@vltpkg/cli-sdk 1.0.0-rc.9 → 1.0.2

package/dist/commands/access.d.ts

@@ -0,0 +1,23 @@
+import type { CommandFn, CommandUsage } from '../index.ts';
+export declare const needsRegistry = true;
+export declare const usage: CommandUsage;
+export type AccessResult = {
+    package: string;
+    access: string;
+} | {
+    packages: Record<string, string>;
+} | {
+    granted: {
+        team: string;
+        permissions: string;
+    };
+} | {
+    revoked: {
+        team: string;
+    };
+};
+export declare const views: {
+    readonly human: (result: AccessResult) => string;
+    readonly json: (r: AccessResult) => AccessResult;
+};
+export declare const command: CommandFn<AccessResult>;

package/dist/commands/access.js

@@ -0,0 +1,251 @@
+import { error } from '@vltpkg/error-cause';
+import { RegistryClient } from '@vltpkg/registry-client';
+import { commandUsage } from "../config/usage.js";
+import { resolveRegistry } from "../require-registry.js";
+export const needsRegistry = true;
+export const usage = () => commandUsage({
+    command: 'access',
+    usage: '<command> [<args>]',
+    description: `Set or get access levels for published packages
+                  and manage team-based package permissions.
+
+                  Target a specific configured registry by alias with
+                  \`vlt registry <alias> access <subcommand>\`.`,
+    subcommands: {
+        'list packages': {
+            usage: '[<scope|user|org>]',
+            description: 'List packages with access info for a scope, user, or org.',
+        },
+        'get status': {
+            usage: '<package>',
+            description: 'Get the access/visibility status of a package.',
+        },
+        'set status': {
+            usage: '<package>',
+            description: `Set the access/visibility of a package. Use --access to specify the level.`,
+        },
+        grant: {
+            usage: '<read-only|read-write> <scope:team> [<package>]',
+            description: 'Grant access to a scope:team for a package.',
+        },
+        revoke: {
+            usage: '<scope:team> [<package>]',
+            description: 'Revoke access from a scope:team for a package.',
+        },
+    },
+    options: {
+        registry: {
+            value: '<url>',
+            description: 'Registry URL to manage access on.',
+        },
+        otp: {
+            description: 'Provide an OTP for access changes.',
+            value: '<otp>',
+        },
+    },
+});
+export const views = {
+    human: (result) => {
+        if ('packages' in result) {
+            const entries = Object.entries(result.packages);
+            if (entries.length === 0)
+                return 'No packages found.';
+            return entries
+                .map(([name, access]) => `${name}: ${access}`)
+                .join('\n');
+        }
+        if ('granted' in result) {
+            return `Granted ${result.granted.permissions} access to ${result.granted.team}.`;
+        }
+        if ('revoked' in result) {
+            return `Revoked access from ${result.revoked.team}.`;
+        }
+        return `${result.package}: ${result.access}`;
+    },
+    json: (r) => r,
+};
+export const command = async (conf) => {
+    const [sub, ...args] = conf.positionals;
+    switch (sub) {
+        case 'list':
+            return listPackages(conf, args);
+        case 'get':
+            return getStatus(conf, args);
+        case 'set':
+            return setStatus(conf, args);
+        case 'grant':
+            return grant(conf, args);
+        case 'revoke':
+            return revoke(conf, args);
+        default: {
+            throw error('Invalid access subcommand', {
+                found: sub,
+                validOptions: ['list', 'get', 'set', 'grant', 'revoke'],
+                code: 'EUSAGE',
+            });
+        }
+    }
+};
+const encodePkgName = (name) => name.startsWith('@') ?
+    `@${encodeURIComponent(name.slice(1))}`
+    : encodeURIComponent(name);
+const listPackages = async (conf, args) => {
+    const [keyword, entity] = args;
+    if (keyword !== 'packages') {
+        throw error('Expected `list packages [<scope|user|org>]`', {
+            found: keyword,
+            code: 'EUSAGE',
+        });
+    }
+    const rc = new RegistryClient(conf.options);
+    const registryUrl = new URL(await resolveRegistry(conf));
+    // Determine who to list for — use entity arg or fall back to scope from package.json
+    const scope = entity ?? getDefaultScope(conf);
+    const url = new URL(`-/org/${encodeURIComponent(scope)}/package`, registryUrl);
+    const response = await rc.request(url, { useCache: false });
+    const data = response.json();
+    return { packages: data };
+};
+const getStatus = async (conf, args) => {
+    const [keyword, pkg] = args;
+    if (keyword !== 'status') {
+        throw error('Expected `get status <package>`', {
+            found: keyword,
+            code: 'EUSAGE',
+        });
+    }
+    if (!pkg) {
+        throw error('Package name is required for `get status`', {
+            code: 'EUSAGE',
+        });
+    }
+    const rc = new RegistryClient(conf.options);
+    const registryUrl = new URL(await resolveRegistry(conf));
+    const url = new URL(`-/package/${encodePkgName(pkg)}/access`, registryUrl);
+    const response = await rc.request(url, { useCache: false });
+    const data = response.json();
+    return { package: pkg, access: data.access };
+};
+const setStatus = async (conf, args) => {
+    // vlt access set status=<public|restricted> <package>
+    const [statusArg, pkg] = args;
+    if (!statusArg?.startsWith('status=')) {
+        throw error('Expected `set status=<public|restricted> <package>`', { found: statusArg, code: 'EUSAGE' });
+    }
+    const accessLevel = statusArg.slice('status='.length);
+    if (accessLevel !== 'public' && accessLevel !== 'restricted') {
+        throw error('Access level must be `public` or `restricted`', {
+            found: accessLevel,
+            validOptions: ['public', 'restricted'],
+            code: 'EUSAGE',
+        });
+    }
+    if (!pkg) {
+        throw error('Package name is required for `set status`', {
+            code: 'EUSAGE',
+        });
+    }
+    const rc = new RegistryClient(conf.options);
+    const registryUrl = new URL(await resolveRegistry(conf));
+    const url = new URL(`-/package/${encodePkgName(pkg)}/access`, registryUrl);
+    await rc.request(url, {
+        method: 'PUT',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ access: accessLevel }),
+        otp: conf.options.otp,
+        useCache: false,
+    });
+    return { package: pkg, access: accessLevel };
+};
+const grant = async (conf, args) => {
+    // vlt access grant <read-only|read-write> <scope:team> [<package>]
+    const [permissions, scopeTeam, pkg] = args;
+    if (permissions !== 'read-only' && permissions !== 'read-write') {
+        throw error('Permissions must be `read-only` or `read-write`', {
+            found: permissions,
+            validOptions: ['read-only', 'read-write'],
+            code: 'EUSAGE',
+        });
+    }
+    if (!scopeTeam?.includes(':')) {
+        throw error('Team must be in the format `<scope>:<team>`', {
+            found: scopeTeam,
+            code: 'EUSAGE',
+        });
+    }
+    const [scope, team] = scopeTeam.split(':');
+    if (!scope || !team) {
+        throw error('Team must be in the format `<scope>:<team>`', {
+            found: scopeTeam,
+            code: 'EUSAGE',
+        });
+    }
+    const pkgName = pkg ?? getDefaultPkgName(conf);
+    const rc = new RegistryClient(conf.options);
+    const registryUrl = new URL(await resolveRegistry(conf));
+    const url = new URL(`-/team/${encodeURIComponent(scope)}/${encodeURIComponent(team)}/package`, registryUrl);
+    await rc.request(url, {
+        method: 'PUT',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+            package: pkgName,
+            permissions,
+        }),
+        otp: conf.options.otp,
+        useCache: false,
+    });
+    return {
+        granted: {
+            team: `${scope}:${team}`,
+            permissions,
+        },
+    };
+};
+const revoke = async (conf, args) => {
+    // vlt access revoke <scope:team> [<package>]
+    const [scopeTeam, pkg] = args;
+    if (!scopeTeam?.includes(':')) {
+        throw error('Team must be in the format `<scope>:<team>`', {
+            found: scopeTeam,
+            code: 'EUSAGE',
+        });
+    }
+    const [scope, team] = scopeTeam.split(':');
+    if (!scope || !team) {
+        throw error('Team must be in the format `<scope>:<team>`', {
+            found: scopeTeam,
+            code: 'EUSAGE',
+        });
+    }
+    const pkgName = pkg ?? getDefaultPkgName(conf);
+    const rc = new RegistryClient(conf.options);
+    const registryUrl = new URL(await resolveRegistry(conf));
+    const url = new URL(`-/team/${encodeURIComponent(scope)}/${encodeURIComponent(team)}/package`, registryUrl);
+    await rc.request(url, {
+        method: 'DELETE',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ package: pkgName }),
+        otp: conf.options.otp,
+        useCache: false,
+    });
+    return {
+        revoked: {
+            team: `${scope}:${team}`,
+        },
+    };
+};
+const getDefaultScope = (conf) => {
+    const name = conf.options.packageJson.maybeRead(conf.projectRoot)?.name;
+    if (name?.startsWith('@')) {
+        const scope = name.split('/')[0];
+        if (scope)
+            return scope;
+    }
+    throw error('Could not determine scope. Provide a scope, user, or org.', { code: 'EUSAGE' });
+};
+const getDefaultPkgName = (conf) => {
+    const name = conf.options.packageJson.maybeRead(conf.projectRoot)?.name;
+    if (name)
+        return name;
+    throw error('Could not determine package name. Provide a package name or run from a package directory.', { code: 'EUSAGE' });
+};

package/dist/{esm/commands → commands}/bugs.d.ts

@@ -15,4 +15,3 @@ export declare const views: {
 };
 export declare const command: CommandFn<CommandResult>;
 export {};
-//# sourceMappingURL=bugs.d.ts.map

package/dist/{esm/commands → commands}/bugs.js

@@ -161,4 +161,3 @@ export const command = async (conf) => {
     await urlOpen(url);
     return { url, name };
 };
-//# sourceMappingURL=bugs.js.map

package/dist/{esm/commands → commands}/build.d.ts

@@ -16,10 +16,10 @@ export declare const views: {
         message: string;
     };
 };
+export declare const needsRegistry = true;
 export declare const usage: CommandUsage;
 /**
  * Build command implementation. Runs any required "postinstall"
  * lifecycle scripts and binary linking.
  */
 export declare const command: CommandFn<BuildResult>;
-//# sourceMappingURL=build.d.ts.map

package/dist/{esm/commands → commands}/build.js

@@ -38,6 +38,7 @@ export const views = {
         };
     },
 };
+export const needsRegistry = true;
 export const usage = () => commandUsage({
     command: 'build',
     usage: ['[query]', '[--target=<query>]'],
@@ -99,4 +100,3 @@ export const command = async (conf) => {
         throw error('Build failed', { cause });
     }
 };
-//# sourceMappingURL=build.js.map

package/dist/{esm/commands → commands}/cache.d.ts

@@ -59,7 +59,7 @@ declare const usageDef: {
         };
     };
 };
+export declare const needsRegistry = true;
 export declare const usage: CommandUsage;
 export declare const command: CommandFn<void | CacheMap>;
 export {};
-//# sourceMappingURL=cache.d.ts.map

package/dist/{esm/commands → commands}/cache.js

@@ -80,6 +80,7 @@ const usageDef = {
         },
     },
 };
+export const needsRegistry = true;
 export const usage = () => commandUsage(usageDef);
 export const command = async (conf) => {
     const [sub, ...args] = conf.positionals;
@@ -254,4 +255,3 @@ const add = async (conf, specs, view) => {
     }
     await Promise.all(promises);
 };
-//# sourceMappingURL=cache.js.map

package/dist/{esm/commands → commands}/ci.d.ts

@@ -2,10 +2,10 @@ import { InstallReporter } from './install/reporter.ts';
 import type { CommandFn, CommandUsage } from '../index.ts';
 import type { InstallResult } from './install.ts';
 export type CIResult = Omit<InstallResult, 'buildQueue'>;
+export declare const needsRegistry = true;
 export declare const usage: CommandUsage;
 export declare const views: {
     readonly json: (i: CIResult) => import("@vltpkg/graph").LockfileData;
     readonly human: typeof InstallReporter;
 };
 export declare const command: CommandFn<CIResult>;
-//# sourceMappingURL=ci.d.ts.map

package/dist/{esm/commands → commands}/ci.js

@@ -1,6 +1,7 @@
 import { install } from '@vltpkg/graph';
 import { commandUsage } from "../config/usage.js";
 import { InstallReporter } from "./install/reporter.js";
+export const needsRegistry = true;
 export const usage = () => commandUsage({
     command: 'ci',
     usage: '',
@@ -11,6 +12,15 @@ export const usage = () => commandUsage({
     examples: {
         '': { description: 'Clean install from lockfile' },
     },
+    options: {
+        'allow-scripts': {
+            value: '<query>',
+            description: 'Filter which packages are allowed to run lifecycle scripts using DSS query syntax.',
+        },
+        'lockfile-only': {
+            description: 'Only update lockfile and package.json files; skip node_modules operations.',
+        },
+    },
 });
 export const views = {
     json: i => i.graph.toJSON(),
@@ -19,8 +29,8 @@ export const views = {
 export const command = async (conf) => {
     const ciOptions = {
         ...conf.options,
-        // allow all scripts by default on ci (unless user specifies a filter)
-        allowScripts: conf.get('allow-scripts') ?? '*',
+        // allow scripts but filter out malware via security archive
+        allowScripts: conf.get('allow-scripts') ?? ':scripts:not(:malware)',
         expectLockfile: true,
         frozenLockfile: true,
         cleanInstall: true,
@@ -29,4 +39,3 @@ export const command = async (conf) => {
     const { graph } = await install(ciOptions);
     return { graph };
 };
-//# sourceMappingURL=ci.js.map

package/dist/{esm/commands → commands}/config.d.ts

@@ -3,4 +3,3 @@ import type { Views } from '../view.ts';
 export declare const views: Views;
 export declare const usage: CommandUsage;
 export declare const command: CommandFn;
-//# sourceMappingURL=config.d.ts.map

package/dist/{esm/commands → commands}/config.js

@@ -18,6 +18,12 @@ export const usage = () => commandUsage({
     command: 'config',
     usage: '[<command>] [<args>]',
     description: 'Get or manipulate vlt configuration values',
+    options: {
+        config: {
+            value: '<all | user | project>',
+            description: 'Specify which configuration to show or operate on.',
+        },
+    },
     subcommands: {
         get: {
             usage: '[<key>] [--config=<all | user | project>]',
@@ -421,4 +427,3 @@ const configLocation = (conf) => {
     const configPath = find(effectiveConfig);
     return configPath;
 };
-//# sourceMappingURL=config.js.map

package/dist/commands/create.d.ts

@@ -0,0 +1,9 @@
+import type { PromptFn } from '@vltpkg/vlx';
+import type { ExecResult } from '../exec-command.ts';
+import type { CommandFn, CommandUsage } from '../index.ts';
+export { views } from '../exec-command.ts';
+export declare const needsRegistry = true;
+export declare const usage: CommandUsage;
+export declare const prettyPath: (path: string) => string;
+export declare const promptFn: PromptFn;
+export declare const command: CommandFn<ExecResult>;

package/dist/commands/create.js

@@ -0,0 +1,103 @@
+import { exec, execFG } from '@vltpkg/run';
+import * as vlx from '@vltpkg/vlx';
+import { homedir } from 'node:os';
+import { createInterface } from 'node:readline/promises';
+import { commandUsage } from "../config/usage.js";
+import { ExecCommand } from "../exec-command.js";
+import { styleTextStdout } from "../output.js";
+export { views } from "../exec-command.js";
+export const needsRegistry = true;
+export const usage = () => commandUsage({
+    command: 'create',
+    usage: '<initializer> [args...]',
+    description: `Initialize a new project from a template package.
+
+                  Works like \`npm create\` and \`bun create\`, automatically
+                  prepending "create-" to the package name and executing it.
+
+                  For example, \`vlt create react-app my-app\` will fetch and
+                  execute the \`create-react-app\` package with the arguments
+                  \`my-app\`.
+
+                  If a satisfying instance of the create package exists in the
+                  local \`node_modules\` folder, then that will be used.
+
+                  At no point will \`vlt create\` change the locally installed
+                  dependencies. Any installs it performs is done in vlt's XDG
+                  data directory.
+    `,
+    examples: {
+        'react-app my-app': {
+            description: 'Create a new React app using create-react-app',
+        },
+        'vite my-project': {
+            description: 'Create a new Vite project using create-vite',
+        },
+        '@scope/template my-app': {
+            description: 'Create a new project using @scope/create-template',
+        },
+    },
+    options: {
+        'allow-scripts': {
+            value: '<query>',
+            description: 'Filter which packages are allowed to run lifecycle scripts using DSS query syntax.',
+        },
+        yes: {
+            description: 'Skip interactive prompts and accept defaults.',
+        },
+    },
+});
+const HOME = homedir();
+export const prettyPath = (path) => path.startsWith(HOME) ? `~${path.substring(HOME.length)}` : path;
+export const promptFn = async (pkgSpec, path, resolution) => {
+    const response = await createInterface(process.stdin, process.stdout).question(`About to install: ${styleTextStdout(['bgWhiteBright', 'black', 'bold'], String(pkgSpec))}
+from: ${styleTextStdout(['bgWhiteBright', 'black', 'bold'], resolution)}
+into: ${styleTextStdout(['bgWhiteBright', 'black', 'bold'], prettyPath(path))}
+Is this ok? (y) `);
+    process.stdin.pause();
+    return response;
+};
+export const command = async (conf) => {
+    const [initializer, ...args] = conf.positionals;
+    if (!initializer) {
+        throw new Error('Missing required argument: <initializer>\n\nUsage: vlt create <initializer> [args...]');
+    }
+    // Transform the initializer to a create-* package name
+    // e.g., "react-app" -> "create-react-app"
+    // or "@scope/template" -> "@scope/create-template"
+    let packageName;
+    if (initializer.startsWith('@')) {
+        // Handle scoped packages: @scope/name -> @scope/create-name
+        const [scope, name] = initializer.split('/');
+        packageName = name ? `${scope}/create-${name}` : `${scope}/create`;
+    }
+    else {
+        // Handle regular packages: name -> create-name
+        packageName = `create-${initializer}`;
+    }
+    /* c8 ignore start */
+    const allowScripts = conf.get('allow-scripts') ?
+        String(conf.get('allow-scripts'))
+        : ':not(*)';
+    /* c8 ignore stop */
+    const yesFlag = conf.get('yes');
+    // Resolve the create-* package using vlx. We pass the package name as
+    // a synthetic positional so vlx treats it as the command to resolve —
+    // NOT the user's args (like "app"). Without this, vlx would mistake
+    // the first user arg as the executable to spawn.
+    const arg0 = await vlx.resolve([packageName], {
+        ...conf.options,
+        query: undefined,
+        allowScripts,
+    }, yesFlag ? async () => 'y' : promptFn);
+    // Set positionals to the resolved executable and the user's args
+    if (arg0) {
+        conf.positionals = [arg0, ...args];
+    }
+    else {
+        throw new Error(`Could not resolve executable for package "${packageName}"`);
+    }
+    // Execute the create package
+    delete conf.options['script-shell'];
+    return await new ExecCommand(conf, exec, execFG).run();
+};

package/dist/commands/deprecate.d.ts

@@ -0,0 +1,14 @@
+import type { CommandFn, CommandUsage } from '../index.ts';
+export declare const needsRegistry = true;
+export declare const usage: CommandUsage;
+export type CommandResult = {
+    name: string;
+    version: string;
+    message: string;
+    versions: string[];
+};
+export declare const views: {
+    readonly human: (result: CommandResult) => string;
+    readonly json: (r: CommandResult) => CommandResult;
+};
+export declare const command: CommandFn<CommandResult>;