@vltpkg/cli-js 1.0.0-rc.25 → 1.0.0-rc.27

package/{bugs-KSVA7QNG.js → bugs-CS34LDPD.js}

@@ -14,36 +14,36 @@ import {
 } from "./chunk-AZLX27EM.js";
 import {
   createHostContextsMap
-} from "./chunk-62UYVR5K.js";
+} from "./chunk-VTZZIXYW.js";
 import {
   Query,
   actual
-} from "./chunk-HPK6ZLUY.js";
+} from "./chunk-DJBBJDHI.js";
 import {
   SecurityArchive
-} from "./chunk-5QLMU4PR.js";
-import "./chunk-VVTZN4QQ.js";
+} from "./chunk-BIUCOMBH.js";
+import "./chunk-52LBC3AX.js";
 import {
   commandUsage
 } from "./chunk-5E5GX4G6.js";
 import {
   PackageInfoClient
-} from "./chunk-QFA4L7SI.js";
+} from "./chunk-INXSTZAX.js";
 import "./chunk-FI5TUER7.js";
-import "./chunk-XBN4TEBD.js";
+import "./chunk-JQHMLTO5.js";
 import {
   urlOpen
 } from "./chunk-D7U7KDEM.js";
-import "./chunk-Z76BQOEV.js";
+import "./chunk-YR47M5L7.js";
 import "./chunk-BGQCUUCA.js";
 import "./chunk-E74WGW5C.js";
 import {
   Spec2 as Spec
-} from "./chunk-FEV5BCW7.js";
+} from "./chunk-QDGZZ5FZ.js";
 import "./chunk-VCSVHRCS.js";
 import "./chunk-D27QPHKI.js";
 import "./chunk-JLJKOF75.js";
-import "./chunk-KXBF4HVG.js";
+import "./chunk-XWF3GJKE.js";
 import "./chunk-HTOTG4TS.js";
 import "./chunk-XNLSTHDK.js";
 import {

package/{build-6QS3HGOJ.js → build-XHEFAWMN.js}

@@ -11,22 +11,22 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   build
-} from "./chunk-HPK6ZLUY.js";
-import "./chunk-5QLMU4PR.js";
-import "./chunk-VVTZN4QQ.js";
+} from "./chunk-DJBBJDHI.js";
+import "./chunk-BIUCOMBH.js";
+import "./chunk-52LBC3AX.js";
 import {
   commandUsage
 } from "./chunk-5E5GX4G6.js";
-import "./chunk-Z76BQOEV.js";
+import "./chunk-YR47M5L7.js";
 import "./chunk-BGQCUUCA.js";
 import "./chunk-E74WGW5C.js";
-import "./chunk-FEV5BCW7.js";
+import "./chunk-QDGZZ5FZ.js";
 import "./chunk-VCSVHRCS.js";
 import "./chunk-D27QPHKI.js";
 import "./chunk-JLJKOF75.js";
 import {
   isErrorWithCause
-} from "./chunk-KXBF4HVG.js";
+} from "./chunk-XWF3GJKE.js";
 import "./chunk-HTOTG4TS.js";
 import "./chunk-XNLSTHDK.js";
 import {

package/{cache-PFWAIDXW.js → cache-LII2V5IM.js}

@@ -15,29 +15,29 @@ import {
 import {
   stderr,
   stdout
-} from "./chunk-56TWRLHO.js";
+} from "./chunk-P2HZ4ISK.js";
 import "./chunk-TDTJOKF2.js";
 import {
   ViewClass
 } from "./chunk-RXNA2XCX.js";
 import "./chunk-WGDTG44V.js";
-import "./chunk-5WHVV7CQ.js";
+import "./chunk-TRXTSZFT.js";
 import {
   commandUsage
 } from "./chunk-5E5GX4G6.js";
 import {
   CacheEntry
-} from "./chunk-XBN4TEBD.js";
+} from "./chunk-JQHMLTO5.js";
 import "./chunk-D7U7KDEM.js";
 import "./chunk-BGQCUUCA.js";
 import "./chunk-E74WGW5C.js";
 import {
   Spec2 as Spec
-} from "./chunk-FEV5BCW7.js";
+} from "./chunk-QDGZZ5FZ.js";
 import "./chunk-VCSVHRCS.js";
 import "./chunk-D27QPHKI.js";
 import "./chunk-JLJKOF75.js";
-import "./chunk-KXBF4HVG.js";
+import "./chunk-XWF3GJKE.js";
 import "./chunk-XNLSTHDK.js";
 import {
   error

package/{chunk-VVTZN4QQ.js → chunk-52LBC3AX.js}

@@ -12,11 +12,11 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   PackageJson,
   getUser
-} from "./chunk-Z76BQOEV.js";
+} from "./chunk-YR47M5L7.js";
 import {
   asError,
   normalizeManifest
-} from "./chunk-KXBF4HVG.js";
+} from "./chunk-XWF3GJKE.js";
 
 // ../../src/init/src/index.ts
 import { basename, resolve } from "node:path";

package/{chunk-2MGFDD5I.js → chunk-6YTJVEK2.js}

@@ -16,24 +16,24 @@ import {
   stderr,
   stdout,
   styleTextStdout
-} from "./chunk-56TWRLHO.js";
+} from "./chunk-P2HZ4ISK.js";
 import {
   require_emoji_regex
 } from "./chunk-VTEFO2FT.js";
 import {
   createHostContextsMap
-} from "./chunk-62UYVR5K.js";
+} from "./chunk-VTZZIXYW.js";
 import {
   Query,
   actual,
   isRunResult
-} from "./chunk-HPK6ZLUY.js";
+} from "./chunk-DJBBJDHI.js";
 import {
   Monorepo
-} from "./chunk-Z76BQOEV.js";
+} from "./chunk-YR47M5L7.js";
 import {
   isErrorWithCause
-} from "./chunk-KXBF4HVG.js";
+} from "./chunk-XWF3GJKE.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
@@ -1192,6 +1192,7 @@ var ExecCommand = class {
       arg0,
       args: this.args,
       env: this.env,
+      ignoreMissing: this.conf.get("if-present") ?? this.#defaultIgnoreMissing,
       projectRoot: this.projectRoot,
       packageJson: this.conf.options.packageJson,
       "script-shell": this.arg0 ? this.conf.get("script-shell") : false

package/{chunk-5QLMU4PR.js → chunk-BIUCOMBH.js}

@@ -16,7 +16,7 @@ import {
   asDepID,
   baseDepID,
   splitDepID
-} from "./chunk-FEV5BCW7.js";
+} from "./chunk-QDGZZ5FZ.js";
 import {
   L
 } from "./chunk-VCSVHRCS.js";

package/{chunk-HPK6ZLUY.js → chunk-DJBBJDHI.js}

@@ -13,16 +13,16 @@ import {
   AbortError,
   SecurityArchive,
   pRetry
-} from "./chunk-5QLMU4PR.js";
+} from "./chunk-BIUCOMBH.js";
 import {
   init
-} from "./chunk-VVTZN4QQ.js";
+} from "./chunk-52LBC3AX.js";
 import {
   Monorepo,
   PackageJson,
   minimatch,
   platformCheck
-} from "./chunk-Z76BQOEV.js";
+} from "./chunk-YR47M5L7.js";
 import {
   rimraf
 } from "./chunk-BGQCUUCA.js";
@@ -49,7 +49,7 @@ import {
   joinExtra,
   splitDepID,
   splitExtra
-} from "./chunk-FEV5BCW7.js";
+} from "./chunk-QDGZZ5FZ.js";
 import {
   promiseSpawn
 } from "./chunk-VCSVHRCS.js";
@@ -84,7 +84,7 @@ import {
   patch,
   satisfies,
   shortDependencyTypes
-} from "./chunk-KXBF4HVG.js";
+} from "./chunk-XWF3GJKE.js";
 import {
   load,
   walkUp
@@ -5376,7 +5376,7 @@ var exec = async (options) => {
       {
         ...process.env,
         ...env2,
-        FORCE_COLOR: color ? "1" : "0"
+        FORCE_COLOR: color && process.stdout.isTTY ? "1" : "0"
       },
       arg0
     ),
@@ -7865,6 +7865,8 @@ var has = async (state) => {
           edges: new Set(state.partial.edges),
           nodes: new Set(state.partial.nodes)
         },
+        diffFiles: state.diffFiles,
+        loose: state.loose,
         hostContexts: state.hostContexts,
         importers: state.importers,
         retries: state.retries,
@@ -7924,6 +7926,7 @@ var is = async (state) => {
           nodes: /* @__PURE__ */ new Set()
         },
         current: node,
+        diffFiles: state.diffFiles,
         initial: state.initial,
         loose: true,
         partial: {
@@ -7964,7 +7967,9 @@ var not = async (state) => {
           nodes: /* @__PURE__ */ new Set()
         },
         current: node,
+        diffFiles: state.diffFiles,
         initial: state.initial,
+        loose: state.loose,
         partial: {
           nodes: new Set(state.partial.nodes),
           edges: new Set(state.partial.edges)
@@ -9163,6 +9168,13 @@ var Graph = class {
       toFoundNode.detached = false;
       toFoundNode.dev &&= flags.dev;
       toFoundNode.optional &&= flags.optional;
+      if (manifest) {
+        if (!toFoundNode.manifest) {
+          toFoundNode.manifest = manifest;
+          this.manifests.set(toFoundNode.id, manifest);
+        }
+        toFoundNode.integrity ??= manifest.dist?.integrity;
+      }
       return toFoundNode;
     }
     const toNode = this.addNode(depId, manifest, spec2);

package/{chunk-P2KTSGDO.js → chunk-DJBVQKBB.js}

@@ -11,13 +11,13 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   stderr
-} from "./chunk-56TWRLHO.js";
+} from "./chunk-P2HZ4ISK.js";
 import {
   ViewClass
 } from "./chunk-RXNA2XCX.js";
 import {
   mermaidOutput
-} from "./chunk-HPK6ZLUY.js";
+} from "./chunk-DJBBJDHI.js";
 import {
   urlOpen
 } from "./chunk-D7U7KDEM.js";

package/{chunk-37DCI4KG.js → chunk-DYL7AFY7.js}

@@ -11,11 +11,11 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   asDependency
-} from "./chunk-HPK6ZLUY.js";
+} from "./chunk-DJBBJDHI.js";
 import {
   Spec2 as Spec,
   joinDepIDTuple
-} from "./chunk-FEV5BCW7.js";
+} from "./chunk-QDGZZ5FZ.js";
 
 // ../../src/cli-sdk/src/parse-add-remove-args.ts
 var rootDepID = joinDepIDTuple(["file", "."]);

package/{chunk-QFA4L7SI.js → chunk-INXSTZAX.js}

@@ -15,7 +15,7 @@ import {
 } from "./chunk-FI5TUER7.js";
 import {
   RegistryClient
-} from "./chunk-XBN4TEBD.js";
+} from "./chunk-JQHMLTO5.js";
 import {
   Monorepo,
   PackageJson,
@@ -23,18 +23,17 @@ import {
   pickManifest,
   resolve,
   revs
-} from "./chunk-Z76BQOEV.js";
+} from "./chunk-YR47M5L7.js";
 import {
   rimraf
 } from "./chunk-BGQCUUCA.js";
 import {
   Spec2 as Spec
-} from "./chunk-FEV5BCW7.js";
+} from "./chunk-QDGZZ5FZ.js";
 import {
   asError,
-  asPackument,
-  isIntegrity
-} from "./chunk-KXBF4HVG.js";
+  asPackument
+} from "./chunk-XWF3GJKE.js";
 import {
   XDG
 } from "./chunk-XNLSTHDK.js";
@@ -783,7 +782,7 @@ var Pool = class {
 
 // ../../src/package-info/src/index.ts
 var import_ssri = __toESM(require_lib(), 1);
-import { randomBytes as randomBytes2 } from "node:crypto";
+import { createHash, randomBytes as randomBytes2 } from "node:crypto";
 import {
   mkdir as mkdir2,
   readFile,
@@ -867,9 +866,15 @@ var PackageInfoClient = class {
   async extract(spec, target, options = {}) {
     if (typeof spec === "string")
       spec = Spec.parse(spec, this.options);
-    const { from = this.#projectRoot, integrity, resolved } = options;
+    const {
+      from = this.#projectRoot,
+      integrity,
+      resolved,
+      fromLockfile = false
+    } = options;
     const f = spec.final;
-    const r = integrity && resolved ? { resolved, integrity, spec } : await this.resolve(spec, options);
+    const alreadyResolved = !!(integrity && resolved);
+    const r = alreadyResolved ? { resolved, integrity, spec } : await this.resolve(spec, options);
     switch (f.type) {
       case "git": {
         const {
@@ -903,30 +908,62 @@ var PackageInfoClient = class {
         }
       }
       case "registry": {
-        const trustIntegrity = this.#trustedIntegrities.get(r.resolved) === r.integrity;
-        const response = await this.registryClient.request(
-          r.resolved,
-          {
-            integrity: r.integrity,
-            trustIntegrity
-          }
-        );
-        if (response.statusCode !== 200) {
-          throw this.#resolveError(
-            spec,
-            options,
-            "failed to fetch tarball",
+        const fetchTarball = async (useCache) => {
+          const trustIntegrity = this.#trustedIntegrities.get(r.resolved) === r.integrity;
+          const response = await this.registryClient.request(
+            r.resolved,
             {
-              url: r.resolved,
-              response
+              integrity: r.integrity,
+              trustIntegrity,
+              ...useCache === false ? { useCache } : {}
             }
           );
-        }
-        if (!trustIntegrity && response.checkIntegrity({ spec, url: resolved })) {
-          this.#trustedIntegrities.set(r.resolved, response.integrity);
+          if (response.statusCode !== 200) {
+            throw this.#resolveError(
+              spec,
+              options,
+              "failed to fetch tarball",
+              {
+                url: r.resolved,
+                response
+              }
+            );
+          }
+          if (!trustIntegrity && response.checkIntegrity({ spec, url: resolved })) {
+            this.#trustedIntegrities.set(
+              r.resolved,
+              response.integrity
+            );
+          }
+          const buf2 = response.buffer();
+          if (r.integrity && !fromLockfile) {
+            const hash = createHash("sha512");
+            hash.update(buf2);
+            const computed = `sha512-${hash.digest("base64")}`;
+            if (computed !== r.integrity) {
+              throw error("Tarball integrity check failed", {
+                code: "EINTEGRITY",
+                spec,
+                url: r.resolved,
+                wanted: r.integrity,
+                found: computed
+              });
+            }
+          }
+          return buf2;
+        };
+        let buf;
+        try {
+          buf = await fetchTarball();
+        } catch (er) {
+          if (er instanceof Error && "cause" in er && er.cause?.code === "EINTEGRITY") {
+            buf = await fetchTarball(false);
+          } else {
+            throw er;
+          }
         }
         try {
-          await this.tarPool.unpack(response.buffer(), target);
+          await this.tarPool.unpack(buf, target);
         } catch (er) {
           throw this.#resolveError(
             spec,
@@ -1122,24 +1159,53 @@ var PackageInfoClient = class {
             "no tarball found in manifest.dist"
           );
         }
-        const trustIntegrity = this.#trustedIntegrities.get(tarball) === integrity;
-        const response = await this.registryClient.request(tarball, {
-          ...options,
-          integrity,
-          trustIntegrity
-        });
-        if (response.statusCode !== 200) {
-          throw this.#resolveError(
-            spec,
-            options,
-            "failed to fetch tarball",
-            { response, url: tarball }
+        const fetchTarball = async (useCache) => {
+          const trustIntegrity = this.#trustedIntegrities.get(tarball) === integrity;
+          const response = await this.registryClient.request(
+            tarball,
+            {
+              ...options,
+              integrity,
+              trustIntegrity,
+              ...useCache === false ? { useCache } : {}
+            }
           );
+          if (response.statusCode !== 200) {
+            throw this.#resolveError(
+              spec,
+              options,
+              "failed to fetch tarball",
+              { response, url: tarball }
+            );
+          }
+          if (!trustIntegrity && response.checkIntegrity({ spec, url: tarball })) {
+            this.#trustedIntegrities.set(tarball, response.integrity);
+          }
+          const buf = response.buffer();
+          if (integrity) {
+            const hash = createHash("sha512");
+            hash.update(buf);
+            const computed = `sha512-${hash.digest("base64")}`;
+            if (computed !== integrity) {
+              throw error("Tarball integrity check failed", {
+                code: "EINTEGRITY",
+                spec,
+                url: tarball,
+                wanted: integrity,
+                found: computed
+              });
+            }
+          }
+          return buf;
+        };
+        try {
+          return await fetchTarball();
+        } catch (er) {
+          if (er instanceof Error && "cause" in er && er.cause?.code === "EINTEGRITY") {
+            return await fetchTarball(false);
+          }
+          throw er;
         }
-        if (!trustIntegrity && response.checkIntegrity({ spec, url: tarball })) {
-          this.#trustedIntegrities.set(tarball, response.integrity);
-        }
-        return response.buffer();
       }
       case "git": {
         const {
@@ -1245,15 +1311,6 @@ var PackageInfoClient = class {
           options
         );
         if (!mani) throw this.#resolveError(spec, options);
-        const { integrity, tarball } = mani.dist ?? /* c8 ignore next */
-        {};
-        if (isIntegrity(integrity) && tarball) {
-          const registryOrigin = new URL(String(f.registry)).origin;
-          const tgzOrigin = new URL(tarball).origin;
-          if (tgzOrigin === registryOrigin) {
-            this.#trustedIntegrities.set(tarball, integrity);
-          }
-        }
         if (cachePath) {
           const json = JSON.stringify({
             ...mani,

package/{chunk-XBN4TEBD.js → chunk-JQHMLTO5.js}

@@ -26,7 +26,7 @@ import {
 } from "./chunk-JLJKOF75.js";
 import {
   asError
-} from "./chunk-KXBF4HVG.js";
+} from "./chunk-XWF3GJKE.js";
 import {
   XDG
 } from "./chunk-XNLSTHDK.js";

package/{chunk-GQUU7WYA.js → chunk-LAG2R3YJ.js}

@@ -16,10 +16,10 @@ import {
 } from "./chunk-FI5TUER7.js";
 import {
   minimatch
-} from "./chunk-Z76BQOEV.js";
+} from "./chunk-YR47M5L7.js";
 import {
   Spec2 as Spec
-} from "./chunk-FEV5BCW7.js";
+} from "./chunk-QDGZZ5FZ.js";
 import {
   parse,
   stringify

package/{chunk-QRBXNJDL.js → chunk-LKFTVDWS.js}

@@ -11,7 +11,7 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   init
-} from "./chunk-VVTZN4QQ.js";
+} from "./chunk-52LBC3AX.js";
 import {
   commandUsage
 } from "./chunk-5E5GX4G6.js";
@@ -19,7 +19,7 @@ import {
   asWSConfig,
   assertWSConfig,
   minimatch
-} from "./chunk-Z76BQOEV.js";
+} from "./chunk-YR47M5L7.js";
 import {
   load,
   save

package/{chunk-56TWRLHO.js → chunk-P2HZ4ISK.js}

@@ -18,18 +18,18 @@ import {
 } from "./chunk-RXNA2XCX.js";
 import {
   parseError
-} from "./chunk-5WHVV7CQ.js";
+} from "./chunk-TRXTSZFT.js";
 import {
   isGraphRunError,
   splitDepID
-} from "./chunk-FEV5BCW7.js";
+} from "./chunk-QDGZZ5FZ.js";
 import {
   defaultView
 } from "./chunk-D27QPHKI.js";
 import {
   isErrorWithCause,
   isObject
-} from "./chunk-KXBF4HVG.js";
+} from "./chunk-XWF3GJKE.js";
 import {
   XDG
 } from "./chunk-XNLSTHDK.js";

package/{chunk-FEV5BCW7.js → chunk-QDGZZ5FZ.js}

@@ -11,7 +11,7 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   parseRange
-} from "./chunk-KXBF4HVG.js";
+} from "./chunk-XWF3GJKE.js";
 import {
   error,
   typeError

package/{chunk-NGEVYSHM.js → chunk-QWWYZ3TT.js}

@@ -17,7 +17,7 @@ var run = async (command) => {
   if (command) {
     process.argv.splice(2, 0, command);
   }
-  const vlt = await import("./src-DYCHGTG4.js");
+  const vlt = await import("./src-SDJWTPCU.js");
   await vlt.default();
 };
 

package/{chunk-L2RQA7D5.js → chunk-S5I2UOBT.js}

@@ -12,19 +12,19 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   findCmdShimIfExists,
   install
-} from "./chunk-HPK6ZLUY.js";
+} from "./chunk-DJBBJDHI.js";
 import {
   PackageInfoClient
-} from "./chunk-QFA4L7SI.js";
+} from "./chunk-INXSTZAX.js";
 import {
   PathScurry
-} from "./chunk-Z76BQOEV.js";
+} from "./chunk-YR47M5L7.js";
 import {
   Spec2 as Spec
-} from "./chunk-FEV5BCW7.js";
+} from "./chunk-QDGZZ5FZ.js";
 import {
   parseScope
-} from "./chunk-KXBF4HVG.js";
+} from "./chunk-XWF3GJKE.js";
 import {
   walkUp
 } from "./chunk-HTOTG4TS.js";

package/{chunk-M562AXMZ.js → chunk-SR66HWMM.js}

@@ -23,7 +23,7 @@ import {
 } from "./chunk-JLJKOF75.js";
 import {
   asError
-} from "./chunk-KXBF4HVG.js";
+} from "./chunk-XWF3GJKE.js";
 import {
   __commonJS,
   __export,

package/{chunk-5WHVV7CQ.js → chunk-TRXTSZFT.js}

@@ -12,7 +12,7 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   isError,
   isObject
-} from "./chunk-KXBF4HVG.js";
+} from "./chunk-XWF3GJKE.js";
 
 // ../../src/output/src/error.ts
 var parseError = (err) => {

package/{chunk-62UYVR5K.js → chunk-VTZZIXYW.js}

@@ -13,10 +13,10 @@ import {
   actual,
   callLimit,
   createVirtualRoot
-} from "./chunk-HPK6ZLUY.js";
+} from "./chunk-DJBBJDHI.js";
 import {
   SecurityArchive
-} from "./chunk-5QLMU4PR.js";
+} from "./chunk-BIUCOMBH.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
@@ -115,7 +115,7 @@ var reloadConfig = async (folder) => {
     unload("project");
   } catch {
   }
-  const { Config } = await import("./config-ECUAC3VA.js");
+  const { Config } = await import("./config-4ZFJD5AY.js");
   return Config.load(folder, process.argv, true);
 };