@vltpkg/cli-js 1.0.1 → 1.0.2

package/{access-SXQICNAN.js → access-DB347PPG.js}

@@ -11,20 +11,20 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   resolveRegistry
-} from "./chunk-FAG776ZD.js";
+} from "./chunk-ONVLPT73.js";
 import {
   commandUsage
 } from "./chunk-LCDBW6IT.js";
 import {
   RegistryClient
-} from "./chunk-U6DM3ROE.js";
+} from "./chunk-3HUTU5SO.js";
 import "./chunk-CNSTFT7U.js";
 import "./chunk-7NHXV6AH.js";
-import "./chunk-PW6S6AIO.js";
+import "./chunk-NS4VFXHX.js";
 import "./chunk-E74WGW5C.js";
 import "./chunk-WP6CYBPM.js";
 import "./chunk-UBLFPJHV.js";
-import "./chunk-2PLIV3N3.js";
+import "./chunk-Q46JRSZU.js";
 import "./chunk-XNLSTHDK.js";
 import {
   error

package/{bugs-OOPMFRCI.js → bugs-QBKI62J6.js}

@@ -14,36 +14,36 @@ import {
 } from "./chunk-CLVRCGOZ.js";
 import {
   createHostContextsMap
-} from "./chunk-VM2RMMY4.js";
+} from "./chunk-YDUHQU7N.js";
 import {
   Query,
   actual
-} from "./chunk-E5YE7UTZ.js";
+} from "./chunk-47IR6Z6C.js";
 import {
   SecurityArchive
-} from "./chunk-F2FKLPZD.js";
+} from "./chunk-3MBSXZ62.js";
 import {
   PackageInfoClient
-} from "./chunk-WXMYKCQW.js";
+} from "./chunk-WAFERMRI.js";
 import "./chunk-FWKQ7YDF.js";
-import "./chunk-ICJRCXSG.js";
-import "./chunk-MT76WHSM.js";
+import "./chunk-F2GLBPGQ.js";
+import "./chunk-FM5DQZVN.js";
 import "./chunk-HTOTG4TS.js";
 import {
   commandUsage
 } from "./chunk-LCDBW6IT.js";
-import "./chunk-U6DM3ROE.js";
+import "./chunk-3HUTU5SO.js";
 import {
   urlOpen
 } from "./chunk-CNSTFT7U.js";
 import "./chunk-7NHXV6AH.js";
 import {
-  Spec2 as Spec
-} from "./chunk-PW6S6AIO.js";
+  Spec
+} from "./chunk-NS4VFXHX.js";
 import "./chunk-E74WGW5C.js";
 import "./chunk-WP6CYBPM.js";
 import "./chunk-UBLFPJHV.js";
-import "./chunk-2PLIV3N3.js";
+import "./chunk-Q46JRSZU.js";
 import "./chunk-XNLSTHDK.js";
 import {
   error

package/{build-HDXI5OA7.js → build-EFJ3FFGU.js}

@@ -11,22 +11,22 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   build
-} from "./chunk-E5YE7UTZ.js";
-import "./chunk-F2FKLPZD.js";
-import "./chunk-ICJRCXSG.js";
-import "./chunk-MT76WHSM.js";
+} from "./chunk-47IR6Z6C.js";
+import "./chunk-3MBSXZ62.js";
+import "./chunk-F2GLBPGQ.js";
+import "./chunk-FM5DQZVN.js";
 import "./chunk-HTOTG4TS.js";
 import {
   commandUsage
 } from "./chunk-LCDBW6IT.js";
 import "./chunk-7NHXV6AH.js";
-import "./chunk-PW6S6AIO.js";
+import "./chunk-NS4VFXHX.js";
 import "./chunk-E74WGW5C.js";
 import "./chunk-WP6CYBPM.js";
 import "./chunk-UBLFPJHV.js";
 import {
   isErrorWithCause
-} from "./chunk-2PLIV3N3.js";
+} from "./chunk-Q46JRSZU.js";
 import "./chunk-XNLSTHDK.js";
 import {
   error

package/{cache-RW4Y4XNQ.js → cache-BQJCMDJN.js}

@@ -15,31 +15,31 @@ import {
 import {
   stderr,
   stdout
-} from "./chunk-EHEVBLDB.js";
+} from "./chunk-ULCDRVY2.js";
 import "./chunk-G2YT2GWF.js";
 import "./chunk-Y7CQIZ7Y.js";
 import {
   ViewClass
 } from "./chunk-RXNA2XCX.js";
 import "./chunk-WGDTG44V.js";
-import "./chunk-EFWPI6IY.js";
-import "./chunk-MT76WHSM.js";
-import "./chunk-FAG776ZD.js";
+import "./chunk-BSB4XGBB.js";
+import "./chunk-FM5DQZVN.js";
+import "./chunk-ONVLPT73.js";
 import {
   commandUsage
 } from "./chunk-LCDBW6IT.js";
 import {
   CacheEntry
-} from "./chunk-U6DM3ROE.js";
+} from "./chunk-3HUTU5SO.js";
 import "./chunk-CNSTFT7U.js";
 import "./chunk-7NHXV6AH.js";
 import {
-  Spec2 as Spec
-} from "./chunk-PW6S6AIO.js";
+  Spec
+} from "./chunk-NS4VFXHX.js";
 import "./chunk-E74WGW5C.js";
 import "./chunk-WP6CYBPM.js";
 import "./chunk-UBLFPJHV.js";
-import "./chunk-2PLIV3N3.js";
+import "./chunk-Q46JRSZU.js";
 import "./chunk-XNLSTHDK.js";
 import {
   error

package/{chunk-U6DM3ROE.js → chunk-3HUTU5SO.js}

@@ -24,7 +24,7 @@ import {
 } from "./chunk-UBLFPJHV.js";
 import {
   asError
-} from "./chunk-2PLIV3N3.js";
+} from "./chunk-Q46JRSZU.js";
 import {
   XDG
 } from "./chunk-XNLSTHDK.js";

package/{chunk-F2FKLPZD.js → chunk-3MBSXZ62.js}

@@ -13,7 +13,7 @@ import {
   asDepID,
   baseDepID,
   splitDepID
-} from "./chunk-MT76WHSM.js";
+} from "./chunk-FM5DQZVN.js";
 import {
   I
 } from "./chunk-7NHXV6AH.js";

package/{chunk-UCD3RJYG.js → chunk-42UTZKAU.js}

@@ -14,26 +14,26 @@ import {
 } from "./chunk-RIYFGX27.js";
 import {
   createHostContextsMap
-} from "./chunk-VM2RMMY4.js";
+} from "./chunk-YDUHQU7N.js";
 import {
   stderr,
   stdout,
   styleTextStdout
-} from "./chunk-EHEVBLDB.js";
+} from "./chunk-ULCDRVY2.js";
 import {
   Query,
   actual,
   isRunResult
-} from "./chunk-E5YE7UTZ.js";
+} from "./chunk-47IR6Z6C.js";
 import {
   require_emoji_regex
 } from "./chunk-VTEFO2FT.js";
 import {
   Monorepo
-} from "./chunk-ICJRCXSG.js";
+} from "./chunk-F2GLBPGQ.js";
 import {
   isErrorWithCause
-} from "./chunk-2PLIV3N3.js";
+} from "./chunk-Q46JRSZU.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";

package/{chunk-E5YE7UTZ.js → chunk-47IR6Z6C.js}

@@ -13,14 +13,14 @@ import {
   AbortError,
   SecurityArchive,
   pRetry
-} from "./chunk-F2FKLPZD.js";
+} from "./chunk-3MBSXZ62.js";
 import {
   Monorepo,
   PackageJson,
   getUser,
   minimatch,
   platformCheck
-} from "./chunk-ICJRCXSG.js";
+} from "./chunk-F2GLBPGQ.js";
 import {
   asDepID,
   getId,
@@ -33,7 +33,7 @@ import {
   joinExtra,
   splitDepID,
   splitExtra
-} from "./chunk-MT76WHSM.js";
+} from "./chunk-FM5DQZVN.js";
 import {
   load,
   walkUp
@@ -43,31 +43,32 @@ import {
   rimraf
 } from "./chunk-7NHXV6AH.js";
 import {
-  Spec,
-  Spec2,
-  defaultGitHostArchives,
-  defaultGitHosts,
-  defaultJsrRegistries,
-  defaultRegistries,
-  defaultRegistryName,
-  defaultScopeRegistries,
-  getOptions,
-  gitHostWebsites
-} from "./chunk-PW6S6AIO.js";
+  Spec as Spec2
+} from "./chunk-NS4VFXHX.js";
 import {
   graphStep
 } from "./chunk-UBLFPJHV.js";
 import {
+  Spec,
   Version,
   asError,
   asManifest,
   asNormalizedManifest,
+  assertPathSafeName,
   assertRecordStringString,
   compare,
+  defaultGitHostArchives,
+  defaultGitHosts,
+  defaultJsrRegistries,
+  defaultRegistries,
+  defaultRegistryName,
+  defaultScopeRegistries,
   dependencyTypes,
   eq,
   expandNormalizedManifestSymbols,
   fastSplit,
+  getOptions,
+  gitHostWebsites,
   gt,
   gte,
   intersects,
@@ -86,7 +87,7 @@ import {
   satisfies,
   shortDependencyTypes,
   subset
-} from "./chunk-2PLIV3N3.js";
+} from "./chunk-Q46JRSZU.js";
 import {
   XDG
 } from "./chunk-XNLSTHDK.js";
@@ -9339,6 +9340,7 @@ var Graph = class {
       if (to) {
         spec2.name = to.name || "(unknown)";
         spec2.spec = `${to.name}@${spec2.bareSpec}`;
+        assertPathSafeName(spec2.name, spec2.spec);
       } else {
         throw error(
           "Impossible to place a missing, nameless dependency",
@@ -9689,6 +9691,7 @@ var loadNodes = (graph, nodes, options, actual2, throwOnMissingManifest) => {
   const nodeCount = entries.length;
   const registryVersionCache = nodeCount > 50 ? /* @__PURE__ */ new Map() : null;
   for (const [id2, lockfileNode] of entries) {
+    asDepID(id2);
     const [
       flags,
       name,
@@ -11767,6 +11770,17 @@ var fixupAddedNames = (add, manifest, options, spec2) => {
   return spec2;
 };
 
+// ../../src/graph/src/path-security-error.ts
+var codes = /* @__PURE__ */ new Set(["EINVALIDNAME"]);
+var isPathSecurityError = (er) => {
+  for (let e = er; e && typeof e === "object"; e = e.cause) {
+    const { code } = e;
+    if (typeof code === "string" && codes.has(code))
+      return true;
+  }
+  return false;
+};
+
 // ../../src/graph/src/reify/extract-node.ts
 var getOptionalFailedNodeRemover = (node, diff2) => {
   return diff2 ? optionalFail(diff2, node) : node.isOptional() ? () => removeOptionalSubgraph(node.graph, node) : void 0;
@@ -12483,6 +12497,7 @@ var fetchManifestsForDeps = async (packageInfo, graph, fromNode, deps, scurry, p
       // part of a graph (either lockfile or actual) and it has valid manifest
       // data so we shortcut the package info manifest fetch here
       existingNode?.detached && existingNode.manifest ? Promise.resolve(existingNode.manifest) : packageInfo.manifest(spec2, { from: scurry.resolve(fromNode.location) }).then((manifest) => manifest).catch((er) => {
+        if (isPathSecurityError(er)) throw er;
         if (edgeOptional || fromNode.optional) {
           return void 0;
         }
@@ -12554,7 +12569,8 @@ var processPlacementTasks = async (graph, options, placementTasks, add, modifier
       fromNode,
       type2,
       spec2,
-      normalizeManifest(manifest),
+      // report broken manifest names against the dependency spec
+      normalizeManifest(manifest, String(spec2)),
       fileTypeInfo?.id,
       joinExtra({ peerSetHash, modifier: queryModifier })
     );
@@ -12934,6 +12950,7 @@ var build3 = async (options) => {
       monorepo
     });
   } catch (err) {
+    if (isPathSecurityError(err)) throw err;
     const cause = err.cause;
     if (cause?.code === "ELOCKFILEVERSION") {
       if (typeof cause.found === "number" && typeof cause.wanted === "number") {

package/{chunk-4ZXA6RLP.js → chunk-5OGQND6H.js}

@@ -17,7 +17,7 @@ var run = async (command) => {
   if (command) {
     process.argv.splice(2, 0, command);
   }
-  const vlt = await import("./src-OK3KHDYR.js");
+  const vlt = await import("./src-BJU7XZNK.js");
   await vlt.default();
 };
 

package/{chunk-3SQ5Y324.js → chunk-5PFGKHIS.js}

@@ -11,24 +11,21 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   PackageInfoClient
-} from "./chunk-WXMYKCQW.js";
+} from "./chunk-WAFERMRI.js";
 import {
   Monorepo,
   PackageJson,
   PathScurry
-} from "./chunk-ICJRCXSG.js";
+} from "./chunk-F2GLBPGQ.js";
 import {
   resetCaches
-} from "./chunk-MT76WHSM.js";
+} from "./chunk-FM5DQZVN.js";
 import {
   find,
   load,
   reload,
   save
 } from "./chunk-HTOTG4TS.js";
-import {
-  getOptions
-} from "./chunk-PW6S6AIO.js";
 import {
   commands,
   definition,
@@ -39,8 +36,9 @@ import {
 import {
   assertRecordStringString,
   assertRecordStringT,
+  getOptions,
   isRecordStringString
-} from "./chunk-2PLIV3N3.js";
+} from "./chunk-Q46JRSZU.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";

package/{chunk-EFWPI6IY.js → chunk-BSB4XGBB.js}

@@ -12,7 +12,7 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   isError,
   isObject
-} from "./chunk-2PLIV3N3.js";
+} from "./chunk-Q46JRSZU.js";
 
 // ../../src/output/src/error.ts
 var parseError = (err) => {

package/{chunk-EQ633HIM.js → chunk-CTDFRLS4.js}

@@ -16,14 +16,14 @@ import {
 } from "./chunk-FWKQ7YDF.js";
 import {
   minimatch
-} from "./chunk-ICJRCXSG.js";
+} from "./chunk-F2GLBPGQ.js";
 import {
   parse,
   stringify
 } from "./chunk-HTOTG4TS.js";
 import {
-  Spec2 as Spec
-} from "./chunk-PW6S6AIO.js";
+  Spec
+} from "./chunk-NS4VFXHX.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";

package/{chunk-CCQYIYTA.js → chunk-DEMBZY23.js}

@@ -12,22 +12,22 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   findCmdShimIfExists,
   install
-} from "./chunk-E5YE7UTZ.js";
+} from "./chunk-47IR6Z6C.js";
 import {
   PackageInfoClient
-} from "./chunk-WXMYKCQW.js";
+} from "./chunk-WAFERMRI.js";
 import {
   PathScurry
-} from "./chunk-ICJRCXSG.js";
+} from "./chunk-F2GLBPGQ.js";
 import {
   walkUp
 } from "./chunk-HTOTG4TS.js";
 import {
-  Spec2 as Spec
-} from "./chunk-PW6S6AIO.js";
+  Spec
+} from "./chunk-NS4VFXHX.js";
 import {
   parseScope
-} from "./chunk-2PLIV3N3.js";
+} from "./chunk-Q46JRSZU.js";
 import {
   XDG
 } from "./chunk-XNLSTHDK.js";

package/{chunk-ICJRCXSG.js → chunk-F2GLBPGQ.js}

@@ -13,7 +13,7 @@ import {
   graphRun,
   graphRunSync,
   joinDepIDTuple
-} from "./chunk-MT76WHSM.js";
+} from "./chunk-FM5DQZVN.js";
 import {
   load,
   parse as parse2,
@@ -27,19 +27,19 @@ import {
   whichSync
 } from "./chunk-7NHXV6AH.js";
 import {
-  Spec2 as Spec,
-  isSpec
-} from "./chunk-PW6S6AIO.js";
+  Spec
+} from "./chunk-NS4VFXHX.js";
 import {
   Range,
   Version,
   asManifest,
   isRange,
+  isSpec,
   longDependencyTypes,
   normalizeManifest,
   parse,
   satisfies
-} from "./chunk-2PLIV3N3.js";
+} from "./chunk-Q46JRSZU.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
@@ -1143,7 +1143,8 @@ var PackageJson = class {
       const res = normalizeManifest(
         asManifest(
           parse2(readFileSync2(filename, { encoding: "utf8" }))
-        )
+        ),
+        filename
       );
       this.#cache.set(dir, res);
       this.#pathCache.set(res, dir);
@@ -6122,7 +6123,7 @@ var Workspace = class {
     this.path = path2;
     this.fullpath = fullpath;
     this.manifest = manifest;
-    this.name = manifest.name ?? path2;
+    this.name = manifest.name ?? basename2(path2);
   }
   get keys() {
     if (this.#keys) {

package/{chunk-MT76WHSM.js → chunk-FM5DQZVN.js}

@@ -9,12 +9,14 @@ globalThis.setInterval = _vlt_setInterval;
 globalThis.clearInterval = _vlt_clearInterval;
 import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
+import {
+  Spec as Spec2
+} from "./chunk-NS4VFXHX.js";
 import {
   Spec,
-  Spec2,
   currentDefaultRegistryName,
   defaultRegistryName
-} from "./chunk-PW6S6AIO.js";
+} from "./chunk-Q46JRSZU.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
@@ -25,10 +27,12 @@ var EXTRA_PEER_SET_DELIMITER = "peer.";
 var depIDRegExp = new RegExp(
   `^((git)?${delimiter}[^${delimiter}]*${delimiter}[^${delimiter}]*(${delimiter}[^${delimiter}]*)?$|^(file|remote|workspace)${delimiter}[^${delimiter}]*)(${delimiter}[^${delimiter}]*)?$`
 );
-var isDepID = (str) => typeof str === "string" && depIDRegExp.test(str);
+var pathUnsafeDepID = (str) => /[/\\\x00-\x1f\x7f]/.test(str) || /^[A-Za-z]:/.test(str) || str.split(delimiter).some((p) => p === "." || p === "..");
+var isDepID = (str) => typeof str === "string" && depIDRegExp.test(str) && !pathUnsafeDepID(str);
 var asDepID = (str) => {
   if (!isDepID(str)) {
-    throw error("Expected dep id", {
+    throw error(`Expected dep id.`, {
+      code: "EINVALIDNAME",
       found: str
     });
   }
@@ -287,7 +291,8 @@ var hydrateTuple = (tuple, name, options = {}) => {
       if (!first) {
         throw error("no name/path on workspace id", { found: tuple });
       }
-      res = name && name !== first ? Spec.parse(name, `workspace:${first}@*`, options) : Spec.parse(first, `workspace:*`, options);
+      const workspaceName = name ?? first.slice(first.lastIndexOf("/") + 1);
+      res = workspaceName !== first ? Spec.parse(workspaceName, `workspace:${first}@*`, options) : Spec.parse(first, "workspace:*", options);
       break;
     }
   }
@@ -503,7 +508,8 @@ var hydrateTuple2 = (tuple, name, options = {}) => {
       if (!first) {
         throw error("no name/path on workspace id", { found: tuple });
       }
-      res = name && name !== first ? Spec2.parse(name, `workspace:${first}@*`, options) : Spec2.parse(first, `workspace:*`, options);
+      const workspaceName = name ?? first.slice(first.lastIndexOf("/") + 1);
+      res = workspaceName !== first ? Spec2.parse(workspaceName, `workspace:${first}@*`, options) : Spec2.parse(first, "workspace:*", options);
       break;
     }
   }

package/{chunk-MU7Y4R5E.js → chunk-L34LR5DV.js}

@@ -11,10 +11,10 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   stderr
-} from "./chunk-EHEVBLDB.js";
+} from "./chunk-ULCDRVY2.js";
 import {
   mermaidOutput
-} from "./chunk-E5YE7UTZ.js";
+} from "./chunk-47IR6Z6C.js";
 import {
   ViewClass
 } from "./chunk-RXNA2XCX.js";

package/chunk-NS4VFXHX.js

@@ -0,0 +1,49 @@
+var global = globalThis;
+import {Buffer} from "node:buffer";
+import {setTimeout as _vlt_setTimeout,clearTimeout as _vlt_clearTimeout,setImmediate as _vlt_setImmediate,clearImmediate as _vlt_clearImmediate,setInterval as _vlt_setInterval,clearInterval as _vlt_clearInterval} from "node:timers";
+globalThis.setTimeout = _vlt_setTimeout;
+globalThis.clearTimeout = _vlt_clearTimeout;
+globalThis.setImmediate = _vlt_setImmediate;
+globalThis.clearImmediate = _vlt_clearImmediate;
+globalThis.setInterval = _vlt_setInterval;
+globalThis.clearInterval = _vlt_clearInterval;
+import {createRequire as _vlt_createRequire} from "node:module";
+var require = _vlt_createRequire(import.meta.filename);
+import {
+  Spec,
+  kCustomInspect
+} from "./chunk-Q46JRSZU.js";
+
+// ../../src/spec/src/index.ts
+import { homedir } from "node:os";
+import {
+  isAbsolute,
+  join,
+  resolve,
+  win32 as winPath
+} from "node:path";
+import { inspect } from "node:util";
+var Spec2 = class extends Spec {
+  [kCustomInspect](_depth, options) {
+    const str = inspect(
+      Object.fromEntries(
+        Object.entries(this).filter(([k, v]) => {
+          return k !== "options" && v !== void 0;
+        })
+      ),
+      options
+    );
+    return `@vltpkg/spec.Spec ${str}`;
+  }
+};
+Spec2.nodejsDependencies = {
+  homedir,
+  isAbsolute,
+  join,
+  resolve,
+  winPath
+};
+
+export {
+  Spec2 as Spec
+};

package/{chunk-FAG776ZD.js → chunk-ONVLPT73.js}

@@ -11,7 +11,7 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   defaultRegistries
-} from "./chunk-PW6S6AIO.js";
+} from "./chunk-Q46JRSZU.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";