@vltpkg/cli-js 1.4.0 → 1.5.0

package/{chunk-7T3XAYP4.js → chunk-IJUVVD7E.js}

@@ -11,7 +11,7 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   getId
-} from "./chunk-PLG3OYCX.js";
+} from "./chunk-F7NPYSI2.js";
 
 // ../../src/cli-sdk/src/stub-node.ts
 var createStubNode = (spec, name, version, options) => ({

package/{chunk-DNRR3XMG.js → chunk-ISAMD2FE.js}

@@ -16,7 +16,7 @@ import {
 import {
   isManifest,
   normalizeBinPaths
-} from "./chunk-FLH4YC6W.js";
+} from "./chunk-6LZM3I4Q.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";

package/{chunk-PHJJPY5G.js → chunk-LH7J5BDU.js}

@@ -11,13 +11,13 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   openUrl
-} from "./chunk-TPRK6IDA.js";
-import {
-  stderr
-} from "./chunk-FZUYGJZU.js";
+} from "./chunk-7UWRR6EE.js";
 import {
   mermaidOutput
-} from "./chunk-OVPHE4O7.js";
+} from "./chunk-4UH3KMTD.js";
+import {
+  stderr
+} from "./chunk-WHWPAYZY.js";
 import {
   ViewClass
 } from "./chunk-4KCU2KZL.js";

package/{chunk-5IJTPZXP.js → chunk-LUVDMEW4.js}

@@ -12,7 +12,7 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   Spec,
   kCustomInspect
-} from "./chunk-FLH4YC6W.js";
+} from "./chunk-6LZM3I4Q.js";
 
 // ../../src/spec/src/index.ts
 import { homedir } from "node:os";

package/{chunk-C23TDXRG.js → chunk-MYX4JCIJ.js}

@@ -34,7 +34,7 @@ var run = async (command) => {
   if (command) {
     process.argv.splice(2, 0, command);
   }
-  const vlt = await import("./src-4CYCUWZL.js");
+  const vlt = await import("./src-34D4DOOH.js");
   await vlt.default();
 };
 

package/{chunk-APMYKJI2.js → chunk-QNHBAGXQ.js}

@@ -12,7 +12,7 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   promiseSpawn,
   which
-} from "./chunk-U7TEQCBN.js";
+} from "./chunk-SUU2WETN.js";
 
 // ../../src/url-open/src/index.ts
 import { release } from "node:os";

package/{chunk-5TNXLRW2.js → chunk-SMXXFQPI.js}

@@ -13,19 +13,19 @@ import {
   asDepID,
   baseDepID,
   splitDepID
-} from "./chunk-PLG3OYCX.js";
+} from "./chunk-F7NPYSI2.js";
 import {
   userAgent
-} from "./chunk-ZJMJ7MCT.js";
+} from "./chunk-G3FZ2ZJK.js";
 import {
   I
-} from "./chunk-U7TEQCBN.js";
+} from "./chunk-B6RIGNEO.js";
 import {
   XDG
 } from "./chunk-XNLSTHDK.js";
 import {
   defaultRegistryName
-} from "./chunk-FLH4YC6W.js";
+} from "./chunk-6LZM3I4Q.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
@@ -291,10 +291,15 @@ var usesNpmRegistry = (node) => {
 // ../../src/security-archive/src/index.ts
 var SOCKET_API_V0_URL = "https://api.socket.dev/v0/purl?alerts=true";
 var SOCKET_PUBLIC_API_TOKEN = "sktsec_t_--RAN5U4ivauy4w37-6aoKyYPDt5ZbaT5JBVMqiwKo_api";
+var asTimeout = (raw) => {
+  const n = Number(raw);
+  return Number.isInteger(n) && n > 0 && n <= 2147483647 ? n : void 0;
+};
 var SecurityArchive = class _SecurityArchive extends I {
   #expired = /* @__PURE__ */ new Set();
   #path;
   #retries;
+  #timeout;
   #nodesByName = /* @__PURE__ */ new Map();
   #nodesByID = /* @__PURE__ */ new Map();
   /**
@@ -302,6 +307,10 @@ var SecurityArchive = class _SecurityArchive extends I {
    * for all public registry packages from the initial list of nodes.
    */
   ok = false;
+  /**
+   * True if the last refresh() timed out waiting for the remote API.
+   */
+  timedOut = false;
   /**
    * Creates a new security archive instance and starts the refresh process.
    */
@@ -322,6 +331,12 @@ var SecurityArchive = class _SecurityArchive extends I {
   static get defaultTtl() {
     return 1e3 * 60 * 60 * 3;
   }
+  /**
+   * By default, remote requests time out after 30 seconds.
+   */
+  static get defaultTimeout() {
+    return 3e4;
+  }
   constructor(options = {}) {
     super({
       max: _SecurityArchive.defaultMax,
@@ -331,6 +346,7 @@ var SecurityArchive = class _SecurityArchive extends I {
     });
     this.#path = options.path ?? new XDG("vlt").cache("security-archive.db");
     this.#retries = options.retries ?? 3;
+    this.#timeout = asTimeout(options.timeout) ?? asTimeout(process.env.VLT_SECURITY_ARCHIVE_TIMEOUT) ?? _SecurityArchive.defaultTimeout;
   }
   /**
    * Get the report data for a node, keyed by its base {@link DepID}.
@@ -433,6 +449,7 @@ var SecurityArchive = class _SecurityArchive extends I {
     const payload = {
       dbPath: this.#path,
       retries: this.#retries,
+      timeout: this.#timeout,
       ttl: _SecurityArchive.defaultTtl,
       expired
     };
@@ -474,7 +491,7 @@ var SecurityArchive = class _SecurityArchive extends I {
    * Fetches security information from the socket.dev API.
    * Returns a string of NDJSON data.
    */
-  async #retrieveRemoteData(queue) {
+  async #retrieveRemoteData(queue, signal) {
     const req = await fetch(SOCKET_API_V0_URL, {
       method: "POST",
       headers: {
@@ -483,7 +500,8 @@ var SecurityArchive = class _SecurityArchive extends I {
       },
       body: JSON.stringify({
         components: Array.from(queue)
-      })
+      }),
+      signal
     });
     if (req.status === 404) {
       throw new AbortError("Missing API");
@@ -494,6 +512,25 @@ var SecurityArchive = class _SecurityArchive extends I {
     const str = await req.text();
     return str.trim() + "\n";
   }
+  /**
+   * Fetches remote data within the configured timeout, retries included.
+   * Returns `undefined` on timeout so that queued packages stay unscanned.
+   */
+  async #fetchRemoteData(queue) {
+    const signal = AbortSignal.timeout(this.#timeout);
+    try {
+      return await pRetry(
+        () => this.#retrieveRemoteData(queue, signal),
+        { retries: this.#retries, signal }
+      );
+    } catch (err) {
+      if (!signal.aborted) throw err;
+      this.timedOut = true;
+      console.warn(
+        `security-archive: timed out after ${this.#timeout}ms fetching security data; ${queue.size} package(s) left unscanned (use :scanned to exclude them). Set VLT_SECURITY_ARCHIVE_TIMEOUT=<ms> to wait longer.`
+      );
+    }
+  }
   /**
    * Parses and load NDJSON data into the in-memory cache.
    * Returns a set of dep ids that were successfully loaded.
@@ -578,6 +615,7 @@ var SecurityArchive = class _SecurityArchive extends I {
    */
   async refresh({ nodes }) {
     this.clear();
+    this.timedOut = false;
     const db = this.#openDatabase();
     this.#nodesByName.clear();
     this.#nodesByID.clear();
@@ -591,12 +629,11 @@ var SecurityArchive = class _SecurityArchive extends I {
       this.#loadItemsFromDatabase(db, nodes);
       const queue = this.#queueUpRequiredPackages();
       if (queue.size > 0) {
-        const res = await pRetry(
-          () => this.#retrieveRemoteData(queue),
-          { retries: this.#retries }
-        );
-        const ids = this.#loadFromNDJSON(res);
-        this.#storeNewItemsToDatabase(db, ids);
+        const res = await this.#fetchRemoteData(queue);
+        if (res !== void 0) {
+          const ids = this.#loadFromNDJSON(res);
+          this.#storeNewItemsToDatabase(db, ids);
+        }
       }
       this.#validateReportData();
     } finally {
@@ -626,5 +663,6 @@ var SecurityArchive = class _SecurityArchive extends I {
 export {
   AbortError,
   pRetry,
+  usesNpmRegistry,
   SecurityArchive
 };

package/chunk-SUU2WETN.js

@@ -0,0 +1,268 @@
+var global = globalThis;
+import {Buffer} from "node:buffer";
+import {setTimeout as _vlt_setTimeout,clearTimeout as _vlt_clearTimeout,setImmediate as _vlt_setImmediate,clearImmediate as _vlt_clearImmediate,setInterval as _vlt_setInterval,clearInterval as _vlt_clearInterval} from "node:timers";
+globalThis.setTimeout = _vlt_setTimeout;
+globalThis.clearTimeout = _vlt_clearTimeout;
+globalThis.setImmediate = _vlt_setImmediate;
+globalThis.clearImmediate = _vlt_clearImmediate;
+globalThis.setInterval = _vlt_setInterval;
+globalThis.clearInterval = _vlt_clearInterval;
+import {createRequire as _vlt_createRequire} from "node:module";
+var require = _vlt_createRequire(import.meta.filename);
+import {
+  error
+} from "./chunk-WZWDS3W4.js";
+
+// ../../src/promise-spawn/src/index.ts
+import { spawn } from "node:child_process";
+var isPipe = (stdio = "pipe", fd) => stdio === "pipe" || stdio === "overlapped" || stdio === null ? true : Array.isArray(stdio) ? isPipe(stdio[fd], fd) : false;
+function stdioResult(stdout, stderr, o) {
+  return {
+    stdout: !isPipe(o.stdio, 1) ? null : o.stdioString !== false ? Buffer.concat(stdout).toString().trim() : Buffer.concat(stdout),
+    stderr: !isPipe(o.stdio, 2) ? null : o.stdioString !== false ? Buffer.concat(stderr).toString().trim() : Buffer.concat(stderr)
+  };
+}
+var SpawnPromise = class extends Promise {
+  [Symbol.toStringTag] = "SpawnPromise";
+  /** The spawned process this promise references */
+  process;
+  /** Expose the child process stdin, if available */
+  stdin;
+  /**
+   * Set static `Symbol.species` back to the base Promise class so that
+   * v8 doesn't get confused by the changed constructor signature.
+   */
+  static get [Symbol.species]() {
+    return Promise;
+  }
+  constructor(command, args, opts, extra = {}) {
+    let proc;
+    super((res, rej) => {
+      proc = spawn(command, args, opts);
+      const stdout = [];
+      const stderr = [];
+      const reject = (er, status, signal) => {
+        const stdio = stdioResult(stdout, stderr, opts);
+        const errorResult = {
+          command,
+          args,
+          stdout: stdio.stdout,
+          stderr: stdio.stderr,
+          cwd: opts.cwd?.toString() ?? process.cwd()
+        };
+        if (er !== void 0) {
+          errorResult.cause = er;
+        }
+        if (status !== void 0) {
+          errorResult.status = status;
+        }
+        if (signal !== void 0) {
+          errorResult.signal = signal;
+        }
+        Object.assign(errorResult, extra);
+        rej(error("command failed", errorResult));
+      };
+      const resolve = (status, signal) => {
+        const stdio = stdioResult(stdout, stderr, opts);
+        const successResult = {
+          command,
+          args,
+          status,
+          signal,
+          stdout: stdio.stdout,
+          stderr: stdio.stderr,
+          cwd: opts.cwd?.toString() ?? process.cwd()
+        };
+        Object.assign(successResult, extra);
+        res(successResult);
+      };
+      proc.on("error", reject);
+      proc.stdout?.on("data", (c) => stdout.push(c)).on("error", reject);
+      proc.stderr?.on("data", (c) => stderr.push(c)).on("error", reject);
+      proc.on("close", (status, signal) => {
+        if ((status || signal) && !opts.acceptFail) {
+          reject(void 0, status, signal);
+        } else {
+          resolve(status, signal);
+        }
+      });
+    });
+    this.process = proc;
+    this.stdin = proc.stdin;
+  }
+};
+function promiseSpawn(command, args, opts = {}, extra = {}) {
+  return new SpawnPromise(command, args, opts, extra);
+}
+
+// ../../node_modules/.vlt/~npm~isexe@3.1.5/node_modules/isexe/dist/esm/index.min.js
+import { statSync as w } from "node:fs";
+import { stat as S } from "node:fs/promises";
+import { statSync as k } from "node:fs";
+import { stat as I } from "node:fs/promises";
+import { delimiter as _ } from "node:path";
+var y = Object.defineProperty;
+var u = (t, r) => {
+  for (var e in r) y(t, e, { get: r[e], enumerable: true });
+};
+var i = {};
+u(i, { isexe: () => C, sync: () => A });
+var C = async (t, r = {}) => {
+  let { ignoreErrors: e = false } = r;
+  try {
+    return d(await S(t), r);
+  } catch (s) {
+    let o = s;
+    if (e || o.code === "EACCES") return false;
+    throw o;
+  }
+};
+var A = (t, r = {}) => {
+  let { ignoreErrors: e = false } = r;
+  try {
+    return d(w(t), r);
+  } catch (s) {
+    let o = s;
+    if (e || o.code === "EACCES") return false;
+    throw o;
+  }
+};
+var d = (t, r) => t.isFile() && T(t, r);
+var T = (t, r) => {
+  let e = r.uid ?? process.getuid?.(), s = r.groups ?? process.getgroups?.() ?? [], o = r.gid ?? process.getgid?.() ?? s[0];
+  if (e === void 0 || o === void 0) throw new Error("cannot get uid or gid");
+  let c = /* @__PURE__ */ new Set([o, ...s]), n = t.mode, l = t.uid, E = t.gid, f = parseInt("100", 8), p = parseInt("010", 8), x = parseInt("001", 8), h = f | p;
+  return !!(n & x || n & p && c.has(E) || n & f && l === e || n & h && e === 0);
+};
+var a = {};
+u(a, { isexe: () => F, sync: () => L });
+var F = async (t, r = {}) => {
+  let { ignoreErrors: e = false } = r;
+  try {
+    return m(await I(t), t, r);
+  } catch (s) {
+    let o = s;
+    if (e || o.code === "EACCES") return false;
+    throw o;
+  }
+};
+var L = (t, r = {}) => {
+  let { ignoreErrors: e = false } = r;
+  try {
+    return m(k(t), t, r);
+  } catch (s) {
+    let o = s;
+    if (e || o.code === "EACCES") return false;
+    throw o;
+  }
+};
+var P = (t, r) => {
+  let { pathExt: e = process.env.PATHEXT || "" } = r, s = e.split(_);
+  if (s.indexOf("") !== -1) return true;
+  for (let o of s) {
+    let c = o.toLowerCase(), n = t.substring(t.length - c.length).toLowerCase();
+    if (c && n === c) return true;
+  }
+  return false;
+};
+var m = (t, r, e) => t.isFile() && P(r, e);
+var v = process.env._ISEXE_TEST_PLATFORM_ || process.platform;
+var g = v === "win32" ? a : i;
+var R = g.isexe;
+var U = g.sync;
+
+// ../../src/which/src/index.ts
+import { delimiter, join, sep } from "node:path";
+var isWindows = process.platform === "win32";
+var rSlash = sep === "/" ? /\// : /[\\/]/;
+var rRel = new RegExp(`^\\.${rSlash.source}`);
+var getNotFoundError = (cmd) => Object.assign(new Error(`not found: ${cmd}`), { code: "ENOENT" });
+var getPathInfo = (cmd, {
+  path: optPath = process.env.PATH,
+  pathExt: optPathExt = process.env.PATHEXT,
+  delimiter: optDelimiter = delimiter
+}) => {
+  const pathEnv = cmd.match(rSlash) ? [""] : [
+    // windows always checks the cwd first
+    /* c8 ignore next - platform-specific */
+    ...isWindows ? [process.cwd()] : [],
+    ...(optPath ?? /* c8 ignore next - very unusual */
+    "").split(
+      optDelimiter
+    )
+  ];
+  if (isWindows) {
+    const pathExtExe = optPathExt || [".EXE", ".CMD", ".BAT", ".COM"].join(optDelimiter);
+    const pathExt = pathExtExe.split(optDelimiter).flatMap((item) => [item, item.toLowerCase()]);
+    if (cmd.includes(".") && pathExt[0] !== "") {
+      pathExt.unshift("");
+    }
+    return { pathEnv, pathExt, pathExtExe };
+  }
+  return { pathEnv, pathExt: [""] };
+};
+var getPathPart = (raw, cmd) => {
+  const pathPart = /^".*"$/.test(raw) ? raw.slice(1, -1) : raw;
+  const prefix = !pathPart && rRel.test(cmd) ? cmd.slice(0, 2) : "";
+  return prefix + join(pathPart, cmd);
+};
+async function which(cmd, opt = {}) {
+  const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt);
+  const found = [];
+  for (const envPart of pathEnv) {
+    const p = getPathPart(envPart, cmd);
+    for (const ext of pathExt) {
+      const withExt = p + ext;
+      const is = await R(withExt, {
+        pathExt: pathExtExe,
+        ignoreErrors: true
+      });
+      if (is) {
+        if (!opt.all) {
+          return withExt;
+        }
+        found.push(withExt);
+      }
+    }
+  }
+  if (opt.all && found.length) {
+    return found;
+  }
+  if (opt.nothrow) {
+    return null;
+  }
+  throw getNotFoundError(cmd);
+}
+function whichSync(cmd, opt = {}) {
+  const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt);
+  const found = [];
+  for (const pathEnvPart of pathEnv) {
+    const p = getPathPart(pathEnvPart, cmd);
+    for (const ext of pathExt) {
+      const withExt = p + ext;
+      const is = U(withExt, {
+        pathExt: pathExtExe,
+        ignoreErrors: true
+      });
+      if (is) {
+        if (!opt.all) {
+          return withExt;
+        }
+        found.push(withExt);
+      }
+    }
+  }
+  if (opt.all && found.length) {
+    return found;
+  }
+  if (opt.nothrow) {
+    return null;
+  }
+  throw getNotFoundError(cmd);
+}
+
+export {
+  promiseSpawn,
+  which,
+  whichSync
+};

package/chunk-T2VBCUF5.js

@@ -0,0 +1,77 @@
+var global = globalThis;
+import {Buffer} from "node:buffer";
+import {setTimeout as _vlt_setTimeout,clearTimeout as _vlt_clearTimeout,setImmediate as _vlt_setImmediate,clearImmediate as _vlt_clearImmediate,setInterval as _vlt_setInterval,clearInterval as _vlt_clearInterval} from "node:timers";
+globalThis.setTimeout = _vlt_setTimeout;
+globalThis.clearTimeout = _vlt_clearTimeout;
+globalThis.setImmediate = _vlt_setImmediate;
+globalThis.clearImmediate = _vlt_clearImmediate;
+globalThis.setInterval = _vlt_setInterval;
+globalThis.clearInterval = _vlt_clearInterval;
+import {createRequire as _vlt_createRequire} from "node:module";
+var require = _vlt_createRequire(import.meta.filename);
+import {
+  error
+} from "./chunk-WZWDS3W4.js";
+import {
+  __glob
+} from "./chunk-PZLD7RTK.js";
+
+// import("./commands/**/*.ts") in ../../src/cli-sdk/src/load-command.ts
+var globImport_commands_ts = __glob({
+  "./commands/access.ts": () => import("./access-QPX4QXV4.js"),
+  "./commands/bugs.ts": () => import("./bugs-TLOECXEM.js"),
+  "./commands/build.ts": () => import("./build-IQOS3LKO.js"),
+  "./commands/cache.ts": () => import("./cache-O5IBYYSB.js"),
+  "./commands/ci.ts": () => import("./ci-ESVUMOZO.js"),
+  "./commands/config.ts": () => import("./config-ZVVLFKR7.js"),
+  "./commands/create.ts": () => import("./create-BLTNKSBQ.js"),
+  "./commands/deprecate.ts": () => import("./deprecate-VA6PGHYL.js"),
+  "./commands/dist-tag.ts": () => import("./dist-tag-OYJREFO2.js"),
+  "./commands/docs.ts": () => import("./docs-6OC3OQNM.js"),
+  "./commands/exec-cache.ts": () => import("./exec-cache-D75UY2WI.js"),
+  "./commands/exec-local.ts": () => import("./exec-local-E2JKB4X4.js"),
+  "./commands/exec.ts": () => import("./exec-AZPGFVRY.js"),
+  "./commands/help.ts": () => import("./help-UPW77X5N.js"),
+  "./commands/init.ts": () => import("./init-SNO6QL7C.js"),
+  "./commands/install.ts": () => import("./install-TEJM2YVX.js"),
+  "./commands/install/reporter.ts": () => import("./reporter-UYVR2WMB.js"),
+  "./commands/list.ts": () => import("./list-NHCC2RNB.js"),
+  "./commands/login.ts": () => import("./login-XNZXCGFD.js"),
+  "./commands/logout.ts": () => import("./logout-YCM7O36Q.js"),
+  "./commands/outdated.ts": () => import("./outdated-4LA7N63W.js"),
+  "./commands/pack.ts": () => import("./pack-RC4CZSWF.js"),
+  "./commands/ping.ts": () => import("./ping-RLVAZGDL.js"),
+  "./commands/pkg.ts": () => import("./pkg-FED5C6TP.js"),
+  "./commands/profile.ts": () => import("./profile-DJZNLQPG.js"),
+  "./commands/publish.ts": () => import("./publish-54AMVMTQ.js"),
+  "./commands/query.ts": () => import("./query-ZQLMSJ7O.js"),
+  "./commands/registry.ts": () => import("./registry-6HKQYSZX.js"),
+  "./commands/repo.ts": () => import("./repo-ITA4BLZ4.js"),
+  "./commands/run-exec.ts": () => import("./run-exec-UGCC53DV.js"),
+  "./commands/run.ts": () => import("./run-TP2HTJRN.js"),
+  "./commands/setup.ts": () => import("./setup-XPAM5U3Z.js"),
+  "./commands/skills.ts": () => import("./skills-LR6GXW3X.js"),
+  "./commands/token.ts": () => import("./token-OF63PFTQ.js"),
+  "./commands/uninstall.ts": () => import("./uninstall-B54FQ5KQ.js"),
+  "./commands/unpublish.ts": () => import("./unpublish-CSHIGMDQ.js"),
+  "./commands/update.ts": () => import("./update-HS4VJ5ZG.js"),
+  "./commands/version.ts": () => import("./version-L7S3DHUS.js"),
+  "./commands/view.ts": () => import("./view-NWKKWFVA.js"),
+  "./commands/whoami.ts": () => import("./whoami-65K35VGW.js")
+});
+
+// ../../src/cli-sdk/src/load-command.ts
+var loadCommand = async (command) => {
+  try {
+    return await globImport_commands_ts(`./commands/${command}.ts`);
+  } catch (e) {
+    throw error("Could not load command", {
+      found: command,
+      cause: e
+    });
+  }
+};
+
+export {
+  loadCommand
+};

package/{chunk-MKWPTN3C.js → chunk-T5EP7QEF.js}

@@ -15,10 +15,10 @@ import {
 } from "./chunk-SRWDPPLX.js";
 import {
   minimatch
-} from "./chunk-I7UMHYZX.js";
+} from "./chunk-C6ZVVEFV.js";
 import {
   Spec
-} from "./chunk-5IJTPZXP.js";
+} from "./chunk-LUVDMEW4.js";
 import {
   parse,
   stringify

package/{chunk-THSYN5EK.js → chunk-UZ6ICZE3.js}

@@ -14,7 +14,7 @@ import {
   defaultRegistryName,
   isErrorWithCause,
   isObject
-} from "./chunk-FLH4YC6W.js";
+} from "./chunk-6LZM3I4Q.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";

package/{chunk-TO23PR7J.js → chunk-VR7NRWAD.js}

@@ -13,24 +13,26 @@ import {
   Qn
 } from "./chunk-SRWDPPLX.js";
 import {
-  Monorepo,
-  PackageJson,
   clone,
   pickManifest,
   resolve,
   revs
-} from "./chunk-I7UMHYZX.js";
+} from "./chunk-IFEZ6BFV.js";
+import {
+  Monorepo,
+  PackageJson
+} from "./chunk-C6ZVVEFV.js";
 import {
   Spec
-} from "./chunk-5IJTPZXP.js";
+} from "./chunk-LUVDMEW4.js";
 import {
   registryErrorMessage,
   storeRoot,
   tokenRefusalAdvice
-} from "./chunk-SR2VOY5J.js";
+} from "./chunk-5KW6AOTT.js";
 import {
   logRequest
-} from "./chunk-U7TEQCBN.js";
+} from "./chunk-B6RIGNEO.js";
 import {
   XDG
 } from "./chunk-XNLSTHDK.js";
@@ -39,7 +41,7 @@ import {
   brotliTarballUrl,
   integrityHex,
   tarballFormat
-} from "./chunk-FLH4YC6W.js";
+} from "./chunk-6LZM3I4Q.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
@@ -336,7 +338,7 @@ var PackageInfoClient = class {
   }
   async getRegistryClient() {
     if (this.#registryClient) return this.#registryClient;
-    this.#registryClientPromise ??= import("./src-I3GMULFP.js").then(({ RegistryClient }) => {
+    this.#registryClientPromise ??= import("./src-H6DFCAPH.js").then(({ RegistryClient }) => {
       this.#registryClient = new RegistryClient(this.options);
       return this.#registryClient;
     });
@@ -375,7 +377,7 @@ var PackageInfoClient = class {
   }
   async getTarPool() {
     if (this.#tarPool) return this.#tarPool;
-    this.#tarPoolPromise ??= import("./src-LUTN2ODD.js").then(
+    this.#tarPoolPromise ??= import("./src-LHDC4NJO.js").then(
       ({ Pool }) => {
         this.#tarPool = new Pool();
         return this.#tarPool;
@@ -591,7 +593,7 @@ var PackageInfoClient = class {
       }
       case "remote": {
         const rc = await this.getRegistryClient();
-        const { CacheEntry: Entry, cacheKey } = await import("./src-I3GMULFP.js");
+        const { CacheEntry: Entry, cacheKey } = await import("./src-H6DFCAPH.js");
         const key = cacheKey("GET", new URL(r.resolved));
         const unzipped = (entry) => {
           try {
@@ -656,7 +658,7 @@ var PackageInfoClient = class {
         r.integrity = found;
         const buf = response.buffer();
         try {
-          await (await this.getTarPool()).unpack(buf, target);
+          await (await this.getTarPool()).unpack(buf, target, tarballFormat(r.resolved));
         } catch (er) {
           throw this.#resolveError(
             spec,
@@ -1199,7 +1201,7 @@ var PackageInfoClient = class {
           const buf = response.buffer();
           const integrity = storedIntegrity(response);
           try {
-            await (await this.getTarPool()).unpack(buf, dir);
+            await (await this.getTarPool()).unpack(buf, dir, tarballFormat(remoteURL));
           } catch (er) {
             throw this.#resolveError(
               s,