Files

41 lines
1.8 KiB
JavaScript
Raw Permalink Normal View History

/** Project the development manifest and lock into the shared runtime artifact. */
export function pluginPackageMetadata(manifest, lock) {
if (
lock.lockfileVersion !== 3 ||
lock.name !== manifest.name ||
lock.version !== manifest.version ||
lock.packages?.[""]?.version !== manifest.version
)
throw new Error("Plugin packaging requires the matching v3 package lock");
// Claude skips dependency installation when a published manifest has
// overrides. Preserve development security overrides in the source owner,
// and reject any future runtime override rather than silently discarding it.
for (const name of Object.keys(manifest.overrides ?? {})) {
const matches = Object.entries(lock.packages).filter(([path]) =>
path.endsWith(`node_modules/${name}`),
);
if (matches.length === 0 || matches.some(([, entry]) => entry.dev !== true))
throw new Error(`Cannot omit a runtime or unresolved override: ${name}`);
}
const packageJson = { ...manifest };
delete packageJson.devDependencies;
delete packageJson.overrides;
// Codex's npm source fetches the archive without installing dependencies.
// Keep optional Frida outside the bundle so ordinary npm installs can still
// run its host-specific installer. PTY binaries are transitive optionals of
// a runtime dependency and are included for every supported platform by the
// archive producer.
packageJson.bundleDependencies = Object.keys(manifest.dependencies ?? {});
const root = { ...lock.packages[""] };
delete root.devDependencies;
const shrinkwrap = {
...lock,
packages: Object.fromEntries(
Object.entries(lock.packages).filter(([, entry]) => entry.dev !== true),
),
};
shrinkwrap.packages[""] = root;
return { packageJson, shrinkwrap };
}