@vltpkg/cli-js 1.4.0 → 1.6.0

package/chunk-DXED4ARV.js

@@ -0,0 +1,436 @@
+var global = globalThis;
+import {Buffer} from "node:buffer";
+import {setTimeout as _vlt_setTimeout,clearTimeout as _vlt_clearTimeout,setImmediate as _vlt_setImmediate,clearImmediate as _vlt_clearImmediate,setInterval as _vlt_setInterval,clearInterval as _vlt_clearInterval} from "node:timers";
+globalThis.setTimeout = _vlt_setTimeout;
+globalThis.clearTimeout = _vlt_clearTimeout;
+globalThis.setImmediate = _vlt_setImmediate;
+globalThis.clearImmediate = _vlt_clearImmediate;
+globalThis.setInterval = _vlt_setInterval;
+globalThis.clearInterval = _vlt_clearInterval;
+import {createRequire as _vlt_createRequire} from "node:module";
+var require = _vlt_createRequire(import.meta.filename);
+import {
+  findSelf,
+  globalSpec,
+  writeInstallReceipt
+} from "./chunk-O6MQ7NN6.js";
+import {
+  prettyPath
+} from "./chunk-BH5CVXNY.js";
+import {
+  findCmdShimIfExists
+} from "./chunk-JV5XR5JQ.js";
+import {
+  loadPackageJson
+} from "./chunk-E74WGW5C.js";
+import {
+  readGlobalState,
+  updateGlobalState
+} from "./chunk-GCTREKA4.js";
+import {
+  globalWorkspacePath,
+  isInside,
+  samePath
+} from "./chunk-MCDLJZXT.js";
+import {
+  parseSpecArg
+} from "./chunk-7M2VTFLP.js";
+import {
+  isDepID
+} from "./chunk-CAV7FKWQ.js";
+import {
+  Spec
+} from "./chunk-6D3QAFNZ.js";
+import {
+  which
+} from "./chunk-SUU2WETN.js";
+import {
+  lt,
+  valid
+} from "./chunk-BF5DRGRZ.js";
+import {
+  error
+} from "./chunk-WZWDS3W4.js";
+
+// ../../src/cli-sdk/src/self-update.ts
+import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import { constants, existsSync } from "node:fs";
+import {
+  access,
+  chmod,
+  lstat,
+  readFile,
+  realpath,
+  rename,
+  rm,
+  stat
+} from "node:fs/promises";
+import {
+  basename,
+  dirname,
+  extname,
+  join,
+  relative,
+  resolve,
+  sep
+} from "node:path";
+var { version: running } = loadPackageJson(
+  import.meta.filename,
+  "cli-package.json"
+);
+var installerLine = "Re-run the installer to update vlt:\n  curl -fsSL https://install.vlt.sh | bash";
+var writable = (dir) => access(dir, constants.W_OK).then(
+  () => true,
+  () => false
+);
+var refuse = (self, message) => {
+  process.exitCode = 1;
+  return { status: "refused", from: running, dir: self.dir, message };
+};
+var isFile = (f) => stat(f).then(
+  (s) => s.isFile(),
+  () => false
+);
+var cellars = () => [
+  process.env.HOMEBREW_CELLAR,
+  "/opt/homebrew/Cellar",
+  "/usr/local/Cellar",
+  "/home/linuxbrew/.linuxbrew/Cellar"
+].filter((c) => !!c);
+var whichNpm = async () => {
+  try {
+    const found = await which("npm", { nothrow: true });
+    if (!found) return;
+    const real = await realpath(
+      (await findCmdShimIfExists(found))?.[1] ?? found
+    );
+    return basename(real) === "npm-cli.js" ? real : void 0;
+  } catch {
+  }
+};
+var findNpm = async (self) => {
+  const i = self.target.lastIndexOf(
+    `${sep}node_modules${sep}vlt${sep}`
+  );
+  if (i === -1) return;
+  const nm = self.target.slice(0, i) + sep + "node_modules";
+  const win32 = process.platform === "win32";
+  const up = dirname(nm);
+  const prefix = win32 ? (
+    // vlt.cmd is in the prefix
+    samePath(up, self.dir) && up
+  ) : basename(up) === "lib" && dirname(up);
+  if (!prefix) return;
+  const node = dirname(process.execPath);
+  const candidates = [
+    join(nm, "npm/bin/npm-cli.js"),
+    win32 ? join(node, "node_modules/npm/bin/npm-cli.js") : join(dirname(node), "lib/node_modules/npm/bin/npm-cli.js")
+  ];
+  for (const c of candidates) {
+    if (await isFile(c)) return { npmCli: c, prefix };
+  }
+  const npmCli = await whichNpm();
+  return npmCli && { npmCli, prefix };
+};
+var classify = async (self, root) => {
+  const g = await realpath(root).catch(() => resolve(root));
+  if (isInside(g, self.target)) return { kind: "global-project" };
+  const { receipt } = self;
+  if (receipt?.data.method === "standalone") {
+    if (self.standalone)
+      return { kind: "standalone-receipt", receipt };
+  } else if (receipt) {
+    const npm2 = receipt.data.method === "npm" && await findNpm(self);
+    return npm2 ? { kind: "npm", ...npm2, receipt } : { kind: "installer" };
+  }
+  if (cellars().some((c) => isInside(c, self.target))) {
+    return { kind: "homebrew" };
+  }
+  if (self.standalone) return { kind: "standalone" };
+  const npm = await findNpm(self);
+  return npm ? { kind: "npm", ...npm } : { kind: "unknown" };
+};
+var sha512 = async (file) => `sha512-${createHash("sha512").update(await readFile(file)).digest("base64")}`;
+var safeBin = (b) => /^[a-z0-9][\w.-]*$/i.test(b);
+var updateStandalone = async (self, receipt, to, fetchRelease) => {
+  const { target, channel, binaries = [] } = receipt.data;
+  if (!fetchRelease || !target) return installerLine;
+  const win32 = process.platform === "win32";
+  const at = prettyPath(self.dir);
+  if (!win32 && (await stat(self.found)).uid === 0 && process.getuid?.() !== 0) {
+    return `vlt at ${at} is owned by root. Update it the way you installed it, or run this as root.`;
+  }
+  if (!await writable(self.dir)) {
+    return `vlt at ${at} is not writable. Update it the way you installed it.`;
+  }
+  const ext = extname(self.found).toLowerCase() === ".exe" ? ".exe" : "";
+  const entries = [];
+  for (const bin of new Set(binaries)) {
+    if (bin === "vlt" || !safeBin(bin)) continue;
+    const file = join(self.dir, bin + ext);
+    const st = await lstat(file).catch(() => void 0);
+    if (st && !st.isSymbolicLink()) entries.push({ bin, file });
+  }
+  entries.push({
+    bin: "vlt",
+    file: join(self.dir, basename(self.found))
+  });
+  const tmps = [];
+  const cleanup = () => Promise.all(tmps.map((f) => rm(f, { force: true })));
+  const ready = [];
+  try {
+    for (const { bin, file } of entries) {
+      if (win32)
+        await rm(`${file}.old`, { force: true }).catch(() => {
+        });
+      const dest = join(self.dir, `.${bin}-${to}.tmp`);
+      tmps.push(dest);
+      const { checksum } = await fetchRelease({
+        version: to,
+        target,
+        channel,
+        bin,
+        dest
+      });
+      const found = await sha512(dest);
+      if (found !== checksum) {
+        throw error(`Checksum mismatch for ${bin} ${to}`, {
+          code: "EINTEGRITY",
+          wanted: checksum,
+          found
+        });
+      }
+      await chmod(dest, (await stat(file)).mode & 511);
+      ready.push({ file, dest });
+    }
+  } catch (er) {
+    await cleanup();
+    throw er;
+  }
+  for (const { file, dest } of ready) {
+    try {
+      if (win32) {
+        await rename(file, `${file}.old`);
+        await rename(dest, file).catch(async (er) => {
+          await rename(`${file}.old`, file).catch(() => {
+          });
+          throw er;
+        });
+      } else {
+        await rename(dest, file);
+      }
+    } catch (cause) {
+      await cleanup();
+      throw error(
+        `Could not replace ${file}. Close other vlt processes and editors, and check permissions.`,
+        { path: file, cause }
+      );
+    }
+  }
+};
+var runNpm = (npmCli, prefix, arg) => new Promise((res, rej) => {
+  const child = spawn(
+    process.execPath,
+    [npmCli, "install", "--global", "--prefix", prefix, arg],
+    { stdio: ["inherit", 2, 2] }
+  );
+  child.on("error", rej);
+  child.on("close", (code) => res(code ?? 1));
+});
+var rewriteReceipt = (receipt, to) => receipt && writeInstallReceipt(receipt.file, { version: to }).catch(() => {
+});
+var vltArg = /^vlt(@|$)|(^|[/\\:])vlt-\d[^/\\]*\.tgz$/;
+var isSelfUpdateArgs = (conf) => conf.command === "install" && !!conf.globalRoot && conf.positionals.some((p) => vltArg.test(p));
+var selfUpdate = async (conf, { fetchRelease } = {}) => {
+  const { globalRoot, positionals } = conf;
+  if (!globalRoot || !positionals.length) return;
+  const specs = await Promise.all(
+    positionals.map((p) => globalSpec(p, conf))
+  );
+  const [spec] = specs;
+  if (!spec || !specs.some((s) => s.name === "vlt")) return;
+  if (specs.length > 1) {
+    throw error("Update vlt on its own, without other packages", {
+      code: "EUSAGE",
+      found: positionals.join(" ")
+    });
+  }
+  const self = await findSelf();
+  if (!self) {
+    throw error(
+      `Can't tell which vlt to update: run the vlt on your PATH, not ${process.argv[1] ?? process.execPath}`,
+      { code: "EUSAGE" }
+    );
+  }
+  const owner = await classify(self, globalRoot);
+  const at = prettyPath(self.dir);
+  const foreign = `vlt at ${at} is not managed by vlt or npm. Update it the way you installed it.`;
+  if (owner.kind === "installer") {
+    return { done: refuse(self, installerLine) };
+  }
+  if (owner.kind === "homebrew") {
+    return {
+      done: refuse(
+        self,
+        `vlt at ${at} was installed by Homebrew. Run \`brew upgrade vlt\`.`
+      )
+    };
+  }
+  if (owner.kind === "standalone") {
+    return { done: refuse(self, foreign) };
+  }
+  const bootstrap = (owner.kind === "npm" || owner.kind === "unknown") && !await writable(self.dir);
+  if (owner.kind === "unknown" && !bootstrap) {
+    return { done: refuse(self, foreign) };
+  }
+  const raw = String(positionals[0]);
+  const implicit = !parseSpecArg(raw, conf.options).bareSpec;
+  const receipt = "receipt" in owner ? owner.receipt : void 0;
+  const channel = receipt?.data.channel;
+  const tag = channel ?? conf.options.tag;
+  const { name, version: to } = await conf.options.packageInfo.manifest(
+    implicit && channel ? Spec.parse("vlt", tag, conf.options) : spec
+  );
+  if (name !== "vlt" || !to) {
+    throw error(`${raw} is not a version of vlt`, {
+      code: "EUSAGE",
+      found: name
+    });
+  }
+  const kind = bootstrap ? "bootstrap" : owner.kind === "standalone-receipt" ? "standalone" : owner.kind === "npm" ? "npm" : "global-project";
+  const base = { case: kind, from: running, to, dir: self.dir };
+  if (to === running)
+    return { done: { ...base, status: "up-to-date" } };
+  if (implicit && lt(to, running)) {
+    return { done: { ...base, status: "newer-running", tag } };
+  }
+  const registry = spec.final.type === "registry";
+  if (owner.kind === "standalone-receipt") {
+    if (!registry || !valid(to)) {
+      throw error(`${raw} is not a vlt release`, {
+        code: "EUSAGE",
+        found: raw
+      });
+    }
+    const refused = await updateStandalone(
+      self,
+      owner.receipt,
+      to,
+      fetchRelease
+    );
+    if (refused) return { done: refuse(self, refused) };
+    await rewriteReceipt(owner.receipt, to);
+    return { done: { ...base, status: "updated" } };
+  }
+  if (owner.kind === "npm" && !bootstrap) {
+    const code = await runNpm(
+      owner.npmCli,
+      owner.prefix,
+      registry ? `vlt@${to}` : `vlt@${spec.bareSpec}`
+    );
+    if (code !== 0) {
+      process.exitCode = code;
+      return { done: { ...base, status: "failed" } };
+    }
+    await rewriteReceipt(receipt, to);
+    return { done: { ...base, status: "updated" } };
+  }
+  if (registry) conf.positionals = [`vlt@${to}`];
+  return {
+    selfUnwritable: bootstrap,
+    finish: async (global) => {
+      const u = {
+        ...base,
+        status: "updated",
+        dir: global?.binDir ?? self.dir,
+        ...bootstrap ? { notWritable: self.dir } : {}
+      };
+      if (bootstrap && global?.inPath && global.bins.includes("vlt")) {
+        const now = await which("vlt", { nothrow: true }).catch(
+          () => null
+        );
+        const first = now && dirname(now);
+        if (first && !samePath(
+          await realpath(first).catch(() => first),
+          global.binDir
+        )) {
+          u.shadowedBy = first;
+        }
+      }
+      return u;
+    }
+  };
+};
+var refuseSelfUninstall = async (conf) => {
+  const { globalRoot, positionals } = conf;
+  if (!globalRoot || !positionals.includes("vlt")) return;
+  const ws = resolve(globalRoot, globalWorkspacePath("vlt"));
+  if (existsSync(resolve(ws, "package.json"))) return;
+  const self = await findSelf();
+  if (!self) return;
+  const { kind } = await classify(self, globalRoot);
+  return refuse(
+    self,
+    kind === "npm" ? "vlt was installed by npm. Run `npm uninstall -g vlt` to remove it." : kind === "homebrew" ? "vlt was installed by Homebrew. Run `brew uninstall vlt` to remove it." : `vlt at ${prettyPath(self.dir)} is not managed by vlt. Remove it the way you installed it.`
+  );
+};
+var runningStoreDep = async (root) => {
+  const script = process.argv[1];
+  if (!script) return;
+  try {
+    const [real, store] = await Promise.all([
+      realpath(script),
+      realpath(resolve(root, "node_modules/.vlt"))
+    ]);
+    const [id] = relative(store, real).split(sep);
+    return isDepID(id) ? id : void 0;
+  } catch {
+  }
+};
+var deferSelfRemove = async (root, graph, keep) => {
+  const store = resolve(await realpath(root), "node_modules/.vlt");
+  const add = keep && !graph.nodes.has(keep) ? [resolve(store, keep)] : [];
+  const { pendingRemove = [] } = await readGlobalState(root);
+  const kept = pendingRemove.filter((p) => {
+    const id = basename(p);
+    return !(isDepID(id) && graph.nodes.has(id));
+  });
+  if (!add.length && kept.length === pendingRemove.length) return;
+  await updateGlobalState(root, (s) => ({
+    ...s,
+    pendingRemove: [.../* @__PURE__ */ new Set([...kept, ...add])]
+  }));
+};
+var selfUpdateLines = (s) => {
+  if (s.status === "refused") return [s.message];
+  if (s.status === "up-to-date") {
+    return [`\u2705 vlt ${s.to} is already up to date`];
+  }
+  if (s.status === "newer-running") {
+    return [
+      `\u2139\uFE0F  vlt ${s.from} is running but "${s.tag}" is ${s.to}; run \`vlt i -g vlt@${s.tag}\` to downgrade`
+    ];
+  }
+  if (s.status === "failed") return [];
+  if (s.case === "bootstrap") {
+    return [
+      `\u2139\uFE0F  ${prettyPath(s.notWritable ?? s.dir)} is not writable, so vlt ${s.to} was installed as a global package.`,
+      ...s.shadowedBy ? [
+        `\u26A0\uFE0F  ${prettyPath(s.shadowedBy)} is earlier in your PATH, so \`vlt\` still runs vlt ${s.from}.`
+      ] : []
+    ];
+  }
+  return [
+    `\u2B06\uFE0F  Updated vlt ${s.from} \u2192 ${s.to} in ${prettyPath(s.dir)}${s.case === "npm" ? " (via npm)" : ""}`
+  ];
+};
+
+export {
+  isSelfUpdateArgs,
+  selfUpdate,
+  refuseSelfUninstall,
+  runningStoreDep,
+  deferSelfRemove,
+  selfUpdateLines
+};

package/chunk-E74WGW5C.js

@@ -0,0 +1,49 @@
+var global = globalThis;
+import {Buffer} from "node:buffer";
+import {setTimeout as _vlt_setTimeout,clearTimeout as _vlt_clearTimeout,setImmediate as _vlt_setImmediate,clearImmediate as _vlt_clearImmediate,setInterval as _vlt_setInterval,clearInterval as _vlt_clearInterval} from "node:timers";
+globalThis.setTimeout = _vlt_setTimeout;
+globalThis.clearTimeout = _vlt_clearTimeout;
+globalThis.setImmediate = _vlt_setImmediate;
+globalThis.clearImmediate = _vlt_clearImmediate;
+globalThis.setInterval = _vlt_setInterval;
+globalThis.clearInterval = _vlt_clearInterval;
+import {createRequire as _vlt_createRequire} from "node:module";
+var require = _vlt_createRequire(import.meta.filename);
+
+// ../../node_modules/.vlt/~npm~package-json-from-dist@1.0.1/node_modules/package-json-from-dist/dist/esm/index.js
+import { readFileSync } from "node:fs";
+import { dirname, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+var NM = `${sep}node_modules${sep}`;
+var STORE = `.store${sep}`;
+var PKG = `${sep}package${sep}`;
+var DIST = `${sep}dist${sep}`;
+var findPackageJson = (from, pathFromSrc = "../package.json") => {
+  const f = typeof from === "object" || from.startsWith("file://") ? fileURLToPath(from) : from;
+  const __dirname = dirname(f);
+  const nms = __dirname.lastIndexOf(NM);
+  if (nms !== -1) {
+    const nm = __dirname.substring(0, nms + NM.length);
+    const pkgDir = __dirname.substring(nms + NM.length);
+    if (pkgDir.startsWith(STORE)) {
+      const pkg = pkgDir.indexOf(PKG, STORE.length);
+      if (pkg) {
+        return resolve(nm, pkgDir.substring(0, pkg + PKG.length), "package.json");
+      }
+    }
+    const pkgName = pkgDir.startsWith("@") ? pkgDir.split(sep, 2).join(sep) : String(pkgDir.split(sep)[0]);
+    return resolve(nm, pkgName, "package.json");
+  } else {
+    const d = __dirname.lastIndexOf(DIST);
+    if (d !== -1) {
+      return resolve(__dirname.substring(0, d), "package.json");
+    } else {
+      return resolve(__dirname, pathFromSrc);
+    }
+  }
+};
+var loadPackageJson = (from, pathFromSrc = "../package.json") => JSON.parse(readFileSync(findPackageJson(from, pathFromSrc), "utf8"));
+
+export {
+  loadPackageJson
+};

package/{chunk-WF6KLKRN.js → chunk-EFHOWRKU.js}

@@ -1108,6 +1108,7 @@ var canonicalCommands = {
   "run-exec": "run-exec",
   run: "run",
   setup: "setup",
+  skills: "skills",
   token: "token",
   uninstall: "uninstall",
   unpublish: "unpublish",
@@ -1517,6 +1518,62 @@ var definition = j2.heading("Configuration").description(
     description: `Specify named workspace group names to load and operate on
                     when doing recursive operations on workspaces.`
   }
+}).flag({
+  global: {
+    short: "g",
+    description: `Operate on the global project instead of the current
+                    one. Supported by \`install\`, \`uninstall\`, \`list\`,
+                    \`query\` and \`build\`.
+
+                    Each global package is installed in its own workspace of
+                    the project in \`--global-dir\`, and its bins are linked
+                    into \`--global-bin-dir\`.`
+  }
+}).opt({
+  "global-dir": {
+    hint: "path",
+    default: xdg.data("global"),
+    description: `Location of the global project used by \`--global\`.
+                    Defaults to \`vlt/global\` in the XDG data directory.
+
+                    Only read from the command line, environment or the user
+                    config, never from a project \`vlt.json\`. A leading
+                    \`~\` is the home directory. Must be absolute in the
+                    user config.`
+  }
+}).opt({
+  "global-bin-dir": {
+    hint: "path",
+    description: `Folder where bins of global packages are linked.
+
+                    Defaults to the folder of the \`vlt\` found in your
+                    \`PATH\` when it is writable, so bins run right away.
+                    If it is not writable, \`~/.local/bin\` is used when
+                    it is in your \`PATH\` (not on Windows). Otherwise
+                    \`<global-dir>/bin\`.
+
+                    Only read from the command line, environment or the
+                    user config, never from a project \`vlt.json\`. A
+                    leading \`~\` is the home directory. Must be absolute
+                    in the user config.`
+  }
+}).flag({
+  path: {
+    description: `With \`vlt setup\`, add the global bin folder
+                    (\`--global-bin-dir\`) to your \`PATH\` by editing
+                    your shell config (your user \`Path\` on Windows).
+                    Asks first, unless \`--yes\`. Command line only.`
+  },
+  "no-modify-path": {
+    description: `Never edit shell config files (or the user
+                    \`Path\` on Windows) to add a folder to your
+                    \`PATH\`: turns off \`vlt setup --path\` edits
+                    and the \`vlt install -g\` offer (printing the line
+                    to add instead), and the \`vlt setup\` PATH prompt.
+                    Set \`VLT_NO_MODIFY_PATH=1\` (any value but \`0\`)
+                    in images or on machines whose dotfiles are
+                    managed elsewhere.`
+  }
 }).opt({
   scope: {
     short: "s",
@@ -1565,7 +1622,9 @@ var definition = j2.heading("Configuration").description(
   config: {
     hint: "all | user | project",
     description: `Specify which configuration to show or operate on when running
-                    \`vlt config\` commands. For read operations (get, pick, list):
+                    \`vlt config\` commands, and which file
+                    \`vlt skills link\` saves \`allow-skills\` to. For read
+                    operations (get, pick, list):
                     \`all\` shows merged configuration from both user and project
                     files (default). For write operations (set, delete, edit):
                     defaults to \`project\`. \`user\` shows/modifies only user-level
@@ -1761,6 +1820,17 @@ var definition = j2.heading("Configuration").description(
                     \`--config=user\`) after a successful \`install\`,
                     \`add\` or \`update\`. Values a config file already
                     has are left alone.`
+  },
+  "migrate-workspaces": {
+    description: `Save workspaces read from the \`workspaces\` field of
+                    the root \`package.json\` or from
+                    \`pnpm-workspace.yaml\` to the project \`vlt.json\` on
+                    \`vlt install\`. \`vlt.json\` then takes precedence.
+
+                    Set \`--no-migrate-workspaces\` to skip this; an
+                    already saved \`workspaces\` field stays until
+                    removed.`,
+    default: true
   }
 }).opt({
   "save-prefix": {
@@ -1825,6 +1895,38 @@ var definition = j2.heading("Configuration").description(
                     Runs scripts only for direct dependencies of the current project and any occurrences
                     of a specific dependency with the name "my-package" anywhere in the dependency graph.`
   }
+}).opt({
+  "allow-skills": {
+    hint: "query",
+    description: `Link the agent skills (folders with a \`SKILL.md\`) shipped by
+                    installed packages matching this DSS query into
+                    the project's agent skill dirs (see \`skills-dir\`)
+                    after \`install\`, \`ci\`, \`update\` or
+                    \`uninstall\`. End a selector with
+                    \`:skill(<name>, \u2026)\` to pick single skills (\`*\`
+                    globs, double-quoted names). Unset (the default) or
+                    \`:not(*)\` links nothing and skips all skills work.
+
+                    \`vlt install --allow-skills=<query>\` saves the query
+                    to the project \`vlt.json\`; \`vlt skills link
+                    [<query>]\` sets, saves and applies it.
+
+                    Example: --allow-skills="#agent-browser:skill(agent-browser)"
+                    Links the agent-browser skill from a package with the same name.`
+  }
+}).optList({
+  "skills-dir": {
+    hint: "path",
+    description: `Dirs to link agent skills into (see \`allow-skills\`),
+                    relative to the project root. Replaces detection:
+                    \`.agents/skills\`, plus \`<folder>/skills\` for each
+                    agent folder at the project root (e.g. \`.claude/\`),
+                    \`.claude/skills\` inside Claude Code, and existing
+                    \`.<name>/skills\` dirs. An empty list (\`[]\` in
+                    vlt.json, or \`--skills-dir=\`) links nothing. Each
+                    dir must be inside the project, not in
+                    node_modules.`
+  }
 }).opt({
   access: {
     description: "Set the access level of the package",