable: true,
+    get: function() {
+        return usesStartup;
+    }
+});
+const _utils = require("../../utils");
+const STARTUP_PACKAGE = '@servicetitan/startup';
+function usesStartup() {
+    var _ref, _ref1;
+    var _packageJson_dependencies, _packageJson_devDependencies, _packageJson_peerDependencies;
+    const packageJson = (0, _utils.getWorkspaceRootPackageJson)();
+    return !!((_ref = (_ref1 = packageJson === null || packageJson === void 0 ? void 0 : (_packageJson_dependencies = packageJson.dependencies) === null || _packageJson_dependencies === void 0 ? void 0 : _packageJson_dependencies[STARTUP_PACKAGE]) !== null && _ref1 !== void 0 ? _ref1 : packageJson === null || packageJson === void 0 ? void 0 : (_packageJson_devDependencies = packageJson.devDependencies) === null || _packageJson_devDependencies === void 0 ? void 0 : _packageJson_devDependencies[STARTUP_PACKAGE]) !== null && _ref !== void 0 ? _ref : packageJson === null || packageJson === void 0 ? void 0 : (_packageJson_peerDependencies = packageJson.peerDependencies) === null || _packageJson_peerDependencies === void 0 ? void 0 : _packageJson_peerDependencies[STARTUP_PACKAGE]);
+}
+
+//# sourceMappingURL=uses-startup.js.map

package/dist/package-manager/utils/uses-startup.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/package-manager/utils/uses-startup.ts"],"sourcesContent":["import { getWorkspaceRootPackageJson } from '../../utils';\n\nconst STARTUP_PACKAGE = '@servicetitan/startup';\n\nexport function usesStartup(): boolean {\n    const packageJson = getWorkspaceRootPackageJson();\n    return !!(\n        packageJson?.dependencies?.[STARTUP_PACKAGE] ??\n        packageJson?.devDependencies?.[STARTUP_PACKAGE] ??\n        packageJson?.peerDependencies?.[STARTUP_PACKAGE]\n    );\n}\n"],"names":["usesStartup","STARTUP_PACKAGE","packageJson","getWorkspaceRootPackageJson","dependencies","devDependencies","peerDependencies"],"mappings":";;;;+BAIgBA;;;eAAAA;;;uBAJ4B;AAE5C,MAAMC,kBAAkB;AAEjB,SAASD;QAGRE;QAAAA,2BACAA,8BACAA;IAJJ,MAAMA,cAAcC,IAAAA,kCAA2B;IAC/C,OAAO,CAAC,GACJD,gBAAAA,wBAAAA,mCAAAA,4BAAAA,YAAaE,YAAY,cAAzBF,gDAAAA,yBAA2B,CAACD,gBAAgB,yCAC5CC,wBAAAA,mCAAAA,+BAAAA,YAAaG,eAAe,cAA5BH,mDAAAA,4BAA8B,CAACD,gBAAgB,cAD/CC,kBAAAA,OAEAA,wBAAAA,mCAAAA,gCAAAA,YAAaI,gBAAgB,cAA7BJ,oDAAAA,6BAA+B,CAACD,gBAAgB;AAExD"}

package/dist/utils/find-workspace-root.d.ts

@@ -0,0 +1,2 @@
+export declare function findWorkspaceRoot(): string | undefined;
+//# sourceMappingURL=find-workspace-root.d.ts.map

package/dist/utils/find-workspace-root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-workspace-root.d.ts","sourceRoot":"","sources":["../../src/utils/find-workspace-root.ts"],"names":[],"mappings":"AAKA,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,SAAS,CActD"}

package/dist/utils/find-workspace-root.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "findWorkspaceRoot", {
+    enumerable: true,
+    get: function() {
+        return findWorkspaceRoot;
+    }
+});
+const _nodefs = /*#__PURE__*/ _interop_require_default(require("node:fs"));
+const _nodepath = /*#__PURE__*/ _interop_require_default(require("node:path"));
+const _findup = require("./find-up");
+const _readjson = require("./read-json");
+function _interop_require_default(obj) {
+    return obj && obj.__esModule ? obj : {
+        default: obj
+    };
+}
+function findWorkspaceRoot() {
+    return (0, _findup.findUp)((directory)=>{
+        var _readJsonSafe, _readJsonSafe1;
+        if ((_readJsonSafe = (0, _readjson.readJsonSafe)(_nodepath.default.join(directory, 'package.json'))) === null || _readJsonSafe === void 0 ? void 0 : _readJsonSafe.workspaces) {
+            return directory;
+        }
+        if (_nodefs.default.existsSync(_nodepath.default.join(directory, 'pnpm-workspace.yaml'))) {
+            return directory;
+        }
+        if ((_readJsonSafe1 = (0, _readjson.readJsonSafe)(_nodepath.default.join(directory, 'lerna.json'))) === null || _readJsonSafe1 === void 0 ? void 0 : _readJsonSafe1.packages) {
+            return directory;
+        }
+    });
+}
+
+//# sourceMappingURL=find-workspace-root.js.map

package/dist/utils/find-workspace-root.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utils/find-workspace-root.ts"],"sourcesContent":["import fs from 'node:fs';\nimport path from 'node:path';\nimport { findUp } from './find-up';\nimport { readJsonSafe } from './read-json';\n\nexport function findWorkspaceRoot(): string | undefined {\n    return findUp(directory => {\n        if (\n            readJsonSafe<{ workspaces?: unknown }>(path.join(directory, 'package.json'))?.workspaces\n        ) {\n            return directory;\n        }\n        if (fs.existsSync(path.join(directory, 'pnpm-workspace.yaml'))) {\n            return directory;\n        }\n        if (readJsonSafe<{ packages?: unknown }>(path.join(directory, 'lerna.json'))?.packages) {\n            return directory;\n        }\n    });\n}\n"],"names":["findWorkspaceRoot","findUp","directory","readJsonSafe","path","join","workspaces","fs","existsSync","packages"],"mappings":";;;;+BAKgBA;;;eAAAA;;;+DALD;iEACE;wBACM;0BACM;;;;;;AAEtB,SAASA;IACZ,OAAOC,IAAAA,cAAM,EAACC,CAAAA;YAENC,eAOAA;QARJ,KACIA,gBAAAA,IAAAA,sBAAY,EAA2BC,iBAAI,CAACC,IAAI,CAACH,WAAW,8BAA5DC,oCAAAA,cAA8EG,UAAU,EAC1F;YACE,OAAOJ;QACX;QACA,IAAIK,eAAE,CAACC,UAAU,CAACJ,iBAAI,CAACC,IAAI,CAACH,WAAW,yBAAyB;YAC5D,OAAOA;QACX;QACA,KAAIC,iBAAAA,IAAAA,sBAAY,EAAyBC,iBAAI,CAACC,IAAI,CAACH,WAAW,4BAA1DC,qCAAAA,eAA0EM,QAAQ,EAAE;YACpF,OAAOP;QACX;IACJ;AACJ"}

package/dist/utils/get-workspace-root-package-json.d.ts

@@ -0,0 +1,10 @@
+export interface PackageJson {
+    cli?: {
+        packageManager?: string;
+    };
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+    peerDependencies?: Record<string, string>;
+}
+export declare function getWorkspaceRootPackageJson(): PackageJson | undefined;
+//# sourceMappingURL=get-workspace-root-package-json.d.ts.map

package/dist/utils/get-workspace-root-package-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-workspace-root-package-json.d.ts","sourceRoot":"","sources":["../../src/utils/get-workspace-root-package-json.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,WAAW;IACxB,GAAG,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAKD,wBAAgB,2BAA2B,IAAI,WAAW,GAAG,SAAS,CAOrE"}

package/dist/utils/get-workspace-root-package-json.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "getWorkspaceRootPackageJson", {
+    enumerable: true,
+    get: function() {
+        return getWorkspaceRootPackageJson;
+    }
+});
+const _nodepath = /*#__PURE__*/ _interop_require_default(require("node:path"));
+const _findworkspaceroot = require("./find-workspace-root");
+const _readjson = require("./read-json");
+function _interop_require_default(obj) {
+    return obj && obj.__esModule ? obj : {
+        default: obj
+    };
+}
+let rootPackageJson;
+let rootPackageJsonLoaded = false;
+function getWorkspaceRootPackageJson() {
+    if (!rootPackageJsonLoaded) {
+        var _findWorkspaceRoot;
+        const root = (_findWorkspaceRoot = (0, _findworkspaceroot.findWorkspaceRoot)()) !== null && _findWorkspaceRoot !== void 0 ? _findWorkspaceRoot : _nodepath.default.resolve('./');
+        rootPackageJson = (0, _readjson.readJsonSafe)(_nodepath.default.join(root, 'package.json'));
+        rootPackageJsonLoaded = true;
+    }
+    return rootPackageJson;
+}
+
+//# sourceMappingURL=get-workspace-root-package-json.js.map

package/dist/utils/get-workspace-root-package-json.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utils/get-workspace-root-package-json.ts"],"sourcesContent":["import path from 'node:path';\nimport { findWorkspaceRoot } from './find-workspace-root';\nimport { readJsonSafe } from './read-json';\n\nexport interface PackageJson {\n    cli?: { packageManager?: string };\n    dependencies?: Record<string, string>;\n    devDependencies?: Record<string, string>;\n    peerDependencies?: Record<string, string>;\n}\n\nlet rootPackageJson: PackageJson | undefined;\nlet rootPackageJsonLoaded = false;\n\nexport function getWorkspaceRootPackageJson(): PackageJson | undefined {\n    if (!rootPackageJsonLoaded) {\n        const root = findWorkspaceRoot() ?? path.resolve('./');\n        rootPackageJson = readJsonSafe<PackageJson>(path.join(root, 'package.json'));\n        rootPackageJsonLoaded = true;\n    }\n    return rootPackageJson;\n}\n"],"names":["getWorkspaceRootPackageJson","rootPackageJson","rootPackageJsonLoaded","findWorkspaceRoot","root","path","resolve","readJsonSafe","join"],"mappings":";;;;+BAcgBA;;;eAAAA;;;iEAdC;mCACiB;0BACL;;;;;;AAS7B,IAAIC;AACJ,IAAIC,wBAAwB;AAErB,SAASF;IACZ,IAAI,CAACE,uBAAuB;YACXC;QAAb,MAAMC,QAAOD,qBAAAA,IAAAA,oCAAiB,iBAAjBA,gCAAAA,qBAAuBE,iBAAI,CAACC,OAAO,CAAC;QACjDL,kBAAkBM,IAAAA,sBAAY,EAAcF,iBAAI,CAACG,IAAI,CAACJ,MAAM;QAC5DF,wBAAwB;IAC5B;IACA,OAAOD;AACX"}

package/dist/utils/index.d.ts

@@ -3,6 +3,7 @@ export * from './debug';
 export * from './find-up';
 export * from './get-packages-with-install-scripts';
 export * from './get-version';
+export * from './get-workspace-root-package-json';
 export * from './git';
 export * from './npm';
 export * from './os';

package/dist/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,MAAM,CAAC;AACrB,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,qCAAqC,CAAC;AACpD,cAAc,eAAe,CAAC;AAC9B,cAAc,OAAO,CAAC;AACtB,cAAc,OAAO,CAAC;AACtB,cAAc,MAAM,CAAC;AACrB,cAAc,aAAa,CAAC;AAC5B,cAAc,kCAAkC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,MAAM,CAAC;AACrB,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,qCAAqC,CAAC;AACpD,cAAc,eAAe,CAAC;AAC9B,cAAc,mCAAmC,CAAC;AAClD,cAAc,OAAO,CAAC;AACtB,cAAc,OAAO,CAAC;AACtB,cAAc,MAAM,CAAC;AACrB,cAAc,aAAa,CAAC;AAC5B,cAAc,kCAAkC,CAAC"}

package/dist/utils/index.js

@@ -7,6 +7,7 @@ _export_star(require("./debug"), exports);
 _export_star(require("./find-up"), exports);
 _export_star(require("./get-packages-with-install-scripts"), exports);
 _export_star(require("./get-version"), exports);
+_export_star(require("./get-workspace-root-package-json"), exports);
 _export_star(require("./git"), exports);
 _export_star(require("./npm"), exports);
 _export_star(require("./os"), exports);

package/dist/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/index.ts"],"sourcesContent":["export * from './ci';\nexport * from './debug';\nexport * from './find-up';\nexport * from './get-packages-with-install-scripts';\nexport * from './get-version';\nexport * from './git';\nexport * from './npm';\nexport * from './os';\nexport * from './read-json';\nexport * from './warn-untrusted-install-scripts';\n"],"names":[],"mappings":";;;;qBAAc;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA"}
+{"version":3,"sources":["../../src/utils/index.ts"],"sourcesContent":["export * from './ci';\nexport * from './debug';\nexport * from './find-up';\nexport * from './get-packages-with-install-scripts';\nexport * from './get-version';\nexport * from './get-workspace-root-package-json';\nexport * from './git';\nexport * from './npm';\nexport * from './os';\nexport * from './read-json';\nexport * from './warn-untrusted-install-scripts';\n"],"names":[],"mappings":";;;;qBAAc;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@servicetitan/install",
-    "version": "38.0.0",
+    "version": "38.2.0",
     "description": "Lightweight wrapper around npm install that configures access to private packages",
     "homepage": "https://docs.st.dev/docs/frontend/uikit/install",
     "repository": {
@@ -30,7 +30,7 @@
         "webpack": false
     },
     "peerDependencies": {
-        "js-yaml": "~4.2.0"
+        "js-yaml": "~5.2.2"
     },
     "peerDependenciesMeta": {
         "js-yaml": {
@@ -40,5 +40,5 @@
     "devDependencies": {
         "ts-node": "~10.9.2"
     },
-    "gitHead": "a96a725030a0c422257567b1f06025bca8ca53b9"
+    "gitHead": "fd8cf00982a529371e44d76a0ca455dbbb42bae5"
 }

package/src/package-manager/get-package-manager.ts

@@ -1,12 +1,10 @@
-import fs from 'fs';
-import path from 'path';
-import { findUp, readJsonSafe } from '../utils';
+import { getWorkspaceRootPackageJson } from '../utils';
 import { NpmPackageManager } from './npm-package-manager';
 import type { PackageManager } from './package-manager';
 import { PnpmPackageManager } from './pnpm-package-manager';
 
 export function getPackageManager(): PackageManager {
-    const name = readPackageManagerName();
+    const name = getWorkspaceRootPackageJson()?.cli?.packageManager ?? 'npm';
     switch (name) {
         case 'npm':
             return new NpmPackageManager();
@@ -16,27 +14,3 @@ export function getPackageManager(): PackageManager {
             throw new Error(`Unsupported package manager: ${name}`);
     }
 }
-
-function readPackageManagerName(): string {
-    const root = findWorkspaceRoot() ?? path.resolve('./');
-    const packageJson = readJsonSafe<{ cli?: { packageManager?: string } }>(
-        path.join(root, 'package.json')
-    );
-    return packageJson?.cli?.packageManager ?? 'npm';
-}
-
-function findWorkspaceRoot(): string | undefined {
-    return findUp(directory => {
-        if (
-            readJsonSafe<{ workspaces?: unknown }>(path.join(directory, 'package.json'))?.workspaces
-        ) {
-            return directory;
-        }
-        if (fs.existsSync(path.join(directory, 'pnpm-workspace.yaml'))) {
-            return directory;
-        }
-        if (readJsonSafe<{ packages?: unknown }>(path.join(directory, 'lerna.json'))?.packages) {
-            return directory;
-        }
-    });
-}

package/src/package-manager/npm-package-manager.ts

@@ -7,7 +7,7 @@ import {
     DEFAULT_ALLOWED_SCRIPTS,
     logAllowedScripts,
     resolveAllowScripts,
-    shouldIgnoreScripts,
+    usesStartup,
 } from './utils';
 
 interface NpmLockFileEntry {
@@ -44,10 +44,11 @@ export class NpmPackageManager extends PackageManager<NpmLockFile> {
     }
 
     installPackages(args: InstallArgs = {}, options?: Parameters<typeof runCommand>[2]) {
-        const allowScripts = resolveAllowScripts(args.allowScripts ?? []);
+        const builtInAllowlist = usesStartup() ? DEFAULT_ALLOWED_SCRIPTS : [];
+        const allowScripts = resolveAllowScripts(args.allowScripts ?? [], builtInAllowlist);
 
         if (!args.quiet) {
-            logAllowedScripts(allowScripts);
+            logAllowedScripts(allowScripts, builtInAllowlist);
         }
 
         runCommand(
@@ -57,7 +58,7 @@ export class NpmPackageManager extends PackageManager<NpmLockFile> {
                 '--audit=false',
                 '--fund=false',
                 '--legacy-peer-deps',
-                ...(shouldIgnoreScripts(allowScripts) ? ['--ignore-scripts'] : []),
+                ...(allowScripts !== true ? ['--ignore-scripts'] : []),
                 ...(args.fix ? ['--package-lock-only', '--prefer-dedupe'] : []),
             ],
             options
@@ -68,11 +69,11 @@ export class NpmPackageManager extends PackageManager<NpmLockFile> {
                 return;
             }
             /*
-             * Rebuild applies when allowScripts is an explicit list:
+             * Rebuild applies when allowScripts is a non-empty explicit list:
              * `true` means npm install already ran every script, `false`
              * means the user opted out.
              */
-            if (Array.isArray(allowScripts)) {
+            if (Array.isArray(allowScripts) && allowScripts.length > 0) {
                 this.runRebuild(allowScripts);
             }
             /*
@@ -82,7 +83,7 @@ export class NpmPackageManager extends PackageManager<NpmLockFile> {
              */
             if (allowScripts !== false) {
                 warnUntrustedInstallScripts(
-                    Array.isArray(allowScripts) ? allowScripts : DEFAULT_ALLOWED_SCRIPTS
+                    Array.isArray(allowScripts) ? allowScripts : builtInAllowlist
                 );
             }
             /*

package/src/package-manager/utils/index.ts

@@ -1,4 +1,4 @@
 export * from './log-allowed-scripts';
 export * from './parse-allow-scripts';
 export * from './resolve-allow-scripts';
-export * from './should-ignore-scripts';
+export * from './uses-startup';

package/src/package-manager/utils/log-allowed-scripts.ts

@@ -1,8 +1,7 @@
 /* eslint-disable no-console */
 import type { AllowScripts } from '../package-manager';
-import { DEFAULT_ALLOWED_SCRIPTS } from './resolve-allow-scripts';
 
-export function logAllowedScripts(allowScripts: AllowScripts) {
+export function logAllowedScripts(allowScripts: AllowScripts, builtInAllowlist: string[]) {
     if (allowScripts === true) {
         console.log('Allowing all install scripts');
         return;
@@ -10,8 +9,12 @@ export function logAllowedScripts(allowScripts: AllowScripts) {
     if (allowScripts === false) {
         return;
     }
-    const extras = allowScripts.filter(s => !DEFAULT_ALLOWED_SCRIPTS.includes(s));
-    if (extras.length) {
-        console.log(`Allowing additional install scripts: ${extras.join(', ')}`);
+    const extras = allowScripts.filter(s => !builtInAllowlist.includes(s));
+    if (!extras.length) {
+        return;
     }
+    const label = builtInAllowlist.length
+        ? 'Allowing additional install scripts'
+        : 'Allowing install scripts';
+    console.log(`${label}: ${extras.join(', ')}`);
 }

package/src/package-manager/utils/resolve-allow-scripts.ts

@@ -9,9 +9,9 @@ export const DEFAULT_ALLOWED_SCRIPTS = [
     'tree-sitter',
 ];
 
-export function resolveAllowScripts(value: AllowScripts): AllowScripts {
+export function resolveAllowScripts(value: AllowScripts, builtInAllowlist: string[]): AllowScripts {
     if (value === true || value === false) {
         return value;
     }
-    return [...DEFAULT_ALLOWED_SCRIPTS, ...parseAllowScripts(value)];
+    return [...builtInAllowlist, ...parseAllowScripts(value)];
 }

package/src/package-manager/utils/uses-startup.ts

@@ -0,0 +1,12 @@
+import { getWorkspaceRootPackageJson } from '../../utils';
+
+const STARTUP_PACKAGE = '@servicetitan/startup';
+
+export function usesStartup(): boolean {
+    const packageJson = getWorkspaceRootPackageJson();
+    return !!(
+        packageJson?.dependencies?.[STARTUP_PACKAGE] ??
+        packageJson?.devDependencies?.[STARTUP_PACKAGE] ??
+        packageJson?.peerDependencies?.[STARTUP_PACKAGE]
+    );
+}

package/src/utils/find-workspace-root.ts

@@ -0,0 +1,20 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { findUp } from './find-up';
+import { readJsonSafe } from './read-json';
+
+export function findWorkspaceRoot(): string | undefined {
+    return findUp(directory => {
+        if (
+            readJsonSafe<{ workspaces?: unknown }>(path.join(directory, 'package.json'))?.workspaces
+        ) {
+            return directory;
+        }
+        if (fs.existsSync(path.join(directory, 'pnpm-workspace.yaml'))) {
+            return directory;
+        }
+        if (readJsonSafe<{ packages?: unknown }>(path.join(directory, 'lerna.json'))?.packages) {
+            return directory;
+        }
+    });
+}

package/src/utils/get-workspace-root-package-json.ts

@@ -0,0 +1,22 @@
+import path from 'node:path';
+import { findWorkspaceRoot } from './find-workspace-root';
+import { readJsonSafe } from './read-json';
+
+export interface PackageJson {
+    cli?: { packageManager?: string };
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+    peerDependencies?: Record<string, string>;
+}
+
+let rootPackageJson: PackageJson | undefined;
+let rootPackageJsonLoaded = false;
+
+export function getWorkspaceRootPackageJson(): PackageJson | undefined {
+    if (!rootPackageJsonLoaded) {
+        const root = findWorkspaceRoot() ?? path.resolve('./');
+        rootPackageJson = readJsonSafe<PackageJson>(path.join(root, 'package.json'));
+        rootPackageJsonLoaded = true;
+    }
+    return rootPackageJson;
+}

package/src/utils/index.ts

@@ -3,6 +3,7 @@ export * from './debug';
 export * from './find-up';
 export * from './get-packages-with-install-scripts';
 export * from './get-version';
+export * from './get-workspace-root-package-json';
 export * from './git';
 export * from './npm';
 export * from './os';

package/dist/package-manager/utils/should-ignore-scripts.d.ts

@@ -1,3 +0,0 @@
-import type { AllowScripts } from '../package-manager';
-export declare function shouldIgnoreScripts(allowScripts: AllowScripts): boolean;
-//# sourceMappingURL=should-ignore-scripts.d.ts.map

package/dist/package-manager/utils/should-ignore-scripts.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"should-ignore-scripts.d.ts","sourceRoot":"","sources":["../../../src/package-manager/utils/should-ignore-scripts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,YAAY,GAAG,OAAO,CAQvE"}

package/dist/package-manager/utils/should-ignore-scripts.js

@@ -1,21 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "shouldIgnoreScripts", {
-    enumerable: true,
-    get: function() {
-        return shouldIgnoreScripts;
-    }
-});
-function shouldIgnoreScripts(allowScripts) {
-    if (allowScripts === true) {
-        return false;
-    }
-    if (allowScripts === false) {
-        return true;
-    }
-    return allowScripts.length > 0;
-}
-
-//# sourceMappingURL=should-ignore-scripts.js.map

package/dist/package-manager/utils/should-ignore-scripts.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/package-manager/utils/should-ignore-scripts.ts"],"sourcesContent":["import type { AllowScripts } from '../package-manager';\n\nexport function shouldIgnoreScripts(allowScripts: AllowScripts): boolean {\n    if (allowScripts === true) {\n        return false;\n    }\n    if (allowScripts === false) {\n        return true;\n    }\n    return allowScripts.length > 0;\n}\n"],"names":["shouldIgnoreScripts","allowScripts","length"],"mappings":";;;;+BAEgBA;;;eAAAA;;;AAAT,SAASA,oBAAoBC,YAA0B;IAC1D,IAAIA,iBAAiB,MAAM;QACvB,OAAO;IACX;IACA,IAAIA,iBAAiB,OAAO;QACxB,OAAO;IACX;IACA,OAAOA,aAAaC,MAAM,GAAG;AACjC"}

package/src/package-manager/utils/should-ignore-scripts.ts

@@ -1,11 +0,0 @@
-import type { AllowScripts } from '../package-manager';
-
-export function shouldIgnoreScripts(allowScripts: AllowScripts): boolean {
-    if (allowScripts === true) {
-        return false;
-    }
-    if (allowScripts === false) {
-        return true;
-    }
-    return allowScripts.length > 0;
-}