npm-packlist 11.0.0 → 11.2.0

package/lib/index.js

@@ -8,6 +8,7 @@ const { log } = require('proc-log')
 
 // symbols used to represent synthetic rule sets
 const defaultRules = Symbol('npm-packlist.rules.default')
+const globalRules = Symbol('npm-packlist.rules.global')
 const strictRules = Symbol('npm-packlist.rules.strict')
 
 // There may be others, but :?|<> are handled by node-tar
@@ -84,13 +85,23 @@ class PackWalker extends IgnoreWalker {
       follow: false,
       // we path.resolve() here because ignore-walk doesn't do it and we want full paths
       path: resolve(opts?.path || tree.path).replace(/\\/g, '/'),
-      ignoreFiles: opts?.ignoreFiles || [
+      // globalRules belongs on the root walker only. Child walkers reach it through
+      // parent.filterEntry, where package.json rules can still override it; reapplying
+      // globalRules at the child level would defeat that override.
+      ignoreFiles: opts?.ignoreFiles || (opts?.parent ? [
         defaultRules,
         'package.json',
         '.npmignore',
         '.gitignore',
         strictRules,
-      ],
+      ] : [
+        defaultRules,
+        globalRules,
+        'package.json',
+        '.npmignore',
+        '.gitignore',
+        strictRules,
+      ]),
     }
 
     super(options)
@@ -98,6 +109,8 @@ class PackWalker extends IgnoreWalker {
     this.isPackage = options.isPackage
     this.seen = options.seen || new Set()
     this.tree = tree
+    this.globalIgnoreFile = options.globalIgnoreFile || null
+    this.globalIgnoreRules = options.globalIgnoreRules || null
 
     const additionalDefaults = []
     if (options.prefix && options.workspaces) {
@@ -124,6 +137,31 @@ class PackWalker extends IgnoreWalker {
     // go ahead and inject the default rules now
     this.injectRules(defaultRules, [...defaults, ...additionalDefaults])
 
+    // inject the global rules from the user's ignore file. positioned between
+    // defaultRules and package.json so an explicit entry in the package "files"
+    // field can still override. only the root walker carries globalRules in its
+    // ignoreFiles list; child walkers see global exclusions via parent.filterEntry,
+    // which is what lets the package.json `!/path/**` override win.
+    if (this.globalIgnoreRules === null && this.globalIgnoreFile) {
+      try {
+        this.globalIgnoreRules = readFile(this.globalIgnoreFile, { encoding: 'utf8' })
+      } catch (err) {
+        // istanbul ignore next -- only ENOENT is expected here
+        if (err.code !== 'ENOENT') {
+          throw err
+        }
+        this.globalIgnoreRules = ''
+      }
+    }
+    if (this.globalIgnoreRules) {
+      this.injectRules(globalRules, [this.globalIgnoreRules])
+      // istanbul ignore else -- globalIgnoreRules without a filename only happens when
+      // a caller pre-populates rules directly instead of going through globalIgnoreFile
+      if (this.globalIgnoreFile) {
+        log.silly('global-ignore-file', `applied rules from ${this.globalIgnoreFile}`)
+      }
+    }
+
     if (!this.isPackage) {
       // if this instance is not a package, then place some strict default rules
       this.injectRules(strictRules, [...strictDefaults])
@@ -267,6 +305,7 @@ class PackWalker extends IgnoreWalker {
       browser,
       files,
       main,
+      patchedDependencies,
     } = this.tree.package
 
     // rules in these arrays are inverted since they are patterns we want to _not_ ignore
@@ -356,6 +395,32 @@ class PackWalker extends IgnoreWalker {
       }
     }
 
+    // patch files declared in patchedDependencies are project-local fixes and must never ship.
+    // patchedDependencies is root-only state, so this applies only to the package being packed.
+    // each declared patch file is force-excluded even when it was added via "files".
+    // only the exact files are excluded, never their directory, so a shared dir keeps its other contents.
+    if (this.tree.isProjectRoot && patchedDependencies && typeof patchedDependencies === 'object') {
+      for (const patchPath of Object.values(patchedDependencies)) {
+        if (typeof patchPath !== 'string') {
+          continue
+        }
+        const rel = normalizePath(patchPath).replace(/^\.?\//, '').replace(/\/+$/, '')
+        // skip absolute paths or paths that escape the package root, which are never packed anyway
+        if (!rel || rel.startsWith('/') || rel === '..' || rel.startsWith('../') || rel.includes('/../')) {
+          continue
+        }
+        // warn when a "files" entry pulled the patch file in, either directly or via its directory
+        const parentGlob = `!/${normalizePath(dirname(rel))}/**`
+        if (files && (ignores.includes(`!/${rel}`) || ignores.includes(parentGlob))) {
+          log.warn(
+            'patched-dependencies',
+            `excluding "${rel}" from the package tarball: patch files in patchedDependencies must not be published`
+          )
+        }
+        strict.push(`/${rel}`)
+      }
+    }
+
     // and now we add all of the strict rules to our synthetic file
     this.injectRules(strictRules, strict, callback)
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npm-packlist",
-  "version": "11.0.0",
+  "version": "11.2.0",
   "description": "Get a list of the files to add from a folder into an npm package",
   "directories": {
     "test": "test"
@@ -19,7 +19,7 @@
   ],
   "devDependencies": {
     "@npmcli/arborist": "^9.0.0",
-    "@npmcli/eslint-config": "^6.0.0",
+    "@npmcli/eslint-config": "^7.0.0",
     "@npmcli/template-oss": "5.1.0",
     "mutate-fs": "^2.1.1",
     "tap": "^16.0.1"