@withmetaphor/darwin-installer
v0.1.5
Published
Install Darwin globally with its reviewed npm lifecycle scripts allowed for this install only.
Readme
Darwin Installer@withmetaphor/darwin-installer installs Darwin globally. On npm 11.16 and newer, it
allows only Darwin's reviewed npm lifecycle scripts for that single installcommand. Older npm versions use npm's normal lifecycle-script behavior becausethey do not support the command-scoped policy.Node.js 20.18.1 or newer is required.## Install or update to the latest Darwinshnpx -y @withmetaphor/darwin-installer@latest
## Install an exact Darwin versionDarwin's updater can pin the release it already selected:shnpx -y @withmetaphor/darwin-installer@latest --darwin-version 0.92.15
````--darwin-version` accepts an exact semantic version only. Tags and ranges such as`latest`, `^0.92.15`, and `0.92.x` are rejected.## Inspect without installingshnpx -y @withmetaphor/darwin-installer@latest --dry-run
```The installer has no dependencies and no lifecycle scripts of its own. It runsthe invoking npm CLI with shell: false. On npm 11.16 and newer, it passes thereviewed list through a command-line --allow-scripts option. It never runsnpm config set and never changes the user's persistent npm configuration.For this command only, the installer also disables inherited ignore-scriptsand dangerously-allow-all-scripts settings, disables inherited npm dry-runand package-lock-only modes, forces executable bin links, includes supportedoptional dependencies, and, where supported, enables strict script policy. Onnpm 11.16 and newer, required reviewed scripts can run while an unrevieweddependency script stops the install.The installer checks the invoking npm version first. npm 11.16 and newer receivethe command-only --allow-scripts list. Older npm versions omit that unsupportedoption because they run lifecycle scripts normally.Darwin's release tests derive the reviewed list from package-lock.json and failwhen a production dependency adds or removes an install script. This keeps theinstaller policy explicit without changing users' persistent npm configuration.
