fyn 3.3.0 → 3.3.1

package/README.md

@@ -22,6 +22,12 @@ cd <your-project>
 fyn
 ```
 
+Once fyn is installed, it can manage its own global install:
+
+```sh
+fyn global add fyn
+```
+
 On an existing install, fyn checks file modification times before reinstalling. This scan
 prunes directories and files matched by repository and nested `.gitignore` rules, alongside
 its built-in exclusions. The rules apply even to tracked source files; manifests, lockfiles,
@@ -51,6 +57,16 @@ fyn outdated lodash --json
 and the registry's `latest` tag. Local, Git, and URL dependencies are not compared. Pass
 `--refresh-meta` to bypass fresh registry metadata caches.
 
+To move locked versions to the newest their declared ranges allow:
+
+```sh
+fyn update
+fyn update lodash
+```
+
+With no names, `update` ignores every lock pin. With names, it updates those packages and their
+dependencies and keeps the rest pinned. It never edits `package.json`.
+
 - It can read and use some settings from your `.npmrc`.
 - It can use `npm-shrinkwrap.json` or `package-lock.json` files.
 

package/dist/fs-worker.mjs

@@ -4770,9 +4770,9 @@ function treeCollector(strip) {
 		fromHeaders: true
 	};
 	const onentry = (entry) => {
-		const parts = entry.path.split(/\/|\\/);
 		const isDir = entry.type === "Directory";
-		const wtree = parts.slice(strip, isDir ? parts.length : parts.length - 1).reduce((wt, dir) => {
+		const parts = entry.path.split(/\/|\\/).slice(strip).filter((p) => p && p !== ".");
+		const wtree = (isDir ? parts : parts.slice(0, -1)).reduce((wt, dir) => {
 			return wt[dir] || (wt[dir] = newDirObj());
 		}, result.tree);
 		if (isDir) return;

package/dist/fyn.mjs

@@ -1238,7 +1238,7 @@ const defaultPathFilter = [new RegExp(`/node_modules.*/(pirates/|isomorphic-load
 function cleanErrorStack(error, { replacePath = `${process.cwd()}/`, ignorePathFilter = [] } = {}) {
 	const stack = error && (error.stack || error.message);
 	if (!stack) return String(stack);
-	return stack.split("\n").map((line) => {
+	return stack.split(/\r?\n/).map((line) => {
 		if (!line.match(/ {4,}at/)) return line;
 		const match = line.match(/( {4,}at )(?:([^(]*\()(.+)(\).*)|(.+))/);
 		const [, at, name = "", location = match === null || match === void 0 ? void 0 : match[5], tail = ""] = match || [];
@@ -1246,7 +1246,10 @@ function cleanErrorStack(error, { replacePath = `${process.cwd()}/`, ignorePathF
 		const path = location.replace(/\\/g, "/");
 		if (defaultPathFilter.concat(ignorePathFilter).find((s) => s && (s instanceof RegExp ? path.match(s) : path.includes(s)))) return false;
 		let path2 = path;
-		if (replacePath && replacePath.length > 1) path2 = path.startsWith(`file://${replacePath}`) ? path.slice(`file://${replacePath}`.length) : path.replace(replacePath, "");
+		if (replacePath && replacePath.length > 1) {
+			const prefix = path.startsWith(`file://${replacePath}`) ? `file://${replacePath}` : replacePath;
+			if (path.startsWith(prefix)) path2 = path.slice(prefix.length);
+		}
 		return `${at}${name}${path2}${tail}`;
 	}).filter((x) => x !== false).join("\n");
 }
@@ -1258,9 +1261,10 @@ function cleanErrorStack(error, { replacePath = `${process.cwd()}/`, ignorePathF
 * @returns aggregate stack
 */
 function aggregateStack(stack, errors) {
-	return [stack].concat(errors && errors.map && errors.map((e) => {
+	const stacks = errors && errors.map ? errors.map((e) => {
 		return (e && (e.stack || e.message) || String(e)).replace(/^/gm, "  ");
-	})).join("\n");
+	}) : [];
+	return [stack].concat(stacks).join("\n");
 }
 /**
 * build the aggregate stack of an AggregateError
@@ -1291,11 +1295,18 @@ var AggregateError$1 = class extends globalThis.AggregateError {
 			},
 			__stack: {
 				enumerable: false,
+				writable: true,
 				value: this.stack
 			},
-			stack: { get() {
-				return aggStack || (aggStack = aggregateErrorStack(this));
-			} }
+			stack: {
+				get() {
+					return aggStack || (aggStack = aggregateErrorStack(this));
+				},
+				set(value) {
+					this.__stack = value;
+					aggStack = "";
+				}
+			}
 		});
 	}
 };
@@ -97525,6 +97536,51 @@ var PkgDepLocker = class {
 			if (sorted) remove$3(sorted, (x) => x === item.resolved);
 		}
 	}
+	/**
+	* Locked versions by package name, newest first, from the serialized lock data
+	*/
+	lockedVersions() {
+		assert(this._isFynFormat, "lock data is no longer in fyn format");
+		const result = {};
+		for (const name in this._lockData) {
+			if (name.startsWith("$")) continue;
+			const versions = Object.keys(this._lockData[name]).filter((v) => !v.startsWith("_"));
+			if (versions.length > 0) result[name] = versions.sort(simpleCompare);
+		}
+		return result;
+	}
+	/**
+	* Drop lock data so the resolver picks the newest versions the ranges allow.
+	* With no names, drop every package. With names, drop those packages and
+	* everything they depend on, directly or not.
+	*
+	* @param names - packages to unlock, or none for all
+	* @returns the unlocked package names
+	*/
+	unlock(names = []) {
+		assert(this._isFynFormat, "lock data is no longer in fyn format");
+		const data = this._lockData;
+		const pending = names.length > 0 ? [...names] : Object.keys(data).filter((n) => !n.startsWith("$"));
+		const unlocked = /* @__PURE__ */ new Set();
+		while (pending.length > 0) {
+			const name = pending.pop();
+			const pkgLocked = data[name];
+			if (unlocked.has(name) || !pkgLocked) continue;
+			unlocked.add(name);
+			if (names.length === 0) continue;
+			for (const version in pkgLocked) {
+				if (version.startsWith("_")) continue;
+				const vpkg = pkgLocked[version];
+				const deps = {
+					...vpkg.dependencies,
+					...vpkg.optionalDependencies
+				};
+				for (const dep in deps) pending.push(parseNpmAlias(deps[dep], dep)?.name || dep);
+			}
+		}
+		for (const name of unlocked) delete data[name];
+		return [...unlocked].sort();
+	}
 	shasum(data) {
 		return Crypto.createHash("sha1").update(data).digest("hex");
 	}
@@ -97709,7 +97765,8 @@ const typeGetters = {
 		return lower === "true" || lower === "yes" || lower === "1" || lower === "on";
 	},
 	truthy: (x) => !!x,
-	json: (x) => JSON.parse(x)
+	json: (x) => JSON.parse(x),
+	array: (x) => JSON.parse(x)
 };
 const getEnvName = (optKey, opt, env) => {
 	if (!Object.prototype.hasOwnProperty.call(opt, "env")) return void 0;
@@ -97732,9 +97789,12 @@ const xenvConfig = (spec, userConfig, options) => {
 	userConfig = userConfig || {};
 	const trace = {};
 	const getType = (opt) => {
-		const tod = Object.prototype.hasOwnProperty.call(opt, "default") && typeof opt.default;
-		const type = opt.type || tod !== "function" && tod || "string";
-		return type === "object" ? "json" : type;
+		if (opt.type) return opt.type === "object" ? "json" : opt.type;
+		if (!Object.prototype.hasOwnProperty.call(opt, "default")) return "string";
+		if (opt.default === null) return "string";
+		if (Array.isArray(opt.default)) return "array";
+		const tod = typeof opt.default;
+		return tod === "object" ? "json" : tod === "function" ? "string" : tod;
 	};
 	const getGetter = (opt) => {
 		const type = getType(opt);
@@ -97768,17 +97828,26 @@ const xenvConfig = (spec, userConfig, options) => {
 		}
 	};
 	const sources = [...options && options.sources || ["env", "option"], "default"];
+	const badSource = sources.find((s) => !Object.prototype.hasOwnProperty.call(getters, s));
+	if (badSource !== void 0) throw new Error(`xenv-config: unknown source "${badSource}"; valid sources are ${Object.keys(getters).join(", ")}`);
 	const config = Object.keys(spec).reduce((cfg, k) => {
+		var _a;
 		const opt = spec[k];
 		const type = getType(opt);
 		let found;
 		if (type !== "json") sources.find((s) => found = getters[s](opt, k));
 		else {
 			const mapped = sources.map((s) => getters[s](opt, k)).filter((x) => Boolean(x));
-			if (mapped.length > 0) found = {
-				trace: { src: mapped.map((x) => x.trace.src).join(",") },
-				value: merge.apply(null, [{}].concat(mapped.map((x) => x.value).reverse()))
-			};
+			if (mapped.length > 0) {
+				const name = (_a = mapped.find((x) => x.trace.name)) === null || _a === void 0 ? void 0 : _a.trace.name;
+				found = {
+					trace: {
+						src: mapped.map((x) => x.trace.src).join(","),
+						...name && { name }
+					},
+					value: merge.apply(null, [{}].concat(mapped.map((x) => x.value).reverse()))
+				};
+			}
 		}
 		if (!found) return cfg;
 		trace[k] = found.trace;
@@ -97874,9 +97943,9 @@ function treeCollector(strip) {
 		fromHeaders: true
 	};
 	const onentry = (entry) => {
-		const parts = entry.path.split(/\/|\\/);
 		const isDir = entry.type === "Directory";
-		const wtree = parts.slice(strip, isDir ? parts.length : parts.length - 1).reduce((wt, dir) => {
+		const parts = entry.path.split(/\/|\\/).slice(strip).filter((p) => p && p !== ".");
+		const wtree = (isDir ? parts : parts.slice(0, -1)).reduce((wt, dir) => {
 			return wt[dir] || (wt[dir] = newDirObj());
 		}, result.tree);
 		if (isDir) return;
@@ -98235,12 +98304,15 @@ var FynCentral = class {
 				await prepare();
 			}
 		};
+		const placing = [];
 		try {
 			const info = await this.getInfo(integrity);
 			const list = flattenTree(info.tree, {
 				dirs: [],
 				files: []
 			}, "");
+			list.dirs = [...new Set(list.dirs)];
+			list.files = [...new Set(list.files)];
 			const srcDir = Path.join(info.contentPath, "package");
 			const cloneDir = this._reflink && this._cloneDirs && await loadReflinkCloneDir();
 			if (cloneDir) {
@@ -98286,10 +98358,14 @@ var FynCentral = class {
 			await map$1(list.files, (file) => {
 				const src = Path.join(info.contentPath, "package", file);
 				const dest = Path.join(destDir, file);
-				if (file === "package.json") return this._reflink && !copy ? cloneFile(src, dest, true) : copyFile(src, dest);
-				return this._hardlink ? this._linkFile(src, dest) : this._cloneOrCopy(src, dest);
+				let placed;
+				if (file === "package.json") placed = this._reflink && !copy ? cloneFile(src, dest, true) : copyFile(src, dest);
+				else placed = this._hardlink ? this._linkFile(src, dest) : this._cloneOrCopy(src, dest);
+				placing.push(placed);
+				return placed;
 			}, { concurrency: 5 });
 		} catch (err) {
+			await Promise.allSettled(placing);
 			const msg = `fyn-central can't replicate package at ${destDir} for integrity ${integrity}`;
 			throw new AggregateError$1([err], msg);
 		}
@@ -105982,7 +106058,8 @@ var PkgOutdatedProvider = class {
 		if (failed) throw failed.reason;
 		return {
 			records: settled.map((result) => result.status === "fulfilled" ? result.value : void 0).filter((record) => Boolean(record)),
-			skipped: skipped.sort()
+			skipped: skipped.sort(),
+			checked: selected.length - skipped.length
 		};
 	}
 };
@@ -106029,6 +106106,7 @@ const showOutdated = async (fyn, options = {}) => {
 	if (output) await new Promise((resolve, reject) => {
 		process.stdout.write(`${output}\n`, (error) => error ? reject(error) : resolve());
 	});
+	else if (!options.json) logger$1.info(result.checked === 1 ? "The only direct dependency is up to date" : result.checked > 1 ? `All ${result.checked} direct dependencies are up to date` : "No registry dependencies to check");
 	if (!options.json && options.packages?.length) for (const name of result.skipped) logger$1.info(`Skipping non-registry dependency ${chalk.cyan(name)}`);
 	return result;
 };
@@ -106608,6 +106686,28 @@ const showAudit = (fyn, opts) => {
 	}).runAudit();
 };
 
+//#endregion
+//#region cli/show-updates.ts
+/**
+* Lines of `name old -> new` for every package whose locked versions changed
+*/
+const formatUpdates = (before, after) => {
+	const names = [.../* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)])].sort();
+	const lines = [];
+	for (const name of names) {
+		const oldVersions = (before[name] || []).join(", ");
+		const newVersions = (after[name] || []).join(", ");
+		if (oldVersions === newVersions) continue;
+		lines.push(`${chalk.cyan(name)} ${chalk.red(oldVersions || "(none)")} -> ${chalk.green(newVersions || "(removed)")}`);
+	}
+	return lines;
+};
+const showUpdates = (before, after) => {
+	const lines = formatUpdates(before, after);
+	if (lines.length === 0) logger$1.info("All locked versions are already the newest their ranges allow");
+	else logger$1.info(`Updated ${lines.length} packages:\n  ${lines.join("\n  ")}`);
+};
+
 //#endregion
 //#region node_modules/.f/_/ini/4.1.1/node_modules/ini/lib/ini.js
 var require_ini = /* @__PURE__ */ __commonJSMin(((exports, module) => {
@@ -108148,6 +108248,8 @@ var FynCli = class {
 		const start = Date.now();
 		const runAudit = argv.opts?.audit !== false;
 		const auditFile = argv.opts?.auditFile;
+		const update = argv.opts?.update;
+		let lockedBefore;
 		const auditAfterInstall = async () => {
 			if (!runAudit) return;
 			try {
@@ -108174,6 +108276,7 @@ var FynCli = class {
 			}
 			installLocked = await this.fyn.createInstallLock();
 			await this.fyn.readLockFiles();
+			if (update) lockedBefore = this.unlockForUpdate(update);
 			await this.fyn._startInstall();
 			const pkg = this.fyn._pkg;
 			if (get$1(pkg, "scripts.preinstall")) {
@@ -108274,6 +108377,7 @@ var FynCli = class {
 			const end = Date.now();
 			await this.fyn.saveFynpoIndirects();
 			logger$1.info(chalk.green("complete in total"), chalk.magenta(`${(end - start) / 1e3}`) + "secs");
+			if (lockedBefore) showUpdates(lockedBefore, this.fyn.depLocker.lockedVersions());
 			await auditAfterInstall();
 		}).catch(async (err) => {
 			if (err.message === "No Change") {
@@ -108298,6 +108402,21 @@ var FynCli = class {
 			fyntil.exit(0);
 		});
 	}
+	/**
+	* Drop lock data for `fyn update` so the resolver picks the newest in-range versions
+	*
+	* @param names - packages to update, or empty for all
+	* @returns the locked versions from before
+	*/
+	unlockForUpdate(names) {
+		const locker = this.fyn.depLocker;
+		const before = locker.lockedVersions();
+		const missing = names.filter((name) => !before[name]);
+		if (missing.length > 0) throw new Error(`not found in lock data: ${missing.join(", ")}`);
+		const unlocked = locker.unlock(names);
+		logger$1.info(`updating ${unlocked.length} locked packages to the newest versions their ranges allow`);
+		return before;
+	}
 	stat(argv) {
 		return showStat(this.fyn, argv.args.packages).finally(() => {
 			return this._opts.saveLogs && this.saveLogs(this._opts.saveLogs);
@@ -118071,6 +118190,30 @@ const commands = {
 			}
 		}
 	},
+	update: {
+		args: "[packages string..]",
+		usage: "$0 $1 [packages..]",
+		desc: "Update locked versions to the newest their package.json ranges allow",
+		exec: async (cmd) => {
+			const meta = cmd.jsonMeta;
+			const config = await pickOptions(cmd);
+			Object.assign(config.opts, {
+				forceInstall: true,
+				refreshMeta: true,
+				npmLock: false
+			});
+			const update = meta.args.packages || [];
+			return new FynCli(config).install({ opts: {
+				audit: meta.opts.audit !== false,
+				update
+			} });
+		},
+		options: { audit: {
+			desc: "run security audit after update (use --no-audit to skip)",
+			args: "<flag boolean>",
+			argDefault: "true"
+		} }
+	},
 	stat: {
 		desc: "Show stats of installed packages",
 		usage: "$0 $1 <package-name>[@semver] [...]",

package/docs/reference.md

@@ -37,6 +37,7 @@ Aliases are in parentheses. Command options are listed with each command. Global
 | `install` (`i`) | Resolve, fetch and install dependencies. Default command. |
 | `add` (`a`) | Add packages to `package.json`, then install. |
 | `remove` (`rm`) | Remove packages from `package.json`, then install. |
+| `update` | Update locked versions to the newest their ranges allow, then install. |
 | `stat` | Show where an installed package comes from and who depends on it. |
 | `outdated` | List direct registry dependencies that have newer versions. |
 | `audit` | Check resolved packages for known vulnerabilities. |
@@ -132,6 +133,25 @@ fyn remove <packages..> [--install] [--audit]
 
 Removes each name from `dependencies`, `devDependencies`, `optionalDependencies`, `peerDependencies`, and from the same sections inside the `fyn` block. Empty sections are deleted. Names not found are logged as `These packages don't exist in your package.json`. If nothing was removed it logs `No package was removed`, skips the install and does not set a failing exit code. No names given: `No packages to remove`, exit 1.
 
+### `update`
+
+```
+fyn update [packages..] [--audit]
+```
+
+| Option | Type | Default | Behavior |
+| --- | --- | --- | --- |
+| `--audit` | boolean | true | Run a summary audit after the update. |
+
+Re-resolves dependencies to the newest versions their declared ranges allow, then installs.
+
+- No names: ignores every pin in `fyn-lock.yaml`, or in `<targetDir>/.f/lock.yaml` when there is no lockfile. `package-lock.json`, `npm-shrinkwrap.json` and `yarn.lock` are also ignored.
+- With names: unlocks those packages and every package they depend on, directly or not. Everything else stays pinned. A shared dependency in that subtree updates for all its dependents.
+- A name that is not in the lock data fails with `not found in lock data: <names>`, exit 1.
+- Always fetches fresh registry metadata and skips the "No Change" shortcut.
+- Never edits `package.json`. Use `add` to move past a declared range.
+- After install it prints `name old -> new` for each package whose locked versions changed, then the audit summary.
+
 ### `stat`
 
 ```
@@ -160,7 +180,7 @@ Rules:
 - `current` is the version in `<targetDir>/<name>/package.json`, or `null` (shown as `MISSING`) when it is not installed.
 - A dependency is reported unless `current === wanted` and (`latest` is missing or `wanted === latest`).
 - Record fields: `name`, `type` (`prod`, `dev`, `optional`, `devOptional`), `requested`, `current`, `wanted`, `latest`, and `resolvedName` for aliases.
-- The table has columns `Package`, `Current`, `Wanted`, `Latest`, `Type`, `Requested`. Empty results print nothing.
+- The table has columns `Package`, `Current`, `Wanted`, `Latest`, `Type`, `Requested`. Empty results log `All N direct dependencies are up to date`, or `No registry dependencies to check` when everything was skipped. `--json` prints `[]`.
 - Errors (bad spec, missing tag target, no matching version, registry failure, unreadable installed `package.json`) are thrown and make the process exit 1.
 
 Exit code: 1 when at least one record is reported, 0 when none. It does not change any file.
@@ -648,6 +668,7 @@ Precedence: an explicit option value (command line, rc, or fynpo `fyn.options.en
 | Uncaught rejection in the bin wrapper | 1 (prints the error). |
 | `install` | 1 on failure. 0 on success or "No Change". |
 | `add`, `remove` | 1 for no package names. Install failures follow `install`. |
+| `update` | 1 for a name that is not locked. Install failures follow `install`. |
 | `outdated` | 1 when anything is outdated. Errors also 1. |
 | `audit` | 0 even with findings. Failures logged only. |
 | `run` | The script's exit code, else 1. Missing script 1 (0 with `--if-present`). |

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fyn",
   "type": "module",
-  "version": "3.3.0",
+  "version": "3.3.1",
   "description": "fyn is a node.js package manager, and supports fynpo -- a zero setup monorepo tool",
   "main": "./bin/index.mjs",
   "homepage": "https://fynjs.pages.dev/",
@@ -85,7 +85,7 @@
     "@fynjs/reflink": "^0.2.0"
   },
   "devDependencies": {
-    "@fynjs/run": "^1.1.10",
+    "@fynjs/run": "^1.1.11",
     "@fynjs/ts-resolve": "^1.0.4",
     "@types/node": "^26.4.1",
     "@vitest/coverage-v8": "^5.0.0",