@vltpkg/cli-js 1.1.1 → 1.2.0

package/{chunk-DS7YMIHP.js → chunk-OE6VHHN4.js}

@@ -14,24 +14,28 @@ import {
 } from "./chunk-APMYKJI2.js";
 import {
   assertOk,
-  registryErrorMessage
-} from "./chunk-SNOBGFNM.js";
+  registryErrorMessage,
+  storeRoot,
+  tokenRefusal
+} from "./chunk-UQUIO7LW.js";
 import {
   userAgent
-} from "./chunk-YBVTY6ZW.js";
+} from "./chunk-JTUZP2OD.js";
 import {
   I,
   logRequest
 } from "./chunk-U7TEQCBN.js";
-import {
-  asError
-} from "./chunk-VFBCWAOC.js";
 import {
   XDG
 } from "./chunk-XNLSTHDK.js";
 import {
   rimraf
 } from "./chunk-BHJT53TP.js";
+import {
+  asError,
+  integrityHex,
+  integrityRE
+} from "./chunk-G5BSQ6DP.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
@@ -25805,6 +25809,7 @@ var Cache = class _Cache extends I {
   #pending = /* @__PURE__ */ new Set();
   onDiskWrite;
   onDiskDelete;
+  store;
   /**
    * A list of the actions currently happening in the background
    */
@@ -25823,6 +25828,7 @@ var Cache = class _Cache extends I {
       onDiskWrite,
       onDiskDelete,
       path,
+      store,
       fetchMethod: _,
       sizeCalculation = options.maxSize || options.maxEntrySize ? (v, k) => v.length + k.length : void 0,
       ...lruOpts
@@ -25846,6 +25852,7 @@ var Cache = class _Cache extends I {
     });
     this.onDiskWrite = onDiskWrite;
     this.onDiskDelete = onDiskDelete;
+    this.store = store;
     this.#path = path;
   }
   /**
@@ -25971,16 +25978,14 @@ var Cache = class _Cache extends I {
    */
   integrityPath(integrity) {
     if (!integrity) return void 0;
-    const m = /^sha512-([a-zA-Z0-9/+]{86}==)$/.exec(integrity);
-    const hash2 = m?.[1];
-    if (!hash2) {
+    const hex = integrityHex(integrity);
+    if (!hex) {
       throw error("invalid integrity value", {
         found: integrity,
-        wanted: /^sha512-([a-zA-Z0-9/+]{86}==)$/
+        wanted: integrityRE
       });
     }
-    const base = Buffer.from(hash2, "base64").toString("hex");
-    return resolve(this.#path, base);
+    return resolve(this.#path, hex);
   }
   /**
    * Read synchronously from the fs cache storage if not already
@@ -26007,13 +26012,20 @@ var Cache = class _Cache extends I {
   }
   /* c8 ignore stop */
   /**
-   * Delete path and path + '.key'
+   * Delete path and path + '.key', and with an integrity, its
+   * integrity link and global store entry
    */
   async #diskDelete(path, integrity) {
-    const intPath = this.#maybeIntegrityPath(integrity);
     const paths = [path, path + ".key"];
-    if (intPath) paths.push(intPath);
-    return await rimraf(paths);
+    const hex = integrityHex(integrity);
+    if (hex) paths.push(resolve(this.#path, hex));
+    const deleted = await rimraf(paths);
+    if (hex && this.store) {
+      const entry = resolve(this.store, hex);
+      await rimraf(entry);
+      await rimraf([entry + ".json", entry + ".copied"]);
+    }
+    return deleted;
   }
   #maybeIntegrityPath(i) {
     try {
@@ -26090,9 +26102,10 @@ var __CODE_SPLIT_SCRIPT_NAME = resolve2(import.meta.dirname, "cache-unzip-src-un
 var isDeno = globalThis.Deno != void 0;
 var didProcessBeforeExitHook = false;
 var registered = /* @__PURE__ */ new Map();
-var register = (path, key) => {
-  const r = registered.get(path) ?? /* @__PURE__ */ new Set();
-  r.add(key);
+var register = (path, key, store, integrity) => {
+  const r = registered.get(path) ?? { keys: /* @__PURE__ */ new Map() };
+  r.keys.set(key, integrity ?? r.keys.get(key));
+  r.store ??= store;
   registered.set(path, r);
   if (!didProcessBeforeExitHook) {
     didProcessBeforeExitHook = true;
@@ -26101,8 +26114,8 @@ var register = (path, key) => {
 };
 var handleBeforeExit = () => {
   const compileCacheDir = module.getCompileCacheDir();
-  for (const [path, r] of registered) {
-    if (!r.size) return;
+  for (const [path, { keys, store }] of registered) {
+    if (!keys.size) return;
     const env = { ...process.env };
     if (compileCacheDir) env.NODE_COMPILE_CACHE ??= compileCacheDir;
     const args = [];
@@ -26114,14 +26127,17 @@ var handleBeforeExit = () => {
       );
     }
     args.push(__CODE_SPLIT_SCRIPT_NAME, path);
+    if (store) args.push(store);
     registered.delete(path);
     const proc2 = spawn(process.execPath, args, {
       detached,
       stdio: ["pipe", "ignore", "ignore"],
       env
     });
-    for (const key of r) {
-      proc2.stdin.write(`${key}\0`);
+    for (const [key, integrity] of keys) {
+      proc2.stdin.write(
+        integrity ? `${key}	${integrity}\0` : `${key}\0`
+      );
     }
     proc2.stdin.end();
     if (detached) {
@@ -26630,8 +26646,9 @@ var CacheEntry = class _CacheEntry {
    * This method **will throw** if the integrity values do not match.
    *
    * Note that this will *usually* not be true if the value is coming out of
-   * the cache, because the cache entries are un-gzipped in place. It should
-   * _only_ be called for artifacts that come from an actual http response.
+   * the cache, because cache entries not exploded into the global store are
+   * un-gzipped in place. It should _only_ be called for artifacts that come
+   * from an actual http response.
    *
    * Returns true if anything was actually verified.
    */
@@ -26648,6 +26665,29 @@ var CacheEntry = class _CacheEntry {
     }
     return true;
   }
+  /**
+   * Check the body against the RFC 9530 digest the server sent with it,
+   * for a response that had no expected integrity. A registry that omits
+   * `dist.integrity` labels every tarball, so a missing digest fails when
+   * `required`. Like {@link checkIntegrity}, only for an actual http
+   * response: cached bodies are un-gzipped in place.
+   *
+   * **Will throw** on a mismatch. Returns the hash of the body.
+   */
+  checkDigest(required, context = {}) {
+    const computed = this.integrityActual;
+    const { digest } = this;
+    if (digest ? digest !== computed : required) {
+      throw error("Integrity check failure", {
+        code: "EINTEGRITY",
+        response: this,
+        wanted: digest,
+        found: computed,
+        ...context
+      });
+    }
+    return computed;
+  }
   get integrityActual() {
     if (this.#integrityActual) return this.#integrityActual;
     const hash2 = createHash2("sha512");
@@ -26669,6 +26709,16 @@ var CacheEntry = class _CacheEntry {
   get integrity() {
     return this.#integrity;
   }
+  /**
+   * The sha-512 member of an RFC 9530 `Repr-Digest` (or `Content-Digest`)
+   * response header, as an SRI string. A registry that serves packuments
+   * without `dist.integrity` labels each tarball this way instead.
+   */
+  get digest() {
+    const value = this.getHeaderString("repr-digest") ?? this.getHeaderString("content-digest");
+    const m = value && /(?:^|,)\s*sha-512=:([A-Za-z0-9+/]{86}==):/.exec(value);
+    return m ? `sha512-${m[1]}` : void 0;
+  }
   /**
    * Give it a key, and it'll return the buffer of that header value
    */
@@ -26690,6 +26740,19 @@ var CacheEntry = class _CacheEntry {
   setHeader(h, value) {
     this.#headers = setRawHeader(this.#headers, h, value);
   }
+  /**
+   * Remove a header, if present
+   */
+  deleteHeader(h) {
+    const key = h.toLowerCase();
+    for (let i = 0; i < this.#headers.length; i += 2) {
+      const k = this.#headers[i];
+      if (k && getDecodedValue(k).toLowerCase() === key) {
+        this.#headers.splice(i, 2);
+        return;
+      }
+    }
+  }
   /**
    * Return the body of the entry as a Buffer
    */
@@ -26869,6 +26932,16 @@ var CacheEntry = class _CacheEntry {
     const gzipBytes = buffer.subarray(headSize, headSize + 2);
     return gzipBytes[0] === 31 && gzipBytes[1] === 139;
   }
+  /**
+   * Head-only check for a 200 non-JSON body with an integrity header,
+   * i.e. a tarball the global store can be built from.
+   */
+  static isTarballEntry(buffer) {
+    const parsed = _CacheEntry.#parseHead(buffer);
+    if (parsed?.statusCode !== 200 || !parsed.integrity) return false;
+    const ct = getRawHeader(parsed.headers, "content-type");
+    return !ct || !/\bjson\b/.test(getDecodedValue(ct));
+  }
   /**
    * Encode status + headers (no body) as they appear at the start of
    * an on-disk cache file.
@@ -27115,6 +27188,10 @@ var otplease = async (client, options, response) => {
     });
   }
   if (wwwAuth.has("bearer")) {
+    const text2 = await responseBodyText(response).catch(() => "");
+    if (tokenRefusal({ statusCode: 401, text: () => text2 })) {
+      return { bodyConsumed: text2 };
+    }
     throw error(
       "Missing or invalid authentication token. Run `vlt login` or `vlt token add` to authenticate.",
       {
@@ -27449,12 +27526,14 @@ var RegistryClient = class {
     this.identity = identity;
     this.staleWhileRevalidateFactor = staleWhileRevalidateFactor;
     const path = resolve4(cache, "registry-client");
+    const store = options.storeRoot ?? storeRoot(cache);
     this.cache = new Cache({
       path,
+      store,
       maxSize: parseCacheMaxSize(process.env.VLT_CACHE_MAX_SIZE),
       onDiskWrite(_path, key, data) {
-        if (CacheEntry.isGzipEntry(data)) {
-          register(path, key);
+        if (CacheEntry.isGzipEntry(data) || CacheEntry.isTarballEntry(data)) {
+          register(path, key, store);
         }
       }
     });
@@ -27728,12 +27807,32 @@ var RegistryClient = class {
         if (entry.statusCode !== 200 || !entry.valid || entry.isJSON) {
           continue;
         }
-        return { path, body: entry.buffer() };
+        return {
+          path,
+          key,
+          body: entry.buffer(),
+          integrity: entry.integrity,
+          gzip: CacheEntry.isGzipEntry(buf)
+        };
       }
     } catch {
     }
     return void 0;
   }
+  /**
+   * Queue the cached tarball at `key` (a {@link CachedBody} key) for the
+   * background child: exploded into the global store when that is on,
+   * else un-gzipped. `integrity` finds it when only the integrity path
+   * holds it.
+   */
+  queueForStore(key, integrity) {
+    register(
+      this.cache.path(),
+      key,
+      this.cache.store,
+      integrity
+    );
+  }
   async request(url, options = {}) {
     const u = typeof url === "string" ? new URL(url) : url;
     const {
@@ -27745,7 +27844,7 @@ var RegistryClient = class {
       staleWhileRevalidate = true,
       forceRevalidate = false
     } = options;
-    let { trustIntegrity } = options;
+    const { trustIntegrity, verifyDigest } = options;
     const m = isCacheableMethod(method) ? method : void 0;
     const { useCache = !!m } = options;
     signal?.throwIfAborted();
@@ -27837,14 +27936,16 @@ var RegistryClient = class {
         durationMs: Date.now() - requestStart
       }
     );
-    if (result.getHeader("integrity")) {
-      trustIntegrity = true;
+    if (!trustIntegrity && !result.fromCache) {
+      result.deleteHeader("integrity");
+      if (result.isGzip) result.checkIntegrity({ url });
     }
-    if (result.isGzip && !trustIntegrity) {
-      result.checkIntegrity({ url });
+    if (verifyDigest && !integrity && !result.fromCache && result.statusCode === 200) {
+      result.checkDigest(verifyDigest === "required", { url });
     }
     const clobbersCachedEntry = forceRevalidate && !!entry && result.statusCode !== 200;
     if (useCache && !clobbersCachedEntry) {
+      const integrity2 = result.integrity ?? (result.statusCode === 200 && !result.isJSON ? result.integrityActual : void 0);
       const buffer2 = result.encode();
       this.cache.set(
         key,
@@ -27853,9 +27954,7 @@ var RegistryClient = class {
           buffer2.byteOffset,
           buffer2.byteLength
         ),
-        {
-          integrity: result.integrity
-        }
+        { integrity: integrity2 }
       );
     }
     return result;

package/{src-MOKZQTH2.js → chunk-QA6RE2GS.js}

@@ -13,19 +13,78 @@ import {
   rimraf,
   rimrafSync
 } from "./chunk-BHJT53TP.js";
-import "./chunk-VE6CCH33.js";
+import {
+  isManifest,
+  normalizeBinPaths
+} from "./chunk-G5BSQ6DP.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
-import "./chunk-PZLD7RTK.js";
+
+// ../../src/tar/src/store-index.ts
+import { readFileSync } from "node:fs";
+import { debuglog } from "node:util";
+var debug = debuglog("vlt");
+var storeIndexPath = (storeEntry) => storeEntry + ".json";
+var isRecord = (x) => !!x && typeof x === "object" && !Array.isArray(x);
+var isOptString = (x) => x === void 0 || typeof x === "string";
+var unsafePath = /(?:^|\/)\.{0,2}(?:\/|$)|\\/;
+var isRelPath = (p) => typeof p === "string" && !unsafePath.test(p);
+var isIndexFile = (f) => Array.isArray(f) && f.length === 3 && isRelPath(f[0]) && typeof f[1] === "number" && (f[2] === 0 || f[2] === 1);
+var isStoreIndex = (x) => isRecord(x) && x.v === 1 && typeof x.scripts === "boolean" && isOptString(x.name) && isOptString(x.version) && (x.bins === void 0 || isRecord(x.bins) && Object.values(x.bins).every((b) => typeof b === "string")) && Array.isArray(x.dirs) && x.dirs.every(isRelPath) && Array.isArray(x.files) && x.files.every(isIndexFile) && isOptString(x.manifest);
+var readStoreIndex = (storeEntry) => {
+  let index;
+  try {
+    index = JSON.parse(
+      readFileSync(storeIndexPath(storeEntry), "utf8")
+    );
+  } catch (er) {
+    if (er.code !== "ENOENT") {
+      debug("global store: invalid index", storeEntry);
+    }
+    return void 0;
+  }
+  if (isStoreIndex(index)) return index;
+  debug("global store: invalid index", storeEntry);
+  return void 0;
+};
+var storeIndexManifest = (packageJson, bindingGyp) => {
+  let pkg;
+  try {
+    pkg = JSON.parse(
+      packageJson.toString("utf8").replace(/^\uFEFF/, "")
+    );
+  } catch (cause) {
+    throw error("invalid package.json in tarball", { cause });
+  }
+  if (!isRecord(pkg)) {
+    throw error("invalid package.json in tarball", { found: pkg });
+  }
+  const { name: name2, version, scripts, bin } = pkg;
+  const s = isRecord(scripts) ? scripts : {};
+  const result = {
+    scripts: !!(s.install || s.preinstall || s.postinstall) || bindingGyp
+  };
+  const bins = normalizeBinPaths({
+    name: typeof name2 === "string" ? name2 : void 0,
+    bin
+  });
+  if (bins && Object.keys(bins).length) result.bins = bins;
+  if (typeof name2 === "string") result.name = name2;
+  if (typeof version === "string") result.version = version;
+  if (isManifest(pkg)) result.manifest = JSON.stringify(pkg);
+  return result;
+};
 
 // ../../src/tar/src/unpack.ts
 import { randomBytes } from "node:crypto";
 import {
+  chmodSync,
   lstatSync,
   mkdirSync,
-  readFileSync,
+  readFileSync as readFileSync2,
   renameSync,
+  statSync,
   writeFileSync
 } from "node:fs";
 import { lstat, mkdir, rename, writeFile } from "node:fs/promises";
@@ -33,6 +92,7 @@ import {
   basename as basename2,
   dirname,
   isAbsolute,
+  join,
   relative,
   resolve,
   sep
@@ -688,7 +748,7 @@ var unpackSync = (tarData, target) => {
   const isGzip = tarData[0] === 31 && tarData[1] === 139;
   unpackUnzippedSync(isGzip ? unzipSync(tarData) : tarData, target);
 };
-var unpackFileSync = (file, target, offset = 0) => unpackSync(readFileSync(file).subarray(offset), target);
+var unpackFileSync = (file, target, offset = 0) => unpackSync(readFileSync2(file).subarray(offset), target);
 var tmpName = (target) => dirname(target) + sep + "." + basename2(target) + "." + tmpSuffix();
 var parseTarball = (buffer, tmp2) => {
   const isGzip = buffer[0] === 31 && buffer[1] === 139;
@@ -863,32 +923,193 @@ var unpackUnzippedSync = (buffer, target) => {
     }
   }
 };
+var storeLayout = (tarData, dir) => {
+  const isGzip = tarData[0] === 31 && tarData[1] === 139;
+  const { dirs, files } = parseTarball(
+    isGzip ? unzipSync(tarData) : tarData,
+    dir
+  );
+  const rel = (p) => relative(dir, p).replace(/\\/g, "/");
+  const list = files.map((f) => [rel(f.path), f]);
+  const pj = list.find(([p]) => p === "package.json")?.[1];
+  if (!pj) throw error("no package.json in tarball", { path: dir });
+  const manifest = storeIndexManifest(
+    pj.body,
+    list.some(([p]) => p === "binding.gyp")
+  );
+  const bins = new Set(
+    Object.values(manifest.bins ?? {}).map(entryKey)
+  );
+  const indexFiles = [];
+  const binFiles = [];
+  for (const [p, f] of list) {
+    if (bins.has(entryKey(p))) {
+      f.executable = true;
+      binFiles.push(f.path);
+    }
+    indexFiles.push([p, f.body.length, f.executable ? 1 : 0]);
+  }
+  const allDirs = /* @__PURE__ */ new Set();
+  for (const d of dirs) {
+    for (let p = rel(d); p && !allDirs.has(p); ) {
+      allDirs.add(p);
+      p = p.slice(0, Math.max(0, p.lastIndexOf("/")));
+    }
+  }
+  const indexDirs = [...allDirs].sort().sort((a, b) => a.length - b.length);
+  return {
+    index: {
+      v: 1,
+      files: indexFiles.sort((a, b) => a[0] < b[0] ? -1 : 1),
+      dirs: indexDirs,
+      ...manifest
+    },
+    files,
+    binFiles
+  };
+};
+var unpackToStoreSync = (tarData, dir) => {
+  const { index, files, binFiles } = storeLayout(tarData, dir);
+  mkdirSync(dirname(dir), { recursive: true });
+  mkdirSync(dir, { mode: 511 });
+  let succeeded = false;
+  try {
+    for (const d of index.dirs) {
+      mkdirSync(join(dir, d), { recursive: true, mode: 511 });
+    }
+    for (const f of files) {
+      writeFileSync(f.path, f.body, {
+        mode: f.executable ? 511 : 438
+      });
+    }
+    let binMode = 0;
+    for (const p of binFiles) {
+      binMode ||= statSync(p).mode & 511 | 73;
+      chmodSync(p, binMode);
+    }
+    succeeded = true;
+  } finally {
+    if (!succeeded) rimrafSync(dir);
+  }
+  return { index };
+};
 
-// ../../src/tar/src/pool.ts
-import { readFile } from "node:fs/promises";
-var syncUnpack = process.env.VLT_TAR_SYNC !== "0";
-var Pool = class {
-  /**
-   * Provide the tardata to be unpacked, and the location where it's to be
-   * placed. Resolves when the tarball has been extracted.
-   */
-  async unpack(tarData, target) {
-    if (!syncUnpack) return unpack(tarData, target);
-    unpackSync(tarData, target);
-  }
-  /**
-   * Same, reading the tarball from a file and skipping `offset` leading
-   * bytes, so a cache entry is unpacked without loading it into the
-   * registry client's in-memory cache.
-   */
-  async unpackFile(file, target, offset = 0) {
-    if (!syncUnpack) {
-      return unpack((await readFile(file)).subarray(offset), target);
-    }
-    unpackFileSync(file, target, offset);
+// ../../src/tar/src/store-entry.ts
+import {
+  closeSync,
+  lstatSync as lstatSync2,
+  openSync,
+  readdirSync,
+  readFileSync as readFileSync3,
+  statSync as statSync2
+} from "node:fs";
+import { join as join2, relative as relative2 } from "node:path";
+import { isDeepStrictEqual } from "node:util";
+var noThrow = { throwIfNoEntry: false };
+var entryName = /^([0-9a-f]{128})(?:\.json|\.copied)?$/;
+var relPath = (from, to) => relative2(from, to).replace(/\\/g, "/");
+var storeEntryNames = (root) => {
+  let names;
+  try {
+    names = readdirSync(root);
+  } catch {
+    return [];
+  }
+  const hexes = /* @__PURE__ */ new Set();
+  for (const name2 of names) {
+    const hex = entryName.exec(name2)?.[1];
+    if (hex) hexes.add(hex);
+  }
+  return [...hexes].sort();
+};
+var storeCopiedPath = (storeEntry) => storeEntry + ".copied";
+var markStoreEntryCopied = (storeEntry) => {
+  try {
+    closeSync(openSync(storeCopiedPath(storeEntry), "wx"));
+  } catch {
   }
 };
+var removeStoreEntry = (storeEntry) => {
+  rimrafSync(storeEntry);
+  rimrafSync(storeIndexPath(storeEntry));
+  rimrafSync(storeCopiedPath(storeEntry));
+};
+var storeEntryTime = (storeEntry) => (statSync2(storeIndexPath(storeEntry), noThrow) ?? statSync2(storeEntry, noThrow))?.mtimeMs ?? 0;
+var storeEntryCopied = (storeEntry, index = readStoreIndex(storeEntry)) => !!index && (index.scripts || !!lstatSync2(storeCopiedPath(storeEntry), noThrow)) && !!lstatSync2(storeEntry, noThrow)?.isDirectory();
+var storeEntryLinked = (storeEntry, index = readStoreIndex(storeEntry)) => !!index?.files.some(
+  ([p]) => (lstatSync2(join2(storeEntry, p), noThrow)?.nlink ?? 1) > 1
+);
+var indexKeys = [
+  "v",
+  "files",
+  "dirs",
+  "scripts",
+  "bins",
+  "name",
+  "version"
+];
+var verifyStoreEntry = (storeEntry, tarData) => {
+  let layout;
+  try {
+    layout = storeLayout(tarData, storeEntry);
+  } catch {
+    return "bad tarball";
+  }
+  const index = readStoreIndex(storeEntry);
+  if (!index) return "no index";
+  if (indexKeys.some(
+    (k) => !isDeepStrictEqual(index[k], layout.index[k])
+  ) || index.manifest !== void 0 && index.manifest !== layout.index.manifest) {
+    return "index differs";
+  }
+  const found = /* @__PURE__ */ new Set();
+  try {
+    for (const d of readdirSync(storeEntry, {
+      recursive: true,
+      withFileTypes: true
+    })) {
+      if (!d.isDirectory()) {
+        found.add(relPath(storeEntry, join2(d.parentPath, d.name)));
+      }
+    }
+  } catch {
+    return "missing";
+  }
+  const modes = process.platform !== "win32";
+  for (const f of layout.files) {
+    const p = relPath(storeEntry, f.path);
+    if (!found.delete(p)) return `missing ${p}`;
+    let body;
+    let mode;
+    try {
+      mode = statSync2(f.path).mode;
+      body = readFileSync3(f.path);
+    } catch {
+      return `unreadable ${p}`;
+    }
+    if (!body.equals(f.body)) return `modified ${p}`;
+    if (modes && (mode & 73) !== 0 !== f.executable) {
+      return `mode ${p}`;
+    }
+  }
+  const [extra] = found;
+  return extra === void 0 ? void 0 : `extra ${extra}`;
+};
+
 export {
-  Pool,
-  unpack
+  storeIndexPath,
+  readStoreIndex,
+  unpack,
+  unpackSync,
+  unpackFileSync,
+  tmpName,
+  unpackToStoreSync,
+  storeEntryNames,
+  storeCopiedPath,
+  markStoreEntryCopied,
+  removeStoreEntry,
+  storeEntryTime,
+  storeEntryCopied,
+  storeEntryLinked,
+  verifyStoreEntry
 };