@vltpkg/cli-sdk 1.3.7 → 1.3.8

package/dist/commands/exec.js

@@ -44,6 +44,11 @@ export const usage = () => commandUsage({
                   If the appropriate excutable cannot be determined, then
                   an error will be raised.
 
+                  If the package is a path to a local directory (eg, \`.\`
+                  or \`../pkg\`, relative to the current directory), its
+                  bins are run in place. Nothing is installed, and its own
+                  \`node_modules\` is used as-is.
+
                   At no point will \`vlt exec\` change the locally installed
                   dependencies. Any installs it performs is done in vlt's XDG
                   data directory.
@@ -58,6 +63,9 @@ export const usage = () => commandUsage({
         'eslint@9.24 src/file.js': {
             description: 'Run the default bin provided by eslint version 9.24',
         },
+        '.': {
+            description: 'Run the default bin of the package in the current directory',
+        },
         'create-react-app --call="echo $PWD"': {
             description: 'Install create-react-app and run an arbitrary command with its bins in PATH',
         },

package/dist/commands/outdated.js

@@ -166,7 +166,9 @@ const explain = (entry) => {
 };
 /**
  * The commands that perform the upgrades, one `vlt install` per set of
- * flags so that the specs can be combined.
+ * flags so that the specs can be combined. Several entries can call
+ * for the same step, such as every workspace that shares a catalog
+ * entry, so each step is listed once.
  */
 const suggestActions = (result) => {
     const lines = [];
@@ -175,26 +177,28 @@ const suggestActions = (result) => {
         lines.push(`Run \`vlt update\` to pick up ${plural(updates, 'in-range update')}.`);
     }
     const installs = new Map();
+    const edits = new Set();
     for (const { action } of result) {
-        if (!action?.startsWith('vlt install '))
+        if (!action)
             continue;
-        const [spec = '', ...flags] = action
-            .slice('vlt install '.length)
-            .split(' ');
-        const key = flags.join(' ');
-        const specs = installs.get(key) ?? [];
-        specs.push(spec);
-        installs.set(key, specs);
+        if (action.startsWith('vlt install ')) {
+            const [spec = '', ...flags] = action
+                .slice('vlt install '.length)
+                .split(' ');
+            const key = flags.join(' ');
+            const specs = installs.get(key) ?? new Set();
+            specs.add(spec);
+            installs.set(key, specs);
+        }
+        else if (!action.startsWith('vlt ')) {
+            edits.add(`${action.charAt(0).toUpperCase()}${action.slice(1)}.`);
+        }
     }
     for (const [flags, specs] of installs) {
         const args = [...specs, ...(flags ? [flags] : [])].join(' ');
         lines.push(`Run \`vlt install ${args}\` to move to latest.`);
     }
-    for (const { action } of result) {
-        if (action && !action.startsWith('vlt ')) {
-            lines.push(`${action.charAt(0).toUpperCase()}${action.slice(1)}.`);
-        }
-    }
+    lines.push(...edits);
     return lines;
 };
 export const views = {
@@ -336,7 +340,10 @@ const actionFor = (edge, entry, { savePrefix }) => {
             return 'vlt update';
         const newRange = `${savePrefix}${latest}`;
         if (edge.spec.type === 'catalog') {
-            return `set the catalog entry for ${edge.name} in vlt.json to ${newRange}`;
+            const catalog = edge.spec.catalog ?
+                `"${edge.spec.catalog}" catalog`
+                : 'catalog';
+            return `set the ${catalog} entry for ${edge.name} in vlt.json to ${newRange}`;
         }
         const workspace = edge.from.mainImporter ?
             ''

package/dist/commands/update.js

@@ -10,8 +10,17 @@ export const usage = () => commandUsage({
     command: 'update',
     usage: '',
     description: `Update dependencies to their latest in-range versions.
-                  Discards the lockfile and resolves dependencies from scratch.`,
+                  Discards the lockfile and resolves dependencies from scratch
+                  (with -w: only matching workspaces' dependencies).`,
     options: {
+        workspace: {
+            value: '<path|glob>',
+            description: 'Limit update to matching workspaces. Others, and deps they share, keep their locked versions.',
+        },
+        'workspace-group': {
+            value: '<name>',
+            description: 'Limit update to workspace groups. Others, and deps they share, keep their locked versions.',
+        },
         'save-config': {
             description: 'Save registry and git host options given on the command line or via env (e.g. `--registries name=url`) to the project vlt.json, or the user vlt.json with --config=user.',
         },

package/dist/commands/view.js

@@ -22,7 +22,11 @@ export const usage = () => commandUsage({
       (e.g., \`dist-tags.latest\`, \`dependencies.lodash\`).
 
       Security data from the vlt security archive is shown when
-      available, including scores and alerts.`,
+      available, including scores and alerts.
+
+      Use \`.\` (or no args) for the package in the current directory
+      (nearest package.json), \`.@<version>\` to pick a version.
+      Private packages show local package.json info.`,
     examples: {
         express: {
             description: 'View info about the latest version of express',
@@ -42,6 +46,12 @@ export const usage = () => commandUsage({
         'express dist-tags.latest': {
             description: 'Show the latest dist-tag value',
         },
+        '.': {
+            description: 'View the package in the current directory',
+        },
+        '. version': {
+            description: 'Show the latest published version of the current package',
+        },
     },
     options: {
         view: {
@@ -114,7 +124,7 @@ const formatHuman = (result) => {
     // Name and version
     const name = manifest.name ?? packument.name;
     const version = manifest.version ?? '';
-    lines.push(`${name}@${version}`);
+    lines.push(version ? `${name}@${version}` : name);
     // Description
     if (manifest.description) {
         lines.push(manifest.description);
@@ -263,15 +273,30 @@ const lookupField = (result, path) => {
     // Default: look up in manifest
     return dotProp.get(result.manifest, path);
 };
-export const command = async (conf) => {
-    const specArg = conf.positionals[0];
-    if (!specArg) {
-        throw error('view requires a package spec argument', {
+const readLocalManifest = (conf) => {
+    const file = conf.options.packageJson.find(process.cwd());
+    if (!file) {
+        throw error('No local package.json found', {
             code: 'EUSAGE',
+            path: process.cwd(),
         });
     }
-    const fieldPath = conf.positionals[1];
-    const spec = Spec.parseArgs(specArg, conf.options);
+    const manifest = conf.options.packageJson.read(file);
+    const { name } = manifest;
+    if (!name) {
+        throw error('No package name found in package.json', {
+            code: 'EUSAGE',
+            found: file,
+        });
+    }
+    return { name, manifest };
+};
+// nothing published: no dist-tags or versions
+const localView = (name, manifest) => ({
+    manifest,
+    packument: { name, 'dist-tags': {}, versions: {} },
+});
+const fetchView = async (spec, conf) => {
     const pic = new PackageInfoClient(conf.options);
     // Fetch the full packument (needs time, maintainers) and resolved manifest
     const [packument, resolvedManifest] = await Promise.all([
@@ -295,11 +320,34 @@ export const command = async (conf) => {
             // Security data is optional, don't fail the command
         }
     }
-    const result = {
-        packument,
-        manifest,
-        security,
-    };
+    return { packument, manifest, security };
+};
+export const command = async (conf) => {
+    // `.` (or no args) is the package in the current directory
+    const specArg = conf.positionals[0] || '.';
+    const fieldPath = conf.positionals[1];
+    let result;
+    if (specArg === '.' || specArg.startsWith('.@')) {
+        const { name, manifest } = readLocalManifest(conf);
+        const rest = specArg.slice(1);
+        if (manifest.private) {
+            // never query the registry for private pkgs
+            if (rest) {
+                throw error('Cannot select a version of a private package', {
+                    code: 'EUSAGE',
+                    found: specArg,
+                });
+            }
+            result = localView(name, manifest);
+        }
+        else {
+            // keep name literal; rest is '' or '@<spec>'
+            result = await fetchView(Spec.parse(name, rest.slice(1), conf.options), conf);
+        }
+    }
+    else {
+        result = await fetchView(Spec.parseArgs(specArg, conf.options), conf);
+    }
     // If a field path is provided, resolve it
     if (fieldPath !== undefined) {
         result.fieldPath = fieldPath;

package/dist/query-auth.d.ts

@@ -2,7 +2,8 @@ import type { GetAuthHeader } from '@vltpkg/query';
 import type { LoadedConfig } from './config/index.ts';
 /**
  * Returns a {@link GetAuthHeader} implementation that looks up
- * authorization tokens from the local keychain / env, used by
+ * authorization tokens from the local keychain / env (incl.
+ * `VLT_TOKEN_<key>` for configured registries), used by
  * network-reliant query selectors, e.g: `:outdated()`.
  */
 export declare const createGetAuthHeader: (conf: LoadedConfig) => GetAuthHeader;

package/dist/query-auth.js

@@ -1,7 +1,11 @@
-import { getTokenByURL } from '@vltpkg/registry-client';
+import { getTokenByURL, registryKeys } from '@vltpkg/registry-client';
 /**
  * Returns a {@link GetAuthHeader} implementation that looks up
- * authorization tokens from the local keychain / env, used by
+ * authorization tokens from the local keychain / env (incl.
+ * `VLT_TOKEN_<key>` for configured registries), used by
  * network-reliant query selectors, e.g: `:outdated()`.
  */
-export const createGetAuthHeader = (conf) => async (url) => getTokenByURL(url, conf.options.identity);
+export const createGetAuthHeader = (conf) => {
+    const keys = registryKeys(conf.options);
+    return async (url) => getTokenByURL(url, conf.options.identity, keys);
+};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/cli-sdk",
   "description": "The source for the vlt CLI",
-  "version": "1.3.7",
+  "version": "1.3.8",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -14,33 +14,33 @@
   },
   "dependencies": {
     "@resvg/resvg-wasm": "^2.6.2",
-    "@vltpkg/config": "1.3.7",
-    "@vltpkg/dep-id": "1.3.7",
-    "@vltpkg/dot-prop": "1.3.7",
-    "@vltpkg/error-cause": "1.3.7",
-    "@vltpkg/git": "1.3.7",
-    "@vltpkg/graph": "1.3.7",
-    "@vltpkg/graph-run": "1.3.7",
-    "@vltpkg/init": "1.3.7",
-    "@vltpkg/output": "1.3.7",
-    "@vltpkg/package-info": "1.3.7",
-    "@vltpkg/package-json": "1.3.7",
-    "@vltpkg/pick-manifest": "1.3.7",
-    "@vltpkg/promise-spawn": "1.3.7",
-    "@vltpkg/query": "1.3.7",
-    "@vltpkg/registry-client": "1.3.7",
-    "@vltpkg/rollback-remove": "1.3.7",
-    "@vltpkg/run": "1.3.7",
-    "@vltpkg/security-archive": "1.3.7",
-    "@vltpkg/semver": "1.3.7",
-    "@vltpkg/spec": "1.3.7",
-    "@vltpkg/tar": "1.3.7",
-    "@vltpkg/types": "1.3.7",
-    "@vltpkg/url-open": "1.3.7",
-    "@vltpkg/vlt-json": "1.3.7",
-    "@vltpkg/vlx": "1.3.7",
-    "@vltpkg/workspaces": "1.3.7",
-    "@vltpkg/xdg": "1.3.7",
+    "@vltpkg/config": "1.3.8",
+    "@vltpkg/dep-id": "1.3.8",
+    "@vltpkg/dot-prop": "1.3.8",
+    "@vltpkg/error-cause": "1.3.8",
+    "@vltpkg/git": "1.3.8",
+    "@vltpkg/graph": "1.3.8",
+    "@vltpkg/graph-run": "1.3.8",
+    "@vltpkg/init": "1.3.8",
+    "@vltpkg/output": "1.3.8",
+    "@vltpkg/package-info": "1.3.8",
+    "@vltpkg/package-json": "1.3.8",
+    "@vltpkg/pick-manifest": "1.3.8",
+    "@vltpkg/promise-spawn": "1.3.8",
+    "@vltpkg/query": "1.3.8",
+    "@vltpkg/registry-client": "1.3.8",
+    "@vltpkg/rollback-remove": "1.3.8",
+    "@vltpkg/run": "1.3.8",
+    "@vltpkg/security-archive": "1.3.8",
+    "@vltpkg/semver": "1.3.8",
+    "@vltpkg/spec": "1.3.8",
+    "@vltpkg/tar": "1.3.8",
+    "@vltpkg/types": "1.3.8",
+    "@vltpkg/url-open": "1.3.8",
+    "@vltpkg/vlt-json": "1.3.8",
+    "@vltpkg/vlx": "1.3.8",
+    "@vltpkg/workspaces": "1.3.8",
+    "@vltpkg/xdg": "1.3.8",
     "ansi-to-pre": "^1.0.6",
     "beautiful-mermaid": "^1.1.3",
     "chalk": "^5.6.2",