@vltpkg/cli-js 1.1.1 → 1.2.0

package/{chunk-BWEH7DHQ.js → chunk-3CUFJPBK.js}

@@ -11,7 +11,7 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   stderr
-} from "./chunk-LR42WTKN.js";
+} from "./chunk-UNWQVOLY.js";
 import {
   urlOpen
 } from "./chunk-APMYKJI2.js";

package/{chunk-CBASIDQH.js → chunk-55DYW2MP.js}

@@ -12,7 +12,7 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   commandAliases,
   jack
-} from "./chunk-CEHPRPGQ.js";
+} from "./chunk-6A3XS52F.js";
 
 // ../../src/cli-sdk/src/config/usage.ts
 var toArr = (v) => Array.isArray(v) ? v : [v];

package/{chunk-6FT6K5YN.js → chunk-5BD4QGW2.js}

@@ -11,36 +11,40 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   PackageInfoClient
-} from "./chunk-LN2A74PF.js";
+} from "./chunk-5YB6UIC3.js";
 import {
   Monorepo,
   PackageJson,
   PathScurry
-} from "./chunk-X2AWQGYG.js";
+} from "./chunk-6G7MTZGS.js";
 import {
   resetCaches
-} from "./chunk-YOE3VZFX.js";
+} from "./chunk-SYGF27W7.js";
 import {
   commands,
   defaultValues,
   definition,
   getCommand,
   isRecordField,
-  recordFields
-} from "./chunk-CEHPRPGQ.js";
+  recordFields,
+  storeLinkers
+} from "./chunk-6A3XS52F.js";
 import {
   find,
   load,
   reload,
   save
 } from "./chunk-HTOTG4TS.js";
+import {
+  storeRoot
+} from "./chunk-UQUIO7LW.js";
 import {
   assertRecordStringString,
   assertRecordStringT,
   getOptions,
   isObject,
   isRecordStringString
-} from "./chunk-VFBCWAOC.js";
+} from "./chunk-G5BSQ6DP.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
@@ -175,7 +179,7 @@ var pairsToRecords = (obj) => {
 var recordsToPairs = (obj) => {
   return Object.fromEntries(
     Object.entries(obj).filter(
-      ([k]) => !(k === "scurry" || k === "packageJson" || k === "monorepo" || k === "projectRoot" || k === "packageInfo")
+      ([k]) => !(k === "scurry" || k === "packageJson" || k === "monorepo" || k === "projectRoot" || k === "storeRoot" || k === "packageInfo")
     ).map(([k, v]) => [
       k,
       k === "command" && v && typeof v === "object" ? (
@@ -236,6 +240,7 @@ var Config = class _Config {
     const asRecords = pairsToRecords(this.parse().values);
     const extras = {
       projectRoot: this.projectRoot,
+      storeRoot: storeRoot(asRecords.cache),
       scurry,
       packageJson,
       monorepo: Monorepo.maybeLoad(this.projectRoot, {
@@ -330,6 +335,9 @@ var Config = class _Config {
   parse(args = process.argv) {
     if (isParsed(this)) return this;
     this.#originalArgs = [...args];
+    const badLinker = process.env.VLT_STORE_LINKER;
+    const fixLinker = badLinker !== void 0 && !storeLinkers.includes(badLinker);
+    if (fixLinker) process.env.VLT_STORE_LINKER = "unpack";
     const envKeys = Object.keys(defaultValues).filter(
       (k) => process.env[envKey(k)] !== void 0
     );
@@ -346,6 +354,10 @@ var Config = class _Config {
     const cmdPairs = cmdSpecific ? recordsToPairs(cmdSpecific) : {};
     if (cmdSpecific) this.jack.setConfigValues(cmdPairs);
     this.jack.applyDefaults(p);
+    if (p.values["store-linker"] === "auto" && process.platform !== "linux") {
+      p.values["store-linker"] = "unpack";
+      envValues["store-linker"] = "unpack";
+    }
     const values = p.values;
     const explicit = {};
     for (const k of /* @__PURE__ */ new Set([...envKeys, ...cliKeys])) {
@@ -386,6 +398,12 @@ var Config = class _Config {
     if (p.values.verbose && p.values.loglevel === "info") {
       p.values.loglevel = "verbose";
     }
+    const { loglevel } = p.values;
+    if (fixLinker && loglevel !== "silent" && loglevel !== "error") {
+      console.error(
+        `Warning: invalid VLT_STORE_LINKER ${JSON.stringify(badLinker)}, using ${p.values["store-linker"]}`
+      );
+    }
     if (!isParsed(this)) throw error("failed to parse config");
     return this;
   }

package/{chunk-WE2TQN32.js → chunk-5PP77V44.js}

@@ -16,10 +16,10 @@ import {
 } from "./chunk-ZWKI5OSF.js";
 import {
   minimatch
-} from "./chunk-X2AWQGYG.js";
+} from "./chunk-6G7MTZGS.js";
 import {
   Spec
-} from "./chunk-XKVU23NC.js";
+} from "./chunk-G5NJ7CYI.js";
 import {
   parse,
   stringify

package/{chunk-LN2A74PF.js → chunk-5YB6UIC3.js}

@@ -20,22 +20,25 @@ import {
   pickManifest,
   resolve,
   revs
-} from "./chunk-X2AWQGYG.js";
+} from "./chunk-6G7MTZGS.js";
 import {
   Spec
-} from "./chunk-XKVU23NC.js";
+} from "./chunk-G5NJ7CYI.js";
 import {
-  registryErrorMessage
-} from "./chunk-SNOBGFNM.js";
+  registryErrorMessage,
+  storeRoot,
+  tokenRefusalAdvice
+} from "./chunk-UQUIO7LW.js";
 import {
   logRequest
 } from "./chunk-U7TEQCBN.js";
-import {
-  asPackument
-} from "./chunk-VFBCWAOC.js";
 import {
   XDG
 } from "./chunk-XNLSTHDK.js";
+import {
+  asPackument,
+  integrityHex
+} from "./chunk-G5BSQ6DP.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
@@ -63,6 +66,59 @@ import {
 } from "node:path";
 import { debuglog } from "node:util";
 
+// ../../src/package-info/src/capabilities.ts
+var none = Object.freeze({});
+var asked = /* @__PURE__ */ new Map();
+var known = /* @__PURE__ */ new Map();
+var peekCapabilities = (client, registry) => {
+  const url = capabilitiesUrl(registry);
+  const seen = known.get(url);
+  if (seen) return seen;
+  void getCapabilities(client, registry);
+  return void 0;
+};
+var getCapabilities = async (client, registry) => {
+  const url = capabilitiesUrl(registry);
+  const seen = asked.get(url);
+  if (seen) return seen;
+  const doc = fetchCapabilities(client, url).then((caps) => {
+    known.set(url, caps);
+    return caps;
+  });
+  asked.set(url, doc);
+  return doc;
+};
+var capabilitiesUrl = (registry) => String(new URL("-/vlt/capabilities", registry));
+var fetchCapabilities = async (client, url) => {
+  try {
+    const response = await client.request(url, {
+      headers: { accept: "application/json" }
+    });
+    if (response.statusCode !== 200) return none;
+    return asCapabilities(response.json());
+  } catch {
+    return none;
+  }
+};
+var asCapabilities = (body) => {
+  if (typeof body !== "object" || body === null) return none;
+  const doc = body;
+  const caps = {};
+  for (const key of [
+    "manifests",
+    "resolve",
+    "stable-filter"
+  ]) {
+    const version = doc[key];
+    if (typeof version === "string") caps[key] = version;
+  }
+  const { mimeTypes } = doc;
+  if (Array.isArray(mimeTypes) && mimeTypes.every((type) => typeof type === "string")) {
+    caps.mimeTypes = mimeTypes;
+  }
+  return caps;
+};
+
 // ../../src/package-info/src/rename.ts
 import { rename as fsRename, rm } from "node:fs/promises";
 var { platform } = process;
@@ -86,13 +142,20 @@ var rename = platform !== "win32" ? fsRename : (async function(oldPath, newPath)
 var debug = debuglog("vlt");
 var xdg = new XDG("vlt");
 var delimiter = "~";
-var PACKUMENT_ACCEPT = "application/vnd.vlt.packument-v1+json; q=1.0, application/json; q=0.8, */*; q=0.1";
+var VLT_PACKUMENT_MIME = "application/vnd.vlt.packument-v1+json";
+var PACKUMENT_ACCEPT = `${VLT_PACKUMENT_MIME}; q=1.0, application/json; q=0.8, */*; q=0.1`;
 var manifestCacheMaxAge = 5 * 60 * 1e3;
 var noRegistryError = (spec) => error(
   'No registry configured to resolve this spec. Set "registry" in vlt.json, pass --registry, or run `vlt login --registry=<url>`. See https://docs.vlt.sh/cli',
   { code: "ECONFIG", spec }
 );
 var isMovingSelector = (f) => !!(f.distTag || f.range?.isAny);
+var isStableSelector = (f) => {
+  const { range } = f;
+  if (!range) return false;
+  return !range.isAny && !range.raw.includes("-");
+};
+var storeLinkers = /* @__PURE__ */ new Set(["auto", "hardlink", "copy"]);
 var PackageInfoClient = class {
   #registryClient;
   #projectRoot;
@@ -102,8 +165,26 @@ var PackageInfoClient = class {
   packageJson;
   monorepo;
   #trustedIntegrities = /* @__PURE__ */ new Map();
+  // `${registry}${name}` of every packument served as VLT_PACKUMENT_MIME
+  #vltPackuments = /* @__PURE__ */ new Set();
   #manifestCacheMinAge = Date.now() - manifestCacheMaxAge;
   #cachePath;
+  #storeRoot;
+  #storeLinker;
+  #storeHits = { link: 0, copy: 0 };
+  #storeMisses = 0;
+  #storeHitRateLogged = false;
+  #logStoreHitRate = () => {
+    const { link, copy } = this.#storeHits;
+    const n = Math.max(1, link + copy + this.#storeMisses);
+    debug(
+      "global store: linked=%d copied=%d missed=%d hit rate=%s%%",
+      link,
+      copy,
+      this.#storeMisses,
+      ((link + copy) / n * 100).toFixed(1)
+    );
+  };
   // In-flight coalescing key is `${registry}${name}` — no representation
   // component. Safe only because every caller requests the same full
   // packument (see #fetchPackument). The one thing that does vary per
@@ -123,15 +204,47 @@ var PackageInfoClient = class {
   #tarPoolPromise;
   async getRegistryClient() {
     if (this.#registryClient) return this.#registryClient;
-    this.#registryClientPromise ??= import("./src-3GN7TDNH.js").then(({ RegistryClient }) => {
+    this.#registryClientPromise ??= import("./src-2BUT4WYP.js").then(({ RegistryClient }) => {
       this.#registryClient = new RegistryClient(this.options);
       return this.#registryClient;
     });
     return this.#registryClientPromise;
   }
+  /**
+   * The vlt extensions `registry` serves, from its
+   * `GET /-/vlt/capabilities` document. A registry that does not answer
+   * one reads as an empty document, so a missing key means unsupported.
+   */
+  async capabilities(registry) {
+    return getCapabilities(await this.getRegistryClient(), registry);
+  }
+  /**
+   * Whether the packument for `f` can be fetched with `?stable`: the
+   * selector has to be one a prerelease cannot answer, and the registry
+   * must not have told us it does not serve the filter.
+   *
+   * Never waits on the capability document, which would put a round trip in
+   * front of the first packument of every cold install. Until that document
+   * arrives the answer is yes: a registry that does not know `?stable`
+   * ignores the parameter and serves the full packument, which resolution
+   * reads just as well. Once the document does arrive it is authoritative,
+   * so a registry that does not serve the filter stops being asked with it.
+   */
+  #stable(f) {
+    const { registry } = f;
+    if (!registry || !isStableSelector(f)) return false;
+    const client = this.#registryClient;
+    if (!client) {
+      void this.capabilities(registry).catch(() => {
+      });
+      return true;
+    }
+    const caps = peekCapabilities(client, registry);
+    return !caps || !!caps["stable-filter"];
+  }
   async getTarPool() {
     if (this.#tarPool) return this.#tarPool;
-    this.#tarPoolPromise ??= import("./src-MOKZQTH2.js").then(
+    this.#tarPoolPromise ??= import("./src-OKMGXMAD.js").then(
       ({ Pool }) => {
         this.#tarPool = new Pool();
         return this.#tarPool;
@@ -154,6 +267,9 @@ var PackageInfoClient = class {
       packageJson: this.packageJson
     });
     this.#cachePath = options.cache ?? xdg.cache();
+    this.#storeRoot = options.storeRoot ?? storeRoot(this.#cachePath);
+    const linker = options["store-linker"];
+    this.#storeLinker = linker && storeLinkers.has(linker) ? linker : "unpack";
     void mkdir(pathResolve(this.#cachePath, "package-info"), {
       recursive: true
     }).catch(() => {
@@ -166,7 +282,8 @@ var PackageInfoClient = class {
       from = this.#projectRoot,
       integrity,
       resolved,
-      fromLockfile = false
+      fromLockfile = false,
+      installScripts = false
     } = options;
     const f = spec.final;
     const alreadyResolved = !!(integrity && resolved);
@@ -204,14 +321,44 @@ var PackageInfoClient = class {
         }
       }
       case "registry": {
-        const cached = (await this.getRegistryClient()).cachedBody(
-          r.resolved,
-          { integrity: r.integrity }
-        );
+        const pool = await this.getTarPool();
+        const hex = f.type === "registry" && this.#storeLinker !== "unpack" ? integrityHex(r.integrity) : void 0;
+        const copy = this.#storeLinker === "copy" || installScripts;
+        if (hex) {
+          if (debug.enabled && !this.#storeHitRateLogged) {
+            this.#storeHitRateLogged = true;
+            process.once("beforeExit", this.#logStoreHitRate);
+          }
+          const linked = await pool.linkFromStore(
+            pathResolve(this.#storeRoot, hex),
+            target,
+            { copy }
+          );
+          if (linked) {
+            const { how, index } = linked;
+            this.#storeHits[how]++;
+            logRequest(r.resolved, how === "link" ? "store" : "cache");
+            return {
+              ...r,
+              manifest: index.manifest,
+              // implies scripts, so most packages skip the scan
+              bindingGyp: index.scripts && index.files.some((f2) => f2[0] === "binding.gyp")
+            };
+          }
+          this.#storeMisses++;
+        }
+        const rc = await this.getRegistryClient();
+        const cached = rc.cachedBody(r.resolved, {
+          integrity: r.integrity
+        });
         if (cached) {
           try {
-            await (await this.getTarPool()).unpack(cached.body, target);
+            await pool.unpack(cached.body, target);
             logRequest(r.resolved, "cache");
+            r.integrity ??= cached.integrity;
+            if (hex || cached.gzip) {
+              rc.queueForStore(cached.key, r.integrity);
+            }
             return r;
           } catch (er) {
             debug(
@@ -226,6 +373,7 @@ var PackageInfoClient = class {
           const response = await (await this.getRegistryClient()).request(r.resolved, {
             integrity: r.integrity,
             trustIntegrity,
+            verifyDigest: r.digestRequired ? "required" : true,
             ...useCache === false ? { useCache } : {}
           });
           if (response.statusCode !== 200) {
@@ -246,19 +394,25 @@ var PackageInfoClient = class {
             );
           }
           const buf2 = response.buffer();
-          if (r.integrity && !fromLockfile && !response.fromCache) {
-            const hash = createHash("sha512");
-            hash.update(buf2);
-            const computed = `sha512-${hash.digest("base64")}`;
-            if (computed !== r.integrity) {
-              throw error("Tarball integrity check failed", {
-                code: "EINTEGRITY",
-                spec,
-                url: r.resolved,
-                wanted: r.integrity,
-                found: computed
-              });
+          if (r.integrity) {
+            if (!fromLockfile && !response.fromCache) {
+              const hash = createHash("sha512");
+              hash.update(buf2);
+              const computed = `sha512-${hash.digest("base64")}`;
+              if (computed !== r.integrity) {
+                throw error("Tarball integrity check failed", {
+                  code: "EINTEGRITY",
+                  spec,
+                  url: r.resolved,
+                  wanted: r.integrity,
+                  found: computed
+                });
+              }
             }
+          } else if (response.fromCache) {
+            r.integrity = response.integrity;
+          } else {
+            r.integrity = response.integrityActual;
           }
           return buf2;
         };
@@ -460,6 +614,9 @@ var PackageInfoClient = class {
             ...options,
             integrity,
             trustIntegrity,
+            // no dist.integrity: checked against the digest the registry
+            // sent with it instead, before the client caches it
+            verifyDigest: this.#vltPackuments.has(`${f.registry}${f.name}`) ? "required" : true,
             ...useCache === false ? { useCache } : {}
           });
           if (response.statusCode !== 200) {
@@ -595,21 +752,30 @@ var PackageInfoClient = class {
               });
               throw new Error("manifest cache expired");
             }
+            if (json.__VLT_PACKUMENT) {
+              this.#vltPackuments.add(`${f.registry}${f.name}`);
+              delete json.__VLT_PACKUMENT;
+            }
             return json;
           } catch {
           }
         }
         const mani = pickManifest(
-          await this.packument(f, options),
+          await this.#packument(f, options, this.#stable(f)),
           spec,
           options
         );
         if (!mani) throw this.#resolveError(spec, options);
         if (cachePath && !this.#manifestWritePaths.has(cachePath)) {
           this.#manifestWritePaths.add(cachePath);
+          const vlt = this.#vltPackuments.has(
+            `${f.registry}${f.name}`
+          );
           void this.#writeManifestCache(
             cachePath,
-            JSON.stringify(mani)
+            JSON.stringify(
+              vlt ? { ...mani, __VLT_PACKUMENT: true } : mani
+            )
           );
         }
         return mani;
@@ -699,7 +865,15 @@ var PackageInfoClient = class {
       }
     }
   }
+  /**
+   * The packument for `spec`, with every version the registry has. Callers
+   * that only pick a manifest out of it go through `#packument` instead,
+   * which can ask for the prerelease-free one.
+   */
   async packument(spec, options = {}) {
+    return this.#packument(spec, options, false);
+  }
+  async #packument(spec, options, stable) {
     if (typeof spec === "string")
       spec = Spec.parse(spec, this.options);
     const f = spec.final;
@@ -738,12 +912,25 @@ var PackageInfoClient = class {
       case "registry": {
         const { registry, name } = f;
         if (!registry) throw noRegistryError(spec);
-        const packumentKey = `${registry}${name}`;
+        if (options.full)
+          return this.#fetchPackument(
+            spec,
+            options,
+            new URL(name, registry)
+          );
+        const fullKey = `${registry}${name}`;
+        const packumentKey = stable ? `${fullKey}?stable` : fullKey;
         const forced = isMovingSelector(f);
-        const inflight = this.#packumentPromises.get(packumentKey);
+        const inflight = this.#packumentPromises.get(packumentKey) ?? // the full packument is a superset of the stable one, so an
+        // in-flight full request answers a stable ask too, and a package
+        // wanted both ways is still fetched once
+        (stable ? this.#packumentPromises.get(fullKey) : void 0);
         if (inflight && (!forced || inflight.forced))
           return inflight.promise;
-        const pakuURL = new URL(name, registry);
+        const pakuURL = new URL(
+          stable ? `${name}?stable` : name,
+          registry
+        );
         const promise = this.#fetchPackument(spec, options, pakuURL);
         const record = { promise, forced };
         this.#packumentPromises.set(packumentKey, record);
@@ -759,8 +946,10 @@ var PackageInfoClient = class {
   }
   async #fetchPackument(spec, options, pakuURL, useCache) {
     const response = await (await this.getRegistryClient()).request(pakuURL, {
-      headers: { accept: PACKUMENT_ACCEPT },
-      ...useCache === false ? { useCache } : {},
+      headers: {
+        accept: options.full ? "application/json" : PACKUMENT_ACCEPT
+      },
+      ...useCache === false || options.full ? { useCache: false } : {},
       // costs a conditional GET per moving selector on an otherwise warm
       // cache, install included. 304s are cheap but not free; the
       // alternative is serving a dist tag that moved (#1656).
@@ -777,14 +966,21 @@ var PackageInfoClient = class {
         }
       );
     }
+    let paku;
     try {
-      return response.json();
+      paku = response.json();
     } catch (er) {
       if (useCache !== false) {
         return this.#fetchPackument(spec, options, pakuURL, false);
       }
       throw er;
     }
+    const { registry, name } = spec.final;
+    if (response.contentType.startsWith(VLT_PACKUMENT_MIME)) {
+      this.#vltPackuments.add(`${registry}${name}`);
+    }
+    if (registry) absolutizeTarballs(paku, registry);
+    return paku;
   }
   async resolve(spec, options = {}) {
     const memoKey = String(spec);
@@ -839,6 +1035,9 @@ var PackageInfoClient = class {
               signatures,
               spec
             };
+            if (!integrity && this.#vltPackuments.has(`${f.registry}${f.name}`)) {
+              r.digestRequired = true;
+            }
             this.#resolutions.set(memoKey, r);
             return r;
           }
@@ -922,8 +1121,10 @@ var PackageInfoClient = class {
   // error resolving
   #resolveError(spec, options = {}, message = "Could not resolve", extra = {}) {
     const { from = this.#projectRoot } = options;
+    const advice = spec?.final.type === "registry" ? tokenRefusalAdvice(extra.response, extra.url) : void 0;
     const er = error(
-      message,
+      advice ? `${message}
+\u26A0\uFE0F ${advice}` : message,
       {
         code: "ERESOLVE",
         spec,
@@ -935,6 +1136,15 @@ var PackageInfoClient = class {
     return er;
   }
 };
+var absolutizeTarballs = (paku, registry) => {
+  const base = registry.endsWith("/") ? registry : registry + "/";
+  for (const { dist } of Object.values(paku.versions)) {
+    const tarball = dist?.tarball;
+    if (tarball && !/^[a-z][a-z0-9+.-]*:/i.test(tarball)) {
+      dist.tarball = String(new URL(tarball, base));
+    }
+  }
+};
 
 export {
   PackageInfoClient

package/{chunk-CEHPRPGQ.js → chunk-6A3XS52F.js}

@@ -1164,6 +1164,12 @@ var recordFields = [
   "jsr-registries"
 ];
 var isRecordField = (s) => recordFields.includes(s);
+var storeLinkers = [
+  "auto",
+  "hardlink",
+  "copy",
+  "unpack"
+];
 var j2 = jack({
   envPrefix: "VLT",
   allowPositionals: true,
@@ -1357,6 +1363,32 @@ var definition = j2.heading("Configuration").description(
       `,
     default: cacheDir
   },
+  "store-linker": {
+    hint: "auto | hardlink | copy | unpack",
+    description: `How packages are placed in \`node_modules\`. Every
+                    linker but \`unpack\` fills a global store under
+                    \`cache\` in the background, then places packages
+                    from it.
+
+                    - auto: Default. On Linux, hardlink from the global
+                      store, copying any file that cannot be linked.
+                      Elsewhere, same as \`unpack\`: a hardlink is the
+                      slowest way to place a file on APFS, so macOS and
+                      Windows unpack by default.
+                    - hardlink: Hardlink from the global store on every
+                      platform.
+                    - copy: Copy from the global store. Use this when
+                      editing files in \`node_modules\` in place, since
+                      a hardlink shares its content with every project.
+                    - unpack: Unpack each package tarball, skipping the
+                      global store.
+
+                    Packages with install scripts are always copied.
+                    An invalid \`VLT_STORE_LINKER\` warns and uses
+                    \`unpack\`.`,
+    validOptions: storeLinkers,
+    default: "auto"
+  },
   tag: {
     description: `Default \`dist-tag\` to install or publish`,
     default: "latest"
@@ -1847,6 +1879,7 @@ export {
   getCommand,
   recordFields,
   isRecordField,
+  storeLinkers,
   definition,
   defaultValues,
   getSortedCliOptions,

package/{chunk-X2AWQGYG.js → chunk-6G7MTZGS.js}

@@ -13,10 +13,10 @@ import {
   graphRun,
   graphRunSync,
   joinDepIDTuple
-} from "./chunk-YOE3VZFX.js";
+} from "./chunk-SYGF27W7.js";
 import {
   Spec
-} from "./chunk-XKVU23NC.js";
+} from "./chunk-G5NJ7CYI.js";
 import {
   load,
   parse as parse2,
@@ -28,6 +28,9 @@ import {
   promiseSpawn,
   whichSync
 } from "./chunk-U7TEQCBN.js";
+import {
+  ts
+} from "./chunk-VE6CCH33.js";
 import {
   Range,
   Version,
@@ -38,10 +41,7 @@ import {
   normalizeManifest,
   parse,
   satisfies
-} from "./chunk-VFBCWAOC.js";
-import {
-  ts
-} from "./chunk-VE6CCH33.js";
+} from "./chunk-G5BSQ6DP.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";