@npmcli/config 10.7.1 → 10.8.0

package/lib/definitions/definitions.js

@@ -946,6 +946,17 @@ const definitions = {
     `,
     flatten,
   }),
+  'include-attestations': new Definition('include-attestations', {
+    default: false,
+    type: Boolean,
+    description: `
+      When used with \`npm audit signatures --json\`, includes the full
+      sigstore attestation bundles in the JSON output for each verified
+      package. The bundles contain DSSE envelopes, verification material,
+      and transparency log entries.
+    `,
+    flatten,
+  }),
   'init-author-email': new Definition('init-author-email', {
     default: '',
     hint: '<email>',
@@ -1353,6 +1364,7 @@ const definitions = {
     hint: '<days>',
     type: [null, Number],
     exclusive: ['before'],
+    envExport: false,
     description: `
        If set, npm will build the npm tree such that only versions that were
        available more than the given number of days ago will be installed.  If
@@ -1612,6 +1624,7 @@ const definitions = {
   'prefer-offline': new Definition('prefer-offline', {
     default: false,
     type: Boolean,
+    exclusive: ['prefer-online'],
     description: `
       If true, staleness checks for cached data will be bypassed, but missing
       data will be requested from the server. To force full offline mode, use
@@ -1622,6 +1635,7 @@ const definitions = {
   'prefer-online': new Definition('prefer-online', {
     default: false,
     type: Boolean,
+    exclusive: ['prefer-offline'],
     description: `
       If true, staleness checks for cached data will be forced, making the CLI
       look for updates immediately even for fresh package data.

package/lib/index.js

@@ -582,7 +582,7 @@ class Config {
       }
     } else {
       conf.raw = obj
-      for (const [key, value] of Object.entries(obj)) {
+      outer: for (const [key, value] of Object.entries(obj)) {
         const k = envReplace(key, this.env)
         const v = this.parseField(value, k)
         if (where !== 'default') {
@@ -590,6 +590,13 @@ class Config {
           if (this.definitions[key]?.exclusive) {
             for (const exclusive of this.definitions[key].exclusive) {
               if (!this.isDefault(exclusive)) {
+                // when loading from env, skip only if sibling was explicitly set via CLI
+                if (where === 'env') {
+                  const cliData = this.data.get('cli').data
+                  if (Object.hasOwn(cliData, exclusive)) {
+                    continue outer
+                  }
+                }
                 throw new TypeError(`--${key} cannot be provided when using --${exclusive}`)
               }
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/config",
-  "version": "10.7.1",
+  "version": "10.8.0",
   "files": [
     "bin/",
     "lib/"