@servicetitan/install 39.3.0 → 40.1.0

package/dist/package-manager/utils/resolve-allow-scripts.d.ts

@@ -1,4 +1,3 @@
 import type { AllowScripts } from '../package-manager';
-export declare const DEFAULT_ALLOWED_SCRIPTS: string[];
 export declare function resolveAllowScripts(value: AllowScripts, builtInAllowlist: string[]): AllowScripts;
 //# sourceMappingURL=resolve-allow-scripts.d.ts.map

package/dist/package-manager/utils/resolve-allow-scripts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-allow-scripts.d.ts","sourceRoot":"","sources":["../../../src/package-manager/utils/resolve-allow-scripts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,eAAO,MAAM,uBAAuB,UAMnC,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,YAAY,CAKjG"}
+{"version":3,"file":"resolve-allow-scripts.d.ts","sourceRoot":"","sources":["../../../src/package-manager/utils/resolve-allow-scripts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,YAAY,CAKjG"}

package/dist/package-manager/utils/resolve-allow-scripts.js

@@ -2,28 +2,13 @@
 Object.defineProperty(exports, "__esModule", {
     value: true
 });
-function _export(target, all) {
-    for(var name in all)Object.defineProperty(target, name, {
-        enumerable: true,
-        get: Object.getOwnPropertyDescriptor(all, name).get
-    });
-}
-_export(exports, {
-    get DEFAULT_ALLOWED_SCRIPTS () {
-        return DEFAULT_ALLOWED_SCRIPTS;
-    },
-    get resolveAllowScripts () {
+Object.defineProperty(exports, "resolveAllowScripts", {
+    enumerable: true,
+    get: function() {
         return resolveAllowScripts;
     }
 });
 const _parseallowscripts = require("./parse-allow-scripts");
-const DEFAULT_ALLOWED_SCRIPTS = [
-    '@servicetitan/startup',
-    'cypress',
-    'msw',
-    'nx',
-    'tree-sitter'
-];
 function resolveAllowScripts(value, builtInAllowlist) {
     if (value === true || value === false) {
         return value;

package/dist/package-manager/utils/resolve-allow-scripts.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/package-manager/utils/resolve-allow-scripts.ts"],"sourcesContent":["import type { AllowScripts } from '../package-manager';\nimport { parseAllowScripts } from './parse-allow-scripts';\n\nexport const DEFAULT_ALLOWED_SCRIPTS = [\n    '@servicetitan/startup',\n    'cypress',\n    'msw',\n    'nx',\n    'tree-sitter',\n];\n\nexport function resolveAllowScripts(value: AllowScripts, builtInAllowlist: string[]): AllowScripts {\n    if (value === true || value === false) {\n        return value;\n    }\n    return [...builtInAllowlist, ...parseAllowScripts(value)];\n}\n"],"names":["DEFAULT_ALLOWED_SCRIPTS","resolveAllowScripts","value","builtInAllowlist","parseAllowScripts"],"mappings":";;;;;;;;;;;QAGaA;eAAAA;;QAQGC;eAAAA;;;mCAVkB;AAE3B,MAAMD,0BAA0B;IACnC;IACA;IACA;IACA;IACA;CACH;AAEM,SAASC,oBAAoBC,KAAmB,EAAEC,gBAA0B;IAC/E,IAAID,UAAU,QAAQA,UAAU,OAAO;QACnC,OAAOA;IACX;IACA,OAAO;WAAIC;WAAqBC,IAAAA,oCAAiB,EAACF;KAAO;AAC7D"}
+{"version":3,"sources":["../../../src/package-manager/utils/resolve-allow-scripts.ts"],"sourcesContent":["import type { AllowScripts } from '../package-manager';\nimport { parseAllowScripts } from './parse-allow-scripts';\n\nexport function resolveAllowScripts(value: AllowScripts, builtInAllowlist: string[]): AllowScripts {\n    if (value === true || value === false) {\n        return value;\n    }\n    return [...builtInAllowlist, ...parseAllowScripts(value)];\n}\n"],"names":["resolveAllowScripts","value","builtInAllowlist","parseAllowScripts"],"mappings":";;;;+BAGgBA;;;eAAAA;;;mCAFkB;AAE3B,SAASA,oBAAoBC,KAAmB,EAAEC,gBAA0B;IAC/E,IAAID,UAAU,QAAQA,UAAU,OAAO;QACnC,OAAOA;IACX;IACA,OAAO;WAAIC;WAAqBC,IAAAA,oCAAiB,EAACF;KAAO;AAC7D"}

package/dist/package-manager/utils/resolve-min-release-age.d.ts

@@ -0,0 +1,6 @@
+export interface ResolvedMinReleaseAge {
+    days: number;
+    exclude: string[];
+}
+export declare function resolveMinReleaseAge(minReleaseAge: false | undefined): ResolvedMinReleaseAge | false;
+//# sourceMappingURL=resolve-min-release-age.d.ts.map

package/dist/package-manager/utils/resolve-min-release-age.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-min-release-age.d.ts","sourceRoot":"","sources":["../../../src/package-manager/utils/resolve-min-release-age.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,qBAAqB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,wBAAgB,oBAAoB,CAChC,aAAa,EAAE,KAAK,GAAG,SAAS,GACjC,qBAAqB,GAAG,KAAK,CAK/B"}

package/dist/package-manager/utils/resolve-min-release-age.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "resolveMinReleaseAge", {
+    enumerable: true,
+    get: function() {
+        return resolveMinReleaseAge;
+    }
+});
+const DEFAULT_MIN_RELEASE_AGE_DAYS = 3;
+const DEFAULT_MIN_RELEASE_AGE_EXCLUDE = [
+    '@servicetitan/*'
+];
+function resolveMinReleaseAge(minReleaseAge) {
+    if (minReleaseAge === false) {
+        return false;
+    }
+    return {
+        days: DEFAULT_MIN_RELEASE_AGE_DAYS,
+        exclude: DEFAULT_MIN_RELEASE_AGE_EXCLUDE
+    };
+}
+
+//# sourceMappingURL=resolve-min-release-age.js.map

package/dist/package-manager/utils/resolve-min-release-age.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/package-manager/utils/resolve-min-release-age.ts"],"sourcesContent":["const DEFAULT_MIN_RELEASE_AGE_DAYS = 3;\nconst DEFAULT_MIN_RELEASE_AGE_EXCLUDE = ['@servicetitan/*'];\n\nexport interface ResolvedMinReleaseAge {\n    days: number;\n    exclude: string[];\n}\n\nexport function resolveMinReleaseAge(\n    minReleaseAge: false | undefined\n): ResolvedMinReleaseAge | false {\n    if (minReleaseAge === false) {\n        return false;\n    }\n    return { days: DEFAULT_MIN_RELEASE_AGE_DAYS, exclude: DEFAULT_MIN_RELEASE_AGE_EXCLUDE };\n}\n"],"names":["resolveMinReleaseAge","DEFAULT_MIN_RELEASE_AGE_DAYS","DEFAULT_MIN_RELEASE_AGE_EXCLUDE","minReleaseAge","days","exclude"],"mappings":";;;;+BAQgBA;;;eAAAA;;;AARhB,MAAMC,+BAA+B;AACrC,MAAMC,kCAAkC;IAAC;CAAkB;AAOpD,SAASF,qBACZG,aAAgC;IAEhC,IAAIA,kBAAkB,OAAO;QACzB,OAAO;IACX;IACA,OAAO;QAAEC,MAAMH;QAA8BI,SAASH;IAAgC;AAC1F"}

package/dist/utils/audited-scripts.d.ts

@@ -0,0 +1,8 @@
+export interface AuditedScript {
+    name: string;
+    action: 'allow' | 'ignore';
+    maximumVersion?: string;
+    note?: string;
+}
+export declare const AUDITED_SCRIPTS: AuditedScript[];
+//# sourceMappingURL=audited-scripts.d.ts.map

package/dist/utils/audited-scripts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audited-scripts.d.ts","sourceRoot":"","sources":["../../src/utils/audited-scripts.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,eAAe,EAAE,aAAa,EAoF1C,CAAC"}

package/dist/utils/audited-scripts.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "AUDITED_SCRIPTS", {
+    enumerable: true,
+    get: function() {
+        return AUDITED_SCRIPTS;
+    }
+});
+const AUDITED_SCRIPTS = [
+    // Trusted to run their install scripts, up to the audited version.
+    ...[
+        {
+            name: '@servicetitan/startup',
+            note: 'Applies patch-package patches to installed dependencies'
+        },
+        {
+            name: 'cypress',
+            maximumVersion: '16.1.1',
+            note: "Downloads Cypress's platform-specific test runner binary"
+        },
+        {
+            name: 'msw',
+            maximumVersion: '3.0.1',
+            note: 'No install script at all since 3.0.0; worker regeneration moved to the manual `msw init` CLI command instead of running automatically on install. Ceiling bumped anyway to prevent audit workflow from flagging old version'
+        },
+        {
+            name: 'nx',
+            maximumVersion: '23.2.1',
+            note: 'Verifies native platform support and updates the Nx Cloud client if the workspace uses Nx Cloud'
+        },
+        {
+            name: 'tree-sitter',
+            maximumVersion: '0.25.1',
+            note: 'Installs a prebuilt native binary via node-gyp-build, compiling from source as a fallback'
+        }
+    ].map((entry)=>({
+            ...entry,
+            action: 'allow'
+        })),
+    // Have install scripts, but don't need them to function correctly.
+    ...[
+        {
+            name: '@parcel/watcher',
+            note: 'Installs platform-specific binary via optionalDependencies, install script is a legacy fallback'
+        },
+        {
+            name: '@progress/kendo-licensing',
+            note: 'Validates Kendo UI license key, not needed for functionality'
+        },
+        {
+            name: '@scarf/scarf',
+            note: 'Sends anonymous analytics/telemetry to Scarf, usage-tracking mechanism with no functional purpose'
+        },
+        {
+            name: '@swc/core',
+            note: 'Installs platform-specific binary via optionalDependencies, postinstall is a legacy fallback'
+        },
+        {
+            name: '@tree-sitter-grammars/tree-sitter-yaml',
+            note: 'Ships prebuilds for all supported targets via node-gyp-build, install script is a source-compile fallback'
+        },
+        {
+            name: '@vaadin/vaadin-usage-statistics',
+            note: "Toggles Vaadin's development-time telemetry, no effect on functionality"
+        },
+        {
+            name: 'contentful',
+            note: 'In 9.3.x, printed a message announcing that v10 was available, no functional purpose; no install script at all since 9.4.0'
+        },
+        {
+            name: 'core-js-pure',
+            note: 'Prints a donation/sponsorship banner to the console, no functional purpose'
+        },
+        {
+            name: 'core-js',
+            note: 'Prints a donation/sponsorship banner to the console, no functional purpose'
+        },
+        {
+            name: 'es5-ext',
+            note: 'Displays politically motivated message targeted at Russian developers, no effect on functionality'
+        },
+        {
+            name: 'esbuild',
+            note: 'Installs platform-specific binary via optionalDependencies, postinstall is a legacy fallback'
+        },
+        {
+            name: 'tree-sitter-json',
+            note: 'Ships prebuilds for all supported targets via node-gyp-build, install script is a source-compile fallback'
+        },
+        {
+            name: 'unrs-resolver',
+            note: 'Installs platform-specific binary via optionalDependencies, postinstall is a legacy fallback'
+        }
+    ].map((entry)=>({
+            ...entry,
+            action: 'ignore'
+        }))
+];
+
+//# sourceMappingURL=audited-scripts.js.map

package/dist/utils/audited-scripts.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utils/audited-scripts.ts"],"sourcesContent":["export interface AuditedScript {\n    name: string;\n    action: 'allow' | 'ignore';\n    maximumVersion?: string;\n    note?: string;\n}\n\nexport const AUDITED_SCRIPTS: AuditedScript[] = [\n    // Trusted to run their install scripts, up to the audited version.\n    ...[\n        {\n            name: '@servicetitan/startup',\n            note: 'Applies patch-package patches to installed dependencies',\n        },\n        {\n            name: 'cypress',\n            maximumVersion: '16.1.1',\n            note: \"Downloads Cypress's platform-specific test runner binary\",\n        },\n        {\n            name: 'msw',\n            maximumVersion: '3.0.1',\n            note: 'No install script at all since 3.0.0; worker regeneration moved to the manual `msw init` CLI command instead of running automatically on install. Ceiling bumped anyway to prevent audit workflow from flagging old version',\n        },\n        {\n            name: 'nx',\n            maximumVersion: '23.2.1',\n            note: 'Verifies native platform support and updates the Nx Cloud client if the workspace uses Nx Cloud',\n        },\n        {\n            name: 'tree-sitter',\n            maximumVersion: '0.25.1',\n            note: 'Installs a prebuilt native binary via node-gyp-build, compiling from source as a fallback',\n        },\n    ].map((entry: Omit<AuditedScript, 'action'>) => ({ ...entry, action: 'allow' as const })),\n\n    // Have install scripts, but don't need them to function correctly.\n    ...[\n        {\n            name: '@parcel/watcher',\n            note: 'Installs platform-specific binary via optionalDependencies, install script is a legacy fallback',\n        },\n        {\n            name: '@progress/kendo-licensing',\n            note: 'Validates Kendo UI license key, not needed for functionality',\n        },\n        {\n            name: '@scarf/scarf',\n            note: 'Sends anonymous analytics/telemetry to Scarf, usage-tracking mechanism with no functional purpose',\n        },\n        {\n            name: '@swc/core',\n            note: 'Installs platform-specific binary via optionalDependencies, postinstall is a legacy fallback',\n        },\n        {\n            name: '@tree-sitter-grammars/tree-sitter-yaml',\n            note: 'Ships prebuilds for all supported targets via node-gyp-build, install script is a source-compile fallback',\n        },\n        {\n            name: '@vaadin/vaadin-usage-statistics',\n            note: \"Toggles Vaadin's development-time telemetry, no effect on functionality\",\n        },\n        {\n            name: 'contentful',\n            note: 'In 9.3.x, printed a message announcing that v10 was available, no functional purpose; no install script at all since 9.4.0',\n        },\n        {\n            name: 'core-js-pure',\n            note: 'Prints a donation/sponsorship banner to the console, no functional purpose',\n        },\n        {\n            name: 'core-js',\n            note: 'Prints a donation/sponsorship banner to the console, no functional purpose',\n        },\n        {\n            name: 'es5-ext',\n            note: 'Displays politically motivated message targeted at Russian developers, no effect on functionality',\n        },\n        {\n            name: 'esbuild',\n            note: 'Installs platform-specific binary via optionalDependencies, postinstall is a legacy fallback',\n        },\n        {\n            name: 'tree-sitter-json',\n            note: 'Ships prebuilds for all supported targets via node-gyp-build, install script is a source-compile fallback',\n        },\n        {\n            name: 'unrs-resolver',\n            note: 'Installs platform-specific binary via optionalDependencies, postinstall is a legacy fallback',\n        },\n    ].map((entry: Omit<AuditedScript, 'action'>) => ({ ...entry, action: 'ignore' as const })),\n];\n"],"names":["AUDITED_SCRIPTS","name","note","maximumVersion","map","entry","action"],"mappings":";;;;+BAOaA;;;eAAAA;;;AAAN,MAAMA,kBAAmC;IAC5C,mEAAmE;OAChE;QACC;YACIC,MAAM;YACNC,MAAM;QACV;QACA;YACID,MAAM;YACNE,gBAAgB;YAChBD,MAAM;QACV;QACA;YACID,MAAM;YACNE,gBAAgB;YAChBD,MAAM;QACV;QACA;YACID,MAAM;YACNE,gBAAgB;YAChBD,MAAM;QACV;QACA;YACID,MAAM;YACNE,gBAAgB;YAChBD,MAAM;QACV;KACH,CAACE,GAAG,CAAC,CAACC,QAA0C,CAAA;YAAE,GAAGA,KAAK;YAAEC,QAAQ;QAAiB,CAAA;IAEtF,mEAAmE;OAChE;QACC;YACIL,MAAM;YACNC,MAAM;QACV;QACA;YACID,MAAM;YACNC,MAAM;QACV;QACA;YACID,MAAM;YACNC,MAAM;QACV;QACA;YACID,MAAM;YACNC,MAAM;QACV;QACA;YACID,MAAM;YACNC,MAAM;QACV;QACA;YACID,MAAM;YACNC,MAAM;QACV;QACA;YACID,MAAM;YACNC,MAAM;QACV;QACA;YACID,MAAM;YACNC,MAAM;QACV;QACA;YACID,MAAM;YACNC,MAAM;QACV;QACA;YACID,MAAM;YACNC,MAAM;QACV;QACA;YACID,MAAM;YACNC,MAAM;QACV;QACA;YACID,MAAM;YACNC,MAAM;QACV;QACA;YACID,MAAM;YACNC,MAAM;QACV;KACH,CAACE,GAAG,CAAC,CAACC,QAA0C,CAAA;YAAE,GAAGA,KAAK;YAAEC,QAAQ;QAAkB,CAAA;CAC1F"}

package/dist/utils/get-packages-with-install-scripts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-packages-with-install-scripts.d.ts","sourceRoot":"","sources":["../../src/utils/get-packages-with-install-scripts.ts"],"names":[],"mappings":"AAEA,UAAU,iBAAiB;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACnB;AAWD,wBAAgB,6BAA6B,IAAI,iBAAiB,EAAE,CAWnE"}
+{"version":3,"file":"get-packages-with-install-scripts.d.ts","sourceRoot":"","sources":["../../src/utils/get-packages-with-install-scripts.ts"],"names":[],"mappings":"AAEA,UAAU,iBAAiB;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACnB;AAWD,wBAAgB,6BAA6B,IAAI,iBAAiB,EAAE,CAOnE"}

package/dist/utils/get-packages-with-install-scripts.js

@@ -19,20 +19,16 @@ const _os = require("./os");
     'postinstall'
 ].map((script)=>`:attr(scripts,[${script}])`).join(',');
 function getPackagesWithInstallScripts() {
-    try {
-        const result = (0, _os.runCommand)('npm', [
-            'query',
-            SELECTORS,
-            '--json'
-        ]);
-        return JSON.parse(result).map(({ location, name, version })=>({
-                location,
-                name,
-                version
-            }));
-    } catch (unused) {
-        return [];
-    }
+    const result = (0, _os.runCommand)('npm', [
+        'query',
+        SELECTORS,
+        '--json'
+    ]);
+    return JSON.parse(result).map(({ location, name, version })=>({
+            location,
+            name,
+            version
+        }));
 }
 
 //# sourceMappingURL=get-packages-with-install-scripts.js.map

package/dist/utils/get-packages-with-install-scripts.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/get-packages-with-install-scripts.ts"],"sourcesContent":["import { runCommand } from './os';\n\ninterface PackageWithScript {\n    location: string;\n    name: string;\n    version: string;\n}\n\n/*\n * Keep this selector free of whitespace. On Windows npm runs through a shell (npm.CMD) and\n * execFileSync passes args unquoted, so a space would split the selector at the shell and npm\n * query would receive a truncated, invalid selector.\n */\nconst SELECTORS = ['preinstall', 'install', 'postinstall']\n    .map(script => `:attr(scripts,[${script}])`)\n    .join(',');\n\nexport function getPackagesWithInstallScripts(): PackageWithScript[] {\n    try {\n        const result = runCommand('npm', ['query', SELECTORS, '--json']);\n        return JSON.parse(result).map(({ location, name, version }: PackageWithScript) => ({\n            location,\n            name,\n            version,\n        }));\n    } catch {\n        return [];\n    }\n}\n"],"names":["getPackagesWithInstallScripts","SELECTORS","map","script","join","result","runCommand","JSON","parse","location","name","version"],"mappings":";;;;+BAiBgBA;;;eAAAA;;;oBAjBW;AAQ3B;;;;CAIC,GACD,MAAMC,YAAY;IAAC;IAAc;IAAW;CAAc,CACrDC,GAAG,CAACC,CAAAA,SAAU,CAAC,eAAe,EAAEA,OAAO,EAAE,CAAC,EAC1CC,IAAI,CAAC;AAEH,SAASJ;IACZ,IAAI;QACA,MAAMK,SAASC,IAAAA,cAAU,EAAC,OAAO;YAAC;YAASL;YAAW;SAAS;QAC/D,OAAOM,KAAKC,KAAK,CAACH,QAAQH,GAAG,CAAC,CAAC,EAAEO,QAAQ,EAAEC,IAAI,EAAEC,OAAO,EAAqB,GAAM,CAAA;gBAC/EF;gBACAC;gBACAC;YACJ,CAAA;IACJ,EAAE,eAAM;QACJ,OAAO,EAAE;IACb;AACJ"}
+{"version":3,"sources":["../../src/utils/get-packages-with-install-scripts.ts"],"sourcesContent":["import { runCommand } from './os';\n\ninterface PackageWithScript {\n    location: string;\n    name: string;\n    version: string;\n}\n\n/*\n * Keep this selector free of whitespace. On Windows npm runs through a shell (npm.CMD) and\n * execFileSync passes args unquoted, so a space would split the selector at the shell and npm\n * query would receive a truncated, invalid selector.\n */\nconst SELECTORS = ['preinstall', 'install', 'postinstall']\n    .map(script => `:attr(scripts,[${script}])`)\n    .join(',');\n\nexport function getPackagesWithInstallScripts(): PackageWithScript[] {\n    const result = runCommand('npm', ['query', SELECTORS, '--json']);\n    return JSON.parse(result).map(({ location, name, version }: PackageWithScript) => ({\n        location,\n        name,\n        version,\n    }));\n}\n"],"names":["getPackagesWithInstallScripts","SELECTORS","map","script","join","result","runCommand","JSON","parse","location","name","version"],"mappings":";;;;+BAiBgBA;;;eAAAA;;;oBAjBW;AAQ3B;;;;CAIC,GACD,MAAMC,YAAY;IAAC;IAAc;IAAW;CAAc,CACrDC,GAAG,CAACC,CAAAA,SAAU,CAAC,eAAe,EAAEA,OAAO,EAAE,CAAC,EAC1CC,IAAI,CAAC;AAEH,SAASJ;IACZ,MAAMK,SAASC,IAAAA,cAAU,EAAC,OAAO;QAAC;QAASL;QAAW;KAAS;IAC/D,OAAOM,KAAKC,KAAK,CAACH,QAAQH,GAAG,CAAC,CAAC,EAAEO,QAAQ,EAAEC,IAAI,EAAEC,OAAO,EAAqB,GAAM,CAAA;YAC/EF;YACAC;YACAC;QACJ,CAAA;AACJ"}

package/dist/utils/index.d.ts

@@ -1,3 +1,4 @@
+export * from './audited-scripts';
 export * from './ci';
 export * from './debug';
 export * from './find-up';
@@ -8,5 +9,6 @@ export * from './git';
 export * from './npm';
 export * from './os';
 export * from './read-json';
+export * from './version-compare';
 export * from './warn-untrusted-install-scripts';
 //# sourceMappingURL=index.d.ts.map

package/dist/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,MAAM,CAAC;AACrB,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,qCAAqC,CAAC;AACpD,cAAc,eAAe,CAAC;AAC9B,cAAc,mCAAmC,CAAC;AAClD,cAAc,OAAO,CAAC;AACtB,cAAc,OAAO,CAAC;AACtB,cAAc,MAAM,CAAC;AACrB,cAAc,aAAa,CAAC;AAC5B,cAAc,kCAAkC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,MAAM,CAAC;AACrB,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,qCAAqC,CAAC;AACpD,cAAc,eAAe,CAAC;AAC9B,cAAc,mCAAmC,CAAC;AAClD,cAAc,OAAO,CAAC;AACtB,cAAc,OAAO,CAAC;AACtB,cAAc,MAAM,CAAC;AACrB,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAClC,cAAc,kCAAkC,CAAC"}

package/dist/utils/index.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", {
     value: true
 });
+_export_star(require("./audited-scripts"), exports);
 _export_star(require("./ci"), exports);
 _export_star(require("./debug"), exports);
 _export_star(require("./find-up"), exports);
@@ -12,6 +13,7 @@ _export_star(require("./git"), exports);
 _export_star(require("./npm"), exports);
 _export_star(require("./os"), exports);
 _export_star(require("./read-json"), exports);
+_export_star(require("./version-compare"), exports);
 _export_star(require("./warn-untrusted-install-scripts"), exports);
 function _export_star(from, to) {
     Object.keys(from).forEach(function(k) {

package/dist/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/index.ts"],"sourcesContent":["export * from './ci';\nexport * from './debug';\nexport * from './find-up';\nexport * from './get-packages-with-install-scripts';\nexport * from './get-version';\nexport * from './get-workspace-root-package-json';\nexport * from './git';\nexport * from './npm';\nexport * from './os';\nexport * from './read-json';\nexport * from './warn-untrusted-install-scripts';\n"],"names":[],"mappings":";;;;qBAAc;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA"}
+{"version":3,"sources":["../../src/utils/index.ts"],"sourcesContent":["export * from './audited-scripts';\nexport * from './ci';\nexport * from './debug';\nexport * from './find-up';\nexport * from './get-packages-with-install-scripts';\nexport * from './get-version';\nexport * from './get-workspace-root-package-json';\nexport * from './git';\nexport * from './npm';\nexport * from './os';\nexport * from './read-json';\nexport * from './version-compare';\nexport * from './warn-untrusted-install-scripts';\n"],"names":[],"mappings":";;;;qBAAc;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA;qBACA"}

package/dist/utils/version-compare.d.ts

@@ -0,0 +1,2 @@
+export declare function versionCompare(version: string, otherVersion: string): -1 | 0 | 1;
+//# sourceMappingURL=version-compare.d.ts.map

package/dist/utils/version-compare.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-compare.d.ts","sourceRoot":"","sources":["../../src/utils/version-compare.ts"],"names":[],"mappings":"AAAA,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAwBhF"}

package/dist/utils/version-compare.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "versionCompare", {
+    enumerable: true,
+    get: function() {
+        return versionCompare;
+    }
+});
+function versionCompare(version, otherVersion) {
+    const [versionCore, versionPrerelease] = splitPrerelease(version);
+    const [otherCore, otherPrerelease] = splitPrerelease(otherVersion);
+    const parts = parseVersion(versionCore);
+    const otherParts = parseVersion(otherCore);
+    const length = Math.max(parts.length, otherParts.length);
+    for(let i = 0; i < length; i++){
+        var _parts_i, _otherParts_i;
+        const part = (_parts_i = parts[i]) !== null && _parts_i !== void 0 ? _parts_i : 0;
+        const otherPart = (_otherParts_i = otherParts[i]) !== null && _otherParts_i !== void 0 ? _otherParts_i : 0;
+        if (part !== otherPart) {
+            return part > otherPart ? 1 : -1;
+        }
+    }
+    /*
+     * Same core version: a pre-release build (e.g. "-canary.5") has lower
+     * precedence than the plain release it precedes.
+     */ if (!!versionPrerelease === !!otherPrerelease) {
+        return 0;
+    }
+    return versionPrerelease ? -1 : 1;
+}
+function splitPrerelease(version) {
+    const [core, ...prerelease] = version.trim().split('-');
+    return [
+        core,
+        prerelease.length > 0 ? prerelease.join('-') : undefined
+    ];
+}
+function parseVersion(version) {
+    return version.split('.').map((part)=>parseInt(part, 10) || 0);
+}
+
+//# sourceMappingURL=version-compare.js.map

package/dist/utils/version-compare.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utils/version-compare.ts"],"sourcesContent":["export function versionCompare(version: string, otherVersion: string): -1 | 0 | 1 {\n    const [versionCore, versionPrerelease] = splitPrerelease(version);\n    const [otherCore, otherPrerelease] = splitPrerelease(otherVersion);\n\n    const parts = parseVersion(versionCore);\n    const otherParts = parseVersion(otherCore);\n\n    const length = Math.max(parts.length, otherParts.length);\n    for (let i = 0; i < length; i++) {\n        const part = parts[i] ?? 0;\n        const otherPart = otherParts[i] ?? 0;\n        if (part !== otherPart) {\n            return part > otherPart ? 1 : -1;\n        }\n    }\n\n    /*\n     * Same core version: a pre-release build (e.g. \"-canary.5\") has lower\n     * precedence than the plain release it precedes.\n     */\n    if (!!versionPrerelease === !!otherPrerelease) {\n        return 0;\n    }\n    return versionPrerelease ? -1 : 1;\n}\n\nfunction splitPrerelease(version: string): [core: string, prerelease: string | undefined] {\n    const [core, ...prerelease] = version.trim().split('-');\n    return [core, prerelease.length > 0 ? prerelease.join('-') : undefined];\n}\n\nfunction parseVersion(version: string): number[] {\n    return version.split('.').map(part => parseInt(part, 10) || 0);\n}\n"],"names":["versionCompare","version","otherVersion","versionCore","versionPrerelease","splitPrerelease","otherCore","otherPrerelease","parts","parseVersion","otherParts","length","Math","max","i","part","otherPart","core","prerelease","trim","split","join","undefined","map","parseInt"],"mappings":";;;;+BAAgBA;;;eAAAA;;;AAAT,SAASA,eAAeC,OAAe,EAAEC,YAAoB;IAChE,MAAM,CAACC,aAAaC,kBAAkB,GAAGC,gBAAgBJ;IACzD,MAAM,CAACK,WAAWC,gBAAgB,GAAGF,gBAAgBH;IAErD,MAAMM,QAAQC,aAAaN;IAC3B,MAAMO,aAAaD,aAAaH;IAEhC,MAAMK,SAASC,KAAKC,GAAG,CAACL,MAAMG,MAAM,EAAED,WAAWC,MAAM;IACvD,IAAK,IAAIG,IAAI,GAAGA,IAAIH,QAAQG,IAAK;YAChBN,UACKE;QADlB,MAAMK,QAAOP,WAAAA,KAAK,CAACM,EAAE,cAARN,sBAAAA,WAAY;QACzB,MAAMQ,aAAYN,gBAAAA,UAAU,CAACI,EAAE,cAAbJ,2BAAAA,gBAAiB;QACnC,IAAIK,SAASC,WAAW;YACpB,OAAOD,OAAOC,YAAY,IAAI,CAAC;QACnC;IACJ;IAEA;;;KAGC,GACD,IAAI,CAAC,CAACZ,sBAAsB,CAAC,CAACG,iBAAiB;QAC3C,OAAO;IACX;IACA,OAAOH,oBAAoB,CAAC,IAAI;AACpC;AAEA,SAASC,gBAAgBJ,OAAe;IACpC,MAAM,CAACgB,MAAM,GAAGC,WAAW,GAAGjB,QAAQkB,IAAI,GAAGC,KAAK,CAAC;IACnD,OAAO;QAACH;QAAMC,WAAWP,MAAM,GAAG,IAAIO,WAAWG,IAAI,CAAC,OAAOC;KAAU;AAC3E;AAEA,SAASb,aAAaR,OAAe;IACjC,OAAOA,QAAQmB,KAAK,CAAC,KAAKG,GAAG,CAACR,CAAAA,OAAQS,SAAST,MAAM,OAAO;AAChE"}

package/dist/utils/warn-untrusted-install-scripts.d.ts

@@ -1,2 +1,3 @@
-export declare function warnUntrustedInstallScripts(allowedScripts: string[]): void;
+import type { AuditedScript } from './audited-scripts';
+export declare function warnUntrustedInstallScripts(allowedScripts: string[], ignored: AuditedScript[]): void;
 //# sourceMappingURL=warn-untrusted-install-scripts.d.ts.map

package/dist/utils/warn-untrusted-install-scripts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"warn-untrusted-install-scripts.d.ts","sourceRoot":"","sources":["../../src/utils/warn-untrusted-install-scripts.ts"],"names":[],"mappings":"AAsBA,wBAAgB,2BAA2B,CAAC,cAAc,EAAE,MAAM,EAAE,QAmBnE"}
+{"version":3,"file":"warn-untrusted-install-scripts.d.ts","sourceRoot":"","sources":["../../src/utils/warn-untrusted-install-scripts.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAIvD,wBAAgB,2BAA2B,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,QAsC7F"}

package/dist/utils/warn-untrusted-install-scripts.js

@@ -9,31 +9,24 @@ Object.defineProperty(exports, "warnUntrustedInstallScripts", {
     }
 });
 const _getpackageswithinstallscripts = require("./get-packages-with-install-scripts");
-// These packages have scripts, but don't need them to function correctly.
-const IGNORE = [
-    '@parcel/watcher',
-    '@progress/kendo-licensing',
-    '@scarf/scarf',
-    '@swc/core',
-    '@tree-sitter-grammars/tree-sitter-yaml',
-    '@vaadin/vaadin-usage-statistics',
-    'contentful',
-    'core-js-pure',
-    'core-js',
-    'es5-ext',
-    'esbuild',
-    'less',
-    'tree-sitter-json',
-    'unrs-resolver'
-];
-function warnUntrustedInstallScripts(allowedScripts) {
-    const packages = (0, _getpackageswithinstallscripts.getPackagesWithInstallScripts)();
-    const trustedOrIgnored = new Set([
-        ...allowedScripts,
-        ...IGNORE
-    ]);
-    const untrusted = packages.filter(({ location, name })=>{
-        return !!location && !trustedOrIgnored.has(name);
+const _versioncompare = require("./version-compare");
+function warnUntrustedInstallScripts(allowedScripts, ignored) {
+    let packages;
+    try {
+        packages = (0, _getpackageswithinstallscripts.getPackagesWithInstallScripts)();
+    } catch (error) {
+        console.warn(`WARNING: Unable to check for untrusted install scripts: ${error}`);
+        return;
+    }
+    const untrusted = packages.filter(({ location, name, version })=>{
+        if (!location || allowedScripts.includes(name) || allowedScripts.includes(`${name}@${version}`)) {
+            return false;
+        }
+        const ignoredEntry = ignored.find((entry)=>entry.name === name);
+        if (!ignoredEntry) {
+            return true;
+        }
+        return !!ignoredEntry.maximumVersion && (0, _versioncompare.versionCompare)(version, ignoredEntry.maximumVersion) > 0;
     });
     if (untrusted.length === 0) {
         return;

package/dist/utils/warn-untrusted-install-scripts.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/warn-untrusted-install-scripts.ts"],"sourcesContent":["/* eslint-disable no-console */\nimport { getPackagesWithInstallScripts } from './get-packages-with-install-scripts';\n\n// These packages have scripts, but don't need them to function correctly.\n\nconst IGNORE = [\n    '@parcel/watcher', // Installs platform-specific binary via optionalDependencies, install script is a legacy fallback\n    '@progress/kendo-licensing', // Validates Kendo UI license key, not needed for functionality\n    '@scarf/scarf', // Sends anonymous analytics/telemetry to Scarf, usage-tracking mechanism with no functional purpose\n    '@swc/core', // Installs platform-specific binary via optionalDependencies, postinstall is a legacy fallback\n    '@tree-sitter-grammars/tree-sitter-yaml', // Ships prebuilds for all supported targets via node-gyp-build, install script is a source-compile fallback\n    '@vaadin/vaadin-usage-statistics', // Toggles Vaadin's development-time telemetry, no effect on functionality\n    'contentful', // v9 printed a message announcing that v10 was available, no functional purpose\n    'core-js-pure', // Prints a donation/sponsorship banner to the console, no functional purpose\n    'core-js', // Prints a donation/sponsorship banner to the console, no functional purpose\n    'es5-ext', // Displays politically motivated message targeted at Russian developers, no effect on functionality\n    'esbuild', // Installs platform-specific binary via optionalDependencies, postinstall is a legacy fallback\n    'less', // Installs Playwright browsers for Less's own test suite\n    'tree-sitter-json', // Ships prebuilds for all supported targets via node-gyp-build, install script is a source-compile fallback\n    'unrs-resolver', // Installs platform-specific binary via optionalDependencies, postinstall is a legacy fallback\n];\n\nexport function warnUntrustedInstallScripts(allowedScripts: string[]) {\n    const packages = getPackagesWithInstallScripts();\n    const trustedOrIgnored = new Set([...allowedScripts, ...IGNORE]);\n    const untrusted = packages.filter(({ location, name }) => {\n        return !!location && !trustedOrIgnored.has(name);\n    });\n\n    if (untrusted.length === 0) {\n        return;\n    }\n\n    const list = untrusted.map(({ name, version }) => `  - ${name}@${version}`).join('\\n');\n    console.warn(\n        [\n            'WARNING: The following packages have untrusted install scripts.',\n            'Review and add trusted packages to --allow-scripts:',\n            list,\n        ].join('\\n')\n    );\n}\n"],"names":["warnUntrustedInstallScripts","IGNORE","allowedScripts","packages","getPackagesWithInstallScripts","trustedOrIgnored","Set","untrusted","filter","location","name","has","length","list","map","version","join","console","warn"],"mappings":"AAAA,6BAA6B;;;;+BAsBbA;;;eAAAA;;;+CArB8B;AAE9C,0EAA0E;AAE1E,MAAMC,SAAS;IACX;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACH;AAEM,SAASD,4BAA4BE,cAAwB;IAChE,MAAMC,WAAWC,IAAAA,4DAA6B;IAC9C,MAAMC,mBAAmB,IAAIC,IAAI;WAAIJ;WAAmBD;KAAO;IAC/D,MAAMM,YAAYJ,SAASK,MAAM,CAAC,CAAC,EAAEC,QAAQ,EAAEC,IAAI,EAAE;QACjD,OAAO,CAAC,CAACD,YAAY,CAACJ,iBAAiBM,GAAG,CAACD;IAC/C;IAEA,IAAIH,UAAUK,MAAM,KAAK,GAAG;QACxB;IACJ;IAEA,MAAMC,OAAON,UAAUO,GAAG,CAAC,CAAC,EAAEJ,IAAI,EAAEK,OAAO,EAAE,GAAK,CAAC,IAAI,EAAEL,KAAK,CAAC,EAAEK,SAAS,EAAEC,IAAI,CAAC;IACjFC,QAAQC,IAAI,CACR;QACI;QACA;QACAL;KACH,CAACG,IAAI,CAAC;AAEf"}
+{"version":3,"sources":["../../src/utils/warn-untrusted-install-scripts.ts"],"sourcesContent":["/* eslint-disable no-console */\nimport type { AuditedScript } from './audited-scripts';\nimport { getPackagesWithInstallScripts } from './get-packages-with-install-scripts';\nimport { versionCompare } from './version-compare';\n\nexport function warnUntrustedInstallScripts(allowedScripts: string[], ignored: AuditedScript[]) {\n    let packages: ReturnType<typeof getPackagesWithInstallScripts>;\n    try {\n        packages = getPackagesWithInstallScripts();\n    } catch (error) {\n        console.warn(`WARNING: Unable to check for untrusted install scripts: ${error}`);\n        return;\n    }\n    const untrusted = packages.filter(({ location, name, version }) => {\n        if (\n            !location ||\n            allowedScripts.includes(name) ||\n            allowedScripts.includes(`${name}@${version}`)\n        ) {\n            return false;\n        }\n        const ignoredEntry = ignored.find(entry => entry.name === name);\n        if (!ignoredEntry) {\n            return true;\n        }\n        return (\n            !!ignoredEntry.maximumVersion &&\n            versionCompare(version, ignoredEntry.maximumVersion) > 0\n        );\n    });\n\n    if (untrusted.length === 0) {\n        return;\n    }\n\n    const list = untrusted.map(({ name, version }) => `  - ${name}@${version}`).join('\\n');\n    console.warn(\n        [\n            'WARNING: The following packages have untrusted install scripts.',\n            'Review and add trusted packages to --allow-scripts:',\n            list,\n        ].join('\\n')\n    );\n}\n"],"names":["warnUntrustedInstallScripts","allowedScripts","ignored","packages","getPackagesWithInstallScripts","error","console","warn","untrusted","filter","location","name","version","includes","ignoredEntry","find","entry","maximumVersion","versionCompare","length","list","map","join"],"mappings":"AAAA,6BAA6B;;;;+BAKbA;;;eAAAA;;;+CAH8B;gCACf;AAExB,SAASA,4BAA4BC,cAAwB,EAAEC,OAAwB;IAC1F,IAAIC;IACJ,IAAI;QACAA,WAAWC,IAAAA,4DAA6B;IAC5C,EAAE,OAAOC,OAAO;QACZC,QAAQC,IAAI,CAAC,CAAC,wDAAwD,EAAEF,OAAO;QAC/E;IACJ;IACA,MAAMG,YAAYL,SAASM,MAAM,CAAC,CAAC,EAAEC,QAAQ,EAAEC,IAAI,EAAEC,OAAO,EAAE;QAC1D,IACI,CAACF,YACDT,eAAeY,QAAQ,CAACF,SACxBV,eAAeY,QAAQ,CAAC,GAAGF,KAAK,CAAC,EAAEC,SAAS,GAC9C;YACE,OAAO;QACX;QACA,MAAME,eAAeZ,QAAQa,IAAI,CAACC,CAAAA,QAASA,MAAML,IAAI,KAAKA;QAC1D,IAAI,CAACG,cAAc;YACf,OAAO;QACX;QACA,OACI,CAAC,CAACA,aAAaG,cAAc,IAC7BC,IAAAA,8BAAc,EAACN,SAASE,aAAaG,cAAc,IAAI;IAE/D;IAEA,IAAIT,UAAUW,MAAM,KAAK,GAAG;QACxB;IACJ;IAEA,MAAMC,OAAOZ,UAAUa,GAAG,CAAC,CAAC,EAAEV,IAAI,EAAEC,OAAO,EAAE,GAAK,CAAC,IAAI,EAAED,KAAK,CAAC,EAAEC,SAAS,EAAEU,IAAI,CAAC;IACjFhB,QAAQC,IAAI,CACR;QACI;QACA;QACAa;KACH,CAACE,IAAI,CAAC;AAEf"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@servicetitan/install",
-    "version": "39.3.0",
+    "version": "40.1.0",
     "description": "Lightweight wrapper around npm install that configures access to private packages",
     "homepage": "https://docs.st.dev/docs/frontend/uikit/install",
     "repository": {
@@ -30,7 +30,7 @@
         "webpack": false
     },
     "peerDependencies": {
-        "js-yaml": "~5.4.1"
+        "js-yaml": "~5.4.2"
     },
     "peerDependenciesMeta": {
         "js-yaml": {

package/src/cli/index.ts

@@ -11,6 +11,7 @@ const args = (function getArgs() {
             'no-allow-scripts': { type: 'boolean' },
             'allow-all-scripts': { type: 'boolean' },
             'fix': { type: 'boolean' },
+            'no-min-release-age': { type: 'boolean' },
             'quiet': { type: 'boolean' },
             'token': { type: 'boolean' },
             'no-token': { type: 'boolean' },
@@ -35,6 +36,9 @@ const args = (function getArgs() {
                 case 'allow-all-scripts':
                     result.allowScripts = true;
                     break;
+                case 'no-min-release-age':
+                    result.minReleaseAge = false;
+                    break;
                 case 'no-token':
                     result.token = false;
                     break;

package/src/cli/install.ts

@@ -14,6 +14,7 @@ const ENVIRONMENT_VARIABLE_REGEX = /\${(?<environmentVariable>[^}]+)}/;
 export interface Args {
     allowScripts?: AllowScripts;
     fix?: boolean;
+    minReleaseAge?: false;
     quiet?: boolean;
     token?: boolean;
 }

package/src/index.ts

@@ -1,3 +1,11 @@
 export { PackageManager, getPackageManager } from './package-manager';
 export type { DeclaredVersionQuery, ResolvedVersionQuery } from './package-manager';
-export { gitCloneRepo, gitIsReachable, isCI, npmWhoAmI } from './utils';
+export {
+    AUDITED_SCRIPTS,
+    gitCloneRepo,
+    gitIsReachable,
+    isCI,
+    npmWhoAmI,
+    versionCompare,
+} from './utils';
+export type { AuditedScript } from './utils';