@lpm-registry/cli 0.58.0 → 0.59.0

package/README.md

@@ -1,64 +1,40 @@
-# LPM — The Package Manager for Modern Software
+# LPM CLI
 
-Fast, secure, all-in-one. Written in Rust.
+Fast, secure, all-in-one package manager written in Rust.
 
 ```bash
 npm install -g @lpm-registry/cli
 ```
 
-<details>
-<summary>Other install methods</summary>
+This package is the npm gateway for the native LPM CLI. It installs a small
+JavaScript launcher plus the matching platform package, such as
+`@lpm-registry/cli-darwin-arm64` or `@lpm-registry/cli-linux-x64`.
 
-```bash
-brew tap lpm-dev/lpm && brew install lpm        # Homebrew
-curl -fsSL https://lpm.dev/install.sh | sh       # Standalone
-cargo install --git https://github.com/lpm-dev/rust-client lpm-cli  # Source
-```
-
-</details>
+The JavaScript launcher does not implement package-manager behavior. All CLI
+commands run in the native Rust binary.
 
-## About This Package
+Source for this npm package lives in `lpm-dev/rust-client/npm/cli`.
 
-This npm package is a thin wrapper that downloads the native Rust binary on `postinstall`. All CLI functionality is provided by the Rust client — see [lpm-dev/rust-client](https://github.com/lpm-dev/rust-client) for full documentation, benchmarks, and the complete command reference.
-
-If the native binary isn't available for your platform, the JS fallback CLI activates automatically.
-
-## Quick Start
+## Updating
 
 ```bash
-lpm login                      # Authenticate
-lpm install                    # Install deps (aliases: i)
-lpm publish                    # Publish to lpm.dev (aliases: p)
-lpm dev                        # Zero-config dev server + HTTPS + tunnel
+lpm self-update
 ```
 
-## Commands
+When LPM was installed through npm, self-update runs:
 
-See the full command reference at [github.com/lpm-dev/rust-client](https://github.com/lpm-dev/rust-client#commands).
+```bash
+npm install -g @lpm-registry/cli@<version>
+```
 
-## API Exports
+## Troubleshooting
 
-This package exports utilities for programmatic use:
+If your package manager was configured to omit optional dependencies, reinstall
+with optional dependencies enabled:
 
-```js
-import {
-  generateIntegrity,
-  verifyIntegrity,
-  runQualityChecks,
-  parseLpmPackageReference,
-  detectFramework,
-} from "@lpm-registry/cli";
+```bash
+npm install -g @lpm-registry/cli
 ```
 
-| Function | Description |
-| --- | --- |
-| `generateIntegrity(buffer, algorithm?)` | Generate an SRI integrity hash (default: `sha512`) |
-| `verifyIntegrity(buffer, expected)` | Verify a buffer against an SRI integrity string |
-| `runQualityChecks({ packageJson, readme, ... })` | Run all 28 quality checks and return score, tier, and checks |
-| `parseLpmPackageReference(ref)` | Parse `@lpm.dev/owner.pkg@version?key=val` into components |
-| `readLpmConfig(dir)` | Read and validate `lpm.config.json` from a directory |
-| `detectFramework()` | Detect the project framework (nextjs, vite, remix, astro) |
-
-## License
-
-MIT
+Other install methods are documented at
+[github.com/lpm-dev/rust-client](https://github.com/lpm-dev/rust-client).

package/bin/lpm.js

@@ -1,356 +1,4 @@
 #!/usr/bin/env node
+import { runNativeCommand } from "./native.js";
 
-/**
- * LPM CLI Entry Point — Minimal fallback wrapper.
- *
- * In most cases, this file has been replaced by a hard link to the native
- * Rust binary during postinstall (zero Node.js overhead). This JS wrapper
- * only runs when:
- *
- * 1. Hard-link failed (cross-device mount, permissions)
- * 2. npm rebuild recreated the symlink
- * 3. Binary download failed during postinstall
- *
- * Resolution order:
- * 1. Try platform package binary (optionalDependencies)
- * 2. Try lpm-bin in bin/ directory (GitHub Releases download)
- * 3. Fall through to JS CLI implementation
- */
-
-import { execFileSync } from "node:child_process";
-import fs from "node:fs";
-import { createRequire } from "node:module";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const require = createRequire(import.meta.url);
-
-// ─── Try native binary (Tier 1: platform package) ──────────────────
-
-const PLATFORMS = {
-  "darwin-arm64": { pkg: "@lpm-registry/cli-darwin-arm64", binary: "lpm" },
-  "darwin-x64": { pkg: "@lpm-registry/cli-darwin-x64", binary: "lpm" },
-  "linux-x64": { pkg: "@lpm-registry/cli-linux-x64", binary: "lpm" },
-  "linux-arm64": { pkg: "@lpm-registry/cli-linux-arm64", binary: "lpm" },
-  "win32-x64": { pkg: "@lpm-registry/cli-win32-x64", binary: "lpm.exe" },
-};
-
-// Allow override via environment variable (for debugging / custom builds)
-const envBinary = process.env.LPM_BINARY_PATH;
-if (envBinary && fs.existsSync(envBinary)) {
-  runBinary(envBinary);
-}
-
-// Try platform package from optionalDependencies
-const platform = `${process.platform}-${os.arch()}`;
-const platformInfo = PLATFORMS[platform];
-
-if (platformInfo) {
-  try {
-    const pkgJsonPath = require.resolve(`${platformInfo.pkg}/package.json`);
-    const binaryPath = path.join(
-      path.dirname(pkgJsonPath),
-      platformInfo.binary,
-    );
-    if (fs.existsSync(binaryPath)) {
-      runBinary(binaryPath);
-    }
-  } catch {
-    // Package not installed
-  }
-}
-
-// ─── Try native binary (Tier 2: downloaded by postinstall) ─────────
-
-const legacyBinaryName =
-  process.platform === "win32" ? "lpm-bin.exe" : "lpm-bin";
-const legacyBinaryPath = path.join(__dirname, legacyBinaryName);
-
-if (fs.existsSync(legacyBinaryPath)) {
-  runBinary(legacyBinaryPath);
-}
-
-// ─── JS CLI fallback (Tier 3) ──────────────────────────────────────
-
-import { Command } from "commander";
-import updateNotifier from "update-notifier";
-import { add } from "../lib/commands/add.js";
-import { audit } from "../lib/commands/audit.js";
-import { cache } from "../lib/commands/cache.js";
-import { checkName } from "../lib/commands/check-name.js";
-import { config } from "../lib/commands/config.js";
-import { doctor } from "../lib/commands/doctor.js";
-import { info } from "../lib/commands/info.js";
-import { init } from "../lib/commands/init.js";
-import { install } from "../lib/commands/install.js";
-import { login } from "../lib/commands/login.js";
-import { logout } from "../lib/commands/logout.js";
-import { marketplaceCompare } from "../lib/commands/marketplace-compare.js";
-import { marketplaceEarnings } from "../lib/commands/marketplace-earnings.js";
-import { mcpRemove, mcpSetup, mcpStatus } from "../lib/commands/mcp-setup.js";
-import { npmrc } from "../lib/commands/npmrc.js";
-import { openDashboard } from "../lib/commands/open.js";
-import { outdated } from "../lib/commands/outdated.js";
-import { poolStats } from "../lib/commands/pool-stats.js";
-import { publish } from "../lib/commands/publish.js";
-import { quality } from "../lib/commands/quality.js";
-import { remove } from "../lib/commands/remove.js";
-import { run } from "../lib/commands/run.js";
-import { search } from "../lib/commands/search.js";
-import { setup } from "../lib/commands/setup.js";
-import {
-  skillsClean,
-  skillsInstall,
-  skillsList,
-  skillsValidate,
-} from "../lib/commands/skills.js";
-import { rotateToken } from "../lib/commands/token-rotate.js";
-import { uninstall } from "../lib/commands/uninstall.js";
-import { whoami } from "../lib/commands/whoami.js";
-
-// Load package.json
-const pkg = JSON.parse(
-  fs.readFileSync(path.join(__dirname, "../package.json"), "utf-8"),
-);
-
-// Check for updates
-updateNotifier({ pkg }).notify();
-
-const program = new Command();
-
-program
-  .name("lpm")
-  .description("CLI for Licensed Package Manager")
-  .version(pkg.version);
-
-// Authentication
-program
-  .command("login")
-  .alias("l")
-  .description("Authenticate with the registry")
-  .action(login);
-program
-  .command("logout")
-  .alias("lo")
-  .description("Clear stored authentication token")
-  .option("--revoke", "Also revoke the token on the server")
-  .option("--clear-cache", "Clear local package cache")
-  .action(logout);
-program
-  .command("whoami")
-  .description("Check current authenticated user")
-  .option("--json", "Output in JSON format")
-  .action(whoami);
-
-// Package Management
-program
-  .command("init")
-  .description("Interactively create a package.json for LPM")
-  .action(init);
-program
-  .command("install [packages...]")
-  .alias("i")
-  .description("Install packages")
-  .option("--json", "Machine-readable JSON output")
-  .option("--no-skills", "Skip fetching Agent Skills")
-  .option("--pm <manager>", "Package manager to use")
-  .action(install);
-program
-  .command("uninstall <packages...>")
-  .aliases(["un", "unlink"])
-  .description("Uninstall packages")
-  .option("--pm <manager>", "Package manager to use")
-  .action(uninstall);
-program
-  .command("publish")
-  .alias("p")
-  .description("Publish a package to the registry")
-  .option("--check", "Quality check only")
-  .option("--min-score <score>", "Minimum quality score")
-  .option("--provenance", "Force OIDC provenance")
-  .option("--dry-run", "Preview without publishing")
-  .action(publish);
-program
-  .command("add <package>")
-  .description("Extract package source code")
-  .option("-p, --path <path>", "Target directory")
-  .option("-f, --force", "Overwrite existing files")
-  .option("-y, --yes", "Accept defaults")
-  .option("--alias <alias>", "Import alias prefix")
-  .option("--target <name>", "Swift SPM target")
-  .option("--json", "JSON output")
-  .option("--dry-run", "Preview only")
-  .action(add);
-program
-  .command("remove <package>")
-  .alias("rm")
-  .description("Remove a previously added package")
-  .action(remove);
-
-// Discovery
-program
-  .command("search <query>")
-  .description("Search packages")
-  .option("--limit <n>", "Max results", "20")
-  .option("--json", "JSON output")
-  .action((q, o) => search(q, { ...o, limit: parseInt(o.limit, 10) }));
-program
-  .command("info <package>")
-  .description("Package info")
-  .option("--json", "JSON output")
-  .option("-a, --all-versions", "Show all versions")
-  .action(info);
-program
-  .command("check-name <name>")
-  .description("Check name availability")
-  .option("--json", "JSON output")
-  .action(checkName);
-program
-  .command("quality <package>")
-  .description("Quality report")
-  .option("--json", "JSON output")
-  .action(quality);
-
-// Maintenance
-program
-  .command("audit [action]")
-  .description("Security audit")
-  .option("--json", "JSON output")
-  .option("--level <level>", "Minimum severity")
-  .action(audit);
-program
-  .command("outdated")
-  .description("Check outdated deps")
-  .option("--json", "JSON output")
-  .option("--all", "Show all deps")
-  .action(outdated);
-program.command("doctor").description("Health check").action(doctor);
-
-// Configuration
-const setupCommand = program
-  .command("setup")
-  .description("Configure .npmrc for CI or local development")
-  .action(() => setupCommand.help());
-setupCommand
-  .command("ci")
-  .description("Generate .npmrc for CI/CD")
-  .option("-r, --registry <url>", "Custom registry URL")
-  .option("--oidc", "Exchange OIDC token")
-  .option("--proxy", "Route all npm traffic through lpm.dev")
-  .option("--scoped", "Scoped registry only")
-  .action(setup);
-setupCommand
-  .command("local")
-  .description("Generate read-only .npmrc token for local development")
-  .option("-d, --days <number>", "Token expiry days")
-  .option("--proxy", "Route all npm traffic through lpm.dev")
-  .option("--scoped", "Scoped registry only")
-  .action(npmrc);
-program
-  .command("config [action] [key] [value]")
-  .description("Manage CLI config")
-  .action(config);
-program
-  .command("set <key> <value>")
-  .description('Shortcut for "lpm config set"')
-  .action((k, v) => config("set", k, v));
-program
-  .command("cache <action>")
-  .description("Manage local cache")
-  .action(cache);
-
-// Utility
-program
-  .command("open")
-  .description("Open dashboard in browser")
-  .action(openDashboard);
-program
-  .command("run <script>")
-  .description("Run npm scripts")
-  .allowUnknownOption()
-  .action(run);
-
-// Subcommands
-const token = program.command("token").description("Token management");
-token.command("rotate").description("Rotate token").action(rotateToken);
-
-const pool = program.command("pool").description("Pool revenue");
-pool
-  .command("stats")
-  .description("Pool earnings")
-  .option("--json", "JSON output")
-  .action(poolStats);
-
-const mcp = program.command("mcp").description("MCP server");
-mcp
-  .command("setup")
-  .description("Configure MCP server")
-  .option("--project", "Project-level config")
-  .action(mcpSetup);
-mcp
-  .command("remove")
-  .description("Remove MCP server")
-  .option("--project", "Project-level only")
-  .action(mcpRemove);
-mcp
-  .command("status")
-  .description("MCP server status")
-  .option("--verbose", "Show diagnostics")
-  .action(mcpStatus);
-
-const skills = program.command("skills").description("Agent Skills");
-skills
-  .command("validate")
-  .description("Validate skills files")
-  .option("--json", "JSON output")
-  .action(skillsValidate);
-skills
-  .command("install [package]")
-  .description("Install skills")
-  .option("--json", "JSON output")
-  .action(skillsInstall);
-skills
-  .command("list")
-  .description("List available skills")
-  .option("--json", "JSON output")
-  .action(skillsList);
-skills
-  .command("clean")
-  .description("Remove installed skills")
-  .option("--json", "JSON output")
-  .action(skillsClean);
-
-const marketplace = program.command("marketplace").description("Marketplace");
-marketplace
-  .command("compare <input>")
-  .description("Find comparable packages")
-  .option("--json", "JSON output")
-  .option("--category <category>", "Filter by category")
-  .option("--limit <n>", "Max results")
-  .action(marketplaceCompare);
-marketplace
-  .command("earnings")
-  .description("Revenue summary")
-  .option("--json", "JSON output")
-  .action(marketplaceEarnings);
-
-program.parse();
-
-// ─── Helper ────────────────────────────────────────────────────────
-
-function runBinary(binaryPath) {
-  try {
-    execFileSync(binaryPath, process.argv.slice(2), {
-      stdio: "inherit",
-      env: process.env,
-    });
-    process.exit(0);
-  } catch (err) {
-    if (err.status != null) {
-      process.exit(err.status);
-    }
-    // Binary failed to execute — fall through to JS CLI
-  }
-}
+runNativeCommand("lpm");

package/bin/lpx.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runNativeCommand } from "./native.js";
+
+runNativeCommand("lpx");

package/bin/native.js

@@ -0,0 +1,154 @@
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import { createRequire } from "node:module";
+import os from "node:os";
+import path from "node:path";
+
+const require = createRequire(import.meta.url);
+
+export const PLATFORMS = Object.freeze({
+  "darwin-arm64": {
+    pkg: "@lpm-registry/cli-darwin-arm64",
+    lpm: "lpm",
+    lpx: "lpx",
+  },
+  "darwin-x64": {
+    pkg: "@lpm-registry/cli-darwin-x64",
+    lpm: "lpm",
+    lpx: "lpx",
+  },
+  "linux-arm64": {
+    pkg: "@lpm-registry/cli-linux-arm64",
+    lpm: "lpm",
+    lpx: "lpx",
+  },
+  "linux-x64": {
+    pkg: "@lpm-registry/cli-linux-x64",
+    lpm: "lpm",
+    lpx: "lpx",
+  },
+  "win32-x64": {
+    pkg: "@lpm-registry/cli-win32-x64",
+    lpm: "lpm.exe",
+    lpx: "lpx.exe",
+  },
+});
+
+export function platformKey(platform = process.platform, arch = os.arch()) {
+  return `${platform}-${arch}`;
+}
+
+export function resolveNativeBinary(options = {}) {
+  const command = options.command ?? "lpm";
+  const env = options.env ?? process.env;
+  const platform = options.platform ?? process.platform;
+  const arch = options.arch ?? os.arch();
+  const requireFn = options.requireFn ?? require;
+
+  const override = env.LPM_BINARY_PATH;
+  if (override) {
+    return {
+      path: override,
+      source: "env",
+      argsPrefix: command === "lpx" ? ["dlx"] : [],
+    };
+  }
+
+  const key = platformKey(platform, arch);
+  const spec = PLATFORMS[key];
+  if (!spec) {
+    throw new LpmWrapperError(
+      `Unsupported platform: ${key}`,
+      [
+        "LPM publishes native npm packages for macOS, Linux, and Windows on x64/arm64.",
+        "Use another install method from https://github.com/lpm-dev/rust-client.",
+      ],
+    );
+  }
+
+  let packageJsonPath;
+  try {
+    packageJsonPath = requireFn.resolve(`${spec.pkg}/package.json`);
+  } catch (error) {
+    throw new LpmWrapperError(
+      `Native package ${spec.pkg} is not installed.`,
+      [
+        "Reinstall with optional dependencies enabled:",
+        "  npm install -g @lpm-registry/cli",
+        "If you used --omit=optional, --no-optional, or a package-manager policy that blocks optional dependencies, remove that setting.",
+      ],
+      error,
+    );
+  }
+
+  const binaryPath = path.join(path.dirname(packageJsonPath), spec[command]);
+  if (!fs.existsSync(binaryPath)) {
+    throw new LpmWrapperError(
+      `Native package ${spec.pkg} is installed, but ${spec[command]} is missing.`,
+      ["Reinstall LPM with `npm install -g @lpm-registry/cli`."],
+    );
+  }
+
+  return {
+    path: binaryPath,
+    source: spec.pkg,
+    argsPrefix: [],
+  };
+}
+
+export function runNativeCommand(command) {
+  let native;
+  try {
+    native = resolveNativeBinary({ command });
+  } catch (error) {
+    printWrapperError(error);
+    process.exit(1);
+  }
+
+  const args = native.argsPrefix.concat(process.argv.slice(2));
+  const result = spawnSync(native.path, args, {
+    stdio: "inherit",
+    env: process.env,
+  });
+
+  if (result.error) {
+    console.error(`[lpm] Failed to run native binary at ${native.path}`);
+    console.error(`[lpm] ${result.error.message}`);
+    process.exit(1);
+  }
+
+  if (result.signal) {
+    forwardSignalExit(result.signal);
+  }
+
+  process.exit(result.status ?? 1);
+}
+
+export class LpmWrapperError extends Error {
+  constructor(message, hints = [], cause = undefined) {
+    super(message, cause ? { cause } : undefined);
+    this.name = "LpmWrapperError";
+    this.hints = hints;
+  }
+}
+
+function printWrapperError(error) {
+  if (error instanceof LpmWrapperError) {
+    console.error(`[lpm] ${error.message}`);
+    for (const hint of error.hints) {
+      console.error(`[lpm] ${hint}`);
+    }
+    return;
+  }
+
+  console.error(`[lpm] ${error?.message ?? error}`);
+}
+
+function forwardSignalExit(signal) {
+  const signalNumber = os.constants.signals[signal];
+  if (signalNumber) {
+    process.kill(process.pid, signal);
+    process.exit(128 + signalNumber);
+  }
+  process.exit(1);
+}