@vltpkg/cli-js 1.3.6 → 1.3.8

package/outdated-FYHPXRMT.js

@@ -0,0 +1,533 @@
+var global = globalThis;
+import {Buffer} from "node:buffer";
+import {setTimeout as _vlt_setTimeout,clearTimeout as _vlt_clearTimeout,setImmediate as _vlt_setImmediate,clearImmediate as _vlt_clearImmediate,setInterval as _vlt_setInterval,clearInterval as _vlt_clearInterval} from "node:timers";
+globalThis.setTimeout = _vlt_setTimeout;
+globalThis.clearTimeout = _vlt_clearTimeout;
+globalThis.setImmediate = _vlt_setImmediate;
+globalThis.clearImmediate = _vlt_clearImmediate;
+globalThis.setInterval = _vlt_setInterval;
+globalThis.clearInterval = _vlt_clearInterval;
+import {createRequire as _vlt_createRequire} from "node:module";
+var require = _vlt_createRequire(import.meta.filename);
+import {
+  createStubNode
+} from "./chunk-3U6QWN62.js";
+import {
+  createGetAuthHeader
+} from "./chunk-QNDM4DVO.js";
+import {
+  assertVltInstalled,
+  createHostContextsMap
+} from "./chunk-WHLYMMI2.js";
+import {
+  PackageInfoClient
+} from "./chunk-DL3H4EMY.js";
+import "./chunk-SRWDPPLX.js";
+import {
+  Edge,
+  GraphModifier,
+  Query,
+  actual
+} from "./chunk-NWHKSRO3.js";
+import {
+  SecurityArchive
+} from "./chunk-XCDLOQZZ.js";
+import {
+  commandUsage
+} from "./chunk-TLY4VGMH.js";
+import {
+  pickManifest
+} from "./chunk-CB65DPZ2.js";
+import "./chunk-SV4WK3KX.js";
+import "./chunk-GZ5MYMBT.js";
+import "./chunk-SE2FSMBR.js";
+import "./chunk-HTOTG4TS.js";
+import "./chunk-5KOLUYXH.js";
+import "./chunk-APMYKJI2.js";
+import "./chunk-6D54UN4T.js";
+import "./chunk-6BQKR2FM.js";
+import "./chunk-U7TEQCBN.js";
+import "./chunk-XNLSTHDK.js";
+import "./chunk-PDWPFR5T.js";
+import "./chunk-Y5PA7DVK.js";
+import {
+  gt,
+  parse,
+  rsort,
+  satisfies,
+  stable
+} from "./chunk-IBGFQR23.js";
+import "./chunk-WZWDS3W4.js";
+import "./chunk-PZLD7RTK.js";
+
+// ../../src/cli-sdk/src/commands/outdated.ts
+var needsRegistry = true;
+var usage = () => commandUsage({
+  command: "outdated",
+  usage: [
+    "",
+    "[package-names...]",
+    "[--target=<query>] [--workspace=<path>]",
+    "[--view=human | json | count]"
+  ],
+  description: `List dependencies that have newer versions available, and
+      what is keeping them from being upgraded.
+
+      For every registry dependency, compare the installed version
+      against the highest version that satisfies the declared range
+      (wanted) and against the registry's \`latest\` dist-tag (latest).
+      Only dependencies that are missing or behind on either count are
+      reported.
+
+      Each report goes beyond the version numbers:
+
+      - the size of the jump (major, minor, patch)
+      - whether the installed version is deprecated
+      - security scores and alerts for the installed, wanted and latest
+        versions, so an upgrade that fixes a vulnerability or one that
+        introduces a flagged version stands out
+      - other dependents whose ranges hold the package back
+      - engine and peer dependency requirements of the latest version
+        that this project does not meet
+      - the command that performs the upgrade
+
+      By default the direct dependencies of the project root and its
+      workspaces are checked; --workspace and --workspace-group narrow
+      that to the given workspaces. The --target option accepts a DSS
+      query selector instead, which can reach any dependency in the
+      graph. Package names given as positional arguments filter either
+      selection.
+
+      The installed versions come from the graph built by
+      \`vlt install\`, so the project must be installed by vlt first.
+      Dependencies that do not resolve against a registry (git, file,
+      remote tarball or workspace specs) are not checked. Catalog specs
+      are checked against the range the catalog resolves them to.`,
+  examples: {
+    "": {
+      description: "Report outdated direct dependencies of the project and all its workspaces"
+    },
+    "react react-dom": {
+      description: `Only check the dependencies named 'react' and 'react-dom'`
+    },
+    "--workspace=packages/app": {
+      description: "Only check the dependencies of a single workspace"
+    },
+    '--target="*"': {
+      description: "Check every dependency in the graph, transitive ones included"
+    },
+    '--target=":root > *:dev"': {
+      description: "Only check the dev dependencies of the project root"
+    },
+    '--target="*:vuln"': {
+      description: "Only check dependencies with known vulnerabilities"
+    },
+    "--view=json": {
+      description: "Print the report as JSON"
+    }
+  },
+  options: {
+    target: {
+      value: "<query>",
+      description: "DSS query selector choosing the dependencies to check, in place of the direct dependencies of the selected importers."
+    },
+    workspace: {
+      value: "<path>",
+      description: "Limit the report to the dependencies of the given workspace(s)."
+    },
+    "workspace-group": {
+      value: "<name>",
+      description: "Limit the report to the dependencies of the workspaces in the given group(s)."
+    },
+    view: {
+      value: "[human | json | count]",
+      description: "Output format. Defaults to human-readable or json if no tty. Count outputs the number of outdated dependencies."
+    }
+  }
+});
+var plural = (n, word) => `${n} ${word}${n === 1 ? "" : "s"}`;
+var missingVersion = (version) => version ?? "missing";
+var formatTable = (columns) => {
+  const lines = [];
+  for (const { title, cells } of columns) {
+    const width = Math.max(title.length, ...cells.map((c) => c.length));
+    const column = [title, ...cells].map((cell) => cell.padEnd(width));
+    column.forEach((cell, i) => {
+      const line = lines[i];
+      lines[i] = line === void 0 ? cell : `${line}  ${cell}`;
+    });
+  }
+  return lines.map((line) => line.trimEnd()).join("\n");
+};
+var alertsNotIn = (alerts, other) => alerts.filter((a) => !other.some((o) => o.key === a.key));
+var serious = (alerts) => alerts.filter(
+  (a) => a.severity === "high" || a.severity === "critical"
+);
+var explain = (entry) => {
+  const parts = [];
+  if (entry.kind !== "missing") parts.push(entry.kind);
+  if (entry.deprecated !== void 0) parts.push("deprecated");
+  const { current } = entry.security ?? {};
+  if (current) {
+    const targets = [
+      ["wanted", entry.inRange ? entry.security?.wanted : void 0],
+      ["latest", entry.security?.latest]
+    ];
+    for (const [label, target] of targets) {
+      if (!target) continue;
+      const fixed = alertsNotIn(
+        serious(current.alerts),
+        target.alerts
+      ).length;
+      const added = alertsNotIn(
+        serious(target.alerts),
+        current.alerts
+      ).length;
+      if (fixed) {
+        parts.push(`${label} fixes ${plural(fixed, "serious alert")}`);
+      }
+      if (added) {
+        parts.push(`${label} adds ${plural(added, "serious alert")}`);
+      }
+      if (current.score - target.score >= 10) {
+        parts.push(
+          `${label} score ${target.score} (from ${current.score})`
+        );
+      }
+    }
+  }
+  if (entry.heldBy?.length) {
+    parts.push(
+      `held by ${entry.heldBy.map((h) => h.dependent).join(", ")}`
+    );
+  }
+  if (entry.requires?.node) {
+    parts.push(`latest needs node ${entry.requires.node}`);
+  }
+  if (entry.requires?.peers) {
+    const peers = Object.entries(entry.requires.peers).map(([name, range]) => `${name}@${range}`).join(", ");
+    parts.push(`latest needs ${peers}`);
+  }
+  return parts.join(", ");
+};
+var suggestActions = (result) => {
+  const lines = [];
+  const updates = result.filter((e) => e.inRange).length;
+  if (updates) {
+    lines.push(
+      `Run \`vlt update\` to pick up ${plural(updates, "in-range update")}.`
+    );
+  }
+  const installs = /* @__PURE__ */ new Map();
+  const edits = /* @__PURE__ */ new Set();
+  for (const { action } of result) {
+    if (!action) continue;
+    if (action.startsWith("vlt install ")) {
+      const [spec = "", ...flags] = action.slice("vlt install ".length).split(" ");
+      const key = flags.join(" ");
+      const specs = installs.get(key) ?? /* @__PURE__ */ new Set();
+      specs.add(spec);
+      installs.set(key, specs);
+    } else if (!action.startsWith("vlt ")) {
+      edits.add(
+        `${action.charAt(0).toUpperCase()}${action.slice(1)}.`
+      );
+    }
+  }
+  for (const [flags, specs] of installs) {
+    const args = [...specs, ...flags ? [flags] : []].join(" ");
+    lines.push(`Run \`vlt install ${args}\` to move to latest.`);
+  }
+  lines.push(...edits);
+  return lines;
+};
+var views = {
+  json: (result) => result,
+  count: (result) => result.length,
+  human: (result) => {
+    if (result.length === 0) {
+      return "All dependencies are up to date.";
+    }
+    const columns = [
+      { title: "Package", cells: result.map((e) => e.name) },
+      {
+        title: "Current",
+        cells: result.map((e) => missingVersion(e.current))
+      },
+      {
+        title: "Wanted",
+        cells: result.map((e) => missingVersion(e.wanted))
+      },
+      {
+        title: "Latest",
+        cells: result.map((e) => missingVersion(e.latest))
+      },
+      { title: "Type", cells: result.map((e) => e.type) }
+    ];
+    if (new Set(result.map((e) => e.dependent)).size > 1) {
+      columns.push({
+        title: "Dependent",
+        cells: result.map((e) => e.dependent)
+      });
+    }
+    columns.push({ title: "Why", cells: result.map(explain) });
+    const actions = suggestActions(result);
+    return [
+      formatTable(columns),
+      ...actions.length ? ["", ...actions] : []
+    ].join("\n");
+  }
+};
+var latestVersion = (packument) => {
+  const tagged = packument["dist-tags"].latest;
+  if (tagged) return tagged;
+  const [highest] = rsort(stable(Object.keys(packument.versions)));
+  return highest;
+};
+var gapKind = (current, target) => {
+  const c = parse(current);
+  const t = parse(target);
+  if (!c || !t) return "patch";
+  if (t.major > c.major) return "major";
+  if (t.minor > c.minor) return "minor";
+  if (t.patch > c.patch) return "patch";
+  return "prerelease";
+};
+var dependentName = (node) => node.importer ? node.name : `${node.name}@${node.version}`;
+var heldBy = (edge, latest) => {
+  const holders = [];
+  for (const other of edge.to?.edgesIn ?? []) {
+    if (other === edge || other.from.importer) continue;
+    const { range } = other.spec.final;
+    if (range && !satisfies(latest, range)) {
+      holders.push({
+        dependent: dependentName(other.from),
+        spec: other.spec.bareSpec
+      });
+    }
+  }
+  return holders;
+};
+var unmetRequirements = (edge, latest, nodeVersion) => {
+  const requires = {};
+  const engine = latest.engines?.node;
+  if (engine && !satisfies(nodeVersion, engine))
+    requires.node = engine;
+  const peers = {};
+  for (const [peer, range] of Object.entries(
+    latest.peerDependencies ?? {}
+  )) {
+    const installed = edge.from.edgesOut.get(peer)?.to?.version;
+    if (installed && !satisfies(installed, range)) peers[peer] = range;
+  }
+  if (Object.keys(peers).length) requires.peers = peers;
+  return requires.node || requires.peers ? requires : void 0;
+};
+var installSpec = (edge, range) => {
+  const { bareSpec, final } = edge.spec;
+  const prefix = bareSpec.slice(
+    0,
+    bareSpec.length - final.bareSpec.length
+  );
+  return `${edge.name}@${prefix}${range}`;
+};
+var saveFlags = {
+  prod: "",
+  dev: " --save-dev",
+  optional: " --save-optional",
+  peer: " --save-peer",
+  peerOptional: " --save-peer"
+};
+var actionFor = (edge, entry, { savePrefix }) => {
+  if (!edge.from.importer) return void 0;
+  if (!entry.current) return "vlt install";
+  const { latest } = entry;
+  const { range } = edge.spec.final;
+  if (latest && gt(latest, entry.current) && range) {
+    if (satisfies(latest, range)) return "vlt update";
+    const newRange = `${savePrefix}${latest}`;
+    if (edge.spec.type === "catalog") {
+      const catalog = edge.spec.catalog ? `"${edge.spec.catalog}" catalog` : "catalog";
+      return `set the ${catalog} entry for ${edge.name} in vlt.json to ${newRange}`;
+    }
+    const workspace = edge.from.mainImporter ? "" : ` --workspace=${edge.from.location.replace(/^\.\//, "")}`;
+    return `vlt install ${installSpec(edge, newRange)}${saveFlags[edge.type]}${workspace}`;
+  }
+  return "vlt update";
+};
+var buildEntry = (edge, packument, options) => {
+  const current = edge.to?.version;
+  const wanted = pickManifest(
+    packument,
+    edge.spec,
+    options.pick
+  )?.version;
+  const latest = latestVersion(packument);
+  const wantedAhead = !!wanted && (!current || gt(wanted, current));
+  const latestAhead = !!latest && (!current || gt(latest, current));
+  if (current && !wantedAhead && !latestAhead) return void 0;
+  const entry = {
+    name: edge.name,
+    spec: edge.spec.bareSpec,
+    type: edge.type,
+    current,
+    wanted,
+    latest,
+    dependent: dependentName(edge.from),
+    location: edge.from.location,
+    kind: !current ? "missing" : latestAhead ? gapKind(current, latest) : gapKind(current, String(wanted)),
+    inRange: wantedAhead
+  };
+  const deprecated = current ? packument.versions[current]?.deprecated : void 0;
+  if (deprecated) entry.deprecated = deprecated;
+  if (latestAhead) {
+    const holders = heldBy(edge, latest);
+    if (holders.length) entry.heldBy = holders;
+    const manifest = packument.versions[latest];
+    const requires = manifest && unmetRequirements(edge, manifest, options.nodeVersion);
+    if (requires) entry.requires = requires;
+  }
+  const action = actionFor(edge, entry, options);
+  if (action) entry.action = action;
+  return entry;
+};
+var selectImporters = (conf, graph) => {
+  const { monorepo } = conf.options;
+  const selected = "workspace" in conf.values || "workspace-group" in conf.values;
+  if (monorepo && selected) {
+    const importers = [];
+    for (const workspace of monorepo.filter(conf.values)) {
+      const node = graph.nodes.get(workspace.id);
+      if (node) importers.push(node);
+    }
+    return importers;
+  }
+  return [...graph.importers];
+};
+var selectEdges = async (conf, graph, archive) => {
+  const target = conf.get("target");
+  if (!target) {
+    return selectImporters(conf, graph).flatMap((importer) => [
+      ...importer.edgesOut.values()
+    ]);
+  }
+  const query = new Query({
+    nodes: new Set(graph.nodes.values()),
+    edges: graph.edges,
+    importers: graph.importers,
+    securityArchive: archive,
+    hostContexts: await createHostContextsMap(conf),
+    getAuthHeader: createGetAuthHeader(conf)
+  });
+  const { edges } = await query.search(target, {
+    signal: new AbortController().signal
+  });
+  return edges.filter((edge) => edge instanceof Edge);
+};
+var startArchive = async (nodes) => {
+  try {
+    return await SecurityArchive.start({ nodes });
+  } catch {
+    return void 0;
+  }
+};
+var securityOf = (archive, id) => {
+  const report = archive.get(id);
+  if (!report) return void 0;
+  return {
+    score: Math.round(report.score.overall * 100),
+    alerts: report.alerts
+  };
+};
+var command = async (conf) => {
+  const { projectRoot, packageJson, monorepo } = conf.options;
+  assertVltInstalled(projectRoot, "outdated");
+  const mainManifest = packageJson.read(projectRoot);
+  const graph = actual.load({
+    ...conf.options,
+    mainManifest,
+    modifiers: GraphModifier.maybeLoad(conf.options),
+    monorepo,
+    loadManifests: true
+  });
+  let archive = conf.get("target") ? await startArchive([...graph.nodes.values()]) : void 0;
+  const names = new Set(conf.positionals);
+  const edges = (await selectEdges(conf, graph, archive)).filter(
+    (edge) => (names.size === 0 || names.has(edge.name)) && edge.spec.final.type === "registry"
+  );
+  const pic = new PackageInfoClient(conf.options);
+  const packuments = /* @__PURE__ */ new Map();
+  const fetchPackument = (edge) => {
+    const { registry, name } = edge.spec.final;
+    const key = `${String(registry)}:${name}`;
+    let p = packuments.get(key);
+    if (!p) {
+      p = pic.packument(edge.spec);
+      packuments.set(key, p);
+    }
+    return p;
+  };
+  const options = {
+    nodeVersion: conf.options["node-version"],
+    savePrefix: conf.options["save-exact"] ? "" : conf.options["save-prefix"],
+    pick: conf.options
+  };
+  const found = [];
+  for (const edge of edges) {
+    const entry = buildEntry(
+      edge,
+      await fetchPackument(edge),
+      options
+    );
+    if (entry) found.push({ edge, entry });
+  }
+  const stub = (edge, version) => createStubNode(
+    edge.spec,
+    edge.spec.final.name,
+    version,
+    conf.options
+  );
+  const securityNodes = /* @__PURE__ */ new Map();
+  const candidates = [];
+  for (const { edge, entry } of found) {
+    const ids = {};
+    if (edge.to) {
+      ids.current = edge.to.id;
+      securityNodes.set(edge.to.id, edge.to);
+    }
+    for (const which of ["wanted", "latest"]) {
+      const version = entry[which];
+      if (!version) continue;
+      const node = stub(edge, version);
+      ids[which] = node.id;
+      securityNodes.set(node.id, node);
+    }
+    candidates.push({ entry, ids });
+  }
+  const nodes = [...securityNodes.values()];
+  if (archive) {
+    await archive.refresh({ nodes }).catch(() => {
+      archive = void 0;
+    });
+  } else if (nodes.length) {
+    archive = await startArchive(nodes);
+  }
+  if (archive) {
+    for (const { entry, ids } of candidates) {
+      const security = {};
+      for (const which of ["current", "wanted", "latest"]) {
+        const id = ids[which];
+        const report = id && securityOf(archive, id);
+        if (report) security[which] = report;
+      }
+      if (Object.keys(security).length) entry.security = security;
+    }
+  }
+  return found.map(({ entry }) => entry);
+};
+export {
+  command,
+  needsRegistry,
+  usage,
+  views
+};

package/{pack-FX24JZR4.js → pack-E5MNPQXK.js}

@@ -11,10 +11,10 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   packTarball
-} from "./chunk-O2B5SLP7.js";
+} from "./chunk-EL4GVZK5.js";
 import {
   createHostContextsMap
-} from "./chunk-WS7BNE5S.js";
+} from "./chunk-WHLYMMI2.js";
 import {
   prettyBytes
 } from "./chunk-XA47WS4N.js";
@@ -23,24 +23,24 @@ import {
   Query,
   actual,
   run
-} from "./chunk-WGSYVB4F.js";
-import "./chunk-2XD7RUKI.js";
+} from "./chunk-NWHKSRO3.js";
+import "./chunk-XCDLOQZZ.js";
 import {
   commandUsage
-} from "./chunk-LHIDMYN2.js";
+} from "./chunk-TLY4VGMH.js";
 import {
   minimatch
-} from "./chunk-GDYDW277.js";
-import "./chunk-JIQBZ2UT.js";
-import "./chunk-64VFL4WI.js";
-import "./chunk-XU5WNX4S.js";
+} from "./chunk-CB65DPZ2.js";
+import "./chunk-SV4WK3KX.js";
+import "./chunk-GZ5MYMBT.js";
+import "./chunk-SE2FSMBR.js";
 import "./chunk-HTOTG4TS.js";
-import "./chunk-TY2UJ3SA.js";
+import "./chunk-6BQKR2FM.js";
 import "./chunk-U7TEQCBN.js";
 import "./chunk-XNLSTHDK.js";
 import "./chunk-PDWPFR5T.js";
 import "./chunk-Y5PA7DVK.js";
-import "./chunk-BP3PQ67D.js";
+import "./chunk-IBGFQR23.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/cli-js",
   "description": "The vlt CLI",
-  "version": "1.3.6",
+  "version": "1.3.8",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",

package/{ping-6QRL622S.js → ping-REQ2KSAR.js}

@@ -11,23 +11,23 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   requireRegistry
-} from "./chunk-J4NHRZX6.js";
+} from "./chunk-A2TSRXZD.js";
 import {
   commandUsage
-} from "./chunk-LHIDMYN2.js";
-import "./chunk-64VFL4WI.js";
-import "./chunk-XU5WNX4S.js";
+} from "./chunk-TLY4VGMH.js";
+import "./chunk-GZ5MYMBT.js";
+import "./chunk-SE2FSMBR.js";
 import {
   RegistryClient
-} from "./chunk-F6ZN6TTL.js";
+} from "./chunk-5KOLUYXH.js";
 import "./chunk-APMYKJI2.js";
-import "./chunk-PBBULTAG.js";
-import "./chunk-TY2UJ3SA.js";
+import "./chunk-6D54UN4T.js";
+import "./chunk-6BQKR2FM.js";
 import "./chunk-U7TEQCBN.js";
 import "./chunk-XNLSTHDK.js";
 import "./chunk-PDWPFR5T.js";
 import "./chunk-Y5PA7DVK.js";
-import "./chunk-BP3PQ67D.js";
+import "./chunk-IBGFQR23.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";

package/{pkg-FPWX4VUE.js → pkg-YB4GSRII.js}

@@ -11,7 +11,7 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   views
-} from "./chunk-RAE3LNUK.js";
+} from "./chunk-PJJCFMLW.js";
 import {
   del,
   get,
@@ -19,33 +19,33 @@ import {
 } from "./chunk-DBANBIL2.js";
 import {
   createHostContextsMap
-} from "./chunk-WS7BNE5S.js";
+} from "./chunk-WHLYMMI2.js";
 import {
   GraphModifier,
   Query,
   VIRTUAL_ROOT_ID,
   actual,
   init
-} from "./chunk-WGSYVB4F.js";
+} from "./chunk-NWHKSRO3.js";
 import {
   SecurityArchive
-} from "./chunk-2XD7RUKI.js";
+} from "./chunk-XCDLOQZZ.js";
 import {
   commandUsage
-} from "./chunk-LHIDMYN2.js";
+} from "./chunk-TLY4VGMH.js";
 import {
   minimatch
-} from "./chunk-GDYDW277.js";
-import "./chunk-JIQBZ2UT.js";
-import "./chunk-64VFL4WI.js";
-import "./chunk-XU5WNX4S.js";
+} from "./chunk-CB65DPZ2.js";
+import "./chunk-SV4WK3KX.js";
+import "./chunk-GZ5MYMBT.js";
+import "./chunk-SE2FSMBR.js";
 import "./chunk-HTOTG4TS.js";
-import "./chunk-TY2UJ3SA.js";
+import "./chunk-6BQKR2FM.js";
 import "./chunk-U7TEQCBN.js";
 import "./chunk-XNLSTHDK.js";
 import "./chunk-PDWPFR5T.js";
 import "./chunk-Y5PA7DVK.js";
-import "./chunk-BP3PQ67D.js";
+import "./chunk-IBGFQR23.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";