create-raredays-app 0.1.3 → 0.1.4

package/bin/compose-allow-builds.mjs

@@ -0,0 +1,47 @@
+// Merge per-module build-script approvals into a template's pnpm-workspace.yaml.
+//
+// pnpm 11 blocks dependency build scripts by default and only honors approvals
+// declared as `allowBuilds` in pnpm-workspace.yaml (the package.json `pnpm`
+// field and .npmrc are ignored). Each scaffold fragment (module or vendor) may
+// declare its own `allowBuilds` map in module.json; the scaffolder unions those
+// onto the template's base so a generated app pre-approves exactly the build
+// scripts its selected modules need — no matter which modules are chosen.
+//
+// Pure string transform over the template's pnpm-workspace.yaml: parse the
+// existing `  <pkg>: true|false` entries, union the fragment-contributed ones
+// (later wins, so a fragment can also opt a build OUT with `false`), and
+// re-emit a sorted block while preserving the file's header comment. We avoid a
+// YAML parser dependency on purpose — the block is a flat name->boolean map.
+
+const ENTRY = /^ {2}["']?([^"':\s]+)["']?:\s*(true|false)\s*$/gm;
+
+/**
+ * @param {string} yamlSource - the template's pnpm-workspace.yaml contents
+ * @param {Record<string, boolean>} extra - build approvals contributed by selected fragments
+ * @returns {string} the rewritten pnpm-workspace.yaml contents
+ */
+export function mergeAllowBuilds(yamlSource, extra) {
+  const merged = {};
+  ENTRY.lastIndex = 0;
+  let match;
+  while ((match = ENTRY.exec(yamlSource)) !== null) {
+    merged[match[1]] = match[2] === "true";
+  }
+  for (const [name, value] of Object.entries(extra)) {
+    merged[name] = value === true || value === "true";
+  }
+
+  // Preserve everything before `allowBuilds:` (the header comment block).
+  const marker = yamlSource.indexOf("allowBuilds:");
+  const header = marker > 0 ? yamlSource.slice(0, marker) : "";
+
+  const lines = Object.keys(merged)
+    .sort()
+    .map((name) => {
+      // Quote names that aren't bare identifiers (e.g. scoped "@sentry/cli").
+      const key = /^[a-zA-Z0-9_-]+$/.test(name) ? name : `"${name}"`;
+      return `  ${key}: ${merged[name] ? "true" : "false"}`;
+    });
+
+  return `${header}allowBuilds:\n${lines.join("\n")}\n`;
+}

package/bin/index.js

@@ -7,6 +7,8 @@ import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
 import * as p from "@clack/prompts";
 
+import { mergeAllowBuilds } from "./compose-allow-builds.mjs";
+
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const packageRoot = resolve(__dirname, "..");
 const templatesDir = resolve(packageRoot, "templates");
@@ -520,6 +522,7 @@ async function scaffold(opts) {
   // Load + apply selected fragments. Static templates don't have a
   // composition root, so skip module composition entirely there.
   const collectedDeps = {};
+  const collectedBuilds = {};
   const envVars = [];
   const vendorMocks = [];
   if (opts.template !== "static" && opts.selectedModules.length > 0) {
@@ -528,6 +531,7 @@ async function scaffold(opts) {
 
     for (const f of valid) {
       Object.assign(collectedDeps, f.deps ?? {});
+      Object.assign(collectedBuilds, f.allowBuilds ?? {});
       if (f.filesDir) await cp(f.filesDir, targetDir, { recursive: true });
     }
 
@@ -537,6 +541,7 @@ async function scaffold(opts) {
       const vendor = f?.vendors?.find((v) => v.key === vendorKey);
       if (!vendor) continue;
       Object.assign(collectedDeps, vendor.deps ?? {});
+      Object.assign(collectedBuilds, vendor.allowBuilds ?? {});
       for (const v of vendor.env ?? []) envVars.push(v);
       if (vendor.mocks) {
         vendorMocks.push(vendor.mocks);
@@ -550,6 +555,16 @@ async function scaffold(opts) {
     await writeFile(runtimePath, composeRuntime(source, valid));
   }
 
+  // Union module/vendor build-script approvals onto the template's
+  // pnpm-workspace.yaml so the generated app pre-approves exactly what its
+  // selected modules need under pnpm 11. No-op when no fragment declares any.
+  if (Object.keys(collectedBuilds).length > 0) {
+    const wsPath = resolve(targetDir, "pnpm-workspace.yaml");
+    if (existsSync(wsPath)) {
+      await writeFile(wsPath, mergeAllowBuilds(await readFile(wsPath, "utf8"), collectedBuilds));
+    }
+  }
+
   // Compose mocks/handlers.ts for any template that ships it (full-stack + client).
   if (opts.template !== "static") {
     const handlersPath = resolve(targetDir, "mocks/handlers.ts");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-raredays-app",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Scaffold a new RareDays Next.js app.",
   "license": "UNLICENSED",
   "author": "Jeremy Harper <jeremy@raredays.com>",

package/templates/client/pnpm-workspace.yaml

@@ -0,0 +1,9 @@
+# pnpm 11 blocks dependency build scripts by default, and its pre-run deps
+# check then aborts every pnpm command (install/build/exec) with
+# ERR_PNPM_IGNORED_BUILDS. Pre-approve the builds this app actually needs so a
+# fresh scaffold works out of the box. (In pnpm 11 `allowBuilds` replaced
+# `onlyBuiltDependencies`; values are booleans, not a list.)
+allowBuilds:
+  esbuild: true
+  msw: true
+  sharp: true

package/templates/full-stack/pnpm-workspace.yaml

@@ -0,0 +1,9 @@
+# pnpm 11 blocks dependency build scripts by default, and its pre-run deps
+# check then aborts every pnpm command (install/build/exec) with
+# ERR_PNPM_IGNORED_BUILDS. Pre-approve the builds this app actually needs so a
+# fresh scaffold works out of the box. (In pnpm 11 `allowBuilds` replaced
+# `onlyBuiltDependencies`; values are booleans, not a list.)
+allowBuilds:
+  esbuild: true
+  msw: true
+  sharp: true

package/templates/static/pnpm-workspace.yaml

@@ -0,0 +1,8 @@
+# pnpm 11 blocks dependency build scripts by default, and its pre-run deps
+# check then aborts every pnpm command (install/build/exec) with
+# ERR_PNPM_IGNORED_BUILDS. Pre-approve the builds this app actually needs so a
+# fresh scaffold works out of the box. (In pnpm 11 `allowBuilds` replaced
+# `onlyBuiltDependencies`; values are booleans, not a list.)
+allowBuilds:
+  esbuild: true
+  sharp: true