@vltpkg/cli-js 1.1.1 → 1.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (85) hide show
  1. package/{access-YYMAAPHV.js → access-HIVJOWXZ.js} +10 -10
  2. package/{bugs-RK5JBPSC.js → bugs-2KFUYMPS.js} +19 -19
  3. package/{build-DVJSYCNF.js → build-CX6YZ4LS.js} +12 -12
  4. package/{cache-JKQNGZ7L.js → cache-I6L5ZRGD.js} +145 -16
  5. package/cache-unzip-src-unzip.js +2953 -164
  6. package/{src-MOKZQTH2.js → chunk-263MHLR3.js} +299 -43
  7. package/{chunk-3LUM7NX5.js → chunk-2HXJ4ZSF.js} +3 -3
  8. package/{chunk-GDJ7JT2R.js → chunk-33HBY5CF.js} +1 -1
  9. package/{chunk-MZA6N2TA.js → chunk-C6LK7C3L.js} +4 -4
  10. package/{chunk-34TE4HZS.js → chunk-CU752KW7.js} +2 -2
  11. package/{chunk-2PWSMJD7.js → chunk-D2LEK7VS.js} +1 -1
  12. package/{chunk-CEHPRPGQ.js → chunk-ENSGPOLR.js} +46 -0
  13. package/{chunk-V4YCZZHY.js → chunk-EP7AVBIO.js} +16 -8
  14. package/{chunk-DS7YMIHP.js → chunk-FHMIECHI.js} +158 -59
  15. package/chunk-GDV5LSQ2.js +75 -0
  16. package/{chunk-BWEH7DHQ.js → chunk-HCZOVC3Y.js} +1 -1
  17. package/{chunk-CBASIDQH.js → chunk-I6QGYSB4.js} +1 -1
  18. package/{chunk-KDF7PEBY.js → chunk-ILRJWH6A.js} +5 -5
  19. package/{chunk-JZJWASXL.js → chunk-J2WL3A3C.js} +134 -68
  20. package/{chunk-YOE3VZFX.js → chunk-J3R4XWB3.js} +2 -2
  21. package/{chunk-DF5K4CYR.js → chunk-JFHEXCG5.js} +5 -5
  22. package/{chunk-LR42WTKN.js → chunk-MJWUULO6.js} +14 -12
  23. package/{chunk-QQYTPGIL.js → chunk-N4RCKCHY.js} +1 -1
  24. package/{chunk-X2AWQGYG.js → chunk-P4LLYWCG.js} +112 -23
  25. package/{chunk-BHJT53TP.js → chunk-PDWPFR5T.js} +1 -1
  26. package/{chunk-XIF734VO.js → chunk-QETVMIIT.js} +4 -4
  27. package/{chunk-WE2TQN32.js → chunk-QWJDHBV7.js} +4 -3
  28. package/{chunk-VFBCWAOC.js → chunk-RH2Y7MPW.js} +29 -0
  29. package/{chunk-LN2A74PF.js → chunk-SVMH3NDM.js} +277 -50
  30. package/{chunk-DR4Z63B6.js → chunk-TYLYZKVA.js} +14 -11
  31. package/{chunk-XKVU23NC.js → chunk-V7EQZOO5.js} +1 -1
  32. package/{chunk-YBVTY6ZW.js → chunk-VBADA6QU.js} +1 -1
  33. package/{chunk-GDT6KI4I.js → chunk-W6UMN2YJ.js} +4 -4
  34. package/{chunk-VE6CCH33.js → chunk-Y5PA7DVK.js} +1 -0
  35. package/{chunk-6FT6K5YN.js → chunk-YZWFWSY7.js} +25 -7
  36. package/{chunk-SNOBGFNM.js → chunk-ZNUXDX6R.js} +50 -8
  37. package/{ci-WVYVR4XK.js → ci-BX54SEU3.js} +12 -12
  38. package/cli-package.json +3 -2
  39. package/{config-VYOTYBGS.js → config-HFF6XDCV.js} +9 -9
  40. package/{config-2MFZVP2N.js → config-WBVJX42R.js} +12 -12
  41. package/{create-OJPLHBRR.js → create-W67HRHWZ.js} +20 -20
  42. package/{deprecate-V4PKGFF7.js → deprecate-5T6JTGJ3.js} +14 -14
  43. package/{devtools-UEMPW5GG.js → devtools-UMJUK42W.js} +2 -2
  44. package/{dist-tag-DNLV4VDE.js → dist-tag-YIZTS7GF.js} +10 -10
  45. package/{docs-LXHDCGL5.js → docs-G7CKMPCL.js} +19 -19
  46. package/{exec-P32YSP44.js → exec-YYCAZZ6Z.js} +20 -20
  47. package/{exec-cache-JZ5PDTOY.js → exec-cache-6ENHAGC6.js} +18 -18
  48. package/{exec-local-HHA464H4.js → exec-local-OXG3PSLF.js} +17 -17
  49. package/{help-GVTTOYUL.js → help-RMOIAILM.js} +4 -4
  50. package/{init-RENGG74N.js → init-UPEQXC4D.js} +12 -12
  51. package/{install-V6VXOBH2.js → install-U7LLEQU6.js} +18 -18
  52. package/{list-7N7Y5OXB.js → list-N6CKPXTK.js} +20 -20
  53. package/{login-D2QSAUJC.js → login-MCO4ZLVF.js} +14 -14
  54. package/{logout-QPOYBQNF.js → logout-BJ4QRZYG.js} +10 -10
  55. package/{pack-4YYGXP3A.js → pack-U6PYRFZ6.js} +13 -13
  56. package/package.json +1 -1
  57. package/{ping-QYRIZONU.js → ping-VFB6SCMH.js} +10 -10
  58. package/{pkg-WQTNABKT.js → pkg-ZNK5SCF4.js} +13 -13
  59. package/{profile-PRI7WXK7.js → profile-TW32HLYA.js} +10 -10
  60. package/{publish-PSBYJQS7.js → publish-AHOITWZQ.js} +36 -21
  61. package/{query-UFYLQW4N.js → query-KKP5PNSQ.js} +20 -20
  62. package/{registry-YTJZ3AQD.js → registry-VHB65BWD.js} +5 -5
  63. package/registry-client-src-revalidate.js +5936 -5801
  64. package/{repo-4S6ETFXX.js → repo-BHTVK5KE.js} +19 -19
  65. package/{reporter-GLWYHI2Y.js → reporter-VQU7HYKM.js} +77 -77
  66. package/{run-OU7NUB7A.js → run-UD32OTUJ.js} +17 -17
  67. package/{run-exec-QPBY7ULE.js → run-exec-NOCIUNGL.js} +17 -17
  68. package/security-archive-src-update-expired.js +1 -1
  69. package/{setup-23QXG473.js → setup-PBCWOSTV.js} +18 -18
  70. package/{src-575IYJOL.js → src-LRKPUV4J.js} +16 -16
  71. package/src-T5FBZFMV.js +222 -0
  72. package/{src-3GN7TDNH.js → src-Z44JKVWS.js} +9 -7
  73. package/{token-FCIA3RGD.js → token-PCPB6NOL.js} +10 -10
  74. package/{uninstall-BQVZVKB5.js → uninstall-LOGSQXFS.js} +14 -14
  75. package/{unpublish-YGJ5HEYF.js → unpublish-O3UFCTEJ.js} +10 -10
  76. package/{update-WCGV66JK.js → update-WBCLWGLN.js} +17 -17
  77. package/{version-7EA3UQG7.js → version-S3LCB2TQ.js} +13 -13
  78. package/{view-5FWIENVE.js → view-LMPENVAJ.js} +12 -12
  79. package/vlr.js +1 -1
  80. package/vlrx.js +1 -1
  81. package/vlt.js +1 -1
  82. package/vlx.js +1 -1
  83. package/vlxl.js +1 -1
  84. package/{whoami-O4ZTBIC4.js → whoami-LYMG7R3P.js} +10 -10
  85. package/chunk-WD74RJXW.js +0 -75
@@ -14,24 +14,29 @@ import {
14
14
  } from "./chunk-APMYKJI2.js";
15
15
  import {
16
16
  assertOk,
17
- registryErrorMessage
18
- } from "./chunk-SNOBGFNM.js";
17
+ registryErrorMessage,
18
+ statusText,
19
+ storeRoot,
20
+ tokenRefusal
21
+ } from "./chunk-ZNUXDX6R.js";
19
22
  import {
20
23
  userAgent
21
- } from "./chunk-YBVTY6ZW.js";
24
+ } from "./chunk-VBADA6QU.js";
22
25
  import {
23
26
  I,
24
27
  logRequest
25
28
  } from "./chunk-U7TEQCBN.js";
26
- import {
27
- asError
28
- } from "./chunk-VFBCWAOC.js";
29
29
  import {
30
30
  XDG
31
31
  } from "./chunk-XNLSTHDK.js";
32
32
  import {
33
33
  rimraf
34
- } from "./chunk-BHJT53TP.js";
34
+ } from "./chunk-PDWPFR5T.js";
35
+ import {
36
+ asError,
37
+ integrityHex,
38
+ integrityRE
39
+ } from "./chunk-RH2Y7MPW.js";
35
40
  import {
36
41
  error
37
42
  } from "./chunk-WZWDS3W4.js";
@@ -2319,14 +2324,14 @@ var require_request = __commonJS({
2319
2324
  onResponseStarted() {
2320
2325
  return this[kHandler].onResponseStarted?.();
2321
2326
  }
2322
- onHeaders(statusCode, headers, resume, statusText) {
2327
+ onHeaders(statusCode, headers, resume, statusText2) {
2323
2328
  assert(!this.aborted);
2324
2329
  assert(!this.completed);
2325
2330
  if (channels.headers.hasSubscribers) {
2326
- channels.headers.publish({ request: this, response: { statusCode, headers, statusText } });
2331
+ channels.headers.publish({ request: this, response: { statusCode, headers, statusText: statusText2 } });
2327
2332
  }
2328
2333
  try {
2329
- return this[kHandler].onHeaders(statusCode, headers, resume, statusText);
2334
+ return this[kHandler].onHeaders(statusCode, headers, resume, statusText2);
2330
2335
  } catch (err) {
2331
2336
  this.abort(err);
2332
2337
  }
@@ -5079,9 +5084,9 @@ var require_util2 = __commonJS({
5079
5084
  function isErrorLike(object) {
5080
5085
  return object instanceof Error || (object?.constructor?.name === "Error" || object?.constructor?.name === "DOMException");
5081
5086
  }
5082
- function isValidReasonPhrase(statusText) {
5083
- for (let i = 0; i < statusText.length; ++i) {
5084
- const c = statusText.charCodeAt(i);
5087
+ function isValidReasonPhrase(statusText2) {
5088
+ for (let i = 0; i < statusText2.length; ++i) {
5089
+ const c = statusText2.charCodeAt(i);
5085
5090
  if (!(c === 9 || // HTAB
5086
5091
  c >= 32 && c <= 126 || // SP / VCHAR
5087
5092
  c >= 128 && c <= 255)) {
@@ -7036,7 +7041,7 @@ var require_client_h1 = __commonJS({
7036
7041
  * @returns {number}
7037
7042
  */
7038
7043
  onHeadersComplete(statusCode, upgrade, shouldKeepAlive) {
7039
- const { client, socket, headers, statusText } = this;
7044
+ const { client, socket, headers, statusText: statusText2 } = this;
7040
7045
  if (socket.destroyed) {
7041
7046
  return -1;
7042
7047
  }
@@ -7101,7 +7106,7 @@ var require_client_h1 = __commonJS({
7101
7106
  } else {
7102
7107
  socket[kReset] = true;
7103
7108
  }
7104
- const pause = request2.onHeaders(statusCode, headers, this.resume, statusText) === false;
7109
+ const pause = request2.onHeaders(statusCode, headers, this.resume, statusText2) === false;
7105
7110
  if (request2.aborted) {
7106
7111
  return -1;
7107
7112
  }
@@ -12599,7 +12604,7 @@ var require_mock_utils = __commonJS({
12599
12604
  kTotalDispatchCount
12600
12605
  } = require_mock_symbols();
12601
12606
  var { serializePathWithQuery } = require_util();
12602
- var { STATUS_CODES: STATUS_CODES2 } = __require("node:http");
12607
+ var { STATUS_CODES } = __require("node:http");
12603
12608
  var {
12604
12609
  types: {
12605
12610
  isPromise
@@ -12807,7 +12812,7 @@ var require_mock_utils = __commonJS({
12807
12812
  return result;
12808
12813
  }
12809
12814
  function getStatusText(statusCode) {
12810
- return STATUS_CODES2[statusCode] || "unknown";
12815
+ return STATUS_CODES[statusCode] || "unknown";
12811
12816
  }
12812
12817
  async function getResponse(body) {
12813
12818
  const buffers = [];
@@ -20413,7 +20418,7 @@ var require_fetch = __commonJS({
20413
20418
  var { dataURLProcessor, serializeAMimeType, minimizeSupportedMimeType } = require_data_url();
20414
20419
  var { getGlobalDispatcher } = require_global2();
20415
20420
  var { webidl } = require_webidl();
20416
- var { STATUS_CODES: STATUS_CODES2 } = __require("node:http");
20421
+ var { STATUS_CODES } = __require("node:http");
20417
20422
  var { bytesMatch } = require_subresource_integrity();
20418
20423
  var { createDeferredPromise } = require_promise();
20419
20424
  var { isomorphicEncode } = require_infra();
@@ -21206,13 +21211,13 @@ var require_fetch = __commonJS({
21206
21211
  })();
21207
21212
  }
21208
21213
  try {
21209
- const { body, status, statusText, headersList, socket } = await dispatch({ body: requestBody });
21214
+ const { body, status, statusText: statusText2, headersList, socket } = await dispatch({ body: requestBody });
21210
21215
  if (socket) {
21211
- response = makeResponse({ status, statusText, headersList, socket });
21216
+ response = makeResponse({ status, statusText: statusText2, headersList, socket });
21212
21217
  } else {
21213
21218
  const iterator = body[Symbol.asyncIterator]();
21214
21219
  fetchParams.controller.next = () => iterator.next();
21215
- response = makeResponse({ status, statusText, headersList });
21220
+ response = makeResponse({ status, statusText: statusText2, headersList });
21216
21221
  }
21217
21222
  } catch (err) {
21218
21223
  if (err.name === "AbortError") {
@@ -21334,7 +21339,7 @@ var require_fetch = __commonJS({
21334
21339
  onResponseStarted() {
21335
21340
  timingInfo.finalNetworkResponseStartTime = coarsenedSharedCurrentTime(fetchParams.crossOriginIsolatedCapability);
21336
21341
  },
21337
- onHeaders(status, rawHeaders, resume, statusText) {
21342
+ onHeaders(status, rawHeaders, resume, statusText2) {
21338
21343
  if (status < 200) {
21339
21344
  return false;
21340
21345
  }
@@ -21397,7 +21402,7 @@ var require_fetch = __commonJS({
21397
21402
  const onError = this.onError.bind(this);
21398
21403
  resolve5({
21399
21404
  status,
21400
- statusText,
21405
+ statusText: statusText2,
21401
21406
  headersList,
21402
21407
  body: decoders.length ? pipeline(this.body, ...decoders, (err) => {
21403
21408
  if (err) {
@@ -21450,7 +21455,7 @@ var require_fetch = __commonJS({
21450
21455
  }
21451
21456
  resolve5({
21452
21457
  status,
21453
- statusText: STATUS_CODES2[status],
21458
+ statusText: STATUS_CODES[status],
21454
21459
  headersList,
21455
21460
  socket
21456
21461
  });
@@ -21474,7 +21479,7 @@ var require_fetch = __commonJS({
21474
21479
  }
21475
21480
  resolve5({
21476
21481
  status,
21477
- statusText: STATUS_CODES2[status],
21482
+ statusText: STATUS_CODES[status],
21478
21483
  headersList,
21479
21484
  socket
21480
21485
  });
@@ -25805,6 +25810,7 @@ var Cache = class _Cache extends I {
25805
25810
  #pending = /* @__PURE__ */ new Set();
25806
25811
  onDiskWrite;
25807
25812
  onDiskDelete;
25813
+ store;
25808
25814
  /**
25809
25815
  * A list of the actions currently happening in the background
25810
25816
  */
@@ -25823,6 +25829,7 @@ var Cache = class _Cache extends I {
25823
25829
  onDiskWrite,
25824
25830
  onDiskDelete,
25825
25831
  path,
25832
+ store,
25826
25833
  fetchMethod: _,
25827
25834
  sizeCalculation = options.maxSize || options.maxEntrySize ? (v, k) => v.length + k.length : void 0,
25828
25835
  ...lruOpts
@@ -25846,6 +25853,7 @@ var Cache = class _Cache extends I {
25846
25853
  });
25847
25854
  this.onDiskWrite = onDiskWrite;
25848
25855
  this.onDiskDelete = onDiskDelete;
25856
+ this.store = store;
25849
25857
  this.#path = path;
25850
25858
  }
25851
25859
  /**
@@ -25971,16 +25979,14 @@ var Cache = class _Cache extends I {
25971
25979
  */
25972
25980
  integrityPath(integrity) {
25973
25981
  if (!integrity) return void 0;
25974
- const m = /^sha512-([a-zA-Z0-9/+]{86}==)$/.exec(integrity);
25975
- const hash2 = m?.[1];
25976
- if (!hash2) {
25982
+ const hex = integrityHex(integrity);
25983
+ if (!hex) {
25977
25984
  throw error("invalid integrity value", {
25978
25985
  found: integrity,
25979
- wanted: /^sha512-([a-zA-Z0-9/+]{86}==)$/
25986
+ wanted: integrityRE
25980
25987
  });
25981
25988
  }
25982
- const base = Buffer.from(hash2, "base64").toString("hex");
25983
- return resolve(this.#path, base);
25989
+ return resolve(this.#path, hex);
25984
25990
  }
25985
25991
  /**
25986
25992
  * Read synchronously from the fs cache storage if not already
@@ -26007,13 +26013,20 @@ var Cache = class _Cache extends I {
26007
26013
  }
26008
26014
  /* c8 ignore stop */
26009
26015
  /**
26010
- * Delete path and path + '.key'
26016
+ * Delete path and path + '.key', and with an integrity, its
26017
+ * integrity link and global store entry
26011
26018
  */
26012
26019
  async #diskDelete(path, integrity) {
26013
- const intPath = this.#maybeIntegrityPath(integrity);
26014
26020
  const paths = [path, path + ".key"];
26015
- if (intPath) paths.push(intPath);
26016
- return await rimraf(paths);
26021
+ const hex = integrityHex(integrity);
26022
+ if (hex) paths.push(resolve(this.#path, hex));
26023
+ const deleted = await rimraf(paths);
26024
+ if (hex && this.store) {
26025
+ const entry = resolve(this.store, hex);
26026
+ await rimraf(entry);
26027
+ await rimraf([entry + ".json", entry + ".copied"]);
26028
+ }
26029
+ return deleted;
26017
26030
  }
26018
26031
  #maybeIntegrityPath(i) {
26019
26032
  try {
@@ -26090,9 +26103,10 @@ var __CODE_SPLIT_SCRIPT_NAME = resolve2(import.meta.dirname, "cache-unzip-src-un
26090
26103
  var isDeno = globalThis.Deno != void 0;
26091
26104
  var didProcessBeforeExitHook = false;
26092
26105
  var registered = /* @__PURE__ */ new Map();
26093
- var register = (path, key) => {
26094
- const r = registered.get(path) ?? /* @__PURE__ */ new Set();
26095
- r.add(key);
26106
+ var register = (path, key, store, integrity) => {
26107
+ const r = registered.get(path) ?? { keys: /* @__PURE__ */ new Map() };
26108
+ r.keys.set(key, integrity ?? r.keys.get(key));
26109
+ r.store ??= store;
26096
26110
  registered.set(path, r);
26097
26111
  if (!didProcessBeforeExitHook) {
26098
26112
  didProcessBeforeExitHook = true;
@@ -26101,8 +26115,8 @@ var register = (path, key) => {
26101
26115
  };
26102
26116
  var handleBeforeExit = () => {
26103
26117
  const compileCacheDir = module.getCompileCacheDir();
26104
- for (const [path, r] of registered) {
26105
- if (!r.size) return;
26118
+ for (const [path, { keys, store }] of registered) {
26119
+ if (!keys.size) return;
26106
26120
  const env = { ...process.env };
26107
26121
  if (compileCacheDir) env.NODE_COMPILE_CACHE ??= compileCacheDir;
26108
26122
  const args = [];
@@ -26114,14 +26128,17 @@ var handleBeforeExit = () => {
26114
26128
  );
26115
26129
  }
26116
26130
  args.push(__CODE_SPLIT_SCRIPT_NAME, path);
26131
+ if (store) args.push(store);
26117
26132
  registered.delete(path);
26118
26133
  const proc2 = spawn(process.execPath, args, {
26119
26134
  detached,
26120
26135
  stdio: ["pipe", "ignore", "ignore"],
26121
26136
  env
26122
26137
  });
26123
- for (const key of r) {
26124
- proc2.stdin.write(`${key}\0`);
26138
+ for (const [key, integrity] of keys) {
26139
+ proc2.stdin.write(
26140
+ integrity ? `${key} ${integrity}\0` : `${key}\0`
26141
+ );
26125
26142
  }
26126
26143
  proc2.stdin.end();
26127
26144
  if (detached) {
@@ -26134,7 +26151,6 @@ var handleBeforeExit = () => {
26134
26151
  var import_undici3 = __toESM(require_undici(), 1);
26135
26152
  import { randomUUID } from "node:crypto";
26136
26153
  import { readFileSync as readFileSync2 } from "node:fs";
26137
- import { STATUS_CODES } from "node:http";
26138
26154
  import { availableParallelism } from "node:os";
26139
26155
  import { dirname as dirname3, resolve as resolve4 } from "node:path";
26140
26156
  import { setTimeout as setTimeout2 } from "node:timers/promises";
@@ -26630,8 +26646,9 @@ var CacheEntry = class _CacheEntry {
26630
26646
  * This method **will throw** if the integrity values do not match.
26631
26647
  *
26632
26648
  * Note that this will *usually* not be true if the value is coming out of
26633
- * the cache, because the cache entries are un-gzipped in place. It should
26634
- * _only_ be called for artifacts that come from an actual http response.
26649
+ * the cache, because cache entries not exploded into the global store are
26650
+ * un-gzipped in place. It should _only_ be called for artifacts that come
26651
+ * from an actual http response.
26635
26652
  *
26636
26653
  * Returns true if anything was actually verified.
26637
26654
  */
@@ -26648,6 +26665,29 @@ var CacheEntry = class _CacheEntry {
26648
26665
  }
26649
26666
  return true;
26650
26667
  }
26668
+ /**
26669
+ * Check the body against the RFC 9530 digest the server sent with it,
26670
+ * for a response that had no expected integrity. A registry that omits
26671
+ * `dist.integrity` labels every tarball, so a missing digest fails when
26672
+ * `required`. Like {@link checkIntegrity}, only for an actual http
26673
+ * response: cached bodies are un-gzipped in place.
26674
+ *
26675
+ * **Will throw** on a mismatch. Returns the hash of the body.
26676
+ */
26677
+ checkDigest(required, context = {}) {
26678
+ const computed = this.integrityActual;
26679
+ const { digest } = this;
26680
+ if (digest ? digest !== computed : required) {
26681
+ throw error("Integrity check failure", {
26682
+ code: "EINTEGRITY",
26683
+ response: this,
26684
+ wanted: digest,
26685
+ found: computed,
26686
+ ...context
26687
+ });
26688
+ }
26689
+ return computed;
26690
+ }
26651
26691
  get integrityActual() {
26652
26692
  if (this.#integrityActual) return this.#integrityActual;
26653
26693
  const hash2 = createHash2("sha512");
@@ -26669,6 +26709,16 @@ var CacheEntry = class _CacheEntry {
26669
26709
  get integrity() {
26670
26710
  return this.#integrity;
26671
26711
  }
26712
+ /**
26713
+ * The sha-512 member of an RFC 9530 `Repr-Digest` (or `Content-Digest`)
26714
+ * response header, as an SRI string. A registry that serves packuments
26715
+ * without `dist.integrity` labels each tarball this way instead.
26716
+ */
26717
+ get digest() {
26718
+ const value = this.getHeaderString("repr-digest") ?? this.getHeaderString("content-digest");
26719
+ const m = value && /(?:^|,)\s*sha-512=:([A-Za-z0-9+/]{86}==):/.exec(value);
26720
+ return m ? `sha512-${m[1]}` : void 0;
26721
+ }
26672
26722
  /**
26673
26723
  * Give it a key, and it'll return the buffer of that header value
26674
26724
  */
@@ -26690,6 +26740,19 @@ var CacheEntry = class _CacheEntry {
26690
26740
  setHeader(h, value) {
26691
26741
  this.#headers = setRawHeader(this.#headers, h, value);
26692
26742
  }
26743
+ /**
26744
+ * Remove a header, if present
26745
+ */
26746
+ deleteHeader(h) {
26747
+ const key = h.toLowerCase();
26748
+ for (let i = 0; i < this.#headers.length; i += 2) {
26749
+ const k = this.#headers[i];
26750
+ if (k && getDecodedValue(k).toLowerCase() === key) {
26751
+ this.#headers.splice(i, 2);
26752
+ return;
26753
+ }
26754
+ }
26755
+ }
26693
26756
  /**
26694
26757
  * Return the body of the entry as a Buffer
26695
26758
  */
@@ -26869,6 +26932,16 @@ var CacheEntry = class _CacheEntry {
26869
26932
  const gzipBytes = buffer.subarray(headSize, headSize + 2);
26870
26933
  return gzipBytes[0] === 31 && gzipBytes[1] === 139;
26871
26934
  }
26935
+ /**
26936
+ * Head-only check for a 200 non-JSON body with an integrity header,
26937
+ * i.e. a tarball the global store can be built from.
26938
+ */
26939
+ static isTarballEntry(buffer) {
26940
+ const parsed = _CacheEntry.#parseHead(buffer);
26941
+ if (parsed?.statusCode !== 200 || !parsed.integrity) return false;
26942
+ const ct = getRawHeader(parsed.headers, "content-type");
26943
+ return !ct || !/\bjson\b/.test(getDecodedValue(ct));
26944
+ }
26872
26945
  /**
26873
26946
  * Encode status + headers (no body) as they appear at the start of
26874
26947
  * an on-disk cache file.
@@ -27115,6 +27188,10 @@ var otplease = async (client, options, response) => {
27115
27188
  });
27116
27189
  }
27117
27190
  if (wwwAuth.has("bearer")) {
27191
+ const text2 = await responseBodyText(response).catch(() => "");
27192
+ if (tokenRefusal({ statusCode: 401, text: () => text2 })) {
27193
+ return { bodyConsumed: text2 };
27194
+ }
27118
27195
  throw error(
27119
27196
  "Missing or invalid authentication token. Run `vlt login` or `vlt token add` to authenticate.",
27120
27197
  {
@@ -27449,12 +27526,14 @@ var RegistryClient = class {
27449
27526
  this.identity = identity;
27450
27527
  this.staleWhileRevalidateFactor = staleWhileRevalidateFactor;
27451
27528
  const path = resolve4(cache, "registry-client");
27529
+ const store = options.storeRoot ?? storeRoot(cache);
27452
27530
  this.cache = new Cache({
27453
27531
  path,
27532
+ store,
27454
27533
  maxSize: parseCacheMaxSize(process.env.VLT_CACHE_MAX_SIZE),
27455
27534
  onDiskWrite(_path, key, data) {
27456
- if (CacheEntry.isGzipEntry(data)) {
27457
- register(path, key);
27535
+ if (CacheEntry.isGzipEntry(data) || CacheEntry.isTarballEntry(data)) {
27536
+ register(path, key, store);
27458
27537
  }
27459
27538
  }
27460
27539
  });
@@ -27492,7 +27571,7 @@ var RegistryClient = class {
27492
27571
  }
27493
27572
  } catch {
27494
27573
  }
27495
- const status = STATUS_CODES[statusCode];
27574
+ const status = statusText(statusCode);
27496
27575
  throw error(
27497
27576
  `Failed to fetch paginated results: ${statusCode}${status ? ` ${status}` : ""}${typeof detail === "string" && detail ? `: ${detail}` : ""}`,
27498
27577
  { code: "EREQUEST", status: statusCode, url: String(url) }
@@ -27609,7 +27688,7 @@ var RegistryClient = class {
27609
27688
  }
27610
27689
  }
27611
27690
  const { statusCode } = response;
27612
- const status = STATUS_CODES[statusCode];
27691
+ const status = statusText(statusCode);
27613
27692
  throw error(
27614
27693
  `Failed to perform web login: ${statusCode}${status ? ` ${status}` : ""}`,
27615
27694
  {
@@ -27716,7 +27795,7 @@ var RegistryClient = class {
27716
27795
  if (i) paths.add(i);
27717
27796
  } catch {
27718
27797
  }
27719
- paths.add(this.cache.path(key));
27798
+ if (!integrity) paths.add(this.cache.path(key));
27720
27799
  for (const path of paths) {
27721
27800
  let buf;
27722
27801
  try {
@@ -27728,12 +27807,32 @@ var RegistryClient = class {
27728
27807
  if (entry.statusCode !== 200 || !entry.valid || entry.isJSON) {
27729
27808
  continue;
27730
27809
  }
27731
- return { path, body: entry.buffer() };
27810
+ return {
27811
+ path,
27812
+ key,
27813
+ body: entry.buffer(),
27814
+ integrity: entry.integrity,
27815
+ gzip: CacheEntry.isGzipEntry(buf)
27816
+ };
27732
27817
  }
27733
27818
  } catch {
27734
27819
  }
27735
27820
  return void 0;
27736
27821
  }
27822
+ /**
27823
+ * Queue the cached tarball at `key` (a {@link CachedBody} key) for the
27824
+ * background child: exploded into the global store when that is on,
27825
+ * else un-gzipped. `integrity` finds it when only the integrity path
27826
+ * holds it.
27827
+ */
27828
+ queueForStore(key, integrity) {
27829
+ register(
27830
+ this.cache.path(),
27831
+ key,
27832
+ this.cache.store,
27833
+ integrity
27834
+ );
27835
+ }
27737
27836
  async request(url, options = {}) {
27738
27837
  const u = typeof url === "string" ? new URL(url) : url;
27739
27838
  const {
@@ -27745,7 +27844,7 @@ var RegistryClient = class {
27745
27844
  staleWhileRevalidate = true,
27746
27845
  forceRevalidate = false
27747
27846
  } = options;
27748
- let { trustIntegrity } = options;
27847
+ const { trustIntegrity, verifyDigest } = options;
27749
27848
  const m = isCacheableMethod(method) ? method : void 0;
27750
27849
  const { useCache = !!m } = options;
27751
27850
  signal?.throwIfAborted();
@@ -27837,14 +27936,16 @@ var RegistryClient = class {
27837
27936
  durationMs: Date.now() - requestStart
27838
27937
  }
27839
27938
  );
27840
- if (result.getHeader("integrity")) {
27841
- trustIntegrity = true;
27939
+ if (!trustIntegrity && !result.fromCache) {
27940
+ result.deleteHeader("integrity");
27941
+ if (result.statusCode === 200) result.checkIntegrity({ url });
27842
27942
  }
27843
- if (result.isGzip && !trustIntegrity) {
27844
- result.checkIntegrity({ url });
27943
+ if (verifyDigest && !integrity && !result.fromCache && result.statusCode === 200) {
27944
+ result.checkDigest(verifyDigest === "required", { url });
27845
27945
  }
27846
27946
  const clobbersCachedEntry = forceRevalidate && !!entry && result.statusCode !== 200;
27847
27947
  if (useCache && !clobbersCachedEntry) {
27948
+ const integrity2 = result.integrity ?? (result.statusCode === 200 && !result.isJSON ? result.integrityActual : void 0);
27848
27949
  const buffer2 = result.encode();
27849
27950
  this.cache.set(
27850
27951
  key,
@@ -27853,9 +27954,7 @@ var RegistryClient = class {
27853
27954
  buffer2.byteOffset,
27854
27955
  buffer2.byteLength
27855
27956
  ),
27856
- {
27857
- integrity: result.integrity
27858
- }
27957
+ { integrity: integrity2 }
27859
27958
  );
27860
27959
  }
27861
27960
  return result;
@@ -0,0 +1,75 @@
1
+ var global = globalThis;
2
+ import {Buffer} from "node:buffer";
3
+ import {setTimeout as _vlt_setTimeout,clearTimeout as _vlt_clearTimeout,setImmediate as _vlt_setImmediate,clearImmediate as _vlt_clearImmediate,setInterval as _vlt_setInterval,clearInterval as _vlt_clearInterval} from "node:timers";
4
+ globalThis.setTimeout = _vlt_setTimeout;
5
+ globalThis.clearTimeout = _vlt_clearTimeout;
6
+ globalThis.setImmediate = _vlt_setImmediate;
7
+ globalThis.clearImmediate = _vlt_clearImmediate;
8
+ globalThis.setInterval = _vlt_setInterval;
9
+ globalThis.clearInterval = _vlt_clearInterval;
10
+ import {createRequire as _vlt_createRequire} from "node:module";
11
+ var require = _vlt_createRequire(import.meta.filename);
12
+ import {
13
+ error
14
+ } from "./chunk-WZWDS3W4.js";
15
+ import {
16
+ __glob
17
+ } from "./chunk-PZLD7RTK.js";
18
+
19
+ // import("./commands/**/*.ts") in ../../src/cli-sdk/src/load-command.ts
20
+ var globImport_commands_ts = __glob({
21
+ "./commands/access.ts": () => import("./access-HIVJOWXZ.js"),
22
+ "./commands/bugs.ts": () => import("./bugs-2KFUYMPS.js"),
23
+ "./commands/build.ts": () => import("./build-CX6YZ4LS.js"),
24
+ "./commands/cache.ts": () => import("./cache-I6L5ZRGD.js"),
25
+ "./commands/ci.ts": () => import("./ci-BX54SEU3.js"),
26
+ "./commands/config.ts": () => import("./config-WBVJX42R.js"),
27
+ "./commands/create.ts": () => import("./create-W67HRHWZ.js"),
28
+ "./commands/deprecate.ts": () => import("./deprecate-5T6JTGJ3.js"),
29
+ "./commands/dist-tag.ts": () => import("./dist-tag-YIZTS7GF.js"),
30
+ "./commands/docs.ts": () => import("./docs-G7CKMPCL.js"),
31
+ "./commands/exec-cache.ts": () => import("./exec-cache-6ENHAGC6.js"),
32
+ "./commands/exec-local.ts": () => import("./exec-local-OXG3PSLF.js"),
33
+ "./commands/exec.ts": () => import("./exec-YYCAZZ6Z.js"),
34
+ "./commands/help.ts": () => import("./help-RMOIAILM.js"),
35
+ "./commands/init.ts": () => import("./init-UPEQXC4D.js"),
36
+ "./commands/install.ts": () => import("./install-U7LLEQU6.js"),
37
+ "./commands/install/reporter.ts": () => import("./reporter-VQU7HYKM.js"),
38
+ "./commands/list.ts": () => import("./list-N6CKPXTK.js"),
39
+ "./commands/login.ts": () => import("./login-MCO4ZLVF.js"),
40
+ "./commands/logout.ts": () => import("./logout-BJ4QRZYG.js"),
41
+ "./commands/pack.ts": () => import("./pack-U6PYRFZ6.js"),
42
+ "./commands/ping.ts": () => import("./ping-VFB6SCMH.js"),
43
+ "./commands/pkg.ts": () => import("./pkg-ZNK5SCF4.js"),
44
+ "./commands/profile.ts": () => import("./profile-TW32HLYA.js"),
45
+ "./commands/publish.ts": () => import("./publish-AHOITWZQ.js"),
46
+ "./commands/query.ts": () => import("./query-KKP5PNSQ.js"),
47
+ "./commands/registry.ts": () => import("./registry-VHB65BWD.js"),
48
+ "./commands/repo.ts": () => import("./repo-BHTVK5KE.js"),
49
+ "./commands/run-exec.ts": () => import("./run-exec-NOCIUNGL.js"),
50
+ "./commands/run.ts": () => import("./run-UD32OTUJ.js"),
51
+ "./commands/setup.ts": () => import("./setup-PBCWOSTV.js"),
52
+ "./commands/token.ts": () => import("./token-PCPB6NOL.js"),
53
+ "./commands/uninstall.ts": () => import("./uninstall-LOGSQXFS.js"),
54
+ "./commands/unpublish.ts": () => import("./unpublish-O3UFCTEJ.js"),
55
+ "./commands/update.ts": () => import("./update-WBCLWGLN.js"),
56
+ "./commands/version.ts": () => import("./version-S3LCB2TQ.js"),
57
+ "./commands/view.ts": () => import("./view-LMPENVAJ.js"),
58
+ "./commands/whoami.ts": () => import("./whoami-LYMG7R3P.js")
59
+ });
60
+
61
+ // ../../src/cli-sdk/src/load-command.ts
62
+ var loadCommand = async (command) => {
63
+ try {
64
+ return await globImport_commands_ts(`./commands/${command}.ts`);
65
+ } catch (e) {
66
+ throw error("Could not load command", {
67
+ found: command,
68
+ cause: e
69
+ });
70
+ }
71
+ };
72
+
73
+ export {
74
+ loadCommand
75
+ };
@@ -11,7 +11,7 @@ import {createRequire as _vlt_createRequire} from "node:module";
11
11
  var require = _vlt_createRequire(import.meta.filename);
12
12
  import {
13
13
  stderr
14
- } from "./chunk-LR42WTKN.js";
14
+ } from "./chunk-MJWUULO6.js";
15
15
  import {
16
16
  urlOpen
17
17
  } from "./chunk-APMYKJI2.js";
@@ -12,7 +12,7 @@ var require = _vlt_createRequire(import.meta.filename);
12
12
  import {
13
13
  commandAliases,
14
14
  jack
15
- } from "./chunk-CEHPRPGQ.js";
15
+ } from "./chunk-ENSGPOLR.js";
16
16
 
17
17
  // ../../src/cli-sdk/src/config/usage.ts
18
18
  var toArr = (v) => Array.isArray(v) ? v : [v];
@@ -14,12 +14,12 @@ import {
14
14
  } from "./chunk-RIYFGX27.js";
15
15
  import {
16
16
  createHostContextsMap
17
- } from "./chunk-3LUM7NX5.js";
17
+ } from "./chunk-2HXJ4ZSF.js";
18
18
  import {
19
19
  stderr,
20
20
  stdout,
21
21
  styleTextStdout
22
- } from "./chunk-LR42WTKN.js";
22
+ } from "./chunk-MJWUULO6.js";
23
23
  import {
24
24
  require_emoji_regex
25
25
  } from "./chunk-VTEFO2FT.js";
@@ -27,13 +27,13 @@ import {
27
27
  Query,
28
28
  actual,
29
29
  isRunResult
30
- } from "./chunk-JZJWASXL.js";
30
+ } from "./chunk-J2WL3A3C.js";
31
31
  import {
32
32
  Monorepo
33
- } from "./chunk-X2AWQGYG.js";
33
+ } from "./chunk-P4LLYWCG.js";
34
34
  import {
35
35
  isErrorWithCause
36
- } from "./chunk-VFBCWAOC.js";
36
+ } from "./chunk-RH2Y7MPW.js";
37
37
  import {
38
38
  error
39
39
  } from "./chunk-WZWDS3W4.js";