@vltpkg/cli-js 1.0.1 → 1.0.3

package/{repo-BFRAXIVU.js → repo-4UIQRBI7.js}

@@ -14,37 +14,38 @@ import {
 } from "./chunk-CLVRCGOZ.js";
 import {
   createHostContextsMap
-} from "./chunk-VM2RMMY4.js";
+} from "./chunk-TMBNGWXK.js";
+import {
+  PackageInfoClient
+} from "./chunk-G7UPIJAP.js";
+import "./chunk-FWKQ7YDF.js";
 import {
   Query,
   actual
-} from "./chunk-E5YE7UTZ.js";
+} from "./chunk-LZGKX7JI.js";
 import {
   SecurityArchive
-} from "./chunk-F2FKLPZD.js";
-import {
-  PackageInfoClient
-} from "./chunk-WXMYKCQW.js";
-import "./chunk-FWKQ7YDF.js";
-import "./chunk-ICJRCXSG.js";
-import "./chunk-MT76WHSM.js";
-import "./chunk-HTOTG4TS.js";
+} from "./chunk-5B23EKN4.js";
+import "./chunk-FFOXTPQA.js";
+import "./chunk-OCJDISSI.js";
 import {
   commandUsage
 } from "./chunk-LCDBW6IT.js";
-import "./chunk-U6DM3ROE.js";
 import {
-  urlOpen
-} from "./chunk-CNSTFT7U.js";
-import "./chunk-7NHXV6AH.js";
+  Spec
+} from "./chunk-XU5SMHXP.js";
+import "./chunk-WP6CYBPM.js";
+import "./chunk-HTOTG4TS.js";
 import {
-  Spec2 as Spec
-} from "./chunk-PW6S6AIO.js";
+  urlOpen
+} from "./chunk-HAYXR3MW.js";
 import "./chunk-E74WGW5C.js";
-import "./chunk-WP6CYBPM.js";
+import "./chunk-LPIBYUMT.js";
 import "./chunk-UBLFPJHV.js";
-import "./chunk-2PLIV3N3.js";
 import "./chunk-XNLSTHDK.js";
+import "./chunk-BJBFEQRR.js";
+import "./chunk-VE6CCH33.js";
+import "./chunk-IITIX4ID.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";

package/{chunk-4RZDJQ5U.js → reporter-DKZTTACW.js}

@@ -12,18 +12,19 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   require_emoji_regex
 } from "./chunk-VTEFO2FT.js";
-import {
-  ViewClass
-} from "./chunk-RXNA2XCX.js";
 import {
   source_default
 } from "./chunk-WGDTG44V.js";
+import {
+  ViewClass
+} from "./chunk-4KCU2KZL.js";
 import {
   emitter
 } from "./chunk-UBLFPJHV.js";
 import {
   asError
-} from "./chunk-2PLIV3N3.js";
+} from "./chunk-IITIX4ID.js";
+import "./chunk-WZWDS3W4.js";
 import {
   __commonJS,
   __export,
@@ -18623,7 +18624,6 @@ var InstallReporter = class extends ViewClass {
     this.#instance?.unmount(asError(err));
   }
 };
-
 export {
   InstallReporter
 };

package/{run-7O65747G.js → run-5DUYI6GL.js}

@@ -12,35 +12,37 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   ExecCommand,
   views
-} from "./chunk-UCD3RJYG.js";
+} from "./chunk-W2Q5EIMH.js";
 import "./chunk-RIYFGX27.js";
-import "./chunk-VM2RMMY4.js";
-import "./chunk-EHEVBLDB.js";
+import "./chunk-TMBNGWXK.js";
+import "./chunk-E737X73P.js";
+import "./chunk-FEIPJIEN.js";
 import "./chunk-G2YT2GWF.js";
-import "./chunk-Y7CQIZ7Y.js";
+import "./chunk-VB3IWNHX.js";
+import "./chunk-T4GYDWUJ.js";
+import "./chunk-VTEFO2FT.js";
+import "./chunk-WGDTG44V.js";
 import {
   run,
   runFG
-} from "./chunk-E5YE7UTZ.js";
-import "./chunk-F2FKLPZD.js";
-import "./chunk-VTEFO2FT.js";
-import "./chunk-RXNA2XCX.js";
-import "./chunk-WGDTG44V.js";
-import "./chunk-EFWPI6IY.js";
-import "./chunk-ICJRCXSG.js";
-import "./chunk-MT76WHSM.js";
-import "./chunk-HTOTG4TS.js";
-import "./chunk-FAG776ZD.js";
+} from "./chunk-LZGKX7JI.js";
+import "./chunk-5B23EKN4.js";
+import "./chunk-FFOXTPQA.js";
+import "./chunk-OCJDISSI.js";
 import {
   commandUsage
 } from "./chunk-LCDBW6IT.js";
-import "./chunk-7NHXV6AH.js";
-import "./chunk-PW6S6AIO.js";
-import "./chunk-E74WGW5C.js";
+import "./chunk-XU5SMHXP.js";
 import "./chunk-WP6CYBPM.js";
+import "./chunk-4KCU2KZL.js";
+import "./chunk-HTOTG4TS.js";
+import "./chunk-E74WGW5C.js";
+import "./chunk-LPIBYUMT.js";
 import "./chunk-UBLFPJHV.js";
-import "./chunk-2PLIV3N3.js";
 import "./chunk-XNLSTHDK.js";
+import "./chunk-BJBFEQRR.js";
+import "./chunk-VE6CCH33.js";
+import "./chunk-IITIX4ID.js";
 import "./chunk-WZWDS3W4.js";
 import "./chunk-PZLD7RTK.js";
 

package/{run-exec-2OYWHL6K.js → run-exec-HPNBVAXH.js}

@@ -12,35 +12,37 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   ExecCommand,
   views
-} from "./chunk-UCD3RJYG.js";
+} from "./chunk-W2Q5EIMH.js";
 import "./chunk-RIYFGX27.js";
-import "./chunk-VM2RMMY4.js";
-import "./chunk-EHEVBLDB.js";
+import "./chunk-TMBNGWXK.js";
+import "./chunk-E737X73P.js";
+import "./chunk-FEIPJIEN.js";
 import "./chunk-G2YT2GWF.js";
-import "./chunk-Y7CQIZ7Y.js";
+import "./chunk-VB3IWNHX.js";
+import "./chunk-T4GYDWUJ.js";
+import "./chunk-VTEFO2FT.js";
+import "./chunk-WGDTG44V.js";
 import {
   runExec,
   runExecFG
-} from "./chunk-E5YE7UTZ.js";
-import "./chunk-F2FKLPZD.js";
-import "./chunk-VTEFO2FT.js";
-import "./chunk-RXNA2XCX.js";
-import "./chunk-WGDTG44V.js";
-import "./chunk-EFWPI6IY.js";
-import "./chunk-ICJRCXSG.js";
-import "./chunk-MT76WHSM.js";
-import "./chunk-HTOTG4TS.js";
-import "./chunk-FAG776ZD.js";
+} from "./chunk-LZGKX7JI.js";
+import "./chunk-5B23EKN4.js";
+import "./chunk-FFOXTPQA.js";
+import "./chunk-OCJDISSI.js";
 import {
   commandUsage
 } from "./chunk-LCDBW6IT.js";
-import "./chunk-7NHXV6AH.js";
-import "./chunk-PW6S6AIO.js";
-import "./chunk-E74WGW5C.js";
+import "./chunk-XU5SMHXP.js";
 import "./chunk-WP6CYBPM.js";
+import "./chunk-4KCU2KZL.js";
+import "./chunk-HTOTG4TS.js";
+import "./chunk-E74WGW5C.js";
+import "./chunk-LPIBYUMT.js";
 import "./chunk-UBLFPJHV.js";
-import "./chunk-2PLIV3N3.js";
 import "./chunk-XNLSTHDK.js";
+import "./chunk-BJBFEQRR.js";
+import "./chunk-VE6CCH33.js";
+import "./chunk-IITIX4ID.js";
 import "./chunk-WZWDS3W4.js";
 import "./chunk-PZLD7RTK.js";
 

package/security-archive-src-update-expired.js

@@ -1146,6 +1146,8 @@ var comparatorNone = {
 };
 
 // ../../src/types/src/index.ts
+import { debuglog } from "node:util";
+var debug = debuglog("vlt");
 var asError = (er, fallbackMessage = "Unknown error") => er instanceof Error ? er : new Error(String(er) || fallbackMessage);
 
 // ../../src/semver/src/range.ts
@@ -1226,16 +1228,42 @@ var Range = class {
 };
 
 // ../../src/semver/src/index.ts
+var rangeCache = /* @__PURE__ */ new Map();
+var MAX_RANGE_CACHE = 4096;
 var parseRange = (range, includePrerelease = false) => {
   if (typeof range === "object") {
     if (range.includePrerelease === includePrerelease) return range;
     range = range.raw;
   }
+  const key = `${+includePrerelease}\0${range}`;
+  const cached = rangeCache.get(key);
+  if (cached !== void 0 || rangeCache.has(key)) return cached;
+  let parsed;
   try {
-    return new Range(range, includePrerelease);
+    parsed = new Range(range, includePrerelease);
   } catch {
-    return void 0;
+    parsed = void 0;
   }
+  if (rangeCache.size >= MAX_RANGE_CACHE) rangeCache.clear();
+  rangeCache.set(key, parsed);
+  return parsed;
+};
+
+// ../../src/spec/src/valid-name.ts
+var pathSafeName = /^(?!(?:node_modules|\.vlt)$)(?![A-Za-z]:)(?:@(?!\.\.?\/)[^/\\\x00-\x1f\x7f]+\/)?(?!\.\.?$)[^/\\\x00-\x1f\x7f]+$/i;
+var isPathSafeName = (name) => typeof name === "string" && pathSafeName.test(name);
+var assertPathSafeName = (name, from) => {
+  if (isPathSafeName(name)) return;
+  throw error(
+    "Invalid package name: not usable as a path segment",
+    {
+      code: "EINVALIDNAME",
+      found: name,
+      from,
+      wanted: "a single path segment, or a well-formed @scope/name"
+    },
+    assertPathSafeName
+  );
 };
 
 // ../../src/spec/src/browser.ts
@@ -1312,6 +1340,7 @@ var Spec = class _Spec {
           parsed.name = parsed.subspec.name;
         }
         parsed.spec = `${parsed.name}@${parsed.bareSpec}`;
+        assertPathSafeName(parsed.name, parsed.spec);
       }
       return parsed;
     } else {
@@ -1399,6 +1428,7 @@ var Spec = class _Spec {
       this.#parseScope(spec);
       this.bareSpec = bareOrOptions;
       this.spec = `${this.name}@${bareOrOptions}`;
+      assertPathSafeName(this.name, this.spec);
     } else {
       this.spec = spec;
       if (!spec.startsWith("git@") && startsWithSpecIdentifier(spec, this.options) && spec.includes(":") && [
@@ -1415,6 +1445,7 @@ var Spec = class _Spec {
           spec += "@";
         }
         this.name = spec.substring(0, at);
+        assertPathSafeName(this.name, spec);
         if (hasScope) this.#parseScope(this.name);
         this.bareSpec = spec.substring(at + 1);
       }
@@ -1544,6 +1575,7 @@ var Spec = class _Spec {
         if (this.subspec && this.name === this.bareSpec) {
           this.name = this.subspec.name;
           this.spec = `${this.name}@${this.bareSpec}`;
+          assertPathSafeName(this.name, this.spec);
         }
         this.#guessRegistryTarball();
         return;
@@ -1719,6 +1751,7 @@ var Spec = class _Spec {
       } else {
         this.name = s.substring(0, s.indexOf("@", 1));
       }
+      assertPathSafeName(this.name, s);
     }
     const reg = `${this.namedJsrRegistry}:`;
     const n = `${reg}${this.name}`;
@@ -1903,10 +1936,12 @@ var delimiter = "~";
 var depIDRegExp = new RegExp(
   `^((git)?${delimiter}[^${delimiter}]*${delimiter}[^${delimiter}]*(${delimiter}[^${delimiter}]*)?$|^(file|remote|workspace)${delimiter}[^${delimiter}]*)(${delimiter}[^${delimiter}]*)?$`
 );
-var isDepID = (str) => typeof str === "string" && depIDRegExp.test(str);
+var pathUnsafeDepID = (str) => /[/\\\x00-\x1f\x7f]/.test(str) || /^[A-Za-z]:/.test(str) || str.split(delimiter).some((p) => p === "." || p === "..");
+var isDepID = (str) => typeof str === "string" && depIDRegExp.test(str) && !pathUnsafeDepID(str);
 var asDepID = (str) => {
   if (!isDepID(str)) {
-    throw error("Expected dep id", {
+    throw error(`Expected dep id.`, {
+      code: "EINVALIDNAME",
       found: str
     });
   }

package/{setup-MMIDAIJI.js → setup-23W5FQVW.js}

@@ -11,30 +11,32 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   stdout
-} from "./chunk-EHEVBLDB.js";
+} from "./chunk-E737X73P.js";
+import "./chunk-FEIPJIEN.js";
 import "./chunk-G2YT2GWF.js";
-import "./chunk-Y7CQIZ7Y.js";
-import "./chunk-RXNA2XCX.js";
+import "./chunk-VB3IWNHX.js";
+import "./chunk-T4GYDWUJ.js";
 import "./chunk-WGDTG44V.js";
-import "./chunk-EFWPI6IY.js";
-import "./chunk-MT76WHSM.js";
-import "./chunk-FAG776ZD.js";
+import "./chunk-OCJDISSI.js";
 import {
   commandUsage
 } from "./chunk-LCDBW6IT.js";
+import "./chunk-XU5SMHXP.js";
+import "./chunk-WP6CYBPM.js";
+import "./chunk-4KCU2KZL.js";
 import {
   RegistryClient
-} from "./chunk-U6DM3ROE.js";
-import "./chunk-CNSTFT7U.js";
-import "./chunk-7NHXV6AH.js";
-import {
-  defaultRegistries
-} from "./chunk-PW6S6AIO.js";
+} from "./chunk-HNCE3YE5.js";
+import "./chunk-HAYXR3MW.js";
 import "./chunk-E74WGW5C.js";
-import "./chunk-WP6CYBPM.js";
+import "./chunk-LPIBYUMT.js";
 import "./chunk-UBLFPJHV.js";
-import "./chunk-2PLIV3N3.js";
 import "./chunk-XNLSTHDK.js";
+import "./chunk-BJBFEQRR.js";
+import "./chunk-VE6CCH33.js";
+import {
+  defaultRegistries
+} from "./chunk-IITIX4ID.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
@@ -45,6 +47,10 @@ import { createInterface } from "node:readline/promises";
 var VLT_SIGNUP_URL = "https://www.vlt.io";
 var VLT_REGISTRY_BASE = "https://registry.vlt.io";
 var accountRegistries = ["npm", "main"];
+var accountRegistryAuthPrompts = {
+  npm: `First, let's authenticate your public npm registry mirror`,
+  main: `Now let's authenticate your private registry`
+};
 var accountRegistryURL = (account, name) => `${VLT_REGISTRY_BASE}/${encodeURIComponent(account)}/${name}/`;
 var normalizeRegistryURL = (url) => url.endsWith("/") ? url : `${url}/`;
 var views = {
@@ -129,8 +135,11 @@ var command = async (conf) => {
         "Authenticate with your vlt.io account now? (Y/n) "
       );
       if (!/^n/i.test(doAuth)) {
+        stdout(
+          "Each registry is authenticated separately, so the browser opens once per registry."
+        );
         for (const name of accountRegistries) {
-          stdout(`Authenticating against the "${name}" registry...`);
+          stdout(`${accountRegistryAuthPrompts[name]} ("${name}")...`);
           await rc.login(accountRegistryURL(account, name));
         }
       }

package/{src-OK3KHDYR.js → src-2NB67FPG.js}

@@ -11,43 +11,42 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   loadCommand
-} from "./chunk-HB7CKTYO.js";
+} from "./chunk-RNJSI3NZ.js";
+import {
+  Config
+} from "./chunk-NXEH3NQZ.js";
+import "./chunk-G7UPIJAP.js";
+import "./chunk-FWKQ7YDF.js";
 import {
   indent,
   outputCommand,
   stderr,
   stdout
-} from "./chunk-EHEVBLDB.js";
+} from "./chunk-E737X73P.js";
+import "./chunk-FEIPJIEN.js";
 import "./chunk-G2YT2GWF.js";
-import "./chunk-Y7CQIZ7Y.js";
-import "./chunk-RXNA2XCX.js";
-import "./chunk-WGDTG44V.js";
 import {
   asRootError
-} from "./chunk-EFWPI6IY.js";
+} from "./chunk-VB3IWNHX.js";
+import "./chunk-T4GYDWUJ.js";
+import "./chunk-WGDTG44V.js";
+import "./chunk-FFOXTPQA.js";
+import "./chunk-OCJDISSI.js";
+import "./chunk-XU5SMHXP.js";
 import {
-  Config
-} from "./chunk-3SQ5Y324.js";
-import "./chunk-WXMYKCQW.js";
-import "./chunk-FWKQ7YDF.js";
-import "./chunk-ICJRCXSG.js";
-import "./chunk-MT76WHSM.js";
+  getSortedCliOptions,
+  getSortedKeys
+} from "./chunk-WP6CYBPM.js";
+import "./chunk-4KCU2KZL.js";
 import "./chunk-HTOTG4TS.js";
-import "./chunk-FAG776ZD.js";
-import "./chunk-U6DM3ROE.js";
-import "./chunk-CNSTFT7U.js";
-import "./chunk-7NHXV6AH.js";
-import "./chunk-PW6S6AIO.js";
 import {
   loadPackageJson
 } from "./chunk-E74WGW5C.js";
-import {
-  getSortedCliOptions,
-  getSortedKeys
-} from "./chunk-WP6CYBPM.js";
+import "./chunk-LPIBYUMT.js";
 import "./chunk-UBLFPJHV.js";
-import "./chunk-2PLIV3N3.js";
 import "./chunk-XNLSTHDK.js";
+import "./chunk-VE6CCH33.js";
+import "./chunk-IITIX4ID.js";
 import "./chunk-WZWDS3W4.js";
 import "./chunk-PZLD7RTK.js";
 
@@ -121,7 +120,7 @@ var run = async () => {
     return process.exit(process.exitCode || 1);
   }
   if (vlt.command === "registry") {
-    const { dispatchRegistry } = await import("./registry-QGI44LG4.js");
+    const { dispatchRegistry } = await import("./registry-CZPFR3OF.js");
     await dispatchRegistry(vlt);
   }
   const command = await loadCommand(vlt.command);

package/src-6OKPBJJT.js

@@ -0,0 +1,59 @@
+var global = globalThis;
+import {Buffer} from "node:buffer";
+import {setTimeout as _vlt_setTimeout,clearTimeout as _vlt_clearTimeout,setImmediate as _vlt_setImmediate,clearImmediate as _vlt_clearImmediate,setInterval as _vlt_setInterval,clearInterval as _vlt_clearInterval} from "node:timers";
+globalThis.setTimeout = _vlt_setTimeout;
+globalThis.clearTimeout = _vlt_clearTimeout;
+globalThis.setImmediate = _vlt_setImmediate;
+globalThis.clearImmediate = _vlt_clearImmediate;
+globalThis.setInterval = _vlt_setInterval;
+globalThis.clearInterval = _vlt_clearInterval;
+import {createRequire as _vlt_createRequire} from "node:module";
+var require = _vlt_createRequire(import.meta.filename);
+import {
+  CacheEntry,
+  RegistryClient,
+  clearRuntimeTokens,
+  deleteToken,
+  getKC,
+  getToken,
+  getTokenByURL,
+  isCacheableMethod,
+  isToken,
+  keychains,
+  normalizeRegistryKey,
+  oidc,
+  registryBase,
+  runtimeTokens,
+  setRuntimeToken,
+  setToken,
+  userAgent
+} from "./chunk-HNCE3YE5.js";
+import "./chunk-HAYXR3MW.js";
+import "./chunk-E74WGW5C.js";
+import "./chunk-LPIBYUMT.js";
+import "./chunk-UBLFPJHV.js";
+import "./chunk-XNLSTHDK.js";
+import "./chunk-BJBFEQRR.js";
+import "./chunk-VE6CCH33.js";
+import "./chunk-IITIX4ID.js";
+import "./chunk-WZWDS3W4.js";
+import "./chunk-PZLD7RTK.js";
+export {
+  CacheEntry,
+  RegistryClient,
+  clearRuntimeTokens,
+  deleteToken,
+  getKC,
+  getToken,
+  getTokenByURL,
+  isCacheableMethod,
+  isToken,
+  keychains,
+  normalizeRegistryKey,
+  oidc,
+  registryBase,
+  runtimeTokens,
+  setRuntimeToken,
+  setToken,
+  userAgent
+};