@vltpkg/cli-js 1.1.1 → 1.3.0

package/{src-MOKZQTH2.js → chunk-263MHLR3.js}

@@ -12,27 +12,93 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   rimraf,
   rimrafSync
-} from "./chunk-BHJT53TP.js";
-import "./chunk-VE6CCH33.js";
+} from "./chunk-PDWPFR5T.js";
+import {
+  isManifest,
+  normalizeBinPaths
+} from "./chunk-RH2Y7MPW.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
-import "./chunk-PZLD7RTK.js";
+
+// ../../src/tar/src/store-index.ts
+import { readFileSync } from "node:fs";
+import { debuglog } from "node:util";
+var debug = debuglog("vlt");
+var storeIndexPath = (storeEntry) => storeEntry + ".json";
+var isRecord = (x) => !!x && typeof x === "object" && !Array.isArray(x);
+var isOptString = (x) => x === void 0 || typeof x === "string";
+var unsafePath = /(?:^|\/)\.{0,2}(?:\/|$)|\\/;
+var isRelPath = (p) => typeof p === "string" && !unsafePath.test(p);
+var isIndexFile = (f) => Array.isArray(f) && f.length === 3 && isRelPath(f[0]) && typeof f[1] === "number" && (f[2] === 0 || f[2] === 1);
+var isStoreIndex = (x) => isRecord(x) && x.v === 1 && typeof x.scripts === "boolean" && isOptString(x.name) && isOptString(x.version) && (x.bins === void 0 || isRecord(x.bins) && Object.values(x.bins).every((b) => typeof b === "string")) && Array.isArray(x.dirs) && x.dirs.every(isRelPath) && Array.isArray(x.files) && x.files.every(isIndexFile) && isOptString(x.manifest);
+var readStoreIndex = (storeEntry) => {
+  let index;
+  try {
+    index = JSON.parse(
+      readFileSync(storeIndexPath(storeEntry), "utf8")
+    );
+  } catch (er) {
+    if (er.code !== "ENOENT") {
+      debug("global store: invalid index", storeEntry);
+    }
+    return void 0;
+  }
+  if (isStoreIndex(index)) return index;
+  debug("global store: invalid index", storeEntry);
+  return void 0;
+};
+var storeIndexManifest = (packageJson, bindingGyp) => {
+  let pkg;
+  try {
+    pkg = JSON.parse(
+      packageJson.toString("utf8").replace(/^\uFEFF/, "")
+    );
+  } catch (cause) {
+    throw error("invalid package.json in tarball", { cause });
+  }
+  if (!isRecord(pkg)) {
+    throw error("invalid package.json in tarball", { found: pkg });
+  }
+  const { name: name2, version, scripts, bin } = pkg;
+  const s = isRecord(scripts) ? scripts : {};
+  const result = {
+    scripts: !!(s.install || s.preinstall || s.postinstall) || bindingGyp
+  };
+  const bins = normalizeBinPaths({
+    name: typeof name2 === "string" ? name2 : void 0,
+    bin
+  });
+  if (bins && Object.keys(bins).length) result.bins = bins;
+  if (typeof name2 === "string") result.name = name2;
+  if (typeof version === "string") result.version = version;
+  if (isManifest(pkg)) result.manifest = JSON.stringify(pkg);
+  return result;
+};
 
 // ../../src/tar/src/unpack.ts
 import { randomBytes } from "node:crypto";
 import {
+  chmodSync,
   lstatSync,
   mkdirSync,
-  readFileSync,
+  readFileSync as readFileSync2,
   renameSync,
+  statSync,
   writeFileSync
 } from "node:fs";
-import { lstat, mkdir, rename, writeFile } from "node:fs/promises";
+import {
+  lstat,
+  mkdir,
+  readFile,
+  rename,
+  writeFile
+} from "node:fs/promises";
 import {
   basename as basename2,
   dirname,
   isAbsolute,
+  join,
   relative,
   resolve,
   sep
@@ -530,7 +596,12 @@ var parseKVLine = (set, line) => {
 };
 
 // ../../src/tar/src/unpack.ts
-import { unzip as unzipCB, unzipSync as unzipSyncCB } from "node:zlib";
+import {
+  brotliDecompress as brotliCB,
+  brotliDecompressSync as brotliSyncCB,
+  unzip as unzipCB,
+  unzipSync as unzipSyncCB
+} from "node:zlib";
 
 // ../../src/tar/src/find-tar-dir.ts
 var findTarDir = (path, tarDir) => {
@@ -579,6 +650,27 @@ var unzipSync = (input) => {
     throw unzipError(er, input.length, max);
   }
 };
+var isGzip = (b) => b[0] === 31 && b[1] === 139;
+var brotli = async (input) => {
+  const max = unzipMax(input.length);
+  return new Promise(
+    (res, rej) => brotliCB(
+      input,
+      { maxOutputLength: max },
+      (er, result) => er ? rej(unzipError(er, input.length, max)) : res(result)
+    )
+  );
+};
+var brotliSync = (input) => {
+  const max = unzipMax(input.length);
+  try {
+    return brotliSyncCB(input, { maxOutputLength: max });
+  } catch (er) {
+    throw unzipError(er, input.length, max);
+  }
+};
+var decompress = async (input, format) => format === "brotli" ? brotli(input) : isGzip(input) ? unzip(input) : input;
+var decompressSync = (input, format) => format === "brotli" ? brotliSync(input) : isGzip(input) ? unzipSync(input) : input;
 var exists = async (path) => {
   try {
     await lstat(path);
@@ -677,24 +769,26 @@ var write = async (path, body, executable = false) => {
     mode: executable ? 511 : 438
   });
 };
-var unpack = async (tarData, target) => {
-  const isGzip = tarData[0] === 31 && tarData[1] === 139;
-  await unpackUnzipped(
-    isGzip ? await unzip(tarData) : tarData,
-    target
-  );
+var unpack = async (tarData, target, format) => {
+  await unpackUnzipped(await decompress(tarData, format), target);
+};
+var unpackSync = (tarData, target, format) => {
+  unpackUnzippedSync(decompressSync(tarData, format), target);
 };
-var unpackSync = (tarData, target) => {
-  const isGzip = tarData[0] === 31 && tarData[1] === 139;
-  unpackUnzippedSync(isGzip ? unzipSync(tarData) : tarData, target);
+var unpackParallel = async (tarData, target, format) => {
+  unpackUnzippedSync(await decompress(tarData, format), target);
 };
-var unpackFileSync = (file, target, offset = 0) => unpackSync(readFileSync(file).subarray(offset), target);
+var unpackFileParallel = async (file, target, offset = 0, format) => unpackParallel(
+  (await readFile(file)).subarray(offset),
+  target,
+  format
+);
+var unpackFileSync = (file, target, offset = 0, format) => unpackSync(readFileSync2(file).subarray(offset), target, format);
 var tmpName = (target) => dirname(target) + sep + "." + basename2(target) + "." + tmpSuffix();
 var parseTarball = (buffer, tmp2) => {
-  const isGzip = buffer[0] === 31 && buffer[1] === 139;
-  if (isGzip) {
+  if (isGzip(buffer)) {
     throw error("still gzipped after unzipping", {
-      found: isGzip,
+      found: true,
       wanted: false
     });
   }
@@ -863,32 +957,194 @@ var unpackUnzippedSync = (buffer, target) => {
     }
   }
 };
+var storeLayout = (tarData, dir, format) => {
+  const { dirs, files } = parseTarball(
+    decompressSync(tarData, format),
+    dir
+  );
+  const rel = (p) => relative(dir, p).replace(/\\/g, "/");
+  const list = files.map((f) => [rel(f.path), f]);
+  const pj = list.find(([p]) => p === "package.json")?.[1];
+  if (!pj) throw error("no package.json in tarball", { path: dir });
+  const manifest = storeIndexManifest(
+    pj.body,
+    list.some(([p]) => p === "binding.gyp")
+  );
+  const bins = new Set(
+    Object.values(manifest.bins ?? {}).map(entryKey)
+  );
+  const indexFiles = [];
+  const binFiles = [];
+  for (const [p, f] of list) {
+    if (bins.has(entryKey(p))) {
+      f.executable = true;
+      binFiles.push(f.path);
+    }
+    indexFiles.push([p, f.body.length, f.executable ? 1 : 0]);
+  }
+  const allDirs = /* @__PURE__ */ new Set();
+  for (const d of dirs) {
+    for (let p = rel(d); p && !allDirs.has(p); ) {
+      allDirs.add(p);
+      p = p.slice(0, Math.max(0, p.lastIndexOf("/")));
+    }
+  }
+  const indexDirs = [...allDirs].sort().sort((a, b) => a.length - b.length);
+  return {
+    index: {
+      v: 1,
+      files: indexFiles.sort((a, b) => a[0] < b[0] ? -1 : 1),
+      dirs: indexDirs,
+      ...manifest
+    },
+    files,
+    binFiles
+  };
+};
+var unpackToStoreSync = (tarData, dir, format) => {
+  const { index, files, binFiles } = storeLayout(tarData, dir, format);
+  mkdirSync(dirname(dir), { recursive: true });
+  mkdirSync(dir, { mode: 511 });
+  let succeeded = false;
+  try {
+    for (const d of index.dirs) {
+      mkdirSync(join(dir, d), { recursive: true, mode: 511 });
+    }
+    for (const f of files) {
+      writeFileSync(f.path, f.body, {
+        mode: f.executable ? 511 : 438
+      });
+    }
+    let binMode = 0;
+    for (const p of binFiles) {
+      binMode ||= statSync(p).mode & 511 | 73;
+      chmodSync(p, binMode);
+    }
+    succeeded = true;
+  } finally {
+    if (!succeeded) rimrafSync(dir);
+  }
+  return { index };
+};
 
-// ../../src/tar/src/pool.ts
-import { readFile } from "node:fs/promises";
-var syncUnpack = process.env.VLT_TAR_SYNC !== "0";
-var Pool = class {
-  /**
-   * Provide the tardata to be unpacked, and the location where it's to be
-   * placed. Resolves when the tarball has been extracted.
-   */
-  async unpack(tarData, target) {
-    if (!syncUnpack) return unpack(tarData, target);
-    unpackSync(tarData, target);
-  }
-  /**
-   * Same, reading the tarball from a file and skipping `offset` leading
-   * bytes, so a cache entry is unpacked without loading it into the
-   * registry client's in-memory cache.
-   */
-  async unpackFile(file, target, offset = 0) {
-    if (!syncUnpack) {
-      return unpack((await readFile(file)).subarray(offset), target);
-    }
-    unpackFileSync(file, target, offset);
+// ../../src/tar/src/store-entry.ts
+import {
+  closeSync,
+  lstatSync as lstatSync2,
+  openSync,
+  readdirSync,
+  readFileSync as readFileSync3,
+  statSync as statSync2
+} from "node:fs";
+import { join as join2, relative as relative2 } from "node:path";
+import { isDeepStrictEqual } from "node:util";
+var noThrow = { throwIfNoEntry: false };
+var entryName = /^([0-9a-f]{128})(?:\.json|\.copied)?$/;
+var relPath = (from, to) => relative2(from, to).replace(/\\/g, "/");
+var storeEntryNames = (root) => {
+  let names;
+  try {
+    names = readdirSync(root);
+  } catch {
+    return [];
+  }
+  const hexes = /* @__PURE__ */ new Set();
+  for (const name2 of names) {
+    const hex = entryName.exec(name2)?.[1];
+    if (hex) hexes.add(hex);
   }
+  return [...hexes].sort();
 };
+var storeCopiedPath = (storeEntry) => storeEntry + ".copied";
+var markStoreEntryCopied = (storeEntry) => {
+  try {
+    closeSync(openSync(storeCopiedPath(storeEntry), "wx"));
+  } catch {
+  }
+};
+var removeStoreEntry = (storeEntry) => {
+  rimrafSync(storeEntry);
+  rimrafSync(storeIndexPath(storeEntry));
+  rimrafSync(storeCopiedPath(storeEntry));
+};
+var storeEntryTime = (storeEntry) => (statSync2(storeIndexPath(storeEntry), noThrow) ?? statSync2(storeEntry, noThrow))?.mtimeMs ?? 0;
+var storeEntryCopied = (storeEntry, index = readStoreIndex(storeEntry)) => !!index && (index.scripts || !!lstatSync2(storeCopiedPath(storeEntry), noThrow)) && !!lstatSync2(storeEntry, noThrow)?.isDirectory();
+var storeEntryLinked = (storeEntry, index = readStoreIndex(storeEntry)) => !!index?.files.some(
+  ([p]) => (lstatSync2(join2(storeEntry, p), noThrow)?.nlink ?? 1) > 1
+);
+var indexKeys = [
+  "v",
+  "files",
+  "dirs",
+  "scripts",
+  "bins",
+  "name",
+  "version"
+];
+var verifyStoreEntry = (storeEntry, tarData) => {
+  let layout;
+  try {
+    layout = storeLayout(tarData, storeEntry);
+  } catch {
+    return "bad tarball";
+  }
+  const index = readStoreIndex(storeEntry);
+  if (!index) return "no index";
+  if (indexKeys.some(
+    (k) => !isDeepStrictEqual(index[k], layout.index[k])
+  ) || index.manifest !== void 0 && index.manifest !== layout.index.manifest) {
+    return "index differs";
+  }
+  const found = /* @__PURE__ */ new Set();
+  try {
+    for (const d of readdirSync(storeEntry, {
+      recursive: true,
+      withFileTypes: true
+    })) {
+      if (!d.isDirectory()) {
+        found.add(relPath(storeEntry, join2(d.parentPath, d.name)));
+      }
+    }
+  } catch {
+    return "missing";
+  }
+  const modes = process.platform !== "win32";
+  for (const f of layout.files) {
+    const p = relPath(storeEntry, f.path);
+    if (!found.delete(p)) return `missing ${p}`;
+    let body;
+    let mode;
+    try {
+      mode = statSync2(f.path).mode;
+      body = readFileSync3(f.path);
+    } catch {
+      return `unreadable ${p}`;
+    }
+    if (!body.equals(f.body)) return `modified ${p}`;
+    if (modes && (mode & 73) !== 0 !== f.executable) {
+      return `mode ${p}`;
+    }
+  }
+  const [extra] = found;
+  return extra === void 0 ? void 0 : `extra ${extra}`;
+};
+
 export {
-  Pool,
-  unpack
+  storeIndexPath,
+  readStoreIndex,
+  unpack,
+  unpackSync,
+  unpackParallel,
+  unpackFileParallel,
+  unpackFileSync,
+  tmpName,
+  unpackToStoreSync,
+  storeEntryNames,
+  storeCopiedPath,
+  markStoreEntryCopied,
+  removeStoreEntry,
+  storeEntryTime,
+  storeEntryCopied,
+  storeEntryLinked,
+  verifyStoreEntry
 };

package/{chunk-3LUM7NX5.js → chunk-2HXJ4ZSF.js}

@@ -13,10 +13,10 @@ import {
   actual,
   callLimit,
   createVirtualRoot
-} from "./chunk-JZJWASXL.js";
+} from "./chunk-J2WL3A3C.js";
 import {
   SecurityArchive
-} from "./chunk-DF5K4CYR.js";
+} from "./chunk-JFHEXCG5.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
@@ -140,7 +140,7 @@ var reloadConfig = async (folder) => {
     unload("project");
   } catch {
   }
-  const { Config } = await import("./config-VYOTYBGS.js");
+  const { Config } = await import("./config-HFF6XDCV.js");
   return Config.load(folder, process.argv, true);
 };
 

package/{chunk-GDJ7JT2R.js → chunk-33HBY5CF.js}

@@ -12,7 +12,7 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   isError,
   isObject
-} from "./chunk-VFBCWAOC.js";
+} from "./chunk-RH2Y7MPW.js";
 
 // ../../src/output/src/error.ts
 var parseError = (err) => {

package/{chunk-MZA6N2TA.js → chunk-C6LK7C3L.js}

@@ -15,14 +15,14 @@ import {
   pairsToRecords,
   registrySelectionFields,
   registrySelectors
-} from "./chunk-6FT6K5YN.js";
+} from "./chunk-YZWFWSY7.js";
 import {
   normalizeRegistryURL
-} from "./chunk-2PWSMJD7.js";
+} from "./chunk-D2LEK7VS.js";
 import {
   getCommand,
   isRecordField
-} from "./chunk-CEHPRPGQ.js";
+} from "./chunk-ENSGPOLR.js";
 import {
   find
 } from "./chunk-HTOTG4TS.js";
@@ -33,7 +33,7 @@ import {
   defaultRegistries,
   defaultRegistryName,
   isObject
-} from "./chunk-VFBCWAOC.js";
+} from "./chunk-RH2Y7MPW.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";

package/{chunk-34TE4HZS.js → chunk-CU752KW7.js}

@@ -14,7 +14,7 @@ import {
 } from "./chunk-WGDTG44V.js";
 import {
   commandAliases
-} from "./chunk-CEHPRPGQ.js";
+} from "./chunk-ENSGPOLR.js";
 
 // ../../node_modules/.vlt/~npm~package-json-from-dist@1.0.1/node_modules/package-json-from-dist/dist/esm/index.js
 import { readFileSync } from "node:fs";
@@ -107,7 +107,7 @@ var commandHelp = {
     defaultOrder: 4
   },
   cache: {
-    args: "[add|ls|info|clean|delete|delete-before|delete-all]",
+    args: "[add|ls|info|clean|delete|delete-before|delete-all|verify|prune-store]",
     desc: "Manage the package cache"
   },
   ci: {

package/{chunk-2PWSMJD7.js → chunk-D2LEK7VS.js}

@@ -14,7 +14,7 @@ import {
   defaultRegistryName,
   isErrorWithCause,
   isObject
-} from "./chunk-VFBCWAOC.js";
+} from "./chunk-RH2Y7MPW.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";

package/{chunk-CEHPRPGQ.js → chunk-ENSGPOLR.js}

@@ -1164,6 +1164,12 @@ var recordFields = [
   "jsr-registries"
 ];
 var isRecordField = (s) => recordFields.includes(s);
+var storeLinkers = [
+  "auto",
+  "hardlink",
+  "copy",
+  "unpack"
+];
 var j2 = jack({
   envPrefix: "VLT",
   allowPositionals: true,
@@ -1357,6 +1363,32 @@ var definition = j2.heading("Configuration").description(
       `,
     default: cacheDir
   },
+  "store-linker": {
+    hint: "auto | hardlink | copy | unpack",
+    description: `How packages are placed in \`node_modules\`. Every
+                    linker but \`unpack\` fills a global store under
+                    \`cache\` in the background, then places packages
+                    from it.
+
+                    - auto: Default. On Linux, hardlink from the global
+                      store, copying any file that cannot be linked.
+                      Elsewhere, same as \`unpack\`: a hardlink is the
+                      slowest way to place a file on APFS, so macOS and
+                      Windows unpack by default.
+                    - hardlink: Hardlink from the global store on every
+                      platform.
+                    - copy: Copy from the global store. Use this when
+                      editing files in \`node_modules\` in place, since
+                      a hardlink shares its content with every project.
+                    - unpack: Unpack each package tarball, skipping the
+                      global store.
+
+                    Packages with install scripts are always copied.
+                    An invalid \`VLT_STORE_LINKER\` warns and uses
+                    \`unpack\`.`,
+    validOptions: storeLinkers,
+    default: "auto"
+  },
   tag: {
     description: `Default \`dist-tag\` to install or publish`,
     default: "latest"
@@ -1748,6 +1780,19 @@ var definition = j2.heading("Configuration").description(
   },
   "lockfile-only": {
     description: "Only update the lockfile (vlt-lock.json) and package.json files, skip all node_modules operations including package extraction and filesystem changes."
+  },
+  "brotli-tarballs": {
+    description: `Resolve to the Brotli (\`.tar.br\`) tarball when the
+                    registry advertises one for a version, transferring far
+                    less than the gzip \`.tgz\`.
+
+                    The \`.tar.br\` is its own artifact and hashes
+                    differently, so a version installed this way records that
+                    hash in \`vlt-lock.json\`. An existing lockfile keeps
+                    whichever artifact it already pinned; set
+                    \`--no-brotli-tarballs\` before resolving to pin the
+                    \`.tgz\` instead.`,
+    default: true
   }
 }).opt({
   "allow-scripts": {
@@ -1847,6 +1892,7 @@ export {
   getCommand,
   recordFields,
   isRecordField,
+  storeLinkers,
   definition,
   defaultValues,
   getSortedCliOptions,

package/{chunk-V4YCZZHY.js → chunk-EP7AVBIO.js}

@@ -11,26 +11,26 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   PackageInfoClient
-} from "./chunk-LN2A74PF.js";
+} from "./chunk-SVMH3NDM.js";
 import {
   findCmdShimIfExists,
   install
-} from "./chunk-JZJWASXL.js";
+} from "./chunk-J2WL3A3C.js";
 import {
   PathScurry
-} from "./chunk-X2AWQGYG.js";
+} from "./chunk-P4LLYWCG.js";
 import {
   Spec
-} from "./chunk-XKVU23NC.js";
+} from "./chunk-V7EQZOO5.js";
 import {
   walkUp
 } from "./chunk-HTOTG4TS.js";
-import {
-  parseScope
-} from "./chunk-VFBCWAOC.js";
 import {
   XDG
 } from "./chunk-XNLSTHDK.js";
+import {
+  parseScope
+} from "./chunk-RH2Y7MPW.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
@@ -200,7 +200,7 @@ var vlxInstall = async (spec, options, promptFn) => {
     resolve3(dir, "package.json"),
     JSON.stringify(manifest, null, 2) + "\n"
   );
-  await install({
+  const { graph } = await install({
     ...options,
     packageInfo,
     projectRoot: dir,
@@ -209,6 +209,14 @@ var vlxInstall = async (spec, options, promptFn) => {
     // allow lifecycle scripts but filter out malware via security archive
     allowScripts: ":scripts:not(:malware)"
   });
+  const installed = graph.mainImporter.edgesOut.get(pkgSpec.name)?.to;
+  if (!manifest.vlx.integrity && installed?.integrity) {
+    manifest.vlx.integrity = installed.integrity;
+    await writeFile(
+      resolve3(dir, "package.json"),
+      JSON.stringify(manifest, null, 2) + "\n"
+    );
+  }
   return vlxInfo(dir, options, manifest);
 };