@vltpkg/cli-sdk 1.1.0 → 1.1.1

package/dist/commands/setup.d.ts

@@ -10,6 +10,13 @@ export declare const VLT_REGISTRY_BASE = "https://registry.vlt.io";
 export declare const accountRegistries: readonly ["npm", "main"];
 /** Build the per-account registry URL for a given registry name. */
 export declare const accountRegistryURL: (account: string, name: string) => string;
+/**
+ * Path-scoped keychain keys do not match sibling registries
+ * (`…/<account>/main` vs `…/<account>/npm`). One account token covers
+ * both, so when the keychain holds it for only one alias, copy it to
+ * the other.
+ */
+export declare const persistAccountTokens: (account: string, identity: string) => Promise<void>;
 export type SetupResult = {
     /** the account slug the registries were built for */
     account: string;

package/dist/commands/setup.js

@@ -1,5 +1,5 @@
 import { error } from '@vltpkg/error-cause';
-import { RegistryClient } from '@vltpkg/registry-client';
+import { getKC, normalizeRegistryKey, RegistryClient, } from '@vltpkg/registry-client';
 import { defaultRegistries } from '@vltpkg/spec';
 import { asError, isErrorWithCause, isObject } from '@vltpkg/types';
 import { createInterface } from 'node:readline/promises';
@@ -19,6 +19,27 @@ export const VLT_REGISTRY_BASE = 'https://registry.vlt.io';
 export const accountRegistries = ['npm', 'main'];
 /** Build the per-account registry URL for a given registry name. */
 export const accountRegistryURL = (account, name) => `${VLT_REGISTRY_BASE}/${encodeURIComponent(account)}/${name}/`;
+/**
+ * Path-scoped keychain keys do not match sibling registries
+ * (`…/<account>/main` vs `…/<account>/npm`). One account token covers
+ * both, so when the keychain holds it for only one alias, copy it to
+ * the other.
+ */
+export const persistAccountTokens = async (account, identity) => {
+    // keychain only: getToken() also returns env/runtime tokens
+    const kc = getKC(identity);
+    const keys = accountRegistries.map(name => normalizeRegistryKey(accountRegistryURL(account, name)));
+    const tokens = await Promise.all(keys.map(k => kc.get(k)));
+    const token = tokens.find(Boolean);
+    if (!token)
+        return;
+    // fill gaps only: never overwrite an existing (maybe newer) token
+    for (const [i, key] of keys.entries()) {
+        if (!tokens[i])
+            kc.set(key, token);
+    }
+    await kc.save();
+};
 /**
  * The account registries live at `${VLT_REGISTRY_BASE}/<account>/<name>/`, so
  * an account slug that doesn't exist is a 404 from the login endpoint. Say
@@ -61,9 +82,10 @@ export const usage = () => commandUsage({
                   that \`vlt install\` and \`vlx\` work out of the box.
 
                   Sign up or log in at ${VLT_SIGNUP_URL} first. The wizard
-                  authenticates against your account and writes the
-                  \`npm\` and \`main\` registry aliases (and any additional
-                  aliases you add) to your user \`vlt.json\`.`,
+                  authenticates against your account, stores the token
+                  for both the \`npm\` and \`main\` registries, and writes
+                  those aliases (and any additional aliases you add) to
+                  your user \`vlt.json\`.`,
     options: {
         config: {
             value: '<user | project>',
@@ -128,8 +150,8 @@ export const command = async (conf) => {
         if (!yes) {
             const doAuth = await ask('Authenticate with your vlt.io account now? (Y/n) ');
             if (!/^n/i.test(doAuth)) {
-                // one token covers every registry on the account, so the browser
-                // opens once and the token is stored for all of them.
+                // one login covers both account registries; the token is stored
+                // for each of them so path-scoped keychain lookups match.
                 stdout(`Authenticating your account registries (${accountRegistries.join(', ')})...`);
                 try {
                     await rc.login(accountRegistries.map(name => accountRegistryURL(account, name)));
@@ -167,6 +189,10 @@ export const command = async (conf) => {
         }
         // 6. persist the staged registries (merged, not clobbered)
         await conf.addConfigToFile(which, { registries });
+        // 7. fill a missing `npm`/`main` keychain entry from the other.
+        // no-op after login(), which already wrote both. runs after the
+        // config write so a keychain failure can't block it.
+        await persistAccountTokens(account, conf.options.identity);
         // writing the user config from inside a project that configures its own
         // registries has no effect here, so say so rather than looking like it
         // worked.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/cli-sdk",
   "description": "The source for the vlt CLI",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -14,30 +14,30 @@
   },
   "dependencies": {
     "@resvg/resvg-wasm": "^2.6.2",
-    "@vltpkg/config": "1.1.0",
-    "@vltpkg/dep-id": "1.1.0",
-    "@vltpkg/dot-prop": "1.1.0",
-    "@vltpkg/error-cause": "1.1.0",
-    "@vltpkg/git": "1.1.0",
-    "@vltpkg/graph": "1.1.0",
-    "@vltpkg/graph-run": "1.1.0",
-    "@vltpkg/init": "1.1.0",
-    "@vltpkg/output": "1.1.0",
-    "@vltpkg/package-info": "1.1.0",
-    "@vltpkg/package-json": "1.1.0",
-    "@vltpkg/promise-spawn": "1.1.0",
-    "@vltpkg/query": "1.1.0",
-    "@vltpkg/registry-client": "1.1.0",
-    "@vltpkg/rollback-remove": "1.1.0",
-    "@vltpkg/run": "1.1.0",
-    "@vltpkg/security-archive": "1.1.0",
-    "@vltpkg/spec": "1.1.0",
-    "@vltpkg/types": "1.1.0",
-    "@vltpkg/url-open": "1.1.0",
-    "@vltpkg/vlt-json": "1.1.0",
-    "@vltpkg/vlx": "1.1.0",
-    "@vltpkg/workspaces": "1.1.0",
-    "@vltpkg/xdg": "1.1.0",
+    "@vltpkg/config": "1.1.1",
+    "@vltpkg/dep-id": "1.1.1",
+    "@vltpkg/dot-prop": "1.1.1",
+    "@vltpkg/error-cause": "1.1.1",
+    "@vltpkg/git": "1.1.1",
+    "@vltpkg/graph": "1.1.1",
+    "@vltpkg/graph-run": "1.1.1",
+    "@vltpkg/init": "1.1.1",
+    "@vltpkg/output": "1.1.1",
+    "@vltpkg/package-info": "1.1.1",
+    "@vltpkg/package-json": "1.1.1",
+    "@vltpkg/promise-spawn": "1.1.1",
+    "@vltpkg/query": "1.1.1",
+    "@vltpkg/registry-client": "1.1.1",
+    "@vltpkg/rollback-remove": "1.1.1",
+    "@vltpkg/run": "1.1.1",
+    "@vltpkg/security-archive": "1.1.1",
+    "@vltpkg/spec": "1.1.1",
+    "@vltpkg/types": "1.1.1",
+    "@vltpkg/url-open": "1.1.1",
+    "@vltpkg/vlt-json": "1.1.1",
+    "@vltpkg/vlx": "1.1.1",
+    "@vltpkg/workspaces": "1.1.1",
+    "@vltpkg/xdg": "1.1.1",
     "ansi-to-pre": "^1.0.6",
     "beautiful-mermaid": "^1.1.3",
     "chalk": "^5.6.2",