@drops-it/dpm 1.0.4 → 1.0.5

package/README.md

@@ -0,0 +1,170 @@
+# dpm
+
+**Drops Package Manager** — a fast, privacy-minded CLI for installing, publishing, and auditing Node packages on [dpm.drops-it.com](https://dpm.drops-it.com), with automatic npm fallback for anything not on the registry.
+
+```text
+  ┌─────────────────────────────────────────┐
+  │  dpm i lodash                           │
+  │  → resolving 1 top-level dependency     │
+  │  ✔ added 1 package in 0.4s              │
+  │  found 0 vulnerabilities                │
+  └─────────────────────────────────────────┘
+```
+
+Requires **Node.js 22+**.
+
+---
+
+## Install
+
+**From DPM (recommended)**
+
+```bash
+# after you already have any dpm binary once:
+dpm i -g dpm
+```
+
+**From npm**
+
+```bash
+npm i -g @drops-it/dpm
+```
+
+**Windows launcher**
+
+Download [`dpm.exe`](https://dpm.drops-it.com/download/dpm.exe) — it boots the CLI if Node is installed.
+
+Verify:
+
+```bash
+dpm --version
+```
+
+---
+
+## Quick start
+
+```bash
+dpm login                 # browser device flow (Drops-IT)
+dpm init                  # create package.json
+dpm i lodash              # add + install
+dpm i                     # install from package.json
+dpm publish --access public
+```
+
+Config lives in `~/.dpmrc` (registry + token). Defaults to `https://dpm.drops-it.com`.
+
+```bash
+dpm config registry https://dpm.drops-it.com
+dpm whoami
+```
+
+---
+
+## Commands
+
+| Command | What it does |
+| --- | --- |
+| `dpm login` / `logout` / `whoami` | Auth via Drops-IT |
+| `dpm init` | Scaffold `package.json` |
+| `dpm i` / `dpm install` | Install deps (or add packages then install) |
+| `dpm i -g <pkg>` | Global install (counts as a DPM download) |
+| `dpm add <pkg…>` | Add to `package.json` and install |
+| `dpm rm` / `remove` / `uninstall` | Remove a local dependency |
+| `dpm rm -g` | Remove the global **dpm** CLI + bin shims |
+| `dpm rm -g <pkg>` | Uninstall a global package |
+| `dpm update` | Re-resolve and reinstall |
+| `dpm search <q>` | Search the registry |
+| `dpm view <name>` | Show package metadata |
+| `dpm publish [--access public\|private]` | Publish the current package |
+| `dpm audit` | Report known vulnerabilities |
+| `dpm audit fix` | Apply non-breaking fixes |
+| `dpm audit fix --force` | Allow breaking upgrades |
+| `dpm config [key] [value]` | Read/write CLI config |
+
+---
+
+## Install experience
+
+- One live status line with a spinner while packages resolve / download / extract
+- Colorized success, warnings, and severity
+- Post-install **advisory report** (npm-compatible bulk advisories)
+- Fix hints: `dpm audit fix` / `dpm audit fix --force`
+- Transitive fixes can land in `package.json` `overrides` so they stick
+
+```bash
+dpm i lodash@4.17.20
+dpm audit
+dpm audit fix
+```
+
+---
+
+## Updates
+
+On the **first `dpm` command in a new terminal**, dpm checks the DPM registry for a newer CLI.
+
+```text
+▲ dpm update available: 1.0.3 → 1.0.4
+  Update with: dpm i -g dpm
+```
+
+No daily nag. No npm noise — updates are driven by the DPM package `dpm`.
+
+---
+
+## Registry behavior
+
+1. Resolve on **DPM** first (`dpm` packages you publish, public or private).
+2. Missing public packages fall through to **npm** and are cached by the registry.
+3. Private scoped packages are free on DPM — use your `@username` or org scope after login.
+
+```bash
+dpm publish --access private   # scoped private packages
+dpm publish --access public
+```
+
+---
+
+## Global CLI lifecycle
+
+```bash
+dpm i -g dpm          # install / update the CLI from DPM
+dpm rm -g             # remove dpm + Windows/Unix shims
+```
+
+`dpm i -g @drops-it/dpm` is accepted and mapped to the DPM package `dpm`.
+
+---
+
+## Development
+
+```bash
+cd cli
+npm install
+npm run build
+npm link              # puts `dpm` on your PATH from this checkout
+npm run dev -- --help
+```
+
+Windows native binary:
+
+```bash
+npm run build:windows --prefix cli
+# optional Authenticode:
+# npm run sign:windows --prefix cli
+```
+
+---
+
+## Links
+
+- Website / registry: [dpm.drops-it.com](https://dpm.drops-it.com)
+- npm package: [`@drops-it/dpm`](https://www.npmjs.com/package/@drops-it/dpm)
+- DPM package: `dpm`
+
+---
+
+## License
+
+MIT © Drops-IT

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drops-it/dpm",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "Drops Package Manager CLI",
   "type": "module",
   "bin": {
@@ -26,8 +26,7 @@
     "commander": "^12.1.0",
     "semver": "^7.6.3",
     "tar": "^7.4.3",
-    "yaml": "^2.7.0",
-    "magmastream": "^2.10.2"
+    "yaml": "^2.7.0"
   },
   "devDependencies": {
     "@types/node": "^22.10.5",