@drops-it/dpm 1.1.1 → 1.1.5

package/dist/config.js

@@ -14,9 +14,16 @@ export async function loadConfig() {
             registry: "https://dpm.drops-it.com",
         };
     }
-    // Env wins (Pterodactyl bootstrap sets DPM_REGISTRY=npmjs).
-    if (process.env.DPM_REGISTRY)
-        config.registry = process.env.DPM_REGISTRY;
+    // Env can override the API host — but public npm is an install fallback only,
+    // never a DPM registry API (publish/login/search would 404 there).
+    if (process.env.DPM_REGISTRY) {
+        const raw = process.env.DPM_REGISTRY.trim();
+        const isPublicNpm = raw === "npmjs" ||
+            /registry\.npmjs\.org/i.test(raw) ||
+            /^https?:\/\/npmjs\.org\/?$/i.test(raw);
+        if (!isPublicNpm)
+            config.registry = raw;
+    }
     if (process.env.DPM_TOKEN)
         config.token = process.env.DPM_TOKEN;
     return config;

package/dist/index.js

@@ -47,8 +47,10 @@ function shouldForwardToRuntime(argv) {
     if (args.length === 0)
         return false;
     const first = args[0];
+    // `-v` must stay on the CLI (Commander); do not forward to the runtime (Bun).
     if (first === "-h" ||
         first === "--help" ||
+        first === "-v" ||
         first === "-V" ||
         first === "--version") {
         return false;
@@ -78,7 +80,7 @@ const program = new Command();
 program
     .name("dpm")
     .description("Drops Package Manager — same commands as a full JS toolkit, plus DPM registry auth/publish")
-    .version(CLI_VERSION)
+    .version(CLI_VERSION, "-v, --version", "output the DPM CLI version")
     .addHelpText("after", `
 Runtime (same surface as a modern JS toolkit; binary is managed by DPM):
   dpm --watch <file>     Run a file with reload

package/dist/install.d.ts

@@ -27,16 +27,20 @@ export declare function installAll(_api: DpmApi, cwd?: string, log?: InstallLog,
 export declare function addPackages(api: DpmApi, specs: string[], cwd?: string, log?: InstallLog): Promise<Lockfile>;
 /**
  * Installs packages into the global prefix via the managed DPM runtime.
- * Used for CLI self-updates: `dpm i -g dpm` / `dpm i -g @drops-it/dpm`.
+ * Self-update of the Windows exe uses `/download/dpm.exe` instead of bun -g.
  */
 export declare function installGlobalPackages(_api: DpmApi, specs: string[], log?: InstallLog): Promise<void>;
 /**
  * Uninstalls global packages (and cleans dpm bin shims when removing the CLI).
- * `dpm rm -g` with no names removes the dpm CLI itself.
+ * `dpm rm -g` with no names removes the dpm CLI itself (Windows exe + bun/npm globals).
  */
 export declare function removeGlobalPackages(specs: string[], log?: InstallLog): Promise<void>;
 export declare function addPackage(api: DpmApi, name: string, range?: string, cwd?: string, log?: InstallLog): Promise<Lockfile>;
-/** Removes a local dependency via the managed DPM runtime. */
+/**
+ * Removes a local dependency via the managed runtime.
+ * If Bun fails (e.g. ENOENT on an unrelated cached tarball), falls back to
+ * editing package.json + reinstall.
+ */
 export declare function removePackage(name: string, cwd?: string, log?: InstallLog): Promise<void>;
 /**
  * Runs a vulnerability audit against the current lockfile (or installs first).

package/dist/install.js

@@ -7,6 +7,7 @@ import { c } from "./colors.js";
 import { loadConfig, loadLockfile, readPackageJson, saveLockfile, writePackageJson, } from "./config.js";
 import { ensureInstallConfig, runtimeInstallEnv, spawnRuntime, } from "./runtime.js";
 import { createUi } from "./ui.js";
+import { hasWindowsExeInstall, uninstallWindowsExe, updateWindowsExe, } from "./windowsInstall.js";
 function asUi(log) {
     if ("status" in log && typeof log.status === "function" && "clearStatus" in log) {
         return log;
@@ -126,7 +127,7 @@ export async function syncLockFromNodeModules(cwd) {
 async function prepareRuntimeInstall(cwd) {
     const config = await loadConfig();
     await ensureInstallConfig(config, cwd);
-    return { config, env: runtimeInstallEnv(config) };
+    return { config, env: runtimeInstallEnv(config, cwd) };
 }
 /** Installs package.json dependencies via the managed DPM runtime. */
 export async function installAll(_api, cwd = process.cwd(), log = createUi(), options = {}) {
@@ -142,7 +143,8 @@ export async function installAll(_api, cwd = process.cwd(), log = createUi(), op
         await writePackageJson(pkg, cwd);
     }
     const { env } = await prepareRuntimeInstall(cwd);
-    setStatus(ui, "installing dependencies…");
+    ui.clearStatus();
+    ui.info(`${c.dim("→")} installing dependencies…`);
     const started = Date.now();
     const code = await spawnRuntime({
         cwd,
@@ -150,7 +152,6 @@ export async function installAll(_api, cwd = process.cwd(), log = createUi(), op
         env,
         brandOutput: true,
     });
-    ui.clearStatus();
     if (code !== 0) {
         throw new Error(`install failed (exit ${code})`);
     }
@@ -183,14 +184,14 @@ export async function addPackages(api, specs, cwd = process.cwd(), log = createU
     const ui = asUi(log);
     await ensurePackageJson(cwd, ui);
     const { env } = await prepareRuntimeInstall(cwd);
-    setStatus(ui, `add ${specs.join(", ")}`);
+    ui.clearStatus();
+    ui.info(`${c.dim("→")} add ${specs.join(", ")}`);
     const code = await spawnRuntime({
         cwd,
         args: ["add", ...specs],
         env,
         brandOutput: true,
     });
-    ui.clearStatus();
     if (code !== 0)
         throw new Error(`add failed (exit ${code})`);
     for (const spec of specs) {
@@ -199,30 +200,62 @@ export async function addPackages(api, specs, cwd = process.cwd(), log = createU
     }
     return syncLockFromNodeModules(cwd);
 }
+const CLI_SELF_NAMES = ["@drops-it/dpm", "dpm"];
+function isCliSelfName(name) {
+    return CLI_SELF_NAMES.includes(name);
+}
 /**
  * Installs packages into the global prefix via the managed DPM runtime.
- * Used for CLI self-updates: `dpm i -g dpm` / `dpm i -g @drops-it/dpm`.
+ * Self-update of the Windows exe uses `/download/dpm.exe` instead of bun -g.
  */
 export async function installGlobalPackages(_api, specs, log = createUi()) {
     if (specs.length === 0) {
         throw new Error("global install requires at least one package name");
     }
     const ui = asUi(log);
-    const mapped = specs.map((spec) => {
+    const parsed = specs.map((spec) => {
         const { name, range } = parsePackageSpec(spec);
         const real = name === "@drops-it/dpm" ? "dpm" : name;
-        return range === "latest" ? real : `${real}@${range}`;
+        return { real, range, original: spec };
     });
+    const selfSpecs = parsed.filter((p) => isCliSelfName(p.real));
+    const otherSpecs = parsed.filter((p) => !isCliSelfName(p.real));
+    if (selfSpecs.length > 0 && (await hasWindowsExeInstall())) {
+        await updateWindowsExe(ui);
+    }
+    else if (selfSpecs.length > 0) {
+        // npm/bun global CLI install
+        const mapped = selfSpecs.map((p) => p.range === "latest" ? p.real : `${p.real}@${p.range}`);
+        const config = await loadConfig();
+        await ensureInstallConfig(config, process.cwd());
+        const env = runtimeInstallEnv(config);
+        ui.clearStatus();
+        ui.info(`${c.dim("→")} install -g ${mapped.join(", ")}`);
+        const code = await spawnRuntime({
+            args: ["add", "-g", ...mapped],
+            env,
+            brandOutput: true,
+        });
+        if (code !== 0)
+            throw new Error(`global install failed (exit ${code})`);
+        if (ui.success)
+            ui.success(`installed ${mapped.join(", ")} globally`);
+        else
+            ui.info(`installed ${mapped.join(", ")} globally`);
+    }
+    if (otherSpecs.length === 0)
+        return;
+    const mapped = otherSpecs.map((p) => p.range === "latest" ? p.real : `${p.real}@${p.range}`);
     const config = await loadConfig();
     await ensureInstallConfig(config, process.cwd());
     const env = runtimeInstallEnv(config);
-    setStatus(ui, `install -g ${mapped.join(", ")}`);
+    ui.clearStatus();
+    ui.info(`${c.dim("→")} install -g ${mapped.join(", ")}`);
     const code = await spawnRuntime({
         args: ["add", "-g", ...mapped],
         env,
         brandOutput: true,
     });
-    ui.clearStatus();
     if (code !== 0)
         throw new Error(`global install failed (exit ${code})`);
     if (ui.success)
@@ -230,12 +263,8 @@ export async function installGlobalPackages(_api, specs, log = createUi()) {
     else
         ui.info(`installed ${mapped.join(", ")} globally`);
 }
-const CLI_SELF_NAMES = ["@drops-it/dpm", "dpm"];
 async function runtimeGlobalPrefix() {
     // Best-effort: common user global paths when removing the CLI.
-    if (process.platform === "win32") {
-        return path.join(homedir(), ".dpm", "global");
-    }
     return path.join(homedir(), ".dpm", "global");
 }
 /** Removes leftover Windows/Unix bin shims for a command name. */
@@ -251,20 +280,51 @@ async function removeGlobalBinShims(binName, prefix) {
     ];
     await Promise.all(candidates.map((p) => rm(p, { force: true })));
 }
+/** Deletes leftover global package trees for the CLI (npm/bun prefixes). */
+async function scrubCliGlobalLeftovers() {
+    const prefix = await runtimeGlobalPrefix();
+    await removeGlobalBinShims("dpm", prefix);
+    const roaming = path.join(homedir(), "AppData", "Roaming", "npm");
+    await removeGlobalBinShims("dpm", roaming);
+    await rm(path.join(prefix, "node_modules", "dpm"), {
+        recursive: true,
+        force: true,
+    });
+    await rm(path.join(homedir(), ".bun", "install", "global", "node_modules", "dpm"), { recursive: true, force: true }).catch(() => undefined);
+    await rm(path.join(homedir(), "AppData", "Roaming", "npm", "node_modules", "@drops-it", "dpm"), { recursive: true, force: true }).catch(() => undefined);
+    await rm(path.join(homedir(), "AppData", "Roaming", "npm", "node_modules", "dpm"), { recursive: true, force: true }).catch(() => undefined);
+}
 /**
  * Uninstalls global packages (and cleans dpm bin shims when removing the CLI).
- * `dpm rm -g` with no names removes the dpm CLI itself.
+ * `dpm rm -g` with no names removes the dpm CLI itself (Windows exe + bun/npm globals).
  */
 export async function removeGlobalPackages(specs, log = createUi()) {
     const ui = asUi(log);
     const targets = specs.length > 0
-        ? specs.map((s) => parsePackageSpec(s).name).map((n) => (n === "@drops-it/dpm" ? "dpm" : n))
-        : [...CLI_SELF_NAMES];
+        ? [
+            ...new Set(specs
+                .map((s) => parsePackageSpec(s).name)
+                .map((n) => (n === "@drops-it/dpm" ? "dpm" : n))),
+        ]
+        : ["dpm"];
     const config = await loadConfig();
     const env = runtimeInstallEnv(config);
-    const removingSelf = targets.some((n) => CLI_SELF_NAMES.includes(n) || n === "dpm");
-    for (const name of targets) {
-        setStatus(ui, `uninstall -g ${c.bold(name)}`);
+    const removingSelf = targets.some(isCliSelfName);
+    const otherTargets = targets.filter((n) => !isCliSelfName(n));
+    let didWindowsUninstall = false;
+    if (removingSelf && (await hasWindowsExeInstall())) {
+        await uninstallWindowsExe(ui);
+        didWindowsUninstall = true;
+    }
+    // bun -g only for non-exe packages (and for self when not an exe install).
+    const bunTargets = didWindowsUninstall
+        ? otherTargets
+        : removingSelf
+            ? [...new Set([...otherTargets, "dpm"])]
+            : otherTargets;
+    for (const name of bunTargets) {
+        ui.clearStatus();
+        ui.info(`${c.dim("→")} uninstall -g ${c.bold(name)}`);
         await spawnRuntime({
             args: ["remove", "-g", name],
             env,
@@ -272,44 +332,96 @@ export async function removeGlobalPackages(specs, log = createUi()) {
         });
     }
     if (removingSelf) {
-        const prefix = await runtimeGlobalPrefix();
-        await removeGlobalBinShims("dpm", prefix);
-        const roaming = path.join(homedir(), "AppData", "Roaming", "npm");
-        await removeGlobalBinShims("dpm", roaming);
-        await rm(path.join(prefix, "node_modules", "dpm"), { recursive: true, force: true });
-        await rm(path.join(homedir(), ".bun", "install", "global", "node_modules", "dpm"), {
-            recursive: true,
-            force: true,
-        }).catch(() => undefined);
+        await scrubCliGlobalLeftovers();
     }
     ui.clearStatus();
-    if (ui.success) {
-        ui.success(removingSelf && specs.length === 0
-            ? "removed global dpm (bins + package)"
-            : `removed global ${targets.join(", ")}`);
+    if (didWindowsUninstall && otherTargets.length === 0) {
+        // uninstallWindowsExe already reported success
+        return;
     }
-    else {
-        ui.info(`removed global ${targets.join(", ")}`);
+    if (removingSelf && specs.length === 0) {
+        if (ui.success)
+            ui.success("removed global dpm");
+        else
+            ui.info("removed global dpm");
+        return;
     }
+    if (ui.success)
+        ui.success(`removed global ${targets.join(", ")}`);
+    else
+        ui.info(`removed global ${targets.join(", ")}`);
 }
 export async function addPackage(api, name, range = "latest", cwd = process.cwd(), log = createUi()) {
     const spec = range === "latest" ? name : `${name}@${range}`;
     return addPackages(api, [spec], cwd, log);
 }
-/** Removes a local dependency via the managed DPM runtime. */
+/** Drops a package name from package.json dependency maps. */
+async function stripFromPackageJson(name, cwd) {
+    const pkg = await readPackageJson(cwd);
+    let changed = false;
+    for (const field of [
+        "dependencies",
+        "devDependencies",
+        "optionalDependencies",
+        "peerDependencies",
+    ]) {
+        const bag = pkg[field];
+        if (bag && typeof bag === "object" && !Array.isArray(bag) && name in bag) {
+            delete bag[name];
+            changed = true;
+        }
+    }
+    if (changed)
+        await writePackageJson(pkg, cwd);
+    return changed;
+}
+/** Module folder under node_modules for a bare or scoped package name. */
+function nodeModulesPath(cwd, name) {
+    if (name.startsWith("@")) {
+        const [scope, pkg] = name.split("/");
+        return path.join(cwd, "node_modules", scope, pkg);
+    }
+    return path.join(cwd, "node_modules", name);
+}
+/**
+ * Removes a local dependency via the managed runtime.
+ * If Bun fails (e.g. ENOENT on an unrelated cached tarball), falls back to
+ * editing package.json + reinstall.
+ */
 export async function removePackage(name, cwd = process.cwd(), log = createUi()) {
     const ui = asUi(log);
     const { env } = await prepareRuntimeInstall(cwd);
-    setStatus(ui, `remove ${c.bold(name)}`);
+    ui.clearStatus();
+    ui.info(`${c.dim("→")} remove ${c.bold(name)}`);
     const code = await spawnRuntime({
         cwd,
         args: ["remove", name],
         env,
         brandOutput: true,
     });
-    ui.clearStatus();
-    if (code !== 0)
-        throw new Error(`remove failed (exit ${code})`);
+    if (code === 0) {
+        await syncLockFromNodeModules(cwd);
+        if (ui.success)
+            ui.success(`removed ${c.bold(name)}`);
+        else
+            ui.info(`removed ${name}`);
+        return;
+    }
+    ui.warn("runtime remove failed (often a missing cache tarball) — updating package.json and reinstalling");
+    const stripped = await stripFromPackageJson(name, cwd);
+    if (!stripped) {
+        throw new Error(`remove failed: ${name} is not listed in package.json`);
+    }
+    await rm(nodeModulesPath(cwd, name), { recursive: true, force: true });
+    const installCode = await spawnRuntime({
+        cwd,
+        args: ["install"],
+        env,
+        brandOutput: true,
+    });
+    if (installCode !== 0) {
+        throw new Error(`remove failed (exit ${code}); reinstall also failed. Try deleting node_modules and the lockfile, then dpm i`);
+    }
     await syncLockFromNodeModules(cwd);
     if (ui.success)
         ui.success(`removed ${c.bold(name)}`);

package/dist/runtime.d.ts

@@ -16,22 +16,24 @@ export type SpawnRuntimeOptions = {
     env?: NodeJS.ProcessEnv;
     /** Extra args after the runtime binary (e.g. ["install"], ["run", "start"]). */
     args: string[];
-    /** When true, rewrite stderr banners that say bun → dpm. */
+    /** When true, pipe + rewrite stdout/stderr so bun never leaks into the UI. */
     brandOutput?: boolean;
 };
 /**
  * Spawns the managed runtime with inherited stdio and returns the exit code.
+ * With `brandOutput`, both stdout and stderr are piped, branded, and each
+ * write starts on a clean line so it never glues onto a DPM spinner.
  */
 export declare function spawnRuntime(opts: SpawnRuntimeOptions): Promise<number>;
 /**
  * Resolves the install registry URL.
- * DPM hosts use the `/npm` facade; plain npmjs (or DPM_BOOTSTRAP=1) uses the URL as-is.
+ * DPM hosts use the `/npm` facade; bootstrap / this app monorepo / npmjs → public npm.
  */
-export declare function resolveInstallRegistryUrl(registry: string): string;
+export declare function resolveInstallRegistryUrl(registry: string, cwd?: string): string;
 /**
  * Writes project-local registry config so the runtime installer hits the DPM npm facade
- * (or npmjs when bootstrapping / pointed at registry.npmjs.org).
+ * (or public npm when bootstrapping / installing this app monorepo).
  */
 export declare function ensureInstallConfig(config: DpmConfig, cwd?: string): Promise<void>;
 /** Builds npm_config_* env for a one-shot install without relying only on files. */
-export declare function runtimeInstallEnv(config: DpmConfig): NodeJS.ProcessEnv;
+export declare function runtimeInstallEnv(config: DpmConfig, cwd?: string): NodeJS.ProcessEnv;

package/dist/runtime.js

@@ -1,8 +1,10 @@
 import { execFileSync, spawn, spawnSync } from "node:child_process";
 import { access, chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
-import { readdirSync, statSync } from "node:fs";
+import { readFileSync, readdirSync, statSync } from "node:fs";
 import { homedir, platform, tmpdir } from "node:os";
 import path from "node:path";
+/** Public npm — used when this app must install while its own registry is offline. */
+const PUBLIC_NPM_REGISTRY = "https://registry.npmjs.org/";
 /** Pinned managed runtime version (oven-sh/bun release tag without prefix). */
 export const RUNTIME_VERSION = "1.2.19";
 const RUNTIME_NAME = process.platform === "win32" ? "dpm-runtime.exe" : "dpm-runtime";
@@ -155,14 +157,16 @@ export async function resolveRuntime() {
         throw new Error(`DPM runtime is not available (${msg}). Re-run the DPM installer or set DPM_RUNTIME.`);
     }
 }
-function brandStderr(chunk) {
-    return Buffer.from(chunk
-        .toString("utf8")
+/** Rewrites managed-runtime banners so users only see DPM branding. */
+function brandText(text) {
+    return text
         .replace(/\bBun\b/g, "DPM")
-        .replace(/\bbun\b/g, "dpm"));
+        .replace(/\bbun\b/g, "dpm");
 }
 /**
  * Spawns the managed runtime with inherited stdio and returns the exit code.
+ * With `brandOutput`, both stdout and stderr are piped, branded, and each
+ * write starts on a clean line so it never glues onto a DPM spinner.
  */
 export async function spawnRuntime(opts) {
     const bin = await resolveRuntime();
@@ -173,58 +177,99 @@ export async function spawnRuntime(opts) {
         npm_config_registry: opts.env?.npm_config_registry ?? process.env.npm_config_registry,
     };
     return new Promise((resolve, reject) => {
+        const brand = Boolean(opts.brandOutput);
         const child = spawn(bin, opts.args, {
             cwd: opts.cwd ?? process.cwd(),
             env,
-            stdio: opts.brandOutput ? ["inherit", "inherit", "pipe"] : "inherit",
+            stdio: brand ? ["inherit", "pipe", "pipe"] : "inherit",
             windowsHide: true,
         });
-        if (opts.brandOutput && child.stderr) {
+        let needClear = brand;
+        const writeBranded = (stream, chunk) => {
+            let text = brandText(chunk.toString("utf8"));
+            if (!text)
+                return;
+            if (needClear) {
+                // Drop any leftover `\r`-style status line before the first child byte.
+                stream.write("\r\x1b[2K");
+                needClear = false;
+            }
+            // If a chunk starts mid-line after a previous incomplete write, keep as-is;
+            // only force a newline when the previous paint left the cursor mid-status.
+            stream.write(text);
+        };
+        if (brand && child.stdout) {
+            child.stdout.on("data", (chunk) => {
+                writeBranded(process.stdout, chunk);
+            });
+        }
+        if (brand && child.stderr) {
             child.stderr.on("data", (chunk) => {
-                process.stderr.write(brandStderr(chunk));
+                writeBranded(process.stderr, chunk);
             });
         }
         child.on("error", reject);
         child.on("close", (code) => resolve(code ?? 1));
     });
 }
+/**
+ * True for the DPM registry app monorepo (`package.json` name dpm + private).
+ * That tree must install from public npm — its own /npm façade is down during restart.
+ */
+function isDpmAppMonorepo(cwd) {
+    try {
+        const pkg = JSON.parse(readFileSync(path.join(cwd, "package.json"), "utf8"));
+        return pkg.name === "dpm" && pkg.private === true;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Resolves the install registry URL.
- * DPM hosts use the `/npm` facade; plain npmjs (or DPM_BOOTSTRAP=1) uses the URL as-is.
+ * DPM hosts use the `/npm` facade; bootstrap / this app monorepo / npmjs → public npm.
  */
-export function resolveInstallRegistryUrl(registry) {
+export function resolveInstallRegistryUrl(registry, cwd = process.cwd()) {
+    if (isDpmAppMonorepo(cwd))
+        return PUBLIC_NPM_REGISTRY;
     const base = registry.replace(/\/$/, "").replace(/\/npm$/i, "");
-    const bootstrap = process.env.DPM_BOOTSTRAP === "1" ||
-        /registry\.npmjs\.org/i.test(base) ||
-        process.env.DPM_USE_NPM_UPSTREAM === "1";
-    if (bootstrap)
-        return `${base}/`;
+    const usePublicNpm = process.env.DPM_BOOTSTRAP === "1" ||
+        process.env.DPM_USE_NPM_UPSTREAM === "1" ||
+        /registry\.npmjs\.org/i.test(base);
+    if (usePublicNpm)
+        return PUBLIC_NPM_REGISTRY;
     return `${base}/npm/`;
 }
 /**
  * Writes project-local registry config so the runtime installer hits the DPM npm facade
- * (or npmjs when bootstrapping / pointed at registry.npmjs.org).
+ * (or public npm when bootstrapping / installing this app monorepo).
  */
 export async function ensureInstallConfig(config, cwd = process.cwd()) {
-    const registryUrl = resolveInstallRegistryUrl(config.registry);
+    const registryUrl = resolveInstallRegistryUrl(config.registry, cwd);
     const host = new URL(registryUrl).host;
     const pathPrefix = registryUrl.includes("/npm") ? "/npm" : "";
+    const token = registryUrl.includes("registry.npmjs.org")
+        ? ""
+        : (config.token ?? "");
     const npmrcLines = [
         `registry=${registryUrl}`,
-        `//${host}${pathPrefix}/:_authToken=${config.token ?? ""}`,
+        `//${host}${pathPrefix}/:_authToken=${token}`,
     ];
-    await writeFile(path.join(cwd, ".npmrc"), `${npmrcLines.join("\n")}\n`, { mode: 0o600 });
+    await writeFile(path.join(cwd, ".npmrc"), `${npmrcLines.join("\n")}\n`, {
+        mode: 0o600,
+    });
     const bunfig = `[install]
 registry = "${registryUrl}"
 `;
     await writeFile(path.join(cwd, "bunfig.toml"), bunfig);
 }
 /** Builds npm_config_* env for a one-shot install without relying only on files. */
-export function runtimeInstallEnv(config) {
-    const registryUrl = resolveInstallRegistryUrl(config.registry);
+export function runtimeInstallEnv(config, cwd = process.cwd()) {
+    const registryUrl = resolveInstallRegistryUrl(config.registry, cwd);
+    const useToken = !registryUrl.includes("registry.npmjs.org") && config.token;
     return {
         npm_config_registry: registryUrl,
-        ...(config.token
+        ...(useToken
             ? {
                 npm_config__authToken: config.token,
                 BUN_CONFIG_TOKEN: config.token,

package/dist/updateCheck.d.ts

@@ -1,7 +1,7 @@
-export declare const CLI_NAME: string;
+export declare const CLI_NAME = "@drops-it/dpm";
 export declare const CLI_VERSION: string;
 /**
  * On the first dpm command in a new terminal session, checks the DPM registry
- * for a newer CLI and prints how to update with dpm. Never blocks on failure.
+ * for a newer CLI and prints a one-line hint (non-blocking on failure).
  */
 export declare function maybeNotifyUpdate(): Promise<void>;

package/dist/updateCheck.js

@@ -1,17 +1,55 @@
 import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { homedir } from "node:os";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
 import semver from "semver";
 import { c } from "./colors.js";
 import { loadConfig } from "./config.js";
-const require = createRequire(import.meta.url);
-const pkg = require("../package.json");
-export const CLI_NAME = pkg.name;
-export const CLI_VERSION = pkg.version;
+/**
+ * Resolves CLI version from esbuild inject, nearby package.json (npm layout),
+ * or a safe fallback — never throws at import time.
+ */
+function resolveCliVersion() {
+    // Windows single-file bundle: esbuild define replaces this identifier.
+    try {
+        const injected = new Function("return typeof __DPM_CLI_VERSION__ !== 'undefined' ? __DPM_CLI_VERSION__ : undefined")();
+        if (typeof injected === "string" && injected.length > 0)
+            return injected;
+    }
+    catch {
+        /* not injected (tsc / npm dist) */
+    }
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    for (const file of [
+        path.join(here, "..", "package.json"),
+        path.join(here, "package.json"),
+    ]) {
+        try {
+            const pkg = JSON.parse(readFileSync(file, "utf8"));
+            if (pkg.version)
+                return pkg.version;
+        }
+        catch {
+            /* try next */
+        }
+    }
+    try {
+        const req = createRequire(import.meta.url);
+        const pkg = req("../package.json");
+        if (pkg.version)
+            return pkg.version;
+    }
+    catch {
+        /* bundled exe has no sibling package.json */
+    }
+    return "1.1.5";
+}
+export const CLI_NAME = "@drops-it/dpm";
+export const CLI_VERSION = resolveCliVersion();
 const STATE_DIR = path.join(homedir(), ".dpm");
 const STATE_PATH = path.join(STATE_DIR, "update-check.json");
-/** Identifies the current terminal so we only notify once per new shell. */
 function sessionKey() {
     const parts = [`ppid:${process.ppid}`];
     if (process.env.WT_SESSION)
@@ -22,11 +60,12 @@ function sessionKey() {
 }
 async function loadState() {
     try {
-        const raw = JSON.parse(await readFile(STATE_PATH, "utf8"));
-        if (Array.isArray(raw.sessions)) {
-            return { sessions: raw.sessions.slice(-40), latest: raw.latest };
-        }
-        return { sessions: [], latest: raw.latest };
+        const raw = await readFile(STATE_PATH, "utf8");
+        const parsed = JSON.parse(raw);
+        return {
+            sessions: Array.isArray(parsed.sessions) ? parsed.sessions : [],
+            latest: parsed.latest,
+        };
     }
     catch {
         return { sessions: [] };
@@ -34,48 +73,44 @@ async function loadState() {
 }
 async function saveState(state) {
     await mkdir(STATE_DIR, { recursive: true });
-    await writeFile(STATE_PATH, JSON.stringify({ sessions: state.sessions.slice(-40), latest: state.latest }), { mode: 0o600 });
+    await writeFile(STATE_PATH, JSON.stringify(state), { mode: 0o600 });
 }
 async function fetchLatestFromDpm(registry) {
     const url = `${registry.replace(/\/$/, "")}/dpm/v1/packages/dpm`;
     const res = await fetch(url, {
-        headers: { accept: "application/json", "user-agent": `dpm-cli/${CLI_VERSION}` },
-        signal: AbortSignal.timeout(2500),
+        headers: {
+            accept: "application/json",
+            "user-agent": `dpm-cli/${CLI_VERSION}`,
+        },
     });
     if (!res.ok)
         return null;
-    const data = (await res.json());
-    return data.latest || data["dist-tags"]?.latest || null;
+    const body = (await res.json());
+    return body.latest ?? body["dist-tags"]?.latest ?? null;
 }
 /**
  * On the first dpm command in a new terminal session, checks the DPM registry
- * for a newer CLI and prints how to update with dpm. Never blocks on failure.
+ * for a newer CLI and prints a one-line hint (non-blocking on failure).
  */
 export async function maybeNotifyUpdate() {
-    const session = sessionKey();
-    const prev = await loadState();
-    if (prev.sessions.includes(session))
-        return;
-    await saveState({ sessions: [...prev.sessions, session], latest: prev.latest });
     try {
+        const key = sessionKey();
+        const state = await loadState();
+        if (state.sessions.includes(key))
+            return;
         const config = await loadConfig();
         const latest = await fetchLatestFromDpm(config.registry);
+        state.sessions = [...state.sessions.filter((s) => s !== key), key].slice(-20);
+        if (latest)
+            state.latest = latest;
+        await saveState(state);
         if (!latest || !semver.valid(latest) || !semver.valid(CLI_VERSION))
             return;
-        await saveState({
-            sessions: [...prev.sessions, session],
-            latest,
-        });
         if (!semver.gt(latest, CLI_VERSION))
             return;
-        console.error([
-            "",
-            `${c.yellow("▲")} ${c.bold("dpm")} update available: ${c.dim(CLI_VERSION)} ${c.cyan("→")} ${c.green(latest)}`,
-            `  Update with: ${c.bold("dpm i -g dpm")}`,
-            "",
-        ].join("\n"));
+        console.error(`${c.yellow("▲")} ${c.bold("dpm")} update available: ${c.dim(CLI_VERSION)} ${c.cyan("→")} ${c.green(latest)}`);
     }
     catch {
-        // Ignore network / parse errors — update checks must never break commands.
+        /* never block the command */
     }
 }

package/dist/windowsInstall.d.ts

@@ -0,0 +1,16 @@
+import type { Ui } from "./ui.js";
+/** `%LOCALAPPDATA%\Programs\DPM` — where `dpm.exe` setup installs. */
+export declare function windowsExeInstallDir(): string;
+export declare function windowsExePath(): string;
+/** True when the Windows launcher install is present. */
+export declare function hasWindowsExeInstall(): Promise<boolean>;
+/**
+ * Uninstalls the Windows `dpm.exe` layout (PATH, shortcut, cache, install dir).
+ * Schedules delete of the running tree after this process exits.
+ */
+export declare function uninstallWindowsExe(ui: Ui): Promise<void>;
+/**
+ * Replaces `%LOCALAPPDATA%\\Programs\\DPM\\dpm.exe` from the registry site's
+ * `/download/dpm.exe` (see latest.json). Used for `dpm i -g dpm` on Windows exe installs.
+ */
+export declare function updateWindowsExe(ui: Ui): Promise<void>;

package/dist/windowsInstall.js

@@ -0,0 +1,175 @@
+import { spawn, spawnSync } from "node:child_process";
+import { createWriteStream } from "node:fs";
+import { access, mkdir, rename, rm, writeFile, } from "node:fs/promises";
+import { homedir } from "node:os";
+import path from "node:path";
+import { pipeline } from "node:stream/promises";
+import { Readable } from "node:stream";
+import { loadConfig } from "./config.js";
+import { CLI_VERSION } from "./updateCheck.js";
+async function exists(p) {
+    try {
+        await access(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** `%LOCALAPPDATA%\Programs\DPM` — where `dpm.exe` setup installs. */
+export function windowsExeInstallDir() {
+    const base = process.env.LOCALAPPDATA || path.join(homedir(), "AppData", "Local");
+    return path.join(base, "Programs", "DPM");
+}
+export function windowsExePath() {
+    return path.join(windowsExeInstallDir(), "dpm.exe");
+}
+/** True when the Windows launcher install is present. */
+export async function hasWindowsExeInstall() {
+    return process.platform === "win32" && exists(windowsExePath());
+}
+function startMenuShortcutPath() {
+    const appData = process.env.APPDATA || path.join(homedir(), "AppData", "Roaming");
+    return path.join(appData, "Microsoft", "Windows", "Start Menu", "Programs", "DPM.lnk");
+}
+function cliCacheRoot() {
+    const base = process.env.LOCALAPPDATA || path.join(homedir(), "AppData", "Local");
+    return path.join(base, "dpm", "cli");
+}
+/** Removes `dir` from the user PATH (HKCU Environment). */
+function removeFromUserPath(dir) {
+    const ps = `
+$dir = [IO.Path]::GetFullPath('${dir.replace(/'/g, "''")}')
+$key = 'HKCU:\\Environment'
+$cur = (Get-ItemProperty -Path $key -Name Path -ErrorAction SilentlyContinue).Path
+if (-not $cur) { return }
+$parts = $cur -split ';' | Where-Object {
+  $_.Trim() -ne '' -and [IO.Path]::GetFullPath($_.Trim()) -ne $dir
+}
+$next = ($parts -join ';').Trim(';')
+Set-ItemProperty -Path $key -Name Path -Value $next
+Add-Type -Namespace Win32 -Name Native -MemberDefinition '[DllImport("user32.dll", SetLastError=true, CharSet=CharSet.Auto)] public static extern IntPtr SendMessageTimeout(IntPtr hWnd, uint Msg, UIntPtr wParam, string lParam, uint fuFlags, uint uTimeout, out UIntPtr lpdwResult);'
+$hwnd = [IntPtr]0xffff; $r = [UIntPtr]::Zero
+[Win32.Native]::SendMessageTimeout($hwnd, 0x1A, [UIntPtr]::Zero, 'Environment', 2, 5000, [ref]$r) | Out-Null
+`;
+    spawnSync("powershell", ["-NoProfile", "-NonInteractive", "-Command", ps], { windowsHide: true, stdio: "ignore" });
+}
+/**
+ * Uninstalls the Windows `dpm.exe` layout (PATH, shortcut, cache, install dir).
+ * Schedules delete of the running tree after this process exits.
+ */
+export async function uninstallWindowsExe(ui) {
+    const installDir = windowsExeInstallDir();
+    const exe = windowsExePath();
+    if (!(await exists(exe))) {
+        ui.warn("No Windows dpm.exe install found under Local\\Programs\\DPM");
+        return;
+    }
+    ui.info("Removing Windows DPM install…");
+    removeFromUserPath(installDir);
+    await rm(startMenuShortcutPath(), { force: true });
+    await rm(cliCacheRoot(), { recursive: true, force: true });
+    // Cannot delete the running exe reliably — cmd deletes the folder after exit.
+    const bat = path.join(process.env.TEMP || installDir, `dpm-uninstall-${Date.now()}.cmd`);
+    const batBody = [
+        "@echo off",
+        "timeout /t 2 /nobreak >nul",
+        `rmdir /s /q "${installDir}"`,
+        `del /f /q "%~f0"`,
+        "",
+    ].join("\r\n");
+    await writeFile(bat, batBody, "utf8");
+    const child = spawn("cmd.exe", ["/c", "start", "/b", "", bat], {
+        windowsHide: true,
+        stdio: "ignore",
+        detached: true,
+    });
+    child.unref();
+    ui.success("Uninstalled DPM from PATH and Start Menu. Install folder will be removed shortly — open a new terminal.");
+}
+function siteBaseFromRegistry(registry) {
+    return registry.replace(/\/$/, "").replace(/\/npm$/i, "");
+}
+async function fetchLatestMeta(site) {
+    const url = `${site}/download/latest.json`;
+    const res = await fetch(url, {
+        headers: { accept: "application/json", "user-agent": `dpm-cli/${CLI_VERSION}` },
+    });
+    if (!res.ok) {
+        throw new Error(`Could not fetch ${url} (${res.status})`);
+    }
+    return (await res.json());
+}
+async function downloadToFile(url, dest) {
+    const res = await fetch(url, {
+        headers: { "user-agent": `dpm-cli/${CLI_VERSION}` },
+        redirect: "follow",
+    });
+    if (!res.ok || !res.body) {
+        throw new Error(`Download failed (${res.status}): ${url}`);
+    }
+    await mkdir(path.dirname(dest), { recursive: true });
+    const tmp = `${dest}.download`;
+    await pipeline(Readable.fromWeb(res.body), createWriteStream(tmp));
+    await rename(tmp, dest);
+}
+/**
+ * Replaces `%LOCALAPPDATA%\\Programs\\DPM\\dpm.exe` from the registry site's
+ * `/download/dpm.exe` (see latest.json). Used for `dpm i -g dpm` on Windows exe installs.
+ */
+export async function updateWindowsExe(ui) {
+    const installDir = windowsExeInstallDir();
+    const exe = windowsExePath();
+    if (!(await exists(exe))) {
+        throw new Error("No Windows dpm.exe install found. Run the downloaded dpm.exe installer first.");
+    }
+    const config = await loadConfig();
+    const site = siteBaseFromRegistry(config.registry);
+    ui.info(`Checking ${site}/download/latest.json…`);
+    const meta = await fetchLatestMeta(site);
+    const remoteVer = meta.version || "unknown";
+    if (remoteVer === CLI_VERSION) {
+        ui.success(`Already up to date (${CLI_VERSION})`);
+        return;
+    }
+    const downloadPath = meta.downloadPath || "/download/dpm.exe";
+    const url = `${site}${downloadPath.startsWith("/") ? "" : "/"}${downloadPath}`;
+    const staging = path.join(installDir, "dpm.exe.new");
+    ui.info(`Downloading DPM ${remoteVer}…`);
+    await downloadToFile(url, staging);
+    const backup = path.join(installDir, "dpm.exe.old");
+    await rm(backup, { force: true });
+    try {
+        await rename(exe, backup);
+    }
+    catch {
+        // Running from another copy — overwrite in place via cmd after exit
+    }
+    try {
+        await rename(staging, exe);
+    }
+    catch {
+        // Locked: schedule replace
+        const bat = path.join(process.env.TEMP || installDir, `dpm-update-${Date.now()}.cmd`);
+        await writeFile(bat, [
+            "@echo off",
+            "timeout /t 2 /nobreak >nul",
+            `move /y "${staging}" "${exe}"`,
+            `del /f /q "${backup}" 2>nul`,
+            `del /f /q "%~f0"`,
+            "",
+        ].join("\r\n"), "utf8");
+        const child = spawn("cmd.exe", ["/c", "start", "/b", "", bat], {
+            windowsHide: true,
+            stdio: "ignore",
+            detached: true,
+        });
+        child.unref();
+        ui.success(`DPM ${remoteVer} downloaded — restart the terminal (or wait a second) to use it.`);
+        return;
+    }
+    await rm(backup, { force: true });
+    // Drop old embedded CLI cache so next launch unpacks the new bundle.
+    await rm(cliCacheRoot(), { recursive: true, force: true });
+    ui.success(`Updated Windows DPM ${CLI_VERSION} → ${remoteVer}. Open a new terminal if \`dpm -v\` still shows the old version.`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drops-it/dpm",
-  "version": "1.1.1",
+  "version": "1.1.5",
   "description": "Drops Package Manager CLI",
   "type": "module",
   "bin": {
@@ -17,20 +17,22 @@
     "prepublishOnly": "npm run build"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
     "commander": "^12.1.0",
-    "semver": "^7.6.3",
-    "tar": "^7.4.3",
-    "yaml": "^2.7.0"
+    "magmastream": "^2.10.4",
+    "semver": "^7.8.5",
+    "tar": "^7.5.22",
+    "yaml": "^2.9.1"
   },
   "devDependencies": {
-    "@types/node": "^22.10.5",
-    "@types/semver": "^7.5.8",
-    "esbuild": "^0.25.0",
-    "tsx": "^4.19.2",
-    "typescript": "^5.7.3"
+    "@types/node": "^22.20.5",
+    "@types/semver": "^7.8.0",
+    "esbuild": "^0.25.12",
+    "tsx": "^4.23.15",
+    "typescript": "^5.9.3"
   },
   "keywords": [
     "dpm",