@vltpkg/cli-sdk 1.0.0-rc.8 → 1.0.1

package/dist/{esm/pack-tarball.d.ts → pack-tarball.d.ts}

@@ -10,7 +10,22 @@ export type PackTarballResult = {
     files: string[];
     integrity?: string;
     shasum?: string;
+    /** The manifest used for packing (may differ from input when publishConfig.directory is set). */
+    resolvedManifest: NormalizedManifest;
 };
+/**
+ * Build the tar filter function for packing.
+ *
+ * Follows npm's precedence rules:
+ *   1. `files` field in package.json → allowlist (ignore files are not read)
+ *   2. `.npmignore` → denylist (`.gitignore` is NOT read)
+ *   3. `.gitignore` → fallback denylist when no `.npmignore` exists
+ *
+ * Regardless of mode, always-excluded files (lockfiles, .git, node_modules,
+ * .npmrc, vlt.json, etc.) are excluded and always-included files (package.json,
+ * README, LICENSE, etc.) are included.
+ */
+export declare const buildPackFilter: (manifest: NormalizedManifest, packDir: string) => ((path: string) => boolean);
 /**
  * Create a tarball from a package directory
  * @param {NormalizedManifest} manifest - The manifest of the package to pack
@@ -19,4 +34,3 @@ export type PackTarballResult = {
  * @returns {Promise<PackTarballResult>} The manifest, filename, and tarball data (unless dry run)
  */
 export declare const packTarball: (manifest: NormalizedManifest, dir: string, config: LoadedConfig) => Promise<PackTarballResult>;
-//# sourceMappingURL=pack-tarball.d.ts.map

package/dist/{esm/pack-tarball.js → pack-tarball.js}

@@ -3,10 +3,11 @@ import { minimatch } from 'minimatch';
 import { error } from '@vltpkg/error-cause';
 import * as ssri from 'ssri';
 import assert from 'node:assert';
-import { existsSync, statSync } from 'node:fs';
+import { existsSync, readFileSync, statSync } from 'node:fs';
 import { Spec } from '@vltpkg/spec';
 import { join } from 'node:path';
 import { parse, stringify } from 'polite-json';
+import ignore from 'ignore';
 /**
  * Replace workspace: and catalog: specs with actual versions
  * @param {NormalizedManifest} manifest_ - The manifest to process
@@ -82,6 +83,121 @@ const replaceWorkspaceAndCatalogSpecs = (manifest_, config) => {
     }
     return manifest;
 };
+const alwaysExcludePatterns = [
+    /^\.?\/?\.git(\/|$)/,
+    /^\.?\/?node_modules(\/|$)/,
+    /^\.?\/?\.nyc_output(\/|$)/,
+    /^\.?\/?coverage(\/|$)/,
+    /^\.?\/?\.vscode(\/|$)/,
+    /^\.?\/?\.idea(\/|$)/,
+    /^\.?\/?\.DS_Store$/,
+    /^\.?\/?\.npmrc$/,
+    /^\.?\/?\.gitignore$/,
+    /^\.?\/?\.npmignore$/,
+    /^\.?\/?\.editorconfig$/,
+    /^\.?\/?package-lock\.json$/,
+    /^\.?\/?yarn\.lock$/,
+    /^\.?\/?pnpm-lock\.yaml$/,
+    /^\.?\/?bun\.lockb$/,
+    /^\.?\/?bun\.lock$/,
+    /^\.?\/?vlt-lock\.json$/,
+    /^\.?\/?vlt\.json$/,
+    /~$/,
+    /\.swp$/,
+    /\.tgz$/,
+];
+const alwaysIncludePatterns = [
+    /^README(\..*)?$/i,
+    /^CHANGELOG(\..*)?$/i,
+    /^HISTORY(\..*)?$/i,
+    /^LICENSE(\..*)?$/i,
+    /^LICENCE(\..*)?$/i,
+];
+/**
+ * Read an ignore file (.npmignore or .gitignore) and return its contents,
+ * or undefined if the file does not exist.
+ */
+const readIgnoreFile = (dir, name) => {
+    const filePath = join(dir, name);
+    if (!existsSync(filePath))
+        return undefined;
+    return readFileSync(filePath, 'utf8');
+};
+/**
+ * Build the tar filter function for packing.
+ *
+ * Follows npm's precedence rules:
+ *   1. `files` field in package.json → allowlist (ignore files are not read)
+ *   2. `.npmignore` → denylist (`.gitignore` is NOT read)
+ *   3. `.gitignore` → fallback denylist when no `.npmignore` exists
+ *
+ * Regardless of mode, always-excluded files (lockfiles, .git, node_modules,
+ * .npmrc, vlt.json, etc.) are excluded and always-included files (package.json,
+ * README, LICENSE, etc.) are included.
+ */
+export const buildPackFilter = (manifest, packDir) => {
+    const manifestWithFiles = manifest;
+    const hasFilesField = Array.isArray(manifestWithFiles.files) &&
+        manifestWithFiles.files.length > 0;
+    const hasEmptyFilesField = Array.isArray(manifestWithFiles.files) &&
+        manifestWithFiles.files.length === 0;
+    // Build ignore matcher from .npmignore or .gitignore (only when no files field)
+    let ig;
+    if (!hasFilesField && !hasEmptyFilesField) {
+        const npmignoreContent = readIgnoreFile(packDir, '.npmignore');
+        if (npmignoreContent !== undefined) {
+            ig = ignore().add(npmignoreContent);
+        }
+        else {
+            const gitignoreContent = readIgnoreFile(packDir, '.gitignore');
+            if (gitignoreContent !== undefined) {
+                ig = ignore().add(gitignoreContent);
+            }
+        }
+    }
+    return (path) => {
+        const normalizedPath = path.replace(/^\.\//, '');
+        if (path === '.' || normalizedPath === '') {
+            return true;
+        }
+        if (alwaysExcludePatterns.some(pattern => pattern.test(normalizedPath))) {
+            return false;
+        }
+        if (alwaysIncludePatterns.some(pattern => pattern.test(normalizedPath))) {
+            return true;
+        }
+        if (normalizedPath === 'package.json') {
+            return true;
+        }
+        // files field: allowlist mode
+        if (hasEmptyFilesField) {
+            return false;
+        }
+        if (hasFilesField && manifestWithFiles.files) {
+            return manifestWithFiles.files.some((pattern) => {
+                if (pattern.endsWith('/')) {
+                    const dirName = pattern.slice(0, -1);
+                    const globPattern = pattern.replace(/\/$/, '/**');
+                    const matchesDir = normalizedPath === dirName;
+                    const matchesContents = minimatch(normalizedPath, globPattern, { dot: true });
+                    return matchesDir || matchesContents;
+                }
+                const directMatch = minimatch(normalizedPath, pattern, {
+                    dot: true,
+                });
+                const isParentDir = pattern.includes('/') &&
+                    pattern.startsWith(normalizedPath + '/');
+                const isChildOfPattern = minimatch(normalizedPath, pattern + '/**', { dot: true });
+                return directMatch || isParentDir || isChildOfPattern;
+            });
+        }
+        // Ignore-file mode: apply .npmignore or .gitignore deny patterns
+        if (ig?.ignores(normalizedPath)) {
+            return false;
+        }
+        return true;
+    };
+};
 /**
  * Create a tarball from a package directory
  * @param {NormalizedManifest} manifest - The manifest of the package to pack
@@ -91,21 +207,25 @@ const replaceWorkspaceAndCatalogSpecs = (manifest_, config) => {
  */
 export const packTarball = async (manifest, dir, config) => {
     let packDir = dir;
-    // Check if publishDirectory is configured
-    const publishDirectory = config.get('publish-directory');
+    // Check if publishDirectory is configured via CLI flag or package.json publishConfig.directory
+    const cliPublishDir = config.get('publish-directory');
+    const manifestPublishDir = manifest.publishConfig?.directory;
+    const publishDirectory = cliPublishDir ?? manifestPublishDir;
     if (publishDirectory) {
+        // CLI flag paths are used as-is; publishConfig.directory is relative to the package dir
+        const resolvedPublishDir = cliPublishDir ? publishDirectory : join(dir, publishDirectory);
         // Validate that the publish directory exists and is a directory
-        assert(existsSync(publishDirectory), error(`Publish directory does not exist: ${publishDirectory}`, {
-            found: publishDirectory,
+        assert(existsSync(resolvedPublishDir), error(`Publish directory does not exist: ${resolvedPublishDir}`, {
+            found: resolvedPublishDir,
         }));
-        assert(statSync(publishDirectory).isDirectory(), error(`Publish directory is not a directory: ${publishDirectory}`, {
-            found: publishDirectory,
+        assert(statSync(resolvedPublishDir).isDirectory(), error(`Publish directory is not a directory: ${resolvedPublishDir}`, {
+            found: resolvedPublishDir,
             wanted: 'directory',
         }));
-        if (existsSync(join(publishDirectory, 'package.json'))) {
-            manifest = config.options.packageJson.read(publishDirectory);
+        if (existsSync(join(resolvedPublishDir, 'package.json'))) {
+            manifest = config.options.packageJson.read(resolvedPublishDir);
         }
-        packDir = publishDirectory;
+        packDir = resolvedPublishDir;
     }
     assert(manifest.name && manifest.version, error('Package must have a name and version'));
     const processedManifest = replaceWorkspaceAndCatalogSpecs(manifest, config);
@@ -113,91 +233,13 @@ export const packTarball = async (manifest, dir, config) => {
     const tarballName = `${manifest.name}-${manifest.version}.tgz`;
     try {
         config.options.packageJson.write(packDir, processedManifest);
+        const packFilter = buildPackFilter(manifest, packDir);
         const tarballData = await tarCreate({
             cwd: packDir,
             gzip: true,
             portable: true,
             prefix: 'package/',
-            filter: (path) => {
-                // Normalize path - remove leading './'
-                const normalizedPath = path.replace(/^\.\//, '');
-                // Always include root directory
-                if (path === '.' || normalizedPath === '') {
-                    return true;
-                }
-                // Always exclude certain files/directories
-                const alwaysExcludePatterns = [
-                    /^\.?\/?\.git(\/|$)/,
-                    /^\.?\/?node_modules(\/|$)/,
-                    /^\.?\/?\.nyc_output(\/|$)/,
-                    /^\.?\/?coverage(\/|$)/,
-                    /^\.?\/?\.DS_Store$/,
-                    /^\.?\/?\.npmrc$/,
-                    /^\.?\/?package-lock\.json$/,
-                    /^\.?\/?yarn\.lock$/,
-                    /^\.?\/?pnpm-lock\.yaml$/,
-                    /^\.?\/?bun\.lockb$/,
-                    /^\.?\/?bun\.lock$/,
-                    /^\.?\/?vlt-lock\.json$/,
-                    /~$/,
-                    /\.swp$/,
-                ];
-                if (alwaysExcludePatterns.some(pattern => pattern.test(normalizedPath))) {
-                    return false;
-                }
-                // Always include certain files
-                const alwaysIncludePatterns = [
-                    /^README(\..*)?$/i,
-                    /^CHANGELOG(\..*)?$/i,
-                    /^HISTORY(\..*)?$/i,
-                    /^LICENSE(\..*)?$/i,
-                    /^LICENCE(\..*)?$/i,
-                ];
-                if (alwaysIncludePatterns.some(pattern => pattern.test(normalizedPath))) {
-                    return true;
-                }
-                // Always include package.json
-                if (normalizedPath === 'package.json') {
-                    return true;
-                }
-                // If files field is specified in package.json, use it for inclusion
-                const manifestWithFiles = manifest;
-                if (manifestWithFiles.files &&
-                    Array.isArray(manifestWithFiles.files)) {
-                    // Empty files array means exclude everything except always-included files
-                    if (manifestWithFiles.files.length === 0) {
-                        return false;
-                    }
-                    return manifestWithFiles.files.some((pattern) => {
-                        if (pattern.endsWith('/')) {
-                            const dirName = pattern.slice(0, -1);
-                            const globPattern = pattern.replace(/\/$/, '/**');
-                            const matchesDir = normalizedPath === dirName;
-                            const matchesContents = minimatch(normalizedPath, globPattern, {
-                                dot: true,
-                            });
-                            return matchesDir || matchesContents;
-                        }
-                        // File pattern: check direct match and if this path is a directory that could contain the pattern
-                        const directMatch = minimatch(normalizedPath, pattern, {
-                            dot: true,
-                        });
-                        // Check if this path is a directory that could contain the pattern
-                        const isParentDir = pattern.includes('/') &&
-                            pattern.startsWith(normalizedPath + '/');
-                        return directMatch || isParentDir;
-                    });
-                }
-                // Default behavior when no files field - exclude common development files
-                const defaultExcludePatterns = [
-                    /^\.?\/?\.vscode(\/|$)/,
-                    /^\.?\/?\.idea(\/|$)/,
-                    /^\.?\/?\.gitignore$/,
-                    /^\.?\/?\.npmignore$/,
-                    /^\.?\/?\.editorconfig$/,
-                ];
-                return !defaultExcludePatterns.some(pattern => pattern.test(normalizedPath));
-            },
+            filter: packFilter,
         }, ['.']).concat();
         let unpackedSize = 0;
         const files = [];
@@ -239,6 +281,7 @@ export const packTarball = async (manifest, dir, config) => {
             files,
             integrity,
             shasum,
+            resolvedManifest: processedManifest,
         };
     }
     finally {
@@ -246,4 +289,3 @@ export const packTarball = async (manifest, dir, config) => {
         config.options.packageJson.write(packDir, manifest);
     }
 };
-//# sourceMappingURL=pack-tarball.js.map

package/dist/{esm/parse-add-remove-args.d.ts → parse-add-remove-args.d.ts}

@@ -26,4 +26,3 @@ export declare const parseAddArgs: (config: LoadedConfig, scurry: PathScurry, mo
  * Parses the positional arguments into {@link RemoveImportersDependenciesMap}.
  */
 export declare const parseRemoveArgs: (config: LoadedConfig, scurry: PathScurry, monorepo?: Monorepo) => ParsedRemoveArgs;
-//# sourceMappingURL=parse-add-remove-args.d.ts.map

package/dist/{esm/parse-add-remove-args.js → parse-add-remove-args.js}

@@ -1,6 +1,7 @@
 import { asDependency } from '@vltpkg/graph';
-import { joinDepIDTuple } from '@vltpkg/dep-id';
+import { joinDepIDTuple, splitDepID } from '@vltpkg/dep-id';
 import { Spec } from '@vltpkg/spec';
+import { isAbsolute, relative, resolve } from 'node:path';
 const rootDepID = joinDepIDTuple(['file', '.']);
 /**
  * Compute a DepID for the current working directory relative to the project
@@ -45,6 +46,36 @@ class AddImportersDependenciesMapImpl extends Map {
 class RemoveImportersDependenciesMapImpl extends Map {
     modifiedDependencies = false;
 }
+/**
+ * Rebase a file: spec's relative path from process.cwd() to the
+ * importer's location. CLI positional args are relative to cwd,
+ * but the graph resolver resolves file: paths relative to the
+ * importer node's location. When these differ (e.g. `-w` flag),
+ * the path must be rebased.
+ *
+ * Also detects when the target path is a workspace and converts
+ * the spec to `workspace:*`.
+ */
+const rebaseFileSpec = (spec, importerPath, scurryCwd, specOptions, monorepo) => {
+    if (spec.type !== 'file' || !spec.file || isAbsolute(spec.file)) {
+        return spec;
+    }
+    const targetAbs = resolve(process.cwd(), spec.file);
+    if (monorepo) {
+        for (const ws of monorepo.values()) {
+            if (ws.fullpath === targetAbs) {
+                return Spec.parse(ws.name, 'workspace:*', specOptions);
+            }
+        }
+    }
+    const importerAbs = resolve(scurryCwd, importerPath);
+    const rebasedPath = relative(importerAbs, targetAbs)
+        .split('\\')
+        .join('/');
+    if (rebasedPath === spec.file)
+        return spec;
+    return Spec.parseArgs(rebasedPath, specOptions);
+};
 /**
  * Parses the positional arguments into {@link AddImportersDependenciesMap}.
  */
@@ -53,7 +84,6 @@ export const parseAddArgs = (config, scurry, monorepo) => {
     const items = config.positionals;
     const type = getType(config.values);
     const importers = getWorkspaceImporters(config.values, monorepo);
-    const newDependencies = new Map();
     const specOptions = config.options;
     // nameless spec definitions will need to use their full
     // stringified spec result instead of their name in order
@@ -61,21 +91,45 @@ export const parseAddArgs = (config, scurry, monorepo) => {
     const getName = (s) => s.name === '(unknown)' ? s.spec : s.name;
     // parses each positional argument into a Spec and
     // adds it to the new dependencies Map
+    const parsedItems = [];
+    let hasFileSpecs = false;
     for (const item of items) {
         const spec = Spec.parseArgs(item, specOptions);
-        newDependencies.set(getName(spec), asDependency({ spec, type }));
+        parsedItems.push({ spec, type });
+        if (spec.type === 'file')
+            hasFileSpecs = true;
         add.modifiedDependencies = true;
     }
     // assigns the new dependencies to each selected workspace importer
-    for (const importer of importers) {
-        add.set(importer, newDependencies);
+    // file: specs need per-importer rebasing since CLI paths are relative
+    // to process.cwd() but get resolved relative to the importer's location
+    if (hasFileSpecs && importers.size) {
+        const scurryCwd = scurry.cwd.fullpath();
+        for (const importer of importers) {
+            const [, importerPath] = splitDepID(importer);
+            const importerDeps = new Map();
+            for (const { spec, type: depType } of parsedItems) {
+                const rebased = rebaseFileSpec(spec, importerPath, scurryCwd, specOptions, monorepo);
+                importerDeps.set(getName(rebased), asDependency({ spec: rebased, type: depType }));
+            }
+            add.set(importer, importerDeps);
+        }
     }
-    // if no workspaces were selected, default to the cwd importer which
-    // can be either the root or a nested folder in case the user is installing
-    // from a subfolder that is also a file: type dependency
-    if (!importers.size) {
-        const cwdDepID = getCwdDepID(scurry);
-        add.set(cwdDepID, newDependencies);
+    else {
+        const newDependencies = new Map();
+        for (const { spec, type: depType } of parsedItems) {
+            newDependencies.set(getName(spec), asDependency({ spec, type: depType }));
+        }
+        for (const importer of importers) {
+            add.set(importer, newDependencies);
+        }
+        // if no workspaces were selected, default to the cwd importer which
+        // can be either the root or a nested folder in case the user is installing
+        // from a subfolder that is also a file: type dependency
+        if (!importers.size) {
+            const cwdDepID = getCwdDepID(scurry);
+            add.set(cwdDepID, newDependencies);
+        }
     }
     return {
         add,
@@ -101,4 +155,3 @@ export const parseRemoveArgs = (config, scurry, monorepo) => {
         remove,
     };
 };
-//# sourceMappingURL=parse-add-remove-args.js.map

package/dist/{esm/print-err.d.ts → print-err.d.ts}

@@ -11,4 +11,3 @@ export type ErrorFormatOptions = InspectOptions & {
 export type Formatter = (arg: unknown, options?: ErrorFormatOptions) => string;
 export declare const indent: (lines: string, num?: number) => string;
 export declare const printErr: (e: unknown, usage: CommandUsage, stderr: (...a: string[]) => void, baseOpts?: ErrorFormatOptions) => void;
-//# sourceMappingURL=print-err.d.ts.map

package/dist/{esm/print-err.js → print-err.js}

@@ -2,8 +2,8 @@ import { splitDepID } from '@vltpkg/dep-id';
 import { parseError } from '@vltpkg/output/error';
 import { isErrorWithCause, isObject } from '@vltpkg/types';
 import { XDG } from '@vltpkg/xdg';
-import { isGraphRunError } from 'graph-run';
-import { mkdirSync, writeFileSync } from 'node:fs';
+import { isGraphRunError } from '@vltpkg/graph-run';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { formatWithOptions } from 'node:util';
 export const formatOptions = {
@@ -13,6 +13,15 @@ export const formatOptions = {
 };
 const isNonEmptyString = (v) => !!v && typeof v === 'string';
 const formatURL = (v, format) => v instanceof URL ? v.toString() : /* c8 ignore next */ format(v);
+// True when `v` overrides the default `Object.prototype.toString`, i.e.
+// stringifying it yields something meaningful (like a `Spec` → `next@*`)
+// rather than `[object Object]`.
+const hasCustomToString = (v) => isObject(v) && v.toString !== Object.prototype.toString;
+// Render a value that has a meaningful custom `toString()` (such as a
+// `Spec`, e.g. `next@*`) as a concise string rather than dumping its
+// entire internal structure via util.inspect. Falls back to `format`
+// for plain values/objects.
+const formatToString = (v, format) => hasCustomToString(v) ? v.toString() : format(v);
 const formatArray = (v, format, joiner = ', ') => Array.isArray(v) ? v.join(joiner) : /* c8 ignore next */ format(v);
 export const indent = (lines, num = 2) => lines
     .split('\n')
@@ -33,6 +42,14 @@ const writeErrorLog = (e, format) => {
         return null;
     }
 };
+const readErrorLog = (file) => {
+    try {
+        return readFileSync(file, 'utf8');
+    }
+    catch {
+        return null;
+    }
+};
 export const printErr = (e, usage, stderr, baseOpts) => {
     const format = (arg, opts) => {
         const { maxLines = 200, ...rest } = {
@@ -62,6 +79,14 @@ export const printErr = (e, usage, stderr, baseOpts) => {
     if (fileWritten) {
         stderr('');
         stderr(`Full details written to: ${fileWritten}`);
+        if (process.env.CI) {
+            const fullErrorLog = readErrorLog(fileWritten);
+            if (fullErrorLog) {
+                stderr('');
+                stderr('Full details:');
+                stderr(fullErrorLog);
+            }
+        }
     }
     if (!knownError || knownError.bug) {
         stderr('');
@@ -131,7 +156,7 @@ const printCode = (err, usage, stderr, format) => {
                 stderr(indent(`While fetching: ${formatURL(url, format)}`));
             }
             if (spec) {
-                stderr(indent(`To satisfy: ${format(spec)}`));
+                stderr(indent(`To satisfy: ${formatToString(spec, format)}`));
             }
             if (from) {
                 stderr(indent(`From: ${format(from)}`));
@@ -175,4 +200,3 @@ const printCode = (err, usage, stderr, format) => {
         }
     }
 };
-//# sourceMappingURL=print-err.js.map

package/dist/query-diff-files.d.ts

@@ -0,0 +1,17 @@
+import type { DiffFilesProvider } from '@vltpkg/query';
+/**
+ * Validates that a commitish string is safe to use
+ * in a git command.
+ */
+export declare const validateCommitish: (commitish: string) => string;
+/**
+ * Creates a {@link DiffFilesProvider} that uses
+ * `git diff --name-only` to determine changed files.
+ * @param {string} projectRoot - The absolute path to the
+ *   project root directory where git commands will be
+ *   executed.
+ * @returns {DiffFilesProvider} A function that takes a
+ *   commitish and returns a Set of changed file paths
+ *   relative to the project root.
+ */
+export declare const createDiffFilesProvider: (projectRoot: string) => DiffFilesProvider;

package/dist/query-diff-files.js

@@ -0,0 +1,63 @@
+import { execSync } from 'node:child_process';
+import { error } from '@vltpkg/error-cause';
+/**
+ * Pattern to validate commitish arguments.
+ * Allows branch names, tags, SHAs, HEAD~N, HEAD^N, etc.
+ * Rejects shell metacharacters to prevent command injection.
+ */
+const VALID_COMMITISH = /^[a-zA-Z0-9_./@^~:#{}-]+$/;
+/**
+ * Validates that a commitish string is safe to use
+ * in a git command.
+ */
+export const validateCommitish = (commitish) => {
+    if (!commitish) {
+        throw error('Missing commitish argument for :diff() selector');
+    }
+    if (!VALID_COMMITISH.test(commitish)) {
+        throw error('Invalid commitish argument for :diff() selector', {
+            found: commitish,
+        });
+    }
+    return commitish;
+};
+/**
+ * Creates a {@link DiffFilesProvider} that uses
+ * `git diff --name-only` to determine changed files.
+ * @param {string} projectRoot - The absolute path to the
+ *   project root directory where git commands will be
+ *   executed.
+ * @returns {DiffFilesProvider} A function that takes a
+ *   commitish and returns a Set of changed file paths
+ *   relative to the project root.
+ */
+export const createDiffFilesProvider = (projectRoot) => {
+    // Cache results per commitish to avoid repeated git calls
+    const cache = new Map();
+    return (commitish) => {
+        const cached = cache.get(commitish);
+        if (cached)
+            return cached;
+        const safeCommitish = validateCommitish(commitish);
+        try {
+            const stdout = execSync(`git diff --name-only ${safeCommitish}`, {
+                cwd: projectRoot,
+                encoding: 'utf8',
+                stdio: ['pipe', 'pipe', 'pipe'],
+                timeout: 30_000,
+            });
+            const files = new Set();
+            for (const line of stdout.split('\n')) {
+                const trimmed = line.trim();
+                if (trimmed) {
+                    files.add(trimmed);
+                }
+            }
+            cache.set(commitish, files);
+            return files;
+        }
+        catch (err) {
+            throw error(`Failed to run git diff for commitish: ${safeCommitish}`, { cause: err });
+        }
+    };
+};

package/dist/{esm/query-host-contexts.d.ts → query-host-contexts.d.ts}

@@ -13,4 +13,3 @@ export type HostContextsMapResult = {
  * pseudo selector to dynamically load graphs from different sources.
  */
 export declare const createHostContextsMap: (conf: LoadedConfig) => Promise<Map<string, () => Promise<HostContextsMapResult>>>;
-//# sourceMappingURL=query-host-contexts.d.ts.map

package/dist/{esm/query-host-contexts.js → query-host-contexts.js}

@@ -1,6 +1,7 @@
 import { homedir } from 'node:os';
 import { parse, posix } from 'node:path';
-import { getProjectData, readProjectFolders, reloadConfig, } from '@vltpkg/server';
+import { readProjectFolders } from "./read-project-folders.js";
+import { reloadConfig } from "./reload-config.js";
 import { actual, createVirtualRoot } from '@vltpkg/graph';
 import { SecurityArchive } from '@vltpkg/security-archive';
 import { error } from '@vltpkg/error-cause';
@@ -13,6 +14,11 @@ try {
 }
 catch { }
 const home = foundHome ?? posix.dirname(posix.format(parse(process.cwd())));
+const isVltInstalled = (folder) => !!folder.resolve('node_modules/.vlt').lstatSync()?.isDirectory() ||
+    !!folder
+        .resolve('node_modules/.vlt-lock.json')
+        .lstatSync()
+        ?.isFile();
 /**
  * Generates possible project keys for a given folder.
  */
@@ -89,12 +95,8 @@ export const createHostContextsMap = async (conf) => {
         for (const folder of projectFolders) {
             try {
                 const config = await reloadConfig(folder.fullpath());
-                const projectInfo = getProjectData({
-                    packageJson: config.options.packageJson,
-                    scurry: config.options.scurry,
-                }, folder);
                 // only include projects that are vlt-installed
-                if (!projectInfo.vltInstalled) {
+                if (!isVltInstalled(folder)) {
                     continue;
                 }
                 // load each individual graph
@@ -132,4 +134,3 @@ export const createHostContextsMap = async (conf) => {
     });
     return hostContexts;
 };
-//# sourceMappingURL=query-host-contexts.js.map

package/dist/{esm/read-password.d.ts → read-password.d.ts}

@@ -5,4 +5,3 @@ export type Streams = {
     stdout: NodeJS.WritableStream;
 };
 export declare const readPassword: (prompt: string, { stdin, stdout }?: Streams) => Promise<string>;
-//# sourceMappingURL=read-password.d.ts.map

package/dist/{esm/read-password.js → read-password.js}

@@ -30,4 +30,3 @@ export const readPassword = async (prompt, { stdin, stdout } = process) => {
     });
     return input;
 };
-//# sourceMappingURL=read-password.js.map

package/dist/read-project-folders.d.ts

@@ -0,0 +1,17 @@
+import type { PathBase, PathScurry } from 'path-scurry';
+type ProjectFolderOptions = {
+    path?: string;
+    scurry: PathScurry;
+    userDefinedProjectPaths: string[];
+};
+/**
+ * Retrieves folders from a given directory, if that directory is
+ * recognized to be the current cli project root folder then we
+ * proceed to read its siblings.
+ *
+ * Traverses nested directory recursively until project folders can
+ * be find, always stopping at the first level where a package.json
+ * is present.
+ */
+export declare const readProjectFolders: ({ path, scurry, userDefinedProjectPaths, }: ProjectFolderOptions, maxDepth?: number) => Promise<PathBase[]>;
+export {};