@vltpkg/cli-sdk 0.0.0-15 → 0.0.0-17

package/dist/esm/pack-tarball.js

@@ -0,0 +1,226 @@
+import { create as tarCreate, list as tarList } from 'tar';
+import { minimatch } from 'minimatch';
+import { error } from '@vltpkg/error-cause';
+import * as ssri from 'ssri';
+import assert from 'node:assert';
+import { Spec } from '@vltpkg/spec';
+/**
+ * Replace workspace: and catalog: specs with actual versions
+ * @param {Manifest} manifest_ - The manifest to process
+ * @param {LoadedConfig} config - The loaded configuration containing project root, monorepo, and catalog data
+ * @returns {Manifest} The manifest with replaced specs
+ */
+const replaceWorkspaceAndCatalogSpecs = (manifest_, config) => {
+    // Create a deep copy of the manifest to avoid modifying the original
+    const manifest = structuredClone(manifest_);
+    // Get workspace and catalog configuration from config
+    const { monorepo, catalog = {}, catalogs = {} } = config.options;
+    // Process dependency types
+    const depTypes = [
+        'dependencies',
+        'devDependencies',
+        'optionalDependencies',
+        'peerDependencies',
+    ];
+    for (const depType of depTypes) {
+        const deps = manifest[depType];
+        /* c8 ignore next */
+        if (!deps || typeof deps !== 'object')
+            continue;
+        const depsObj = deps;
+        for (const [depName, depSpec] of Object.entries(depsObj)) {
+            /* c8 ignore next */
+            if (typeof depSpec !== 'string')
+                continue;
+            const spec = Spec.parse(`${depName}@${depSpec}`, {
+                catalog,
+                catalogs,
+            });
+            switch (spec.type) {
+                case 'workspace': {
+                    assert(monorepo, error(`No workspace configuration found for ${depName}`, {
+                        found: depName,
+                    }));
+                    const workspaceName = spec.workspace;
+                    assert(workspaceName, error(`No workspace name found for ${depName}`, {
+                        found: depName,
+                    }));
+                    const workspace = monorepo.get(workspaceName);
+                    assert(workspace, error(`Workspace '${workspaceName}' not found`, {
+                        found: workspaceName,
+                        validOptions: Array.from(monorepo.keys()),
+                    }));
+                    const actualVersion = workspace.manifest.version;
+                    assert(actualVersion, error(`No version found for workspace '${workspaceName}'`, {
+                        found: workspaceName,
+                        wanted: 'package version',
+                    }));
+                    depsObj[depName] = actualVersion;
+                    break;
+                }
+                case 'catalog': {
+                    const catalogName = spec.catalog || '';
+                    const targetCatalog = catalogName ? catalogs[catalogName] : catalog;
+                    assert(targetCatalog, error(`Catalog '${catalogName}' not found`, {
+                        found: catalogName,
+                        validOptions: Object.keys(catalogs),
+                    }));
+                    const actualVersion = targetCatalog[depName];
+                    assert(actualVersion, error(`Package '${depName}' not found in catalog '${catalogName || 'default'}'`, {
+                        found: depName,
+                        validOptions: Object.keys(targetCatalog),
+                    }));
+                    depsObj[depName] = actualVersion;
+                    break;
+                }
+            }
+        }
+    }
+    return manifest;
+};
+/**
+ * Create a tarball from a package directory
+ * @param {Manifest} manifest - The manifest of the package to pack
+ * @param {string} dir - The directory containing the package to pack
+ * @param {LoadedConfig} [config] - The loaded configuration (for workspace/catalog resolution)
+ * @returns {Promise<PackTarballResult>} The manifest, filename, and tarball data (unless dry run)
+ */
+export const packTarball = async (manifest, dir, config) => {
+    assert(manifest.name && manifest.version, error('Package must have a name and version'));
+    const processedManifest = replaceWorkspaceAndCatalogSpecs(manifest, config);
+    const filename = `${manifest.name.replace('@', '').replace('/', '-')}-${manifest.version}.tgz`;
+    try {
+        config.options.packageJson.write(dir, processedManifest);
+        const tarballData = await tarCreate({
+            cwd: dir,
+            gzip: true,
+            portable: true,
+            prefix: 'package/',
+            filter: (path) => {
+                // Normalize path - remove leading './'
+                const normalizedPath = path.replace(/^\.\//, '');
+                // Always include root directory
+                if (path === '.' || normalizedPath === '') {
+                    return true;
+                }
+                // Always exclude certain files/directories
+                const alwaysExcludePatterns = [
+                    /^\.?\/?\.git(\/|$)/,
+                    /^\.?\/?node_modules(\/|$)/,
+                    /^\.?\/?\.nyc_output(\/|$)/,
+                    /^\.?\/?coverage(\/|$)/,
+                    /^\.?\/?\.DS_Store$/,
+                    /^\.?\/?\.npmrc$/,
+                    /^\.?\/?package-lock\.json$/,
+                    /^\.?\/?yarn\.lock$/,
+                    /^\.?\/?pnpm-lock\.yaml$/,
+                    /^\.?\/?bun\.lockb$/,
+                    /^\.?\/?bun\.lock$/,
+                    /^\.?\/?vlt-lock\.json$/,
+                    /~$/,
+                    /\.swp$/,
+                ];
+                if (alwaysExcludePatterns.some(pattern => pattern.test(normalizedPath))) {
+                    return false;
+                }
+                // Always include certain files
+                const alwaysIncludePatterns = [
+                    /^README(\..*)?$/i,
+                    /^CHANGELOG(\..*)?$/i,
+                    /^HISTORY(\..*)?$/i,
+                    /^LICENSE(\..*)?$/i,
+                    /^LICENCE(\..*)?$/i,
+                ];
+                if (alwaysIncludePatterns.some(pattern => pattern.test(normalizedPath))) {
+                    return true;
+                }
+                // Always include package.json
+                if (normalizedPath === 'package.json') {
+                    return true;
+                }
+                // If files field is specified in package.json, use it for inclusion
+                const manifestWithFiles = manifest;
+                if (manifestWithFiles.files &&
+                    Array.isArray(manifestWithFiles.files)) {
+                    // Empty files array means exclude everything except always-included files
+                    if (manifestWithFiles.files.length === 0) {
+                        return false;
+                    }
+                    return manifestWithFiles.files.some((pattern) => {
+                        if (pattern.endsWith('/')) {
+                            const dirName = pattern.slice(0, -1);
+                            const globPattern = pattern.replace(/\/$/, '/**');
+                            const matchesDir = normalizedPath === dirName;
+                            const matchesContents = minimatch(normalizedPath, globPattern, {
+                                dot: true,
+                            });
+                            return matchesDir || matchesContents;
+                        }
+                        // File pattern: check direct match and if this path is a directory that could contain the pattern
+                        const directMatch = minimatch(normalizedPath, pattern, {
+                            dot: true,
+                        });
+                        // Check if this path is a directory that could contain the pattern
+                        const isParentDir = pattern.includes('/') &&
+                            pattern.startsWith(normalizedPath + '/');
+                        return directMatch || isParentDir;
+                    });
+                }
+                // Default behavior when no files field - exclude common development files
+                const defaultExcludePatterns = [
+                    /^\.?\/?\.vscode(\/|$)/,
+                    /^\.?\/?\.idea(\/|$)/,
+                    /^\.?\/?\.gitignore$/,
+                    /^\.?\/?\.npmignore$/,
+                    /^\.?\/?\.editorconfig$/,
+                ];
+                return !defaultExcludePatterns.some(pattern => pattern.test(normalizedPath));
+            },
+        }, ['.']).concat();
+        let unpackedSize = 0;
+        const files = [];
+        await new Promise((resolve, reject) => {
+            const stream = tarList({
+                onentry: entry => {
+                    if (entry.type === 'File') {
+                        unpackedSize += entry.size;
+                        // Remove the package/ prefix for cleaner file listing
+                        const cleanPath = entry.path.replace(/^[^/]+\//, '');
+                        if (cleanPath) {
+                            // Skip empty paths
+                            files.push(cleanPath);
+                        }
+                    }
+                },
+            });
+            stream
+                .on('end', () => resolve())
+                .on('error', reject)
+                .write(tarballData);
+            stream.end();
+        });
+        const integrityMap = ssri.fromData(tarballData, {
+            algorithms: [...new Set(['sha1', 'sha512'])],
+        });
+        // eslint-disable-next-line @typescript-eslint/no-base-to-string
+        const integrity = integrityMap.sha512?.[0]?.toString();
+        // @ts-expect-error -- types from DT are missing hexDigest
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-call
+        const shasum = integrityMap.sha1?.[0]?.hexDigest();
+        return {
+            name: manifest.name,
+            version: manifest.version,
+            filename,
+            tarballData,
+            unpackedSize,
+            files,
+            integrity,
+            shasum,
+        };
+    }
+    finally {
+        // Restore the original package.json
+        config.options.packageJson.write(dir, manifest);
+    }
+};
+//# sourceMappingURL=pack-tarball.js.map

package/dist/esm/pack-tarball.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack-tarball.js","sourceRoot":"","sources":["../../src/pack-tarball.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,IAAI,IAAI,OAAO,EAAE,MAAM,KAAK,CAAA;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAC3C,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AAcnC;;;;;GAKG;AACH,MAAM,+BAA+B,GAAG,CACtC,SAAmB,EACnB,MAAoB,EACV,EAAE;IACZ,qEAAqE;IACrE,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,CAAA;IAE3C,sDAAsD;IACtD,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,EAAE,EAAE,QAAQ,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,CAAA;IAEhE,2BAA2B;IAC3B,MAAM,QAAQ,GAAG;QACf,cAAc;QACd,iBAAiB;QACjB,sBAAsB;QACtB,kBAAkB;KACV,CAAA;IAEV,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;QAC9B,oBAAoB;QACpB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAQ;QAE/C,MAAM,OAAO,GAAG,IAA+B,CAAA;QAC/C,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACzD,oBAAoB;YACpB,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAAE,SAAQ;YAEzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,OAAO,EAAE,EAAE;gBAC/C,OAAO;gBACP,QAAQ;aACT,CAAC,CAAA;YAEF,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;gBAClB,KAAK,WAAW,CAAC,CAAC,CAAC;oBACjB,MAAM,CACJ,QAAQ,EACR,KAAK,CAAC,wCAAwC,OAAO,EAAE,EAAE;wBACvD,KAAK,EAAE,OAAO;qBACf,CAAC,CACH,CAAA;oBAED,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAA;oBACpC,MAAM,CACJ,aAAa,EACb,KAAK,CAAC,+BAA+B,OAAO,EAAE,EAAE;wBAC9C,KAAK,EAAE,OAAO;qBACf,CAAC,CACH,CAAA;oBAED,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;oBAC7C,MAAM,CACJ,SAAS,EACT,KAAK,CAAC,cAAc,aAAa,aAAa,EAAE;wBAC9C,KAAK,EAAE,aAAa;wBACpB,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;qBAC1C,CAAC,CACH,CAAA;oBAED,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAA;oBAChD,MAAM,CACJ,aAAa,EACb,KAAK,CACH,mCAAmC,aAAa,GAAG,EACnD;wBACE,KAAK,EAAE,aAAa;wBACpB,MAAM,EAAE,iBAAiB;qBAC1B,CACF,CACF,CAAA;oBAED,OAAO,CAAC,OAAO,CAAC,GAAG,aAAa,CAAA;oBAEhC,MAAK;gBACP,CAAC;gBAED,KAAK,SAAS,CAAC,CAAC,CAAC;oBACf,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAA;oBACtC,MAAM,aAAa,GACjB,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;oBAC/C,MAAM,CACJ,aAAa,EACb,KAAK,CAAC,YAAY,WAAW,aAAa,EAAE;wBAC1C,KAAK,EAAE,WAAW;wBAClB,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;qBACpC,CAAC,CACH,CAAA;oBAED,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;oBAC5C,MAAM,CACJ,aAAa,EACb,KAAK,CACH,YAAY,OAAO,2BAA2B,WAAW,IAAI,SAAS,GAAG,EACzE;wBACE,KAAK,EAAE,OAAO;wBACd,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;qBACzC,CACF,CACF,CAAA;oBAED,OAAO,CAAC,OAAO,CAAC,GAAG,aAAa,CAAA;oBAEhC,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,QAAkB,EAClB,GAAW,EACX,MAAoB,EACQ,EAAE;IAC9B,MAAM,CACJ,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EACjC,KAAK,CAAC,sCAAsC,CAAC,CAC9C,CAAA;IAED,MAAM,iBAAiB,GAAG,+BAA+B,CACvD,QAAQ,EACR,MAAM,CACP,CAAA;IAED,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,QAAQ,CAAC,OAAO,MAAM,CAAA;IAE9F,IAAI,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAA;QAExD,MAAM,WAAW,GAAG,MAAM,SAAS,CACjC;YACE,GAAG,EAAE,GAAG;YACR,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACvB,uCAAuC;gBACvC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;gBAEhD,gCAAgC;gBAChC,IAAI,IAAI,KAAK,GAAG,IAAI,cAAc,KAAK,EAAE,EAAE,CAAC;oBAC1C,OAAO,IAAI,CAAA;gBACb,CAAC;gBAED,2CAA2C;gBAC3C,MAAM,qBAAqB,GAAG;oBAC5B,oBAAoB;oBACpB,2BAA2B;oBAC3B,2BAA2B;oBAC3B,uBAAuB;oBACvB,oBAAoB;oBACpB,iBAAiB;oBACjB,4BAA4B;oBAC5B,oBAAoB;oBACpB,yBAAyB;oBACzB,oBAAoB;oBACpB,mBAAmB;oBACnB,wBAAwB;oBACxB,IAAI;oBACJ,QAAQ;iBACT,CAAA;gBAED,IACE,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CACnC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAC7B,EACD,CAAC;oBACD,OAAO,KAAK,CAAA;gBACd,CAAC;gBAED,+BAA+B;gBAC/B,MAAM,qBAAqB,GAAG;oBAC5B,kBAAkB;oBAClB,qBAAqB;oBACrB,mBAAmB;oBACnB,mBAAmB;oBACnB,mBAAmB;iBACpB,CAAA;gBAED,IACE,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CACnC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAC7B,EACD,CAAC;oBACD,OAAO,IAAI,CAAA;gBACb,CAAC;gBAED,8BAA8B;gBAC9B,IAAI,cAAc,KAAK,cAAc,EAAE,CAAC;oBACtC,OAAO,IAAI,CAAA;gBACb,CAAC;gBAED,oEAAoE;gBACpE,MAAM,iBAAiB,GAAG,QAEzB,CAAA;gBACD,IACE,iBAAiB,CAAC,KAAK;oBACvB,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,EACtC,CAAC;oBACD,0EAA0E;oBAC1E,IAAI,iBAAiB,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACzC,OAAO,KAAK,CAAA;oBACd,CAAC;oBACD,OAAO,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAe,EAAE,EAAE;wBACtD,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;4BAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;4BACpC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;4BACjD,MAAM,UAAU,GAAG,cAAc,KAAK,OAAO,CAAA;4BAC7C,MAAM,eAAe,GAAG,SAAS,CAC/B,cAAc,EACd,WAAW,EACX;gCACE,GAAG,EAAE,IAAI;6BACV,CACF,CAAA;4BACD,OAAO,UAAU,IAAI,eAAe,CAAA;wBACtC,CAAC;wBAED,kGAAkG;wBAClG,MAAM,WAAW,GAAG,SAAS,CAAC,cAAc,EAAE,OAAO,EAAE;4BACrD,GAAG,EAAE,IAAI;yBACV,CAAC,CAAA;wBACF,mEAAmE;wBACnE,MAAM,WAAW,GACf,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;4BACrB,OAAO,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC,CAAA;wBAC1C,OAAO,WAAW,IAAI,WAAW,CAAA;oBACnC,CAAC,CAAC,CAAA;gBACJ,CAAC;gBAED,0EAA0E;gBAC1E,MAAM,sBAAsB,GAAG;oBAC7B,uBAAuB;oBACvB,qBAAqB;oBACrB,qBAAqB;oBACrB,qBAAqB;oBACrB,wBAAwB;iBACzB,CAAA;gBAED,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAC5C,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAC7B,CAAA;YACH,CAAC;SACF,EACD,CAAC,GAAG,CAAC,CACN,CAAC,MAAM,EAAE,CAAA;QAEV,IAAI,YAAY,GAAG,CAAC,CAAA;QACpB,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,OAAO,CAAC;gBACrB,OAAO,EAAE,KAAK,CAAC,EAAE;oBACf,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;wBAC1B,YAAY,IAAI,KAAK,CAAC,IAAI,CAAA;wBAC1B,sDAAsD;wBACtD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;wBACpD,IAAI,SAAS,EAAE,CAAC;4BACd,mBAAmB;4BACnB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;wBACvB,CAAC;oBACH,CAAC;gBACH,CAAC;aACF,CAAC,CAAA;YACF,MAAM;iBACH,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;iBAC1B,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;iBACnB,KAAK,CAAC,WAAW,CAAC,CAAA;YACrB,MAAM,CAAC,GAAG,EAAE,CAAA;QACd,CAAC,CAAC,CAAA;QAEF,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE;YAC9C,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;SAC7C,CAAC,CAAA;QAEF,gEAAgE;QAChE,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAA;QACtD,0DAA0D;QAC1D,6DAA6D;QAC7D,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAEnC,CAAA;QAEb,OAAO;YACL,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,QAAQ;YACR,WAAW;YACX,YAAY;YACZ,KAAK;YACL,SAAS;YACT,MAAM;SACP,CAAA;IACH,CAAC;YAAS,CAAC;QACT,oCAAoC;QACpC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACjD,CAAC;AACH,CAAC,CAAA","sourcesContent":["import type { Manifest } from '@vltpkg/types'\nimport { create as tarCreate, list as tarList } from 'tar'\nimport { minimatch } from 'minimatch'\nimport { error } from '@vltpkg/error-cause'\nimport * as ssri from 'ssri'\nimport assert from 'node:assert'\nimport { Spec } from '@vltpkg/spec'\nimport type { LoadedConfig } from './config/index.ts'\n\nexport type PackTarballResult = {\n  name: string\n  version: string\n  filename: string\n  tarballData: Buffer\n  unpackedSize: number\n  files: string[]\n  integrity?: string\n  shasum?: string\n}\n\n/**\n * Replace workspace: and catalog: specs with actual versions\n * @param {Manifest} manifest_ - The manifest to process\n * @param {LoadedConfig} config - The loaded configuration containing project root, monorepo, and catalog data\n * @returns {Manifest} The manifest with replaced specs\n */\nconst replaceWorkspaceAndCatalogSpecs = (\n  manifest_: Manifest,\n  config: LoadedConfig,\n): Manifest => {\n  // Create a deep copy of the manifest to avoid modifying the original\n  const manifest = structuredClone(manifest_)\n\n  // Get workspace and catalog configuration from config\n  const { monorepo, catalog = {}, catalogs = {} } = config.options\n\n  // Process dependency types\n  const depTypes = [\n    'dependencies',\n    'devDependencies',\n    'optionalDependencies',\n    'peerDependencies',\n  ] as const\n\n  for (const depType of depTypes) {\n    const deps = manifest[depType]\n    /* c8 ignore next */\n    if (!deps || typeof deps !== 'object') continue\n\n    const depsObj = deps as Record<string, unknown>\n    for (const [depName, depSpec] of Object.entries(depsObj)) {\n      /* c8 ignore next */\n      if (typeof depSpec !== 'string') continue\n\n      const spec = Spec.parse(`${depName}@${depSpec}`, {\n        catalog,\n        catalogs,\n      })\n\n      switch (spec.type) {\n        case 'workspace': {\n          assert(\n            monorepo,\n            error(`No workspace configuration found for ${depName}`, {\n              found: depName,\n            }),\n          )\n\n          const workspaceName = spec.workspace\n          assert(\n            workspaceName,\n            error(`No workspace name found for ${depName}`, {\n              found: depName,\n            }),\n          )\n\n          const workspace = monorepo.get(workspaceName)\n          assert(\n            workspace,\n            error(`Workspace '${workspaceName}' not found`, {\n              found: workspaceName,\n              validOptions: Array.from(monorepo.keys()),\n            }),\n          )\n\n          const actualVersion = workspace.manifest.version\n          assert(\n            actualVersion,\n            error(\n              `No version found for workspace '${workspaceName}'`,\n              {\n                found: workspaceName,\n                wanted: 'package version',\n              },\n            ),\n          )\n\n          depsObj[depName] = actualVersion\n\n          break\n        }\n\n        case 'catalog': {\n          const catalogName = spec.catalog || ''\n          const targetCatalog =\n            catalogName ? catalogs[catalogName] : catalog\n          assert(\n            targetCatalog,\n            error(`Catalog '${catalogName}' not found`, {\n              found: catalogName,\n              validOptions: Object.keys(catalogs),\n            }),\n          )\n\n          const actualVersion = targetCatalog[depName]\n          assert(\n            actualVersion,\n            error(\n              `Package '${depName}' not found in catalog '${catalogName || 'default'}'`,\n              {\n                found: depName,\n                validOptions: Object.keys(targetCatalog),\n              },\n            ),\n          )\n\n          depsObj[depName] = actualVersion\n\n          break\n        }\n      }\n    }\n  }\n\n  return manifest\n}\n\n/**\n * Create a tarball from a package directory\n * @param {Manifest} manifest - The manifest of the package to pack\n * @param {string} dir - The directory containing the package to pack\n * @param {LoadedConfig} [config] - The loaded configuration (for workspace/catalog resolution)\n * @returns {Promise<PackTarballResult>} The manifest, filename, and tarball data (unless dry run)\n */\nexport const packTarball = async (\n  manifest: Manifest,\n  dir: string,\n  config: LoadedConfig,\n): Promise<PackTarballResult> => {\n  assert(\n    manifest.name && manifest.version,\n    error('Package must have a name and version'),\n  )\n\n  const processedManifest = replaceWorkspaceAndCatalogSpecs(\n    manifest,\n    config,\n  )\n\n  const filename = `${manifest.name.replace('@', '').replace('/', '-')}-${manifest.version}.tgz`\n\n  try {\n    config.options.packageJson.write(dir, processedManifest)\n\n    const tarballData = await tarCreate(\n      {\n        cwd: dir,\n        gzip: true,\n        portable: true,\n        prefix: 'package/',\n        filter: (path: string) => {\n          // Normalize path - remove leading './'\n          const normalizedPath = path.replace(/^\\.\\//, '')\n\n          // Always include root directory\n          if (path === '.' || normalizedPath === '') {\n            return true\n          }\n\n          // Always exclude certain files/directories\n          const alwaysExcludePatterns = [\n            /^\\.?\\/?\\.git(\\/|$)/,\n            /^\\.?\\/?node_modules(\\/|$)/,\n            /^\\.?\\/?\\.nyc_output(\\/|$)/,\n            /^\\.?\\/?coverage(\\/|$)/,\n            /^\\.?\\/?\\.DS_Store$/,\n            /^\\.?\\/?\\.npmrc$/,\n            /^\\.?\\/?package-lock\\.json$/,\n            /^\\.?\\/?yarn\\.lock$/,\n            /^\\.?\\/?pnpm-lock\\.yaml$/,\n            /^\\.?\\/?bun\\.lockb$/,\n            /^\\.?\\/?bun\\.lock$/,\n            /^\\.?\\/?vlt-lock\\.json$/,\n            /~$/,\n            /\\.swp$/,\n          ]\n\n          if (\n            alwaysExcludePatterns.some(pattern =>\n              pattern.test(normalizedPath),\n            )\n          ) {\n            return false\n          }\n\n          // Always include certain files\n          const alwaysIncludePatterns = [\n            /^README(\\..*)?$/i,\n            /^CHANGELOG(\\..*)?$/i,\n            /^HISTORY(\\..*)?$/i,\n            /^LICENSE(\\..*)?$/i,\n            /^LICENCE(\\..*)?$/i,\n          ]\n\n          if (\n            alwaysIncludePatterns.some(pattern =>\n              pattern.test(normalizedPath),\n            )\n          ) {\n            return true\n          }\n\n          // Always include package.json\n          if (normalizedPath === 'package.json') {\n            return true\n          }\n\n          // If files field is specified in package.json, use it for inclusion\n          const manifestWithFiles = manifest as Manifest & {\n            files?: string[]\n          }\n          if (\n            manifestWithFiles.files &&\n            Array.isArray(manifestWithFiles.files)\n          ) {\n            // Empty files array means exclude everything except always-included files\n            if (manifestWithFiles.files.length === 0) {\n              return false\n            }\n            return manifestWithFiles.files.some((pattern: string) => {\n              if (pattern.endsWith('/')) {\n                const dirName = pattern.slice(0, -1)\n                const globPattern = pattern.replace(/\\/$/, '/**')\n                const matchesDir = normalizedPath === dirName\n                const matchesContents = minimatch(\n                  normalizedPath,\n                  globPattern,\n                  {\n                    dot: true,\n                  },\n                )\n                return matchesDir || matchesContents\n              }\n\n              // File pattern: check direct match and if this path is a directory that could contain the pattern\n              const directMatch = minimatch(normalizedPath, pattern, {\n                dot: true,\n              })\n              // Check if this path is a directory that could contain the pattern\n              const isParentDir =\n                pattern.includes('/') &&\n                pattern.startsWith(normalizedPath + '/')\n              return directMatch || isParentDir\n            })\n          }\n\n          // Default behavior when no files field - exclude common development files\n          const defaultExcludePatterns = [\n            /^\\.?\\/?\\.vscode(\\/|$)/,\n            /^\\.?\\/?\\.idea(\\/|$)/,\n            /^\\.?\\/?\\.gitignore$/,\n            /^\\.?\\/?\\.npmignore$/,\n            /^\\.?\\/?\\.editorconfig$/,\n          ]\n\n          return !defaultExcludePatterns.some(pattern =>\n            pattern.test(normalizedPath),\n          )\n        },\n      },\n      ['.'],\n    ).concat()\n\n    let unpackedSize = 0\n    const files: string[] = []\n    await new Promise<void>((resolve, reject) => {\n      const stream = tarList({\n        onentry: entry => {\n          if (entry.type === 'File') {\n            unpackedSize += entry.size\n            // Remove the package/ prefix for cleaner file listing\n            const cleanPath = entry.path.replace(/^[^/]+\\//, '')\n            if (cleanPath) {\n              // Skip empty paths\n              files.push(cleanPath)\n            }\n          }\n        },\n      })\n      stream\n        .on('end', () => resolve())\n        .on('error', reject)\n        .write(tarballData)\n      stream.end()\n    })\n\n    const integrityMap = ssri.fromData(tarballData, {\n      algorithms: [...new Set(['sha1', 'sha512'])],\n    })\n\n    // eslint-disable-next-line @typescript-eslint/no-base-to-string\n    const integrity = integrityMap.sha512?.[0]?.toString()\n    // @ts-expect-error -- types from DT are missing hexDigest\n    // eslint-disable-next-line @typescript-eslint/no-unsafe-call\n    const shasum = integrityMap.sha1?.[0]?.hexDigest() as\n      | string\n      | undefined\n\n    return {\n      name: manifest.name,\n      version: manifest.version,\n      filename,\n      tarballData,\n      unpackedSize,\n      files,\n      integrity,\n      shasum,\n    }\n  } finally {\n    // Restore the original package.json\n    config.options.packageJson.write(dir, manifest)\n  }\n}\n"]}

package/dist/esm/start-gui.d.ts

@@ -1,6 +1,7 @@
 import type { PathScurry } from 'path-scurry';
 import type { LoadedConfig } from './config/index.ts';
 export declare const getDefaultStartingRoute: (options: {
+    queryString?: string;
     startingRoute?: string;
     projectRoot: string;
     scurry: PathScurry;

package/dist/esm/start-gui.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"start-gui.d.ts","sourceRoot":"","sources":["../../src/start-gui.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAIrD,eAAO,MAAM,uBAAuB,YAAmB;IACrD,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,UAAU,CAAA;CACnB,oBAOA,CAAA;AAaD,eAAO,MAAM,QAAQ,SACb,YAAY,kBACF,MAAM,gDAuBvB,CAAA"}
+{"version":3,"file":"start-gui.d.ts","sourceRoot":"","sources":["../../src/start-gui.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAGrD,eAAO,MAAM,uBAAuB,YAAmB;IACrD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,UAAU,CAAA;CACnB,oBAYA,CAAA;AAaD,eAAO,MAAM,QAAQ,SACb,YAAY,kBACF,MAAM,gDAwBvB,CAAA"}

package/dist/esm/start-gui.js

@@ -1,14 +1,15 @@
+import { resolve } from 'node:path';
+import LZString from 'lz-string';
 import { createServer } from '@vltpkg/server';
 import { urlOpen } from '@vltpkg/url-open';
 import { stdout } from "./output.js";
-import { resolve } from 'node:path';
 export const getDefaultStartingRoute = async (options) => {
-    const { startingRoute, projectRoot, scurry } = options;
+    const { queryString = ':root', startingRoute, projectRoot, scurry, } = options;
     if (startingRoute)
         return startingRoute;
     const stat = await scurry.lstat(`${projectRoot}/package.json`);
     return stat?.isFile() && !stat.isSymbolicLink() ?
-        `/explore?query=${encodeURIComponent(':root')}`
+        `/explore/${LZString.compressToEncodedURIComponent(queryString)}/overview`
         : '/';
 };
 const getAssetsDir = () => {
@@ -31,6 +32,7 @@ export const startGUI = async (conf, startingRoute) => {
     await server.start();
     stdout(`⚡️ vlt GUI running at ${server.address()}`);
     void urlOpen(server.address(await getDefaultStartingRoute({
+        queryString: conf.values.target,
         startingRoute,
         projectRoot,
         scurry,

package/dist/esm/start-gui.js.map

@@ -1 +1 @@
-{"version":3,"file":"start-gui.js","sourceRoot":"","sources":["../../src/start-gui.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAG1C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAAE,OAI7C,EAAE,EAAE;IACH,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IACtD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAA;IACvC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,eAAe,CAAC,CAAA;IAC9D,OAAO,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QAC7C,kBAAkB,kBAAkB,CAAC,OAAO,CAAC,EAAE;QACjD,CAAC,CAAC,GAAG,CAAA;AACT,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,GAAG,EAAE;IACxB,qBAAqB;IACrB,IAAI,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,CAAC;QAC9C,OAAO,OAAO,CACZ,MAAM,CAAC,IAAI,CAAC,OAAO,EACnB,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAC1C,CAAA;IACH,CAAC;IACD,oBAAoB;AACtB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,EAC3B,IAAkB,EAClB,aAAsB,EACtB,EAAE;IACF,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,GAAG,IAAI,CAAC,OAAO;QACf,SAAS,EAAE,YAAY,EAAE;KAC1B,CAAC,CAAA;IACF,MAAM,CAAC,EAAE,CAAC,kBAAkB,EAAE,GAAG,CAAC,EAAE;QAClC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CACrB;QAAC,MAA6B,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IACF,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAA;IAC5C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;IACpB,MAAM,CAAC,yBAAyB,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IACnD,KAAK,OAAO,CACV,MAAM,CAAC,OAAO,CACZ,MAAM,uBAAuB,CAAC;QAC5B,aAAa;QACb,WAAW;QACX,MAAM;KACP,CAAC,CACH,CACF,CAAA;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA","sourcesContent":["import type { VltServerListening } from '@vltpkg/server'\nimport { createServer } from '@vltpkg/server'\nimport { urlOpen } from '@vltpkg/url-open'\nimport type { PathScurry } from 'path-scurry'\nimport type { LoadedConfig } from './config/index.ts'\nimport { stdout } from './output.ts'\nimport { resolve } from 'node:path'\n\nexport const getDefaultStartingRoute = async (options: {\n  startingRoute?: string\n  projectRoot: string\n  scurry: PathScurry\n}) => {\n  const { startingRoute, projectRoot, scurry } = options\n  if (startingRoute) return startingRoute\n  const stat = await scurry.lstat(`${projectRoot}/package.json`)\n  return stat?.isFile() && !stat.isSymbolicLink() ?\n      `/explore?query=${encodeURIComponent(':root')}`\n    : '/'\n}\n\nconst getAssetsDir = () => {\n  /* c8 ignore start */\n  if (process.env.__VLT_INTERNAL_GUI_ASSETS_DIR) {\n    return resolve(\n      import.meta.dirname,\n      process.env.__VLT_INTERNAL_GUI_ASSETS_DIR,\n    )\n  }\n  /* c8 ignore stop */\n}\n\nexport const startGUI = async (\n  conf: LoadedConfig,\n  startingRoute?: string,\n) => {\n  const server = createServer({\n    ...conf.options,\n    assetsDir: getAssetsDir(),\n  })\n  server.on('needConfigUpdate', dir => {\n    conf.resetOptions(dir)\n    ;(server as VltServerListening).updateOptions(conf.options)\n  })\n  const { projectRoot, scurry } = conf.options\n  await server.start()\n  stdout(`⚡️ vlt GUI running at ${server.address()}`)\n  void urlOpen(\n    server.address(\n      await getDefaultStartingRoute({\n        startingRoute,\n        projectRoot,\n        scurry,\n      }),\n    ),\n  )\n  return server\n}\n"]}
+{"version":3,"file":"start-gui.js","sourceRoot":"","sources":["../../src/start-gui.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,QAAQ,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAKpC,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAAE,OAK7C,EAAE,EAAE;IACH,MAAM,EACJ,WAAW,GAAG,OAAO,EACrB,aAAa,EACb,WAAW,EACX,MAAM,GACP,GAAG,OAAO,CAAA;IACX,IAAI,aAAa;QAAE,OAAO,aAAa,CAAA;IACvC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,eAAe,CAAC,CAAA;IAC9D,OAAO,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QAC7C,YAAY,QAAQ,CAAC,6BAA6B,CAAC,WAAW,CAAC,WAAW;QAC5E,CAAC,CAAC,GAAG,CAAA;AACT,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,GAAG,EAAE;IACxB,qBAAqB;IACrB,IAAI,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,CAAC;QAC9C,OAAO,OAAO,CACZ,MAAM,CAAC,IAAI,CAAC,OAAO,EACnB,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAC1C,CAAA;IACH,CAAC;IACD,oBAAoB;AACtB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,EAC3B,IAAkB,EAClB,aAAsB,EACtB,EAAE;IACF,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,GAAG,IAAI,CAAC,OAAO;QACf,SAAS,EAAE,YAAY,EAAE;KAC1B,CAAC,CAAA;IACF,MAAM,CAAC,EAAE,CAAC,kBAAkB,EAAE,GAAG,CAAC,EAAE;QAClC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CACrB;QAAC,MAA6B,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IACF,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAA;IAC5C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;IACpB,MAAM,CAAC,yBAAyB,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IACnD,KAAK,OAAO,CACV,MAAM,CAAC,OAAO,CACZ,MAAM,uBAAuB,CAAC;QAC5B,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;QAC/B,aAAa;QACb,WAAW;QACX,MAAM;KACP,CAAC,CACH,CACF,CAAA;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA","sourcesContent":["import { resolve } from 'node:path'\nimport LZString from 'lz-string'\nimport { createServer } from '@vltpkg/server'\nimport { urlOpen } from '@vltpkg/url-open'\nimport { stdout } from './output.ts'\nimport type { PathScurry } from 'path-scurry'\nimport type { LoadedConfig } from './config/index.ts'\nimport type { VltServerListening } from '@vltpkg/server'\n\nexport const getDefaultStartingRoute = async (options: {\n  queryString?: string\n  startingRoute?: string\n  projectRoot: string\n  scurry: PathScurry\n}) => {\n  const {\n    queryString = ':root',\n    startingRoute,\n    projectRoot,\n    scurry,\n  } = options\n  if (startingRoute) return startingRoute\n  const stat = await scurry.lstat(`${projectRoot}/package.json`)\n  return stat?.isFile() && !stat.isSymbolicLink() ?\n      `/explore/${LZString.compressToEncodedURIComponent(queryString)}/overview`\n    : '/'\n}\n\nconst getAssetsDir = () => {\n  /* c8 ignore start */\n  if (process.env.__VLT_INTERNAL_GUI_ASSETS_DIR) {\n    return resolve(\n      import.meta.dirname,\n      process.env.__VLT_INTERNAL_GUI_ASSETS_DIR,\n    )\n  }\n  /* c8 ignore stop */\n}\n\nexport const startGUI = async (\n  conf: LoadedConfig,\n  startingRoute?: string,\n) => {\n  const server = createServer({\n    ...conf.options,\n    assetsDir: getAssetsDir(),\n  })\n  server.on('needConfigUpdate', dir => {\n    conf.resetOptions(dir)\n    ;(server as VltServerListening).updateOptions(conf.options)\n  })\n  const { projectRoot, scurry } = conf.options\n  await server.start()\n  stdout(`⚡️ vlt GUI running at ${server.address()}`)\n  void urlOpen(\n    server.address(\n      await getDefaultStartingRoute({\n        queryString: conf.values.target,\n        startingRoute,\n        projectRoot,\n        scurry,\n      }),\n    ),\n  )\n  return server\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/cli-sdk",
   "description": "The source for the vlt CLI",
-  "version": "0.0.0-15",
+  "version": "0.0.0-17",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -27,40 +27,46 @@
     "ink": "^5.2.1",
     "ink-spinner": "^5.0.0",
     "jackspeak": "^4.1.1",
+    "lz-string": "^1.5.0",
+    "minimatch": "^10.0.1",
     "package-json-from-dist": "^1.0.1",
     "path-scurry": "^2.0.0",
     "pretty-bytes": "^6.1.1",
     "react": "^18.3.1",
     "react-devtools-core": "^4.28.5",
+    "ssri": "^12.0.0",
     "supports-color": "^10.0.0",
-    "@vltpkg/dep-id": "0.0.0-15",
-    "@vltpkg/error-cause": "0.0.0-15",
-    "@vltpkg/dot-prop": "0.0.0-15",
-    "@vltpkg/graph": "0.0.0-15",
-    "@vltpkg/output": "0.0.0-15",
-    "@vltpkg/init": "0.0.0-15",
-    "@vltpkg/package-json": "0.0.0-15",
-    "@vltpkg/package-info": "0.0.0-15",
-    "@vltpkg/query": "0.0.0-15",
-    "@vltpkg/registry-client": "0.0.0-15",
-    "@vltpkg/run": "0.0.0-15",
-    "@vltpkg/security-archive": "0.0.0-15",
-    "@vltpkg/server": "0.0.0-15",
-    "@vltpkg/rollback-remove": "0.0.0-15",
-    "@vltpkg/spec": "0.0.0-15",
-    "@vltpkg/url-open": "0.0.0-15",
-    "@vltpkg/vlt-json": "0.0.0-15",
-    "@vltpkg/xdg": "0.0.0-15",
-    "@vltpkg/vlx": "0.0.0-15",
-    "@vltpkg/types": "0.0.0-15",
-    "@vltpkg/workspaces": "0.0.0-15"
+    "tar": "^7.4.3",
+    "@vltpkg/dep-id": "0.0.0-17",
+    "@vltpkg/dot-prop": "0.0.0-17",
+    "@vltpkg/git": "0.0.0-17",
+    "@vltpkg/graph": "0.0.0-17",
+    "@vltpkg/error-cause": "0.0.0-17",
+    "@vltpkg/package-info": "0.0.0-17",
+    "@vltpkg/output": "0.0.0-17",
+    "@vltpkg/package-json": "0.0.0-17",
+    "@vltpkg/registry-client": "0.0.0-17",
+    "@vltpkg/query": "0.0.0-17",
+    "@vltpkg/rollback-remove": "0.0.0-17",
+    "@vltpkg/init": "0.0.0-17",
+    "@vltpkg/run": "0.0.0-17",
+    "@vltpkg/security-archive": "0.0.0-17",
+    "@vltpkg/server": "0.0.0-17",
+    "@vltpkg/spec": "0.0.0-17",
+    "@vltpkg/types": "0.0.0-17",
+    "@vltpkg/url-open": "0.0.0-17",
+    "@vltpkg/workspaces": "0.0.0-17",
+    "@vltpkg/xdg": "0.0.0-17",
+    "@vltpkg/vlt-json": "0.0.0-17",
+    "@vltpkg/vlx": "0.0.0-17"
   },
   "devDependencies": {
     "@eslint/js": "^9.28.0",
     "@types/node": "^22.15.29",
     "@types/react": "^18.3.23",
+    "@types/ssri": "^7.1.5",
     "eslint": "^9.28.0",
-    "prettier": "^3.5.3",
+    "prettier": "^3.6.0",
     "tap": "^21.1.0",
     "tshy": "^3.0.2",
     "typedoc": "~0.27.9",