@vltpkg/cli-sdk 1.0.0-rc.9 → 1.0.1

package/dist/{esm/commands → commands}/uninstall.js

@@ -2,11 +2,26 @@ import { uninstall } from '@vltpkg/graph';
 import { commandUsage } from "../config/usage.js";
 import { parseRemoveArgs } from "../parse-add-remove-args.js";
 import { InstallReporter } from "./install/reporter.js";
+export const needsRegistry = true;
 export const usage = () => commandUsage({
     command: 'uninstall',
     usage: '[package ...]',
     description: `The opposite of \`vlt install\`. Removes deps and updates
                   vlt-lock.json and package.json appropriately.`,
+    options: {
+        workspace: {
+            value: '<path|glob>',
+            description: 'Limit uninstall targets to matching workspaces.',
+        },
+        'workspace-group': {
+            value: '<name>',
+            description: 'Limit uninstall targets to workspace groups.',
+        },
+        'allow-scripts': {
+            value: '<query>',
+            description: 'Filter which packages are allowed to run lifecycle scripts using DSS query syntax.',
+        },
+    },
 });
 export const views = {
     json: i => i.graph.toJSON(),
@@ -23,4 +38,3 @@ export const command = async (conf) => {
     const { graph } = await uninstall({ ...conf.options, allowScripts }, remove);
     return { graph };
 };
-//# sourceMappingURL=uninstall.js.map

package/dist/commands/unpublish.d.ts

@@ -0,0 +1,16 @@
+import type { CommandFn, CommandUsage } from '../index.ts';
+export declare const needsRegistry = true;
+export declare const usage: CommandUsage;
+export type CommandResult = {
+    /** The package name */
+    name: string;
+    /** The version that was unpublished, or undefined for entire package */
+    version?: string;
+    /** The registry URL */
+    registry: string;
+};
+export declare const views: {
+    readonly human: (result: CommandResult) => string;
+    readonly json: (r: CommandResult) => CommandResult;
+};
+export declare const command: CommandFn<CommandResult>;

package/dist/commands/unpublish.js

@@ -0,0 +1,203 @@
+import { error } from '@vltpkg/error-cause';
+import { RegistryClient } from '@vltpkg/registry-client';
+import { Spec } from '@vltpkg/spec';
+import { asError } from '@vltpkg/types';
+import { commandUsage } from "../config/usage.js";
+import { resolveRegistry } from "../require-registry.js";
+export const needsRegistry = true;
+export const usage = () => commandUsage({
+    command: 'unpublish',
+    usage: ['<package>@<version>', '<package> --force'],
+    description: `Remove a package version from the registry.
+
+    To unpublish a single version, specify the package name and version.
+    To unpublish an entire package, specify the package name and use --force.
+
+    ⚠️  Unpublishing is a destructive action that cannot be undone.
+    Consider using \`vlt deprecate\` instead if you want to discourage
+    usage of a package without removing it.`,
+    examples: {
+        'my-package@1.0.0': {
+            description: 'Unpublish a specific version',
+        },
+        '@scope/my-package@1.0.0': {
+            description: 'Unpublish a specific version of a scoped package',
+        },
+        'my-package --force': {
+            description: 'Unpublish an entire package (requires --force)',
+        },
+    },
+    options: {
+        force: {
+            description: 'Required to unpublish an entire package (all versions).',
+        },
+        otp: {
+            description: 'Provide a one-time password for authentication.',
+            value: '<otp>',
+        },
+    },
+});
+export const views = {
+    human: (result) => {
+        if (result.version) {
+            return `⚠️  ${result.name}@${result.version} has been unpublished from ${result.registry}.`;
+        }
+        return `⚠️  ${result.name} (all versions) has been unpublished from ${result.registry}.`;
+    },
+    json: (r) => r,
+};
+export const command = async (conf) => {
+    const specArg = conf.positionals[0];
+    if (!specArg) {
+        throw error('unpublish requires a package spec argument (e.g. pkg@version)', { code: 'EUSAGE' });
+    }
+    const { otp, force } = conf.options;
+    const registry = await resolveRegistry(conf);
+    const registryUrl = new URL(registry);
+    const spec = Spec.parseArgs(specArg, conf.options);
+    const name = spec.name;
+    /* c8 ignore start - Spec.parseArgs always produces a name for valid input */
+    if (!name) {
+        throw error('Package name is required', {
+            found: specArg,
+        });
+    }
+    /* c8 ignore stop */
+    const version = spec.bareSpec;
+    // If no version specified, require --force to unpublish the entire package
+    if (!version) {
+        if (!force) {
+            throw error('Refusing to unpublish entire package without --force.\n' +
+                'To unpublish a specific version, use: vlt unpublish <package>@<version>\n' +
+                'To unpublish all versions, use: vlt unpublish <package> --force');
+        }
+    }
+    const rc = new RegistryClient(conf.options);
+    const encodedName = name.startsWith('@') ? name.replace('/', '%2F') : name;
+    if (version) {
+        // Unpublish a specific version:
+        // 1. Fetch the packument
+        // 2. Remove the version from the packument
+        // 3. PUT the updated packument back
+        const packumentUrl = new URL(encodedName, registryUrl);
+        let packumentResponse;
+        try {
+            packumentResponse = await rc.request(packumentUrl, {
+                useCache: false,
+            });
+        }
+        catch (err) {
+            throw error('Failed to fetch package metadata', {
+                cause: asError(err),
+            });
+        }
+        if (packumentResponse.statusCode !== 200) {
+            throw error('Package not found on the registry', {
+                url: packumentUrl,
+                response: packumentResponse,
+            });
+        }
+        const packument = packumentResponse.json();
+        const versions = packument.versions;
+        const distTags = packument['dist-tags'];
+        if (!versions?.[version]) {
+            throw error(`Version ${version} not found in package ${name}`, {
+                found: version,
+                wanted: Object.keys(versions ?? {}),
+            });
+        }
+        // Remove the version
+        delete versions[version];
+        // Remove any dist-tags pointing to this version
+        if (distTags) {
+            for (const [tag, tagVersion] of Object.entries(distTags)) {
+                if (tagVersion === version) {
+                    delete distTags[tag];
+                }
+            }
+        }
+        // Remove the version from the time field if present
+        const time = packument.time;
+        if (time?.[version]) {
+            delete time[version];
+        }
+        // PUT the updated packument
+        const putUrl = new URL(`${encodedName}/-rev/${packument._rev}`, registryUrl);
+        let response;
+        try {
+            response = await rc.request(putUrl, {
+                method: 'PUT',
+                headers: {
+                    'content-type': 'application/json',
+                    'npm-auth-type': 'web',
+                    'npm-command': 'unpublish',
+                },
+                body: JSON.stringify(packument),
+                otp,
+            });
+        }
+        catch (err) {
+            throw error('Failed to unpublish package version', {
+                cause: asError(err),
+            });
+        }
+        if (response.statusCode !== 200 && response.statusCode !== 201) {
+            throw error('Failed to unpublish package version', {
+                url: putUrl,
+                response,
+            });
+        }
+    }
+    else {
+        // Unpublish entire package — DELETE the packument
+        // First fetch the packument to get the _rev
+        const packumentUrl = new URL(encodedName, registryUrl);
+        let packumentResponse;
+        try {
+            packumentResponse = await rc.request(packumentUrl, {
+                useCache: false,
+            });
+        }
+        catch (err) {
+            throw error('Failed to fetch package metadata', {
+                cause: asError(err),
+            });
+        }
+        if (packumentResponse.statusCode !== 200) {
+            throw error('Package not found on the registry', {
+                url: packumentUrl,
+                response: packumentResponse,
+            });
+        }
+        const packument = packumentResponse.json();
+        const deleteUrl = new URL(`${encodedName}/-rev/${packument._rev}`, registryUrl);
+        let response;
+        try {
+            response = await rc.request(deleteUrl, {
+                method: 'DELETE',
+                headers: {
+                    'content-type': 'application/json',
+                    'npm-auth-type': 'web',
+                    'npm-command': 'unpublish',
+                },
+                otp,
+            });
+        }
+        catch (err) {
+            throw error('Failed to unpublish package', {
+                cause: asError(err),
+            });
+        }
+        if (response.statusCode !== 200 && response.statusCode !== 201) {
+            throw error('Failed to unpublish package', {
+                url: deleteUrl,
+                response,
+            });
+        }
+    }
+    return {
+        name,
+        ...(version ? { version } : {}),
+        registry: registryUrl.origin,
+    };
+};

package/dist/{esm/commands → commands}/update.d.ts

@@ -1,6 +1,7 @@
 import type { CommandFn, CommandUsage } from '../index.ts';
 import { InstallReporter } from './install/reporter.ts';
 import type { InstallResult } from './install.ts';
+export declare const needsRegistry = true;
 export declare const usage: CommandUsage;
 export declare const views: {
     readonly json: (i: InstallResult) => {
@@ -11,4 +12,3 @@ export declare const views: {
     readonly human: typeof InstallReporter;
 };
 export declare const command: CommandFn<InstallResult>;
-//# sourceMappingURL=update.d.ts.map

package/dist/{esm/commands → commands}/update.js

@@ -2,11 +2,18 @@ import { update } from '@vltpkg/graph';
 import { error } from '@vltpkg/error-cause';
 import { commandUsage } from "../config/usage.js";
 import { InstallReporter } from "./install/reporter.js";
+export const needsRegistry = true;
 export const usage = () => commandUsage({
     command: 'update',
     usage: '',
     description: `Update dependencies to their latest in-range versions.
                   Discards the lockfile and resolves dependencies from scratch.`,
+    options: {
+        'allow-scripts': {
+            value: '<query>',
+            description: 'Filter which packages are allowed to run lifecycle scripts using DSS query syntax.',
+        },
+    },
 });
 export const views = {
     json: i => ({
@@ -38,4 +45,3 @@ export const command = async (conf) => {
     });
     return { buildQueue, graph };
 };
-//# sourceMappingURL=update.js.map

package/dist/{esm/commands → commands}/version.d.ts

@@ -23,4 +23,3 @@ export declare const views: {
     readonly human: (results: CommandResult) => string;
 };
 export declare const command: CommandFn<CommandResult>;
-//# sourceMappingURL=version.d.ts.map

package/dist/{esm/commands → commands}/version.js

@@ -8,6 +8,7 @@ import assert from 'node:assert';
 import { actual } from '@vltpkg/graph';
 import { Query } from '@vltpkg/query';
 import { createHostContextsMap } from "../query-host-contexts.js";
+import { minimatch } from 'minimatch';
 const isValidVersionIncrement = (value) => versionIncrements.includes(value);
 const version = async (conf, increment, cwd, { 
 // Hardcode happy path options for now.
@@ -146,6 +147,23 @@ export const usage = () => {
     The \`<newversion>\` argument should be a valid semver string or a valid increment type (one of patch, minor, major, prepatch, preminor, premajor, prerelease).
 
     If run in a git repository, it will also create a version commit and tag.`,
+        options: {
+            scope: {
+                value: '<query>',
+                description: 'Filter version bump targets using a DSS query.',
+            },
+            workspace: {
+                value: '<path|glob>',
+                description: 'Limit version bump targets to matching workspaces.',
+            },
+            'workspace-group': {
+                value: '<name>',
+                description: 'Limit version bump targets to workspace groups.',
+            },
+            recursive: {
+                description: 'Run version bump across all workspaces in the monorepo.',
+            },
+        },
     });
 };
 export const views = {
@@ -206,6 +224,15 @@ export const command = async (conf) => {
     }
     else if (paths?.length || groups?.length || recursive) {
         for (const workspace of options.monorepo ?? []) {
+            if (paths?.length) {
+                const matches = paths.some((p) => workspace.path === p ||
+                    workspace.name === p ||
+                    workspace.fullpath === p ||
+                    resolve(projectRoot, p) === workspace.fullpath ||
+                    minimatch(workspace.path, p));
+                if (!matches)
+                    continue;
+            }
             locations.push(workspace.fullpath);
         }
     }
@@ -223,4 +250,3 @@ export const command = async (conf) => {
     }
     return results;
 };
-//# sourceMappingURL=version.js.map

package/dist/commands/view.d.ts

@@ -0,0 +1,23 @@
+import type { Manifest, Packument } from '@vltpkg/types';
+import type { PackageReportData } from '@vltpkg/security-archive';
+import type { CommandFn, CommandUsage } from '../index.ts';
+import type { ViewOptions } from '../view.ts';
+export declare const needsRegistry = true;
+export declare const usage: CommandUsage;
+export type ViewResult = {
+    /** The full packument data from the registry */
+    packument: Packument;
+    /** The resolved manifest for the requested version */
+    manifest: Manifest;
+    /** Security report data, if available */
+    security?: PackageReportData;
+    /** The specific field value if a field was requested */
+    fieldValue?: unknown;
+    /** The field path that was requested */
+    fieldPath?: string;
+};
+export declare const views: {
+    readonly human: (result: ViewResult, _options: ViewOptions, _conf: import("../config/index.ts").ParsedConfig) => string;
+    readonly json: (result: ViewResult, _options: ViewOptions, _conf: import("../config/index.ts").ParsedConfig) => unknown;
+};
+export declare const command: CommandFn<ViewResult>;