@vltpkg/cli-js 1.0.0-rc.30 → 1.0.0-rc.32

package/{chunk-FXFN5J74.js → chunk-SDBTQF2Y.js}

@@ -14,26 +14,26 @@ import {
 } from "./chunk-RIYFGX27.js";
 import {
   createHostContextsMap
-} from "./chunk-LUL76G2K.js";
+} from "./chunk-XFQ2EH5D.js";
 import {
   stderr,
   stdout,
   styleTextStdout
-} from "./chunk-LPLXAVG7.js";
+} from "./chunk-5UXEBLLT.js";
 import {
   Query,
   actual,
   isRunResult
-} from "./chunk-E76YOTJF.js";
+} from "./chunk-YQXDHMHG.js";
 import {
   require_emoji_regex
 } from "./chunk-VTEFO2FT.js";
 import {
   Monorepo
-} from "./chunk-XYCCQT7N.js";
+} from "./chunk-KRGA5VLT.js";
 import {
   isErrorWithCause
-} from "./chunk-Q3DNNTPG.js";
+} from "./chunk-6YXVQ5HC.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";

package/{chunk-I626GJCR.js → chunk-SIXXDCBI.js}

@@ -12,22 +12,22 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   findCmdShimIfExists,
   install
-} from "./chunk-E76YOTJF.js";
+} from "./chunk-YQXDHMHG.js";
 import {
   PackageInfoClient
-} from "./chunk-DPQWORL7.js";
+} from "./chunk-LEX7YPHR.js";
 import {
   PathScurry
-} from "./chunk-XYCCQT7N.js";
+} from "./chunk-KRGA5VLT.js";
 import {
   Spec2 as Spec
-} from "./chunk-IEISSXS4.js";
+} from "./chunk-JKAZKVQU.js";
 import {
   walkUp
 } from "./chunk-HTOTG4TS.js";
 import {
   parseScope
-} from "./chunk-Q3DNNTPG.js";
+} from "./chunk-6YXVQ5HC.js";
 import {
   XDG
 } from "./chunk-XNLSTHDK.js";

package/{chunk-LUL76G2K.js → chunk-XFQ2EH5D.js}

@@ -13,10 +13,10 @@ import {
   actual,
   callLimit,
   createVirtualRoot
-} from "./chunk-E76YOTJF.js";
+} from "./chunk-YQXDHMHG.js";
 import {
   SecurityArchive
-} from "./chunk-MAIQR5GM.js";
+} from "./chunk-DM3WGEVB.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
@@ -115,7 +115,7 @@ var reloadConfig = async (folder) => {
     unload("project");
   } catch {
   }
-  const { Config } = await import("./config-EUN3UG63.js");
+  const { Config } = await import("./config-LRL3N7TN.js");
   return Config.load(folder, process.argv, true);
 };
 

package/{chunk-E76YOTJF.js → chunk-YQXDHMHG.js}

@@ -13,14 +13,14 @@ import {
   AbortError,
   SecurityArchive,
   pRetry
-} from "./chunk-MAIQR5GM.js";
+} from "./chunk-DM3WGEVB.js";
 import {
   Monorepo,
   PackageJson,
   getUser,
   minimatch,
   platformCheck
-} from "./chunk-XYCCQT7N.js";
+} from "./chunk-KRGA5VLT.js";
 import {
   asDepID,
   getId,
@@ -33,7 +33,7 @@ import {
   joinExtra,
   splitDepID,
   splitExtra
-} from "./chunk-TYV4N3S3.js";
+} from "./chunk-IAKUGHGT.js";
 import {
   Spec,
   Spec2,
@@ -46,7 +46,7 @@ import {
   defaultScopeRegistries,
   getOptions,
   gitHostWebsites
-} from "./chunk-IEISSXS4.js";
+} from "./chunk-JKAZKVQU.js";
 import {
   load,
   walkUp
@@ -83,8 +83,9 @@ import {
   parseRange,
   patch,
   satisfies,
-  shortDependencyTypes
-} from "./chunk-Q3DNNTPG.js";
+  shortDependencyTypes,
+  subset
+} from "./chunk-6YXVQ5HC.js";
 import {
   XDG
 } from "./chunk-XNLSTHDK.js";
@@ -5980,19 +5981,22 @@ var confused = async (state) => {
 
 // ../../src/query/src/pseudo/cve.ts
 var parseInternals2 = (nodes) => {
+  if (!nodes[0]) {
+    return { cveId: void 0 };
+  }
+  const selectorNode = asPostcssNodeWithChildren(nodes[0]);
+  if (!selectorNode.nodes[0]) {
+    return { cveId: void 0 };
+  }
   let cveId = "";
-  if (isStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])) {
-    cveId = removeQuotes(
-      asStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0]).value
-    );
-  } else if (isTagNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])) {
-    cveId = asTagNode(
-      asPostcssNodeWithChildren(nodes[0]).nodes[0]
-    ).value;
+  if (isStringNode(selectorNode.nodes[0])) {
+    cveId = removeQuotes(asStringNode(selectorNode.nodes[0]).value);
+  } else if (isTagNode(selectorNode.nodes[0])) {
+    cveId = asTagNode(selectorNode.nodes[0]).value;
   }
   if (!cveId) {
     throw error("Expected a CVE ID", {
-      found: asPostcssNodeWithChildren(nodes[0]).nodes[0]
+      found: selectorNode.nodes[0]
     });
   }
   return { cveId };
@@ -6010,9 +6014,14 @@ var cve = async (state) => {
   const { cveId } = internals;
   for (const node of state.partial.nodes) {
     const report = state.securityArchive.get(node.id);
-    const exclude = !report?.alerts.some(
-      (alert) => alert.props?.cveId?.trim().toLowerCase() === cveId.trim().toLowerCase()
-    );
+    let exclude;
+    if (cveId === void 0) {
+      exclude = !report?.alerts.some((alert) => alert.props?.cveId);
+    } else {
+      exclude = !report?.alerts.some(
+        (alert) => alert.props?.cveId?.trim().toLowerCase() === cveId.trim().toLowerCase()
+      );
+    }
     if (exclude) {
       removeNode(state, node);
     }
@@ -6023,19 +6032,22 @@ var cve = async (state) => {
 
 // ../../src/query/src/pseudo/cwe.ts
 var parseInternals3 = (nodes) => {
+  if (!nodes[0]) {
+    return { cweId: void 0 };
+  }
+  const selectorNode = asPostcssNodeWithChildren(nodes[0]);
+  if (!selectorNode.nodes[0]) {
+    return { cweId: void 0 };
+  }
   let cweId = "";
-  if (isStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])) {
-    cweId = removeQuotes(
-      asStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0]).value
-    );
-  } else if (isTagNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])) {
-    cweId = asTagNode(
-      asPostcssNodeWithChildren(nodes[0]).nodes[0]
-    ).value;
+  if (isStringNode(selectorNode.nodes[0])) {
+    cweId = removeQuotes(asStringNode(selectorNode.nodes[0]).value);
+  } else if (isTagNode(selectorNode.nodes[0])) {
+    cweId = asTagNode(selectorNode.nodes[0]).value;
   }
   if (!cweId) {
     throw error("Expected a CWE ID", {
-      found: asPostcssNodeWithChildren(nodes[0]).nodes[0]
+      found: selectorNode.nodes[0]
     });
   }
   return { cweId };
@@ -6053,11 +6065,18 @@ var cwe = async (state) => {
   const { cweId } = internals;
   for (const node of state.partial.nodes) {
     const report = state.securityArchive.get(node.id);
-    const exclude = !report?.alerts.some(
-      (alert) => alert.props?.cwes?.some(
-        (cwe2) => cwe2.id.trim().toLowerCase() === cweId.trim().toLowerCase()
-      )
-    );
+    let exclude;
+    if (cweId === void 0) {
+      exclude = !report?.alerts.some(
+        (alert) => alert.props?.cwes && alert.props.cwes.length > 0
+      );
+    } else {
+      exclude = !report?.alerts.some(
+        (alert) => alert.props?.cwes?.some(
+          (cwe2) => cwe2.id.trim().toLowerCase() === cweId.trim().toLowerCase()
+        )
+      );
+    }
     if (exclude) {
       removeNode(state, node);
     }
@@ -6198,6 +6217,95 @@ var diff = async (state) => {
   return state;
 };
 
+// ../../src/query/src/pseudo/dist.ts
+var retrieveDistTags = async (node, signal) => {
+  const spec2 = hydrate(node.id, String(node.name), node.options);
+  if (!spec2.registry || !node.name) {
+    return {};
+  }
+  const url = new URL(spec2.registry);
+  url.pathname = `/${node.name}`;
+  const response = await fetch(String(url), {
+    headers: {
+      Accept: "application/vnd.npm.install-v1+json"
+    },
+    signal
+  });
+  if (response.status === 404) {
+    throw new AbortError("Missing API");
+  }
+  if (!response.ok) {
+    throw error("Failed to fetch packument", {
+      name: node.name,
+      spec: spec2,
+      response
+    });
+  }
+  const packument = await response.json();
+  return packument["dist-tags"];
+};
+var queueNode = async (state, node, tagName) => {
+  if (!node.name || !node.version) {
+    return node;
+  }
+  let distTags;
+  try {
+    distTags = await pRetry(
+      () => retrieveDistTags(node, state.signal),
+      {
+        retries: state.retries,
+        signal: state.signal
+      }
+    );
+  } catch (err) {
+    console.warn(
+      error("Could not retrieve dist-tags", {
+        name: node.name,
+        cause: err
+      })
+    );
+    return node;
+  }
+  const tagVersion = distTags[tagName];
+  if (tagVersion !== node.version) {
+    return node;
+  }
+  return void 0;
+};
+var dist = async (state) => {
+  const top = asPostcssNodeWithChildren(state.current);
+  const selector = asPostcssNodeWithChildren(top.nodes[0]);
+  const firstChild = selector.nodes[0];
+  let tagName;
+  try {
+    tagName = removeQuotes(asStringNode(firstChild).value);
+  } catch {
+    if (isTagNode(firstChild)) {
+      tagName = asTagNode(firstChild).value;
+    } else {
+      throw error("Failed to parse :dist selector", {
+        found: firstChild
+      });
+    }
+  }
+  const queue = [];
+  for (const node of state.partial.nodes) {
+    if (splitDepID(node.id)[0] !== "registry") {
+      removeNode(state, node);
+      continue;
+    }
+    queue.push(queueNode(state, node, tagName));
+  }
+  const removeNodeQueue = await Promise.all(queue);
+  for (const node of removeNodeQueue) {
+    if (node) {
+      removeNode(state, node);
+    }
+  }
+  removeDanglingEdges(state);
+  return state;
+};
+
 // ../../src/query/src/pseudo/dynamic.ts
 var dynamic = createSecuritySelectorFilter(
   "dynamic",
@@ -6751,7 +6859,7 @@ var parseInternals8 = (nodes) => {
   }
   return { kind };
 };
-var queueNode = async (state, node, kind) => {
+var queueNode2 = async (state, node, kind) => {
   if (!node.name || !node.version) {
     return node;
   }
@@ -6849,7 +6957,7 @@ var outdated = async (state) => {
       removeNode(state, node);
       continue;
     }
-    queue.push(queueNode(state, node, kind));
+    queue.push(queueNode2(state, node, kind));
   }
   const removeNodeQueue = await Promise.all(queue);
   for (const node of removeNodeQueue) {
@@ -7042,7 +7150,7 @@ var parseInternals9 = (nodes) => {
   }
   return { relativeDate, comparator };
 };
-var queueNode2 = async (state, node, relativeDate, comparator) => {
+var queueNode3 = async (state, node, relativeDate, comparator) => {
   if (!node.name || !node.version) {
     return node;
   }
@@ -7116,7 +7224,7 @@ var published = async (state) => {
       removeNode(state, node);
       continue;
     }
-    queue.push(queueNode2(state, node, relativeDate, comparator));
+    queue.push(queueNode3(state, node, relativeDate, comparator));
   }
   const removeNodeQueue = await Promise.all(queue);
   for (const node of removeNodeQueue) {
@@ -7353,7 +7461,9 @@ var semverFunctionNames = /* @__PURE__ */ new Set([
   "lt",
   "lte",
   "eq",
-  "neq"
+  "neq",
+  "intersects",
+  "subset"
 ]);
 var isSemverFunctionName = (name) => semverFunctionNames.has(name);
 var asSemverFunctionName = (name) => {
@@ -7374,6 +7484,10 @@ var semverFunctions = /* @__PURE__ */ new Map([
   ["eq", eq],
   ["neq", neq]
 ]);
+var semverRangeFunctions = /* @__PURE__ */ new Map([
+  ["intersects", intersects],
+  ["subset", subset]
+]);
 var parseInternals11 = (nodes, loose) => {
   let semverValue = "";
   try {
@@ -7415,10 +7529,14 @@ var parseInternals11 = (nodes, loose) => {
     }
   }
   const semverFunction = semverFunctions.get(fnName);
-  if (!semverFunction) {
+  const semverRangeFunction = semverRangeFunctions.get(fnName);
+  if (!semverFunction && !semverRangeFunction) {
     throw error("Invalid semver function name", {
       found: fnName,
-      validOptions: Array.from(semverFunctions.keys())
+      validOptions: [
+        ...Array.from(semverFunctions.keys()),
+        ...Array.from(semverRangeFunctions.keys())
+      ]
     });
   }
   let compareAttribute;
@@ -7445,7 +7563,8 @@ var parseInternals11 = (nodes, loose) => {
   }
   return {
     semverValue,
-    semverFunction,
+    semverFunction: semverFunction ?? satisfies,
+    semverRangeFunction,
     compareAttribute
   };
 };
@@ -7461,7 +7580,36 @@ var semverParser = async (state) => {
       cause: err
     });
   }
-  const { semverValue, semverFunction, compareAttribute } = internals;
+  const {
+    semverValue,
+    semverFunction,
+    semverRangeFunction,
+    compareAttribute
+  } = internals;
+  if (semverRangeFunction) {
+    if (compareAttribute) {
+      for (const node of state.partial.nodes) {
+        const compareValues = getManifestPropertyValues(
+          node,
+          compareAttribute.properties,
+          compareAttribute.attribute
+        );
+        const compareValue = compareValues?.[0];
+        if (!compareValue || !semverRangeFunction(compareValue, semverValue)) {
+          removeNode(state, node);
+        }
+      }
+    } else {
+      for (const edge of state.partial.edges) {
+        const edgeRange = edge.spec.semver ?? edge.spec.bareSpec;
+        if (!edgeRange || !semverRangeFunction(edgeRange, semverValue)) {
+          removeEdge(state, edge);
+        }
+      }
+      removeUnlinkedNodes(state);
+    }
+    return state;
+  }
   for (const node of state.partial.nodes) {
     if (compareAttribute) {
       const compareValues = getManifestPropertyValues(
@@ -7832,6 +7980,20 @@ var unstable = createSecuritySelectorFilter(
   "unstableOwnership"
 );
 
+// ../../src/query/src/pseudo/vulnerable.ts
+var vulnerable = async (state) => {
+  assertSecurityArchive(state, "vulnerable");
+  for (const node of state.partial.nodes) {
+    const report = state.securityArchive.get(node.id);
+    const hasCve = report?.alerts.some((alert) => alert.props?.cveId);
+    if (!hasCve) {
+      removeNode(state, node);
+    }
+  }
+  removeDanglingEdges(state);
+  return state;
+};
+
 // ../../src/query/src/pseudo/workspace.ts
 var workspace = async (state) => {
   for (const node of state.partial.nodes) {
@@ -8041,6 +8203,7 @@ var pseudoSelectors = new Map(
     deprecated,
     dev,
     diff,
+    dist,
     dynamic,
     eval: evalParser,
     empty,
@@ -8093,6 +8256,8 @@ var pseudoSelectors = new Map(
     unpopular,
     unstable,
     v: semverParser,
+    vuln: vulnerable,
+    vulnerable,
     workspace
   })
 );
@@ -9311,6 +9476,9 @@ import { resolve as resolve4 } from "node:path";
 var retrieveNodeFromGraph = (key, value, graph, fromId, seenNodes) => {
   const foundNode = graph.nodes.get(asDepID(fromId));
   if (!foundNode) {
+    if (fromId.startsWith("workspace") || fromId.startsWith("file")) {
+      return void 0;
+    }
     throw error("Edge info missing its `from` node", {
       found: {
         nodes: [...graph.nodes].map(([id2]) => id2),
@@ -9360,6 +9528,7 @@ var loadEdges = (graph, edges, options) => {
     } else {
       fromNode = retrieveNodeFromGraph(key, value, graph, fromId);
     }
+    if (!fromNode) continue;
     const toId = valRest.substring(vrSplit + 1);
     let toNode = void 0;
     if (toId !== "MISSING") {
@@ -11260,8 +11429,19 @@ var getImporterSpecs = (options) => {
       for (const [depName, depSpec] of deps) {
         const edge = importer.edgesOut.get(depName);
         if (edge?.to && depSpec === edge.spec.bareSpec) continue;
+        const spec2 = Spec2.parse(depName, depSpec, options);
+        if (spec2.type === "workspace" && !edge?.to) {
+          const wsExists = [...graph.importers].some(
+            (n) => n.name === depName
+          );
+          if (!wsExists) {
+            removeDeps.add(depName);
+            removeResult.modifiedDependencies = true;
+            continue;
+          }
+        }
         const dependency = asDependency({
-          spec: Spec2.parse(depName, depSpec, options),
+          spec: spec2,
           type: shorten(depType, depName, importer.manifest)
         });
         addDeps.set(depName, dependency);
@@ -12135,6 +12315,13 @@ var fetchManifestsForDeps = async (packageInfo, graph, fromNode, deps, scurry, p
       reuseTasks.push({ type: type2, spec: spec2, fromNode, toNode: existingNode });
       continue;
     }
+    if (spec2.final.type === "workspace") {
+      const wsVersion = graph.nodesByName.get(spec2.name)?.values().next().value?.version;
+      throw error(
+        wsVersion ? `workspace dependency ${spec2} does not match the local workspace version (${wsVersion})` : `no workspace found matching ${spec2}`,
+        { spec: spec2 }
+      );
+    }
     const edgeOptional = type2 === "optional" || type2 === "peerOptional";
     const manifestPromise = (
       // the "detached" node state means that it has already been load as
@@ -13406,6 +13593,15 @@ var reify = async (options) => {
   const skippable = skipOptionalOnly && !options.update;
   const res = { diff: diff2 };
   if (!diff2.hasChanges() || skippable) {
+    if (!scurry.lstatSync("vlt-lock.json") || !scurry.lstatSync("node_modules/.vlt-lock.json")) {
+      saveHidden(options);
+      const lfData = lockfileData(options);
+      saveData(lfData, scurry.resolve("vlt-lock.json"), false);
+    }
+    const pending = [...actual2.nodes.values()].filter((n) => n.buildState === "needed").map((n) => n.id);
+    if (pending.length) {
+      res.buildQueue = pending;
+    }
     done();
     return res;
   }

package/{chunk-BCS77CZK.js → chunk-ZUP6UTME.js}

@@ -21,7 +21,7 @@ import {
 import {
   asError,
   emitter
-} from "./chunk-Q3DNNTPG.js";
+} from "./chunk-6YXVQ5HC.js";
 import {
   __commonJS,
   __export,

package/{ci-25PDKMKT.js → ci-FQJANSQW.js}

@@ -11,24 +11,24 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   InstallReporter
-} from "./chunk-BCS77CZK.js";
+} from "./chunk-ZUP6UTME.js";
 import {
   install
-} from "./chunk-E76YOTJF.js";
-import "./chunk-MAIQR5GM.js";
+} from "./chunk-YQXDHMHG.js";
+import "./chunk-DM3WGEVB.js";
 import "./chunk-VTEFO2FT.js";
 import "./chunk-RXNA2XCX.js";
 import "./chunk-WGDTG44V.js";
-import "./chunk-XYCCQT7N.js";
-import "./chunk-TYV4N3S3.js";
-import "./chunk-IEISSXS4.js";
+import "./chunk-KRGA5VLT.js";
+import "./chunk-IAKUGHGT.js";
+import "./chunk-JKAZKVQU.js";
 import "./chunk-HTOTG4TS.js";
 import {
   commandUsage
 } from "./chunk-FBTBHRPG.js";
 import "./chunk-R44FR7BY.js";
 import "./chunk-2V4AQPBR.js";
-import "./chunk-Q3DNNTPG.js";
+import "./chunk-6YXVQ5HC.js";
 import "./chunk-XNLSTHDK.js";
 import "./chunk-WZWDS3W4.js";
 import "./chunk-PZLD7RTK.js";

package/cli-package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/cli-sdk",
   "description": "The source for the vlt CLI",
-  "version": "1.0.0-rc.30",
+  "version": "1.0.0-rc.32",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",

package/{config-SGKD6FN7.js → config-4KQTTXJH.js}

@@ -15,16 +15,16 @@ import {
 } from "./chunk-DBANBIL2.js";
 import {
   asRootError
-} from "./chunk-IYO5QKUW.js";
+} from "./chunk-DFNHGGGV.js";
 import {
   pairsToRecords,
   recordsToPairs
-} from "./chunk-CX6CSVSZ.js";
-import "./chunk-DPQWORL7.js";
+} from "./chunk-G6PG3AGN.js";
+import "./chunk-LEX7YPHR.js";
 import "./chunk-HQ4US6G3.js";
-import "./chunk-XYCCQT7N.js";
-import "./chunk-TYV4N3S3.js";
-import "./chunk-IEISSXS4.js";
+import "./chunk-KRGA5VLT.js";
+import "./chunk-IAKUGHGT.js";
+import "./chunk-JKAZKVQU.js";
 import {
   find,
   load
@@ -32,7 +32,7 @@ import {
 import {
   commandUsage
 } from "./chunk-FBTBHRPG.js";
-import "./chunk-UUE6D7ZK.js";
+import "./chunk-DI2CYYXF.js";
 import "./chunk-YCQTLBWF.js";
 import "./chunk-R44FR7BY.js";
 import {
@@ -41,7 +41,7 @@ import {
 } from "./chunk-2V4AQPBR.js";
 import {
   isObject
-} from "./chunk-Q3DNNTPG.js";
+} from "./chunk-6YXVQ5HC.js";
 import "./chunk-XNLSTHDK.js";
 import {
   error

package/{config-EUN3UG63.js → config-LRL3N7TN.js}

@@ -14,14 +14,14 @@ import {
   kCustomInspect,
   pairsToRecords,
   recordsToPairs
-} from "./chunk-CX6CSVSZ.js";
-import "./chunk-DPQWORL7.js";
+} from "./chunk-G6PG3AGN.js";
+import "./chunk-LEX7YPHR.js";
 import "./chunk-HQ4US6G3.js";
-import "./chunk-XYCCQT7N.js";
-import "./chunk-TYV4N3S3.js";
-import "./chunk-IEISSXS4.js";
+import "./chunk-KRGA5VLT.js";
+import "./chunk-IAKUGHGT.js";
+import "./chunk-JKAZKVQU.js";
 import "./chunk-HTOTG4TS.js";
-import "./chunk-UUE6D7ZK.js";
+import "./chunk-DI2CYYXF.js";
 import "./chunk-YCQTLBWF.js";
 import "./chunk-R44FR7BY.js";
 import {
@@ -30,7 +30,7 @@ import {
   isRecordField,
   recordFields
 } from "./chunk-2V4AQPBR.js";
-import "./chunk-Q3DNNTPG.js";
+import "./chunk-6YXVQ5HC.js";
 import "./chunk-XNLSTHDK.js";
 import "./chunk-WZWDS3W4.js";
 import "./chunk-PZLD7RTK.js";