@drops-it/dpm 1.0.6 → 1.1.5

package/README.md

@@ -1,43 +1,42 @@
 # dpm
 
-**Drops Package Manager** — a fast, privacy-minded CLI for installing, publishing, and auditing Node packages on [dpm.drops-it.com](https://dpm.drops-it.com), with automatic npm fallback for anything not on the registry.
+**Drops Package Manager** — a fast, privacy-minded CLI for installing, publishing, running, and auditing packages on [dpm.drops-it.com](https://dpm.drops-it.com), with automatic npm fallback for anything not on the registry.
 
 ```text
   ┌─────────────────────────────────────────┐
   │  dpm i lodash                           │
-  │  → resolving 1 top-level dependency     │
+  │  → installing dependencies…             │
   │  ✔ added 1 package in 0.4s              │
   │  found 0 vulnerabilities                │
   └─────────────────────────────────────────┘
 ```
 
-Requires **Node.js 22+**.
+The Windows installer ships a managed DPM runtime (used for install + `dpm run`). You never need to invoke another runtime by name.
 
 ---
 
 ## Install
 
-**From DPM (recommended)**
+**Windows**
+
+Download [`dpm.exe`](https://dpm.drops-it.com/download/dpm.exe) and run it once (double-click). It installs into your user profile, adds `dpm` to PATH, installs the DPM runtime, and creates a Start Menu shortcut.
 
 ```bash
-# after you already have any dpm binary once:
-dpm i -g dpm
+# after install, open a NEW terminal:
+dpm --help
+dpm login
 ```
 
 **From npm**
 
 ```bash
-npm i -g @drops-it/dpm
+npm install -g @drops-it/dpm
 ```
 
-**Windows launcher**
-
-Download [`dpm.exe`](https://dpm.drops-it.com/download/dpm.exe) — it boots the CLI if Node is installed.
-
-Verify:
+**How To Update DPM** (once you already have any `dpm`)
 
 ```bash
-dpm --version
+dpm i -g dpm
 ```
 
 ---
@@ -49,6 +48,7 @@ dpm login                 # browser device flow (Drops-IT)
 dpm init                  # create package.json
 dpm i lodash              # add + install
 dpm i                     # install from package.json
+dpm run starter           # run a package.json script
 dpm publish --access public
 ```
 
@@ -74,6 +74,13 @@ dpm whoami
 | `dpm rm -g` | Remove the global **dpm** CLI + bin shims |
 | `dpm rm -g <pkg>` | Uninstall a global package |
 | `dpm update` | Re-resolve and reinstall |
+| `dpm run <script>` | Run a `package.json` script |
+| `dpm test` | Run tests |
+| `dpm x` / `exec` | Execute a package binary |
+| `dpm build` | Bundle with the DPM runtime |
+| `dpm --watch <file>` | Run a file with reload (e.g. API server) |
+| `dpm <file>` | Run a JS/TS file |
+| `dpm create` / `repl` / `pm` / `link` / `unlink` / `outdated` / `patch` / `why` / `info` / `upgrade` | Toolkit commands (managed runtime) |
 | `dpm search <q>` | Search the registry |
 | `dpm view <name>` | Show package metadata |
 | `dpm publish [--access public\|private]` | Publish the current package |
@@ -86,9 +93,9 @@ dpm whoami
 
 ## Install experience
 
-- One live status line with a spinner while packages resolve / download / extract
+- Fast parallel installs via the managed DPM runtime against the DPM registry (`/npm` facade)
 - Colorized success, warnings, and severity
-- Post-install **advisory report** (npm-compatible bulk advisories)
+- Post-install **advisory report**
 - Fix hints: `dpm audit fix` / `dpm audit fix --force`
 - Transitive fixes can land in `package.json` `overrides` so they stick
 
@@ -105,11 +112,11 @@ dpm audit fix
 On the **first `dpm` command in a new terminal**, dpm checks the DPM registry for a newer CLI.
 
 ```text
-▲ dpm update available: 1.0.3 → 1.0.4
+▲ dpm update available: 1.1.0 → 1.1.1
   Update with: dpm i -g dpm
 ```
 
-No daily nag. No npm noise — updates are driven by the DPM package `dpm`.
+No daily nag. Updates are driven by the DPM package `dpm`.
 
 ---
 

package/dist/config.js

@@ -4,16 +4,29 @@ import path from "node:path";
 import YAML from "yaml";
 const CONFIG_PATH = path.join(homedir(), ".dpmrc");
 export async function loadConfig() {
+    let config;
     try {
         const raw = await readFile(CONFIG_PATH, "utf8");
-        return JSON.parse(raw);
+        config = JSON.parse(raw);
     }
     catch {
-        return {
-            registry: process.env.DPM_REGISTRY || "https://dpm.drops-it.com",
-            token: process.env.DPM_TOKEN,
+        config = {
+            registry: "https://dpm.drops-it.com",
         };
     }
+    // Env can override the API host — but public npm is an install fallback only,
+    // never a DPM registry API (publish/login/search would 404 there).
+    if (process.env.DPM_REGISTRY) {
+        const raw = process.env.DPM_REGISTRY.trim();
+        const isPublicNpm = raw === "npmjs" ||
+            /registry\.npmjs\.org/i.test(raw) ||
+            /^https?:\/\/npmjs\.org\/?$/i.test(raw);
+        if (!isPublicNpm)
+            config.registry = raw;
+    }
+    if (process.env.DPM_TOKEN)
+        config.token = process.env.DPM_TOKEN;
+    return config;
 }
 export async function saveConfig(config) {
     await writeFile(CONFIG_PATH, JSON.stringify(config, null, 2), { mode: 0o600 });

package/dist/index.js

@@ -3,11 +3,99 @@ import { exec } from "node:child_process";
 import { Command } from "commander";
 import { DpmApi } from "./api.js";
 import { loadConfig, saveConfig, writePackageJson } from "./config.js";
-import { addPackages, auditFix, installAll, installGlobalPackages, packTarball, removeGlobalPackages, removePackage, runAudit, } from "./install.js";
+import { addPackages, auditFix, installGlobalPackages, packTarball, removeGlobalPackages, removePackage, runAudit, syncLockFromNodeModules, } from "./install.js";
+import { ensureInstallConfig, runtimeInstallEnv, spawnRuntime } from "./runtime.js";
 import { createUi } from "./ui.js";
 import { CLI_VERSION, maybeNotifyUpdate } from "./updateCheck.js";
+/**
+ * Commands handled by DPM itself (registry / auth / branded PM wrappers).
+ * Everything else — including all other runtime CLI commands — is forwarded.
+ */
+const NATIVE_COMMANDS = new Set([
+    "config",
+    "login",
+    "logout",
+    "whoami",
+    "init",
+    "search",
+    "view",
+    "install",
+    "i",
+    "add",
+    "a",
+    "update",
+    "remove",
+    "rm",
+    "uninstall",
+    "audit",
+    "publish",
+    "run",
+    "test",
+    "x",
+    "exec",
+    "build",
+    "help",
+]);
+function argvAfterCommand(names) {
+    const idx = process.argv.findIndex((a, i) => i >= 2 && names.includes(a));
+    if (idx < 0)
+        return process.argv.slice(2);
+    return process.argv.slice(idx + 1);
+}
+function shouldForwardToRuntime(argv) {
+    const args = argv.slice(2);
+    if (args.length === 0)
+        return false;
+    const first = args[0];
+    // `-v` must stay on the CLI (Commander); do not forward to the runtime (Bun).
+    if (first === "-h" ||
+        first === "--help" ||
+        first === "-v" ||
+        first === "-V" ||
+        first === "--version") {
+        return false;
+    }
+    if (first.startsWith("-"))
+        return true;
+    return !NATIVE_COMMANDS.has(first);
+}
+/** Spawns the managed runtime with registry env for package-manager ops. */
+async function runtimePm(args) {
+    const config = await loadConfig();
+    await ensureInstallConfig(config, process.cwd());
+    return spawnRuntime({
+        args,
+        env: runtimeInstallEnv(config),
+        brandOutput: true,
+    });
+}
+/** Spawns the managed runtime for non-PM commands (run, test, build, …). */
+async function runtimeRaw(args) {
+    return spawnRuntime({
+        args,
+        brandOutput: true,
+    });
+}
 const program = new Command();
-program.name("dpm").description("Drops Package Manager").version(CLI_VERSION);
+program
+    .name("dpm")
+    .description("Drops Package Manager — same commands as a full JS toolkit, plus DPM registry auth/publish")
+    .version(CLI_VERSION, "-v, --version", "output the DPM CLI version")
+    .addHelpText("after", `
+Runtime (same surface as a modern JS toolkit; binary is managed by DPM):
+  dpm --watch <file>     Run a file with reload
+  dpm <file>             Run a JS/TS file
+  dpm create <template>  Scaffold from a template
+  dpm repl               Interactive REPL
+  dpm pm <subcommand>    Package utilities (ls, cache, …)
+  dpm outdated           List outdated deps
+  dpm link / unlink      Link local packages
+  dpm patch / why / info Extra package tools
+  dpm upgrade            Upgrade the managed DPM runtime
+
+DPM registry:
+  dpm login | publish | search | view | config
+`);
 program.hook("preAction", async () => {
     await maybeNotifyUpdate();
 });
@@ -81,17 +169,25 @@ program
 });
 program
     .command("init")
-    .description("Create a package.json")
+    .description("Create a package.json (or pass flags through to the runtime init)")
+    .allowUnknownOption(true)
+    .argument("[args...]")
     .action(async () => {
-    await writePackageJson({
-        name: "my-package",
-        version: "1.0.0",
-        description: "",
-        main: "index.js",
-        license: "MIT",
-        dependencies: {},
-    });
-    console.log("Created package.json");
+    const rest = argvAfterCommand(["init"]);
+    // No args → simple DPM scaffold; any flags/args → full runtime init
+    if (rest.length === 0) {
+        await writePackageJson({
+            name: "my-package",
+            version: "1.0.0",
+            description: "",
+            main: "index.js",
+            license: "MIT",
+            dependencies: {},
+        });
+        console.log("Created package.json");
+        return;
+    }
+    process.exit(await runtimeRaw(["init", ...rest]));
 });
 program
     .command("search")
@@ -118,53 +214,81 @@ program
 program
     .command("install")
     .alias("i")
-    .argument("[packages...]", "optional packages to add (like npm i lodash)")
-    .option("-g, --global", "install into the npm global prefix")
-    .description("Install package.json deps, or add packages then install")
-    .action(async (packages, opts) => {
-    const api = new DpmApi(await loadConfig());
-    const ui = createUi();
-    if (opts.global) {
-        await installGlobalPackages(api, packages, ui);
+    .description("Install deps via DPM registry (all runtime install flags supported)")
+    .allowUnknownOption(true)
+    .argument("[args...]")
+    .action(async () => {
+    const rest = argvAfterCommand(["install", "i"]);
+    const global = rest.includes("-g") || rest.includes("--global");
+    const packages = rest.filter((a) => !a.startsWith("-"));
+    if (global && packages.length > 0) {
+        const api = new DpmApi(await loadConfig());
+        await installGlobalPackages(api, packages, createUi());
         return;
     }
-    if (packages.length > 0) {
-        await addPackages(api, packages, process.cwd(), ui);
-        return;
+    if (!global && packages.length > 0 && rest.every((a) => !a.startsWith("-") || a === packages[0])) {
+        // Plain `dpm i lodash` / `dpm install lodash@1` without flags → add flow
+        if (rest.every((a) => !a.startsWith("-"))) {
+            const api = new DpmApi(await loadConfig());
+            await addPackages(api, packages, process.cwd(), createUi());
+            return;
+        }
     }
-    await installAll(api, process.cwd(), ui);
+    const code = await runtimePm(["install", ...rest]);
+    if (code !== 0)
+        process.exit(code);
+    await syncLockFromNodeModules(process.cwd());
 });
 program
     .command("add")
-    .argument("<packages...>")
-    .option("-g, --global", "install into the npm global prefix")
-    .description("Add dependencies to package.json and install")
-    .action(async (packages, opts) => {
-    const api = new DpmApi(await loadConfig());
-    const ui = createUi();
-    if (opts.global) {
-        await installGlobalPackages(api, packages, ui);
+    .alias("a")
+    .description("Add dependencies (runtime add flags supported)")
+    .allowUnknownOption(true)
+    .argument("[args...]")
+    .action(async () => {
+    const rest = argvAfterCommand(["add", "a"]);
+    const global = rest.includes("-g") || rest.includes("--global");
+    const packages = rest.filter((a) => !a.startsWith("-"));
+    if (global) {
+        const api = new DpmApi(await loadConfig());
+        await installGlobalPackages(api, packages, createUi());
+        return;
+    }
+    if (packages.length > 0 && rest.every((a) => !a.startsWith("-"))) {
+        const api = new DpmApi(await loadConfig());
+        await addPackages(api, packages, process.cwd(), createUi());
         return;
     }
-    await addPackages(api, packages, process.cwd(), ui);
+    const code = await runtimePm(["add", ...rest]);
+    if (code !== 0)
+        process.exit(code);
+    await syncLockFromNodeModules(process.cwd());
 });
 program
     .command("update")
-    .description("Re-resolve and install dependencies")
+    .description("Update dependencies (runtime update flags supported)")
+    .allowUnknownOption(true)
+    .argument("[args...]")
     .action(async () => {
-    const api = new DpmApi(await loadConfig());
-    await installAll(api, process.cwd(), createUi());
+    const rest = argvAfterCommand(["update"]);
+    const code = await runtimePm(["update", ...rest]);
+    if (code !== 0)
+        process.exit(code);
+    await syncLockFromNodeModules(process.cwd());
 });
 program
     .command("remove")
     .alias("rm")
     .alias("uninstall")
-    .argument("[packages...]", "package to remove (omit with -g to remove the dpm CLI)")
-    .option("-g, --global", "remove from the npm global prefix")
-    .description("Remove a dependency, or uninstall the global dpm CLI")
-    .action(async (packages, opts) => {
+    .description("Remove a dependency (or dpm rm -g for the global CLI)")
+    .allowUnknownOption(true)
+    .argument("[args...]")
+    .action(async () => {
+    const rest = argvAfterCommand(["remove", "rm", "uninstall"]);
+    const global = rest.includes("-g") || rest.includes("--global");
+    const packages = rest.filter((a) => !a.startsWith("-"));
     const ui = createUi();
-    if (opts.global) {
+    if (global) {
         await removeGlobalPackages(packages, ui);
         return;
     }
@@ -172,13 +296,20 @@ program
         console.error("Usage: dpm rm <name>   or   dpm rm -g");
         process.exit(1);
     }
-    for (const name of packages) {
-        await removePackage(name, process.cwd(), ui);
+    if (rest.every((a) => !a.startsWith("-"))) {
+        for (const name of packages) {
+            await removePackage(name, process.cwd(), ui);
+        }
+        return;
     }
+    const code = await runtimePm(["remove", ...rest]);
+    if (code !== 0)
+        process.exit(code);
+    await syncLockFromNodeModules(process.cwd());
 });
 const auditCmd = program
     .command("audit")
-    .description("Report known vulnerabilities (like npm audit)")
+    .description("Report known vulnerabilities")
     .action(async () => {
     const api = new DpmApi(await loadConfig());
     await runAudit(api, process.cwd(), createUi());
@@ -194,29 +325,82 @@ auditCmd
 program
     .command("publish")
     .option("--access <access>", "public or private")
+    .description("Publish the current package to the DPM registry")
     .action(async (opts) => {
     const api = new DpmApi(await loadConfig());
     const packed = await packTarball();
+    const manifest = { ...packed.manifest };
+    // CLI npm name maps to the DPM registry package `dpm`.
+    if (manifest.name === "@drops-it/dpm")
+        manifest.name = "dpm";
     const result = await api.publish({
-        manifest: packed.manifest,
+        manifest,
         tarballBase64: packed.tarballBase64,
-        access: opts.access,
+        access: opts.access ?? "public",
     });
     console.log(`Published ${result.name}@${result.version} (${result.access})`);
 });
 program
-    .command("link")
-    .description("Reserved for local workspace linking")
-    .action(() => {
-    console.log("Use file: dependencies or workspaces for now.");
+    .command("run")
+    .description("Run a package.json script or file")
+    .allowUnknownOption(true)
+    .argument("[args...]")
+    .action(async () => {
+    process.exit(await runtimeRaw(["run", ...argvAfterCommand(["run"])]));
+});
+program
+    .command("test")
+    .description("Run tests")
+    .allowUnknownOption(true)
+    .argument("[args...]")
+    .action(async () => {
+    process.exit(await runtimeRaw(["test", ...argvAfterCommand(["test"])]));
+});
+program
+    .command("x")
+    .alias("exec")
+    .description("Execute a package binary (installing if needed)")
+    .allowUnknownOption(true)
+    .argument("[args...]")
+    .action(async () => {
+    const name = process.argv.includes("exec") ? "exec" : "x";
+    // Prefer `x` for package bins; `exec` stays exec for shell-style
+    const cmd = name === "exec" ? "exec" : "x";
+    process.exit(await runtimeRaw([cmd, ...argvAfterCommand(["x", "exec"])]));
 });
 program
-    .command("unlink")
-    .description("Reserved for local workspace unlinking")
-    .action(() => {
-    console.log("Unlink placeholder — remove file: links from package.json.");
+    .command("build")
+    .description("Bundle with the DPM runtime")
+    .allowUnknownOption(true)
+    .argument("[args...]")
+    .action(async () => {
+    process.exit(await runtimeRaw(["build", ...argvAfterCommand(["build"])]));
 });
-program.parseAsync(process.argv).catch((err) => {
+async function main() {
+    if (shouldForwardToRuntime(process.argv)) {
+        await maybeNotifyUpdate();
+        const args = process.argv.slice(2);
+        // Package-manager-ish forwards still get DPM registry config
+        const pmFirst = new Set([
+            "link",
+            "unlink",
+            "outdated",
+            "pm",
+            "patch",
+            "why",
+            "info",
+            "list",
+            "create",
+        ]);
+        const first = args[0] ?? "";
+        const code = pmFirst.has(first)
+            ? await runtimePm(args)
+            : await runtimeRaw(args);
+        process.exit(code);
+    }
+    await program.parseAsync(process.argv);
+}
+main().catch((err) => {
     console.error(err instanceof Error ? err.message : err);
     process.exit(1);
 });

package/dist/install.d.ts

@@ -9,9 +9,7 @@ export type InstallLog = {
     clearStatus?: () => void;
 };
 export type InstallOptions = {
-    /** Prefer these exact versions when they satisfy the requested range. */
     preferredVersions?: Record<string, string>;
-    /** Skip the post-install vulnerability check (used by nested audit-fix reinstall). */
     skipAudit?: boolean;
 };
 /** Parse `name`, `name@1.2.3`, `name@^1`, `@scope/name`, `@scope/name@1.0.0`. */
@@ -19,20 +17,30 @@ export declare function parsePackageSpec(spec: string): {
     name: string;
     range: string;
 };
-export declare function installAll(api: DpmApi, cwd?: string, log?: InstallLog, options?: InstallOptions): Promise<Lockfile>;
+/**
+ * Builds a DPM lock snapshot from installed node_modules for audit tooling.
+ */
+export declare function syncLockFromNodeModules(cwd: string): Promise<Lockfile>;
+/** Installs package.json dependencies via the managed DPM runtime. */
+export declare function installAll(_api: DpmApi, cwd?: string, log?: InstallLog, options?: InstallOptions): Promise<Lockfile>;
+/** Adds packages then installs via the managed DPM runtime. */
 export declare function addPackages(api: DpmApi, specs: string[], cwd?: string, log?: InstallLog): Promise<Lockfile>;
 /**
- * Installs packages into the npm global prefix (bins linked by npm).
- * Downloads through the DPM registry so installs count as DPM downloads.
- * Used for CLI self-updates: `dpm i -g dpm` / `dpm i -g @drops-it/dpm`.
+ * Installs packages into the global prefix via the managed DPM runtime.
+ * Self-update of the Windows exe uses `/download/dpm.exe` instead of bun -g.
  */
-export declare function installGlobalPackages(api: DpmApi, specs: string[], log?: InstallLog): Promise<void>;
+export declare function installGlobalPackages(_api: DpmApi, specs: string[], log?: InstallLog): Promise<void>;
 /**
  * Uninstalls global packages (and cleans dpm bin shims when removing the CLI).
- * `dpm rm -g` with no names removes the dpm CLI itself.
+ * `dpm rm -g` with no names removes the dpm CLI itself (Windows exe + bun/npm globals).
  */
 export declare function removeGlobalPackages(specs: string[], log?: InstallLog): Promise<void>;
 export declare function addPackage(api: DpmApi, name: string, range?: string, cwd?: string, log?: InstallLog): Promise<Lockfile>;
+/**
+ * Removes a local dependency via the managed runtime.
+ * If Bun fails (e.g. ENOENT on an unrelated cached tarball), falls back to
+ * editing package.json + reinstall.
+ */
 export declare function removePackage(name: string, cwd?: string, log?: InstallLog): Promise<void>;
 /**
  * Runs a vulnerability audit against the current lockfile (or installs first).
@@ -42,12 +50,13 @@ export declare function runAudit(api: DpmApi, cwd?: string, log?: InstallLog): P
     fixes: ProposedFix[];
 }>;
 /**
- * Applies available advisory fixes (like `npm audit fix`), then reinstalls.
+ * Applies available advisory fixes, then reinstalls via the DPM runtime.
  */
 export declare function auditFix(api: DpmApi, cwd?: string, log?: InstallLog, force?: boolean): Promise<{
     fixed: ProposedFix[];
     lock: Lockfile;
 }>;
+/** Packs the current package into a gzipped tarball for publish. */
 export declare function packTarball(cwd?: string): Promise<{
     manifest: Record<string, unknown>;
     tarballBase64: string;