@vltpkg/cli-sdk 1.0.0-rc.9 → 1.0.1

package/dist/{esm/commands → commands}/pkg.d.ts

@@ -4,4 +4,3 @@ export declare const views: {
 };
 export declare const usage: CommandUsage;
 export declare const command: CommandFn;
-//# sourceMappingURL=pkg.d.ts.map

package/dist/{esm/commands → commands}/pkg.js

@@ -9,6 +9,7 @@ import { SecurityArchive } from '@vltpkg/security-archive';
 import { views as initViews } from "./init.js";
 import { commandUsage } from "../config/usage.js";
 import { createHostContextsMap } from "../query-host-contexts.js";
+import { minimatch } from 'minimatch';
 export const views = {
     human: (results, _, config) => {
         // `vlt pkg init` is an alias for `vlt init`
@@ -58,6 +59,23 @@ export const usage = () => commandUsage({
             description: 'Append a value to an array',
         },
     },
+    options: {
+        scope: {
+            value: '<query>',
+            description: 'Filter package.json targets using a DSS query.',
+        },
+        workspace: {
+            value: '<path|glob>',
+            description: 'Limit package.json targets to matching workspaces.',
+        },
+        'workspace-group': {
+            value: '<name>',
+            description: 'Limit package.json targets to workspace groups.',
+        },
+        recursive: {
+            description: 'Operate across all workspaces in the current monorepo.',
+        },
+    },
 });
 export const command = async (conf) => {
     const [sub, ...args] = conf.positionals;
@@ -123,6 +141,15 @@ export const command = async (conf) => {
     }
     else if (paths?.length || groups?.length || recursive) {
         for (const workspace of options.monorepo ?? []) {
+            if (paths?.length) {
+                const matches = paths.some((p) => workspace.path === p ||
+                    workspace.name === p ||
+                    workspace.fullpath === p ||
+                    resolve(projectRoot, p) === workspace.fullpath ||
+                    minimatch(workspace.path, p));
+                if (!matches)
+                    continue;
+            }
             locations.push(workspace.fullpath);
         }
     }
@@ -203,4 +230,3 @@ const rm = (manifest, location, pkg, args) => {
         location,
     };
 };
-//# sourceMappingURL=pkg.js.map

package/dist/commands/profile.d.ts

@@ -0,0 +1,14 @@
+import type { JSONField } from '@vltpkg/types';
+import type { CommandFn, CommandUsage } from '../index.ts';
+export declare const needsRegistry = true;
+export declare const usage: CommandUsage;
+export type ProfileData = Record<string, JSONField>;
+export type ProfileResult = ProfileData | {
+    property: string;
+    value: JSONField;
+};
+export declare const views: {
+    readonly human: (result: ProfileResult) => string;
+    readonly json: (r: ProfileResult) => ProfileResult;
+};
+export declare const command: CommandFn<ProfileResult>;

package/dist/commands/profile.js

@@ -0,0 +1,106 @@
+import { error } from '@vltpkg/error-cause';
+import { RegistryClient } from '@vltpkg/registry-client';
+import { commandUsage } from "../config/usage.js";
+import { resolveRegistry } from "../require-registry.js";
+export const needsRegistry = true;
+export const usage = () => commandUsage({
+    command: 'profile',
+    usage: '<command> [<args>]',
+    description: `Get or set profile properties for the authenticated user
+                  on the configured registry.`,
+    subcommands: {
+        get: {
+            usage: '[<property>]',
+            description: 'Display profile information. Optionally pass a property name to get a single value.',
+        },
+        set: {
+            usage: '<property> <value>',
+            description: 'Set a profile property to the given value.',
+        },
+    },
+    options: {
+        registry: {
+            value: '<url>',
+            description: 'Registry URL to query for profile info.',
+        },
+        identity: {
+            value: '<name>',
+            description: 'Identity namespace used to look up auth tokens.',
+        },
+        otp: {
+            description: 'Provide an OTP to use when updating profile properties.',
+            value: '<otp>',
+        },
+    },
+});
+const stringify = (v) => typeof v === 'string' ? v
+    : typeof v === 'number' || typeof v === 'boolean' ? `${v}`
+        : v === null ? 'null'
+            : JSON.stringify(v);
+export const views = {
+    human: result => {
+        if ('property' in result) {
+            return stringify(result.value);
+        }
+        return Object.entries(result)
+            .map(([k, v]) => `${k}: ${stringify(v)}`)
+            .join('\n');
+    },
+    json: r => r,
+};
+export const command = async (conf) => {
+    const [sub, ...args] = conf.positionals;
+    switch (sub) {
+        case 'get':
+            return getProfile(conf, args);
+        case 'set':
+            return setProfile(conf, args);
+        default: {
+            throw error('Invalid profile subcommand', {
+                found: sub,
+                validOptions: ['get', 'set'],
+                code: 'EUSAGE',
+            });
+        }
+    }
+};
+const getProfile = async (conf, args) => {
+    const rc = new RegistryClient(conf.options);
+    const registryUrl = new URL(await resolveRegistry(conf));
+    const url = new URL('-/npm/v1/user', registryUrl);
+    const response = await rc.request(url, { useCache: false });
+    const data = response.json();
+    const [property] = args;
+    if (property) {
+        if (!(property in data)) {
+            throw error('Property not found in profile', {
+                found: property,
+                validOptions: Object.keys(data),
+                code: 'EUSAGE',
+            });
+        }
+        return { property, value: data[property] };
+    }
+    return data;
+};
+const setProfile = async (conf, args) => {
+    const [property, ...rest] = args;
+    const value = rest.join(' ');
+    if (!property || !value) {
+        throw error('set requires a property name and value', {
+            code: 'EUSAGE',
+        });
+    }
+    const rc = new RegistryClient(conf.options);
+    const registryUrl = new URL(await resolveRegistry(conf));
+    const url = new URL('-/npm/v1/user', registryUrl);
+    const response = await rc.request(url, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ [property]: value }),
+        otp: conf.options.otp,
+        useCache: false,
+    });
+    const data = response.json();
+    return { property, value: data[property] };
+};

package/dist/{esm/commands → commands}/publish.d.ts

@@ -1,4 +1,5 @@
 import type { CommandFn, CommandUsage } from '../index.ts';
+export declare const needsRegistry = true;
 export declare const usage: CommandUsage;
 export type CommandResultSingle = {
     id: string;
@@ -9,7 +10,7 @@ export type CommandResultSingle = {
     shasum?: string;
     integrity?: string;
     size: number;
-    access: string;
+    access?: string;
     unpackedSize: number;
     files: string[];
 };
@@ -19,4 +20,3 @@ export declare const views: {
     readonly json: (r: CommandResult) => CommandResult;
 };
 export declare const command: CommandFn<CommandResult>;
-//# sourceMappingURL=publish.d.ts.map

package/dist/{esm/commands → commands}/publish.js

@@ -1,5 +1,5 @@
 import { error } from '@vltpkg/error-cause';
-import { RegistryClient } from '@vltpkg/registry-client';
+import { RegistryClient, oidc, registryBase, } from '@vltpkg/registry-client';
 import { run } from '@vltpkg/run';
 import { commandUsage } from "../config/usage.js";
 import { packTarball } from "../pack-tarball.js";
@@ -10,6 +10,10 @@ import prettyBytes from 'pretty-bytes';
 import { actual } from '@vltpkg/graph';
 import { Query } from '@vltpkg/query';
 import { createHostContextsMap } from "../query-host-contexts.js";
+import { minimatch } from 'minimatch';
+import { resolveRegistry } from "../require-registry.js";
+import { registryErrorMessage } from "../registry-error-message.js";
+export const needsRegistry = true;
 export const usage = () => commandUsage({
     command: 'publish',
     usage: '',
@@ -35,6 +39,24 @@ export const usage = () => commandUsage({
                     The directory must exist and nothing will be copied to it.`,
             value: '<path>',
         },
+        'dry-run': {
+            description: 'Show what would be published without actually publishing.',
+        },
+        scope: {
+            value: '<query>',
+            description: 'Filter packages to publish using a DSS query selector.',
+        },
+        workspace: {
+            value: '<path|glob>',
+            description: 'Limit publish targets to matching workspaces.',
+        },
+        'workspace-group': {
+            value: '<name>',
+            description: 'Limit publish targets to workspace groups.',
+        },
+        recursive: {
+            description: 'Publish all workspaces in the monorepo.',
+        },
     },
 });
 export const views = {
@@ -102,6 +124,15 @@ export const command = async (conf) => {
     }
     else if (paths?.length || groups?.length || recursive) {
         for (const workspace of options.monorepo ?? []) {
+            if (paths?.length) {
+                const matches = paths.some((p) => workspace.path === p ||
+                    workspace.name === p ||
+                    workspace.fullpath === p ||
+                    resolve(projectRoot, p) === workspace.fullpath ||
+                    minimatch(workspace.path, p));
+                if (!matches)
+                    continue;
+            }
             locations.push(workspace.fullpath);
         }
     }
@@ -118,14 +149,26 @@ export const command = async (conf) => {
     }
     return results;
 };
+const getPublishConfig = (manifest) => {
+    const pc = manifest
+        .publishConfig;
+    if (pc && typeof pc === 'object') {
+        return pc;
+    }
+    return undefined;
+};
 const commandSingle = async (location, conf) => {
     const manifestPath = conf.options.packageJson.find(location);
     assert(manifestPath, 'No package.json found');
     const manifestDir = dirname(manifestPath);
     const manifest = conf.options.packageJson.read(manifestDir);
     assert(!manifest.private, error('Package has been marked as private'));
-    const { tag = 'latest', access, registry, 'dry-run': dry = false, otp, } = conf.options;
-    const registryUrl = new URL(registry);
+    const { 'dry-run': dry = false, otp } = conf.options;
+    const publishConfig = getPublishConfig(manifest);
+    const tag = publishConfig?.tag ?? conf.options.tag;
+    const access = publishConfig?.access ?? conf.options.access;
+    const registry = publishConfig?.registry ?? (await resolveRegistry(conf));
+    const registryUrl = new URL(registryBase(registry));
     const runOptions = {
         cwd: manifestDir,
         projectRoot: conf.projectRoot,
@@ -150,7 +193,11 @@ const commandSingle = async (location, conf) => {
         ...runOptions,
         arg0: 'prepare',
     });
-    const { name, version, tarballName, tarballData, unpackedSize, files, integrity, shasum, } = await packTarball(manifest, manifestDir, conf);
+    // Re-read the manifest after lifecycle scripts, which may have modified package.json.
+    const updatedManifest = conf.options.packageJson.read(manifestDir, {
+        reload: true,
+    });
+    const { name, version, tarballName, tarballData, unpackedSize, files, integrity, shasum, resolvedManifest, } = await packTarball(updatedManifest, manifestDir, conf);
     await run({
         ...runOptions,
         arg0: 'postpack',
@@ -162,17 +209,17 @@ const commandSingle = async (location, conf) => {
     const publishMetadata = {
         _id: name,
         name,
-        description: manifest.description || '',
+        description: resolvedManifest.description || '',
         'dist-tags': {
             [tag]: version,
         },
         versions: {
             [version]: {
-                ...manifest,
+                ...resolvedManifest,
                 _id: `${name}@${version}`,
                 _nodeVersion: process.versions.node,
                 dist: {
-                    ...manifest.dist,
+                    ...resolvedManifest.dist,
                     integrity,
                     shasum,
                     tarball: new URL(`${name}/-/${tarballName}`, registryUrl)
@@ -180,7 +227,7 @@ const commandSingle = async (location, conf) => {
                 },
             },
         },
-        access,
+        ...(access ? { access } : {}),
         _attachments: {
             [tarballName]: {
                 content_type: 'application/octet-stream',
@@ -190,6 +237,12 @@ const commandSingle = async (location, conf) => {
         },
     };
     const rc = new RegistryClient(conf.options);
+    // Attempt OIDC token exchange for CI environments (GitHub Actions, GitLab, CircleCI).
+    // This is always optional — failures are silent and won't affect local publishing.
+    await oidc({
+        packageName: name,
+        registry: registryUrl.href,
+    });
     const publishUrl = new URL(name.startsWith('@') ? name.replace('/', '%2F') : name, registryUrl);
     if (!dry) {
         let response;
@@ -212,13 +265,15 @@ const commandSingle = async (location, conf) => {
             });
         }
         if (response.statusCode !== 200 && response.statusCode !== 201) {
-            let extraMsg = '';
-            // special case 404 errors to provide a better hint to the user
-            if (response.statusCode === 404) {
-                extraMsg =
-                    ".\n⚠️ Make sure you're logged in and have access to publish the package.";
+            let advice = '';
+            if (response.statusCode === 409) {
+                advice = `\n⚠️ ${name}@${version} already exists in the registry. Bump the version and try again.`;
+            }
+            else if (response.statusCode === 404) {
+                advice =
+                    "\n⚠️ Make sure you're logged in and have access to publish the package.";
             }
-            throw error(`Failed to publish package${extraMsg}`, {
+            throw error(`Failed to publish package: ${registryErrorMessage(response)}${advice}`, {
                 url: publishUrl,
                 response,
             });
@@ -233,7 +288,7 @@ const commandSingle = async (location, conf) => {
         name,
         version,
         tag,
-        access,
+        ...(access ? { access } : {}),
         registry: registryUrl.origin,
         integrity,
         shasum,
@@ -242,4 +297,3 @@ const commandSingle = async (location, conf) => {
         files,
     };
 };
-//# sourceMappingURL=publish.js.map

package/dist/{esm/commands → commands}/query.d.ts

@@ -1,6 +1,8 @@
 import { humanReadableOutput, jsonOutput, mermaidOutput } from '@vltpkg/graph';
 import type { HumanReadableOutputGraph, JSONOutputGraph, MermaidOutputGraph } from '@vltpkg/graph';
+import { MermaidImageView } from '../mermaid-image-view.ts';
 import type { CommandFn, CommandUsage } from '../index.ts';
+export declare const needsRegistry = true;
 export declare const usage: CommandUsage;
 type QueryResult = JSONOutputGraph & MermaidOutputGraph & HumanReadableOutputGraph & {
     queryString: string;
@@ -9,8 +11,9 @@ export declare const views: {
     readonly json: typeof jsonOutput;
     readonly mermaid: typeof mermaidOutput;
     readonly human: typeof humanReadableOutput;
-    readonly gui: ({ queryString }: QueryResult, _: import("../view.ts").ViewOptions, conf: import("../config/index.ts").ParsedConfig) => Promise<void>;
+    readonly count: (result: QueryResult) => number;
+    readonly svg: typeof MermaidImageView;
+    readonly png: typeof MermaidImageView;
 };
 export declare const command: CommandFn<QueryResult>;
 export {};
-//# sourceMappingURL=query.d.ts.map

package/dist/{esm/commands → commands}/query.js

@@ -1,18 +1,20 @@
 import { actual, asNode, humanReadableOutput, jsonOutput, mermaidOutput, GraphModifier, } from '@vltpkg/graph';
-import { error } from '@vltpkg/error-cause';
-import LZString from 'lz-string';
 import { Query } from '@vltpkg/query';
+import { stdout } from "../output.js";
+import { error } from '@vltpkg/error-cause';
+import { createDiffFilesProvider } from "../query-diff-files.js";
 import { SecurityArchive } from '@vltpkg/security-archive';
-import { startGUI } from "../start-gui.js";
 import { commandUsage } from "../config/usage.js";
 import { createHostContextsMap } from "../query-host-contexts.js";
+import { MermaidImageView } from "../mermaid-image-view.js";
+export const needsRegistry = true;
 export const usage = () => commandUsage({
     command: 'query',
     usage: [
         '',
-        '<query> --view=<human | json | mermaid | gui>',
+        '<query> --view=<human | json | mermaid | svg | png | count>',
         '<query> --expect-results=<comparison string>',
-        '--target=<query> --view=<human | json | mermaid | gui>',
+        '--target=<query> --view=<human | json | mermaid | svg | png | count>',
     ],
     description: `List installed dependencies matching the provided query.
 
@@ -68,8 +70,8 @@ export const usage = () => commandUsage({
             description: 'Query selector to filter packages using DSS syntax.',
         },
         view: {
-            value: '[human | json | mermaid | gui]',
-            description: 'Output format. Defaults to human-readable or json if no tty.',
+            value: '[human | json | mermaid | svg | png | count]',
+            description: 'Output format. Defaults to human-readable or json if no tty. Use svg or png to render the dependency graph as an image and open it. Count outputs the number of dependency relationships in the result.',
         },
     },
 });
@@ -96,9 +98,9 @@ export const views = {
     json: jsonOutput,
     mermaid: mermaidOutput,
     human: humanReadableOutput,
-    gui: async ({ queryString }, _, conf) => {
-        await startGUI(conf, `/explore/${LZString.compressToEncodedURIComponent(queryString)}/overview`);
-    },
+    count: (result) => result.edges.length,
+    svg: MermaidImageView,
+    png: MermaidImageView,
 };
 export const command = async (conf) => {
     const modifiers = GraphModifier.maybeLoad(conf.options);
@@ -127,6 +129,7 @@ export const command = async (conf) => {
     const scopeQueryString = conf.get('scope');
     const queryString = targetQueryString || positionalQueryString;
     const hostContexts = await createHostContextsMap(conf);
+    const diffFiles = createDiffFilesProvider(conf.options.projectRoot);
     const importers = new Set();
     const scopeIDs = [];
     // Handle --scope option to add scope nodes as importers
@@ -146,11 +149,24 @@ export const command = async (conf) => {
             importers,
             securityArchive,
             hostContexts,
+            diffFiles,
         });
         const { nodes: resultNodes } = await scopeQuery.search(scopeQueryString, {
             signal: new AbortController().signal,
         });
         scopeNodes = resultNodes;
+        if (scopeNodes.length === 0) {
+            if (conf.values.view === 'human') {
+                stdout('No packages found matching scope query:', scopeQueryString);
+            }
+            return {
+                importers: new Set(),
+                edges: [],
+                nodes: [],
+                highlightSelection: false,
+                queryString: scopeQueryString,
+            };
+        }
     }
     if (scopeQueryString && scopeNodes) {
         // Add all scope nodes to importers Set (treat them as top-level items)
@@ -170,6 +186,18 @@ export const command = async (conf) => {
                 }
             }
         }
+        if (importers.size === 0) {
+            if (conf.values.view === 'human') {
+                stdout('No matching workspaces found:', conf.values.workspace);
+            }
+            return {
+                importers: new Set(),
+                edges: [],
+                nodes: [],
+                highlightSelection: false,
+                queryString: queryString ?? '',
+            };
+        }
     }
     // retrieve the selected nodes and edges
     const edges_ = graph?.edges ?? new Set();
@@ -185,6 +213,7 @@ export const command = async (conf) => {
         importers: importers_,
         securityArchive,
         hostContexts,
+        diffFiles,
     });
     const query = queryString ||
         (graph ? defaultProjectQueryString : defaultLocalScopeQueryString);
@@ -198,6 +227,21 @@ export const command = async (conf) => {
             wanted: conf.values['expect-results'],
         });
     }
+    if (graph &&
+        nodes.length === 0 &&
+        edges.length === 0 &&
+        !conf.values['expect-results']) {
+        if (conf.values.view === 'human') {
+            stdout('No packages found matching query:', query);
+        }
+        return {
+            importers: new Set(),
+            edges: [],
+            nodes: [],
+            highlightSelection: false,
+            queryString: query,
+        };
+    }
     return {
         importers: importers.size === 0 ?
             new Set(queryResultImporters)
@@ -211,4 +255,3 @@ export const command = async (conf) => {
                 : defaultLocalScopeQueryString),
     };
 };
-//# sourceMappingURL=query.js.map

package/dist/commands/registry.d.ts

@@ -0,0 +1,26 @@
+import type { LoadedConfig } from '../config/index.ts';
+import type { CommandFn, CommandUsage } from '../index.ts';
+/**
+ * The account/auth commands that can be scoped to a named registry
+ * alias via `vlt registry <alias> <command>`.
+ */
+export declare const registrySubcommands: ["whoami", "logout", "login", "token", "access", "publish", "unpublish", "deprecate", "dist-tag", "profile", "ping"];
+export declare const usage: CommandUsage;
+export declare const views: {
+    readonly human: () => void;
+};
+/**
+ * Resolve `vlt registry <alias> <command>` in place: determine the
+ * target subcommand and registry, then rewrite `conf` so the outer
+ * runner dispatches the real command with the resolved registry
+ * injected. When invoked with `--help` or without a subcommand, `conf`
+ * is left untouched so the `registry` usage/error is shown instead.
+ *
+ * Streams / interactivity are injectable for tests.
+ */
+export declare const dispatchRegistry: (conf: LoadedConfig, { interactive, input, output, }?: {
+    interactive?: boolean;
+    input?: NodeJS.ReadableStream;
+    output?: NodeJS.WritableStream;
+}) => Promise<void>;
+export declare const command: CommandFn<void>;

package/dist/commands/registry.js

@@ -0,0 +1,99 @@
+import { error } from '@vltpkg/error-cause';
+import { getCommand } from "../config/definition.js";
+import { commandUsage } from "../config/usage.js";
+import { resolveRegistry } from "../require-registry.js";
+/**
+ * The account/auth commands that can be scoped to a named registry
+ * alias via `vlt registry <alias> <command>`.
+ */
+export const registrySubcommands = [
+    'whoami',
+    'logout',
+    'login',
+    'token',
+    'access',
+    'publish',
+    'unpublish',
+    'deprecate',
+    'dist-tag',
+    'profile',
+    'ping',
+];
+const isRegistrySubcommand = (s) => {
+    const canonical = getCommand(s);
+    return (canonical !== undefined &&
+        registrySubcommands.includes(canonical));
+};
+export const usage = () => commandUsage({
+    command: 'registry',
+    usage: '<alias> <command> [<args>]',
+    description: `Run an account command against a specific configured
+                  registry, selected by its \`registries\` alias instead
+                  of a full URL.
+
+                  For example, \`vlt registry main whoami\` runs \`whoami\`
+                  against the registry configured as \`main\`. Omit the
+                  alias (e.g. \`vlt registry whoami\`) to be prompted to
+                  choose from the configured registries, or to fall back
+                  to \`--default-registry-alias\` when non-interactive.
+
+                  \`<command>\` is one of:
+                  ${registrySubcommands.join(', ')}.`,
+});
+export const views = {
+    human: () => { },
+};
+/**
+ * Resolve `vlt registry <alias> <command>` in place: determine the
+ * target subcommand and registry, then rewrite `conf` so the outer
+ * runner dispatches the real command with the resolved registry
+ * injected. When invoked with `--help` or without a subcommand, `conf`
+ * is left untouched so the `registry` usage/error is shown instead.
+ *
+ * Streams / interactivity are injectable for tests.
+ */
+export const dispatchRegistry = async (conf, { interactive, input, output, } = {}) => {
+    if (conf.get('help'))
+        return;
+    const [first, ...restArgs] = conf.positionals;
+    if (first === undefined)
+        return;
+    let alias;
+    let subRaw;
+    let args;
+    if (isRegistrySubcommand(first)) {
+        subRaw = first;
+        args = restArgs;
+    }
+    else {
+        alias = first;
+        subRaw = restArgs[0];
+        args = restArgs.slice(1);
+    }
+    if (!isRegistrySubcommand(subRaw)) {
+        throw error('Unknown registry subcommand', {
+            found: subRaw,
+            validOptions: [...registrySubcommands],
+            code: 'EUSAGE',
+        });
+    }
+    const registry = await resolveRegistry(conf, {
+        alias,
+        interactive,
+        input,
+        output,
+    });
+    conf.options.registry = registry;
+    conf.values.registry = registry;
+    conf.command = subRaw;
+    conf.positionals = args;
+};
+export const command = async (conf) => {
+    // Reached only when dispatchRegistry did not rewrite conf, i.e. no
+    // subcommand was provided (help is handled by the runner earlier).
+    throw error('Missing registry subcommand', {
+        found: conf.positionals[0],
+        validOptions: [...registrySubcommands],
+        code: 'EUSAGE',
+    });
+};

package/dist/commands/repo.d.ts

@@ -0,0 +1,17 @@
+import type { CommandFn, CommandUsage } from '../index.ts';
+export declare const usage: CommandUsage;
+type CommandResultSingle = {
+    url: string;
+    name: string;
+};
+type CommandResultMultiple = {
+    url: string;
+    name: string;
+}[];
+export type CommandResult = CommandResultSingle | CommandResultMultiple;
+export declare const views: {
+    readonly human: (r: CommandResult) => string;
+    readonly json: (r: CommandResult) => CommandResult;
+};
+export declare const command: CommandFn<CommandResult>;
+export {};