@vltpkg/cli-js 1.3.0 → 1.3.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (78) hide show
  1. package/{access-HIVJOWXZ.js → access-M5BOAKLX.js} +6 -6
  2. package/{bugs-2KFUYMPS.js → bugs-QZ5NURDC.js} +14 -14
  3. package/{build-CX6YZ4LS.js → build-CEAMZG7H.js} +7 -7
  4. package/{cache-I6L5ZRGD.js → cache-ILCET6EY.js} +10 -10
  5. package/{chunk-ILRJWH6A.js → chunk-2UW4UIVL.js} +5 -5
  6. package/{chunk-VBADA6QU.js → chunk-3NWCWTIU.js} +1 -1
  7. package/{chunk-YZWFWSY7.js → chunk-4FHGRT4J.js} +5 -5
  8. package/{chunk-W6UMN2YJ.js → chunk-4QYSZZZQ.js} +4 -4
  9. package/{chunk-JFHEXCG5.js → chunk-4WQ76RJD.js} +3 -3
  10. package/{chunk-V7EQZOO5.js → chunk-64VFL4WI.js} +1 -1
  11. package/{chunk-RH2Y7MPW.js → chunk-BP3PQ67D.js} +9 -1
  12. package/{chunk-P4LLYWCG.js → chunk-BUKZHMMK.js} +3 -3
  13. package/{chunk-33HBY5CF.js → chunk-CRGWLUGC.js} +1 -1
  14. package/{chunk-MJWUULO6.js → chunk-CSZTT7QN.js} +4 -4
  15. package/{chunk-TYLYZKVA.js → chunk-E53Z7AF6.js} +2 -2
  16. package/{chunk-2HXJ4ZSF.js → chunk-EJFGJ543.js} +3 -3
  17. package/{chunk-C6LK7C3L.js → chunk-HBB2ECAT.js} +3 -3
  18. package/{chunk-J2WL3A3C.js → chunk-IIXKXSLE.js} +9 -14
  19. package/{chunk-D2LEK7VS.js → chunk-J4NHRZX6.js} +1 -1
  20. package/{chunk-J3R4XWB3.js → chunk-JIQBZ2UT.js} +2 -2
  21. package/{chunk-QWJDHBV7.js → chunk-KH3ERNCA.js} +2 -2
  22. package/{chunk-HCZOVC3Y.js → chunk-MC6CESRA.js} +1 -1
  23. package/{chunk-QETVMIIT.js → chunk-NAVFU65Z.js} +4 -4
  24. package/{chunk-FHMIECHI.js → chunk-O63K3ZP6.js} +54 -7
  25. package/{chunk-ZNUXDX6R.js → chunk-PBBULTAG.js} +1 -1
  26. package/{chunk-EP7AVBIO.js → chunk-QX6KMBTX.js} +5 -5
  27. package/chunk-TGOC27YZ.js +75 -0
  28. package/{chunk-N4RCKCHY.js → chunk-USLE2NXK.js} +7 -2
  29. package/{chunk-263MHLR3.js → chunk-X2WYIUFQ.js} +1 -1
  30. package/{chunk-SVMH3NDM.js → chunk-ZMRJRQDK.js} +41 -20
  31. package/{ci-BX54SEU3.js → ci-4AI6XHRE.js} +20 -16
  32. package/cli-package.json +1 -1
  33. package/{config-HFF6XDCV.js → config-PJVA5HZQ.js} +7 -7
  34. package/{config-WBVJX42R.js → config-UHPA5FHX.js} +8 -8
  35. package/{create-W67HRHWZ.js → create-NQNFYWOC.js} +15 -15
  36. package/{deprecate-5T6JTGJ3.js → deprecate-35D4AZFD.js} +9 -9
  37. package/{dist-tag-YIZTS7GF.js → dist-tag-W3AJECYB.js} +6 -6
  38. package/{docs-G7CKMPCL.js → docs-OFRPTPOG.js} +14 -14
  39. package/{exec-YYCAZZ6Z.js → exec-UTWGYF3B.js} +15 -15
  40. package/{exec-cache-6ENHAGC6.js → exec-cache-VLPJMK7E.js} +13 -13
  41. package/{exec-local-OXG3PSLF.js → exec-local-JKBHBKJZ.js} +12 -12
  42. package/{help-RMOIAILM.js → help-YRQQVODA.js} +1 -1
  43. package/{init-UPEQXC4D.js → init-2QZ5TITF.js} +8 -8
  44. package/{install-U7LLEQU6.js → install-QBVAEHTO.js} +14 -14
  45. package/{list-N6CKPXTK.js → list-P4UQWDX7.js} +15 -15
  46. package/{login-MCO4ZLVF.js → login-6KPWMFG4.js} +10 -10
  47. package/{logout-BJ4QRZYG.js → logout-KCYMUY6H.js} +6 -6
  48. package/{pack-U6PYRFZ6.js → pack-WQLFLOE2.js} +9 -9
  49. package/package.json +1 -1
  50. package/{ping-VFB6SCMH.js → ping-GYFPW4F5.js} +6 -6
  51. package/{pkg-ZNK5SCF4.js → pkg-KVQ6QMQH.js} +9 -9
  52. package/{profile-TW32HLYA.js → profile-APD6X27T.js} +6 -6
  53. package/{publish-AHOITWZQ.js → publish-EYKECRD3.js} +14 -14
  54. package/{query-KKP5PNSQ.js → query-3N5D2ZZW.js} +15 -15
  55. package/{registry-VHB65BWD.js → registry-MXAA4HVJ.js} +3 -3
  56. package/registry-client-src-revalidate.js +52 -5
  57. package/{repo-BHTVK5KE.js → repo-6B5W7Q2C.js} +14 -14
  58. package/{reporter-VQU7HYKM.js → reporter-ZEDO2YIG.js} +9 -9
  59. package/{run-UD32OTUJ.js → run-INZMUBF2.js} +12 -12
  60. package/{run-exec-NOCIUNGL.js → run-exec-RVYS73II.js} +12 -12
  61. package/security-archive-src-update-expired.js +1 -1
  62. package/{setup-PBCWOSTV.js → setup-Q7JD6XJV.js} +12 -12
  63. package/{src-Z44JKVWS.js → src-3UQFZRM3.js} +4 -4
  64. package/{src-LRKPUV4J.js → src-527GIT4Y.js} +12 -12
  65. package/{src-T5FBZFMV.js → src-EJSVFFXB.js} +2 -2
  66. package/{token-PCPB6NOL.js → token-5HFD3COV.js} +6 -6
  67. package/{uninstall-LOGSQXFS.js → uninstall-4R7Z2FD7.js} +10 -10
  68. package/{unpublish-O3UFCTEJ.js → unpublish-RBRQE53F.js} +6 -6
  69. package/{update-WBCLWGLN.js → update-7LXJAEJN.js} +13 -13
  70. package/{version-S3LCB2TQ.js → version-UHRS2KJX.js} +8 -8
  71. package/{view-LMPENVAJ.js → view-BNQKJF5L.js} +8 -8
  72. package/vlr.js +2 -1
  73. package/vlrx.js +2 -1
  74. package/vlt.js +2 -1
  75. package/vlx.js +2 -1
  76. package/vlxl.js +2 -1
  77. package/{whoami-LYMG7R3P.js → whoami-GYAT6NWM.js} +6 -6
  78. package/chunk-GDV5LSQ2.js +0 -75
@@ -18,10 +18,10 @@ import {
18
18
  statusText,
19
19
  storeRoot,
20
20
  tokenRefusal
21
- } from "./chunk-ZNUXDX6R.js";
21
+ } from "./chunk-PBBULTAG.js";
22
22
  import {
23
23
  userAgent
24
- } from "./chunk-VBADA6QU.js";
24
+ } from "./chunk-3NWCWTIU.js";
25
25
  import {
26
26
  I,
27
27
  logRequest
@@ -36,7 +36,7 @@ import {
36
36
  asError,
37
37
  integrityHex,
38
38
  integrityRE
39
- } from "./chunk-RH2Y7MPW.js";
39
+ } from "./chunk-BP3PQ67D.js";
40
40
  import {
41
41
  error
42
42
  } from "./chunk-WZWDS3W4.js";
@@ -26150,7 +26150,7 @@ var handleBeforeExit = () => {
26150
26150
  // ../../src/registry-client/src/index.ts
26151
26151
  var import_undici3 = __toESM(require_undici(), 1);
26152
26152
  import { randomUUID } from "node:crypto";
26153
- import { readFileSync as readFileSync2 } from "node:fs";
26153
+ import { closeSync, openSync, readFileSync as readFileSync2, readSync } from "node:fs";
26154
26154
  import { availableParallelism } from "node:os";
26155
26155
  import { dirname as dirname3, resolve as resolve4 } from "node:path";
26156
26156
  import { setTimeout as setTimeout2 } from "node:timers/promises";
@@ -26937,10 +26937,19 @@ var CacheEntry = class _CacheEntry {
26937
26937
  * i.e. a tarball the global store can be built from.
26938
26938
  */
26939
26939
  static isTarballEntry(buffer) {
26940
+ return !!_CacheEntry.tarballIntegrity(buffer);
26941
+ }
26942
+ /**
26943
+ * The hash recorded on such an entry, or undefined if this is not one.
26944
+ * {@link isTarballEntry} is built on this, and both only need the head.
26945
+ */
26946
+ static tarballIntegrity(buffer) {
26940
26947
  const parsed = _CacheEntry.#parseHead(buffer);
26941
- if (parsed?.statusCode !== 200 || !parsed.integrity) return false;
26948
+ if (parsed?.statusCode !== 200 || !parsed.integrity) {
26949
+ return void 0;
26950
+ }
26942
26951
  const ct = getRawHeader(parsed.headers, "content-type");
26943
- return !ct || !/\bjson\b/.test(getDecodedValue(ct));
26952
+ return !ct || !/\bjson\b/.test(getDecodedValue(ct)) ? parsed.integrity : void 0;
26944
26953
  }
26945
26954
  /**
26946
26955
  * Encode status + headers (no body) as they appear at the start of
@@ -27480,13 +27489,13 @@ var exchangeToken = async (idToken, packageName, registry) => {
27480
27489
  // ../../src/registry-client/src/index.ts
27481
27490
  var log3 = (msg) => console.error(msg);
27482
27491
  var isCacheableMethod = (m) => m === "GET" || m === "HEAD";
27492
+ var maxHeadSize = 1024 * 1024;
27483
27493
  var cacheKey = (method, url) => `${method !== "GET" ? method + " " : ""}${url}`;
27484
27494
  var agentOptions = {
27485
27495
  bodyTimeout: 6e5,
27486
27496
  headersTimeout: 6e5,
27487
27497
  keepAliveMaxTimeout: 12e5,
27488
27498
  keepAliveTimeout: 6e5,
27489
- keepAliveTimeoutThreshold: 3e4,
27490
27499
  connect: {
27491
27500
  timeout: 6e5,
27492
27501
  keepAlive: true,
@@ -27767,6 +27776,44 @@ var RegistryClient = class {
27767
27776
  response
27768
27777
  });
27769
27778
  }
27779
+ /**
27780
+ * The hash the cache recorded for `url`. This reads only the entry's
27781
+ * head, which is about a kilobyte, rather than the body, which can be a
27782
+ * megabyte. A caller that is about to look the package up in the global
27783
+ * store needs nothing else, and if the store misses it can still read
27784
+ * the body afterwards.
27785
+ *
27786
+ * Returns undefined if there is no entry, or if the entry is not a
27787
+ * tarball. This never reads the body, so if `cache-unzip` rewrote the
27788
+ * entry underneath us the worst case is a stale hash. That misses in the
27789
+ * store; it cannot return the wrong bytes.
27790
+ */
27791
+ cachedIntegrity(url, options = {}) {
27792
+ const { method = "GET" } = options;
27793
+ try {
27794
+ const key = cacheKey(
27795
+ method,
27796
+ typeof url === "string" ? new URL(url) : url
27797
+ );
27798
+ if (this.cache.peek(key)) return void 0;
27799
+ const fd = openSync(this.cache.path(key), "r");
27800
+ try {
27801
+ const size = Buffer.allocUnsafe(4);
27802
+ if (readSync(fd, size, 0, 4, 0) < 4) return void 0;
27803
+ const headSize = size.readUInt32BE(0);
27804
+ if (headSize < 7 || headSize > maxHeadSize) return void 0;
27805
+ const head = Buffer.allocUnsafe(headSize);
27806
+ if (readSync(fd, head, 0, headSize, 0) < headSize) {
27807
+ return void 0;
27808
+ }
27809
+ return CacheEntry.tarballIntegrity(head);
27810
+ } finally {
27811
+ closeSync(fd);
27812
+ }
27813
+ } catch {
27814
+ }
27815
+ return void 0;
27816
+ }
27770
27817
  /**
27771
27818
  * Read a valid cached non-JSON body straight off disk, bypassing the
27772
27819
  * in-memory cache LRU so that a tarball is never held in it.
@@ -12,7 +12,7 @@ var require = _vlt_createRequire(import.meta.filename);
12
12
  import {
13
13
  asError,
14
14
  isObject
15
- } from "./chunk-RH2Y7MPW.js";
15
+ } from "./chunk-BP3PQ67D.js";
16
16
  import {
17
17
  error
18
18
  } from "./chunk-WZWDS3W4.js";
@@ -11,17 +11,17 @@ import {createRequire as _vlt_createRequire} from "node:module";
11
11
  var require = _vlt_createRequire(import.meta.filename);
12
12
  import {
13
13
  PackageInfoClient
14
- } from "./chunk-SVMH3NDM.js";
14
+ } from "./chunk-ZMRJRQDK.js";
15
15
  import {
16
16
  findCmdShimIfExists,
17
17
  install
18
- } from "./chunk-J2WL3A3C.js";
18
+ } from "./chunk-IIXKXSLE.js";
19
19
  import {
20
20
  PathScurry
21
- } from "./chunk-P4LLYWCG.js";
21
+ } from "./chunk-BUKZHMMK.js";
22
22
  import {
23
23
  Spec
24
- } from "./chunk-V7EQZOO5.js";
24
+ } from "./chunk-64VFL4WI.js";
25
25
  import {
26
26
  walkUp
27
27
  } from "./chunk-HTOTG4TS.js";
@@ -30,7 +30,7 @@ import {
30
30
  } from "./chunk-XNLSTHDK.js";
31
31
  import {
32
32
  parseScope
33
- } from "./chunk-RH2Y7MPW.js";
33
+ } from "./chunk-BP3PQ67D.js";
34
34
  import {
35
35
  error
36
36
  } from "./chunk-WZWDS3W4.js";
@@ -0,0 +1,75 @@
1
+ var global = globalThis;
2
+ import {Buffer} from "node:buffer";
3
+ import {setTimeout as _vlt_setTimeout,clearTimeout as _vlt_clearTimeout,setImmediate as _vlt_setImmediate,clearImmediate as _vlt_clearImmediate,setInterval as _vlt_setInterval,clearInterval as _vlt_clearInterval} from "node:timers";
4
+ globalThis.setTimeout = _vlt_setTimeout;
5
+ globalThis.clearTimeout = _vlt_clearTimeout;
6
+ globalThis.setImmediate = _vlt_setImmediate;
7
+ globalThis.clearImmediate = _vlt_clearImmediate;
8
+ globalThis.setInterval = _vlt_setInterval;
9
+ globalThis.clearInterval = _vlt_clearInterval;
10
+ import {createRequire as _vlt_createRequire} from "node:module";
11
+ var require = _vlt_createRequire(import.meta.filename);
12
+ import {
13
+ error
14
+ } from "./chunk-WZWDS3W4.js";
15
+ import {
16
+ __glob
17
+ } from "./chunk-PZLD7RTK.js";
18
+
19
+ // import("./commands/**/*.ts") in ../../src/cli-sdk/src/load-command.ts
20
+ var globImport_commands_ts = __glob({
21
+ "./commands/access.ts": () => import("./access-M5BOAKLX.js"),
22
+ "./commands/bugs.ts": () => import("./bugs-QZ5NURDC.js"),
23
+ "./commands/build.ts": () => import("./build-CEAMZG7H.js"),
24
+ "./commands/cache.ts": () => import("./cache-ILCET6EY.js"),
25
+ "./commands/ci.ts": () => import("./ci-4AI6XHRE.js"),
26
+ "./commands/config.ts": () => import("./config-UHPA5FHX.js"),
27
+ "./commands/create.ts": () => import("./create-NQNFYWOC.js"),
28
+ "./commands/deprecate.ts": () => import("./deprecate-35D4AZFD.js"),
29
+ "./commands/dist-tag.ts": () => import("./dist-tag-W3AJECYB.js"),
30
+ "./commands/docs.ts": () => import("./docs-OFRPTPOG.js"),
31
+ "./commands/exec-cache.ts": () => import("./exec-cache-VLPJMK7E.js"),
32
+ "./commands/exec-local.ts": () => import("./exec-local-JKBHBKJZ.js"),
33
+ "./commands/exec.ts": () => import("./exec-UTWGYF3B.js"),
34
+ "./commands/help.ts": () => import("./help-YRQQVODA.js"),
35
+ "./commands/init.ts": () => import("./init-2QZ5TITF.js"),
36
+ "./commands/install.ts": () => import("./install-QBVAEHTO.js"),
37
+ "./commands/install/reporter.ts": () => import("./reporter-ZEDO2YIG.js"),
38
+ "./commands/list.ts": () => import("./list-P4UQWDX7.js"),
39
+ "./commands/login.ts": () => import("./login-6KPWMFG4.js"),
40
+ "./commands/logout.ts": () => import("./logout-KCYMUY6H.js"),
41
+ "./commands/pack.ts": () => import("./pack-WQLFLOE2.js"),
42
+ "./commands/ping.ts": () => import("./ping-GYFPW4F5.js"),
43
+ "./commands/pkg.ts": () => import("./pkg-KVQ6QMQH.js"),
44
+ "./commands/profile.ts": () => import("./profile-APD6X27T.js"),
45
+ "./commands/publish.ts": () => import("./publish-EYKECRD3.js"),
46
+ "./commands/query.ts": () => import("./query-3N5D2ZZW.js"),
47
+ "./commands/registry.ts": () => import("./registry-MXAA4HVJ.js"),
48
+ "./commands/repo.ts": () => import("./repo-6B5W7Q2C.js"),
49
+ "./commands/run-exec.ts": () => import("./run-exec-RVYS73II.js"),
50
+ "./commands/run.ts": () => import("./run-INZMUBF2.js"),
51
+ "./commands/setup.ts": () => import("./setup-Q7JD6XJV.js"),
52
+ "./commands/token.ts": () => import("./token-5HFD3COV.js"),
53
+ "./commands/uninstall.ts": () => import("./uninstall-4R7Z2FD7.js"),
54
+ "./commands/unpublish.ts": () => import("./unpublish-RBRQE53F.js"),
55
+ "./commands/update.ts": () => import("./update-7LXJAEJN.js"),
56
+ "./commands/version.ts": () => import("./version-UHRS2KJX.js"),
57
+ "./commands/view.ts": () => import("./view-BNQKJF5L.js"),
58
+ "./commands/whoami.ts": () => import("./whoami-GYAT6NWM.js")
59
+ });
60
+
61
+ // ../../src/cli-sdk/src/load-command.ts
62
+ var loadCommand = async (command) => {
63
+ try {
64
+ return await globImport_commands_ts(`./commands/${command}.ts`);
65
+ } catch (e) {
66
+ throw error("Could not load command", {
67
+ found: command,
68
+ cause: e
69
+ });
70
+ }
71
+ };
72
+
73
+ export {
74
+ loadCommand
75
+ };
@@ -9,17 +9,22 @@ globalThis.setInterval = _vlt_setInterval;
9
9
  globalThis.clearInterval = _vlt_clearInterval;
10
10
  import {createRequire as _vlt_createRequire} from "node:module";
11
11
  var require = _vlt_createRequire(import.meta.filename);
12
+ import {
13
+ XDG
14
+ } from "./chunk-XNLSTHDK.js";
12
15
 
13
16
  // ../build/src/bins.ts
14
17
  import module from "node:module";
15
18
  import { resolve } from "node:path";
16
- module.enableCompileCache();
19
+ if (module.enableCompileCache().status === module.constants.compileCacheStatus.FAILED) {
20
+ module.enableCompileCache(new XDG("vlt").cache("compile-cache"));
21
+ }
17
22
  var BINS_DIR = resolve(import.meta.dirname, "bins");
18
23
  var run = async (command) => {
19
24
  if (command) {
20
25
  process.argv.splice(2, 0, command);
21
26
  }
22
- const vlt = await import("./src-LRKPUV4J.js");
27
+ const vlt = await import("./src-527GIT4Y.js");
23
28
  await vlt.default();
24
29
  };
25
30
 
@@ -16,7 +16,7 @@ import {
16
16
  import {
17
17
  isManifest,
18
18
  normalizeBinPaths
19
- } from "./chunk-RH2Y7MPW.js";
19
+ } from "./chunk-BP3PQ67D.js";
20
20
  import {
21
21
  error
22
22
  } from "./chunk-WZWDS3W4.js";
@@ -20,15 +20,15 @@ import {
20
20
  pickManifest,
21
21
  resolve,
22
22
  revs
23
- } from "./chunk-P4LLYWCG.js";
23
+ } from "./chunk-BUKZHMMK.js";
24
24
  import {
25
25
  Spec
26
- } from "./chunk-V7EQZOO5.js";
26
+ } from "./chunk-64VFL4WI.js";
27
27
  import {
28
28
  registryErrorMessage,
29
29
  storeRoot,
30
30
  tokenRefusalAdvice
31
- } from "./chunk-ZNUXDX6R.js";
31
+ } from "./chunk-PBBULTAG.js";
32
32
  import {
33
33
  logRequest
34
34
  } from "./chunk-U7TEQCBN.js";
@@ -40,7 +40,7 @@ import {
40
40
  brotliTarballUrl,
41
41
  integrityHex,
42
42
  tarballFormat
43
- } from "./chunk-RH2Y7MPW.js";
43
+ } from "./chunk-BP3PQ67D.js";
44
44
  import {
45
45
  error
46
46
  } from "./chunk-WZWDS3W4.js";
@@ -145,7 +145,8 @@ var debug = debuglog("vlt");
145
145
  var xdg = new XDG("vlt");
146
146
  var delimiter = "~";
147
147
  var VLT_PACKUMENT_MIME = "application/vnd.vlt.packument-v1+json";
148
- var PACKUMENT_ACCEPT = `${VLT_PACKUMENT_MIME}; q=1.0, application/json; q=0.8, */*; q=0.1`;
148
+ var VLT_PACKUMENT_V2_MIME = "application/vnd.vlt.packument-v2+json";
149
+ var PACKUMENT_ACCEPT = `${VLT_PACKUMENT_V2_MIME}; q=1.0, ${VLT_PACKUMENT_MIME}; q=0.9, application/json; q=0.8, */*; q=0.1`;
149
150
  var manifestCacheMaxAge = 5 * 60 * 1e3;
150
151
  var noRegistryError = (spec) => error(
151
152
  'No registry configured to resolve this spec. Set "registry" in vlt.json, pass --registry, or run `vlt login --registry=<url>`. See https://docs.vlt.sh/cli',
@@ -167,7 +168,7 @@ var PackageInfoClient = class {
167
168
  packageJson;
168
169
  monorepo;
169
170
  #trustedIntegrities = /* @__PURE__ */ new Map();
170
- // `${registry}${name}` of every packument served as VLT_PACKUMENT_MIME
171
+ // `${registry}${name}` of every packument served as a vlt packument type
171
172
  #vltPackuments = /* @__PURE__ */ new Set();
172
173
  #manifestCacheMinAge = Date.now() - manifestCacheMaxAge;
173
174
  #cachePath;
@@ -206,7 +207,7 @@ var PackageInfoClient = class {
206
207
  #tarPoolPromise;
207
208
  async getRegistryClient() {
208
209
  if (this.#registryClient) return this.#registryClient;
209
- this.#registryClientPromise ??= import("./src-Z44JKVWS.js").then(({ RegistryClient }) => {
210
+ this.#registryClientPromise ??= import("./src-3UQFZRM3.js").then(({ RegistryClient }) => {
210
211
  this.#registryClient = new RegistryClient(this.options);
211
212
  return this.#registryClient;
212
213
  });
@@ -246,7 +247,7 @@ var PackageInfoClient = class {
246
247
  }
247
248
  async getTarPool() {
248
249
  if (this.#tarPool) return this.#tarPool;
249
- this.#tarPoolPromise ??= import("./src-T5FBZFMV.js").then(
250
+ this.#tarPoolPromise ??= import("./src-EJSVFFXB.js").then(
250
251
  ({ Pool }) => {
251
252
  this.#tarPool = new Pool();
252
253
  return this.#tarPool;
@@ -255,11 +256,12 @@ var PackageInfoClient = class {
255
256
  return this.#tarPoolPromise;
256
257
  }
257
258
  /**
258
- * The absolute URL of a version's Brotli (`.tar.br`) tarball, or
259
- * undefined when the registry advertised none, advertised one this
260
- * client does not use (see {@link brotliTarballUrl}), or
261
- * `--no-brotli-tarballs` is set. `dist.tarball` is already absolute
262
- * here -- see `absolutizeTarballs`.
259
+ * A version's Brotli (`.tar.br`) alternate: its absolute URL, plus its
260
+ * hash if the registry sent one. Returns undefined if the version has no
261
+ * alternate, if it has one this client does not use (see
262
+ * {@link brotliTarballUrl}), or if `--no-brotli-tarballs` is set.
263
+ * `dist.tarball` is already absolute by this point; see
264
+ * `absolutizeTarballs`.
263
265
  */
264
266
  #brotliTarball(tarball, alternates) {
265
267
  if (this.options["brotli-tarballs"] === false) return void 0;
@@ -341,8 +343,13 @@ var PackageInfoClient = class {
341
343
  case "registry": {
342
344
  const pool = await this.getTarPool();
343
345
  const format = tarballFormat(r.resolved);
344
- const hex = f.type === "registry" && this.#storeLinker !== "unpack" ? integrityHex(r.integrity) : void 0;
346
+ const storeOn = f.type === "registry" && this.#storeLinker !== "unpack";
345
347
  const copy = this.#storeLinker === "copy" || installScripts;
348
+ const hex = !storeOn ? void 0 : r.integrity ? integrityHex(r.integrity) : integrityHex(
349
+ (await this.getRegistryClient()).cachedIntegrity(
350
+ r.resolved
351
+ )
352
+ );
346
353
  if (hex) {
347
354
  if (debug.enabled && !this.#storeHitRateLogged) {
348
355
  this.#storeHitRateLogged = true;
@@ -375,7 +382,7 @@ var PackageInfoClient = class {
375
382
  await pool.unpack(cached.body, target, format);
376
383
  logRequest(r.resolved, "cache");
377
384
  r.integrity ??= cached.integrity;
378
- if (hex || cached.gzip) {
385
+ if (storeOn || cached.gzip) {
379
386
  rc.queueForStore(cached.key, r.integrity);
380
387
  }
381
388
  return r;
@@ -997,10 +1004,15 @@ var PackageInfoClient = class {
997
1004
  throw er;
998
1005
  }
999
1006
  const { registry, name } = spec.final;
1000
- if (response.contentType.startsWith(VLT_PACKUMENT_MIME)) {
1007
+ const { contentType } = response;
1008
+ const v2 = contentType.startsWith(VLT_PACKUMENT_V2_MIME);
1009
+ if (v2 || contentType.startsWith(VLT_PACKUMENT_MIME)) {
1001
1010
  this.#vltPackuments.add(`${registry}${name}`);
1002
1011
  }
1003
- if (registry) absolutizeTarballs(paku, registry);
1012
+ if (registry) {
1013
+ const base = registry.endsWith("/") ? registry : registry + "/";
1014
+ absolutizeTarballs(paku, v2 ? `${base}${name}/-/` : base);
1015
+ }
1004
1016
  return paku;
1005
1017
  }
1006
1018
  async resolve(spec, options = {}) {
@@ -1051,7 +1063,17 @@ var PackageInfoClient = class {
1051
1063
  const { integrity, tarball, signatures, alternates } = mani.dist;
1052
1064
  if (tarball) {
1053
1065
  const brotli = this.#brotliTarball(tarball, alternates);
1054
- const r = brotli ? { resolved: brotli, spec, digestRequired: true } : { resolved: tarball, integrity, signatures, spec };
1066
+ const r = brotli ? {
1067
+ resolved: brotli.tarball,
1068
+ spec,
1069
+ // Pin the alternate's own hash if the registry sent
1070
+ // one. That also means we can look the package up in
1071
+ // the global store before downloading it. If there is
1072
+ // no hash, the Repr-Digest header is the only check we
1073
+ // get, so require it instead of treating it as
1074
+ // optional.
1075
+ ...brotli.integrity ? { integrity: brotli.integrity } : { digestRequired: true }
1076
+ } : { resolved: tarball, integrity, signatures, spec };
1055
1077
  if (!brotli && !integrity && this.#vltPackuments.has(`${f.registry}${f.name}`)) {
1056
1078
  r.digestRequired = true;
1057
1079
  }
@@ -1153,8 +1175,7 @@ var PackageInfoClient = class {
1153
1175
  return er;
1154
1176
  }
1155
1177
  };
1156
- var absolutizeTarballs = (paku, registry) => {
1157
- const base = registry.endsWith("/") ? registry : registry + "/";
1178
+ var absolutizeTarballs = (paku, base) => {
1158
1179
  for (const { dist } of Object.values(paku.versions)) {
1159
1180
  const tarball = dist?.tarball;
1160
1181
  if (tarball && !/^[a-z][a-z0-9+.-]*:/i.test(tarball)) {
@@ -11,25 +11,25 @@ import {createRequire as _vlt_createRequire} from "node:module";
11
11
  var require = _vlt_createRequire(import.meta.filename);
12
12
  import {
13
13
  install
14
- } from "./chunk-J2WL3A3C.js";
15
- import "./chunk-JFHEXCG5.js";
14
+ } from "./chunk-IIXKXSLE.js";
15
+ import "./chunk-4WQ76RJD.js";
16
16
  import {
17
17
  commandUsage
18
18
  } from "./chunk-I6QGYSB4.js";
19
- import "./chunk-P4LLYWCG.js";
19
+ import "./chunk-BUKZHMMK.js";
20
20
  import {
21
21
  lazyView
22
22
  } from "./chunk-4KCU2KZL.js";
23
- import "./chunk-J3R4XWB3.js";
24
- import "./chunk-V7EQZOO5.js";
23
+ import "./chunk-JIQBZ2UT.js";
24
+ import "./chunk-64VFL4WI.js";
25
25
  import "./chunk-ENSGPOLR.js";
26
26
  import "./chunk-HTOTG4TS.js";
27
- import "./chunk-VBADA6QU.js";
27
+ import "./chunk-3NWCWTIU.js";
28
28
  import "./chunk-U7TEQCBN.js";
29
29
  import "./chunk-XNLSTHDK.js";
30
30
  import "./chunk-PDWPFR5T.js";
31
31
  import "./chunk-Y5PA7DVK.js";
32
- import "./chunk-RH2Y7MPW.js";
32
+ import "./chunk-BP3PQ67D.js";
33
33
  import "./chunk-WZWDS3W4.js";
34
34
  import "./chunk-PZLD7RTK.js";
35
35
 
@@ -39,10 +39,14 @@ var needsNpmRegistry = true;
39
39
  var usage = () => commandUsage({
40
40
  command: "ci",
41
41
  usage: "",
42
- description: `Clean install from lockfile. Deletes node_modules and installs
43
- dependencies exactly as specified in vlt-lock.json. This is
44
- similar to running 'vlt install --expect-lockfile' but performs
45
- a clean install by removing node_modules first.`,
42
+ description: `Clean install from lockfile. Deletes node_modules and installs
43
+ dependencies exactly as specified in vlt-lock.json. This is
44
+ similar to running 'vlt install --expect-lockfile' but performs
45
+ a clean install by removing node_modules first.
46
+
47
+ Like install, runs no dependency lifecycle scripts unless
48
+ allowed with --allow-scripts; run 'vlt build' afterwards to
49
+ build packages.`,
46
50
  examples: {
47
51
  "": { description: "Clean install from lockfile" }
48
52
  },
@@ -59,21 +63,21 @@ var usage = () => commandUsage({
59
63
  var views = {
60
64
  json: (i) => i.graph.toJSON(),
61
65
  human: lazyView(
62
- async () => (await import("./reporter-VQU7HYKM.js")).InstallReporter
66
+ async () => (await import("./reporter-ZEDO2YIG.js")).InstallReporter
63
67
  )
64
68
  };
65
69
  var command = async (conf) => {
66
70
  const ciOptions = {
67
71
  ...conf.options,
68
- // allow scripts but filter out malware via security archive
69
- allowScripts: conf.get("allow-scripts") ?? ":scripts:not(:malware)",
72
+ // same default as install: no scripts
73
+ allowScripts: conf.get("allow-scripts") ?? ":not(*)",
70
74
  expectLockfile: true,
71
75
  frozenLockfile: true,
72
76
  cleanInstall: true,
73
77
  lockfileOnly: conf.options["lockfile-only"]
74
78
  };
75
- const { graph } = await install(ciOptions);
76
- return { graph };
79
+ const { buildQueue, graph } = await install(ciOptions);
80
+ return { buildQueue, graph };
77
81
  };
78
82
  export {
79
83
  command,
package/cli-package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@vltpkg/cli-sdk",
3
3
  "description": "The source for the vlt CLI",
4
- "version": "1.3.0",
4
+ "version": "1.3.2",
5
5
  "repository": {
6
6
  "type": "git",
7
7
  "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -16,12 +16,12 @@ import {
16
16
  kCustomInspect,
17
17
  pairsToRecords,
18
18
  recordsToPairs
19
- } from "./chunk-YZWFWSY7.js";
20
- import "./chunk-SVMH3NDM.js";
19
+ } from "./chunk-4FHGRT4J.js";
20
+ import "./chunk-ZMRJRQDK.js";
21
21
  import "./chunk-ZWKI5OSF.js";
22
- import "./chunk-P4LLYWCG.js";
23
- import "./chunk-J3R4XWB3.js";
24
- import "./chunk-V7EQZOO5.js";
22
+ import "./chunk-BUKZHMMK.js";
23
+ import "./chunk-JIQBZ2UT.js";
24
+ import "./chunk-64VFL4WI.js";
25
25
  import {
26
26
  commands,
27
27
  definition,
@@ -29,11 +29,11 @@ import {
29
29
  recordFields
30
30
  } from "./chunk-ENSGPOLR.js";
31
31
  import "./chunk-HTOTG4TS.js";
32
- import "./chunk-ZNUXDX6R.js";
32
+ import "./chunk-PBBULTAG.js";
33
33
  import "./chunk-U7TEQCBN.js";
34
34
  import "./chunk-XNLSTHDK.js";
35
35
  import "./chunk-Y5PA7DVK.js";
36
- import "./chunk-RH2Y7MPW.js";
36
+ import "./chunk-BP3PQ67D.js";
37
37
  import "./chunk-WZWDS3W4.js";
38
38
  import "./chunk-PZLD7RTK.js";
39
39
  export {
@@ -15,19 +15,19 @@ import {
15
15
  } from "./chunk-DBANBIL2.js";
16
16
  import {
17
17
  asRootError
18
- } from "./chunk-33HBY5CF.js";
18
+ } from "./chunk-CRGWLUGC.js";
19
19
  import {
20
20
  pairsToRecords,
21
21
  recordsToPairs
22
- } from "./chunk-YZWFWSY7.js";
23
- import "./chunk-SVMH3NDM.js";
22
+ } from "./chunk-4FHGRT4J.js";
23
+ import "./chunk-ZMRJRQDK.js";
24
24
  import "./chunk-ZWKI5OSF.js";
25
25
  import {
26
26
  commandUsage
27
27
  } from "./chunk-I6QGYSB4.js";
28
- import "./chunk-P4LLYWCG.js";
29
- import "./chunk-J3R4XWB3.js";
30
- import "./chunk-V7EQZOO5.js";
28
+ import "./chunk-BUKZHMMK.js";
29
+ import "./chunk-JIQBZ2UT.js";
30
+ import "./chunk-64VFL4WI.js";
31
31
  import {
32
32
  getSortedKeys,
33
33
  isRecordField
@@ -36,13 +36,13 @@ import {
36
36
  find,
37
37
  load
38
38
  } from "./chunk-HTOTG4TS.js";
39
- import "./chunk-ZNUXDX6R.js";
39
+ import "./chunk-PBBULTAG.js";
40
40
  import "./chunk-U7TEQCBN.js";
41
41
  import "./chunk-XNLSTHDK.js";
42
42
  import "./chunk-Y5PA7DVK.js";
43
43
  import {
44
44
  isObject
45
- } from "./chunk-RH2Y7MPW.js";
45
+ } from "./chunk-BP3PQ67D.js";
46
46
  import {
47
47
  error
48
48
  } from "./chunk-WZWDS3W4.js";
@@ -11,45 +11,45 @@ import {createRequire as _vlt_createRequire} from "node:module";
11
11
  var require = _vlt_createRequire(import.meta.filename);
12
12
  import {
13
13
  vlxResolve
14
- } from "./chunk-EP7AVBIO.js";
14
+ } from "./chunk-QX6KMBTX.js";
15
15
  import {
16
16
  ExecCommand,
17
17
  views
18
- } from "./chunk-ILRJWH6A.js";
18
+ } from "./chunk-2UW4UIVL.js";
19
19
  import "./chunk-RIYFGX27.js";
20
- import "./chunk-2HXJ4ZSF.js";
20
+ import "./chunk-EJFGJ543.js";
21
21
  import {
22
22
  styleTextStdout
23
- } from "./chunk-MJWUULO6.js";
23
+ } from "./chunk-CSZTT7QN.js";
24
24
  import "./chunk-CU752KW7.js";
25
25
  import "./chunk-G2YT2GWF.js";
26
- import "./chunk-33HBY5CF.js";
26
+ import "./chunk-CRGWLUGC.js";
27
27
  import "./chunk-VTEFO2FT.js";
28
- import "./chunk-SVMH3NDM.js";
28
+ import "./chunk-ZMRJRQDK.js";
29
29
  import "./chunk-ZWKI5OSF.js";
30
30
  import "./chunk-WGDTG44V.js";
31
- import "./chunk-D2LEK7VS.js";
31
+ import "./chunk-J4NHRZX6.js";
32
32
  import {
33
33
  exec,
34
34
  execFG
35
- } from "./chunk-J2WL3A3C.js";
36
- import "./chunk-JFHEXCG5.js";
35
+ } from "./chunk-IIXKXSLE.js";
36
+ import "./chunk-4WQ76RJD.js";
37
37
  import {
38
38
  commandUsage
39
39
  } from "./chunk-I6QGYSB4.js";
40
- import "./chunk-P4LLYWCG.js";
40
+ import "./chunk-BUKZHMMK.js";
41
41
  import "./chunk-4KCU2KZL.js";
42
- import "./chunk-J3R4XWB3.js";
43
- import "./chunk-V7EQZOO5.js";
42
+ import "./chunk-JIQBZ2UT.js";
43
+ import "./chunk-64VFL4WI.js";
44
44
  import "./chunk-ENSGPOLR.js";
45
45
  import "./chunk-HTOTG4TS.js";
46
- import "./chunk-ZNUXDX6R.js";
47
- import "./chunk-VBADA6QU.js";
46
+ import "./chunk-PBBULTAG.js";
47
+ import "./chunk-3NWCWTIU.js";
48
48
  import "./chunk-U7TEQCBN.js";
49
49
  import "./chunk-XNLSTHDK.js";
50
50
  import "./chunk-PDWPFR5T.js";
51
51
  import "./chunk-Y5PA7DVK.js";
52
- import "./chunk-RH2Y7MPW.js";
52
+ import "./chunk-BP3PQ67D.js";
53
53
  import "./chunk-WZWDS3W4.js";
54
54
  import "./chunk-PZLD7RTK.js";
55
55