@vltpkg/cli-js 1.1.1 → 1.3.0

package/{chunk-LN2A74PF.js → chunk-SVMH3NDM.js}

@@ -20,22 +20,27 @@ import {
   pickManifest,
   resolve,
   revs
-} from "./chunk-X2AWQGYG.js";
+} from "./chunk-P4LLYWCG.js";
 import {
   Spec
-} from "./chunk-XKVU23NC.js";
+} from "./chunk-V7EQZOO5.js";
 import {
-  registryErrorMessage
-} from "./chunk-SNOBGFNM.js";
+  registryErrorMessage,
+  storeRoot,
+  tokenRefusalAdvice
+} from "./chunk-ZNUXDX6R.js";
 import {
   logRequest
 } from "./chunk-U7TEQCBN.js";
-import {
-  asPackument
-} from "./chunk-VFBCWAOC.js";
 import {
   XDG
 } from "./chunk-XNLSTHDK.js";
+import {
+  asPackument,
+  brotliTarballUrl,
+  integrityHex,
+  tarballFormat
+} from "./chunk-RH2Y7MPW.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
@@ -63,6 +68,59 @@ import {
 } from "node:path";
 import { debuglog } from "node:util";
 
+// ../../src/package-info/src/capabilities.ts
+var none = Object.freeze({});
+var asked = /* @__PURE__ */ new Map();
+var known = /* @__PURE__ */ new Map();
+var peekCapabilities = (client, registry) => {
+  const url = capabilitiesUrl(registry);
+  const seen = known.get(url);
+  if (seen) return seen;
+  void getCapabilities(client, registry);
+  return void 0;
+};
+var getCapabilities = async (client, registry) => {
+  const url = capabilitiesUrl(registry);
+  const seen = asked.get(url);
+  if (seen) return seen;
+  const doc = fetchCapabilities(client, url).then((caps) => {
+    known.set(url, caps);
+    return caps;
+  });
+  asked.set(url, doc);
+  return doc;
+};
+var capabilitiesUrl = (registry) => String(new URL("-/vlt/capabilities", registry));
+var fetchCapabilities = async (client, url) => {
+  try {
+    const response = await client.request(url, {
+      headers: { accept: "application/json" }
+    });
+    if (response.statusCode !== 200) return none;
+    return asCapabilities(response.json());
+  } catch {
+    return none;
+  }
+};
+var asCapabilities = (body) => {
+  if (typeof body !== "object" || body === null) return none;
+  const doc = body;
+  const caps = {};
+  for (const key of [
+    "manifests",
+    "resolve",
+    "stable-filter"
+  ]) {
+    const version = doc[key];
+    if (typeof version === "string") caps[key] = version;
+  }
+  const { mimeTypes } = doc;
+  if (Array.isArray(mimeTypes) && mimeTypes.every((type) => typeof type === "string")) {
+    caps.mimeTypes = mimeTypes;
+  }
+  return caps;
+};
+
 // ../../src/package-info/src/rename.ts
 import { rename as fsRename, rm } from "node:fs/promises";
 var { platform } = process;
@@ -86,13 +144,20 @@ var rename = platform !== "win32" ? fsRename : (async function(oldPath, newPath)
 var debug = debuglog("vlt");
 var xdg = new XDG("vlt");
 var delimiter = "~";
-var PACKUMENT_ACCEPT = "application/vnd.vlt.packument-v1+json; q=1.0, application/json; q=0.8, */*; q=0.1";
+var VLT_PACKUMENT_MIME = "application/vnd.vlt.packument-v1+json";
+var PACKUMENT_ACCEPT = `${VLT_PACKUMENT_MIME}; q=1.0, application/json; q=0.8, */*; q=0.1`;
 var manifestCacheMaxAge = 5 * 60 * 1e3;
 var noRegistryError = (spec) => error(
   'No registry configured to resolve this spec. Set "registry" in vlt.json, pass --registry, or run `vlt login --registry=<url>`. See https://docs.vlt.sh/cli',
   { code: "ECONFIG", spec }
 );
 var isMovingSelector = (f) => !!(f.distTag || f.range?.isAny);
+var isStableSelector = (f) => {
+  const { range } = f;
+  if (!range) return false;
+  return !range.isAny && !range.raw.includes("-");
+};
+var storeLinkers = /* @__PURE__ */ new Set(["auto", "hardlink", "copy"]);
 var PackageInfoClient = class {
   #registryClient;
   #projectRoot;
@@ -102,8 +167,26 @@ var PackageInfoClient = class {
   packageJson;
   monorepo;
   #trustedIntegrities = /* @__PURE__ */ new Map();
+  // `${registry}${name}` of every packument served as VLT_PACKUMENT_MIME
+  #vltPackuments = /* @__PURE__ */ new Set();
   #manifestCacheMinAge = Date.now() - manifestCacheMaxAge;
   #cachePath;
+  #storeRoot;
+  #storeLinker;
+  #storeHits = { link: 0, copy: 0 };
+  #storeMisses = 0;
+  #storeHitRateLogged = false;
+  #logStoreHitRate = () => {
+    const { link, copy } = this.#storeHits;
+    const n = Math.max(1, link + copy + this.#storeMisses);
+    debug(
+      "global store: linked=%d copied=%d missed=%d hit rate=%s%%",
+      link,
+      copy,
+      this.#storeMisses,
+      ((link + copy) / n * 100).toFixed(1)
+    );
+  };
   // In-flight coalescing key is `${registry}${name}` — no representation
   // component. Safe only because every caller requests the same full
   // packument (see #fetchPackument). The one thing that does vary per
@@ -123,15 +206,47 @@ var PackageInfoClient = class {
   #tarPoolPromise;
   async getRegistryClient() {
     if (this.#registryClient) return this.#registryClient;
-    this.#registryClientPromise ??= import("./src-3GN7TDNH.js").then(({ RegistryClient }) => {
+    this.#registryClientPromise ??= import("./src-Z44JKVWS.js").then(({ RegistryClient }) => {
       this.#registryClient = new RegistryClient(this.options);
       return this.#registryClient;
     });
     return this.#registryClientPromise;
   }
+  /**
+   * The vlt extensions `registry` serves, from its
+   * `GET /-/vlt/capabilities` document. A registry that does not answer
+   * one reads as an empty document, so a missing key means unsupported.
+   */
+  async capabilities(registry) {
+    return getCapabilities(await this.getRegistryClient(), registry);
+  }
+  /**
+   * Whether the packument for `f` can be fetched with `?stable`: the
+   * selector has to be one a prerelease cannot answer, and the registry
+   * must not have told us it does not serve the filter.
+   *
+   * Never waits on the capability document, which would put a round trip in
+   * front of the first packument of every cold install. Until that document
+   * arrives the answer is yes: a registry that does not know `?stable`
+   * ignores the parameter and serves the full packument, which resolution
+   * reads just as well. Once the document does arrive it is authoritative,
+   * so a registry that does not serve the filter stops being asked with it.
+   */
+  #stable(f) {
+    const { registry } = f;
+    if (!registry || !isStableSelector(f)) return false;
+    const client = this.#registryClient;
+    if (!client) {
+      void this.capabilities(registry).catch(() => {
+      });
+      return true;
+    }
+    const caps = peekCapabilities(client, registry);
+    return !caps || !!caps["stable-filter"];
+  }
   async getTarPool() {
     if (this.#tarPool) return this.#tarPool;
-    this.#tarPoolPromise ??= import("./src-MOKZQTH2.js").then(
+    this.#tarPoolPromise ??= import("./src-T5FBZFMV.js").then(
       ({ Pool }) => {
         this.#tarPool = new Pool();
         return this.#tarPool;
@@ -139,6 +254,17 @@ var PackageInfoClient = class {
     );
     return this.#tarPoolPromise;
   }
+  /**
+   * The absolute URL of a version's Brotli (`.tar.br`) tarball, or
+   * undefined when the registry advertised none, advertised one this
+   * client does not use (see {@link brotliTarballUrl}), or
+   * `--no-brotli-tarballs` is set. `dist.tarball` is already absolute
+   * here -- see `absolutizeTarballs`.
+   */
+  #brotliTarball(tarball, alternates) {
+    if (this.options["brotli-tarballs"] === false) return void 0;
+    return brotliTarballUrl(tarball, alternates);
+  }
   constructor(options = {}) {
     this.options = options;
     this.#projectRoot = options.projectRoot || process.cwd();
@@ -154,6 +280,9 @@ var PackageInfoClient = class {
       packageJson: this.packageJson
     });
     this.#cachePath = options.cache ?? xdg.cache();
+    this.#storeRoot = options.storeRoot ?? storeRoot(this.#cachePath);
+    const linker = options["store-linker"];
+    this.#storeLinker = linker && storeLinkers.has(linker) ? linker : "unpack";
     void mkdir(pathResolve(this.#cachePath, "package-info"), {
       recursive: true
     }).catch(() => {
@@ -166,11 +295,17 @@ var PackageInfoClient = class {
       from = this.#projectRoot,
       integrity,
       resolved,
-      fromLockfile = false
+      fromLockfile = false,
+      installScripts = false
     } = options;
     const f = spec.final;
-    const alreadyResolved = !!(integrity && resolved);
-    const r = alreadyResolved ? { resolved, integrity, spec } : await this.resolve(spec, options);
+    const brotli = !!resolved && tarballFormat(resolved) === "brotli";
+    const r = resolved && (integrity || brotli) ? {
+      resolved,
+      integrity,
+      spec,
+      ...brotli && !integrity ? { digestRequired: true } : {}
+    } : await this.resolve(spec, options);
     switch (f.type) {
       case "git": {
         const {
@@ -204,14 +339,45 @@ var PackageInfoClient = class {
         }
       }
       case "registry": {
-        const cached = (await this.getRegistryClient()).cachedBody(
-          r.resolved,
-          { integrity: r.integrity }
-        );
+        const pool = await this.getTarPool();
+        const format = tarballFormat(r.resolved);
+        const hex = f.type === "registry" && this.#storeLinker !== "unpack" ? integrityHex(r.integrity) : void 0;
+        const copy = this.#storeLinker === "copy" || installScripts;
+        if (hex) {
+          if (debug.enabled && !this.#storeHitRateLogged) {
+            this.#storeHitRateLogged = true;
+            process.once("beforeExit", this.#logStoreHitRate);
+          }
+          const linked = await pool.linkFromStore(
+            pathResolve(this.#storeRoot, hex),
+            target,
+            { copy }
+          );
+          if (linked) {
+            const { how, index } = linked;
+            this.#storeHits[how]++;
+            logRequest(r.resolved, how === "link" ? "store" : "cache");
+            return {
+              ...r,
+              manifest: index.manifest,
+              // implies scripts, so most packages skip the scan
+              bindingGyp: index.scripts && index.files.some((f2) => f2[0] === "binding.gyp")
+            };
+          }
+          this.#storeMisses++;
+        }
+        const rc = await this.getRegistryClient();
+        const cached = rc.cachedBody(r.resolved, {
+          integrity: r.integrity
+        });
         if (cached) {
           try {
-            await (await this.getTarPool()).unpack(cached.body, target);
+            await pool.unpack(cached.body, target, format);
             logRequest(r.resolved, "cache");
+            r.integrity ??= cached.integrity;
+            if (hex || cached.gzip) {
+              rc.queueForStore(cached.key, r.integrity);
+            }
             return r;
           } catch (er) {
             debug(
@@ -226,6 +392,7 @@ var PackageInfoClient = class {
           const response = await (await this.getRegistryClient()).request(r.resolved, {
             integrity: r.integrity,
             trustIntegrity,
+            verifyDigest: r.digestRequired ? "required" : true,
             ...useCache === false ? { useCache } : {}
           });
           if (response.statusCode !== 200) {
@@ -239,26 +406,33 @@ var PackageInfoClient = class {
               }
             );
           }
-          if (!trustIntegrity && response.checkIntegrity({ spec, url: resolved })) {
+          const verified = !trustIntegrity && response.checkIntegrity({ spec, url: resolved });
+          if (verified) {
             this.#trustedIntegrities.set(
               r.resolved,
               response.integrity
             );
           }
           const buf2 = response.buffer();
-          if (r.integrity && !fromLockfile && !response.fromCache) {
-            const hash = createHash("sha512");
-            hash.update(buf2);
-            const computed = `sha512-${hash.digest("base64")}`;
-            if (computed !== r.integrity) {
-              throw error("Tarball integrity check failed", {
-                code: "EINTEGRITY",
-                spec,
-                url: r.resolved,
-                wanted: r.integrity,
-                found: computed
-              });
+          if (r.integrity) {
+            if (!verified && !fromLockfile && !response.fromCache) {
+              const hash = createHash("sha512");
+              hash.update(buf2);
+              const computed = `sha512-${hash.digest("base64")}`;
+              if (computed !== r.integrity) {
+                throw error("Tarball integrity check failed", {
+                  code: "EINTEGRITY",
+                  spec,
+                  url: r.resolved,
+                  wanted: r.integrity,
+                  found: computed
+                });
+              }
             }
+          } else if (response.fromCache) {
+            r.integrity = response.integrity;
+          } else {
+            r.integrity = response.integrityActual;
           }
           return buf2;
         };
@@ -273,7 +447,7 @@ var PackageInfoClient = class {
           }
         }
         try {
-          await (await this.getTarPool()).unpack(buf, target);
+          await pool.unpack(buf, target, format);
         } catch (er) {
           throw this.#resolveError(
             spec,
@@ -460,6 +634,9 @@ var PackageInfoClient = class {
             ...options,
             integrity,
             trustIntegrity,
+            // no dist.integrity: checked against the digest the registry
+            // sent with it instead, before the client caches it
+            verifyDigest: this.#vltPackuments.has(`${f.registry}${f.name}`) ? "required" : true,
             ...useCache === false ? { useCache } : {}
           });
           if (response.statusCode !== 200) {
@@ -470,11 +647,12 @@ var PackageInfoClient = class {
               { response, url: tarball }
             );
           }
-          if (!trustIntegrity && response.checkIntegrity({ spec, url: tarball })) {
+          const verified = !trustIntegrity && response.checkIntegrity({ spec, url: tarball });
+          if (verified) {
             this.#trustedIntegrities.set(tarball, response.integrity);
           }
           const buf = response.buffer();
-          if (integrity && !response.fromCache) {
+          if (integrity && !verified && !response.fromCache) {
             const hash = createHash("sha512");
             hash.update(buf);
             const computed = `sha512-${hash.digest("base64")}`;
@@ -595,21 +773,30 @@ var PackageInfoClient = class {
               });
               throw new Error("manifest cache expired");
             }
+            if (json.__VLT_PACKUMENT) {
+              this.#vltPackuments.add(`${f.registry}${f.name}`);
+              delete json.__VLT_PACKUMENT;
+            }
             return json;
           } catch {
           }
         }
         const mani = pickManifest(
-          await this.packument(f, options),
+          await this.#packument(f, options, this.#stable(f)),
           spec,
           options
         );
         if (!mani) throw this.#resolveError(spec, options);
         if (cachePath && !this.#manifestWritePaths.has(cachePath)) {
           this.#manifestWritePaths.add(cachePath);
+          const vlt = this.#vltPackuments.has(
+            `${f.registry}${f.name}`
+          );
           void this.#writeManifestCache(
             cachePath,
-            JSON.stringify(mani)
+            JSON.stringify(
+              vlt ? { ...mani, __VLT_PACKUMENT: true } : mani
+            )
           );
         }
         return mani;
@@ -699,7 +886,15 @@ var PackageInfoClient = class {
       }
     }
   }
+  /**
+   * The packument for `spec`, with every version the registry has. Callers
+   * that only pick a manifest out of it go through `#packument` instead,
+   * which can ask for the prerelease-free one.
+   */
   async packument(spec, options = {}) {
+    return this.#packument(spec, options, false);
+  }
+  async #packument(spec, options, stable) {
     if (typeof spec === "string")
       spec = Spec.parse(spec, this.options);
     const f = spec.final;
@@ -738,12 +933,25 @@ var PackageInfoClient = class {
       case "registry": {
         const { registry, name } = f;
         if (!registry) throw noRegistryError(spec);
-        const packumentKey = `${registry}${name}`;
+        if (options.full)
+          return this.#fetchPackument(
+            spec,
+            options,
+            new URL(name, registry)
+          );
+        const fullKey = `${registry}${name}`;
+        const packumentKey = stable ? `${fullKey}?stable` : fullKey;
         const forced = isMovingSelector(f);
-        const inflight = this.#packumentPromises.get(packumentKey);
+        const inflight = this.#packumentPromises.get(packumentKey) ?? // the full packument is a superset of the stable one, so an
+        // in-flight full request answers a stable ask too, and a package
+        // wanted both ways is still fetched once
+        (stable ? this.#packumentPromises.get(fullKey) : void 0);
         if (inflight && (!forced || inflight.forced))
           return inflight.promise;
-        const pakuURL = new URL(name, registry);
+        const pakuURL = new URL(
+          stable ? `${name}?stable` : name,
+          registry
+        );
         const promise = this.#fetchPackument(spec, options, pakuURL);
         const record = { promise, forced };
         this.#packumentPromises.set(packumentKey, record);
@@ -759,8 +967,10 @@ var PackageInfoClient = class {
   }
   async #fetchPackument(spec, options, pakuURL, useCache) {
     const response = await (await this.getRegistryClient()).request(pakuURL, {
-      headers: { accept: PACKUMENT_ACCEPT },
-      ...useCache === false ? { useCache } : {},
+      headers: {
+        accept: options.full ? "application/json" : PACKUMENT_ACCEPT
+      },
+      ...useCache === false || options.full ? { useCache: false } : {},
       // costs a conditional GET per moving selector on an otherwise warm
       // cache, install included. 304s are cheap but not free; the
       // alternative is serving a dist tag that moved (#1656).
@@ -777,14 +987,21 @@ var PackageInfoClient = class {
         }
       );
     }
+    let paku;
     try {
-      return response.json();
+      paku = response.json();
     } catch (er) {
       if (useCache !== false) {
         return this.#fetchPackument(spec, options, pakuURL, false);
       }
       throw er;
     }
+    const { registry, name } = spec.final;
+    if (response.contentType.startsWith(VLT_PACKUMENT_MIME)) {
+      this.#vltPackuments.add(`${registry}${name}`);
+    }
+    if (registry) absolutizeTarballs(paku, registry);
+    return paku;
   }
   async resolve(spec, options = {}) {
     const memoKey = String(spec);
@@ -831,14 +1048,13 @@ var PackageInfoClient = class {
       case "registry": {
         const mani = await this.manifest(spec, options);
         if (mani.dist) {
-          const { integrity, tarball, signatures } = mani.dist;
+          const { integrity, tarball, signatures, alternates } = mani.dist;
           if (tarball) {
-            const r = {
-              resolved: tarball,
-              integrity,
-              signatures,
-              spec
-            };
+            const brotli = this.#brotliTarball(tarball, alternates);
+            const r = brotli ? { resolved: brotli, spec, digestRequired: true } : { resolved: tarball, integrity, signatures, spec };
+            if (!brotli && !integrity && this.#vltPackuments.has(`${f.registry}${f.name}`)) {
+              r.digestRequired = true;
+            }
             this.#resolutions.set(memoKey, r);
             return r;
           }
@@ -922,8 +1138,10 @@ var PackageInfoClient = class {
   // error resolving
   #resolveError(spec, options = {}, message = "Could not resolve", extra = {}) {
     const { from = this.#projectRoot } = options;
+    const advice = spec?.final.type === "registry" ? tokenRefusalAdvice(extra.response, extra.url) : void 0;
     const er = error(
-      message,
+      advice ? `${message}
+\u26A0\uFE0F ${advice}` : message,
       {
         code: "ERESOLVE",
         spec,
@@ -935,6 +1153,15 @@ var PackageInfoClient = class {
     return er;
   }
 };
+var absolutizeTarballs = (paku, registry) => {
+  const base = registry.endsWith("/") ? registry : registry + "/";
+  for (const { dist } of Object.values(paku.versions)) {
+    const tarball = dist?.tarball;
+    if (tarball && !/^[a-z][a-z0-9+.-]*:/i.test(tarball)) {
+      dist.tarball = String(new URL(tarball, base));
+    }
+  }
+};
 
 export {
   PackageInfoClient

package/{chunk-DR4Z63B6.js → chunk-TYLYZKVA.js}

@@ -12,15 +12,16 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   init,
   install
-} from "./chunk-JZJWASXL.js";
+} from "./chunk-J2WL3A3C.js";
 import {
   commandUsage
-} from "./chunk-CBASIDQH.js";
+} from "./chunk-I6QGYSB4.js";
 import {
-  asWSConfig,
   assertWSConfig,
-  minimatch
-} from "./chunk-X2AWQGYG.js";
+  minimatch,
+  resolveWSConfig,
+  splitNegatedPatterns
+} from "./chunk-P4LLYWCG.js";
 import {
   load,
   save
@@ -74,8 +75,11 @@ Modify/add properties using \`vlt pkg\`. For example:
 var command = async (conf) => {
   const allowScripts = conf.get("allow-scripts") ? String(conf.get("allow-scripts")) : ":not(*)";
   if (conf.values.workspace?.length) {
-    const workspacesConfig = load("workspaces", assertWSConfig);
-    const parsedWSConfig = asWSConfig(workspacesConfig ?? {});
+    const { config: parsedWSConfig, source } = resolveWSConfig(
+      conf.options.projectRoot,
+      conf.options.packageJson
+    );
+    const workspacesConfig = load("workspaces", assertWSConfig) ?? (source === "package.json" ? Object.values(parsedWSConfig).flat() : void 0);
     const results = [];
     const addToConfig = [];
     for (const workspace of conf.values.workspace) {
@@ -83,10 +87,9 @@ var command = async (conf) => {
       mkdirSync(cwd, { recursive: true });
       results.push(await init({ cwd }));
       const isMatched = Object.values(parsedWSConfig).some(
-        (patterns) => {
-          return patterns.some(
-            (pattern) => minimatch(workspace, pattern)
-          );
+        (group) => {
+          const { patterns, ignore } = splitNegatedPatterns(group);
+          return patterns.some((pattern) => minimatch(workspace, pattern)) && !ignore.some((pattern) => minimatch(workspace, pattern));
         }
       );
       if (!isMatched) {

package/{chunk-XKVU23NC.js → chunk-V7EQZOO5.js}

@@ -12,7 +12,7 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   Spec,
   kCustomInspect
-} from "./chunk-VFBCWAOC.js";
+} from "./chunk-RH2Y7MPW.js";
 
 // ../../src/spec/src/index.ts
 import { homedir } from "node:os";

package/{chunk-YBVTY6ZW.js → chunk-VBADA6QU.js}

@@ -14,7 +14,7 @@ var require = _vlt_createRequire(import.meta.filename);
 var package_default = {
   name: "@vltpkg/user-agent",
   description: "The User-Agent string that vlt sends with every outbound request",
-  version: "1.1.1",
+  version: "1.3.0",
   repository: {
     type: "git",
     url: "git+https://github.com/vltpkg/vltpkg.git",

package/{chunk-GDT6KI4I.js → chunk-W6UMN2YJ.js}

@@ -11,19 +11,19 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   openUrl
-} from "./chunk-BWEH7DHQ.js";
+} from "./chunk-HCZOVC3Y.js";
 import {
   stderr
-} from "./chunk-LR42WTKN.js";
+} from "./chunk-MJWUULO6.js";
 import {
   mermaidOutput
-} from "./chunk-JZJWASXL.js";
+} from "./chunk-J2WL3A3C.js";
 import {
   ViewClass
 } from "./chunk-4KCU2KZL.js";
 import {
   getTokenByURL
-} from "./chunk-DS7YMIHP.js";
+} from "./chunk-FHMIECHI.js";
 
 // ../../src/cli-sdk/src/query-auth.ts
 var createGetAuthHeader = (conf) => async (url) => getTokenByURL(url, conf.options.identity);

package/{chunk-VE6CCH33.js → chunk-Y5PA7DVK.js}

@@ -2995,6 +2995,7 @@ var Ze = Object.assign(Je, { glob: Je, globSync: ts, sync: Ui, globStream: Qe, s
 Ze.glob = Ze;
 
 export {
+  ot,
   ts,
   Ze
 };