@vltpkg/cli-js 1.3.3 → 1.3.5

package/{access-KMBBQIIT.js → access-X2ZZH2BV.js}

@@ -14,17 +14,17 @@ import {
 } from "./chunk-J4NHRZX6.js";
 import {
   commandUsage
-} from "./chunk-I6QGYSB4.js";
+} from "./chunk-LHIDMYN2.js";
 import "./chunk-64VFL4WI.js";
-import "./chunk-ENSGPOLR.js";
+import "./chunk-XU5WNX4S.js";
 import {
   RegistryClient
-} from "./chunk-SH24EMXO.js";
+} from "./chunk-2B5STVCP.js";
 import "./chunk-APMYKJI2.js";
 import {
   assertOk
 } from "./chunk-PBBULTAG.js";
-import "./chunk-YU2W5UPG.js";
+import "./chunk-ADDCQBGR.js";
 import "./chunk-U7TEQCBN.js";
 import "./chunk-XNLSTHDK.js";
 import "./chunk-PDWPFR5T.js";

package/{bugs-CABZX76X.js → bugs-SF56YATZ.js}

@@ -14,41 +14,41 @@ import {
 } from "./chunk-CLVRCGOZ.js";
 import {
   openUrl
-} from "./chunk-MC6CESRA.js";
+} from "./chunk-AFUXQ3P4.js";
 import {
   createHostContextsMap
-} from "./chunk-LY5FNWRY.js";
-import "./chunk-CSZTT7QN.js";
-import "./chunk-CU752KW7.js";
+} from "./chunk-B2CTWVQM.js";
+import "./chunk-TOKUDCSW.js";
+import "./chunk-BCANUHR3.js";
 import "./chunk-G2YT2GWF.js";
 import "./chunk-CRGWLUGC.js";
 import {
   PackageInfoClient
-} from "./chunk-MOL2DUEQ.js";
-import "./chunk-ZWKI5OSF.js";
+} from "./chunk-7DHDJ5XY.js";
+import "./chunk-SRWDPPLX.js";
 import "./chunk-WGDTG44V.js";
 import "./chunk-J4NHRZX6.js";
 import {
   Query,
   actual
-} from "./chunk-ZRRNOLEG.js";
+} from "./chunk-ZZFFMXI2.js";
 import {
   SecurityArchive
-} from "./chunk-DCFLXO2M.js";
+} from "./chunk-XUGOPOLF.js";
 import {
   commandUsage
-} from "./chunk-I6QGYSB4.js";
-import "./chunk-BUKZHMMK.js";
+} from "./chunk-LHIDMYN2.js";
+import "./chunk-INEKXXUQ.js";
 import "./chunk-4KCU2KZL.js";
 import "./chunk-JIQBZ2UT.js";
 import {
   Spec
 } from "./chunk-64VFL4WI.js";
-import "./chunk-ENSGPOLR.js";
+import "./chunk-XU5WNX4S.js";
 import "./chunk-HTOTG4TS.js";
 import "./chunk-APMYKJI2.js";
 import "./chunk-PBBULTAG.js";
-import "./chunk-YU2W5UPG.js";
+import "./chunk-ADDCQBGR.js";
 import "./chunk-U7TEQCBN.js";
 import "./chunk-XNLSTHDK.js";
 import "./chunk-PDWPFR5T.js";

package/{build-WNHKYA4E.js → build-RRJ645SV.js}

@@ -11,17 +11,17 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   build
-} from "./chunk-ZRRNOLEG.js";
-import "./chunk-DCFLXO2M.js";
+} from "./chunk-ZZFFMXI2.js";
+import "./chunk-XUGOPOLF.js";
 import {
   commandUsage
-} from "./chunk-I6QGYSB4.js";
-import "./chunk-BUKZHMMK.js";
+} from "./chunk-LHIDMYN2.js";
+import "./chunk-INEKXXUQ.js";
 import "./chunk-JIQBZ2UT.js";
 import "./chunk-64VFL4WI.js";
-import "./chunk-ENSGPOLR.js";
+import "./chunk-XU5WNX4S.js";
 import "./chunk-HTOTG4TS.js";
-import "./chunk-YU2W5UPG.js";
+import "./chunk-ADDCQBGR.js";
 import "./chunk-U7TEQCBN.js";
 import "./chunk-XNLSTHDK.js";
 import "./chunk-PDWPFR5T.js";

package/{cache-KKT4GIYD.js → cache-NETXHYQU.js}

@@ -15,15 +15,15 @@ import {
 import {
   stderr,
   stdout
-} from "./chunk-CSZTT7QN.js";
-import "./chunk-CU752KW7.js";
+} from "./chunk-TOKUDCSW.js";
+import "./chunk-BCANUHR3.js";
 import "./chunk-G2YT2GWF.js";
 import "./chunk-CRGWLUGC.js";
 import "./chunk-WGDTG44V.js";
 import "./chunk-J4NHRZX6.js";
 import {
   commandUsage
-} from "./chunk-I6QGYSB4.js";
+} from "./chunk-LHIDMYN2.js";
 import {
   ViewClass
 } from "./chunk-4KCU2KZL.js";
@@ -31,15 +31,15 @@ import "./chunk-JIQBZ2UT.js";
 import {
   Spec
 } from "./chunk-64VFL4WI.js";
-import "./chunk-ENSGPOLR.js";
+import "./chunk-XU5WNX4S.js";
 import {
   CacheEntry
-} from "./chunk-SH24EMXO.js";
+} from "./chunk-2B5STVCP.js";
 import "./chunk-APMYKJI2.js";
 import {
   assertOk
 } from "./chunk-PBBULTAG.js";
-import "./chunk-YU2W5UPG.js";
+import "./chunk-ADDCQBGR.js";
 import "./chunk-U7TEQCBN.js";
 import "./chunk-XNLSTHDK.js";
 import {

package/{chunk-SH24EMXO.js → chunk-2B5STVCP.js}

@@ -21,7 +21,7 @@ import {
 } from "./chunk-PBBULTAG.js";
 import {
   userAgent
-} from "./chunk-YU2W5UPG.js";
+} from "./chunk-ADDCQBGR.js";
 import {
   I,
   logRequest
@@ -7857,7 +7857,7 @@ var require_client_h2 = __commonJS({
   "../../node_modules/.vlt/~npm~undici@7.29.0/node_modules/undici/lib/dispatcher/client-h2.js"(exports, module3) {
     "use strict";
     var assert = __require("node:assert");
-    var { pipeline } = __require("node:stream");
+    var { pipeline: pipeline2 } = __require("node:stream");
     var util = require_util();
     var {
       RequestContentLengthMismatchError,
@@ -8490,7 +8490,7 @@ var require_client_h2 = __commonJS({
     }
     function writeStream(abort, socket, expectsPayload, h2stream, body, client, request2, contentLength) {
       assert(contentLength !== 0 || client[kRunning] === 0, "stream body cannot be pipelined");
-      const pipe = pipeline(
+      const pipe = pipeline2(
         body,
         h2stream,
         (err) => {
@@ -12317,7 +12317,7 @@ var require_api_pipeline = __commonJS({
         util.destroy(ret, err);
       }
     };
-    function pipeline(opts, handler) {
+    function pipeline2(opts, handler) {
       try {
         const pipelineHandler = new PipelineHandler(opts, handler);
         this.dispatch({ ...opts, body: pipelineHandler.req }, pipelineHandler);
@@ -12326,7 +12326,7 @@ var require_api_pipeline = __commonJS({
         return new PassThrough().destroy(err);
       }
     }
-    module3.exports = pipeline;
+    module3.exports = pipeline2;
   }
 });
 
@@ -17558,13 +17558,13 @@ var require_cache2 = __commonJS({
 var require_decompress = __commonJS({
   "../../node_modules/.vlt/~npm~undici@7.29.0/node_modules/undici/lib/interceptor/decompress.js"(exports, module3) {
     "use strict";
-    var { createInflate, createGunzip, createBrotliDecompress, createZstdDecompress } = __require("node:zlib");
-    var { pipeline } = __require("node:stream");
+    var { createInflate, createGunzip: createGunzip2, createBrotliDecompress, createZstdDecompress } = __require("node:zlib");
+    var { pipeline: pipeline2 } = __require("node:stream");
     var DecoratorHandler = require_decorator_handler();
     var { runtimeFeatures } = require_runtime_features();
     var supportedEncodings = {
-      gzip: createGunzip,
-      "x-gzip": createGunzip,
+      gzip: createGunzip2,
+      "x-gzip": createGunzip2,
       br: createBrotliDecompress,
       deflate: createInflate,
       compress: createInflate,
@@ -17668,7 +17668,7 @@ var require_decompress = __commonJS({
       #setupMultipleDecompressors(controller) {
         const lastDecompressor = this.#decompressors[this.#decompressors.length - 1];
         this.#setupDecompressorEvents(lastDecompressor, controller);
-        pipeline(this.#decompressors, (err) => {
+        pipeline2(this.#decompressors, (err) => {
           if (err) {
             super.onResponseError(controller, err);
             return;
@@ -20413,7 +20413,7 @@ var require_fetch = __commonJS({
       subresourceSet
     } = require_constants3();
     var EE = __require("node:events");
-    var { Readable, pipeline, finished, isErrored, isReadable } = __require("node:stream");
+    var { Readable, pipeline: pipeline2, finished, isErrored, isReadable } = __require("node:stream");
     var { addAbortListener, bufferToLowerCasedHeaderName } = require_util();
     var { dataURLProcessor, serializeAMimeType, minimizeSupportedMimeType } = require_data_url();
     var { getGlobalDispatcher } = require_global2();
@@ -21404,7 +21404,7 @@ var require_fetch = __commonJS({
                 status,
                 statusText: statusText2,
                 headersList,
-                body: decoders.length ? pipeline(this.body, ...decoders, (err) => {
+                body: decoders.length ? pipeline2(this.body, ...decoders, (err) => {
                   if (err) {
                     this.onError(err);
                   }
@@ -25105,7 +25105,7 @@ ${value}`;
 var require_eventsource = __commonJS({
   "../../node_modules/.vlt/~npm~undici@7.29.0/node_modules/undici/lib/web/eventsource/eventsource.js"(exports, module3) {
     "use strict";
-    var { pipeline } = __require("node:stream");
+    var { pipeline: pipeline2 } = __require("node:stream");
     var { fetching } = require_fetch();
     var { makeRequest } = require_request2();
     var { webidl } = require_webidl();
@@ -25263,7 +25263,7 @@ var require_eventsource = __commonJS({
               ));
             }
           });
-          pipeline(
+          pipeline2(
             response.body.stream,
             eventSourceStream,
             (error2) => {
@@ -26153,7 +26153,9 @@ import { randomUUID } from "node:crypto";
 import { closeSync, openSync, readFileSync as readFileSync2, readSync } from "node:fs";
 import { availableParallelism } from "node:os";
 import { dirname as dirname3, resolve as resolve4 } from "node:path";
+import { pipeline } from "node:stream";
 import { setTimeout as setTimeout2 } from "node:timers/promises";
+import { createGunzip } from "node:zlib";
 
 // ../../src/registry-client/src/is-iterable.ts
 var isIterable = (o) => !!o && typeof o === "object" && Symbol.iterator in o;
@@ -26648,7 +26650,9 @@ var CacheEntry = class _CacheEntry {
    * Note that this will *usually* not be true if the value is coming out of
    * the cache, because cache entries not exploded into the global store are
    * un-gzipped in place. It should _only_ be called for artifacts that come
-   * from an actual http response.
+   * from an actual http response, whatever its encoding: an identity body
+   * is hashed as it came, a gzipped one before anything un-gzips it in
+   * memory.
    *
    * Returns true if anything was actually verified.
    */
@@ -26688,11 +26692,26 @@ var CacheEntry = class _CacheEntry {
     }
     return computed;
   }
+  #hash(body = this._body) {
+    const hash2 = createHash2("sha512");
+    hash2.update(body);
+    return `sha512-${hash2.digest("base64")}`;
+  }
+  /**
+   * The hash of the body un-gzipped, or of the body itself if it is not
+   * gzipped, without un-gzipping the entry. Bounded like {@link unzip},
+   * and throws like it on a body that will not un-gzip.
+   *
+   * Never the hash to record for an artifact, which is the hash of its
+   * bytes as served. It pins the same content, though, and is what a
+   * body hashed after something un-gzipped it was pinned with.
+   */
+  unzippedIntegrity() {
+    return this.#hash(this.isGzip ? this.#gunzip() : this._body);
+  }
   get integrityActual() {
     if (this.#integrityActual) return this.#integrityActual;
-    const hash2 = createHash2("sha512");
-    hash2.update(this._body);
-    const i = `sha512-${hash2.digest("base64")}`;
+    const i = this.#hash();
     this.integrityActual = i;
     return i;
   }
@@ -26780,13 +26799,40 @@ var CacheEntry = class _CacheEntry {
     const ct = this.getHeaderString("content-type");
     if (ct) return this.#isJSON = /\bjson\b/.test(ct);
     if (!this._body.length) return false;
+    const wire = !this.#fromCache && !this.#integrityActual && this.isGzip ? this.#hash() : void 0;
     this.unzip();
     const buf = this._body;
     if (!buf.length) return false;
     this.#isJSON = buf[0] === 123;
     if (this.#isJSON) this.setHeader("content-type", "text/json");
+    else if (wire) this.integrityActual = wire;
     return this.#isJSON;
   }
+  /**
+   * Label a 200 network body that is not json and came with no
+   * content-type `application/octet-stream`, the way the json sniff
+   * labels json `text/json`.
+   *
+   * The label says the hash the entry is stored under is the hash of
+   * its bytes as served, checked or recorded by
+   * `RegistryClient.request()`. So it is applied only where that is
+   * known, right before such an entry is stored, and never by the
+   * sniff: an entry with no content-type read back from the cache is
+   * not known to be one.
+   *
+   * A decoded entry, an error body, an empty body, json, and a body
+   * served with a content-type are left as they are. Not an error body
+   * or an empty one: a content-type that is not json makes an entry
+   * immutable (see {@link valid}), which neither was when served with
+   * none, and no artifact is empty. The length is checked after the
+   * sniff, which un-gzips a body with no content-type.
+   */
+  labelArtifact() {
+    if (this.#fromCache || this.#statusCode !== 200 || this.isJSON || this.getHeaderString("content-type") || !this.#bodyLength) {
+      return;
+    }
+    this.setHeader("content-type", "application/octet-stream");
+  }
   #isGzip;
   get isGzip() {
     if (this.#isGzip !== void 0) return this.#isGzip;
@@ -26803,6 +26849,24 @@ var CacheEntry = class _CacheEntry {
     }
     return this.#isGzip;
   }
+  // the body un-gzipped, for a body known to be gzipped
+  #gunzip() {
+    if (this._body.length === 0)
+      throw error("Invalid buffer, cant unzip");
+    const max = Math.min(
+      maxUnpackedBytes,
+      this._body.length * MAX_DECOMPRESSION_RATIO
+    );
+    try {
+      return gunzipSync(this._body, { maxOutputLength: max });
+    } catch (er) {
+      throw er.code === "ERR_BUFFER_TOO_LARGE" ? error("cache entry exceeds maximum unpacked size", {
+        found: this._body.length,
+        max,
+        cause: er
+      }) : er;
+    }
+  }
   /**
    * Un-gzip encode the body.
    * Returns true if it was previously gzip (so something was done), otherwise
@@ -26810,22 +26874,7 @@ var CacheEntry = class _CacheEntry {
    */
   unzip() {
     if (this.isGzip) {
-      if (this._body.length === 0)
-        throw error("Invalid buffer, cant unzip");
-      const max = Math.min(
-        maxUnpackedBytes,
-        this._body.length * MAX_DECOMPRESSION_RATIO
-      );
-      let b;
-      try {
-        b = gunzipSync(this._body, { maxOutputLength: max });
-      } catch (er) {
-        throw er.code === "ERR_BUFFER_TOO_LARGE" ? error("cache entry exceeds maximum unpacked size", {
-          found: this._body.length,
-          max,
-          cause: er
-        }) : er;
-      }
+      const b = this.#gunzip();
       this.setHeader("content-encoding", "identity");
       const u8 = new Uint8Array(b.buffer, b.byteOffset, b.byteLength);
       this.#body = u8;
@@ -27886,6 +27935,65 @@ var RegistryClient = class {
       integrity
     );
   }
+  /**
+   * Make a request and hand back the response body as it arrives, instead of
+   * buffering it into a {@link CacheEntry}. For a body a caller acts on line
+   * by line — the NDJSON the batch endpoints stream — waiting for the last
+   * byte is the difference between using the first record now and using it
+   * once the server has finished computing the last one.
+   *
+   * The body is gunzipped here when the registry compressed it, so a caller
+   * always reads what the server serialized. Nothing is cached and nothing is
+   * retried: a caller that loses the stream falls back to the requests it was
+   * avoiding.
+   */
+  async requestStream(url, options = {}) {
+    const u = typeof url === "string" ? new URL(url) : url;
+    const o = {
+      ...options,
+      method: options.method ?? "GET",
+      path: u.pathname.replace(/\/+$/, "") + u.search,
+      origin: u.origin,
+      headers: addHeader(
+        addHeader(
+          addHeader(
+            options.headers,
+            "accept-encoding",
+            "gzip;q=1.0, identity;q=0.5"
+          ),
+          "user-agent",
+          userAgent
+        ),
+        "npm-session",
+        this.#session
+      )
+    };
+    o.headers = addHeader(
+      o.headers,
+      "authorization",
+      await getTokenByURL(String(u), this.identity)
+    );
+    logRequest(url, "start", { method: o.method });
+    const requestStart = Date.now();
+    const response = await this.agent.request(
+      o
+    );
+    logRequest(url, "complete", {
+      method: o.method,
+      statusCode: response.statusCode,
+      durationMs: Date.now() - requestStart
+    });
+    const encoding = response.headers["content-encoding"];
+    const gzipped = typeof encoding === "string" && /\bgzip\b/.test(encoding);
+    let body = response.body;
+    if (gzipped) {
+      const gunzip = createGunzip();
+      pipeline(response.body, gunzip, () => {
+      });
+      body = gunzip;
+    }
+    return { statusCode: response.statusCode, body };
+  }
   async request(url, options = {}) {
     const u = typeof url === "string" ? new URL(url) : url;
     const {
@@ -27899,10 +28007,10 @@ var RegistryClient = class {
     } = options;
     const { trustIntegrity, verifyDigest } = options;
     const m = isCacheableMethod(method) ? method : void 0;
-    const { useCache = !!m } = options;
+    const { useCache = !!m, readCache = true } = options;
     signal?.throwIfAborted();
     const key = cacheKey(method, u);
-    const buffer = useCache ? await this.cache.fetch(key, { context: { integrity } }) : void 0;
+    const buffer = useCache && readCache ? await this.cache.fetch(key, { context: { integrity } }) : void 0;
     const entry = buffer ? this.#decodeCached(buffer) : void 0;
     if (entry?.valid && forceRevalidate !== true) {
       if (forceRevalidate === "background" && m) {
@@ -27997,16 +28105,17 @@ var RegistryClient = class {
         durationMs: Date.now() - requestStart
       }
     );
-    if (!trustIntegrity && !result.fromCache) {
-      result.deleteHeader("integrity");
-      if (result.statusCode === 200) result.checkIntegrity({ url });
+    if (!trustIntegrity && !result.fromCache && result.statusCode === 200) {
+      result.checkIntegrity({ url });
     }
     if (verifyDigest && !integrity && !result.fromCache && result.statusCode === 200) {
       result.checkDigest(verifyDigest === "required", { url });
     }
     const clobbersCachedEntry = forceRevalidate && !!entry && result.statusCode !== 200;
     if (useCache && !clobbersCachedEntry) {
-      const integrity2 = result.integrity ?? (result.statusCode === 200 && !result.isJSON ? result.integrityActual : void 0);
+      const artifact = !result.fromCache && result.statusCode === 200 && !result.isJSON;
+      const integrity2 = result.integrity ?? (artifact ? result.integrityActual : void 0);
+      if (artifact) result.labelArtifact();
       const encoded = result.encode();
       const stored = Buffer.from(
         encoded.buffer,
@@ -28048,6 +28157,7 @@ var RegistryClient = class {
         contentLength
       }
     );
+    if (!trustIntegrity) result.deleteHeader("integrity");
     if (isRedirect(result)) {
       response.body.resume();
       const [nextURL, nextOptions] = redirect(options, result, url);

package/{chunk-GZWJAGBL.js → chunk-35OBZITS.js}

@@ -11,12 +11,12 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   PackageInfoClient
-} from "./chunk-MOL2DUEQ.js";
+} from "./chunk-7DHDJ5XY.js";
 import {
   Monorepo,
   PackageJson,
   PathScurry
-} from "./chunk-BUKZHMMK.js";
+} from "./chunk-INEKXXUQ.js";
 import {
   resetCaches
 } from "./chunk-JIQBZ2UT.js";
@@ -28,7 +28,7 @@ import {
   isRecordField,
   recordFields,
   storeLinkers
-} from "./chunk-ENSGPOLR.js";
+} from "./chunk-XU5WNX4S.js";
 import {
   find,
   load,

package/{chunk-ROCFQPP2.js → chunk-75F2WCA5.js}

@@ -15,14 +15,14 @@ import {
   pairsToRecords,
   registrySelectionFields,
   registrySelectors
-} from "./chunk-GZWJAGBL.js";
+} from "./chunk-35OBZITS.js";
 import {
   normalizeRegistryURL
 } from "./chunk-J4NHRZX6.js";
 import {
   getCommand,
   isRecordField
-} from "./chunk-ENSGPOLR.js";
+} from "./chunk-XU5WNX4S.js";
 import {
   find
 } from "./chunk-HTOTG4TS.js";