@drops-it/dpm 1.0.1 → 1.0.5

package/README.md

@@ -0,0 +1,170 @@
+# dpm
+
+**Drops Package Manager** — a fast, privacy-minded CLI for installing, publishing, and auditing Node packages on [dpm.drops-it.com](https://dpm.drops-it.com), with automatic npm fallback for anything not on the registry.
+
+```text
+  ┌─────────────────────────────────────────┐
+  │  dpm i lodash                           │
+  │  → resolving 1 top-level dependency     │
+  │  ✔ added 1 package in 0.4s              │
+  │  found 0 vulnerabilities                │
+  └─────────────────────────────────────────┘
+```
+
+Requires **Node.js 22+**.
+
+---
+
+## Install
+
+**From DPM (recommended)**
+
+```bash
+# after you already have any dpm binary once:
+dpm i -g dpm
+```
+
+**From npm**
+
+```bash
+npm i -g @drops-it/dpm
+```
+
+**Windows launcher**
+
+Download [`dpm.exe`](https://dpm.drops-it.com/download/dpm.exe) — it boots the CLI if Node is installed.
+
+Verify:
+
+```bash
+dpm --version
+```
+
+---
+
+## Quick start
+
+```bash
+dpm login                 # browser device flow (Drops-IT)
+dpm init                  # create package.json
+dpm i lodash              # add + install
+dpm i                     # install from package.json
+dpm publish --access public
+```
+
+Config lives in `~/.dpmrc` (registry + token). Defaults to `https://dpm.drops-it.com`.
+
+```bash
+dpm config registry https://dpm.drops-it.com
+dpm whoami
+```
+
+---
+
+## Commands
+
+| Command | What it does |
+| --- | --- |
+| `dpm login` / `logout` / `whoami` | Auth via Drops-IT |
+| `dpm init` | Scaffold `package.json` |
+| `dpm i` / `dpm install` | Install deps (or add packages then install) |
+| `dpm i -g <pkg>` | Global install (counts as a DPM download) |
+| `dpm add <pkg…>` | Add to `package.json` and install |
+| `dpm rm` / `remove` / `uninstall` | Remove a local dependency |
+| `dpm rm -g` | Remove the global **dpm** CLI + bin shims |
+| `dpm rm -g <pkg>` | Uninstall a global package |
+| `dpm update` | Re-resolve and reinstall |
+| `dpm search <q>` | Search the registry |
+| `dpm view <name>` | Show package metadata |
+| `dpm publish [--access public\|private]` | Publish the current package |
+| `dpm audit` | Report known vulnerabilities |
+| `dpm audit fix` | Apply non-breaking fixes |
+| `dpm audit fix --force` | Allow breaking upgrades |
+| `dpm config [key] [value]` | Read/write CLI config |
+
+---
+
+## Install experience
+
+- One live status line with a spinner while packages resolve / download / extract
+- Colorized success, warnings, and severity
+- Post-install **advisory report** (npm-compatible bulk advisories)
+- Fix hints: `dpm audit fix` / `dpm audit fix --force`
+- Transitive fixes can land in `package.json` `overrides` so they stick
+
+```bash
+dpm i lodash@4.17.20
+dpm audit
+dpm audit fix
+```
+
+---
+
+## Updates
+
+On the **first `dpm` command in a new terminal**, dpm checks the DPM registry for a newer CLI.
+
+```text
+▲ dpm update available: 1.0.3 → 1.0.4
+  Update with: dpm i -g dpm
+```
+
+No daily nag. No npm noise — updates are driven by the DPM package `dpm`.
+
+---
+
+## Registry behavior
+
+1. Resolve on **DPM** first (`dpm` packages you publish, public or private).
+2. Missing public packages fall through to **npm** and are cached by the registry.
+3. Private scoped packages are free on DPM — use your `@username` or org scope after login.
+
+```bash
+dpm publish --access private   # scoped private packages
+dpm publish --access public
+```
+
+---
+
+## Global CLI lifecycle
+
+```bash
+dpm i -g dpm          # install / update the CLI from DPM
+dpm rm -g             # remove dpm + Windows/Unix shims
+```
+
+`dpm i -g @drops-it/dpm` is accepted and mapped to the DPM package `dpm`.
+
+---
+
+## Development
+
+```bash
+cd cli
+npm install
+npm run build
+npm link              # puts `dpm` on your PATH from this checkout
+npm run dev -- --help
+```
+
+Windows native binary:
+
+```bash
+npm run build:windows --prefix cli
+# optional Authenticode:
+# npm run sign:windows --prefix cli
+```
+
+---
+
+## Links
+
+- Website / registry: [dpm.drops-it.com](https://dpm.drops-it.com)
+- npm package: [`@drops-it/dpm`](https://www.npmjs.com/package/@drops-it/dpm)
+- DPM package: `dpm`
+
+---
+
+## License
+
+MIT © Drops-IT

package/dist/index.js

@@ -3,7 +3,7 @@ import { exec } from "node:child_process";
 import { Command } from "commander";
 import { DpmApi } from "./api.js";
 import { loadConfig, saveConfig, writePackageJson } from "./config.js";
-import { addPackages, auditFix, installAll, installGlobalPackages, packTarball, removePackage, runAudit, } from "./install.js";
+import { addPackages, auditFix, installAll, installGlobalPackages, packTarball, removeGlobalPackages, removePackage, runAudit, } from "./install.js";
 import { createUi } from "./ui.js";
 import { CLI_VERSION, maybeNotifyUpdate } from "./updateCheck.js";
 const program = new Command();
@@ -158,9 +158,23 @@ program
 program
     .command("remove")
     .alias("rm")
-    .argument("<name>")
-    .action(async (name) => {
-    await removePackage(name, process.cwd(), createUi());
+    .alias("uninstall")
+    .argument("[packages...]", "package to remove (omit with -g to remove the dpm CLI)")
+    .option("-g, --global", "remove from the npm global prefix")
+    .description("Remove a dependency, or uninstall the global dpm CLI")
+    .action(async (packages, opts) => {
+    const ui = createUi();
+    if (opts.global) {
+        await removeGlobalPackages(packages, ui);
+        return;
+    }
+    if (packages.length === 0) {
+        console.error("Usage: dpm rm <name>   or   dpm rm -g");
+        process.exit(1);
+    }
+    for (const name of packages) {
+        await removePackage(name, process.cwd(), ui);
+    }
 });
 const auditCmd = program
     .command("audit")

package/dist/install.d.ts

@@ -23,9 +23,15 @@ export declare function installAll(api: DpmApi, cwd?: string, log?: InstallLog,
 export declare function addPackages(api: DpmApi, specs: string[], cwd?: string, log?: InstallLog): Promise<Lockfile>;
 /**
  * Installs packages into the npm global prefix (bins linked by npm).
- * Used for CLI self-updates: `dpm i -g @drops-it/dpm`.
+ * Downloads through the DPM registry so installs count as DPM downloads.
+ * Used for CLI self-updates: `dpm i -g dpm` / `dpm i -g @drops-it/dpm`.
  */
 export declare function installGlobalPackages(api: DpmApi, specs: string[], log?: InstallLog): Promise<void>;
+/**
+ * Uninstalls global packages (and cleans dpm bin shims when removing the CLI).
+ * `dpm rm -g` with no names removes the dpm CLI itself.
+ */
+export declare function removeGlobalPackages(specs: string[], log?: InstallLog): Promise<void>;
 export declare function addPackage(api: DpmApi, name: string, range?: string, cwd?: string, log?: InstallLog): Promise<Lockfile>;
 export declare function removePackage(name: string, cwd?: string, log?: InstallLog): Promise<void>;
 /**

package/dist/install.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
-import { execFile } from "node:child_process";
+import { execFile, exec } from "node:child_process";
 import { access, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
 import path from "node:path";
 import { promisify } from "node:util";
 import * as tar from "tar";
@@ -10,6 +11,25 @@ import { c } from "./colors.js";
 import { loadLockfile, readPackageJson, saveLockfile, writePackageJson, } from "./config.js";
 import { createUi } from "./ui.js";
 const execFileAsync = promisify(execFile);
+const execAsync = promisify(exec);
+function quoteNpmArg(value) {
+    if (!/[ \t"&<>|^]/.test(value))
+        return value;
+    return `"${value.replace(/"/g, '\\"')}"`;
+}
+async function runNpm(args) {
+    if (process.platform === "win32") {
+        const cmdline = ["npm", ...args.map(quoteNpmArg)].join(" ");
+        return execAsync(cmdline, {
+            windowsHide: true,
+            maxBuffer: 10 * 1024 * 1024,
+        });
+    }
+    return execFileAsync("npm", args, {
+        windowsHide: true,
+        maxBuffer: 10 * 1024 * 1024,
+    });
+}
 function asUi(log) {
     if ("status" in log && typeof log.status === "function" && "clearStatus" in log) {
         return log;
@@ -199,7 +219,8 @@ export async function addPackages(api, specs, cwd = process.cwd(), log = createU
 }
 /**
  * Installs packages into the npm global prefix (bins linked by npm).
- * Used for CLI self-updates: `dpm i -g @drops-it/dpm`.
+ * Downloads through the DPM registry so installs count as DPM downloads.
+ * Used for CLI self-updates: `dpm i -g dpm` / `dpm i -g @drops-it/dpm`.
  */
 export async function installGlobalPackages(api, specs, log = createUi()) {
     if (specs.length === 0) {
@@ -207,7 +228,10 @@ export async function installGlobalPackages(api, specs, log = createUi()) {
     }
     const ui = asUi(log);
     for (const spec of specs) {
-        const { name, range } = parsePackageSpec(spec);
+        let { name, range } = parsePackageSpec(spec);
+        // CLI lives on DPM as unscoped `dpm` — map the npm name away.
+        if (name === "@drops-it/dpm")
+            name = "dpm";
         setStatus(ui, `resolve ${c.bold(name)}`);
         const meta = await api.getPackage(name);
         if (!meta)
@@ -217,16 +241,17 @@ export async function installGlobalPackages(api, specs, log = createUi()) {
         if (!version)
             throw new Error(`No version of ${name} matches ${range}`);
         const ver = meta.versions.find((v) => v.version === version);
+        // Prefer the DPM tarball URL so the registry records the download.
+        const tarballUrl = ver.dist.tarball.includes("/dpm/v1/packages/")
+            ? ver.dist.tarball
+            : `/dpm/v1/packages/${encodeURIComponent(name)}/-/${encodeURIComponent(name)}-${version}.tgz`;
         setStatus(ui, `download ${c.bold(name)}@${c.green(version)}`);
-        const tarball = await api.downloadTarball(ver.dist.tarball);
-        const tmp = path.join(process.cwd(), `.dpm-global-${Date.now()}-${Math.random().toString(16).slice(2)}.tgz`);
+        const tarball = await api.downloadTarball(tarballUrl);
+        const tmp = path.join(tmpdir(), `dpm-global-${Date.now()}-${Math.random().toString(16).slice(2)}.tgz`);
         await writeFile(tmp, tarball);
         try {
             setStatus(ui, `npm install -g ${c.bold(name)}@${c.green(version)}`);
-            await execFileAsync("npm", ["install", "-g", tmp], {
-                windowsHide: true,
-                maxBuffer: 10 * 1024 * 1024,
-            });
+            await runNpm(["install", "-g", tmp]);
         }
         finally {
             await rm(tmp, { force: true });
@@ -238,6 +263,79 @@ export async function installGlobalPackages(api, specs, log = createUi()) {
             ui.info(`installed ${name}@${version} globally`);
     }
 }
+async function npmGlobalPrefix() {
+    const { stdout } = await runNpm(["prefix", "-g"]);
+    return stdout.toString().trim();
+}
+async function tryNpmUninstallGlobal(name) {
+    try {
+        await runNpm(["uninstall", "-g", name]);
+    }
+    catch {
+        try {
+            await runNpm(["unlink", "-g", name]);
+        }
+        catch {
+            // Package may already be gone.
+        }
+    }
+}
+/** Removes leftover Windows/Unix bin shims for a command name. */
+async function removeGlobalBinShims(binName, prefix) {
+    const candidates = [
+        path.join(prefix, binName),
+        path.join(prefix, `${binName}.cmd`),
+        path.join(prefix, `${binName}.ps1`),
+        path.join(prefix, "node_modules", ".bin", binName),
+        path.join(prefix, "node_modules", ".bin", `${binName}.cmd`),
+        path.join(prefix, "node_modules", ".bin", `${binName}.ps1`),
+    ];
+    await Promise.all(candidates.map((p) => rm(p, { force: true })));
+}
+const CLI_SELF_NAMES = ["@drops-it/dpm", "dpm"];
+/**
+ * Uninstalls global packages (and cleans dpm bin shims when removing the CLI).
+ * `dpm rm -g` with no names removes the dpm CLI itself.
+ */
+export async function removeGlobalPackages(specs, log = createUi()) {
+    const ui = asUi(log);
+    const targets = specs.length > 0
+        ? specs.map((s) => parsePackageSpec(s).name)
+        : [...CLI_SELF_NAMES];
+    const prefix = await npmGlobalPrefix();
+    const removingSelf = targets.some((n) => CLI_SELF_NAMES.includes(n));
+    for (const name of targets) {
+        setStatus(ui, `uninstall -g ${c.bold(name)}`);
+        await tryNpmUninstallGlobal(name);
+        // Scoped packages may leave the unscoped alias around.
+        if (name === "@drops-it/dpm")
+            await tryNpmUninstallGlobal("dpm");
+        if (name === "dpm")
+            await tryNpmUninstallGlobal("@drops-it/dpm");
+    }
+    if (removingSelf) {
+        await removeGlobalBinShims("dpm", prefix);
+        // Also clear a linked/local leftover under the user npm folder on Windows.
+        const roaming = path.join(homedir(), "AppData", "Roaming", "npm");
+        if (roaming.toLowerCase() !== prefix.toLowerCase()) {
+            await removeGlobalBinShims("dpm", roaming);
+        }
+        await rm(path.join(prefix, "node_modules", "dpm"), { recursive: true, force: true });
+        await rm(path.join(prefix, "node_modules", "@drops-it", "dpm"), {
+            recursive: true,
+            force: true,
+        });
+    }
+    ui.clearStatus();
+    if (ui.success) {
+        ui.success(removingSelf && specs.length === 0
+            ? "removed global dpm (bins + package)"
+            : `removed global ${targets.join(", ")}`);
+    }
+    else {
+        ui.info(`removed global ${targets.join(", ")}`);
+    }
+}
 export async function addPackage(api, name, range = "latest", cwd = process.cwd(), log = createUi()) {
     const spec = range === "latest" ? name : `${name}@${range}`;
     return addPackages(api, [spec], cwd, log);

package/dist/updateCheck.d.ts

@@ -1,7 +1,7 @@
 export declare const CLI_NAME: string;
 export declare const CLI_VERSION: string;
 /**
- * On the first dpm command of each day, checks DPM + npm for a newer CLI
- * and prints how to update with dpm when one exists. Never blocks on failure.
+ * On the first dpm command in a new terminal session, checks the DPM registry
+ * for a newer CLI and prints how to update with dpm. Never blocks on failure.
  */
 export declare function maybeNotifyUpdate(): Promise<void>;

package/dist/updateCheck.js

@@ -9,31 +9,35 @@ const require = createRequire(import.meta.url);
 const pkg = require("../package.json");
 export const CLI_NAME = pkg.name;
 export const CLI_VERSION = pkg.version;
-/** Package names checked for a newer CLI release. */
-const UPDATE_CANDIDATES = ["dpm", "@drops-it/dpm"];
 const STATE_DIR = path.join(homedir(), ".dpm");
 const STATE_PATH = path.join(STATE_DIR, "update-check.json");
-function todayKey() {
-    const d = new Date();
-    const y = d.getFullYear();
-    const m = String(d.getMonth() + 1).padStart(2, "0");
-    const day = String(d.getDate()).padStart(2, "0");
-    return `${y}-${m}-${day}`;
+/** Identifies the current terminal so we only notify once per new shell. */
+function sessionKey() {
+    const parts = [`ppid:${process.ppid}`];
+    if (process.env.WT_SESSION)
+        parts.push(`wt:${process.env.WT_SESSION}`);
+    if (process.env.TERM_SESSION_ID)
+        parts.push(`term:${process.env.TERM_SESSION_ID}`);
+    return parts.join("|");
 }
 async function loadState() {
     try {
-        return JSON.parse(await readFile(STATE_PATH, "utf8"));
+        const raw = JSON.parse(await readFile(STATE_PATH, "utf8"));
+        if (Array.isArray(raw.sessions)) {
+            return { sessions: raw.sessions.slice(-40), latest: raw.latest };
+        }
+        return { sessions: [], latest: raw.latest };
     }
     catch {
-        return null;
+        return { sessions: [] };
     }
 }
 async function saveState(state) {
     await mkdir(STATE_DIR, { recursive: true });
-    await writeFile(STATE_PATH, JSON.stringify(state), { mode: 0o600 });
+    await writeFile(STATE_PATH, JSON.stringify({ sessions: state.sessions.slice(-40), latest: state.latest }), { mode: 0o600 });
 }
-async function fetchLatestFromDpm(name, registry) {
-    const url = `${registry.replace(/\/$/, "")}/dpm/v1/packages/${encodeURIComponent(name)}`;
+async function fetchLatestFromDpm(registry) {
+    const url = `${registry.replace(/\/$/, "")}/dpm/v1/packages/dpm`;
     const res = await fetch(url, {
         headers: { accept: "application/json", "user-agent": `dpm-cli/${CLI_VERSION}` },
         signal: AbortSignal.timeout(2500),
@@ -43,59 +47,31 @@ async function fetchLatestFromDpm(name, registry) {
     const data = (await res.json());
     return data.latest || data["dist-tags"]?.latest || null;
 }
-async function fetchLatestFromNpm(name) {
-    const scopedUrl = name.startsWith("@")
-        ? `https://registry.npmjs.org/${name.replace("/", "%2F")}`
-        : `https://registry.npmjs.org/${encodeURIComponent(name)}`;
-    const res = await fetch(scopedUrl, {
-        headers: { accept: "application/json", "user-agent": `dpm-cli/${CLI_VERSION}` },
-        signal: AbortSignal.timeout(2500),
-    });
-    if (!res.ok)
-        return null;
-    const data = (await res.json());
-    return data["dist-tags"]?.latest || null;
-}
-async function resolveNewestAvailable() {
-    const config = await loadConfig();
-    const found = [];
-    await Promise.all(UPDATE_CANDIDATES.map(async (name) => {
-        const [dpm, npm] = await Promise.all([
-            fetchLatestFromDpm(name, config.registry).catch(() => null),
-            fetchLatestFromNpm(name).catch(() => null),
-        ]);
-        if (dpm && semver.valid(dpm))
-            found.push(dpm);
-        if (npm && semver.valid(npm))
-            found.push(npm);
-    }));
-    if (found.length === 0)
-        return null;
-    return found.sort(semver.rcompare)[0] ?? null;
-}
 /**
- * On the first dpm command of each day, checks DPM + npm for a newer CLI
- * and prints how to update with dpm when one exists. Never blocks on failure.
+ * On the first dpm command in a new terminal session, checks the DPM registry
+ * for a newer CLI and prints how to update with dpm. Never blocks on failure.
  */
 export async function maybeNotifyUpdate() {
-    const day = todayKey();
+    const session = sessionKey();
     const prev = await loadState();
-    if (prev?.day === day)
+    if (prev.sessions.includes(session))
         return;
-    // Mark the day early so a slow/failed check does not retry every command.
-    await saveState({ day, latest: prev?.latest });
+    await saveState({ sessions: [...prev.sessions, session], latest: prev.latest });
     try {
-        const latest = await resolveNewestAvailable();
-        if (!latest || !semver.valid(CLI_VERSION))
+        const config = await loadConfig();
+        const latest = await fetchLatestFromDpm(config.registry);
+        if (!latest || !semver.valid(latest) || !semver.valid(CLI_VERSION))
             return;
-        await saveState({ day, latest });
+        await saveState({
+            sessions: [...prev.sessions, session],
+            latest,
+        });
         if (!semver.gt(latest, CLI_VERSION))
             return;
-        const updatePkg = CLI_NAME.startsWith("@") ? CLI_NAME : "@drops-it/dpm";
         console.error([
             "",
             `${c.yellow("▲")} ${c.bold("dpm")} update available: ${c.dim(CLI_VERSION)} ${c.cyan("→")} ${c.green(latest)}`,
-            `  Update with: ${c.bold(`dpm i -g ${updatePkg}`)}`,
+            `  Update with: ${c.bold("dpm i -g dpm")}`,
             "",
         ].join("\n"));
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drops-it/dpm",
-  "version": "1.0.1",
+  "version": "1.0.5",
   "description": "Drops Package Manager CLI",
   "type": "module",
   "bin": {