@vltpkg/cli-sdk 1.0.0-rc.27 → 1.0.0-rc.29

package/dist/config/definition.d.ts

@@ -23,12 +23,15 @@ export declare const commands: {
     readonly ls: "list";
     readonly show: "view";
     readonly xc: "exec-cache";
+    readonly access: "access";
     readonly bugs: "bugs";
     readonly build: "build";
     readonly cache: "cache";
     readonly ci: "ci";
     readonly config: "config";
     readonly create: "create";
+    readonly deprecate: "deprecate";
+    readonly 'dist-tag': "dist-tag";
     readonly docs: "docs";
     readonly exec: "exec";
     readonly 'exec-local': "exec-local";
@@ -41,6 +44,7 @@ export declare const commands: {
     readonly pack: "pack";
     readonly ping: "ping";
     readonly pkg: "pkg";
+    readonly profile: "profile";
     readonly publish: "publish";
     readonly query: "query";
     readonly repo: "repo";
@@ -48,6 +52,7 @@ export declare const commands: {
     readonly run: "run";
     readonly token: "token";
     readonly uninstall: "uninstall";
+    readonly unpublish: "unpublish";
     readonly update: "update";
     readonly 'exec-cache': "exec-cache";
     readonly version: "version";
@@ -63,7 +68,7 @@ export declare const getCommand: (s?: string) => Commands[keyof Commands] | unde
 /**
  * Fields that are parsed as a set of key=value pairs
  */
-export declare const recordFields: readonly ["git-hosts", "registries", "git-host-archives", "scope-registries", "jsr-registries"];
+export declare const recordFields: readonly ["git-hosts", "registries", "git-host-archives", "scoped-registries", "jsr-registries"];
 export type RecordField = (typeof recordFields)[number];
 export declare const isRecordField: (s: string) => s is RecordField;
 export declare const definition: import("jackspeak").Jack<{
@@ -91,7 +96,7 @@ export declare const definition: import("jackspeak").Jack<{
         hint: string;
         description: string;
     };
-    'scope-registries': {
+    'scoped-registries': {
         hint: string;
         description: string;
     };
@@ -111,7 +116,7 @@ export declare const definition: import("jackspeak").Jack<{
     };
 } & {
     registries: import("jackspeak").ConfigOption<"string", true, readonly string[] | undefined>;
-    'scope-registries': import("jackspeak").ConfigOption<"string", true, readonly string[] | undefined>;
+    'scoped-registries': import("jackspeak").ConfigOption<"string", true, readonly string[] | undefined>;
     'jsr-registries': import("jackspeak").ConfigOption<"string", true, readonly string[] | undefined>;
     'git-hosts': import("jackspeak").ConfigOption<"string", true, readonly string[] | undefined>;
     'git-host-archives': import("jackspeak").ConfigOption<"string", true, readonly string[] | undefined>;
@@ -341,6 +346,10 @@ export declare const definition: import("jackspeak").Jack<{
     'dry-run': {
         description: string;
     };
+    force: {
+        short: string;
+        description: string;
+    };
     'expect-lockfile': {
         description: string;
     };
@@ -352,6 +361,7 @@ export declare const definition: import("jackspeak").Jack<{
     };
 } & {
     'dry-run': import("jackspeak").ConfigOption<"boolean", false, undefined>;
+    force: import("jackspeak").ConfigOption<"boolean", false, undefined>;
     'expect-lockfile': import("jackspeak").ConfigOption<"boolean", false, undefined>;
     'frozen-lockfile': import("jackspeak").ConfigOption<"boolean", false, undefined>;
     'lockfile-only': import("jackspeak").ConfigOption<"boolean", false, undefined>;
@@ -380,6 +390,13 @@ export declare const definition: import("jackspeak").Jack<{
 } & {
     otp: import("jackspeak").ConfigOption<"string", false, readonly string[] | undefined>;
     'publish-directory': import("jackspeak").ConfigOption<"string", false, readonly string[] | undefined>;
+} & {
+    telemetry: {
+        description: string;
+        default: true;
+    };
+} & {
+    telemetry: import("jackspeak").ConfigOption<"boolean", false, undefined>;
 } & {
     yes: {
         short: string;

package/dist/config/definition.js

@@ -15,12 +15,15 @@ export const defaultEditor = () => process.env.EDITOR ||
         `${process.env.SYSTEMROOT}\\notepad.exe`
         : 'vi');
 const canonicalCommands = {
+    access: 'access',
     bugs: 'bugs',
     build: 'build',
     cache: 'cache',
     ci: 'ci',
     config: 'config',
     create: 'create',
+    deprecate: 'deprecate',
+    'dist-tag': 'dist-tag',
     docs: 'docs',
     exec: 'exec',
     'exec-local': 'exec-local',
@@ -34,6 +37,7 @@ const canonicalCommands = {
     pack: 'pack',
     ping: 'ping',
     pkg: 'pkg',
+    profile: 'profile',
     publish: 'publish',
     query: 'query',
     repo: 'repo',
@@ -41,6 +45,7 @@ const canonicalCommands = {
     run: 'run',
     token: 'token',
     uninstall: 'uninstall',
+    unpublish: 'unpublish',
     update: 'update',
     'exec-cache': 'exec-cache',
     version: 'version',
@@ -98,35 +103,21 @@ export const recordFields = [
     'git-hosts',
     'registries',
     'git-host-archives',
-    'scope-registries',
+    'scoped-registries',
     'jsr-registries',
 ];
 export const isRecordField = (s) => recordFields.includes(s);
-const stopParsingCommands = [
-    'create',
-    'run',
-    'run-exec',
-    'exec-local',
-    'exec',
-];
-let stopParsing = undefined;
 const j = jack({
     envPrefix: 'VLT',
     allowPositionals: true,
     usage: `vlt [<options>] [<cmd> [<args> ...]]`,
-    stopAtPositionalTest: arg => {
-        if (stopParsing)
-            return true;
-        const a = arg;
-        // we stop parsing AFTER the thing, so you can do
-        // vlt run --vlt --configs scriptName --args --for --script
-        // or
-        // vlt exec --vlt --configs command --args --for --command
-        if (stopParsingCommands.includes(commands[a])) {
-            stopParsing = true;
-        }
-        return false;
-    },
+    // vlt options can appear on either side of the command/script
+    // name. To forward an argument (especially a flag-like one) to
+    // the underlying bin/script without vlt interpreting it, place
+    // it after a `--` terminator, e.g.:
+    //   vlt run scriptName --vlt-flag -- --script-flag --more
+    // Node's `parseArgs` natively treats everything following `--`
+    // as positional, so no special-casing is needed here.
 })
     .heading('vlt')
     .description(`More documentation available at <https://docs.vlt.sh>`)
@@ -196,12 +187,12 @@ export const definition = j
                     mapping in most cases.
                     `,
     },
-    'scope-registries': {
+    'scoped-registries': {
         hint: '@scope=url',
         description: `Map package name scopes to registry URLs.
 
                     For example,
-                    \`--scope-registries @acme=https://registry.acme/\`
+                    \`--scoped-registries @acme=https://registry.acme/\`
                     would tell vlt to fetch any packages named
                     \`@acme/...\` from the \`https://registry.acme/\`
                     registry.
@@ -612,6 +603,10 @@ export const definition = j
     'dry-run': {
         description: 'Run command without making any changes',
     },
+    force: {
+        short: 'f',
+        description: 'Force potentially dangerous operations, such as unpublishing an entire package.',
+    },
     'expect-lockfile': {
         description: 'Fail if lockfile is missing or out of date. Used by ci command to enforce lockfile integrity.',
     },
@@ -650,6 +645,19 @@ export const definition = j
         description: `Directory to use for pack and publish operations instead of the current directory.
                     The directory must exist and nothing will be copied to it.`,
     },
+})
+    .flag({
+    telemetry: {
+        description: `Enable anonymous usage telemetry.
+
+                    vlt collects anonymized usage data to help improve
+                    the tool. No personally identifiable information is
+                    ever sent.
+
+                    Set \`--no-telemetry\` or \`VLT_TELEMETRY=0\` or
+                    \`DO_NOT_TRACK=1\` to opt out.`,
+        default: true,
+    },
 })
     .flag({
     yes: {

package/dist/config/index.js

@@ -231,6 +231,7 @@ export class Config {
      * If the config value is not set at all, an empty object is returned.
      */
     getRecord(k) {
+        // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion
         const pairs = this.get(k);
         if (!pairs)
             return {};

package/dist/custom-help.js

@@ -234,6 +234,13 @@ const allCommands = [
         desc: 'Remove dependencies',
         showByDefault: false,
     },
+    {
+        name: 'unpublish',
+        aliases: [],
+        args: '<pkg>[@<version>]',
+        desc: 'Remove a package from the registry',
+        showByDefault: false,
+    },
     {
         name: 'update',
         aliases: ['u'],

package/dist/exec-command.js

@@ -73,11 +73,11 @@ export class ExecCommand {
         this.conf = conf;
         this.bg = bg;
         this.fg = fg;
-        this.view = this.validViewValues.get(conf.values.view) ?? 'human';
         const { projectRoot, positionals: [arg0, ...args], } = conf;
         this.arg0 = arg0;
         this.args = args;
         this.projectRoot = projectRoot;
+        this.view = this.validViewValues.get(conf.values.view) ?? 'human';
     }
     #targetCount() {
         if (this.#nodes)

package/dist/index.js

@@ -67,6 +67,6 @@ const run = async () => {
         return process.exit(process.exitCode || 1);
     }
     const command = await loadCommand(vlt.command);
-    await outputCommand(command, vlt, { start });
+    await outputCommand(command, vlt, { start, vltVersion: version });
 };
 export default run;

package/dist/output.d.ts

@@ -14,7 +14,8 @@ export type OnDone<T> = (result: T) => Promise<unknown>;
  * the user-requested view, or the default if the user requested a view
  * that is not defined for this command.
  */
-export declare const outputCommand: <T>(cliCommand: Command<T>, conf: LoadedConfig, { start }?: {
+export declare const outputCommand: <T>(cliCommand: Command<T>, conf: LoadedConfig, { start, vltVersion }?: {
     start: number;
+    vltVersion?: string;
 }) => Promise<void>;
 export {};

package/dist/output.js

@@ -4,6 +4,16 @@ import { defaultView } from "./config/definition.js";
 import { printErr, formatOptions } from "./print-err.js";
 import { isViewClass } from "./view.js";
 import { generateDefaultHelp, generateFullHelp, } from "./custom-help.js";
+import { flush as flushTelemetry, trackCommand, trackError, } from "./telemetry.js";
+/* c8 ignore start - CI env detection is a best-effort heuristic */
+const isCI = () => !!(process.env.CI ||
+    process.env.GITHUB_ACTIONS ||
+    process.env.GITLAB_CI ||
+    process.env.CIRCLECI ||
+    process.env.JENKINS_URL ||
+    process.env.BUILDKITE ||
+    process.env.TRAVIS);
+/* c8 ignore stop */
 const supportsColor = (stream) => {
     const res = createSupportsColor(stream, { sniffFlags: false });
     if (res === false)
@@ -77,7 +87,9 @@ const startView = (conf, opts, views, { start } = { start: Date.now() }) => {
  * the user-requested view, or the default if the user requested a view
  * that is not defined for this command.
  */
-export const outputCommand = async (cliCommand, conf, { start } = { start: Date.now() }) => {
+export const outputCommand = async (cliCommand, conf, { start, vltVersion } = {
+    start: Date.now(),
+}) => {
     const { usage, views, command } = cliCommand;
     const stdoutColor = conf.values.color ?? supportsColor(process.stdout);
     const stderrColor = conf.values.color ?? supportsColor(process.stderr);
@@ -102,8 +114,21 @@ export const outputCommand = async (cliCommand, conf, { start } = { start: Date.
     const { onDone, onError } = startView(conf, 
     // assume views will always output to stdout so use color support from there
     { colors: stdoutColor }, views, { start });
+    const telemetryEnabled = conf.values.telemetry;
+    const commandName = conf.command;
     try {
         const output = await onDone(await command(conf));
+        const duration_ms = Date.now() - start;
+        trackCommand({
+            command: commandName,
+            duration_ms,
+            success: true,
+            node_version: process.version,
+            vlt_version: vltVersion ?? 'unknown',
+            os: process.platform,
+            arch: process.arch,
+            ci: isCI(),
+        }, telemetryEnabled);
         if (output !== undefined && conf.values.view !== 'silent') {
             stdout(conf.values.view === 'json' ?
                 JSON.stringify(output, null, 2)
@@ -112,10 +137,39 @@ export const outputCommand = async (cliCommand, conf, { start } = { start: Date.
                     colors: stdoutColor,
                 }, output));
         }
+        // Await the flush so pending telemetry events are sent before
+        // the process exits.  The flush has a built-in timeout cap
+        // (SHUTDOWN_TIMEOUT_MS) so it will never block for long, and the
+        // timer is unreffed so even if this is not awaited the process
+        // can still exit promptly.
+        await flushTelemetry();
     }
     catch (err) {
         onError?.(err);
         process.exitCode ||= 1;
+        const duration_ms = Date.now() - start;
+        trackCommand({
+            command: commandName,
+            duration_ms,
+            success: false,
+            node_version: process.version,
+            vlt_version: vltVersion ?? 'unknown',
+            os: process.platform,
+            arch: process.arch,
+            ci: isCI(),
+        }, telemetryEnabled);
+        const errorCode = (err instanceof Error &&
+            err.cause &&
+            typeof err.cause === 'object' &&
+            'code' in err.cause &&
+            typeof err.cause.code === 'string') ?
+            err.cause.code
+            : undefined;
+        trackError({
+            command: commandName,
+            error_code: errorCode,
+        }, telemetryEnabled);
+        await flushTelemetry();
         printErr(err, usage, stderr, {
             ...formatOptions,
             colors: stderrColor,

package/dist/telemetry.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Anonymized telemetry for the vlt CLI.
+ *
+ * - Sends anonymous, non-PII events to PostHog.
+ * - Generates a random UUID on first run, stored in XDG data dir.
+ * - Respects opt-out via `DO_NOT_TRACK=1`, `VLT_TELEMETRY=0`,
+ *   or the `--telemetry=false` config flag.
+ * - Flush is awaited with a timeout cap so it never blocks CLI exit for long.
+ * - Fails silently on any network or runtime error.
+ * @module
+ */
+/**
+ * Check whether telemetry is disabled via environment variables.
+ *
+ * - `DO_NOT_TRACK=1` — https://consoledonottrack.com/
+ * - `VLT_TELEMETRY=0`
+ */
+export declare const isOptedOut: () => boolean;
+export interface CommandEvent {
+    command: string;
+    duration_ms: number;
+    success: boolean;
+    node_version: string;
+    vlt_version: string;
+    os: string;
+    arch: string;
+    ci: boolean;
+}
+export interface InstallEvent {
+    dependency_count: number;
+    duration_ms: number;
+}
+export interface ErrorEvent {
+    command: string;
+    error_code?: string;
+}
+/**
+ * Capture a `cli_command` event.
+ */
+export declare const trackCommand: (ev: CommandEvent, telemetryFlag?: boolean) => void;
+/**
+ * Capture a `cli_install` event.
+ */
+export declare const trackInstall: (ev: InstallEvent, telemetryFlag?: boolean) => void;
+/**
+ * Capture a `cli_error` event.
+ */
+export declare const trackError: (ev: ErrorEvent, telemetryFlag?: boolean) => void;
+/**
+ * Flush pending events. Returns a promise that resolves once flushing
+ * completes **or** when `SHUTDOWN_TIMEOUT_MS` elapses — whichever
+ * comes first. Never rejects.
+ *
+ * The safety-net timer is unreffed so it cannot keep the process alive
+ * on its own — if the caller does not `await` this, Node will still
+ * exit promptly once all other handles are drained.
+ */
+export declare const flush: () => Promise<void>;

package/dist/telemetry.js

@@ -0,0 +1,170 @@
+/**
+ * Anonymized telemetry for the vlt CLI.
+ *
+ * - Sends anonymous, non-PII events to PostHog.
+ * - Generates a random UUID on first run, stored in XDG data dir.
+ * - Respects opt-out via `DO_NOT_TRACK=1`, `VLT_TELEMETRY=0`,
+ *   or the `--telemetry=false` config flag.
+ * - Flush is awaited with a timeout cap so it never blocks CLI exit for long.
+ * - Fails silently on any network or runtime error.
+ * @module
+ */
+import { randomUUID } from 'node:crypto';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { XDG } from '@vltpkg/xdg';
+const POSTHOG_API_KEY = 'phc_k9xCAgC6sPIBLb5UhjhnGWpt1mos0hLV4mmEhZTGPpO';
+const POSTHOG_HOST = 'https://us.i.posthog.com';
+/** Timeout (ms) we wait for PostHog to flush before giving up. */
+const SHUTDOWN_TIMEOUT_MS = 2_000;
+const xdg = new XDG('vlt');
+/**
+ * Check whether telemetry is disabled via environment variables.
+ *
+ * - `DO_NOT_TRACK=1` — https://consoledonottrack.com/
+ * - `VLT_TELEMETRY=0`
+ */
+export const isOptedOut = () => process.env.DO_NOT_TRACK === '1' ||
+    process.env.VLT_TELEMETRY === '0';
+/**
+ * Return (or create) a stable anonymous distinct ID.
+ * Stored at `<XDG_DATA_HOME>/vlt/telemetry-id`.
+ */
+const getAnonymousId = () => {
+    const dir = xdg.data();
+    const file = xdg.data('telemetry-id');
+    try {
+        const existing = readFileSync(file, 'utf8').trim();
+        if (existing)
+            return existing;
+    }
+    catch {
+        // file doesn't exist yet — create it below
+    }
+    const id = randomUUID();
+    try {
+        mkdirSync(dir, { recursive: true });
+        writeFileSync(file, id + '\n');
+    }
+    catch {
+        // best-effort — if we can't persist, just use a transient id
+    }
+    return id;
+};
+// ---------------------------------------------------------------------------
+// PostHog client — lazily initialised
+// ---------------------------------------------------------------------------
+let _posthog;
+let _initFailed = false;
+const getClient = () => {
+    if (_posthog)
+        return _posthog;
+    if (_initFailed)
+        return undefined;
+    try {
+        // Dynamic import would be async; posthog-node also ships a
+        // synchronous constructor, so we use createRequire to keep
+        // the hot-path synchronous in this ESM package.
+        const req = createRequire(import.meta.url);
+        const { PostHog } = req('posthog-node');
+        _posthog = new PostHog(POSTHOG_API_KEY, {
+            host: POSTHOG_HOST,
+            // Buffer up to 20 events and flush every 10 s — but we always
+            // call shutdown at the end so this is just a safety net.
+            flushAt: 20,
+            flushInterval: 10_000,
+        });
+        return _posthog;
+        /* c8 ignore next 4 */
+    }
+    catch {
+        _initFailed = true;
+        return undefined;
+    }
+};
+/**
+ * Capture a `cli_command` event.
+ */
+export const trackCommand = (ev, telemetryFlag) => {
+    if (telemetryFlag === false || isOptedOut())
+        return;
+    const ph = getClient();
+    if (!ph)
+        return;
+    try {
+        ph.capture({
+            distinctId: getAnonymousId(),
+            event: 'cli_command',
+            properties: { ...ev },
+        });
+    }
+    catch {
+        // fail silently
+    }
+};
+/**
+ * Capture a `cli_install` event.
+ */
+export const trackInstall = (ev, telemetryFlag) => {
+    if (telemetryFlag === false || isOptedOut())
+        return;
+    const ph = getClient();
+    if (!ph)
+        return;
+    try {
+        ph.capture({
+            distinctId: getAnonymousId(),
+            event: 'cli_install',
+            properties: { ...ev },
+        });
+    }
+    catch {
+        // fail silently
+    }
+};
+/**
+ * Capture a `cli_error` event.
+ */
+export const trackError = (ev, telemetryFlag) => {
+    if (telemetryFlag === false || isOptedOut())
+        return;
+    const ph = getClient();
+    if (!ph)
+        return;
+    try {
+        ph.capture({
+            distinctId: getAnonymousId(),
+            event: 'cli_error',
+            properties: { ...ev },
+        });
+    }
+    catch {
+        // fail silently
+    }
+};
+/**
+ * Flush pending events. Returns a promise that resolves once flushing
+ * completes **or** when `SHUTDOWN_TIMEOUT_MS` elapses — whichever
+ * comes first. Never rejects.
+ *
+ * The safety-net timer is unreffed so it cannot keep the process alive
+ * on its own — if the caller does not `await` this, Node will still
+ * exit promptly once all other handles are drained.
+ */
+export const flush = () => {
+    const ph = _posthog;
+    if (!ph)
+        return Promise.resolve();
+    // Clear the reference so no further events are captured and
+    // PostHog's internal timers can be garbage-collected.
+    _posthog = undefined;
+    return Promise.race([
+        ph.shutdown().catch(() => { }),
+        new Promise(r => {
+            const t = setTimeout(r, SHUTDOWN_TIMEOUT_MS);
+            // Unref so this timer alone won't keep the process alive.
+            if (typeof t === 'object' && 'unref' in t)
+                t.unref();
+        }),
+    ]);
+};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/cli-sdk",
   "description": "The source for the vlt CLI",
-  "version": "1.0.0-rc.27",
+  "version": "1.0.0-rc.29",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -14,30 +14,30 @@
   },
   "dependencies": {
     "@resvg/resvg-wasm": "^2.6.2",
-    "@vltpkg/config": "1.0.0-rc.27",
-    "@vltpkg/dep-id": "1.0.0-rc.27",
-    "@vltpkg/dot-prop": "1.0.0-rc.27",
-    "@vltpkg/error-cause": "1.0.0-rc.27",
-    "@vltpkg/git": "1.0.0-rc.27",
-    "@vltpkg/graph": "1.0.0-rc.27",
-    "@vltpkg/graph-run": "1.0.0-rc.27",
-    "@vltpkg/init": "1.0.0-rc.27",
-    "@vltpkg/output": "1.0.0-rc.27",
-    "@vltpkg/package-info": "1.0.0-rc.27",
-    "@vltpkg/package-json": "1.0.0-rc.27",
-    "@vltpkg/promise-spawn": "1.0.0-rc.27",
-    "@vltpkg/query": "1.0.0-rc.27",
-    "@vltpkg/registry-client": "1.0.0-rc.27",
-    "@vltpkg/rollback-remove": "1.0.0-rc.27",
-    "@vltpkg/run": "1.0.0-rc.27",
-    "@vltpkg/security-archive": "1.0.0-rc.27",
-    "@vltpkg/spec": "1.0.0-rc.27",
-    "@vltpkg/types": "1.0.0-rc.27",
-    "@vltpkg/url-open": "1.0.0-rc.27",
-    "@vltpkg/vlt-json": "1.0.0-rc.27",
-    "@vltpkg/vlx": "1.0.0-rc.27",
-    "@vltpkg/workspaces": "1.0.0-rc.27",
-    "@vltpkg/xdg": "1.0.0-rc.27",
+    "@vltpkg/config": "1.0.0-rc.29",
+    "@vltpkg/dep-id": "1.0.0-rc.29",
+    "@vltpkg/dot-prop": "1.0.0-rc.29",
+    "@vltpkg/error-cause": "1.0.0-rc.29",
+    "@vltpkg/git": "1.0.0-rc.29",
+    "@vltpkg/graph": "1.0.0-rc.29",
+    "@vltpkg/graph-run": "1.0.0-rc.29",
+    "@vltpkg/init": "1.0.0-rc.29",
+    "@vltpkg/output": "1.0.0-rc.29",
+    "@vltpkg/package-info": "1.0.0-rc.29",
+    "@vltpkg/package-json": "1.0.0-rc.29",
+    "@vltpkg/promise-spawn": "1.0.0-rc.29",
+    "@vltpkg/query": "1.0.0-rc.29",
+    "@vltpkg/registry-client": "1.0.0-rc.29",
+    "@vltpkg/rollback-remove": "1.0.0-rc.29",
+    "@vltpkg/run": "1.0.0-rc.29",
+    "@vltpkg/security-archive": "1.0.0-rc.29",
+    "@vltpkg/spec": "1.0.0-rc.29",
+    "@vltpkg/types": "1.0.0-rc.29",
+    "@vltpkg/url-open": "1.0.0-rc.29",
+    "@vltpkg/vlt-json": "1.0.0-rc.29",
+    "@vltpkg/vlx": "1.0.0-rc.29",
+    "@vltpkg/workspaces": "1.0.0-rc.29",
+    "@vltpkg/xdg": "1.0.0-rc.29",
     "ansi-to-pre": "^1.0.6",
     "beautiful-mermaid": "^1.1.3",
     "chalk": "^5.6.2",
@@ -49,6 +49,7 @@
     "package-json-from-dist": "^1.0.1",
     "path-scurry": "^2.0.1",
     "polite-json": "^5.0.0",
+    "posthog-node": "^4.0.0",
     "pretty-bytes": "^7.1.0",
     "promise-call-limit": "^3.0.2",
     "react": "^19.2.1",