@vltpkg/cli-js 1.3.7 → 1.3.8

package/{chunk-7BHHCB5C.js → chunk-NWHKSRO3.js}

@@ -13,7 +13,7 @@ import {
   AbortError,
   SecurityArchive,
   pRetry
-} from "./chunk-OWUICQFY.js";
+} from "./chunk-XCDLOQZZ.js";
 import {
   Monorepo,
   PackageJson,
@@ -47,7 +47,7 @@ import {
 import {
   userAgent,
   userAgentHeaders
-} from "./chunk-VBDNOU76.js";
+} from "./chunk-6BQKR2FM.js";
 import {
   graphStep,
   promiseSpawn
@@ -103,6 +103,7 @@ import {
 } from "./chunk-IBGFQR23.js";
 import {
   error,
+  syntaxError,
   typeError
 } from "./chunk-WZWDS3W4.js";
 import {
@@ -5632,6 +5633,85 @@ var runExecFG = async (options) => runExecImpl(options, runFG, execFG);
 // ../../src/dss-parser/src/index.ts
 var import_postcss_selector_parser = __toESM(require_dist(), 1);
 
+// ../../src/dss-parser/src/grammar.ts
+var pseudoClassNames = [
+  "abandoned",
+  "attr",
+  "built",
+  "confused",
+  "cve",
+  "cwe",
+  "debug",
+  "deprecated",
+  "dev",
+  "diff",
+  "dist",
+  "dynamic",
+  "empty",
+  "entropic",
+  "env",
+  "eval",
+  "fs",
+  "has",
+  "host",
+  "hostname",
+  "is",
+  "license",
+  "link",
+  "malware",
+  "minified",
+  "missing",
+  "native",
+  "network",
+  "not",
+  "obfuscated",
+  "optional",
+  "outdated",
+  "overridden",
+  "path",
+  "peer",
+  "prerelease",
+  "private",
+  "prod",
+  "project",
+  "published",
+  "registry",
+  "root",
+  "scanned",
+  "scope",
+  "score",
+  "scripts",
+  "semver",
+  "sev",
+  "severity",
+  "shell",
+  "shrinkwrap",
+  "spec",
+  "squat",
+  "suspicious",
+  "tracker",
+  "trivial",
+  "type",
+  "undesirable",
+  "unknown",
+  "unmaintained",
+  "unpopular",
+  "unstable",
+  "v",
+  "vuln",
+  "vulnerable",
+  "workspace"
+];
+var combinatorNames = [">", "~", " "];
+var attributeOperatorNames = [
+  "=",
+  "^=",
+  "$=",
+  "~=",
+  "*=",
+  "|="
+];
+
 // ../../src/dss-parser/src/types.ts
 var isPostcssNodeWithChildren = (node) => "type" in node && "nodes" in node;
 var asPostcssNodeWithChildren = (node) => {
@@ -5758,7 +5838,68 @@ var pseudoCleanUpNeeded = /* @__PURE__ */ new Set([
   ":vulnerable"
 ]);
 var hasParamsToEscape = (node) => pseudoCleanUpNeeded.has(node.value);
-var parse2 = (query) => {
+var pseudoClasses = new Set(pseudoClassNames);
+var combinators = new Set(combinatorNames);
+var attributeOperators = new Set(attributeOperatorNames);
+var selectorPseudos = /* @__PURE__ */ new Set(["has", "is", "not"]);
+var invalid = (message, found) => syntaxError(message, { code: "EQUERY", found });
+var validate = (selector, query, forgiving = false) => {
+  const nodes = selector.nodes.filter((n) => n.type !== "comment");
+  if (!nodes.length && !forgiving) {
+    throw invalid("Empty selector", query);
+  }
+  nodes.forEach((node, i) => {
+    if (node.type === "id" && !node.value || node.type === "attribute" && !node.attribute) {
+      throw invalid(
+        "Unsupported selector",
+        node.type === "id" ? "#" : "[]"
+      );
+    }
+    if (isCombinatorNode(node)) {
+      if (forgiving) return;
+      if (!combinators.has(node.value)) {
+        throw syntaxError(`Unsupported combinator: ${node.value}`, {
+          code: "EQUERY",
+          found: node.value,
+          validOptions: combinatorNames
+        });
+      }
+      const next = nodes[i + 1];
+      if (!next || isCombinatorNode(next)) {
+        throw invalid("Dangling combinator", query);
+      }
+    } else if (isPseudoNode(node)) {
+      const name = node.value.slice(1);
+      if (!pseudoClasses.has(name)) {
+        if (forgiving) return;
+        throw invalid(
+          `Unsupported pseudo-class: ${node.value}`,
+          node.value
+        );
+      }
+      if (selectorPseudos.has(name)) {
+        for (const n of node.nodes) {
+          validate(
+            asSelectorNode(n),
+            query,
+            forgiving || name === "is"
+          );
+        }
+      }
+    } else if (isAttributeNode(node)) {
+      if (!forgiving && node.operator && !attributeOperators.has(node.operator)) {
+        throw invalid(
+          `Unsupported attribute operator: ${node.operator}`,
+          node.operator
+        );
+      }
+    } else if (isTagNode(node) && node.value !== "{" && node.value !== "}" || isStringNode(node)) {
+      throw invalid("Unsupported selector", node.value);
+    }
+  });
+};
+var parse2 = (query, { loose = false } = {}) => {
+  if (!loose && !query.trim()) throw invalid("Empty query", query);
   const escapedQuery = escapeDots(escapeScopedNamesSlashes(query));
   const transformAst = (root2) => {
     root2.walk((node) => {
@@ -5768,6 +5909,7 @@ var parse2 = (query) => {
       if (isPseudoNode(node) && hasParamsToEscape(node)) {
         for (const n of node.nodes) {
           const selector = asSelectorNode(n);
+          if (!selector.nodes.length) continue;
           selector.nodes.forEach((currentNode, index, arr) => {
             const nextNode = arr[index + 1];
             if (isCombinatorNode(currentNode) && isTagNode(nextNode)) {
@@ -5797,7 +5939,24 @@ var parse2 = (query) => {
       }
     });
   };
-  return (0, import_postcss_selector_parser.default)(transformAst).astSync(escapedQuery);
+  let ast;
+  try {
+    ast = (0, import_postcss_selector_parser.default)(transformAst).astSync(escapedQuery);
+  } catch (err) {
+    const reason = err instanceof TypeError ? "unexpected end of input" : err.message;
+    throw syntaxError(`Invalid query syntax: ${reason}`, {
+      code: "EQUERY",
+      found: query,
+      cause: err
+    });
+  }
+  if (!loose) {
+    if (/(^|[^\\])(\\\\)*,\s*$/.test(query)) {
+      throw invalid("Empty selector", query);
+    }
+    for (const s of ast.nodes) validate(s, query);
+  }
+  return ast;
 };
 
 // ../../src/query/src/error.ts
@@ -8951,7 +9110,7 @@ var Query = class {
         edges.add(edge);
       }
     }
-    const current = parse2(query);
+    const current = parse2(query, { loose: true });
     const loose = asPostcssNodeWithChildren(current).nodes.length > 1;
     const {
       collect,
@@ -9006,7 +9165,7 @@ var Query = class {
     const tokens = [];
     const ast = (q) => {
       try {
-        return parse2(q);
+        return parse2(q, { loose: true });
       } catch (_e) {
         return ast(q.slice(0, -1));
       }
@@ -9437,9 +9596,10 @@ var Graph = class {
   /**
    * Whether the lockfile on disk no longer matches this graph even
    * though no node changed, e.g. an importer edge spec was rewritten to
-   * the value saved to `package.json`, or the config options the graph
-   * was built with differ from the ones stored in the lockfile. Reify
-   * saves the lockfiles from its no-diff early return when set.
+   * the value saved to `package.json`, a node dev/optional flag was
+   * re-derived, or the config options the graph was built with differ
+   * from the ones stored in the lockfile. Reify saves the lockfiles
+   * from its no-diff early return when set.
    */
   lockfileStale = false;
   /**
@@ -9530,6 +9690,34 @@ var Graph = class {
   nextPeerContextIndex() {
     return ++this.currentPeerContextIndex;
   }
+  /**
+   * Re-derive node `dev`/`optional` flags: a node is dev/optional only
+   * when every importer path crosses a dev/optional edge. Placement only
+   * ever lowers these flags, so removed or retyped edges leave them
+   * stale. Sets `lockfileStale` when any flag changes.
+   */
+  recomputeFlags() {
+    const reach = (skip) => {
+      const seen = new Set(this.importers);
+      for (const node of seen) {
+        for (const edge of node.edgesOut.values()) {
+          if (edge.to && !skip(edge)) seen.add(edge.to);
+        }
+      }
+      return seen;
+    };
+    const nonDev = reach((edge) => edge.dev);
+    const nonOptional = reach((edge) => edge.optional);
+    for (const node of this.nodes.values()) {
+      const dev2 = !nonDev.has(node);
+      const optional2 = !nonOptional.has(node);
+      if (node.dev !== dev2 || node.optional !== optional2) {
+        node.dev = dev2;
+        node.optional = optional2;
+        this.lockfileStale = true;
+      }
+    }
+  }
   /**
    * Delete all nodes and edges that are unreachable from the importers.
    * The collection of deleted nodes is returned.
@@ -11513,7 +11701,7 @@ var Breadcrumb = class {
   constructor(query) {
     this.#items = [];
     this.specificity = { idCounter: 0, commonCounter: 0 };
-    const ast = parse2(query);
+    const ast = parse2(query, { loose: true });
     let afterCombinator = true;
     for (const item of ast.first.nodes) {
       const pseudoNode = isPseudoNode(item);
@@ -14176,6 +14364,7 @@ var buildIdealFromStartingGraph = async (options) => {
       options
     );
   }
+  options.graph.recomputeFlags();
   return options.graph;
 };
 
@@ -14310,7 +14499,7 @@ import {
   stat as stat2,
   writeFile as writeFile3
 } from "node:fs/promises";
-import { dirname as dirname5, relative as relative2 } from "node:path";
+import { dirname as dirname5, isAbsolute, relative as relative2 } from "node:path";
 
 // ../../src/cmd-shim/src/to-batch-syntax.ts
 var convertToSetCommand = (key, value) => convertToSetCommand_(key.trim(), value.trim());
@@ -14411,6 +14600,18 @@ var cmdShimIfExists = async (from, to, remover) => {
   }
   await writeShim(from, to, remover);
 };
+var cmdShim = async (from, to, remover) => {
+  try {
+    await stat2(from);
+    await writeShim(from, to, remover);
+  } catch (er) {
+    throw error("Could not shim to executable file", {
+      path: from,
+      target: to,
+      cause: er
+    });
+  }
+};
 var writeShim = async (from, to, remover) => {
   await Promise.all([
     remover.rm(to),
@@ -14435,6 +14636,7 @@ var writeShim = async (from, to, remover) => {
 };
 var writeShim_ = async (from, to, prog, args, variables) => {
   let shTarget = relative2(dirname5(to), from);
+  const [dp0, basedir] = isAbsolute(shTarget) ? ["", ""] : ["%dp0%\\", "$basedir/"];
   let target = shTarget.split("/").join("\\");
   let longProg;
   let shProg = prog?.split("\\").join("/");
@@ -14445,8 +14647,8 @@ var writeShim_ = async (from, to, prog, args, variables) => {
   args = args || "";
   variables = variables || "";
   if (!prog) {
-    prog = `"%dp0%\\${target}"`;
-    shProg = `"$basedir/${shTarget}"`;
+    prog = `"${dp0}${target}"`;
+    shProg = `"${basedir}${shTarget}"`;
     pwshProg = shProg;
     args = "";
     target = "";
@@ -14455,8 +14657,8 @@ var writeShim_ = async (from, to, prog, args, variables) => {
     longProg = `"%dp0%\\${prog}.exe"`;
     shLongProg = `"$basedir/${prog}"`;
     pwshLongProg = `"$basedir/${prog}$exe"`;
-    target = `"%dp0%\\${target}"`;
-    shTarget = `"$basedir/${shTarget}"`;
+    target = `"${dp0}${target}"`;
+    shTarget = `"${basedir}${shTarget}"`;
   }
   const head = "@ECHO off\r\nGOTO start\r\n:find_dp0\r\nSET dp0=%~dp0\r\nEXIT /b\r\n:start\r\nSETLOCAL\r\nCALL :find_dp0\r\n";
   let cmd;
@@ -15174,15 +15376,21 @@ var uninstall = async (options, remove) => {
   const mainManifest = options.packageJson.read(options.projectRoot);
   const modifiers = GraphModifier.maybeLoad(options);
   const remover = new RollbackRemove();
+  const monorepo = Monorepo.maybeLoad(options.projectRoot, {
+    packageJson: options.packageJson,
+    scurry: options.scurry
+  });
   try {
     const act = load4({
       ...options,
+      monorepo,
       modifiers: void 0,
       mainManifest,
       loadManifests: true
     });
     const graph = await build3({
       ...options,
+      monorepo,
       actual: act,
       remove,
       mainManifest,
@@ -15232,6 +15440,30 @@ var uninstall = async (options, remove) => {
 // ../../src/graph/src/update.ts
 import { existsSync as existsSync5, rmSync as rmSync3 } from "node:fs";
 import { resolve as resolve12 } from "node:path";
+var startingGraph = (options, monorepo) => {
+  const fresh = () => new Graph({ ...options, monorepo });
+  if (!options.monorepo || !monorepo) return fresh();
+  const selected = new Set(
+    [...options.monorepo.values()].map((ws) => ws.id)
+  );
+  if (selected.size === monorepo.size) return fresh();
+  let graph;
+  try {
+    graph = load3({ ...options, monorepo });
+  } catch (err) {
+    if (isPathSecurityError(err)) throw err;
+    graph = load4({ ...options, monorepo, loadManifests: true });
+  }
+  for (const importer of graph.importers) {
+    if (!selected.has(importer.id)) continue;
+    for (const edge of importer.edgesOut.values()) {
+      edge.to?.edgesIn.delete(edge);
+    }
+    importer.edgesOut.clear();
+  }
+  graph.gc();
+  return graph;
+};
 var update = async (options) => {
   let mainManifest = void 0;
   try {
@@ -15248,6 +15480,10 @@ var update = async (options) => {
   }
   const modifiers = GraphModifier.maybeLoad(options);
   const remover = new RollbackRemove();
+  const monorepo = Monorepo.maybeLoad(options.projectRoot, {
+    packageJson: options.packageJson,
+    scurry: options.scurry
+  });
   try {
     const done = graphStep("build");
     const graph = await buildIdealFromStartingGraph({
@@ -15256,13 +15492,17 @@ var update = async (options) => {
       remove: Object.assign(/* @__PURE__ */ new Map(), {
         modifiedDependencies: false
       }),
-      graph: new Graph({ ...options, mainManifest }),
+      graph: startingGraph(
+        { ...options, mainManifest, modifiers },
+        monorepo
+      ),
       modifiers,
       remover
     });
     done();
     const act = load4({
       ...options,
+      monorepo,
       mainManifest,
       loadManifests: true
     });
@@ -15612,6 +15852,7 @@ export {
   humanReadableOutput,
   mermaidOutput,
   findCmdShimIfExists,
+  cmdShim,
   RollbackRemove,
   GraphModifier,
   init,

package/{chunk-5ZCDGBVU.js → chunk-OAP2ROTL.js}

@@ -34,7 +34,7 @@ var run = async (command) => {
   if (command) {
     process.argv.splice(2, 0, command);
   }
-  const vlt = await import("./src-QEJ6WZQ7.js");
+  const vlt = await import("./src-XQ7KVUVN.js");
   await vlt.default();
 };
 

package/{chunk-W2ZO5RZL.js → chunk-PJJCFMLW.js}

@@ -12,7 +12,7 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   init,
   install
-} from "./chunk-7BHHCB5C.js";
+} from "./chunk-NWHKSRO3.js";
 import {
   commandUsage
 } from "./chunk-TLY4VGMH.js";

package/{chunk-F5D3DVC5.js → chunk-QNDM4DVO.js}

@@ -10,11 +10,15 @@ globalThis.clearInterval = _vlt_clearInterval;
 import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
-  getTokenByURL
-} from "./chunk-QVPNKMUU.js";
+  getTokenByURL,
+  registryKeys
+} from "./chunk-5KOLUYXH.js";
 
 // ../../src/cli-sdk/src/query-auth.ts
-var createGetAuthHeader = (conf) => async (url) => getTokenByURL(url, conf.options.identity);
+var createGetAuthHeader = (conf) => {
+  const keys = registryKeys(conf.options);
+  return async (url) => getTokenByURL(url, conf.options.identity, keys);
+};
 
 export {
   createGetAuthHeader

package/{chunk-FKZ5I53D.js → chunk-WHLYMMI2.js}

@@ -13,10 +13,10 @@ import {
   actual,
   callLimit,
   createVirtualRoot
-} from "./chunk-7BHHCB5C.js";
+} from "./chunk-NWHKSRO3.js";
 import {
   SecurityArchive
-} from "./chunk-OWUICQFY.js";
+} from "./chunk-XCDLOQZZ.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
@@ -140,7 +140,7 @@ var reloadConfig = async (folder) => {
     unload("project");
   } catch {
   }
-  const { Config } = await import("./config-3UQXAYAA.js");
+  const { Config } = await import("./config-MVNXGEOQ.js");
   return Config.load(folder, process.argv, true);
 };
 

package/{chunk-KOFQTETH.js → chunk-WKA5UYNA.js}

@@ -17,7 +17,7 @@ import {
 } from "./chunk-XDSZO74H.js";
 import {
   mermaidOutput
-} from "./chunk-7BHHCB5C.js";
+} from "./chunk-NWHKSRO3.js";
 import {
   ViewClass
 } from "./chunk-4KCU2KZL.js";

package/{chunk-OWUICQFY.js → chunk-XCDLOQZZ.js}

@@ -16,7 +16,7 @@ import {
 } from "./chunk-SV4WK3KX.js";
 import {
   userAgent
-} from "./chunk-VBDNOU76.js";
+} from "./chunk-6BQKR2FM.js";
 import {
   I
 } from "./chunk-U7TEQCBN.js";

package/{ci-76TAJGF5.js → ci-EDRETPUF.js}

@@ -11,8 +11,8 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   install
-} from "./chunk-7BHHCB5C.js";
-import "./chunk-OWUICQFY.js";
+} from "./chunk-NWHKSRO3.js";
+import "./chunk-XCDLOQZZ.js";
 import {
   commandUsage
 } from "./chunk-TLY4VGMH.js";
@@ -24,7 +24,7 @@ import "./chunk-SV4WK3KX.js";
 import "./chunk-GZ5MYMBT.js";
 import "./chunk-SE2FSMBR.js";
 import "./chunk-HTOTG4TS.js";
-import "./chunk-VBDNOU76.js";
+import "./chunk-6BQKR2FM.js";
 import "./chunk-U7TEQCBN.js";
 import "./chunk-XNLSTHDK.js";
 import "./chunk-PDWPFR5T.js";
@@ -63,7 +63,7 @@ var usage = () => commandUsage({
 var views = {
   json: (i) => i.graph.toJSON(),
   human: lazyView(
-    async () => (await import("./reporter-TGBPLNR5.js")).InstallReporter
+    async () => (await import("./reporter-4KK2JNGO.js")).InstallReporter
   )
 };
 var command = async (conf) => {

package/cli-package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/cli-sdk",
   "description": "The source for the vlt CLI",
-  "version": "1.3.7",
+  "version": "1.3.8",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",

package/{config-3UQXAYAA.js → config-MVNXGEOQ.js}

@@ -16,8 +16,8 @@ import {
   kCustomInspect,
   pairsToRecords,
   recordsToPairs
-} from "./chunk-L3K2ZAOO.js";
-import "./chunk-3D3IB4YN.js";
+} from "./chunk-43HNQWPQ.js";
+import "./chunk-DL3H4EMY.js";
 import "./chunk-SRWDPPLX.js";
 import "./chunk-CB65DPZ2.js";
 import "./chunk-SV4WK3KX.js";

package/{config-AFIHF54I.js → config-OKBXU7TU.js}

@@ -19,8 +19,8 @@ import {
 import {
   pairsToRecords,
   recordsToPairs
-} from "./chunk-L3K2ZAOO.js";
-import "./chunk-3D3IB4YN.js";
+} from "./chunk-43HNQWPQ.js";
+import "./chunk-DL3H4EMY.js";
 import "./chunk-SRWDPPLX.js";
 import {
   commandUsage

package/{create-5ADQTH6K.js → create-R7BXYJSU.js}

@@ -11,13 +11,13 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   vlxResolve
-} from "./chunk-QYS5MGGM.js";
+} from "./chunk-BGA3WB7H.js";
 import {
   ExecCommand,
   views
-} from "./chunk-I7SCSGUO.js";
+} from "./chunk-FIUUAQGC.js";
 import "./chunk-RIYFGX27.js";
-import "./chunk-FKZ5I53D.js";
+import "./chunk-WHLYMMI2.js";
 import {
   styleTextStdout
 } from "./chunk-XDSZO74H.js";
@@ -25,15 +25,15 @@ import "./chunk-KMOOTBHM.js";
 import "./chunk-G2YT2GWF.js";
 import "./chunk-IHXJVKAE.js";
 import "./chunk-VTEFO2FT.js";
-import "./chunk-3D3IB4YN.js";
+import "./chunk-DL3H4EMY.js";
 import "./chunk-SRWDPPLX.js";
 import "./chunk-WGDTG44V.js";
 import "./chunk-A2TSRXZD.js";
 import {
   exec,
   execFG
-} from "./chunk-7BHHCB5C.js";
-import "./chunk-OWUICQFY.js";
+} from "./chunk-NWHKSRO3.js";
+import "./chunk-XCDLOQZZ.js";
 import {
   commandUsage
 } from "./chunk-TLY4VGMH.js";
@@ -44,7 +44,7 @@ import "./chunk-GZ5MYMBT.js";
 import "./chunk-SE2FSMBR.js";
 import "./chunk-HTOTG4TS.js";
 import "./chunk-6D54UN4T.js";
-import "./chunk-VBDNOU76.js";
+import "./chunk-6BQKR2FM.js";
 import "./chunk-U7TEQCBN.js";
 import "./chunk-XNLSTHDK.js";
 import "./chunk-PDWPFR5T.js";

package/{deprecate-RTQVLJDZ.js → deprecate-YSUKBKQM.js}

@@ -11,7 +11,7 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   PackageInfoClient
-} from "./chunk-3D3IB4YN.js";
+} from "./chunk-DL3H4EMY.js";
 import "./chunk-SRWDPPLX.js";
 import {
   resolveRegistry
@@ -28,13 +28,13 @@ import "./chunk-SE2FSMBR.js";
 import "./chunk-HTOTG4TS.js";
 import {
   RegistryClient
-} from "./chunk-QVPNKMUU.js";
+} from "./chunk-5KOLUYXH.js";
 import "./chunk-APMYKJI2.js";
 import {
   assertOk,
   requestError
 } from "./chunk-6D54UN4T.js";
-import "./chunk-VBDNOU76.js";
+import "./chunk-6BQKR2FM.js";
 import "./chunk-U7TEQCBN.js";
 import "./chunk-XNLSTHDK.js";
 import "./chunk-PDWPFR5T.js";

package/{dist-tag-V4DRDHWA.js → dist-tag-MIGYSR4F.js}

@@ -21,12 +21,12 @@ import {
 import "./chunk-SE2FSMBR.js";
 import {
   RegistryClient
-} from "./chunk-QVPNKMUU.js";
+} from "./chunk-5KOLUYXH.js";
 import "./chunk-APMYKJI2.js";
 import {
   assertOk
 } from "./chunk-6D54UN4T.js";
-import "./chunk-VBDNOU76.js";
+import "./chunk-6BQKR2FM.js";
 import "./chunk-U7TEQCBN.js";
 import "./chunk-XNLSTHDK.js";
 import "./chunk-PDWPFR5T.js";