@penvhq/launcher 0.10.0 → 0.12.0

package/dist/bin.js

@@ -5,7 +5,7 @@ import {
   httpFetcher,
   nodeSpawner,
   runLauncher
-} from "./chunk-BNUZ52VN.js";
+} from "./chunk-A5LJQPYS.js";
 
 // src/bin.ts
 function readLine() {

package/dist/{chunk-BNUZ52VN.js → chunk-A5LJQPYS.js}

@@ -170,6 +170,8 @@ import {
   PenvError
 } from "@penvhq/core";
 var INSTALL_COMMAND = "penv install";
+var UPGRADE_COMMAND = "penv upgrade";
+var YES_FLAG = "--yes";
 var MIN_PACKAGE_AGE_DAYS = 7;
 var TRUST_YOUNG_FLAG = "--trust-young";
 function addCommand(name, version, extra) {
@@ -275,7 +277,7 @@ var AddFlagError = class extends PenvError {
     super(
       "PENV_ADD_FLAG",
       `\`penv add\` does not understand \`${flag}\``,
-      `Run \`penv add <package>\` with \`${TRUST_YOUNG_FLAG}\`, \`--registry <url>\`, or \`${LOCAL_FLAG}\` \u2014 those are the three it takes.`
+      `Run \`penv add <package>\` with \`${TRUST_YOUNG_FLAG}\`, \`--registry <url>\`, \`${LOCAL_FLAG}\`, or \`${YES_FLAG}\` \u2014 those are the four it takes.`
     );
   }
 };
@@ -352,11 +354,11 @@ var OfficialRegistryError = class extends PenvError {
 };
 var RegistryUnreadableError = class extends PenvError {
   name = "RegistryUnreadableError";
-  constructor(name, url, detail) {
+  constructor(name, url, detail, retry = addCommand(name)) {
     super(
       "PENV_REGISTRY_UNREADABLE",
       `Reading ${name} from ${url} failed: ${detail}`,
-      `Run \`${addCommand(name)}\` again when the registry is reachable.`
+      `Run \`${retry}\` again when the registry is reachable.`
     );
   }
 };
@@ -372,11 +374,11 @@ var PackageUnknownError = class extends PenvError {
 };
 var VersionUnknownError = class extends PenvError {
   name = "VersionUnknownError";
-  constructor(name, version, url) {
+  constructor(name, version, url, retry = addCommand(name)) {
     super(
       "PENV_VERSION_UNKNOWN",
       `${url} publishes no ${version} of ${name}`,
-      `Run \`${addCommand(name)}\` to take the version \`latest\` points at.`
+      `Run \`${retry}\` to take the version \`latest\` points at.`
     );
   }
 };
@@ -421,13 +423,13 @@ var AddNoDownloadError = class extends PenvError {
     );
   }
 };
-var AddNotInteractiveError = class extends PenvError {
-  name = "AddNotInteractiveError";
-  constructor(name) {
+var AddTrustUnattendedError = class extends PenvError {
+  name = "AddTrustUnattendedError";
+  constructor(name, ceremony) {
     super(
-      "PENV_ADD_NOT_INTERACTIVE",
-      `Adding ${name} rewrites ${MANIFEST_PATH}, and this run has nobody to decide that`,
-      `Run \`${addCommand(name)}\` from a terminal and commit what it writes. In CI, run \`${INSTALL_COMMAND}\` \u2014 it installs the versions the committed manifest already pins.`
+      "PENV_ADD_TRUST_UNATTENDED",
+      `Adding ${name} records ${ceremony}, and this run has nobody to write it`,
+      `Run \`${addCommand(name)}\` from a terminal, without \`${YES_FLAG}\` \u2014 the trust block is a line only a person can write. In CI, run \`${INSTALL_COMMAND}\`: it installs the versions the committed manifest already pins.`
     );
   }
 };
@@ -501,6 +503,66 @@ var EnginePinMismatchError = class extends PenvError {
     );
   }
 };
+var UpgradeSubjectError = class extends PenvError {
+  name = "UpgradeSubjectError";
+  constructor() {
+    super(
+      "PENV_UPGRADE_SUBJECT",
+      "`penv upgrade` takes one version, or none",
+      `Run \`${UPGRADE_COMMAND}\` to move to whatever \`latest\` points at, or \`${UPGRADE_COMMAND} 0.9.6\` to move to an exact release.`
+    );
+  }
+};
+var UpgradeFlagError = class extends PenvError {
+  name = "UpgradeFlagError";
+  constructor(flag) {
+    super(
+      "PENV_UPGRADE_FLAG",
+      `\`${UPGRADE_COMMAND}\` does not understand \`${flag}\``,
+      `Run \`${UPGRADE_COMMAND} [version]\` with \`${YES_FLAG}\` \u2014 that is the one flag it takes.`
+    );
+  }
+};
+var UpgradeNoDownloadError = class extends PenvError {
+  name = "UpgradeNoDownloadError";
+  constructor() {
+    super(
+      "PENV_UPGRADE_NO_DOWNLOAD",
+      `Upgrading means reading the registry for the version and integrity to pin, and \`--no-download\` says this run does not`,
+      `Run \`${UPGRADE_COMMAND}\` without \`--no-download\`. Nothing was fetched or written.`
+    );
+  }
+};
+var UpgradeUnattendedError = class extends PenvError {
+  name = "UpgradeUnattendedError";
+  constructor() {
+    super(
+      "PENV_UPGRADE_UNATTENDED",
+      `Upgrading rewrites ${MANIFEST_PATH} and package.json, and this run has nobody to decide that`,
+      `Run \`${UPGRADE_COMMAND} <version> ${YES_FLAG}\` \u2014 unattended, penv moves the pin only to a version you named. In CI, run \`${INSTALL_COMMAND}\`: it installs what the committed manifest already pins.`
+    );
+  }
+};
+var UpgradeDeclinedError = class extends PenvError {
+  name = "UpgradeDeclinedError";
+  constructor(version) {
+    super(
+      "PENV_UPGRADE_DECLINED",
+      `${ENGINE_PACKAGE} ${version} was not installed, so ${MANIFEST_PATH} and package.json are unchanged`,
+      `Run \`${UPGRADE_COMMAND} ${version}\` again when you want both of them to move.`
+    );
+  }
+};
+var UpgradeInstallFailedError = class extends PenvError {
+  name = "UpgradeInstallFailedError";
+  constructor(manager, version) {
+    super(
+      "PENV_UPGRADE_INSTALL_FAILED",
+      `${manager} did not finish moving this project to ${ENGINE_PACKAGE} ${version}, so ${MANIFEST_PATH} still pins the engine it pinned before`,
+      `Read what ${manager} printed above \u2014 it names what it refused. Fix that and run \`${UPGRADE_COMMAND} ${version}\` again; the pin and the dependency move together or not at all.`
+    );
+  }
+};
 var EngineEntryError = class extends PenvError {
   name = "EngineEntryError";
   constructor(name, version, dir) {
@@ -811,7 +873,8 @@ async function fetchRelease(query) {
     throw new RegistryUnreadableError(
       query.name,
       url,
-      cause instanceof Error ? cause.message : String(cause)
+      cause instanceof Error ? cause.message : String(cause),
+      query.retry
     );
   }
   let parsed;
@@ -821,7 +884,8 @@ async function fetchRelease(query) {
     throw new RegistryUnreadableError(
       query.name,
       url,
-      cause instanceof Error ? cause.message : String(cause)
+      cause instanceof Error ? cause.message : String(cause),
+      query.retry
     );
   }
   const packument = record(parsed);
@@ -837,7 +901,7 @@ async function fetchRelease(query) {
   const version = record(at(versions, asked)) === void 0 ? text3(at(tags, asked)) ?? asked : asked;
   const release = record(at(versions, version));
   if (release === void 0) {
-    throw new VersionUnknownError(query.name, asked, url);
+    throw new VersionUnknownError(query.name, asked, url, query.retry);
   }
   const dist = record(at(release, "dist"));
   const integrity = text3(at(dist, "integrity"));
@@ -939,12 +1003,17 @@ function parseRequest(argv) {
   let registry;
   let trustYoung = false;
   let local = false;
+  let yes = false;
   for (let index = 0; index < argv.length; index += 1) {
     const token = argv[index] ?? "";
     if (token === LOCAL_FLAG) {
       local = true;
       continue;
     }
+    if (token === YES_FLAG) {
+      yes = true;
+      continue;
+    }
     if (token === TRUST_YOUNG_FLAG) {
       trustYoung = true;
       continue;
@@ -984,7 +1053,10 @@ function parseRequest(argv) {
       throw new AddLocalFlagError(`\`${TRUST_YOUNG_FLAG}\``);
     }
   }
-  return { name, version, registry, trustYoung, local };
+  return { name, version, registry, trustYoung, local, yes };
+}
+function ceremonyFor(tier) {
+  return tier === "official" ? void 0 : "who publishes it and why you trust it";
 }
 function tierOf(request) {
   if (request.name.startsWith(OFFICIAL_SCOPE2)) {
@@ -1063,7 +1135,29 @@ function recordExtension(manifestFile, name, entry) {
   };
   return serializeManifest(next);
 }
-async function offerConfigEdit(options, name) {
+var NONE = /* @__PURE__ */ new Set(["", "none", "no", "n"]);
+var ALL = /* @__PURE__ */ new Set(["all", "a", "yes", "y"]);
+function chooseEnvironments(answer, offered) {
+  const normalized = answer.trim().toLowerCase();
+  if (NONE.has(normalized)) {
+    return { chosen: [], unknown: [] };
+  }
+  if (ALL.has(normalized)) {
+    return { chosen: offered, unknown: [] };
+  }
+  const chosen = [];
+  const unknown = [];
+  for (const token of normalized.split(/[\s,]+/).filter((part) => part !== "")) {
+    const match = offered.find((environment) => environment.toLowerCase() === token);
+    if (match === void 0) {
+      unknown.push(token);
+    } else {
+      chosen.push(match);
+    }
+  }
+  return { chosen, unknown };
+}
+async function offerConfigEdit(options, name, ask) {
   const { io, root } = options;
   const configFile = findConfigFile(root);
   const line = `Add \`type: ${JSON.stringify(name)}\` to an environment in penv.config.ts.`;
@@ -1078,31 +1172,35 @@ async function offerConfigEdit(options, name) {
     io.out(line);
     return;
   }
-  if (entries.every((entry) => entry.type === name)) {
+  const offered = entries.filter((entry) => entry.type !== name).map((entry) => entry.environment);
+  if (offered.length === 0) {
     return;
   }
-  if (!io.interactive) {
+  if (!ask) {
     io.out(line);
     return;
   }
-  for (const entry of entries) {
-    if (entry.type === name) {
-      continue;
-    }
-    if (!await io.confirm(`Point \`${entry.environment}\` at ${name} in ${shown}?`)) {
-      continue;
-    }
-    const next = setProviderType(current, entry.environment, name);
+  const { chosen, unknown } = chooseEnvironments(
+    await io.ask(`Point which of ${offered.join(", ")} at ${name} in ${shown}? all / none / names`),
+    offered
+  );
+  if (unknown.length > 0) {
+    io.out(`${shown} declares no ${unknown.join(", ")}, so nothing was repointed.`);
+    io.out(line);
+    return;
+  }
+  for (const environment of chosen) {
+    const next = setProviderType(current, environment, name);
     if (next === void 0) {
-      io.out(`Add \`type: ${JSON.stringify(name)}\` to \`${entry.environment}\` in ${shown}.`);
+      io.out(`Add \`type: ${JSON.stringify(name)}\` to \`${environment}\` in ${shown}.`);
       continue;
     }
     current = next;
     writeFileSync3(configFile, current);
-    io.out(`\u2713 ${shown} points \`${entry.environment}\` at ${name}`);
+    io.out(`\u2713 ${shown} points \`${environment}\` at ${name}`);
   }
 }
-async function offerOnboarding(io, name, onboard) {
+async function offerOnboarding(io, name, onboard, ask) {
   if (onboard === void 0) {
     return void 0;
   }
@@ -1111,7 +1209,7 @@ async function offerOnboarding(io, name, onboard) {
     return void 0;
   }
   const command = `penv ${args.join(" ")}`;
-  if (io.interactive && await io.confirm(`Run \`${command}\` now?`)) {
+  if (ask && await io.confirm(`Run \`${command}\` now?`)) {
     return args;
   }
   io.out(`Run \`${command}\` to finish setting ${name} up.`);
@@ -1192,8 +1290,9 @@ async function addLocal(options, request) {
   io.out(`\u2713 ${request.name} resolves from this project and imports \u2014 nothing is pinned`);
   io.out(`\u2713 ${LOCAL_EXTENSIONS_PATH2} records it`);
   io.out(`\u2713 ${declaration} declares its config type`);
-  await offerConfigEdit(options, request.name);
-  return { onboard: await offerOnboarding(io, request.name, installed.onboard) };
+  const ask = io.interactive && !request.yes;
+  await offerConfigEdit(options, request.name, ask);
+  return { onboard: await offerOnboarding(io, request.name, installed.onboard, ask) };
 }
 async function add(options) {
   const { io, fetcher, home, root, manifestFile } = options;
@@ -1203,11 +1302,13 @@ async function add(options) {
   }
   const tier = tierOf(request);
   const now = (options.now ?? (() => /* @__PURE__ */ new Date()))();
+  const ask = io.interactive && !request.yes;
   if (options.noDownload === true) {
     throw new AddNoDownloadError(request.name);
   }
-  if (options.ci === true || !io.interactive) {
-    throw new AddNotInteractiveError(request.name);
+  const ceremony = ceremonyFor(tier);
+  if (ceremony !== void 0 && (options.ci === true || !ask)) {
+    throw new AddTrustUnattendedError(request.name, ceremony);
   }
   const release = await fetchRelease({
     name: request.name,
@@ -1249,8 +1350,8 @@ async function add(options) {
   io.out(`\u2713 ${release.name} ${release.version} installed \u2014 ${provenance}`);
   io.out(`\u2713 ${MANIFEST_PATH2} pins it`);
   io.out(`\u2713 ${declaration} declares its config type`);
-  await offerConfigEdit(options, release.name);
-  return { onboard: await offerOnboarding(io, release.name, installed.onboard) };
+  await offerConfigEdit(options, release.name, ask);
+  return { onboard: await offerOnboarding(io, release.name, installed.onboard, ask) };
 }
 
 // src/delegate.ts
@@ -1299,12 +1400,12 @@ function nodeSpawner() {
 // src/engine.ts
 import { existsSync as existsSync2, readFileSync as readFileSync5 } from "fs";
 import { createRequire as createRequire2 } from "module";
-import { dirname as dirname4, join as join5, resolve as resolve3, sep as sep3 } from "path";
+import { dirname as dirname4, join as join4, resolve as resolve3, sep as sep3 } from "path";
 import { ENGINE_PACKAGE as ENGINE_PACKAGE2, PenvError as PenvError2 } from "@penvhq/core";
 var ENGINE_BIN = "penv-engine";
 function readPackageManifest(dir) {
   try {
-    return JSON.parse(readFileSync5(join5(dir, "package.json"), "utf8"));
+    return JSON.parse(readFileSync5(join4(dir, "package.json"), "utf8"));
   } catch {
     return void 0;
   }
@@ -1369,8 +1470,8 @@ var DEV_PIN_INTEGRITY = "sha512-development-build-not-a-published-release";
 var DEV_PIN_VERSION = "0.0.0-dev";
 var BUNDLED_ENGINE_PIN = {
   package: ENGINE_PACKAGE3,
-  version: "0.10.0",
-  integrity: "sha512-b+U0c3xWbk1ILtMfPjJW8x5XBxSLAaw/IAOLMBmGvT2uuYv41JPED8PrenEj4s3ZJY5BxpWU9mQcJHEBouaw/Q=="
+  version: "0.12.0",
+  integrity: "sha512-9HUylEIbFq0BGTOW54Vxhkzv8AvuB7H3bImTFP5J+dfglkR7udP2KUsr8b0I2mf45YMTQO5xsYpI5+nhLERGtA=="
 };
 function assertReleasePin(pin) {
   if (pin.integrity === DEV_PIN_INTEGRITY || pin.version === DEV_PIN_VERSION) {
@@ -1387,7 +1488,7 @@ function releaseEnginePin(pin, ranVersion) {
 
 // src/project.ts
 import { existsSync as existsSync3 } from "fs";
-import { dirname as dirname5, join as join6, resolve as resolve4 } from "path";
+import { dirname as dirname5, join as join5, resolve as resolve4 } from "path";
 import { MANIFEST_PATH as MANIFEST_PATH3, stateDir } from "@penvhq/core";
 var MANIFEST_SEGMENTS = MANIFEST_PATH3.split("/");
 function findUp(cwd, matches) {
@@ -1404,42 +1505,152 @@ function findUp(cwd, matches) {
   }
 }
 function findProject(cwd) {
-  const root = findUp(cwd, (dir) => existsSync3(join6(dir, ...MANIFEST_SEGMENTS)));
-  return root === void 0 ? void 0 : { root, manifestFile: join6(root, ...MANIFEST_SEGMENTS) };
+  const root = findUp(cwd, (dir) => existsSync3(join5(dir, ...MANIFEST_SEGMENTS)));
+  return root === void 0 ? void 0 : { root, manifestFile: join5(root, ...MANIFEST_SEGMENTS) };
 }
 function findAdoptedRoot(cwd) {
   return findUp(cwd, (dir) => existsSync3(stateDir(dir)));
 }
 
+// src/upgrade.ts
+import { writeFileSync as writeFileSync4 } from "fs";
+import {
+  installWithPackageManager,
+  planInstall,
+  RUNTIME_PACKAGE,
+  renderInstallPlan
+} from "@penvhq/cli/install";
+import { ENGINE_PACKAGE as ENGINE_PACKAGE4, MANIFEST_PATH as MANIFEST_PATH4, serializeManifest as serializeManifest2 } from "@penvhq/core";
+function parseRequest2(argv) {
+  let version;
+  let yes = false;
+  for (const token of argv) {
+    if (token === YES_FLAG) {
+      yes = true;
+      continue;
+    }
+    if (token.startsWith("-")) {
+      throw new UpgradeFlagError(token);
+    }
+    if (version !== void 0 || token === "") {
+      throw new UpgradeSubjectError();
+    }
+    version = token;
+  }
+  return { version, yes };
+}
+function renderPinChange(engine, release) {
+  return [
+    MANIFEST_PATH4,
+    `  -   "integrity": "${engine.integrity}"`,
+    `  -   "version": "${engine.version}"`,
+    `  +   "integrity": "${release.integrity}"`,
+    `  +   "version": "${release.version}"`
+  ];
+}
+function pinnedElsewhere(manifest, version) {
+  return Object.entries(manifest.extensions).filter(([, entry]) => entry.version !== version).map(([name]) => name);
+}
+async function consent(options, release, plan, yes) {
+  const { io, manifest } = options;
+  io.out(`${ENGINE_PACKAGE4} ${manifest.engine.version} \u2192 ${release.version}`);
+  io.out("");
+  for (const line of renderPinChange(manifest.engine, release)) {
+    io.out(line);
+  }
+  for (const line of renderInstallPlan(plan)) {
+    io.out(line);
+  }
+  if (yes) {
+    return;
+  }
+  if (!await io.confirm(`Move this project to ${release.version}?`)) {
+    throw new UpgradeDeclinedError(release.version);
+  }
+}
+async function upgrade(options) {
+  const { io, fetcher, home, root, manifest, manifestFile } = options;
+  const request = parseRequest2(options.argv);
+  if (options.noDownload === true) {
+    throw new UpgradeNoDownloadError();
+  }
+  if ((options.ci === true || !io.interactive) && !(request.yes && request.version !== void 0)) {
+    throw new UpgradeUnattendedError();
+  }
+  const release = await fetchRelease({
+    name: ENGINE_PACKAGE4,
+    ...request.version === void 0 ? {} : { version: request.version },
+    retry: UPGRADE_COMMAND,
+    fetcher
+  });
+  const plan = planInstall(root, release.version);
+  if (manifest.engine.version === release.version && plan.satisfied) {
+    io.out(`\u2713 Already on ${ENGINE_PACKAGE4} ${release.version} \u2014 nothing to move`);
+    return;
+  }
+  const manifestText = serializeManifest2({
+    ...manifest,
+    engine: { package: ENGINE_PACKAGE4, version: release.version, integrity: release.integrity }
+  });
+  await consent(options, release, plan, request.yes);
+  await installPin({
+    home,
+    kind: "engines",
+    pin: { name: ENGINE_PACKAGE4, version: release.version, integrity: release.integrity },
+    fetcher
+  });
+  io.out(`\u2713 ${ENGINE_PACKAGE4} ${release.version} installed`);
+  if (!plan.satisfied) {
+    try {
+      await (options.install ?? installWithPackageManager)(plan);
+    } catch {
+      throw new UpgradeInstallFailedError(plan.manager, release.version);
+    }
+    for (const step of plan.steps.filter((entry) => !entry.satisfied)) {
+      io.out(`\u2713 ${step.manifest} depends on ${RUNTIME_PACKAGE} ${release.version}`);
+    }
+  }
+  writeFileSync4(manifestFile, manifestText);
+  io.out(`\u2713 ${MANIFEST_PATH4} pins ${ENGINE_PACKAGE4} ${release.version}`);
+  const kept = pinnedElsewhere(manifest, release.version);
+  if (kept.length > 0) {
+    const subject = kept.length === 1 ? "keeps its own pin" : "keep their own pins";
+    io.out(`\u2192 ${kept.join(", ")} ${subject} \u2014 \`penv add <package>@<version>\` moves one.`);
+  }
+}
+
 // src/launcher.ts
-import { existsSync as existsSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+import { join as join6 } from "path";
 import {
   MANIFEST_FORMAT,
-  MANIFEST_PATH as MANIFEST_PATH5,
+  MANIFEST_PATH as MANIFEST_PATH6,
   PENV_HOME_VAR,
   PenvError as PenvError3,
+  packageEntry as packageEntry2,
   parseManifest as parseManifest2,
   penvHome,
-  serializeManifest as serializeManifest2,
+  serializeManifest as serializeManifest3,
   UnsupportedManifestFormatError
 } from "@penvhq/core";
 
 // src/help.ts
-import { EXTENSIONS_PATH as EXTENSIONS_PATH3, MANIFEST_PATH as MANIFEST_PATH4 } from "@penvhq/core";
+import { RUNTIME_PACKAGE as RUNTIME_PACKAGE2 } from "@penvhq/cli/install";
+import { ENGINE_PACKAGE as ENGINE_PACKAGE5, EXTENSIONS_PATH as EXTENSIONS_PATH3, MANIFEST_PATH as MANIFEST_PATH5, OFFICIAL_SCOPE as OFFICIAL_SCOPE3 } from "@penvhq/core";
 function printLauncherCommands(io) {
   io.out("");
   io.out("LAUNCHER COMMANDS (penv itself, whatever engine a project pins)");
   io.out("");
-  io.out(`  install                Installs everything ${MANIFEST_PATH4} pins`);
+  io.out(`  install                Installs everything ${MANIFEST_PATH5} pins`);
   io.out("  add <package>          Pins a provider extension, and commits the decision");
   io.out(`  add ${LOCAL_FLAG} <package>  Adds the one this repository builds \u2014 nothing is pinned`);
+  io.out(`  upgrade [version]      Moves the engine pin and ${RUNTIME_PACKAGE2} together`);
   io.out("");
 }
 function printInstallHelp(io) {
   io.out(`${INSTALL_COMMAND}`);
   io.out("");
-  io.out(`Downloads, verifies and installs every version ${MANIFEST_PATH4} pins \u2014 the engine and`);
+  io.out(`Downloads, verifies and installs every version ${MANIFEST_PATH5} pins \u2014 the engine and`);
   io.out("every extension \u2014 into $PENV_HOME. The one penv command CI and production run that");
   io.out("may reach the registry.");
 }
@@ -1451,15 +1662,32 @@ function printAddHelp(io) {
   io.out(
     `  ${TRUST_YOUNG_FLAG}      Add a release published less than ${MIN_PACKAGE_AGE_DAYS} days ago`
   );
+  io.out(`  ${YES_FLAG}              Ask nothing \u2014 the config and onboarding offers print instead`);
   io.out("");
-  io.out(`Pins the release in ${MANIFEST_PATH4} and writes its type declaration to`);
+  io.out(`Pins the release in ${MANIFEST_PATH5} and writes its type declaration to`);
   io.out(`${EXTENSIONS_PATH3}/. Both are committed, so \`${INSTALL_COMMAND}\` gives every machine`);
   io.out(`the bytes you reviewed. \`${LOCAL_FLAG}\` pins nothing and touches no manifest.`);
+  io.out("");
+  io.out(`An \`${OFFICIAL_SCOPE3}*\` package asks nothing, so it adds unattended. Anything else`);
+  io.out("records who publishes it and why you trust it, which needs a person at a terminal \u2014");
+  io.out(`\`${YES_FLAG}\` cannot write that line for you.`);
+}
+function printUpgradeHelp(io) {
+  io.out("penv upgrade [version]");
+  io.out("");
+  io.out(`  ${YES_FLAG}              Skip the question \u2014 unattended runs need it and a version`);
+  io.out("");
+  io.out(`Moves the ${ENGINE_PACKAGE5} pin in ${MANIFEST_PATH5} and this project's`);
+  io.out(`${RUNTIME_PACKAGE2} dependency to the same exact version. No version takes whatever`);
+  io.out("`latest` points at; the integrity is the one the registry states, never one penv");
+  io.out("computed. Both files are shown before either moves, and they move together or not");
+  io.out("at all. Extensions keep their own pins.");
 }
 
 // src/launcher.ts
 var INSTALL = "install";
 var ADD = "add";
+var UPGRADE = "upgrade";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["--version", "-v"]);
 var HELP_FLAGS = /* @__PURE__ */ new Set(["--help", "-h"]);
 var NO_DOWNLOAD = "--no-download";
@@ -1555,6 +1783,10 @@ async function launch(options) {
       printAddHelp(io);
       return 0;
     }
+    if (first === UPGRADE) {
+      printUpgradeHelp(io);
+      return 0;
+    }
   }
   const project = findProject(cwd);
   if (project === void 0) {
@@ -1582,6 +1814,20 @@ async function launch(options) {
     io.out(`penv ${manifest.engine.version}`);
     return 0;
   }
+  if (first === UPGRADE) {
+    await upgrade({
+      argv: forwarded.slice(1),
+      root: project.root,
+      manifestFile: project.manifestFile,
+      manifest,
+      home,
+      io,
+      fetcher: options.fetcher,
+      noDownload,
+      ci: isCi(env)
+    });
+    return 0;
+  }
   const enginePin = enginePinOf(manifest);
   const engineDir = await ensure(options, "engines", enginePin, home, noDownload);
   for (const pin of extensionPinsOf(manifest)) {
@@ -1600,16 +1846,16 @@ async function adopt(options, forwarded, home, cwd, noDownload) {
   if (root === void 0) {
     return 0;
   }
-  const manifestFile = join7(root, ...MANIFEST_PATH5.split("/"));
+  const manifestFile = join6(root, ...MANIFEST_PATH6.split("/"));
   if (existsSync4(manifestFile)) {
     return 0;
   }
   const pin = releaseEnginePin(options.bundledPin, engine.version);
-  writeFileSync4(
+  writeFileSync5(
     manifestFile,
-    serializeManifest2({ format: MANIFEST_FORMAT, engine: pin, extensions: {} })
+    serializeManifest3({ format: MANIFEST_FORMAT, engine: pin, extensions: {} })
   );
-  options.io.out(`\u2713 ${MANIFEST_PATH5} pins ${pin.package} ${pin.version}`);
+  options.io.out(`\u2713 ${MANIFEST_PATH6} pins ${pin.package} ${pin.version}`);
   await ensureAdoptedEngine(
     options,
     { name: pin.package, version: pin.version, integrity: pin.integrity },
@@ -1656,12 +1902,14 @@ async function install(options, pins, home, broken) {
     if (state === "corrupt") {
       throw new PackageCorruptError(pin.name, pin.version, dir);
     }
-    if (state === "installed") {
-      options.io.out(`\u2713 ${pin.name} ${pin.version} already installed`);
-      continue;
+    if (state === "absent") {
+      await installPin({ home, kind, pin, fetcher: options.fetcher });
+    }
+    if (kind === "extensions") {
+      await assertLoadable(pin.name, packageEntry2(dir), false);
     }
-    await installPin({ home, kind, pin, fetcher: options.fetcher });
-    options.io.out(`\u2713 ${pin.name} ${pin.version} installed`);
+    const verb = state === "absent" ? "installed" : "already installed";
+    options.io.out(`\u2713 ${pin.name} ${pin.version} ${verb}`);
   }
   if (broken.length > 0) {
     report(new ManifestEntriesUnreadableError(broken), options.io);
@@ -1709,6 +1957,8 @@ export {
   readProviderEntries,
   setProviderType,
   INSTALL_COMMAND,
+  UPGRADE_COMMAND,
+  YES_FLAG,
   MIN_PACKAGE_AGE_DAYS,
   TRUST_YOUNG_FLAG,
   NoProjectError,
@@ -1735,7 +1985,7 @@ export {
   ReleaseIncompleteError,
   PackageTooYoungError,
   AddNoDownloadError,
-  AddNotInteractiveError,
+  AddTrustUnattendedError,
   TrustDeclinedError,
   TrustPublisherMissingError,
   TrustReasonMissingError,
@@ -1743,6 +1993,12 @@ export {
   DeclarationNotSelfContainedError,
   EnginePinUnreleasedError,
   EnginePinMismatchError,
+  UpgradeSubjectError,
+  UpgradeFlagError,
+  UpgradeNoDownloadError,
+  UpgradeUnattendedError,
+  UpgradeDeclinedError,
+  UpgradeInstallFailedError,
   EngineEntryError,
   readExtensionPackage,
   renderDeclaration,
@@ -1773,6 +2029,7 @@ export {
   releaseEnginePin,
   findProject,
   findAdoptedRoot,
+  upgrade,
   runLauncher
 };
-//# sourceMappingURL=chunk-BNUZ52VN.js.map
+//# sourceMappingURL=chunk-A5LJQPYS.js.map