@vltpkg/cli-sdk 1.2.0 → 1.3.1

package/dist/commands/init.js

@@ -4,7 +4,7 @@ import { minimatch } from 'minimatch';
 import { init } from '@vltpkg/init';
 import { install } from '@vltpkg/graph';
 import { load, save } from '@vltpkg/vlt-json';
-import { assertWSConfig, asWSConfig } from '@vltpkg/workspaces';
+import { assertWSConfig, resolveWSConfig, splitNegatedPatterns, } from '@vltpkg/workspaces';
 import { commandUsage } from "../config/usage.js";
 export const usage = () => commandUsage({
     command: 'init',
@@ -55,8 +55,18 @@ export const command = async (conf) => {
         : ':not(*)';
     /* c8 ignore stop */
     if (conf.values.workspace?.length) {
-        const workspacesConfig = load('workspaces', assertWSConfig);
-        const parsedWSConfig = asWSConfig(workspacesConfig ?? {});
+        // the *effective* config, which may come from the root package.json
+        // rather than vlt.json
+        const { config: parsedWSConfig, source } = resolveWSConfig(conf.options.projectRoot, conf.options.packageJson);
+        // what gets written back to vlt.json. The raw vlt.json value is
+        // reused as-is so its existing shape is preserved. When the
+        // definitions live in package.json instead, seed vlt.json with them
+        // first -- otherwise adding a `workspaces` field here would shadow
+        // every workspace package.json already declares.
+        const workspacesConfig = load('workspaces', assertWSConfig) ??
+            (source === 'package.json' ?
+                Object.values(parsedWSConfig).flat()
+                : undefined);
         const results = [];
         const addToConfig = [];
         // create a new package.json file for every workspace
@@ -69,8 +79,10 @@ export const command = async (conf) => {
             // run the initialization script and collect results
             results.push(await init({ cwd }));
             // Check if this workspace path is covered by existing workspace patterns
-            const isMatched = Object.values(parsedWSConfig).some((patterns) => {
-                return patterns.some(pattern => minimatch(workspace, pattern));
+            const isMatched = Object.values(parsedWSConfig).some((group) => {
+                const { patterns, ignore } = splitNegatedPatterns(group);
+                return (patterns.some(pattern => minimatch(workspace, pattern)) &&
+                    !ignore.some(pattern => minimatch(workspace, pattern)));
             });
             // When a workspace is not matched we track it for insertion later
             if (!isMatched) {

package/dist/commands/publish.js

@@ -4,7 +4,8 @@ import { run } from '@vltpkg/run';
 import { commandUsage } from "../config/usage.js";
 import { packTarball } from "../pack-tarball.js";
 import assert from 'node:assert';
-import { dirname, resolve } from 'node:path';
+import { readFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
 import prettyBytes from 'pretty-bytes';
 import { actual } from '@vltpkg/graph';
 import { Query } from '@vltpkg/query';
@@ -156,6 +157,28 @@ const getPublishConfig = (manifest) => {
     }
     return undefined;
 };
+/** Of several readmes at the package root, npm prefers the markdown one. */
+const README_MARKDOWN_EXTENSION = /\.(?:md|markdown|mdown|mdwn|mkd|mkdn)$/i;
+/**
+ * The readme fields npm's CLI puts in a publish payload, read out of the
+ * files that were just packed. Registries serve this as the package's front
+ * page, so a payload without it leaves the page blank even though the readme
+ * is sitting inside the tarball.
+ *
+ * npm takes the readme at the package root and prefers the markdown one; a
+ * package without a readme gets no fields at all.
+ */
+const readPublishReadme = (packDir, files) => {
+    const readmes = files.filter(file => /^readme(\.[^.]*)?$/i.test(file));
+    const readmeFilename = readmes.find(file => README_MARKDOWN_EXTENSION.test(file)) ??
+        readmes[0];
+    if (!readmeFilename)
+        return undefined;
+    return {
+        readme: readFileSync(join(packDir, readmeFilename), 'utf8'),
+        readmeFilename,
+    };
+};
 const commandSingle = async (location, conf) => {
     const manifestPath = conf.options.packageJson.find(location);
     assert(manifestPath, 'No package.json found');
@@ -196,7 +219,7 @@ const commandSingle = async (location, conf) => {
     const updatedManifest = conf.options.packageJson.read(manifestDir, {
         reload: true,
     });
-    const { name, version, tarballName, tarballData, unpackedSize, files, integrity, shasum, resolvedManifest, } = await packTarball(updatedManifest, manifestDir, conf);
+    const { name, version, tarballName, tarballData, unpackedSize, files, integrity, shasum, resolvedManifest, packDir, } = await packTarball(updatedManifest, manifestDir, conf);
     await run({
         ...runOptions,
         arg0: 'postpack',
@@ -215,6 +238,7 @@ const commandSingle = async (location, conf) => {
         versions: {
             [version]: {
                 ...resolvedManifest,
+                ...readPublishReadme(packDir, files),
                 _id: `${name}@${version}`,
                 _nodeVersion: process.versions.node,
                 dist: {

package/dist/config/definition.d.ts

@@ -406,12 +406,17 @@ export declare const definition: import("jackspeak").Jack<{
     'lockfile-only': {
         description: string;
     };
+    'brotli-tarballs': {
+        description: string;
+        default: true;
+    };
 } & {
     'dry-run': import("jackspeak").ConfigOption<"boolean", false, undefined>;
     force: import("jackspeak").ConfigOption<"boolean", false, undefined>;
     'expect-lockfile': import("jackspeak").ConfigOption<"boolean", false, undefined>;
     'frozen-lockfile': import("jackspeak").ConfigOption<"boolean", false, undefined>;
     'lockfile-only': import("jackspeak").ConfigOption<"boolean", false, undefined>;
+    'brotli-tarballs': import("jackspeak").ConfigOption<"boolean", false, undefined>;
 } & {
     'allow-scripts': {
         hint: string;

package/dist/config/definition.js

@@ -751,6 +751,19 @@ export const definition = j
     'lockfile-only': {
         description: 'Only update the lockfile (vlt-lock.json) and package.json files, skip all node_modules operations including package extraction and filesystem changes.',
     },
+    'brotli-tarballs': {
+        description: `Resolve to the Brotli (\`.tar.br\`) tarball when the
+                    registry advertises one for a version, transferring far
+                    less than the gzip \`.tgz\`.
+
+                    The \`.tar.br\` is its own artifact and hashes
+                    differently, so a version installed this way records that
+                    hash in \`vlt-lock.json\`. An existing lockfile keeps
+                    whichever artifact it already pinned; set
+                    \`--no-brotli-tarballs\` before resolving to pin the
+                    \`.tgz\` instead.`,
+        default: true,
+    },
 })
     .opt({
     'allow-scripts': {

package/dist/index.js

@@ -57,7 +57,7 @@ const run = async () => {
     if (vlt.command !== 'init' &&
         (vlt.get('workspace') || vlt.get('workspace-group')) &&
         ![...(monorepo?.values() ?? [])].length) {
-        stderr(`Error: No matching workspaces found. Make sure the vlt.json config contains the correct workspaces.`);
+        stderr(`Error: No matching workspaces found. Make sure the vlt.json config, or the "workspaces" field of the root package.json, contains the correct workspaces.`);
         if (vlt.get('workspace')) {
             stderr(indent(`Workspace: ${format(vlt.get('workspace'))}`));
         }

package/dist/pack-tarball.d.ts

@@ -12,6 +12,8 @@ export type PackTarballResult = {
     shasum?: string;
     /** The manifest used for packing (may differ from input when publishConfig.directory is set). */
     resolvedManifest: NormalizedManifest;
+    /** The directory that was packed (differs from input when publishConfig.directory is set). */
+    packDir: string;
 };
 /**
  * Build the tar filter function for packing.

package/dist/pack-tarball.js

@@ -282,6 +282,7 @@ export const packTarball = async (manifest, dir, config) => {
             integrity,
             shasum,
             resolvedManifest: processedManifest,
+            packDir,
         };
     }
     finally {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/cli-sdk",
   "description": "The source for the vlt CLI",
-  "version": "1.2.0",
+  "version": "1.3.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -14,31 +14,31 @@
   },
   "dependencies": {
     "@resvg/resvg-wasm": "^2.6.2",
-    "@vltpkg/config": "1.2.0",
-    "@vltpkg/dep-id": "1.2.0",
-    "@vltpkg/dot-prop": "1.2.0",
-    "@vltpkg/error-cause": "1.2.0",
-    "@vltpkg/git": "1.2.0",
-    "@vltpkg/graph": "1.2.0",
-    "@vltpkg/graph-run": "1.2.0",
-    "@vltpkg/init": "1.2.0",
-    "@vltpkg/output": "1.2.0",
-    "@vltpkg/package-info": "1.2.0",
-    "@vltpkg/package-json": "1.2.0",
-    "@vltpkg/promise-spawn": "1.2.0",
-    "@vltpkg/query": "1.2.0",
-    "@vltpkg/registry-client": "1.2.0",
-    "@vltpkg/rollback-remove": "1.2.0",
-    "@vltpkg/run": "1.2.0",
-    "@vltpkg/security-archive": "1.2.0",
-    "@vltpkg/spec": "1.2.0",
-    "@vltpkg/tar": "1.2.0",
-    "@vltpkg/types": "1.2.0",
-    "@vltpkg/url-open": "1.2.0",
-    "@vltpkg/vlt-json": "1.2.0",
-    "@vltpkg/vlx": "1.2.0",
-    "@vltpkg/workspaces": "1.2.0",
-    "@vltpkg/xdg": "1.2.0",
+    "@vltpkg/config": "1.3.1",
+    "@vltpkg/dep-id": "1.3.1",
+    "@vltpkg/dot-prop": "1.3.1",
+    "@vltpkg/error-cause": "1.3.1",
+    "@vltpkg/git": "1.3.1",
+    "@vltpkg/graph": "1.3.1",
+    "@vltpkg/graph-run": "1.3.1",
+    "@vltpkg/init": "1.3.1",
+    "@vltpkg/output": "1.3.1",
+    "@vltpkg/package-info": "1.3.1",
+    "@vltpkg/package-json": "1.3.1",
+    "@vltpkg/promise-spawn": "1.3.1",
+    "@vltpkg/query": "1.3.1",
+    "@vltpkg/registry-client": "1.3.1",
+    "@vltpkg/rollback-remove": "1.3.1",
+    "@vltpkg/run": "1.3.1",
+    "@vltpkg/security-archive": "1.3.1",
+    "@vltpkg/spec": "1.3.1",
+    "@vltpkg/tar": "1.3.1",
+    "@vltpkg/types": "1.3.1",
+    "@vltpkg/url-open": "1.3.1",
+    "@vltpkg/vlt-json": "1.3.1",
+    "@vltpkg/vlx": "1.3.1",
+    "@vltpkg/workspaces": "1.3.1",
+    "@vltpkg/xdg": "1.3.1",
     "ansi-to-pre": "^1.0.6",
     "beautiful-mermaid": "^1.1.3",
     "chalk": "^5.6.2",
@@ -63,7 +63,7 @@
   "devDependencies": {
     "@eslint/js": "^9.39.1",
     "@types/node": "^22.19.2",
-    "@types/react": "^18.3.27",
+    "@types/react": "^19",
     "@types/ssri": "^7.1.5",
     "eslint": "^9.39.1",
     "prettier": "^3.7.4",