@vltpkg/cli-js 1.3.3 → 1.3.5

package/{chunk-MOL2DUEQ.js → chunk-7DHDJ5XY.js}

@@ -10,9 +10,8 @@ globalThis.clearInterval = _vlt_clearInterval;
 import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
-  Qn,
-  require_lib
-} from "./chunk-ZWKI5OSF.js";
+  Qn
+} from "./chunk-SRWDPPLX.js";
 import {
   Monorepo,
   PackageJson,
@@ -20,7 +19,7 @@ import {
   pickManifest,
   resolve,
   revs
-} from "./chunk-BUKZHMMK.js";
+} from "./chunk-INEKXXUQ.js";
 import {
   Spec
 } from "./chunk-64VFL4WI.js";
@@ -44,12 +43,67 @@ import {
 import {
   error
 } from "./chunk-WZWDS3W4.js";
-import {
-  __toESM
-} from "./chunk-PZLD7RTK.js";
+
+// ../../src/package-info/src/resolve-batch.ts
+import { createInterface } from "node:readline";
+var fetchResolve = async (client, registry, request, onRecord, signal) => {
+  if (!request.roots.length) return;
+  let body;
+  try {
+    const response = await client.requestStream(
+      new URL("-/vlt/resolve", registry),
+      {
+        // POST, not QUERY: CloudFront's allowed-method sets are fixed and
+        // none includes QUERY. The registry answers both.
+        method: "POST",
+        signal,
+        headers: {
+          "content-type": "application/json",
+          accept: "application/x-ndjson"
+        },
+        body: JSON.stringify(request)
+      }
+    );
+    if (response.statusCode !== 207) {
+      response.body.resume();
+      return;
+    }
+    body = response.body;
+  } catch {
+    return;
+  }
+  try {
+    for await (const line of createInterface({ input: body })) {
+      const record = parseRecord(line);
+      if (record) onRecord(record);
+    }
+  } catch {
+    body.destroy();
+  }
+};
+var parseRecord = (l) => {
+  let record;
+  try {
+    record = JSON.parse(l);
+  } catch {
+    return;
+  }
+  const { status, name, requested, manifest } = record;
+  if (status !== 200 || typeof name !== "string") return;
+  if (!Array.isArray(requested) || !requested.every((s) => typeof s === "string"))
+    return;
+  if (typeof manifest !== "object" || manifest === null) return;
+  const mani = manifest;
+  if (mani.name !== name || typeof mani.version !== "string") return;
+  return {
+    name,
+    version: mani.version,
+    requested,
+    manifest: mani
+  };
+};
 
 // ../../src/package-info/src/index.ts
-var import_ssri = __toESM(require_lib(), 1);
 import { createHash, randomBytes } from "node:crypto";
 import {
   mkdir,
@@ -66,6 +120,7 @@ import {
   resolve as pathResolve,
   relative
 } from "node:path";
+import { setTimeout } from "node:timers/promises";
 import { debuglog } from "node:util";
 
 // ../../src/package-info/src/capabilities.ts
@@ -147,6 +202,18 @@ var delimiter = "~";
 var VLT_PACKUMENT_MIME = "application/vnd.vlt.packument-v1+json";
 var VLT_PACKUMENT_V2_MIME = "application/vnd.vlt.packument-v2+json";
 var PACKUMENT_ACCEPT = `${VLT_PACKUMENT_V2_MIME}; q=1.0, ${VLT_PACKUMENT_MIME}; q=0.9, application/json; q=0.8, */*; q=0.1`;
+var resolveWaitMs = () => {
+  const configured = Number(process.env.VLT_BATCH_RESOLVE_WAIT_MS);
+  return Number.isFinite(configured) && configured >= 0 ? configured : 250;
+};
+var graceOver = /* @__PURE__ */ Symbol("graceOver");
+var SELECTION_OPTIONS = [
+  "before",
+  "os",
+  "arch",
+  "libc",
+  "node-version"
+];
 var manifestCacheMaxAge = 5 * 60 * 1e3;
 var noRegistryError = (spec) => error(
   'No registry configured to resolve this spec. Set "registry" in vlt.json, pass --registry, or run `vlt login --registry=<url>`. See https://docs.vlt.sh/cli',
@@ -160,6 +227,7 @@ var isStableSelector = (f) => {
   return !range.isAny && !range.raw.includes("-");
 };
 var storeLinkers = /* @__PURE__ */ new Set(["auto", "hardlink", "copy"]);
+var storedIntegrity = (response) => !response.fromCache ? response.integrityActual : !response.contentType ? void 0 : response.integrity ?? (response.isGzip ? response.integrityActual : void 0);
 var PackageInfoClient = class {
   #registryClient;
   #projectRoot;
@@ -204,11 +272,36 @@ var PackageInfoClient = class {
   // needed. entries are removed when the on-disk file is invalidated
   // so the refreshed manifest can be written again.
   #manifestWritePaths = /* @__PURE__ */ new Set();
+  // Manifests a resolve batch delivered, keyed both as
+  // `${registry}${name}@${range}` for every spec that chose a version and
+  // `${registry}${name}@${version}` for the version itself.
+  #resolvedManifests = /* @__PURE__ */ new Map();
+  /**
+   * The resolve requests in flight against each registry, with when the
+   * registry last delivered a record: the grace a lookup gives the stream
+   * is measured from there, and it is set when the request is sent, so
+   * a registry with a request in flight always has a time.
+   */
+  #resolveInflight = /* @__PURE__ */ new Map();
+  /**
+   * each request in flight, by its `#resolveSent` key: its controller and
+   * how many builds are still reading it. a request that settled on its
+   * own stays in `#resolveSent`, since its records are still here
+   */
+  #resolveOwners = /* @__PURE__ */ new Map();
+  // Requests already sent, so the same ask is not repeated. Keyed on the
+  // request rather than the registry: a later step asking for a different
+  // root set is a different question.
+  #resolveSent = /* @__PURE__ */ new Set();
+  // Keys `manifest()` is waiting for, each woken by the record that carries
+  // it. Waiting per key rather than on the whole response is what lets a
+  // build place level N while the server still walks level N+1.
+  #resolveWaiters = /* @__PURE__ */ new Map();
   #registryClientPromise;
   #tarPoolPromise;
   async getRegistryClient() {
     if (this.#registryClient) return this.#registryClient;
-    this.#registryClientPromise ??= import("./src-U4MCZFJT.js").then(({ RegistryClient }) => {
+    this.#registryClientPromise ??= import("./src-ODLA6WPY.js").then(({ RegistryClient }) => {
       this.#registryClient = new RegistryClient(this.options);
       return this.#registryClient;
     });
@@ -248,7 +341,7 @@ var PackageInfoClient = class {
   }
   async getTarPool() {
     if (this.#tarPool) return this.#tarPool;
-    this.#tarPoolPromise ??= import("./src-EJSVFFXB.js").then(
+    this.#tarPoolPromise ??= import("./src-3MEJQYBG.js").then(
       ({ Pool }) => {
         this.#tarPool = new Pool();
         return this.#tarPool;
@@ -298,8 +391,7 @@ var PackageInfoClient = class {
       from = this.#projectRoot,
       integrity,
       resolved,
-      fromLockfile = false,
-      installScripts = false
+      fromLockfile = false
     } = options;
     const f = spec.final;
     const brotli = !!resolved && tarballFormat(resolved) === "brotli";
@@ -345,7 +437,7 @@ var PackageInfoClient = class {
         const pool = await this.getTarPool();
         const format = tarballFormat(r.resolved);
         const storeOn = f.type === "registry" && this.#storeLinker !== "unpack";
-        const copy = this.#storeLinker === "copy" || installScripts;
+        const copy = this.#storeLinker === "copy";
         const hex = !storeOn ? void 0 : r.integrity ? integrityHex(r.integrity) : integrityHex(
           (await this.getRegistryClient()).cachedIntegrity(
             r.resolved
@@ -467,30 +559,71 @@ var PackageInfoClient = class {
         return r;
       }
       case "remote": {
-        const response = await (await this.getRegistryClient()).request(r.resolved);
-        if (response.statusCode !== 200) {
-          throw this.#resolveError(
-            spec,
-            options,
-            `failed to fetch remote tarball: ${registryErrorMessage(response)}`,
-            {
-              url: r.resolved,
-              response
+        const rc = await this.getRegistryClient();
+        const { CacheEntry: Entry, cacheKey } = await import("./src-ODLA6WPY.js");
+        const key = cacheKey("GET", new URL(r.resolved));
+        const unzipped = (entry) => {
+          try {
+            return entry.unzippedIntegrity() === r.integrity;
+          } catch {
+            return false;
+          }
+        };
+        const fetchTarball = async (readCache) => {
+          let response2;
+          try {
+            response2 = await rc.request(r.resolved, {
+              integrity: r.integrity,
+              ...readCache === false ? { readCache } : {}
+            });
+          } catch (er) {
+            const cause = er.cause;
+            if (cause?.code !== "EINTEGRITY" || !(cause.response instanceof Entry) || !unzipped(cause.response)) {
+              throw er;
             }
-          );
+            response2 = cause.response;
+            r.integrity = response2.integrityActual;
+            response2.labelArtifact();
+            rc.cache.set(key, response2.encode(), {
+              integrity: r.integrity
+            });
+          }
+          if (response2.statusCode !== 200) {
+            throw this.#resolveError(
+              spec,
+              options,
+              `failed to fetch remote tarball: ${registryErrorMessage(response2)}`,
+              {
+                url: r.resolved,
+                response: response2
+              }
+            );
+          }
+          return response2;
+        };
+        let response = await fetchTarball();
+        let found = storedIntegrity(response);
+        if (response.fromCache && found && r.integrity && r.integrity !== found && unzipped(response)) {
+          r.integrity = found;
         }
-        const buf = response.buffer();
-        const computed = import_ssri.default.fromData(buf, { algorithms: ["sha512"] }).toString();
-        if (r.integrity && r.integrity !== computed) {
+        if (response.fromCache && (!found || r.integrity && r.integrity !== found)) {
+          rc.cache.delete(key, true, found);
+          if (r.integrity) rc.cache.delete(key, true, r.integrity);
+          await rc.cache.promise();
+          response = await fetchTarball(false);
+          found = storedIntegrity(response);
+        }
+        if (!found || r.integrity && r.integrity !== found) {
           throw error("Integrity check failure", {
             code: "EINTEGRITY",
             spec,
             url: r.resolved,
             wanted: r.integrity,
-            found: computed
+            found
           });
         }
-        r.integrity = computed;
+        r.integrity = found;
+        const buf = response.buffer();
         try {
           await (await this.getTarPool()).unpack(buf, target);
         } catch (er) {
@@ -760,6 +893,168 @@ var PackageInfoClient = class {
       }
     }
   }
+  /**
+   * Start a server-side resolve for `request` against `registry` and
+   * return without waiting. `manifest()` answers from what has arrived,
+   * and blocks on the request only when it needs a key that has not.
+   *
+   * A no-op unless the registry says it serves the endpoint. Anything it
+   * does not deliver is left to `manifest()`.
+   *
+   * Returns the function that releases the request. A build calls it once
+   * it has placed its last node; when the last build reading a request has
+   * released it, the stream is ended, so an install never waits on a
+   * stream nothing will read. The records it delivered stay answerable.
+   */
+  prefetchResolve(registry, request) {
+    if (!request.roots.length) return () => {
+    };
+    if (!registry.endsWith("/")) registry += "/";
+    const sent = `${registry}\0${JSON.stringify(request)}`;
+    const owned = this.#resolveOwners.get(sent);
+    if (owned) {
+      owned.readers++;
+      return () => this.#releaseResolve(sent, owned);
+    }
+    if (this.#resolveSent.has(sent)) return () => {
+    };
+    this.#resolveSent.add(sent);
+    const owner = { controller: new AbortController(), readers: 1 };
+    this.#resolveOwners.set(sent, owner);
+    let inflight = this.#resolveInflight.get(registry);
+    if (!inflight) {
+      inflight = { requests: /* @__PURE__ */ new Set(), lastRecordAt: 0 };
+      this.#resolveInflight.set(registry, inflight);
+    }
+    inflight.lastRecordAt = Date.now();
+    const promise = this.#runResolve(
+      registry,
+      request,
+      owner.controller.signal,
+      inflight
+    );
+    inflight.requests.add(promise);
+    const clear = () => {
+      inflight.requests.delete(promise);
+      if (this.#resolveOwners.get(sent) === owner)
+        this.#resolveOwners.delete(sent);
+    };
+    promise.then(clear, clear);
+    return () => this.#releaseResolve(sent, owner);
+  }
+  /**
+   * One build is done reading the request; the last one out ends it, and
+   * the same question can then be asked again.
+   */
+  #releaseResolve(sent, owner) {
+    if (--owner.readers > 0) return;
+    if (this.#resolveOwners.get(sent) === owner) {
+      this.#resolveOwners.delete(sent);
+      this.#resolveSent.delete(sent);
+    }
+    owner.controller.abort();
+  }
+  /** Never rejects: a resolve that fails leaves every spec to manifest(). */
+  async #runResolve(registry, request, signal, inflight) {
+    try {
+      if ((await this.capabilities(registry)).resolve === void 0)
+        return;
+      const client = await this.getRegistryClient();
+      await fetchResolve(
+        client,
+        registry,
+        request,
+        (record) => {
+          inflight.lastRecordAt = Date.now();
+          absolutizeTarball(
+            record.manifest,
+            `${registry}${record.name}/-/`
+          );
+          this.#vltPackuments.add(`${registry}${record.name}`);
+          for (const spec of record.requested) {
+            this.#deliverResolved(
+              `${registry}${record.name}@${spec}`,
+              record.manifest
+            );
+          }
+          this.#deliverResolved(
+            `${registry}${record.name}@${record.version}`,
+            record.manifest
+          );
+        },
+        signal
+      );
+    } catch {
+    }
+  }
+  /** Record an arrived manifest and wake whoever was waiting for it. */
+  #deliverResolved(key, manifest) {
+    debug("resolve delivered %s", key);
+    this.#resolvedManifests.set(key, manifest);
+    const waiters = this.#resolveWaiters.get(key);
+    if (waiters) {
+      this.#resolveWaiters.delete(key);
+      for (const wake of waiters) wake(manifest);
+    }
+  }
+  /**
+   * The manifest for `key` from an in-flight resolve, or from `fetch` when
+   * the resolve is not carrying it. Undefined when nothing is in flight.
+   *
+   * A stream that is delivering gets a short grace to carry the key, since
+   * its records come in the order the build asks for them; one that has
+   * gone quiet gets none, so a server that is slow to start never charges
+   * that grace to every level of the build. After the grace `fetch` runs as
+   * well and the first answer wins, so a slow server can never hold a
+   * lookup longer than fetching the packument would have. A fetch that
+   * fails while the stream is still open waits for the stream's verdict.
+   */
+  async #awaitResolved(registry, key, fetch) {
+    const inflight = this.#resolveInflight.get(registry);
+    if (!inflight?.requests.size) return void 0;
+    let wake;
+    const arrival = new Promise((res) => {
+      wake = res;
+    });
+    let waiters = this.#resolveWaiters.get(key);
+    if (!waiters) this.#resolveWaiters.set(key, waiters = /* @__PURE__ */ new Set());
+    waiters.add(wake);
+    const settled = Promise.all([...inflight.requests]).then(
+      () => this.#resolvedManifests.get(key)
+    );
+    const quietFor = Date.now() - inflight.lastRecordAt;
+    const grace = Math.max(0, resolveWaitMs() - quietFor);
+    try {
+      const early = await Promise.race([
+        arrival,
+        settled,
+        // unref'd: a pending wait must never be what keeps the process up
+        setTimeout(grace, graceOver, { ref: false })
+      ]);
+      if (early !== graceOver) return early ?? await fetch();
+      debug("resolve hedge %s", key);
+      const hedge = fetch();
+      const outcome = await Promise.race([
+        arrival,
+        settled,
+        hedge.catch(() => void 0)
+      ]);
+      if (outcome) return outcome;
+      const found = await Promise.race([
+        arrival,
+        settled,
+        setTimeout(resolveWaitMs(), graceOver, { ref: false })
+      ]);
+      return found && found !== graceOver ? found : await hedge;
+    } finally {
+      waiters.delete(wake);
+      if (!waiters.size) this.#resolveWaiters.delete(key);
+    }
+  }
+  /** How many manifests resolve batches have delivered. For tests. */
+  get resolvedManifestCount() {
+    return this.#resolvedManifests.size;
+  }
   async manifest(spec, options = {}) {
     const { from = this.#projectRoot } = options;
     if (typeof spec === "string")
@@ -767,6 +1062,14 @@ var PackageInfoClient = class {
     const f = spec.final;
     switch (f.type) {
       case "registry": {
+        const selecting = SELECTION_OPTIONS.some(
+          (k) => options[k] !== void 0
+        );
+        const resolveKey = `${f.registry ?? ""}${f.name}@${f.bareSpec}`;
+        if (!selecting) {
+          const resolved = this.#resolvedManifests.get(resolveKey);
+          if (resolved) return resolved;
+        }
         const cachePath = this._manifestCachePath(spec, options);
         if (cachePath) {
           try {
@@ -789,25 +1092,36 @@ var PackageInfoClient = class {
           } catch {
           }
         }
-        const mani = pickManifest(
-          await this.#packument(f, options, this.#stable(f)),
-          spec,
-          options
-        );
-        if (!mani) throw this.#resolveError(spec, options);
-        if (cachePath && !this.#manifestWritePaths.has(cachePath)) {
-          this.#manifestWritePaths.add(cachePath);
-          const vlt = this.#vltPackuments.has(
-            `${f.registry}${f.name}`
+        const fromPackument = async () => {
+          const mani = pickManifest(
+            await this.#packument(f, options, this.#stable(f)),
+            spec,
+            options
           );
-          void this.#writeManifestCache(
-            cachePath,
-            JSON.stringify(
-              vlt ? { ...mani, __VLT_PACKUMENT: true } : mani
-            )
+          if (!mani) throw this.#resolveError(spec, options);
+          if (cachePath && !this.#manifestWritePaths.has(cachePath)) {
+            this.#manifestWritePaths.add(cachePath);
+            const vlt = this.#vltPackuments.has(
+              `${f.registry}${f.name}`
+            );
+            void this.#writeManifestCache(
+              cachePath,
+              JSON.stringify(
+                vlt ? { ...mani, __VLT_PACKUMENT: true } : mani
+              )
+            );
+          }
+          return mani;
+        };
+        if (!selecting && f.registry) {
+          const resolved = await this.#awaitResolved(
+            f.registry,
+            resolveKey,
+            fromPackument
           );
+          if (resolved) return resolved;
         }
-        return mani;
+        return fromPackument();
       }
       case "git": {
         const {
@@ -849,7 +1163,7 @@ var PackageInfoClient = class {
             );
           }
           const buf = response.buffer();
-          const computed = import_ssri.default.fromData(buf, { algorithms: ["sha512"] }).toString();
+          const integrity = storedIntegrity(response);
           try {
             await (await this.getTarPool()).unpack(buf, dir);
           } catch (er) {
@@ -861,7 +1175,7 @@ var PackageInfoClient = class {
             );
           }
           const mani = this.#readExtracted(dir, s, options);
-          mani.dist = { integrity: computed };
+          if (integrity) mani.dist = { integrity };
           return mani;
         });
       }
@@ -1179,11 +1493,14 @@ var PackageInfoClient = class {
   }
 };
 var absolutizeTarballs = (paku, base) => {
-  for (const { dist } of Object.values(paku.versions)) {
-    const tarball = dist?.tarball;
-    if (tarball && !/^[a-z][a-z0-9+.-]*:/i.test(tarball)) {
-      dist.tarball = String(new URL(tarball, base));
-    }
+  for (const manifest of Object.values(paku.versions)) {
+    absolutizeTarball(manifest, base);
+  }
+};
+var absolutizeTarball = (manifest, base) => {
+  const dist = manifest.dist;
+  if (dist?.tarball && !/^[a-z][a-z0-9+.-]*:/i.test(dist.tarball)) {
+    dist.tarball = String(new URL(dist.tarball, base));
   }
 };
 

package/{chunk-YU2W5UPG.js → chunk-ADDCQBGR.js}

@@ -14,7 +14,7 @@ var require = _vlt_createRequire(import.meta.filename);
 var package_default = {
   name: "@vltpkg/user-agent",
   description: "The User-Agent string that vlt sends with every outbound request",
-  version: "1.3.3",
+  version: "1.3.5",
   repository: {
     type: "git",
     url: "git+https://github.com/vltpkg/vltpkg.git",

package/{chunk-MC6CESRA.js → chunk-AFUXQ3P4.js}

@@ -11,7 +11,7 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   stderr
-} from "./chunk-CSZTT7QN.js";
+} from "./chunk-TOKUDCSW.js";
 import {
   urlOpen
 } from "./chunk-APMYKJI2.js";

package/{chunk-LY5FNWRY.js → chunk-B2CTWVQM.js}

@@ -13,10 +13,10 @@ import {
   actual,
   callLimit,
   createVirtualRoot
-} from "./chunk-ZRRNOLEG.js";
+} from "./chunk-ZZFFMXI2.js";
 import {
   SecurityArchive
-} from "./chunk-DCFLXO2M.js";
+} from "./chunk-XUGOPOLF.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
@@ -140,7 +140,7 @@ var reloadConfig = async (folder) => {
     unload("project");
   } catch {
   }
-  const { Config } = await import("./config-AWX2VEKL.js");
+  const { Config } = await import("./config-HO7N7FPS.js");
   return Config.load(folder, process.argv, true);
 };
 

package/{chunk-CU752KW7.js → chunk-BCANUHR3.js}

@@ -14,7 +14,7 @@ import {
 } from "./chunk-WGDTG44V.js";
 import {
   commandAliases
-} from "./chunk-ENSGPOLR.js";
+} from "./chunk-XU5WNX4S.js";
 
 // ../../node_modules/.vlt/~npm~package-json-from-dist@1.0.1/node_modules/package-json-from-dist/dist/esm/index.js
 import { readFileSync } from "node:fs";

package/{chunk-GA4LA6B2.js → chunk-EGWLQVDZ.js}

@@ -11,19 +11,19 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   openUrl
-} from "./chunk-MC6CESRA.js";
+} from "./chunk-AFUXQ3P4.js";
 import {
   stderr
-} from "./chunk-CSZTT7QN.js";
+} from "./chunk-TOKUDCSW.js";
 import {
   mermaidOutput
-} from "./chunk-ZRRNOLEG.js";
+} from "./chunk-ZZFFMXI2.js";
 import {
   ViewClass
 } from "./chunk-4KCU2KZL.js";
 import {
   getTokenByURL
-} from "./chunk-SH24EMXO.js";
+} from "./chunk-2B5STVCP.js";
 
 // ../../src/cli-sdk/src/query-auth.ts
 var createGetAuthHeader = (conf) => async (url) => getTokenByURL(url, conf.options.identity);