@servicetitan/install 38.1.0 → 38.2.0

package/dist/package-manager/get-package-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-package-manager.d.ts","sourceRoot":"","sources":["../../src/package-manager/get-package-manager.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD,wBAAgB,iBAAiB,IAAI,cAAc,CAUlD"}
+{"version":3,"file":"get-package-manager.d.ts","sourceRoot":"","sources":["../../src/package-manager/get-package-manager.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD,wBAAgB,iBAAiB,IAAI,cAAc,CAUlD"}

package/dist/package-manager/get-package-manager.js

@@ -8,18 +8,13 @@ Object.defineProperty(exports, "getPackageManager", {
         return getPackageManager;
     }
 });
-const _fs = /*#__PURE__*/ _interop_require_default(require("fs"));
-const _path = /*#__PURE__*/ _interop_require_default(require("path"));
 const _utils = require("../utils");
 const _npmpackagemanager = require("./npm-package-manager");
 const _pnpmpackagemanager = require("./pnpm-package-manager");
-function _interop_require_default(obj) {
-    return obj && obj.__esModule ? obj : {
-        default: obj
-    };
-}
 function getPackageManager() {
-    const name = readPackageManagerName();
+    var _ref;
+    var _getWorkspaceRootPackageJson_cli, _getWorkspaceRootPackageJson;
+    const name = (_ref = (_getWorkspaceRootPackageJson = (0, _utils.getWorkspaceRootPackageJson)()) === null || _getWorkspaceRootPackageJson === void 0 ? void 0 : (_getWorkspaceRootPackageJson_cli = _getWorkspaceRootPackageJson.cli) === null || _getWorkspaceRootPackageJson_cli === void 0 ? void 0 : _getWorkspaceRootPackageJson_cli.packageManager) !== null && _ref !== void 0 ? _ref : 'npm';
     switch(name){
         case 'npm':
             return new _npmpackagemanager.NpmPackageManager();
@@ -29,26 +24,5 @@ function getPackageManager() {
             throw new Error(`Unsupported package manager: ${name}`);
     }
 }
-function readPackageManagerName() {
-    var _findWorkspaceRoot, _ref;
-    var _packageJson_cli;
-    const root = (_findWorkspaceRoot = findWorkspaceRoot()) !== null && _findWorkspaceRoot !== void 0 ? _findWorkspaceRoot : _path.default.resolve('./');
-    const packageJson = (0, _utils.readJsonSafe)(_path.default.join(root, 'package.json'));
-    return (_ref = packageJson === null || packageJson === void 0 ? void 0 : (_packageJson_cli = packageJson.cli) === null || _packageJson_cli === void 0 ? void 0 : _packageJson_cli.packageManager) !== null && _ref !== void 0 ? _ref : 'npm';
-}
-function findWorkspaceRoot() {
-    return (0, _utils.findUp)((directory)=>{
-        var _readJsonSafe, _readJsonSafe1;
-        if ((_readJsonSafe = (0, _utils.readJsonSafe)(_path.default.join(directory, 'package.json'))) === null || _readJsonSafe === void 0 ? void 0 : _readJsonSafe.workspaces) {
-            return directory;
-        }
-        if (_fs.default.existsSync(_path.default.join(directory, 'pnpm-workspace.yaml'))) {
-            return directory;
-        }
-        if ((_readJsonSafe1 = (0, _utils.readJsonSafe)(_path.default.join(directory, 'lerna.json'))) === null || _readJsonSafe1 === void 0 ? void 0 : _readJsonSafe1.packages) {
-            return directory;
-        }
-    });
-}
 
 //# sourceMappingURL=get-package-manager.js.map

package/dist/package-manager/get-package-manager.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/package-manager/get-package-manager.ts"],"sourcesContent":["import fs from 'fs';\nimport path from 'path';\nimport { findUp, readJsonSafe } from '../utils';\nimport { NpmPackageManager } from './npm-package-manager';\nimport type { PackageManager } from './package-manager';\nimport { PnpmPackageManager } from './pnpm-package-manager';\n\nexport function getPackageManager(): PackageManager {\n    const name = readPackageManagerName();\n    switch (name) {\n        case 'npm':\n            return new NpmPackageManager();\n        case 'pnpm':\n            return new PnpmPackageManager();\n        default:\n            throw new Error(`Unsupported package manager: ${name}`);\n    }\n}\n\nfunction readPackageManagerName(): string {\n    const root = findWorkspaceRoot() ?? path.resolve('./');\n    const packageJson = readJsonSafe<{ cli?: { packageManager?: string } }>(\n        path.join(root, 'package.json')\n    );\n    return packageJson?.cli?.packageManager ?? 'npm';\n}\n\nfunction findWorkspaceRoot(): string | undefined {\n    return findUp(directory => {\n        if (\n            readJsonSafe<{ workspaces?: unknown }>(path.join(directory, 'package.json'))?.workspaces\n        ) {\n            return directory;\n        }\n        if (fs.existsSync(path.join(directory, 'pnpm-workspace.yaml'))) {\n            return directory;\n        }\n        if (readJsonSafe<{ packages?: unknown }>(path.join(directory, 'lerna.json'))?.packages) {\n            return directory;\n        }\n    });\n}\n"],"names":["getPackageManager","name","readPackageManagerName","NpmPackageManager","PnpmPackageManager","Error","findWorkspaceRoot","packageJson","root","path","resolve","readJsonSafe","join","cli","packageManager","findUp","directory","workspaces","fs","existsSync","packages"],"mappings":";;;;+BAOgBA;;;eAAAA;;;2DAPD;6DACE;uBACoB;mCACH;oCAEC;;;;;;AAE5B,SAASA;IACZ,MAAMC,OAAOC;IACb,OAAQD;QACJ,KAAK;YACD,OAAO,IAAIE,oCAAiB;QAChC,KAAK;YACD,OAAO,IAAIC,sCAAkB;QACjC;YACI,MAAM,IAAIC,MAAM,CAAC,6BAA6B,EAAEJ,MAAM;IAC9D;AACJ;AAEA,SAASC;QACQI;QAINC;IAJP,MAAMC,QAAOF,qBAAAA,iCAAAA,gCAAAA,qBAAuBG,aAAI,CAACC,OAAO,CAAC;IACjD,MAAMH,cAAcI,IAAAA,mBAAY,EAC5BF,aAAI,CAACG,IAAI,CAACJ,MAAM;IAEpB,eAAOD,wBAAAA,mCAAAA,mBAAAA,YAAaM,GAAG,cAAhBN,uCAAAA,iBAAkBO,cAAc,uCAAI;AAC/C;AAEA,SAASR;IACL,OAAOS,IAAAA,aAAM,EAACC,CAAAA;YAENL,eAOAA;QARJ,KACIA,gBAAAA,IAAAA,mBAAY,EAA2BF,aAAI,CAACG,IAAI,CAACI,WAAW,8BAA5DL,oCAAAA,cAA8EM,UAAU,EAC1F;YACE,OAAOD;QACX;QACA,IAAIE,WAAE,CAACC,UAAU,CAACV,aAAI,CAACG,IAAI,CAACI,WAAW,yBAAyB;YAC5D,OAAOA;QACX;QACA,KAAIL,iBAAAA,IAAAA,mBAAY,EAAyBF,aAAI,CAACG,IAAI,CAACI,WAAW,4BAA1DL,qCAAAA,eAA0ES,QAAQ,EAAE;YACpF,OAAOJ;QACX;IACJ;AACJ"}
+{"version":3,"sources":["../../src/package-manager/get-package-manager.ts"],"sourcesContent":["import { getWorkspaceRootPackageJson } from '../utils';\nimport { NpmPackageManager } from './npm-package-manager';\nimport type { PackageManager } from './package-manager';\nimport { PnpmPackageManager } from './pnpm-package-manager';\n\nexport function getPackageManager(): PackageManager {\n    const name = getWorkspaceRootPackageJson()?.cli?.packageManager ?? 'npm';\n    switch (name) {\n        case 'npm':\n            return new NpmPackageManager();\n        case 'pnpm':\n            return new PnpmPackageManager();\n        default:\n            throw new Error(`Unsupported package manager: ${name}`);\n    }\n}\n"],"names":["getPackageManager","getWorkspaceRootPackageJson","name","cli","packageManager","NpmPackageManager","PnpmPackageManager","Error"],"mappings":";;;;+BAKgBA;;;eAAAA;;;uBAL4B;mCACV;oCAEC;AAE5B,SAASA;;QACCC,kCAAAA;IAAb,MAAMC,gBAAOD,+BAAAA,IAAAA,kCAA2B,iBAA3BA,oDAAAA,mCAAAA,6BAA+BE,GAAG,cAAlCF,uDAAAA,iCAAoCG,cAAc,uCAAI;IACnE,OAAQF;QACJ,KAAK;YACD,OAAO,IAAIG,oCAAiB;QAChC,KAAK;YACD,OAAO,IAAIC,sCAAkB;QACjC;YACI,MAAM,IAAIC,MAAM,CAAC,6BAA6B,EAAEL,MAAM;IAC9D;AACJ"}

package/dist/package-manager/npm-package-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"npm-package-manager.d.ts","sourceRoot":"","sources":["../../src/package-manager/npm-package-manager.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,UAAU,EAA+B,MAAM,UAAU,CAAC;AACzE,OAAO,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAQnD,UAAU,gBAAgB;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC/C;AAED,qBAAa,iBAAkB,SAAQ,cAAc,CAAC,WAAW,CAAC;IAC9D,QAAQ,CAAC,OAAO,SAAS;IACzB,QAAQ,CAAC,YAAY,uBAAuB;IAE5C,UAAU;IAIV,kBAAkB,CAAC,EACf,gBAAgB,EAChB,UAAU,EACV,UAAU,GACb,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAK5C,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAI9F,eAAe,CAAC,IAAI,GAAE,WAAgB,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IAuDlF,SAAS,CAAC,aAAa,IAAI,WAAW,GAAG,SAAS;IAYlD;;;;;;;OAOG;IACH,OAAO,CAAC,SAAS;IAiBjB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,qBAAqB;CAOhC"}
+{"version":3,"file":"npm-package-manager.d.ts","sourceRoot":"","sources":["../../src/package-manager/npm-package-manager.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,UAAU,EAA+B,MAAM,UAAU,CAAC;AACzE,OAAO,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAQnD,UAAU,gBAAgB;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC/C;AAED,qBAAa,iBAAkB,SAAQ,cAAc,CAAC,WAAW,CAAC;IAC9D,QAAQ,CAAC,OAAO,SAAS;IACzB,QAAQ,CAAC,YAAY,uBAAuB;IAE5C,UAAU;IAIV,kBAAkB,CAAC,EACf,gBAAgB,EAChB,UAAU,EACV,UAAU,GACb,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAK5C,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAI9F,eAAe,CAAC,IAAI,GAAE,WAAgB,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IAwDlF,SAAS,CAAC,aAAa,IAAI,WAAW,GAAG,SAAS;IAYlD;;;;;;;OAOG;IACH,OAAO,CAAC,SAAS;IAiBjB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,qBAAqB;CAOhC"}

package/dist/package-manager/npm-package-manager.js

@@ -54,16 +54,17 @@ class NpmPackageManager extends _packagemanager.PackageManager {
     }
     installPackages(args = {}, options) {
         var _args_allowScripts;
-        const allowScripts = (0, _utils1.resolveAllowScripts)((_args_allowScripts = args.allowScripts) !== null && _args_allowScripts !== void 0 ? _args_allowScripts : []);
+        const builtInAllowlist = (0, _utils1.usesStartup)() ? _utils1.DEFAULT_ALLOWED_SCRIPTS : [];
+        const allowScripts = (0, _utils1.resolveAllowScripts)((_args_allowScripts = args.allowScripts) !== null && _args_allowScripts !== void 0 ? _args_allowScripts : [], builtInAllowlist);
         if (!args.quiet) {
-            (0, _utils1.logAllowedScripts)(allowScripts);
+            (0, _utils1.logAllowedScripts)(allowScripts, builtInAllowlist);
         }
         (0, _utils.runCommand)(this.command, [
             (0, _utils.isCI)() ? 'ci' : 'i',
             '--audit=false',
             '--fund=false',
             '--legacy-peer-deps',
-            ...(0, _utils1.shouldIgnoreScripts)(allowScripts) ? [
+            ...allowScripts !== true ? [
                 '--ignore-scripts'
             ] : [],
             ...args.fix ? [
@@ -76,10 +77,10 @@ class NpmPackageManager extends _packagemanager.PackageManager {
                 return;
             }
             /*
-             * Rebuild applies when allowScripts is an explicit list:
+             * Rebuild applies when allowScripts is a non-empty explicit list:
              * `true` means npm install already ran every script, `false`
              * means the user opted out.
-             */ if (Array.isArray(allowScripts)) {
+             */ if (Array.isArray(allowScripts) && allowScripts.length > 0) {
                 this.runRebuild(allowScripts);
             }
             /*
@@ -87,7 +88,7 @@ class NpmPackageManager extends _packagemanager.PackageManager {
              * scripts they should add to --allow-scripts. Skip when the user
              * explicitly opted out (`false`); they made an informed choice.
              */ if (allowScripts !== false) {
-                (0, _utils.warnUntrustedInstallScripts)(Array.isArray(allowScripts) ? allowScripts : _utils1.DEFAULT_ALLOWED_SCRIPTS);
+                (0, _utils.warnUntrustedInstallScripts)(Array.isArray(allowScripts) ? allowScripts : builtInAllowlist);
             }
             /*
              * When allowScripts is `true`, npm already ran project postinstall.

package/dist/package-manager/npm-package-manager.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/package-manager/npm-package-manager.ts"],"sourcesContent":["/* eslint-disable no-console */\nimport fs from 'fs';\nimport { isCI, runCommand, warnUntrustedInstallScripts } from '../utils';\nimport type { DeclaredVersionQuery, InstallArgs, ResolvedVersionQuery } from './package-manager';\nimport { PackageManager } from './package-manager';\nimport {\n    DEFAULT_ALLOWED_SCRIPTS,\n    logAllowedScripts,\n    resolveAllowScripts,\n    shouldIgnoreScripts,\n} from './utils';\n\ninterface NpmLockFileEntry {\n    version?: string;\n    resolved?: string;\n    link?: boolean;\n    dependencies?: Record<string, string>;\n    peerDependencies?: Record<string, string>;\n}\n\nexport interface NpmLockFile {\n    packages?: Record<string, NpmLockFileEntry>;\n}\n\nexport class NpmPackageManager extends PackageManager<NpmLockFile> {\n    readonly command = 'npm';\n    readonly lockFileName = 'package-lock.json';\n\n    clearCache() {\n        runCommand(this.command, ['cache', 'clear', '--force']);\n    }\n\n    getDeclaredVersion({\n        workspacePackage,\n        declaredBy,\n        dependency,\n    }: DeclaredVersionQuery): string | undefined {\n        const entry = this.findEntry({ workspacePackage, package: declaredBy });\n        return entry?.dependencies?.[dependency] ?? entry?.peerDependencies?.[dependency];\n    }\n\n    getResolvedVersion({ workspacePackage, dependency }: ResolvedVersionQuery): string | undefined {\n        return this.findEntry({ workspacePackage, package: dependency })?.version;\n    }\n\n    installPackages(args: InstallArgs = {}, options?: Parameters<typeof runCommand>[2]) {\n        const allowScripts = resolveAllowScripts(args.allowScripts ?? []);\n\n        if (!args.quiet) {\n            logAllowedScripts(allowScripts);\n        }\n\n        runCommand(\n            this.command,\n            [\n                isCI() ? 'ci' : 'i',\n                '--audit=false',\n                '--fund=false',\n                '--legacy-peer-deps',\n                ...(shouldIgnoreScripts(allowScripts) ? ['--ignore-scripts'] : []),\n                ...(args.fix ? ['--package-lock-only', '--prefer-dedupe'] : []),\n            ],\n            options\n        );\n\n        try {\n            if (args.fix) {\n                return;\n            }\n            /*\n             * Rebuild applies when allowScripts is an explicit list:\n             * `true` means npm install already ran every script, `false`\n             * means the user opted out.\n             */\n            if (Array.isArray(allowScripts)) {\n                this.runRebuild(allowScripts);\n            }\n            /*\n             * Warn against the effective allowlist so teams can see which\n             * scripts they should add to --allow-scripts. Skip when the user\n             * explicitly opted out (`false`); they made an informed choice.\n             */\n            if (allowScripts !== false) {\n                warnUntrustedInstallScripts(\n                    Array.isArray(allowScripts) ? allowScripts : DEFAULT_ALLOWED_SCRIPTS\n                );\n            }\n            /*\n             * When allowScripts is `true`, npm already ran project postinstall.\n             * In other cases, we run it manually. Note, `false` only ignores\n             * package scripts, the project postinstall is always trusted.\n             */\n            if (allowScripts !== true) {\n                this.runProjectPostinstall(options);\n            }\n        } finally {\n            this.reset();\n        }\n    }\n\n    protected parseLockFile(): NpmLockFile | undefined {\n        const lockFilePath = this.getLockFilePath();\n        if (!lockFilePath) {\n            return undefined;\n        }\n        try {\n            return JSON.parse(fs.readFileSync(lockFilePath, 'utf-8'));\n        } catch {\n            return undefined;\n        }\n    }\n\n    /**\n     * Looks up a lockfile entry for the given workspace package, falling back\n     * to the hoisted root entry. `workspacePackage` is the package's relative\n     * path from the repo root; the empty string `''` denotes the root\n     * workspace package itself, matching npm's own lockfile key convention.\n     * Follows link entries to the resolved workspace package, so callers see\n     * the workspace package's own metadata rather than the symlink stub.\n     */\n    private findEntry({\n        workspacePackage,\n        package: packageName,\n    }: {\n        workspacePackage: string;\n        package: string;\n    }): NpmLockFileEntry | undefined {\n        const packages = this.getLockFile()?.packages;\n        const entry =\n            packages?.[`${workspacePackage}/node_modules/${packageName}`] ??\n            packages?.[`node_modules/${packageName}`];\n        if (entry?.link && entry.resolved) {\n            return packages?.[entry.resolved];\n        }\n        return entry;\n    }\n\n    private runRebuild(scripts: string[]) {\n        try {\n            runCommand(this.command, ['rebuild', ...scripts]);\n        } catch {\n            console.error(`Failed to run allowed scripts: ${scripts.join(', ')}`);\n            process.exitCode = 1;\n        }\n    }\n\n    private runProjectPostinstall(options?: Parameters<typeof runCommand>[2]) {\n        try {\n            runCommand(this.command, ['run', 'postinstall', '--if-present'], options);\n        } catch {\n            process.exitCode = 1;\n        }\n    }\n}\n"],"names":["NpmPackageManager","PackageManager","clearCache","runCommand","command","getDeclaredVersion","workspacePackage","declaredBy","dependency","entry","findEntry","package","dependencies","peerDependencies","getResolvedVersion","version","installPackages","args","options","allowScripts","resolveAllowScripts","quiet","logAllowedScripts","isCI","shouldIgnoreScripts","fix","Array","isArray","runRebuild","warnUntrustedInstallScripts","DEFAULT_ALLOWED_SCRIPTS","runProjectPostinstall","reset","parseLockFile","lockFilePath","getLockFilePath","undefined","JSON","parse","fs","readFileSync","packageName","packages","getLockFile","link","resolved","scripts","console","error","join","process","exitCode","lockFileName"],"mappings":"AAAA,6BAA6B;;;;+BAwBhBA;;;eAAAA;;;2DAvBE;uBAC+C;gCAE/B;wBAMxB;;;;;;;;;;;;;;;;;AAcA,MAAMA,0BAA0BC,8BAAc;IAIjDC,aAAa;QACTC,IAAAA,iBAAU,EAAC,IAAI,CAACC,OAAO,EAAE;YAAC;YAAS;YAAS;SAAU;IAC1D;IAEAC,mBAAmB,EACfC,gBAAgB,EAChBC,UAAU,EACVC,UAAU,EACS,EAAsB;;YAElCC,qBAAqCA;QAD5C,MAAMA,QAAQ,IAAI,CAACC,SAAS,CAAC;YAAEJ;YAAkBK,SAASJ;QAAW;QACrE,eAAOE,kBAAAA,6BAAAA,sBAAAA,MAAOG,YAAY,cAAnBH,0CAAAA,mBAAqB,CAACD,WAAW,uCAAIC,kBAAAA,6BAAAA,0BAAAA,MAAOI,gBAAgB,cAAvBJ,8CAAAA,uBAAyB,CAACD,WAAW;IACrF;IAEAM,mBAAmB,EAAER,gBAAgB,EAAEE,UAAU,EAAwB,EAAsB;YACpF;QAAP,QAAO,kBAAA,IAAI,CAACE,SAAS,CAAC;YAAEJ;YAAkBK,SAASH;QAAW,gBAAvD,sCAAA,gBAA2DO,OAAO;IAC7E;IAEAC,gBAAgBC,OAAoB,CAAC,CAAC,EAAEC,OAA0C,EAAE;YACvCD;QAAzC,MAAME,eAAeC,IAAAA,2BAAmB,GAACH,qBAAAA,KAAKE,YAAY,cAAjBF,gCAAAA,qBAAqB,EAAE;QAEhE,IAAI,CAACA,KAAKI,KAAK,EAAE;YACbC,IAAAA,yBAAiB,EAACH;QACtB;QAEAhB,IAAAA,iBAAU,EACN,IAAI,CAACC,OAAO,EACZ;YACImB,IAAAA,WAAI,MAAK,OAAO;YAChB;YACA;YACA;eACIC,IAAAA,2BAAmB,EAACL,gBAAgB;gBAAC;aAAmB,GAAG,EAAE;eAC7DF,KAAKQ,GAAG,GAAG;gBAAC;gBAAuB;aAAkB,GAAG,EAAE;SACjE,EACDP;QAGJ,IAAI;YACA,IAAID,KAAKQ,GAAG,EAAE;gBACV;YACJ;YACA;;;;aAIC,GACD,IAAIC,MAAMC,OAAO,CAACR,eAAe;gBAC7B,IAAI,CAACS,UAAU,CAACT;YACpB;YACA;;;;aAIC,GACD,IAAIA,iBAAiB,OAAO;gBACxBU,IAAAA,kCAA2B,EACvBH,MAAMC,OAAO,CAACR,gBAAgBA,eAAeW,+BAAuB;YAE5E;YACA;;;;aAIC,GACD,IAAIX,iBAAiB,MAAM;gBACvB,IAAI,CAACY,qBAAqB,CAACb;YAC/B;QACJ,SAAU;YACN,IAAI,CAACc,KAAK;QACd;IACJ;IAEUC,gBAAyC;QAC/C,MAAMC,eAAe,IAAI,CAACC,eAAe;QACzC,IAAI,CAACD,cAAc;YACf,OAAOE;QACX;QACA,IAAI;YACA,OAAOC,KAAKC,KAAK,CAACC,WAAE,CAACC,YAAY,CAACN,cAAc;QACpD,EAAE,eAAM;YACJ,OAAOE;QACX;IACJ;IAEA;;;;;;;KAOC,GACD,AAAQ1B,UAAU,EACdJ,gBAAgB,EAChBK,SAAS8B,WAAW,EAIvB,EAAgC;;YACZ;QAAjB,MAAMC,YAAW,oBAAA,IAAI,CAACC,WAAW,gBAAhB,wCAAA,kBAAoBD,QAAQ;QAC7C,MAAMjC,gBACFiC,qBAAAA,+BAAAA,QAAU,CAAC,GAAGpC,iBAAiB,cAAc,EAAEmC,aAAa,CAAC,uCAC7DC,qBAAAA,+BAAAA,QAAU,CAAC,CAAC,aAAa,EAAED,aAAa,CAAC;QAC7C,IAAIhC,CAAAA,kBAAAA,4BAAAA,MAAOmC,IAAI,KAAInC,MAAMoC,QAAQ,EAAE;YAC/B,OAAOH,qBAAAA,+BAAAA,QAAU,CAACjC,MAAMoC,QAAQ,CAAC;QACrC;QACA,OAAOpC;IACX;IAEQmB,WAAWkB,OAAiB,EAAE;QAClC,IAAI;YACA3C,IAAAA,iBAAU,EAAC,IAAI,CAACC,OAAO,EAAE;gBAAC;mBAAc0C;aAAQ;QACpD,EAAE,eAAM;YACJC,QAAQC,KAAK,CAAC,CAAC,+BAA+B,EAAEF,QAAQG,IAAI,CAAC,OAAO;YACpEC,QAAQC,QAAQ,GAAG;QACvB;IACJ;IAEQpB,sBAAsBb,OAA0C,EAAE;QACtE,IAAI;YACAf,IAAAA,iBAAU,EAAC,IAAI,CAACC,OAAO,EAAE;gBAAC;gBAAO;gBAAe;aAAe,EAAEc;QACrE,EAAE,eAAM;YACJgC,QAAQC,QAAQ,GAAG;QACvB;IACJ;;QAhIG,gBACH,uBAAS/C,WAAU,QACnB,uBAASgD,gBAAe;;AA+H5B"}
+{"version":3,"sources":["../../src/package-manager/npm-package-manager.ts"],"sourcesContent":["/* eslint-disable no-console */\nimport fs from 'fs';\nimport { isCI, runCommand, warnUntrustedInstallScripts } from '../utils';\nimport type { DeclaredVersionQuery, InstallArgs, ResolvedVersionQuery } from './package-manager';\nimport { PackageManager } from './package-manager';\nimport {\n    DEFAULT_ALLOWED_SCRIPTS,\n    logAllowedScripts,\n    resolveAllowScripts,\n    usesStartup,\n} from './utils';\n\ninterface NpmLockFileEntry {\n    version?: string;\n    resolved?: string;\n    link?: boolean;\n    dependencies?: Record<string, string>;\n    peerDependencies?: Record<string, string>;\n}\n\nexport interface NpmLockFile {\n    packages?: Record<string, NpmLockFileEntry>;\n}\n\nexport class NpmPackageManager extends PackageManager<NpmLockFile> {\n    readonly command = 'npm';\n    readonly lockFileName = 'package-lock.json';\n\n    clearCache() {\n        runCommand(this.command, ['cache', 'clear', '--force']);\n    }\n\n    getDeclaredVersion({\n        workspacePackage,\n        declaredBy,\n        dependency,\n    }: DeclaredVersionQuery): string | undefined {\n        const entry = this.findEntry({ workspacePackage, package: declaredBy });\n        return entry?.dependencies?.[dependency] ?? entry?.peerDependencies?.[dependency];\n    }\n\n    getResolvedVersion({ workspacePackage, dependency }: ResolvedVersionQuery): string | undefined {\n        return this.findEntry({ workspacePackage, package: dependency })?.version;\n    }\n\n    installPackages(args: InstallArgs = {}, options?: Parameters<typeof runCommand>[2]) {\n        const builtInAllowlist = usesStartup() ? DEFAULT_ALLOWED_SCRIPTS : [];\n        const allowScripts = resolveAllowScripts(args.allowScripts ?? [], builtInAllowlist);\n\n        if (!args.quiet) {\n            logAllowedScripts(allowScripts, builtInAllowlist);\n        }\n\n        runCommand(\n            this.command,\n            [\n                isCI() ? 'ci' : 'i',\n                '--audit=false',\n                '--fund=false',\n                '--legacy-peer-deps',\n                ...(allowScripts !== true ? ['--ignore-scripts'] : []),\n                ...(args.fix ? ['--package-lock-only', '--prefer-dedupe'] : []),\n            ],\n            options\n        );\n\n        try {\n            if (args.fix) {\n                return;\n            }\n            /*\n             * Rebuild applies when allowScripts is a non-empty explicit list:\n             * `true` means npm install already ran every script, `false`\n             * means the user opted out.\n             */\n            if (Array.isArray(allowScripts) && allowScripts.length > 0) {\n                this.runRebuild(allowScripts);\n            }\n            /*\n             * Warn against the effective allowlist so teams can see which\n             * scripts they should add to --allow-scripts. Skip when the user\n             * explicitly opted out (`false`); they made an informed choice.\n             */\n            if (allowScripts !== false) {\n                warnUntrustedInstallScripts(\n                    Array.isArray(allowScripts) ? allowScripts : builtInAllowlist\n                );\n            }\n            /*\n             * When allowScripts is `true`, npm already ran project postinstall.\n             * In other cases, we run it manually. Note, `false` only ignores\n             * package scripts, the project postinstall is always trusted.\n             */\n            if (allowScripts !== true) {\n                this.runProjectPostinstall(options);\n            }\n        } finally {\n            this.reset();\n        }\n    }\n\n    protected parseLockFile(): NpmLockFile | undefined {\n        const lockFilePath = this.getLockFilePath();\n        if (!lockFilePath) {\n            return undefined;\n        }\n        try {\n            return JSON.parse(fs.readFileSync(lockFilePath, 'utf-8'));\n        } catch {\n            return undefined;\n        }\n    }\n\n    /**\n     * Looks up a lockfile entry for the given workspace package, falling back\n     * to the hoisted root entry. `workspacePackage` is the package's relative\n     * path from the repo root; the empty string `''` denotes the root\n     * workspace package itself, matching npm's own lockfile key convention.\n     * Follows link entries to the resolved workspace package, so callers see\n     * the workspace package's own metadata rather than the symlink stub.\n     */\n    private findEntry({\n        workspacePackage,\n        package: packageName,\n    }: {\n        workspacePackage: string;\n        package: string;\n    }): NpmLockFileEntry | undefined {\n        const packages = this.getLockFile()?.packages;\n        const entry =\n            packages?.[`${workspacePackage}/node_modules/${packageName}`] ??\n            packages?.[`node_modules/${packageName}`];\n        if (entry?.link && entry.resolved) {\n            return packages?.[entry.resolved];\n        }\n        return entry;\n    }\n\n    private runRebuild(scripts: string[]) {\n        try {\n            runCommand(this.command, ['rebuild', ...scripts]);\n        } catch {\n            console.error(`Failed to run allowed scripts: ${scripts.join(', ')}`);\n            process.exitCode = 1;\n        }\n    }\n\n    private runProjectPostinstall(options?: Parameters<typeof runCommand>[2]) {\n        try {\n            runCommand(this.command, ['run', 'postinstall', '--if-present'], options);\n        } catch {\n            process.exitCode = 1;\n        }\n    }\n}\n"],"names":["NpmPackageManager","PackageManager","clearCache","runCommand","command","getDeclaredVersion","workspacePackage","declaredBy","dependency","entry","findEntry","package","dependencies","peerDependencies","getResolvedVersion","version","installPackages","args","options","builtInAllowlist","usesStartup","DEFAULT_ALLOWED_SCRIPTS","allowScripts","resolveAllowScripts","quiet","logAllowedScripts","isCI","fix","Array","isArray","length","runRebuild","warnUntrustedInstallScripts","runProjectPostinstall","reset","parseLockFile","lockFilePath","getLockFilePath","undefined","JSON","parse","fs","readFileSync","packageName","packages","getLockFile","link","resolved","scripts","console","error","join","process","exitCode","lockFileName"],"mappings":"AAAA,6BAA6B;;;;+BAwBhBA;;;eAAAA;;;2DAvBE;uBAC+C;gCAE/B;wBAMxB;;;;;;;;;;;;;;;;;AAcA,MAAMA,0BAA0BC,8BAAc;IAIjDC,aAAa;QACTC,IAAAA,iBAAU,EAAC,IAAI,CAACC,OAAO,EAAE;YAAC;YAAS;YAAS;SAAU;IAC1D;IAEAC,mBAAmB,EACfC,gBAAgB,EAChBC,UAAU,EACVC,UAAU,EACS,EAAsB;;YAElCC,qBAAqCA;QAD5C,MAAMA,QAAQ,IAAI,CAACC,SAAS,CAAC;YAAEJ;YAAkBK,SAASJ;QAAW;QACrE,eAAOE,kBAAAA,6BAAAA,sBAAAA,MAAOG,YAAY,cAAnBH,0CAAAA,mBAAqB,CAACD,WAAW,uCAAIC,kBAAAA,6BAAAA,0BAAAA,MAAOI,gBAAgB,cAAvBJ,8CAAAA,uBAAyB,CAACD,WAAW;IACrF;IAEAM,mBAAmB,EAAER,gBAAgB,EAAEE,UAAU,EAAwB,EAAsB;YACpF;QAAP,QAAO,kBAAA,IAAI,CAACE,SAAS,CAAC;YAAEJ;YAAkBK,SAASH;QAAW,gBAAvD,sCAAA,gBAA2DO,OAAO;IAC7E;IAEAC,gBAAgBC,OAAoB,CAAC,CAAC,EAAEC,OAA0C,EAAE;YAEvCD;QADzC,MAAME,mBAAmBC,IAAAA,mBAAW,MAAKC,+BAAuB,GAAG,EAAE;QACrE,MAAMC,eAAeC,IAAAA,2BAAmB,GAACN,qBAAAA,KAAKK,YAAY,cAAjBL,gCAAAA,qBAAqB,EAAE,EAAEE;QAElE,IAAI,CAACF,KAAKO,KAAK,EAAE;YACbC,IAAAA,yBAAiB,EAACH,cAAcH;QACpC;QAEAhB,IAAAA,iBAAU,EACN,IAAI,CAACC,OAAO,EACZ;YACIsB,IAAAA,WAAI,MAAK,OAAO;YAChB;YACA;YACA;eACIJ,iBAAiB,OAAO;gBAAC;aAAmB,GAAG,EAAE;eACjDL,KAAKU,GAAG,GAAG;gBAAC;gBAAuB;aAAkB,GAAG,EAAE;SACjE,EACDT;QAGJ,IAAI;YACA,IAAID,KAAKU,GAAG,EAAE;gBACV;YACJ;YACA;;;;aAIC,GACD,IAAIC,MAAMC,OAAO,CAACP,iBAAiBA,aAAaQ,MAAM,GAAG,GAAG;gBACxD,IAAI,CAACC,UAAU,CAACT;YACpB;YACA;;;;aAIC,GACD,IAAIA,iBAAiB,OAAO;gBACxBU,IAAAA,kCAA2B,EACvBJ,MAAMC,OAAO,CAACP,gBAAgBA,eAAeH;YAErD;YACA;;;;aAIC,GACD,IAAIG,iBAAiB,MAAM;gBACvB,IAAI,CAACW,qBAAqB,CAACf;YAC/B;QACJ,SAAU;YACN,IAAI,CAACgB,KAAK;QACd;IACJ;IAEUC,gBAAyC;QAC/C,MAAMC,eAAe,IAAI,CAACC,eAAe;QACzC,IAAI,CAACD,cAAc;YACf,OAAOE;QACX;QACA,IAAI;YACA,OAAOC,KAAKC,KAAK,CAACC,WAAE,CAACC,YAAY,CAACN,cAAc;QACpD,EAAE,eAAM;YACJ,OAAOE;QACX;IACJ;IAEA;;;;;;;KAOC,GACD,AAAQ5B,UAAU,EACdJ,gBAAgB,EAChBK,SAASgC,WAAW,EAIvB,EAAgC;;YACZ;QAAjB,MAAMC,YAAW,oBAAA,IAAI,CAACC,WAAW,gBAAhB,wCAAA,kBAAoBD,QAAQ;QAC7C,MAAMnC,gBACFmC,qBAAAA,+BAAAA,QAAU,CAAC,GAAGtC,iBAAiB,cAAc,EAAEqC,aAAa,CAAC,uCAC7DC,qBAAAA,+BAAAA,QAAU,CAAC,CAAC,aAAa,EAAED,aAAa,CAAC;QAC7C,IAAIlC,CAAAA,kBAAAA,4BAAAA,MAAOqC,IAAI,KAAIrC,MAAMsC,QAAQ,EAAE;YAC/B,OAAOH,qBAAAA,+BAAAA,QAAU,CAACnC,MAAMsC,QAAQ,CAAC;QACrC;QACA,OAAOtC;IACX;IAEQsB,WAAWiB,OAAiB,EAAE;QAClC,IAAI;YACA7C,IAAAA,iBAAU,EAAC,IAAI,CAACC,OAAO,EAAE;gBAAC;mBAAc4C;aAAQ;QACpD,EAAE,eAAM;YACJC,QAAQC,KAAK,CAAC,CAAC,+BAA+B,EAAEF,QAAQG,IAAI,CAAC,OAAO;YACpEC,QAAQC,QAAQ,GAAG;QACvB;IACJ;IAEQpB,sBAAsBf,OAA0C,EAAE;QACtE,IAAI;YACAf,IAAAA,iBAAU,EAAC,IAAI,CAACC,OAAO,EAAE;gBAAC;gBAAO;gBAAe;aAAe,EAAEc;QACrE,EAAE,eAAM;YACJkC,QAAQC,QAAQ,GAAG;QACvB;IACJ;;QAjIG,gBACH,uBAASjD,WAAU,QACnB,uBAASkD,gBAAe;;AAgI5B"}

package/dist/package-manager/utils/index.d.ts

@@ -1,5 +1,5 @@
 export * from './log-allowed-scripts';
 export * from './parse-allow-scripts';
 export * from './resolve-allow-scripts';
-export * from './should-ignore-scripts';
+export * from './uses-startup';
 //# sourceMappingURL=index.d.ts.map

package/dist/package-manager/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/package-manager/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/package-manager/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,gBAAgB,CAAC"}

package/dist/package-manager/utils/index.js

@@ -5,7 +5,7 @@ Object.defineProperty(exports, "__esModule", {
 _export_star(require("./log-allowed-scripts"), exports);
 _export_star(require("./parse-allow-scripts"), exports);
 _export_star(require("./resolve-allow-scripts"), exports);
-_export_star(require("./should-ignore-scripts"), exports);
+_export_star(require("./uses-startup"), exports);
 function _export_star(from, to) {
     Object.keys(from).forEach(function(k) {
         if (k !== "default" && !Object.prototype.hasOwnProperty.call(to, k)) {

package/dist/package-manager/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/package-manager/utils/index.ts"],"sourcesContent":["export * from './log-allowed-scripts';\nexport * from './parse-allow-scripts';\nexport * from './resolve-allow-scripts';\nexport * from './should-ignore-scripts';\n"],"names":[],"mappings":";;;;qBAAc;qBACA;qBACA;qBACA"}
+{"version":3,"sources":["../../../src/package-manager/utils/index.ts"],"sourcesContent":["export * from './log-allowed-scripts';\nexport * from './parse-allow-scripts';\nexport * from './resolve-allow-scripts';\nexport * from './uses-startup';\n"],"names":[],"mappings":";;;;qBAAc;qBACA;qBACA;qBACA"}

package/dist/package-manager/utils/log-allowed-scripts.d.ts

@@ -1,3 +1,3 @@
 import type { AllowScripts } from '../package-manager';
-export declare function logAllowedScripts(allowScripts: AllowScripts): void;
+export declare function logAllowedScripts(allowScripts: AllowScripts, builtInAllowlist: string[]): void;
 //# sourceMappingURL=log-allowed-scripts.d.ts.map

package/dist/package-manager/utils/log-allowed-scripts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"log-allowed-scripts.d.ts","sourceRoot":"","sources":["../../../src/package-manager/utils/log-allowed-scripts.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,YAAY,QAY3D"}
+{"version":3,"file":"log-allowed-scripts.d.ts","sourceRoot":"","sources":["../../../src/package-manager/utils/log-allowed-scripts.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAgBvF"}

package/dist/package-manager/utils/log-allowed-scripts.js

@@ -8,8 +8,7 @@ Object.defineProperty(exports, "logAllowedScripts", {
         return logAllowedScripts;
     }
 });
-const _resolveallowscripts = require("./resolve-allow-scripts");
-function logAllowedScripts(allowScripts) {
+function logAllowedScripts(allowScripts, builtInAllowlist) {
     if (allowScripts === true) {
         console.log('Allowing all install scripts');
         return;
@@ -17,10 +16,12 @@ function logAllowedScripts(allowScripts) {
     if (allowScripts === false) {
         return;
     }
-    const extras = allowScripts.filter((s)=>!_resolveallowscripts.DEFAULT_ALLOWED_SCRIPTS.includes(s));
-    if (extras.length) {
-        console.log(`Allowing additional install scripts: ${extras.join(', ')}`);
+    const extras = allowScripts.filter((s)=>!builtInAllowlist.includes(s));
+    if (!extras.length) {
+        return;
     }
+    const label = builtInAllowlist.length ? 'Allowing additional install scripts' : 'Allowing install scripts';
+    console.log(`${label}: ${extras.join(', ')}`);
 }
 
 //# sourceMappingURL=log-allowed-scripts.js.map

package/dist/package-manager/utils/log-allowed-scripts.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/package-manager/utils/log-allowed-scripts.ts"],"sourcesContent":["/* eslint-disable no-console */\nimport type { AllowScripts } from '../package-manager';\nimport { DEFAULT_ALLOWED_SCRIPTS } from './resolve-allow-scripts';\n\nexport function logAllowedScripts(allowScripts: AllowScripts) {\n    if (allowScripts === true) {\n        console.log('Allowing all install scripts');\n        return;\n    }\n    if (allowScripts === false) {\n        return;\n    }\n    const extras = allowScripts.filter(s => !DEFAULT_ALLOWED_SCRIPTS.includes(s));\n    if (extras.length) {\n        console.log(`Allowing additional install scripts: ${extras.join(', ')}`);\n    }\n}\n"],"names":["logAllowedScripts","allowScripts","console","log","extras","filter","s","DEFAULT_ALLOWED_SCRIPTS","includes","length","join"],"mappings":"AAAA,6BAA6B;;;;+BAIbA;;;eAAAA;;;qCAFwB;AAEjC,SAASA,kBAAkBC,YAA0B;IACxD,IAAIA,iBAAiB,MAAM;QACvBC,QAAQC,GAAG,CAAC;QACZ;IACJ;IACA,IAAIF,iBAAiB,OAAO;QACxB;IACJ;IACA,MAAMG,SAASH,aAAaI,MAAM,CAACC,CAAAA,IAAK,CAACC,4CAAuB,CAACC,QAAQ,CAACF;IAC1E,IAAIF,OAAOK,MAAM,EAAE;QACfP,QAAQC,GAAG,CAAC,CAAC,qCAAqC,EAAEC,OAAOM,IAAI,CAAC,OAAO;IAC3E;AACJ"}
+{"version":3,"sources":["../../../src/package-manager/utils/log-allowed-scripts.ts"],"sourcesContent":["/* eslint-disable no-console */\nimport type { AllowScripts } from '../package-manager';\n\nexport function logAllowedScripts(allowScripts: AllowScripts, builtInAllowlist: string[]) {\n    if (allowScripts === true) {\n        console.log('Allowing all install scripts');\n        return;\n    }\n    if (allowScripts === false) {\n        return;\n    }\n    const extras = allowScripts.filter(s => !builtInAllowlist.includes(s));\n    if (!extras.length) {\n        return;\n    }\n    const label = builtInAllowlist.length\n        ? 'Allowing additional install scripts'\n        : 'Allowing install scripts';\n    console.log(`${label}: ${extras.join(', ')}`);\n}\n"],"names":["logAllowedScripts","allowScripts","builtInAllowlist","console","log","extras","filter","s","includes","length","label","join"],"mappings":"AAAA,6BAA6B;;;;+BAGbA;;;eAAAA;;;AAAT,SAASA,kBAAkBC,YAA0B,EAAEC,gBAA0B;IACpF,IAAID,iBAAiB,MAAM;QACvBE,QAAQC,GAAG,CAAC;QACZ;IACJ;IACA,IAAIH,iBAAiB,OAAO;QACxB;IACJ;IACA,MAAMI,SAASJ,aAAaK,MAAM,CAACC,CAAAA,IAAK,CAACL,iBAAiBM,QAAQ,CAACD;IACnE,IAAI,CAACF,OAAOI,MAAM,EAAE;QAChB;IACJ;IACA,MAAMC,QAAQR,iBAAiBO,MAAM,GAC/B,wCACA;IACNN,QAAQC,GAAG,CAAC,GAAGM,MAAM,EAAE,EAAEL,OAAOM,IAAI,CAAC,OAAO;AAChD"}

package/dist/package-manager/utils/resolve-allow-scripts.d.ts

@@ -1,4 +1,4 @@
 import type { AllowScripts } from '../package-manager';
 export declare const DEFAULT_ALLOWED_SCRIPTS: string[];
-export declare function resolveAllowScripts(value: AllowScripts): AllowScripts;
+export declare function resolveAllowScripts(value: AllowScripts, builtInAllowlist: string[]): AllowScripts;
 //# sourceMappingURL=resolve-allow-scripts.d.ts.map

package/dist/package-manager/utils/resolve-allow-scripts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-allow-scripts.d.ts","sourceRoot":"","sources":["../../../src/package-manager/utils/resolve-allow-scripts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,eAAO,MAAM,uBAAuB,UAMnC,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,GAAG,YAAY,CAKrE"}
+{"version":3,"file":"resolve-allow-scripts.d.ts","sourceRoot":"","sources":["../../../src/package-manager/utils/resolve-allow-scripts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,eAAO,MAAM,uBAAuB,UAMnC,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,YAAY,CAKjG"}

package/dist/package-manager/utils/resolve-allow-scripts.js

@@ -24,12 +24,12 @@ const DEFAULT_ALLOWED_SCRIPTS = [
     'nx',
     'tree-sitter'
 ];
-function resolveAllowScripts(value) {
+function resolveAllowScripts(value, builtInAllowlist) {
     if (value === true || value === false) {
         return value;
     }
     return [
-        ...DEFAULT_ALLOWED_SCRIPTS,
+        ...builtInAllowlist,
         ...(0, _parseallowscripts.parseAllowScripts)(value)
     ];
 }

package/dist/package-manager/utils/resolve-allow-scripts.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/package-manager/utils/resolve-allow-scripts.ts"],"sourcesContent":["import type { AllowScripts } from '../package-manager';\nimport { parseAllowScripts } from './parse-allow-scripts';\n\nexport const DEFAULT_ALLOWED_SCRIPTS = [\n    '@servicetitan/startup',\n    'cypress',\n    'msw',\n    'nx',\n    'tree-sitter',\n];\n\nexport function resolveAllowScripts(value: AllowScripts): AllowScripts {\n    if (value === true || value === false) {\n        return value;\n    }\n    return [...DEFAULT_ALLOWED_SCRIPTS, ...parseAllowScripts(value)];\n}\n"],"names":["DEFAULT_ALLOWED_SCRIPTS","resolveAllowScripts","value","parseAllowScripts"],"mappings":";;;;;;;;;;;QAGaA;eAAAA;;QAQGC;eAAAA;;;mCAVkB;AAE3B,MAAMD,0BAA0B;IACnC;IACA;IACA;IACA;IACA;CACH;AAEM,SAASC,oBAAoBC,KAAmB;IACnD,IAAIA,UAAU,QAAQA,UAAU,OAAO;QACnC,OAAOA;IACX;IACA,OAAO;WAAIF;WAA4BG,IAAAA,oCAAiB,EAACD;KAAO;AACpE"}
+{"version":3,"sources":["../../../src/package-manager/utils/resolve-allow-scripts.ts"],"sourcesContent":["import type { AllowScripts } from '../package-manager';\nimport { parseAllowScripts } from './parse-allow-scripts';\n\nexport const DEFAULT_ALLOWED_SCRIPTS = [\n    '@servicetitan/startup',\n    'cypress',\n    'msw',\n    'nx',\n    'tree-sitter',\n];\n\nexport function resolveAllowScripts(value: AllowScripts, builtInAllowlist: string[]): AllowScripts {\n    if (value === true || value === false) {\n        return value;\n    }\n    return [...builtInAllowlist, ...parseAllowScripts(value)];\n}\n"],"names":["DEFAULT_ALLOWED_SCRIPTS","resolveAllowScripts","value","builtInAllowlist","parseAllowScripts"],"mappings":";;;;;;;;;;;QAGaA;eAAAA;;QAQGC;eAAAA;;;mCAVkB;AAE3B,MAAMD,0BAA0B;IACnC;IACA;IACA;IACA;IACA;CACH;AAEM,SAASC,oBAAoBC,KAAmB,EAAEC,gBAA0B;IAC/E,IAAID,UAAU,QAAQA,UAAU,OAAO;QACnC,OAAOA;IACX;IACA,OAAO;WAAIC;WAAqBC,IAAAA,oCAAiB,EAACF;KAAO;AAC7D"}

package/dist/package-manager/utils/uses-startup.d.ts

@@ -0,0 +1,2 @@
+export declare function usesStartup(): boolean;
+//# sourceMappingURL=uses-startup.d.ts.map

package/dist/package-manager/utils/uses-startup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"uses-startup.d.ts","sourceRoot":"","sources":["../../../src/package-manager/utils/uses-startup.ts"],"names":[],"mappings":"AAIA,wBAAgB,WAAW,IAAI,OAAO,CAOrC"}

package/dist/package-manager/utils/uses-startup.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "usesStartup", {
+    enumerable: true,
+    get: function() {
+        return usesStartup;
+    }
+});
+const _utils = require("../../utils");
+const STARTUP_PACKAGE = '@servicetitan/startup';
+function usesStartup() {
+    var _ref, _ref1;
+    var _packageJson_dependencies, _packageJson_devDependencies, _packageJson_peerDependencies;
+    const packageJson = (0, _utils.getWorkspaceRootPackageJson)();
+    return !!((_ref = (_ref1 = packageJson === null || packageJson === void 0 ? void 0 : (_packageJson_dependencies = packageJson.dependencies) === null || _packageJson_dependencies === void 0 ? void 0 : _packageJson_dependencies[STARTUP_PACKAGE]) !== null && _ref1 !== void 0 ? _ref1 : packageJson === null || packageJson === void 0 ? void 0 : (_packageJson_devDependencies = packageJson.devDependencies) === null || _packageJson_devDependencies === void 0 ? void 0 : _packageJson_devDependencies[STARTUP_PACKAGE]) !== null && _ref !== void 0 ? _ref : packageJson === null || packageJson === void 0 ? void 0 : (_packageJson_peerDependencies = packageJson.peerDependencies) === null || _packageJson_peerDependencies === void 0 ? void 0 : _packageJson_peerDependencies[STARTUP_PACKAGE]);
+}
+
+//# sourceMappingURL=uses-startup.js.map

package/dist/package-manager/utils/uses-startup.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/package-manager/utils/uses-startup.ts"],"sourcesContent":["import { getWorkspaceRootPackageJson } from '../../utils';\n\nconst STARTUP_PACKAGE = '@servicetitan/startup';\n\nexport function usesStartup(): boolean {\n    const packageJson = getWorkspaceRootPackageJson();\n    return !!(\n        packageJson?.dependencies?.[STARTUP_PACKAGE] ??\n        packageJson?.devDependencies?.[STARTUP_PACKAGE] ??\n        packageJson?.peerDependencies?.[STARTUP_PACKAGE]\n    );\n}\n"],"names":["usesStartup","STARTUP_PACKAGE","packageJson","getWorkspaceRootPackageJson","dependencies","devDependencies","peerDependencies"],"mappings":";;;;+BAIgBA;;;eAAAA;;;uBAJ4B;AAE5C,MAAMC,kBAAkB;AAEjB,SAASD;QAGRE;QAAAA,2BACAA,8BACAA;IAJJ,MAAMA,cAAcC,IAAAA,kCAA2B;IAC/C,OAAO,CAAC,GACJD,gBAAAA,wBAAAA,mCAAAA,4BAAAA,YAAaE,YAAY,cAAzBF,gDAAAA,yBAA2B,CAACD,gBAAgB,yCAC5CC,wBAAAA,mCAAAA,+BAAAA,YAAaG,eAAe,cAA5BH,mDAAAA,4BAA8B,CAACD,gBAAgB,cAD/CC,kBAAAA,OAEAA,wBAAAA,mCAAAA,gCAAAA,YAAaI,gBAAgB,cAA7BJ,oDAAAA,6BAA+B,CAACD,gBAAgB;AAExD"}

package/dist/utils/find-workspace-root.d.ts

@@ -0,0 +1,2 @@
+export declare function findWorkspaceRoot(): string | undefined;
+//# sourceMappingURL=find-workspace-root.d.ts.map

package/dist/utils/find-workspace-root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-workspace-root.d.ts","sourceRoot":"","sources":["../../src/utils/find-workspace-root.ts"],"names":[],"mappings":"AAKA,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,SAAS,CActD"}

package/dist/utils/find-workspace-root.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "findWorkspaceRoot", {
+    enumerable: true,
+    get: function() {
+        return findWorkspaceRoot;
+    }
+});
+const _nodefs = /*#__PURE__*/ _interop_require_default(require("node:fs"));
+const _nodepath = /*#__PURE__*/ _interop_require_default(require("node:path"));
+const _findup = require("./find-up");
+const _readjson = require("./read-json");
+function _interop_require_default(obj) {
+    return obj && obj.__esModule ? obj : {
+        default: obj
+    };
+}
+function findWorkspaceRoot() {
+    return (0, _findup.findUp)((directory)=>{
+        var _readJsonSafe, _readJsonSafe1;
+        if ((_readJsonSafe = (0, _readjson.readJsonSafe)(_nodepath.default.join(directory, 'package.json'))) === null || _readJsonSafe === void 0 ? void 0 : _readJsonSafe.workspaces) {
+            return directory;
+        }
+        if (_nodefs.default.existsSync(_nodepath.default.join(directory, 'pnpm-workspace.yaml'))) {
+            return directory;
+        }
+        if ((_readJsonSafe1 = (0, _readjson.readJsonSafe)(_nodepath.default.join(directory, 'lerna.json'))) === null || _readJsonSafe1 === void 0 ? void 0 : _readJsonSafe1.packages) {
+            return directory;
+        }
+    });
+}
+
+//# sourceMappingURL=find-workspace-root.js.map

package/dist/utils/find-workspace-root.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utils/find-workspace-root.ts"],"sourcesContent":["import fs from 'node:fs';\nimport path from 'node:path';\nimport { findUp } from './find-up';\nimport { readJsonSafe } from './read-json';\n\nexport function findWorkspaceRoot(): string | undefined {\n    return findUp(directory => {\n        if (\n            readJsonSafe<{ workspaces?: unknown }>(path.join(directory, 'package.json'))?.workspaces\n        ) {\n            return directory;\n        }\n        if (fs.existsSync(path.join(directory, 'pnpm-workspace.yaml'))) {\n            return directory;\n        }\n        if (readJsonSafe<{ packages?: unknown }>(path.join(directory, 'lerna.json'))?.packages) {\n            return directory;\n        }\n    });\n}\n"],"names":["findWorkspaceRoot","findUp","directory","readJsonSafe","path","join","workspaces","fs","existsSync","packages"],"mappings":";;;;+BAKgBA;;;eAAAA;;;+DALD;iEACE;wBACM;0BACM;;;;;;AAEtB,SAASA;IACZ,OAAOC,IAAAA,cAAM,EAACC,CAAAA;YAENC,eAOAA;QARJ,KACIA,gBAAAA,IAAAA,sBAAY,EAA2BC,iBAAI,CAACC,IAAI,CAACH,WAAW,8BAA5DC,oCAAAA,cAA8EG,UAAU,EAC1F;YACE,OAAOJ;QACX;QACA,IAAIK,eAAE,CAACC,UAAU,CAACJ,iBAAI,CAACC,IAAI,CAACH,WAAW,yBAAyB;YAC5D,OAAOA;QACX;QACA,KAAIC,iBAAAA,IAAAA,sBAAY,EAAyBC,iBAAI,CAACC,IAAI,CAACH,WAAW,4BAA1DC,qCAAAA,eAA0EM,QAAQ,EAAE;YACpF,OAAOP;QACX;IACJ;AACJ"}

package/dist/utils/get-workspace-root-package-json.d.ts

@@ -0,0 +1,10 @@
+export interface PackageJson {
+    cli?: {
+        packageManager?: string;
+    };
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+    peerDependencies?: Record<string, string>;
+}
+export declare function getWorkspaceRootPackageJson(): PackageJson | undefined;
+//# sourceMappingURL=get-workspace-root-package-json.d.ts.map

package/dist/utils/get-workspace-root-package-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-workspace-root-package-json.d.ts","sourceRoot":"","sources":["../../src/utils/get-workspace-root-package-json.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,WAAW;IACxB,GAAG,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAKD,wBAAgB,2BAA2B,IAAI,WAAW,GAAG,SAAS,CAOrE"}

package/dist/utils/get-workspace-root-package-json.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "getWorkspaceRootPackageJson", {
+    enumerable: true,
+    get: function() {
+        return getWorkspaceRootPackageJson;
+    }
+});
+const _nodepath = /*#__PURE__*/ _interop_require_default(require("node:path"));
+const _findworkspaceroot = require("./find-workspace-root");
+const _readjson = require("./read-json");
+function _interop_require_default(obj) {
+    return obj && obj.__esModule ? obj : {
+        default: obj
+    };
+}
+let rootPackageJson;
+let rootPackageJsonLoaded = false;
+function getWorkspaceRootPackageJson() {
+    if (!rootPackageJsonLoaded) {
+        var _findWorkspaceRoot;
+        const root = (_findWorkspaceRoot = (0, _findworkspaceroot.findWorkspaceRoot)()) !== null && _findWorkspaceRoot !== void 0 ? _findWorkspaceRoot : _nodepath.default.resolve('./');
+        rootPackageJson = (0, _readjson.readJsonSafe)(_nodepath.default.join(root, 'package.json'));
+        rootPackageJsonLoaded = true;
+    }
+    return rootPackageJson;
+}
+
+//# sourceMappingURL=get-workspace-root-package-json.js.map

package/dist/utils/get-workspace-root-package-json.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utils/get-workspace-root-package-json.ts"],"sourcesContent":["import path from 'node:path';\nimport { findWorkspaceRoot } from './find-workspace-root';\nimport { readJsonSafe } from './read-json';\n\nexport interface PackageJson {\n    cli?: { packageManager?: string };\n    dependencies?: Record<string, string>;\n    devDependencies?: Record<string, string>;\n    peerDependencies?: Record<string, string>;\n}\n\nlet rootPackageJson: PackageJson | undefined;\nlet rootPackageJsonLoaded = false;\n\nexport function getWorkspaceRootPackageJson(): PackageJson | undefined {\n    if (!rootPackageJsonLoaded) {\n        const root = findWorkspaceRoot() ?? path.resolve('./');\n        rootPackageJson = readJsonSafe<PackageJson>(path.join(root, 'package.json'));\n        rootPackageJsonLoaded = true;\n    }\n    return rootPackageJson;\n}\n"],"names":["getWorkspaceRootPackageJson","rootPackageJson","rootPackageJsonLoaded","findWorkspaceRoot","root","path","resolve","readJsonSafe","join"],"mappings":";;;;+BAcgBA;;;eAAAA;;;iEAdC;mCACiB;0BACL;;;;;;AAS7B,IAAIC;AACJ,IAAIC,wBAAwB;AAErB,SAASF;IACZ,IAAI,CAACE,uBAAuB;YACXC;QAAb,MAAMC,QAAOD,qBAAAA,IAAAA,oCAAiB,iBAAjBA,gCAAAA,qBAAuBE,iBAAI,CAACC,OAAO,CAAC;QACjDL,kBAAkBM,IAAAA,sBAAY,EAAcF,iBAAI,CAACG,IAAI,CAACJ,MAAM;QAC5DF,wBAAwB;IAC5B;IACA,OAAOD;AACX"}

package/dist/utils/index.d.ts

@@ -3,6 +3,7 @@ export * from './debug';
 export * from './find-up';
 export * from './get-packages-with-install-scripts';
 export * from './get-version';
+export * from './get-workspace-root-package-json';
 export * from './git';
 export * from './npm';
 export * from './os';

package/dist/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,MAAM,CAAC;AACrB,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,qCAAqC,CAAC;AACpD,cAAc,eAAe,CAAC;AAC9B,cAAc,OAAO,CAAC;AACtB,cAAc,OAAO,CAAC;AACtB,cAAc,MAAM,CAAC;AACrB,cAAc,aAAa,CAAC;AAC5B,cAAc,kCAAkC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,MAAM,CAAC;AACrB,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,qCAAqC,CAAC;AACpD,cAAc,eAAe,CAAC;AAC9B,cAAc,mCAAmC,CAAC;AAClD,cAAc,OAAO,CAAC;AACtB,cAAc,OAAO,CAAC;AACtB,cAAc,MAAM,CAAC;AACrB,cAAc,aAAa,CAAC;AAC5B,cAAc,kCAAkC,CAAC"}

package/dist/utils/index.js

@@ -7,6 +7,7 @@ _export_star(require("./debug"), exports);
 _export_star(require("./find-up"), exports);
 _export_star(require("./get-packages-with-install-scripts"), exports);
 _export_star(require("./get-version"), exports);
+_export_star(require("./get-workspace-root-package-json"), exports);
 _export_star(require("./git"), exports);
 _export_star(require("./npm"), exports);
 _export_star(require("./os"), exports);

package/dist/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/index.ts"],"sourcesContent":["export * from './ci';\nexport * from './debug';\nexport * from './find-up';\nexport * from './get-packages-with-install-scripts';\nexport * from './get-version';\nexport * from './git';\nexport * from './npm';\nexport * from './os';\nexport * from './read-json';\nexport * from './warn-untrusted-install-scripts';\n"],"names":[],"mappings":";;;;qBAAc;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA"}
+{"version":3,"sources":["../../src/utils/index.ts"],"sourcesContent":["export * from './ci';\nexport * from './debug';\nexport * from './find-up';\nexport * from './get-packages-with-install-scripts';\nexport * from './get-version';\nexport * from './get-workspace-root-package-json';\nexport * from './git';\nexport * from './npm';\nexport * from './os';\nexport * from './read-json';\nexport * from './warn-untrusted-install-scripts';\n"],"names":[],"mappings":";;;;qBAAc;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@servicetitan/install",
-    "version": "38.1.0",
+    "version": "38.2.0",
     "description": "Lightweight wrapper around npm install that configures access to private packages",
     "homepage": "https://docs.st.dev/docs/frontend/uikit/install",
     "repository": {
@@ -30,7 +30,7 @@
         "webpack": false
     },
     "peerDependencies": {
-        "js-yaml": "~5.2.1"
+        "js-yaml": "~5.2.2"
     },
     "peerDependenciesMeta": {
         "js-yaml": {
@@ -40,5 +40,5 @@
     "devDependencies": {
         "ts-node": "~10.9.2"
     },
-    "gitHead": "e8c601a26ad49ca0d6b0b84a9f530f3242d53c7f"
+    "gitHead": "fd8cf00982a529371e44d76a0ca455dbbb42bae5"
 }

package/src/package-manager/get-package-manager.ts

@@ -1,12 +1,10 @@
-import fs from 'fs';
-import path from 'path';
-import { findUp, readJsonSafe } from '../utils';
+import { getWorkspaceRootPackageJson } from '../utils';
 import { NpmPackageManager } from './npm-package-manager';
 import type { PackageManager } from './package-manager';
 import { PnpmPackageManager } from './pnpm-package-manager';
 
 export function getPackageManager(): PackageManager {
-    const name = readPackageManagerName();
+    const name = getWorkspaceRootPackageJson()?.cli?.packageManager ?? 'npm';
     switch (name) {
         case 'npm':
             return new NpmPackageManager();
@@ -16,27 +14,3 @@ export function getPackageManager(): PackageManager {
             throw new Error(`Unsupported package manager: ${name}`);
     }
 }
-
-function readPackageManagerName(): string {
-    const root = findWorkspaceRoot() ?? path.resolve('./');
-    const packageJson = readJsonSafe<{ cli?: { packageManager?: string } }>(
-        path.join(root, 'package.json')
-    );
-    return packageJson?.cli?.packageManager ?? 'npm';
-}
-
-function findWorkspaceRoot(): string | undefined {
-    return findUp(directory => {
-        if (
-            readJsonSafe<{ workspaces?: unknown }>(path.join(directory, 'package.json'))?.workspaces
-        ) {
-            return directory;
-        }
-        if (fs.existsSync(path.join(directory, 'pnpm-workspace.yaml'))) {
-            return directory;
-        }
-        if (readJsonSafe<{ packages?: unknown }>(path.join(directory, 'lerna.json'))?.packages) {
-            return directory;
-        }
-    });
-}

package/src/package-manager/npm-package-manager.ts

@@ -7,7 +7,7 @@ import {
     DEFAULT_ALLOWED_SCRIPTS,
     logAllowedScripts,
     resolveAllowScripts,
-    shouldIgnoreScripts,
+    usesStartup,
 } from './utils';
 
 interface NpmLockFileEntry {
@@ -44,10 +44,11 @@ export class NpmPackageManager extends PackageManager<NpmLockFile> {
     }
 
     installPackages(args: InstallArgs = {}, options?: Parameters<typeof runCommand>[2]) {
-        const allowScripts = resolveAllowScripts(args.allowScripts ?? []);
+        const builtInAllowlist = usesStartup() ? DEFAULT_ALLOWED_SCRIPTS : [];
+        const allowScripts = resolveAllowScripts(args.allowScripts ?? [], builtInAllowlist);
 
         if (!args.quiet) {
-            logAllowedScripts(allowScripts);
+            logAllowedScripts(allowScripts, builtInAllowlist);
         }
 
         runCommand(
@@ -57,7 +58,7 @@ export class NpmPackageManager extends PackageManager<NpmLockFile> {
                 '--audit=false',
                 '--fund=false',
                 '--legacy-peer-deps',
-                ...(shouldIgnoreScripts(allowScripts) ? ['--ignore-scripts'] : []),
+                ...(allowScripts !== true ? ['--ignore-scripts'] : []),
                 ...(args.fix ? ['--package-lock-only', '--prefer-dedupe'] : []),
             ],
             options
@@ -68,11 +69,11 @@ export class NpmPackageManager extends PackageManager<NpmLockFile> {
                 return;
             }
             /*
-             * Rebuild applies when allowScripts is an explicit list:
+             * Rebuild applies when allowScripts is a non-empty explicit list:
              * `true` means npm install already ran every script, `false`
              * means the user opted out.
              */
-            if (Array.isArray(allowScripts)) {
+            if (Array.isArray(allowScripts) && allowScripts.length > 0) {
                 this.runRebuild(allowScripts);
             }
             /*
@@ -82,7 +83,7 @@ export class NpmPackageManager extends PackageManager<NpmLockFile> {
              */
             if (allowScripts !== false) {
                 warnUntrustedInstallScripts(
-                    Array.isArray(allowScripts) ? allowScripts : DEFAULT_ALLOWED_SCRIPTS
+                    Array.isArray(allowScripts) ? allowScripts : builtInAllowlist
                 );
             }
             /*

package/src/package-manager/utils/index.ts

@@ -1,4 +1,4 @@
 export * from './log-allowed-scripts';
 export * from './parse-allow-scripts';
 export * from './resolve-allow-scripts';
-export * from './should-ignore-scripts';
+export * from './uses-startup';

package/src/package-manager/utils/log-allowed-scripts.ts

@@ -1,8 +1,7 @@
 /* eslint-disable no-console */
 import type { AllowScripts } from '../package-manager';
-import { DEFAULT_ALLOWED_SCRIPTS } from './resolve-allow-scripts';
 
-export function logAllowedScripts(allowScripts: AllowScripts) {
+export function logAllowedScripts(allowScripts: AllowScripts, builtInAllowlist: string[]) {
     if (allowScripts === true) {
         console.log('Allowing all install scripts');
         return;
@@ -10,8 +9,12 @@ export function logAllowedScripts(allowScripts: AllowScripts) {
     if (allowScripts === false) {
         return;
     }
-    const extras = allowScripts.filter(s => !DEFAULT_ALLOWED_SCRIPTS.includes(s));
-    if (extras.length) {
-        console.log(`Allowing additional install scripts: ${extras.join(', ')}`);
+    const extras = allowScripts.filter(s => !builtInAllowlist.includes(s));
+    if (!extras.length) {
+        return;
     }
+    const label = builtInAllowlist.length
+        ? 'Allowing additional install scripts'
+        : 'Allowing install scripts';
+    console.log(`${label}: ${extras.join(', ')}`);
 }

package/src/package-manager/utils/resolve-allow-scripts.ts

@@ -9,9 +9,9 @@ export const DEFAULT_ALLOWED_SCRIPTS = [
     'tree-sitter',
 ];
 
-export function resolveAllowScripts(value: AllowScripts): AllowScripts {
+export function resolveAllowScripts(value: AllowScripts, builtInAllowlist: string[]): AllowScripts {
     if (value === true || value === false) {
         return value;
     }
-    return [...DEFAULT_ALLOWED_SCRIPTS, ...parseAllowScripts(value)];
+    return [...builtInAllowlist, ...parseAllowScripts(value)];
 }

package/src/package-manager/utils/uses-startup.ts

@@ -0,0 +1,12 @@
+import { getWorkspaceRootPackageJson } from '../../utils';
+
+const STARTUP_PACKAGE = '@servicetitan/startup';
+
+export function usesStartup(): boolean {
+    const packageJson = getWorkspaceRootPackageJson();
+    return !!(
+        packageJson?.dependencies?.[STARTUP_PACKAGE] ??
+        packageJson?.devDependencies?.[STARTUP_PACKAGE] ??
+        packageJson?.peerDependencies?.[STARTUP_PACKAGE]
+    );
+}

package/src/utils/find-workspace-root.ts

@@ -0,0 +1,20 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { findUp } from './find-up';
+import { readJsonSafe } from './read-json';
+
+export function findWorkspaceRoot(): string | undefined {
+    return findUp(directory => {
+        if (
+            readJsonSafe<{ workspaces?: unknown }>(path.join(directory, 'package.json'))?.workspaces
+        ) {
+            return directory;
+        }
+        if (fs.existsSync(path.join(directory, 'pnpm-workspace.yaml'))) {
+            return directory;
+        }
+        if (readJsonSafe<{ packages?: unknown }>(path.join(directory, 'lerna.json'))?.packages) {
+            return directory;
+        }
+    });
+}

package/src/utils/get-workspace-root-package-json.ts

@@ -0,0 +1,22 @@
+import path from 'node:path';
+import { findWorkspaceRoot } from './find-workspace-root';
+import { readJsonSafe } from './read-json';
+
+export interface PackageJson {
+    cli?: { packageManager?: string };
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+    peerDependencies?: Record<string, string>;
+}
+
+let rootPackageJson: PackageJson | undefined;
+let rootPackageJsonLoaded = false;
+
+export function getWorkspaceRootPackageJson(): PackageJson | undefined {
+    if (!rootPackageJsonLoaded) {
+        const root = findWorkspaceRoot() ?? path.resolve('./');
+        rootPackageJson = readJsonSafe<PackageJson>(path.join(root, 'package.json'));
+        rootPackageJsonLoaded = true;
+    }
+    return rootPackageJson;
+}

package/src/utils/index.ts

@@ -3,6 +3,7 @@ export * from './debug';
 export * from './find-up';
 export * from './get-packages-with-install-scripts';
 export * from './get-version';
+export * from './get-workspace-root-package-json';
 export * from './git';
 export * from './npm';
 export * from './os';

package/dist/package-manager/utils/should-ignore-scripts.d.ts

@@ -1,3 +0,0 @@
-import type { AllowScripts } from '../package-manager';
-export declare function shouldIgnoreScripts(allowScripts: AllowScripts): boolean;
-//# sourceMappingURL=should-ignore-scripts.d.ts.map

package/dist/package-manager/utils/should-ignore-scripts.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"should-ignore-scripts.d.ts","sourceRoot":"","sources":["../../../src/package-manager/utils/should-ignore-scripts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,YAAY,GAAG,OAAO,CAQvE"}

package/dist/package-manager/utils/should-ignore-scripts.js

@@ -1,21 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "shouldIgnoreScripts", {
-    enumerable: true,
-    get: function() {
-        return shouldIgnoreScripts;
-    }
-});
-function shouldIgnoreScripts(allowScripts) {
-    if (allowScripts === true) {
-        return false;
-    }
-    if (allowScripts === false) {
-        return true;
-    }
-    return allowScripts.length > 0;
-}
-
-//# sourceMappingURL=should-ignore-scripts.js.map

package/dist/package-manager/utils/should-ignore-scripts.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/package-manager/utils/should-ignore-scripts.ts"],"sourcesContent":["import type { AllowScripts } from '../package-manager';\n\nexport function shouldIgnoreScripts(allowScripts: AllowScripts): boolean {\n    if (allowScripts === true) {\n        return false;\n    }\n    if (allowScripts === false) {\n        return true;\n    }\n    return allowScripts.length > 0;\n}\n"],"names":["shouldIgnoreScripts","allowScripts","length"],"mappings":";;;;+BAEgBA;;;eAAAA;;;AAAT,SAASA,oBAAoBC,YAA0B;IAC1D,IAAIA,iBAAiB,MAAM;QACvB,OAAO;IACX;IACA,IAAIA,iBAAiB,OAAO;QACxB,OAAO;IACX;IACA,OAAOA,aAAaC,MAAM,GAAG;AACjC"}

package/src/package-manager/utils/should-ignore-scripts.ts

@@ -1,11 +0,0 @@
-import type { AllowScripts } from '../package-manager';
-
-export function shouldIgnoreScripts(allowScripts: AllowScripts): boolean {
-    if (allowScripts === true) {
-        return false;
-    }
-    if (allowScripts === false) {
-        return true;
-    }
-    return allowScripts.length > 0;
-}