@vltpkg/cli-js 1.3.6 → 1.3.8

package/{chunk-WGSYVB4F.js → chunk-NWHKSRO3.js}

@@ -13,7 +13,7 @@ import {
   AbortError,
   SecurityArchive,
   pRetry
-} from "./chunk-2XD7RUKI.js";
+} from "./chunk-XCDLOQZZ.js";
 import {
   Monorepo,
   PackageJson,
@@ -21,7 +21,7 @@ import {
   getUser,
   minimatch,
   platformCheck
-} from "./chunk-GDYDW277.js";
+} from "./chunk-CB65DPZ2.js";
 import {
   asDepID,
   baseDepID,
@@ -36,10 +36,10 @@ import {
   joinExtra,
   splitDepID,
   splitExtra
-} from "./chunk-JIQBZ2UT.js";
+} from "./chunk-SV4WK3KX.js";
 import {
   Spec as Spec2
-} from "./chunk-64VFL4WI.js";
+} from "./chunk-GZ5MYMBT.js";
 import {
   load,
   walkUp
@@ -47,7 +47,7 @@ import {
 import {
   userAgent,
   userAgentHeaders
-} from "./chunk-TY2UJ3SA.js";
+} from "./chunk-6BQKR2FM.js";
 import {
   graphStep,
   promiseSpawn
@@ -100,9 +100,10 @@ import {
   shortDependencyTypes,
   subset,
   tarballFormat
-} from "./chunk-BP3PQ67D.js";
+} from "./chunk-IBGFQR23.js";
 import {
   error,
+  syntaxError,
   typeError
 } from "./chunk-WZWDS3W4.js";
 import {
@@ -4913,6 +4914,9 @@ var Node = class _Node {
   }
 };
 var copyPackageMetadata = (to, from) => {
+  if (!from.integrity && !from.resolved) return;
+  if (!to.integrity && !to.resolved) to.brotli = from.brotli;
+  if (to.brotli !== from.brotli) return;
   to.integrity ??= from.integrity;
   to.resolved ??= from.resolved;
   if (from.resolvedFromLockfile && to.integrity && to.resolved) {
@@ -5629,6 +5633,85 @@ var runExecFG = async (options) => runExecImpl(options, runFG, execFG);
 // ../../src/dss-parser/src/index.ts
 var import_postcss_selector_parser = __toESM(require_dist(), 1);
 
+// ../../src/dss-parser/src/grammar.ts
+var pseudoClassNames = [
+  "abandoned",
+  "attr",
+  "built",
+  "confused",
+  "cve",
+  "cwe",
+  "debug",
+  "deprecated",
+  "dev",
+  "diff",
+  "dist",
+  "dynamic",
+  "empty",
+  "entropic",
+  "env",
+  "eval",
+  "fs",
+  "has",
+  "host",
+  "hostname",
+  "is",
+  "license",
+  "link",
+  "malware",
+  "minified",
+  "missing",
+  "native",
+  "network",
+  "not",
+  "obfuscated",
+  "optional",
+  "outdated",
+  "overridden",
+  "path",
+  "peer",
+  "prerelease",
+  "private",
+  "prod",
+  "project",
+  "published",
+  "registry",
+  "root",
+  "scanned",
+  "scope",
+  "score",
+  "scripts",
+  "semver",
+  "sev",
+  "severity",
+  "shell",
+  "shrinkwrap",
+  "spec",
+  "squat",
+  "suspicious",
+  "tracker",
+  "trivial",
+  "type",
+  "undesirable",
+  "unknown",
+  "unmaintained",
+  "unpopular",
+  "unstable",
+  "v",
+  "vuln",
+  "vulnerable",
+  "workspace"
+];
+var combinatorNames = [">", "~", " "];
+var attributeOperatorNames = [
+  "=",
+  "^=",
+  "$=",
+  "~=",
+  "*=",
+  "|="
+];
+
 // ../../src/dss-parser/src/types.ts
 var isPostcssNodeWithChildren = (node) => "type" in node && "nodes" in node;
 var asPostcssNodeWithChildren = (node) => {
@@ -5755,7 +5838,68 @@ var pseudoCleanUpNeeded = /* @__PURE__ */ new Set([
   ":vulnerable"
 ]);
 var hasParamsToEscape = (node) => pseudoCleanUpNeeded.has(node.value);
-var parse2 = (query) => {
+var pseudoClasses = new Set(pseudoClassNames);
+var combinators = new Set(combinatorNames);
+var attributeOperators = new Set(attributeOperatorNames);
+var selectorPseudos = /* @__PURE__ */ new Set(["has", "is", "not"]);
+var invalid = (message, found) => syntaxError(message, { code: "EQUERY", found });
+var validate = (selector, query, forgiving = false) => {
+  const nodes = selector.nodes.filter((n) => n.type !== "comment");
+  if (!nodes.length && !forgiving) {
+    throw invalid("Empty selector", query);
+  }
+  nodes.forEach((node, i) => {
+    if (node.type === "id" && !node.value || node.type === "attribute" && !node.attribute) {
+      throw invalid(
+        "Unsupported selector",
+        node.type === "id" ? "#" : "[]"
+      );
+    }
+    if (isCombinatorNode(node)) {
+      if (forgiving) return;
+      if (!combinators.has(node.value)) {
+        throw syntaxError(`Unsupported combinator: ${node.value}`, {
+          code: "EQUERY",
+          found: node.value,
+          validOptions: combinatorNames
+        });
+      }
+      const next = nodes[i + 1];
+      if (!next || isCombinatorNode(next)) {
+        throw invalid("Dangling combinator", query);
+      }
+    } else if (isPseudoNode(node)) {
+      const name = node.value.slice(1);
+      if (!pseudoClasses.has(name)) {
+        if (forgiving) return;
+        throw invalid(
+          `Unsupported pseudo-class: ${node.value}`,
+          node.value
+        );
+      }
+      if (selectorPseudos.has(name)) {
+        for (const n of node.nodes) {
+          validate(
+            asSelectorNode(n),
+            query,
+            forgiving || name === "is"
+          );
+        }
+      }
+    } else if (isAttributeNode(node)) {
+      if (!forgiving && node.operator && !attributeOperators.has(node.operator)) {
+        throw invalid(
+          `Unsupported attribute operator: ${node.operator}`,
+          node.operator
+        );
+      }
+    } else if (isTagNode(node) && node.value !== "{" && node.value !== "}" || isStringNode(node)) {
+      throw invalid("Unsupported selector", node.value);
+    }
+  });
+};
+var parse2 = (query, { loose = false } = {}) => {
+  if (!loose && !query.trim()) throw invalid("Empty query", query);
   const escapedQuery = escapeDots(escapeScopedNamesSlashes(query));
   const transformAst = (root2) => {
     root2.walk((node) => {
@@ -5765,6 +5909,7 @@ var parse2 = (query) => {
       if (isPseudoNode(node) && hasParamsToEscape(node)) {
         for (const n of node.nodes) {
           const selector = asSelectorNode(n);
+          if (!selector.nodes.length) continue;
           selector.nodes.forEach((currentNode, index, arr) => {
             const nextNode = arr[index + 1];
             if (isCombinatorNode(currentNode) && isTagNode(nextNode)) {
@@ -5794,7 +5939,24 @@ var parse2 = (query) => {
       }
     });
   };
-  return (0, import_postcss_selector_parser.default)(transformAst).astSync(escapedQuery);
+  let ast;
+  try {
+    ast = (0, import_postcss_selector_parser.default)(transformAst).astSync(escapedQuery);
+  } catch (err) {
+    const reason = err instanceof TypeError ? "unexpected end of input" : err.message;
+    throw syntaxError(`Invalid query syntax: ${reason}`, {
+      code: "EQUERY",
+      found: query,
+      cause: err
+    });
+  }
+  if (!loose) {
+    if (/(^|[^\\])(\\\\)*,\s*$/.test(query)) {
+      throw invalid("Empty selector", query);
+    }
+    for (const s of ast.nodes) validate(s, query);
+  }
+  return ast;
 };
 
 // ../../src/query/src/error.ts
@@ -8948,7 +9110,7 @@ var Query = class {
         edges.add(edge);
       }
     }
-    const current = parse2(query);
+    const current = parse2(query, { loose: true });
     const loose = asPostcssNodeWithChildren(current).nodes.length > 1;
     const {
       collect,
@@ -9003,7 +9165,7 @@ var Query = class {
     const tokens = [];
     const ast = (q) => {
       try {
-        return parse2(q);
+        return parse2(q, { loose: true });
       } catch (_e) {
         return ast(q.slice(0, -1));
       }
@@ -9434,9 +9596,10 @@ var Graph = class {
   /**
    * Whether the lockfile on disk no longer matches this graph even
    * though no node changed, e.g. an importer edge spec was rewritten to
-   * the value saved to `package.json`, or the config options the graph
-   * was built with differ from the ones stored in the lockfile. Reify
-   * saves the lockfiles from its no-diff early return when set.
+   * the value saved to `package.json`, a node dev/optional flag was
+   * re-derived, or the config options the graph was built with differ
+   * from the ones stored in the lockfile. Reify saves the lockfiles
+   * from its no-diff early return when set.
    */
   lockfileStale = false;
   /**
@@ -9527,6 +9690,34 @@ var Graph = class {
   nextPeerContextIndex() {
     return ++this.currentPeerContextIndex;
   }
+  /**
+   * Re-derive node `dev`/`optional` flags: a node is dev/optional only
+   * when every importer path crosses a dev/optional edge. Placement only
+   * ever lowers these flags, so removed or retyped edges leave them
+   * stale. Sets `lockfileStale` when any flag changes.
+   */
+  recomputeFlags() {
+    const reach = (skip) => {
+      const seen = new Set(this.importers);
+      for (const node of seen) {
+        for (const edge of node.edgesOut.values()) {
+          if (edge.to && !skip(edge)) seen.add(edge.to);
+        }
+      }
+      return seen;
+    };
+    const nonDev = reach((edge) => edge.dev);
+    const nonOptional = reach((edge) => edge.optional);
+    for (const node of this.nodes.values()) {
+      const dev2 = !nonDev.has(node);
+      const optional2 = !nonOptional.has(node);
+      if (node.dev !== dev2 || node.optional !== optional2) {
+        node.dev = dev2;
+        node.optional = optional2;
+        this.lockfileStale = true;
+      }
+    }
+  }
   /**
    * Delete all nodes and edges that are unreachable from the importers.
    * The collection of deleted nodes is returned.
@@ -10070,7 +10261,9 @@ var loadNodes = (graph, nodes, options, actual2, throwOnMissingManifest) => {
     node.optional = optional2;
     node.brotli = brotli;
     node.integrity = integrity ?? referenceNode?.integrity;
-    node.resolved = type2 === "remote" ? filepath : resolved ?? referenceNode?.resolved;
+    const refResolved = referenceNode?.resolved;
+    const refResolvedUsable = !integrity || !refResolved || tarballFormat(refResolved) === "brotli" === brotli;
+    node.resolved = type2 === "remote" ? filepath : resolved ?? (refResolvedUsable ? refResolved : void 0);
     node.resolvedFromLockfile = !!(node.integrity && node.resolved);
     node.projectRoot = graph.projectRoot;
     if (!node.resolved) node.setResolved();
@@ -11508,7 +11701,7 @@ var Breadcrumb = class {
   constructor(query) {
     this.#items = [];
     this.specificity = { idCounter: 0, commonCounter: 0 };
-    const ast = parse2(query);
+    const ast = parse2(query, { loose: true });
     let afterCombinator = true;
     for (const item of ast.first.nodes) {
       const pseudoNode = isPseudoNode(item);
@@ -14171,6 +14364,7 @@ var buildIdealFromStartingGraph = async (options) => {
       options
     );
   }
+  options.graph.recomputeFlags();
   return options.graph;
 };
 
@@ -14305,7 +14499,7 @@ import {
   stat as stat2,
   writeFile as writeFile3
 } from "node:fs/promises";
-import { dirname as dirname5, relative as relative2 } from "node:path";
+import { dirname as dirname5, isAbsolute, relative as relative2 } from "node:path";
 
 // ../../src/cmd-shim/src/to-batch-syntax.ts
 var convertToSetCommand = (key, value) => convertToSetCommand_(key.trim(), value.trim());
@@ -14406,6 +14600,18 @@ var cmdShimIfExists = async (from, to, remover) => {
   }
   await writeShim(from, to, remover);
 };
+var cmdShim = async (from, to, remover) => {
+  try {
+    await stat2(from);
+    await writeShim(from, to, remover);
+  } catch (er) {
+    throw error("Could not shim to executable file", {
+      path: from,
+      target: to,
+      cause: er
+    });
+  }
+};
 var writeShim = async (from, to, remover) => {
   await Promise.all([
     remover.rm(to),
@@ -14430,6 +14636,7 @@ var writeShim = async (from, to, remover) => {
 };
 var writeShim_ = async (from, to, prog, args, variables) => {
   let shTarget = relative2(dirname5(to), from);
+  const [dp0, basedir] = isAbsolute(shTarget) ? ["", ""] : ["%dp0%\\", "$basedir/"];
   let target = shTarget.split("/").join("\\");
   let longProg;
   let shProg = prog?.split("\\").join("/");
@@ -14440,8 +14647,8 @@ var writeShim_ = async (from, to, prog, args, variables) => {
   args = args || "";
   variables = variables || "";
   if (!prog) {
-    prog = `"%dp0%\\${target}"`;
-    shProg = `"$basedir/${shTarget}"`;
+    prog = `"${dp0}${target}"`;
+    shProg = `"${basedir}${shTarget}"`;
     pwshProg = shProg;
     args = "";
     target = "";
@@ -14450,8 +14657,8 @@ var writeShim_ = async (from, to, prog, args, variables) => {
     longProg = `"%dp0%\\${prog}.exe"`;
     shLongProg = `"$basedir/${prog}"`;
     pwshLongProg = `"$basedir/${prog}$exe"`;
-    target = `"%dp0%\\${target}"`;
-    shTarget = `"$basedir/${shTarget}"`;
+    target = `"${dp0}${target}"`;
+    shTarget = `"${basedir}${shTarget}"`;
   }
   const head = "@ECHO off\r\nGOTO start\r\n:find_dp0\r\nSET dp0=%~dp0\r\nEXIT /b\r\n:start\r\nSETLOCAL\r\nCALL :find_dp0\r\n";
   let cmd;
@@ -15169,15 +15376,21 @@ var uninstall = async (options, remove) => {
   const mainManifest = options.packageJson.read(options.projectRoot);
   const modifiers = GraphModifier.maybeLoad(options);
   const remover = new RollbackRemove();
+  const monorepo = Monorepo.maybeLoad(options.projectRoot, {
+    packageJson: options.packageJson,
+    scurry: options.scurry
+  });
   try {
     const act = load4({
       ...options,
+      monorepo,
       modifiers: void 0,
       mainManifest,
       loadManifests: true
     });
     const graph = await build3({
       ...options,
+      monorepo,
       actual: act,
       remove,
       mainManifest,
@@ -15227,6 +15440,30 @@ var uninstall = async (options, remove) => {
 // ../../src/graph/src/update.ts
 import { existsSync as existsSync5, rmSync as rmSync3 } from "node:fs";
 import { resolve as resolve12 } from "node:path";
+var startingGraph = (options, monorepo) => {
+  const fresh = () => new Graph({ ...options, monorepo });
+  if (!options.monorepo || !monorepo) return fresh();
+  const selected = new Set(
+    [...options.monorepo.values()].map((ws) => ws.id)
+  );
+  if (selected.size === monorepo.size) return fresh();
+  let graph;
+  try {
+    graph = load3({ ...options, monorepo });
+  } catch (err) {
+    if (isPathSecurityError(err)) throw err;
+    graph = load4({ ...options, monorepo, loadManifests: true });
+  }
+  for (const importer of graph.importers) {
+    if (!selected.has(importer.id)) continue;
+    for (const edge of importer.edgesOut.values()) {
+      edge.to?.edgesIn.delete(edge);
+    }
+    importer.edgesOut.clear();
+  }
+  graph.gc();
+  return graph;
+};
 var update = async (options) => {
   let mainManifest = void 0;
   try {
@@ -15243,6 +15480,10 @@ var update = async (options) => {
   }
   const modifiers = GraphModifier.maybeLoad(options);
   const remover = new RollbackRemove();
+  const monorepo = Monorepo.maybeLoad(options.projectRoot, {
+    packageJson: options.packageJson,
+    scurry: options.scurry
+  });
   try {
     const done = graphStep("build");
     const graph = await buildIdealFromStartingGraph({
@@ -15251,13 +15492,17 @@ var update = async (options) => {
       remove: Object.assign(/* @__PURE__ */ new Map(), {
         modifiedDependencies: false
       }),
-      graph: new Graph({ ...options, mainManifest }),
+      graph: startingGraph(
+        { ...options, mainManifest, modifiers },
+        monorepo
+      ),
       modifiers,
       remover
     });
     done();
     const act = load4({
       ...options,
+      monorepo,
       mainManifest,
       loadManifests: true
     });
@@ -15591,6 +15836,7 @@ var install = async (options, add) => {
 export {
   asDependency,
   addKey,
+  Edge,
   asNode,
   run,
   runFG,
@@ -15606,6 +15852,7 @@ export {
   humanReadableOutput,
   mermaidOutput,
   findCmdShimIfExists,
+  cmdShim,
   RollbackRemove,
   GraphModifier,
   init,

package/{chunk-JELA46YR.js → chunk-OAP2ROTL.js}

@@ -34,7 +34,7 @@ var run = async (command) => {
   if (command) {
     process.argv.splice(2, 0, command);
   }
-  const vlt = await import("./src-54SW7RQE.js");
+  const vlt = await import("./src-XQ7KVUVN.js");
   await vlt.default();
 };
 

package/{chunk-AFUXQ3P4.js → chunk-OWMR2EDW.js}

@@ -11,7 +11,7 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   stderr
-} from "./chunk-TOKUDCSW.js";
+} from "./chunk-XDSZO74H.js";
 import {
   urlOpen
 } from "./chunk-APMYKJI2.js";

package/{chunk-RAE3LNUK.js → chunk-PJJCFMLW.js}

@@ -12,16 +12,16 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   init,
   install
-} from "./chunk-WGSYVB4F.js";
+} from "./chunk-NWHKSRO3.js";
 import {
   commandUsage
-} from "./chunk-LHIDMYN2.js";
+} from "./chunk-TLY4VGMH.js";
 import {
   assertWSConfig,
   minimatch,
   resolveWSConfig,
   splitNegatedPatterns
-} from "./chunk-GDYDW277.js";
+} from "./chunk-CB65DPZ2.js";
 import {
   load,
   save

package/chunk-QNDM4DVO.js

@@ -0,0 +1,25 @@
+var global = globalThis;
+import {Buffer} from "node:buffer";
+import {setTimeout as _vlt_setTimeout,clearTimeout as _vlt_clearTimeout,setImmediate as _vlt_setImmediate,clearImmediate as _vlt_clearImmediate,setInterval as _vlt_setInterval,clearInterval as _vlt_clearInterval} from "node:timers";
+globalThis.setTimeout = _vlt_setTimeout;
+globalThis.clearTimeout = _vlt_clearTimeout;
+globalThis.setImmediate = _vlt_setImmediate;
+globalThis.clearImmediate = _vlt_clearImmediate;
+globalThis.setInterval = _vlt_setInterval;
+globalThis.clearInterval = _vlt_clearInterval;
+import {createRequire as _vlt_createRequire} from "node:module";
+var require = _vlt_createRequire(import.meta.filename);
+import {
+  getTokenByURL,
+  registryKeys
+} from "./chunk-5KOLUYXH.js";
+
+// ../../src/cli-sdk/src/query-auth.ts
+var createGetAuthHeader = (conf) => {
+  const keys = registryKeys(conf.options);
+  return async (url) => getTokenByURL(url, conf.options.identity, keys);
+};
+
+export {
+  createGetAuthHeader
+};

package/{chunk-XU5WNX4S.js → chunk-SE2FSMBR.js}

@@ -1096,6 +1096,7 @@ var canonicalCommands = {
   logout: "logout",
   list: "list",
   ls: "ls",
+  outdated: "outdated",
   pack: "pack",
   ping: "ping",
   pkg: "pkg",

package/{chunk-JIQBZ2UT.js → chunk-SV4WK3KX.js}

@@ -11,12 +11,12 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   Spec as Spec2
-} from "./chunk-64VFL4WI.js";
+} from "./chunk-GZ5MYMBT.js";
 import {
   Spec,
   currentDefaultRegistryName,
   defaultRegistryName
-} from "./chunk-BP3PQ67D.js";
+} from "./chunk-IBGFQR23.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";

package/{chunk-LHIDMYN2.js → chunk-TLY4VGMH.js}

@@ -12,7 +12,7 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   commandAliases,
   jack
-} from "./chunk-XU5WNX4S.js";
+} from "./chunk-SE2FSMBR.js";
 
 // ../../src/cli-sdk/src/config/usage.ts
 var toArr = (v) => Array.isArray(v) ? v : [v];

package/{chunk-WS7BNE5S.js → chunk-WHLYMMI2.js}

@@ -13,10 +13,10 @@ import {
   actual,
   callLimit,
   createVirtualRoot
-} from "./chunk-WGSYVB4F.js";
+} from "./chunk-NWHKSRO3.js";
 import {
   SecurityArchive
-} from "./chunk-2XD7RUKI.js";
+} from "./chunk-XCDLOQZZ.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
@@ -140,7 +140,7 @@ var reloadConfig = async (folder) => {
     unload("project");
   } catch {
   }
-  const { Config } = await import("./config-6VRNS5F3.js");
+  const { Config } = await import("./config-MVNXGEOQ.js");
   return Config.load(folder, process.argv, true);
 };
 

package/{chunk-LFCZGP2L.js → chunk-WKA5UYNA.js}

@@ -11,22 +11,16 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   openUrl
-} from "./chunk-AFUXQ3P4.js";
+} from "./chunk-OWMR2EDW.js";
 import {
   stderr
-} from "./chunk-TOKUDCSW.js";
+} from "./chunk-XDSZO74H.js";
 import {
   mermaidOutput
-} from "./chunk-WGSYVB4F.js";
+} from "./chunk-NWHKSRO3.js";
 import {
   ViewClass
 } from "./chunk-4KCU2KZL.js";
-import {
-  getTokenByURL
-} from "./chunk-F6ZN6TTL.js";
-
-// ../../src/cli-sdk/src/query-auth.ts
-var createGetAuthHeader = (conf) => async (url) => getTokenByURL(url, conf.options.identity);
 
 // ../../src/cli-sdk/src/mermaid-image-view.ts
 var MermaidImageView = class extends ViewClass {
@@ -53,6 +47,5 @@ var MermaidImageView = class extends ViewClass {
 };
 
 export {
-  createGetAuthHeader,
   MermaidImageView
 };

package/{chunk-2XD7RUKI.js → chunk-XCDLOQZZ.js}

@@ -13,10 +13,10 @@ import {
   asDepID,
   baseDepID,
   splitDepID
-} from "./chunk-JIQBZ2UT.js";
+} from "./chunk-SV4WK3KX.js";
 import {
   userAgent
-} from "./chunk-TY2UJ3SA.js";
+} from "./chunk-6BQKR2FM.js";
 import {
   I
 } from "./chunk-U7TEQCBN.js";
@@ -25,7 +25,7 @@ import {
 } from "./chunk-XNLSTHDK.js";
 import {
   defaultRegistryName
-} from "./chunk-BP3PQ67D.js";
+} from "./chunk-IBGFQR23.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";