Commands

Every viv subcommand, in the order viv --help lists them, each with its full --help output so the flags on this page never drift from the binary.

viv install

Run this after cloning a project or pulling a composer.lock change: it installs the exact versions the lock file records.

Install packages from composer.lock

Usage: viv install [OPTIONS]

Options:
      --no-dev
          Skip `require-dev` packages

  -v, --verbose
          Raise logging to debug

      --cache-dir <CACHE_DIR>
          Store location (default `$XDG_CACHE_HOME/vivace`, or `~/.cache/vivace`)

      --dry-run
          Print the plan and stop: no network, no filesystem writes

      --link-mode <LINK_MODE>
          How store files reach `vendor/`

          Possible values:
          - hardlink: One inode shared with the store; vendor files stay read-only
          - copy:     Independent copies, for projects that patch `vendor/` or whose vendor dir sits on another filesystem
          - clone:    A reflink (Linux `FICLONE` on btrfs/XFS, macOS `clonefile` on APFS): a copy-on-write clone sharing the store's extents, so it costs about as much to make as a hardlink but, unlike a hardlink, is never made read-only — patching `vendor/` works without `--link-mode copy`'s extra copy. Falls back to hardlink, then copy, the first time a file doesn't support it (probed once per run, same as the hardlink -> copy fallback below)

          [default: hardlink]

      --offline
          Fail fast on any request instead of connecting: install errors, naming every package not already in the store; update solves from cached repository metadata only, erroring on an uncached package. Also set by `COMPOSER_DISABLE_NETWORK` (any value but unset, empty or `0`; Composer's own git-priming `prime` value is not special-cased here, since neither `install` nor `update` touch a git source)

      --adopt
          Reinstall every locked package from the store even if `installed.json` already matches it, e.g. to relink a `vendor/` Composer (or an older viv) wrote as plain copies. Prompts for confirmation when stdin is a terminal (skip with a non-interactive stdin, e.g. `</dev/null`)

  -d, --project-dir <PROJECT_DIR>
          Project directory holding `composer.json`/`composer.lock`

          [default: .]

  -o, --optimize-autoloader
          Also classmap-scan PSR-0/PSR-4 directories (`config.optimize-autoloader`)

  -a, --classmap-authoritative
          Classmap-only autoloading, no PSR-0/PSR-4 fallback at runtime (`config.classmap-authoritative`); implies `-o`

      --apcu-autoloader
          Cache classmap lookups in `APCu` (`config.apcu-autoloader`)

      --apcu-autoloader-prefix <PREFIX>
          Fixed `APCu` cache-key prefix, instead of one generated per run (`config.apcu-autoloader-prefix`); implies `--apcu-autoloader`

      --ignore-platform-reqs
          Skip every platform (`php`/`ext-*`) requirement check, same as Composer's flag of the same name; wins over `--ignore-platform-req` below when both are given (`PlatformRequirementFilterFactory::fromBoolOrList`)

      --ignore-platform-req <REQ>
          Skip one named platform requirement (`*` glob, repeatable)

      --no-scripts
          Skip `pre-install-cmd`/`post-install-cmd`/`post-autoload-dump` and every other root `scripts` listener

      --no-plugins
          Install every package under `vendor/`, as Composer does with the same flag: the native `composer/installers`/`wordpress-core-installer` adapters are disabled, and any other enabled plugin viv would otherwise refuse only warns (`docs/plugin-strategy.md`)

      --no-progress
          Never draw the fetch/link progress line on stderr, even when it's a terminal (Composer has the same flag)

  -n, --no-interaction
          Accepted for compatibility with the CI-script idiom that pairs it with `--prefer-dist`/`--no-progress` (#211): viv never prompts, aside from `--adopt` on a TTY, so this is already true and only logged

      --prefer-dist
          Accepted for compatibility (#211): viv only ever installs dist archives, so this is already true and only logged

      --no-suggest
          Accepted for compatibility (#211): viv prints no suggestions to skip

  -h, --help
          Print help (see a summary with '-h')

viv update

Run this when composer.json has changed and you want viv to resolve fresh versions, write the lock and install them.

Resolve composer.json, write a composer.lock (full or partial update) and install (`--no-install` opts out)

Usage: viv update [OPTIONS] [PACKAGES]...

Arguments:
  [PACKAGES]...  Only these packages (and, with `-w`/`-W`, their dependencies) may change version; everything else stays at its locked version (`Request::UPDATE_*`). Empty means a full update

Options:
  -v, --verbose
          Raise logging to debug
  -w, --with-dependencies
          Also allow each listed package's dependencies to update, except ones also directly required by the root `composer.json` (`UPDATE_LISTED_WITH_TRANSITIVE_DEPS_NO_ROOT_REQUIRE`)
      --cache-dir <CACHE_DIR>
          Store location (default `$XDG_CACHE_HOME/vivace`, or `~/.cache/vivace`)
  -W, --with-all-dependencies
          Like `-w`, but a dependency directly required by the root `composer.json` may update too (`UPDATE_LISTED_WITH_TRANSITIVE_DEPS`)
      --minimal-changes
          Prefer already-locked versions over the newest one an update could otherwise pick, for every package not on this update's own literal package list (`Installer::setMinimalUpdate`, `preferred_versions` below)
      --offline
          Fail fast on any request instead of connecting: install errors, naming every package not already in the store; update solves from cached repository metadata only, erroring on an uncached package. Also set by `COMPOSER_DISABLE_NETWORK` (any value but unset, empty or `0`; Composer's own git-priming `prime` value is not special-cased here, since neither `install` nor `update` touch a git source)
      --lock
          Re-derive `composer.lock` from itself (content-hash, key order, `fixupJsonDataType`) without solving: `composer update --lock`
      --no-dev
          Solve without `require-dev`, but still resolve and record dev packages in the lock (`composer update --no-dev`'s actual behaviour: only `install`'s package selection skips them, not the lock)
      --prefer-lowest
          Prefer the lowest package versions that satisfy every constraint
      --prefer-stable
          Prefer stable releases, even when a less stable one would otherwise win the version pick
      --dry-run
          Solve and print, but don't write `composer.lock`
      --bump-after-update [<BUMP_AFTER_UPDATE>]
          Increases the lower bound of every root requirement whose package this update just installed or upgraded to a caret constraint on the version it locked (`Composer\Command\BumpCommand`), same rule `config.bump-after-update` applies. Bare `--bump-after-update` bumps both `require` and `require-dev`; `=dev` limits it to `require-dev`, `=no-dev` to `require`. Wins over `config.bump-after-update` when passed
  -d, --project-dir <PROJECT_DIR>
          Project directory holding `composer.json` [default: .]
      --no-scripts
          Skip `pre-update-cmd`/`post-update-cmd` and every other root `scripts` listener, including the chained install's own `pre-autoload-dump`/`post-autoload-dump`
      --no-plugins
          Passed straight through to the chained install (`docs/plugin-strategy.md`)
      --no-install
          Skip the install step after writing `composer.lock` (`composer update --no-install`): today's `viv update` behaviour
      --ignore-platform-reqs
          Skip every platform (`php`/`ext-*`) requirement check on the *chained install*'s autoload write, same as `install`'s own flag (`#231`). Unlike Composer, this does not reach the solve: the pool still only offers versions whose `require: php`/`ext-*` the detected (or `config.platform`-overridden) platform satisfies, so an update cannot resolve a package pinned to a PHP version this interpreter lacks (`Installer.php`'s `PlatformRequirementFilter` has no port yet, `docs/resolver-design.md`; tracked separately)
      --ignore-platform-req <REQ>
          Skip one named platform requirement (`*` glob, repeatable) on the chained install's autoload write; the same solve-side gap as `--ignore-platform-reqs` above applies
      --no-blocking
          Allows installing a version a known security advisory covers or a package Packagist marks abandoned, instead of blocking it by default (#175, `audit.block-insecure`/`audit.block-abandoned`). Also settable via `COMPOSER_NO_SECURITY_BLOCKING=1`
      --metadata-ttl <METADATA_TTL>
          Seconds a cached `/p2/` provider file may be served without revalidating it (#191): within the window, a back-to-back `update` makes no metadata requests at all. `0` (the default) always revalidates, matching today's behaviour. Also settable via `VIV_METADATA_TTL` (this flag wins); `--offline` always wins over either
  -h, --help
          Print help

viv update-lock

Use this to re-derive composer.lock from itself, without solving or installing, for example after a manual edit.

`update --lock`'s own first-class subcommand (#86): re-derive `composer.lock` from itself without solving or installing

Usage: viv update-lock [OPTIONS] [PACKAGES]...

Arguments:
  [PACKAGES]...  Only these packages (and, with `-w`/`-W`, their dependencies) may change version; everything else stays at its locked version (`Request::UPDATE_*`). Empty means a full update

Options:
  -v, --verbose
          Raise logging to debug
  -w, --with-dependencies
          Also allow each listed package's dependencies to update, except ones also directly required by the root `composer.json` (`UPDATE_LISTED_WITH_TRANSITIVE_DEPS_NO_ROOT_REQUIRE`)
      --cache-dir <CACHE_DIR>
          Store location (default `$XDG_CACHE_HOME/vivace`, or `~/.cache/vivace`)
  -W, --with-all-dependencies
          Like `-w`, but a dependency directly required by the root `composer.json` may update too (`UPDATE_LISTED_WITH_TRANSITIVE_DEPS`)
      --minimal-changes
          Prefer already-locked versions over the newest one an update could otherwise pick, for every package not on this update's own literal package list (`Installer::setMinimalUpdate`, `preferred_versions` below)
      --offline
          Fail fast on any request instead of connecting: install errors, naming every package not already in the store; update solves from cached repository metadata only, erroring on an uncached package. Also set by `COMPOSER_DISABLE_NETWORK` (any value but unset, empty or `0`; Composer's own git-priming `prime` value is not special-cased here, since neither `install` nor `update` touch a git source)
      --lock
          Re-derive `composer.lock` from itself (content-hash, key order, `fixupJsonDataType`) without solving: `composer update --lock`
      --no-dev
          Solve without `require-dev`, but still resolve and record dev packages in the lock (`composer update --no-dev`'s actual behaviour: only `install`'s package selection skips them, not the lock)
      --prefer-lowest
          Prefer the lowest package versions that satisfy every constraint
      --prefer-stable
          Prefer stable releases, even when a less stable one would otherwise win the version pick
      --dry-run
          Solve and print, but don't write `composer.lock`
      --bump-after-update [<BUMP_AFTER_UPDATE>]
          Increases the lower bound of every root requirement whose package this update just installed or upgraded to a caret constraint on the version it locked (`Composer\Command\BumpCommand`), same rule `config.bump-after-update` applies. Bare `--bump-after-update` bumps both `require` and `require-dev`; `=dev` limits it to `require-dev`, `=no-dev` to `require`. Wins over `config.bump-after-update` when passed
  -d, --project-dir <PROJECT_DIR>
          Project directory holding `composer.json` [default: .]
      --no-scripts
          Skip `pre-update-cmd`/`post-update-cmd` and every other root `scripts` listener, including the chained install's own `pre-autoload-dump`/`post-autoload-dump`
      --no-plugins
          Passed straight through to the chained install (`docs/plugin-strategy.md`)
      --no-install
          Skip the install step after writing `composer.lock` (`composer update --no-install`): today's `viv update` behaviour
      --ignore-platform-reqs
          Skip every platform (`php`/`ext-*`) requirement check on the *chained install*'s autoload write, same as `install`'s own flag (`#231`). Unlike Composer, this does not reach the solve: the pool still only offers versions whose `require: php`/`ext-*` the detected (or `config.platform`-overridden) platform satisfies, so an update cannot resolve a package pinned to a PHP version this interpreter lacks (`Installer.php`'s `PlatformRequirementFilter` has no port yet, `docs/resolver-design.md`; tracked separately)
      --ignore-platform-req <REQ>
          Skip one named platform requirement (`*` glob, repeatable) on the chained install's autoload write; the same solve-side gap as `--ignore-platform-reqs` above applies
      --no-blocking
          Allows installing a version a known security advisory covers or a package Packagist marks abandoned, instead of blocking it by default (#175, `audit.block-insecure`/`audit.block-abandoned`). Also settable via `COMPOSER_NO_SECURITY_BLOCKING=1`
      --metadata-ttl <METADATA_TTL>
          Seconds a cached `/p2/` provider file may be served without revalidating it (#191): within the window, a back-to-back `update` makes no metadata requests at all. `0` (the default) always revalidates, matching today's behaviour. Also settable via `VIV_METADATA_TTL` (this flag wins); `--offline` always wins over either
  -h, --help
          Print help

viv add

Edits composer.json, resolves the new dependency and installs it in one step.

Add a dependency to composer.json, resolve it and install (`--no-install`/`--no-update` opt out)

Usage: viv add [OPTIONS] <PACKAGES>...

Arguments:
  <PACKAGES>...  `vendor/package` or `vendor/package:constraint`; a bare name gets a synthesised constraint (`VersionSelector::findRecommendedRequireVersion`)

Options:
      --dev                          Add to `require-dev` instead of `require`
  -v, --verbose                      Raise logging to debug
      --cache-dir <CACHE_DIR>        Store location (default `$XDG_CACHE_HOME/vivace`, or `~/.cache/vivace`)
      --no-update                    Edit `composer.json` only; don't resolve, touch `composer.lock`, or install (implies `--no-install`, matching `composer require`)
      --offline                      Fail fast on any request instead of connecting: install errors, naming every package not already in the store; update solves from cached repository metadata only, erroring on an uncached package. Also set by `COMPOSER_DISABLE_NETWORK` (any value but unset, empty or `0`; Composer's own git-priming `prime` value is not special-cased here, since neither `install` nor `update` touch a git source)
      --sort-packages                Sort the touched require section alphabetically (platform packages first), even if `config.sort-packages` is not set
      --prefer-lowest                Prefer the lowest package versions that satisfy every constraint
      --prefer-stable                Prefer stable releases for the synthesised constraint and the partial update alike
      --no-normalize                 Deprecated, no-op (#145): `add` always normalizes `composer.json` now, same as `install`/`dump-autoload` since 0.6
  -d, --project-dir <PROJECT_DIR>    Project directory holding `composer.json` [default: .]
      --no-scripts                   Skip `pre-update-cmd`/`post-update-cmd` and every other root `scripts` listener, including the chained install's own `pre-autoload-dump`/`post-autoload-dump`
      --no-plugins                   Passed straight through to the chained install (`docs/plugin-strategy.md`)
      --no-install                   Skip the install step after writing `composer.lock` (`composer require --no-install`): today's `viv add` behaviour
      --ignore-platform-reqs         Skip every platform (`php`/`ext-*`) requirement check on the chained install's autoload write, same as `install`'s own flag (`#231`). The partial update's own solve still only offers versions the detected platform satisfies (`update.rs`'s `UpdateArgs` doc comment on the same pair of flags explains the gap)
      --ignore-platform-req <REQ>    Skip one named platform requirement (`*` glob, repeatable) on the chained install's autoload write; the same solve-side gap applies
      --no-blocking                  Allows installing a version a known security advisory covers or a package Packagist marks abandoned, instead of blocking it by default (#175, `audit.block-insecure`/`audit.block-abandoned`). Also settable via `COMPOSER_NO_SECURITY_BLOCKING=1`
      --metadata-ttl <METADATA_TTL>  Seconds a cached `/p2/` provider file may be served without revalidating it (#191). `0` (the default) always revalidates, matching today's behaviour. Also settable via `VIV_METADATA_TTL` (this flag wins); `--offline` always wins over either
  -h, --help                         Print help

viv rm

Edits composer.json, resolves the rest of the dependency graph and installs it, minus the package you removed.

Remove a dependency from composer.json, resolve the rest and install (`--no-install`/`--no-update` opt out)

Usage: viv rm [OPTIONS] <PACKAGES>...

Arguments:
  <PACKAGES>...  `vendor/package`, one or more

Options:
      --dev                          Remove from `require-dev` instead of `require`
  -v, --verbose                      Raise logging to debug
      --cache-dir <CACHE_DIR>        Store location (default `$XDG_CACHE_HOME/vivace`, or `~/.cache/vivace`)
      --no-update                    Edit `composer.json` only; don't resolve, touch `composer.lock`, or install (implies `--no-install`, matching `composer remove`)
      --no-normalize                 Deprecated, no-op (#145): `rm` always normalizes `composer.json` now, same as `install`/`dump-autoload` since 0.6
      --offline                      Fail fast on any request instead of connecting: install errors, naming every package not already in the store; update solves from cached repository metadata only, erroring on an uncached package. Also set by `COMPOSER_DISABLE_NETWORK` (any value but unset, empty or `0`; Composer's own git-priming `prime` value is not special-cased here, since neither `install` nor `update` touch a git source)
  -d, --project-dir <PROJECT_DIR>    Project directory holding `composer.json` [default: .]
      --no-scripts                   Skip `pre-update-cmd`/`post-update-cmd` and every other root `scripts` listener, including the chained install's own `pre-autoload-dump`/`post-autoload-dump`
      --no-plugins                   Passed straight through to the chained install (`docs/plugin-strategy.md`)
      --no-install                   Skip the install step after writing `composer.lock` (`composer remove --no-install`): today's `viv rm` behaviour
      --ignore-platform-reqs         Skip every platform (`php`/`ext-*`) requirement check on the chained install's autoload write, same as `install`'s own flag (`#231`). The partial update's own solve still only offers versions the detected platform satisfies (`update.rs`'s `UpdateArgs` doc comment on the same pair of flags explains the gap)
      --ignore-platform-req <REQ>    Skip one named platform requirement (`*` glob, repeatable) on the chained install's autoload write; the same solve-side gap applies
      --no-blocking                  Allows installing a version a known security advisory covers or a package Packagist marks abandoned, instead of blocking it by default (#175, `audit.block-insecure`/`audit.block-abandoned`). Also settable via `COMPOSER_NO_SECURITY_BLOCKING=1`
      --metadata-ttl <METADATA_TTL>  Seconds a cached `/p2/` provider file may be served without revalidating it (#191). `0` (the default) always revalidates, matching today's behaviour. Also settable via `VIV_METADATA_TTL` (this flag wins); `--offline` always wins over either
  -h, --help                         Print help

viv dump-autoload

Run this after you've added classes or changed autoload rules, without needing to reinstall any package.

Regenerate the autoload files and `vendor/bin` from an already installed `vendor/`, without fetching or linking

Usage: viv dump-autoload [OPTIONS]

Options:
      --no-dev
          Skip `require-dev` packages
  -v, --verbose
          Raise logging to debug
      --cache-dir <CACHE_DIR>
          Store location (default `$XDG_CACHE_HOME/vivace`, or `~/.cache/vivace`)
  -d, --project-dir <PROJECT_DIR>
          Project directory holding `composer.json`/`composer.lock` [default: .]
  -o, --optimize-autoloader
          Also classmap-scan PSR-0/PSR-4 directories (`config.optimize-autoloader`)
      --offline
          Fail fast on any request instead of connecting: install errors, naming every package not already in the store; update solves from cached repository metadata only, erroring on an uncached package. Also set by `COMPOSER_DISABLE_NETWORK` (any value but unset, empty or `0`; Composer's own git-priming `prime` value is not special-cased here, since neither `install` nor `update` touch a git source)
  -a, --classmap-authoritative
          Classmap-only autoloading, no PSR-0/PSR-4 fallback at runtime (`config.classmap-authoritative`); implies `-o`
      --apcu-autoloader
          Cache classmap lookups in `APCu` (`config.apcu-autoloader`)
      --apcu-autoloader-prefix <PREFIX>
          Fixed `APCu` cache-key prefix, instead of one generated per run (`config.apcu-autoloader-prefix`); implies `--apcu-autoloader`
      --ignore-platform-reqs
          Skip every platform (`php`/`ext-*`) requirement check, same as Composer's flag of the same name; wins over `--ignore-platform-req` below when both are given (`PlatformRequirementFilterFactory::fromBoolOrList`)
      --ignore-platform-req <REQ>
          Skip one named platform requirement (`*` glob, repeatable)
      --no-scripts
          Skip `pre-autoload-dump`/`post-autoload-dump` and every other root `scripts` listener
      --no-plugins
          Regenerate every package's autoload entry at its plain `vendor/` location: the native installer adapters are disabled, same as `install --no-plugins` (`docs/plugin-strategy.md`)
  -n, --no-interaction
          Accepted for compatibility (#211): global to every Composer command, but `dump-autoload` never prompts either way, so this is already true and only logged. `--prefer-dist`/`--no-suggest` aren't accepted here (`install`-only in Composer): `dump-autoload` fetches nothing
  -h, --help
          Print help

viv init

Writes a new project's composer.json and stops, with no interactive prompts.

Write a composer.json for a new project and stop (#143): no interactive question flow, defaults inferred from git and the directory. `--require`/`--require-dev` chain into the same resolve/lock/install `viv add` runs (`--no-install` opts out)

Usage: viv init [OPTIONS]

Options:
      --name <NAME>                `vendor/package`; inferred from git/the OS user and the directory name when not given
  -v, --verbose                    Raise logging to debug
      --cache-dir <CACHE_DIR>      Store location (default `$XDG_CACHE_HOME/vivace`, or `~/.cache/vivace`)
      --description <DESCRIPTION>  Free-text project description; left out of the file entirely when not given
      --offline                    Fail fast on any request instead of connecting: install errors, naming every package not already in the store; update solves from cached repository metadata only, erroring on an uncached package. Also set by `COMPOSER_DISABLE_NETWORK` (any value but unset, empty or `0`; Composer's own git-priming `prime` value is not special-cased here, since neither `install` nor `update` touch a git source)
      --type <PACKAGE_TYPE>        Package type. Defaults to `project`
      --license <LICENSE>          SPDX licence identifier. Defaults to `MIT`
      --autoload <AUTOLOAD>        Directory to autoload under `psr-4`; also forces the entry even when the directory doesn't exist yet (the default only adds one when `src/` is already there)
      --require <REQUIRE>          `vendor/package[:constraint]`, repeatable; a bare name gets a synthesised constraint, same as `viv add`
      --require-dev <REQUIRE_DEV>  `vendor/package[:constraint]` for `require-dev`, repeatable
      --no-install                 Write composer.json (and, with `--require`/`--require-dev`, composer.lock) but don't install
      --force                      Overwrite an existing composer.json
  -d, --project-dir <PROJECT_DIR>  Project directory to write composer.json into [default: .]
  -h, --help                       Print help

viv new

Starts a project from scratch: a bare name creates an empty directory and runs init's defaults inside it, or a vendor/package spec downloads that package's dist as a skeleton, Laravel's new command style.

Start a project in a directory that doesn't exist yet (#139): a bare directory name runs `init`'s own defaults inside it; a `vendor/package[:constraint]` spec downloads that package's dist as a skeleton and installs it there. `create-project` is Composer's own name, kept as an alias along with its `vendor/package dir constraint` three-positional shape (prefer `vendor/package:constraint` instead)

Usage: viv new [OPTIONS] <TARGET> [DIR] [CONSTRAINT]

Arguments:
  <TARGET>      A bare directory name for an empty project, or `vendor/package[:constraint]` for a skeleton (constraint defaults to the newest stable version)
  [DIR]         Directory to create the skeleton in (default: the package's short name); rejected alongside a bare directory `target`
  [CONSTRAINT]  `composer create-project vendor/package dir constraint`'s own third positional, accepted only for that compatibility: prefer `vendor/package:constraint`. An error alongside a colon constraint

Options:
      --no-dev                   Resolve without `require-dev`; `install` (unless `--no-install`) skips dev packages too, matching `viv update`/`viv install`'s own `--no-dev`
  -v, --verbose                  Raise logging to debug
      --cache-dir <CACHE_DIR>    Store location (default `$XDG_CACHE_HOME/vivace`, or `~/.cache/vivace`)
      --no-install               Unpack the skeleton and write composer.lock, but don't install
      --no-scripts               Skip `post-root-package-install`/`post-create-project-cmd` and every other root `scripts` listener the install half would run
      --offline                  Fail fast on any request instead of connecting: install errors, naming every package not already in the store; update solves from cached repository metadata only, erroring on an uncached package. Also set by `COMPOSER_DISABLE_NETWORK` (any value but unset, empty or `0`; Composer's own git-priming `prime` value is not special-cased here, since neither `install` nor `update` touch a git source)
      --repository <REPOSITORY>  Extra `composer`-type repository to resolve the skeleton from (Private Packagist, Satis), same priority as `composer.json`'s own `repositories`
  -h, --help                     Print help

viv show

Lists what's installed, or inspects a single package's detail with --tree.

List installed packages, or inspect one (`--tree`/`-t` for the require tree)

Usage: viv show [OPTIONS] [PACKAGE]

Arguments:
  [PACKAGE]  Package to inspect (an exact name, no wildcard support)

Options:
  -t, --tree                       Render the require tree instead of the package list (`viv tree` sets this unconditionally, ignoring the flag itself)
  -v, --verbose                    Raise logging to debug
      --cache-dir <CACHE_DIR>      Store location (default `$XDG_CACHE_HOME/vivace`, or `~/.cache/vivace`)
      --name-only                  Print names only, one per line
  -D, --direct                     Only packages required directly by the root package
      --offline                    Fail fast on any request instead of connecting: install errors, naming every package not already in the store; update solves from cached repository metadata only, erroring on an uncached package. Also set by `COMPOSER_DISABLE_NETWORK` (any value but unset, empty or `0`; Composer's own git-priming `prime` value is not special-cased here, since neither `install` nor `update` touch a git source)
      --no-dev                     Skip `require-dev` packages
      --locked                     Read `composer.lock` instead of `vendor/composer/installed.json`
      --invert                     With `--tree`/`viv tree`, list which packages require `package` instead of rendering its own require tree (`composer why`/`depends`, #86; `viv why` sets this unconditionally)
      --format <FORMAT>            Output format for the list view [default: text] [possible values: text, json]
  -d, --project-dir <PROJECT_DIR>  Project directory holding `composer.json` [default: .]
  -h, --help                       Print help

viv tree

The shorthand for show --tree, printing the require graph.

`show --tree`'s spelling (#86)

Usage: viv tree [OPTIONS] [PACKAGE]

Arguments:
  [PACKAGE]  Package to inspect (an exact name, no wildcard support)

Options:
  -t, --tree                       Render the require tree instead of the package list (`viv tree` sets this unconditionally, ignoring the flag itself)
  -v, --verbose                    Raise logging to debug
      --cache-dir <CACHE_DIR>      Store location (default `$XDG_CACHE_HOME/vivace`, or `~/.cache/vivace`)
      --name-only                  Print names only, one per line
  -D, --direct                     Only packages required directly by the root package
      --offline                    Fail fast on any request instead of connecting: install errors, naming every package not already in the store; update solves from cached repository metadata only, erroring on an uncached package. Also set by `COMPOSER_DISABLE_NETWORK` (any value but unset, empty or `0`; Composer's own git-priming `prime` value is not special-cased here, since neither `install` nor `update` touch a git source)
      --no-dev                     Skip `require-dev` packages
      --locked                     Read `composer.lock` instead of `vendor/composer/installed.json`
      --invert                     With `--tree`/`viv tree`, list which packages require `package` instead of rendering its own require tree (`composer why`/`depends`, #86; `viv why` sets this unconditionally)
      --format <FORMAT>            Output format for the list view [default: text] [possible values: text, json]
  -d, --project-dir <PROJECT_DIR>  Project directory holding `composer.json` [default: .]
  -h, --help                       Print help

viv why

Finds which installed packages require the package you name.

`composer why`/`depends`'s alias (#86): `tree --invert`, listing which installed packages require `package`

Usage: viv why [OPTIONS] [PACKAGE]

Arguments:
  [PACKAGE]  Package to inspect (an exact name, no wildcard support)

Options:
  -t, --tree                       Render the require tree instead of the package list (`viv tree` sets this unconditionally, ignoring the flag itself)
  -v, --verbose                    Raise logging to debug
      --cache-dir <CACHE_DIR>      Store location (default `$XDG_CACHE_HOME/vivace`, or `~/.cache/vivace`)
      --name-only                  Print names only, one per line
  -D, --direct                     Only packages required directly by the root package
      --offline                    Fail fast on any request instead of connecting: install errors, naming every package not already in the store; update solves from cached repository metadata only, erroring on an uncached package. Also set by `COMPOSER_DISABLE_NETWORK` (any value but unset, empty or `0`; Composer's own git-priming `prime` value is not special-cased here, since neither `install` nor `update` touch a git source)
      --no-dev                     Skip `require-dev` packages
      --locked                     Read `composer.lock` instead of `vendor/composer/installed.json`
      --invert                     With `--tree`/`viv tree`, list which packages require `package` instead of rendering its own require tree (`composer why`/`depends`, #86; `viv why` sets this unconditionally)
      --format <FORMAT>            Output format for the list view [default: text] [possible values: text, json]
  -d, --project-dir <PROJECT_DIR>  Project directory holding `composer.json` [default: .]
  -h, --help                       Print help

viv outdated

Flags installed packages that have a newer version available.

List installed packages with a newer version available (`show --latest --outdated`)

Usage: viv outdated [OPTIONS] [PACKAGE]

Arguments:
  [PACKAGE]  Package to inspect (an exact name, no wildcard support)

Options:
  -D, --direct                     Only packages required directly by the root package
  -v, --verbose                    Raise logging to debug
      --cache-dir <CACHE_DIR>      Store location (default `$XDG_CACHE_HOME/vivace`, or `~/.cache/vivace`)
      --no-dev                     Skip `require-dev` packages
      --locked                     Read `composer.lock` instead of `vendor/composer/installed.json`
      --offline                    Fail fast on any request instead of connecting: install errors, naming every package not already in the store; update solves from cached repository metadata only, erroring on an uncached package. Also set by `COMPOSER_DISABLE_NETWORK` (any value but unset, empty or `0`; Composer's own git-priming `prime` value is not special-cased here, since neither `install` nor `update` touch a git source)
  -M, --major-only                 Only major SemVer-compatible updates
  -m, --minor-only                 Only minor SemVer-compatible updates
  -p, --patch-only                 Only patch SemVer-compatible updates
      --strict                     Exit `1` when an outdated package is found
      --ignore <IGNORE>            Package name globs (`*` wildcard) to leave out of the report
      --format <FORMAT>            Output format [default: text] [possible values: text, json]
  -d, --project-dir <PROJECT_DIR>  Project directory holding `composer.json` [default: .]
  -h, --help                       Print help

viv audit

Run this before a release to check for known security advisories and abandoned packages among your installed or locked dependencies.

Check installed (or locked) packages for security vulnerability advisories and abandoned packages

Usage: viv audit [OPTIONS]

Options:
      --no-dev
          Disables auditing of `require-dev` packages
  -v, --verbose
          Raise logging to debug
      --cache-dir <CACHE_DIR>
          Store location (default `$XDG_CACHE_HOME/vivace`, or `~/.cache/vivace`)
  -f, --format <FORMAT>
          Output format [default: table] [possible values: table, plain, json, summary]
      --locked
          Audit `composer.lock` instead of the installed packages (`vendor/composer/installed.json`)
      --offline
          Fail fast on any request instead of connecting: install errors, naming every package not already in the store; update solves from cached repository metadata only, erroring on an uncached package. Also set by `COMPOSER_DISABLE_NETWORK` (any value but unset, empty or `0`; Composer's own git-priming `prime` value is not special-cased here, since neither `install` nor `update` touch a git source)
      --abandoned <ABANDONED>
          Behaviour on abandoned packages: `ignore`, `report`, or `fail` (Composer default: `fail`, overriding `config.audit.abandoned`)
      --ignore-severity <IGNORE_SEVERITY>
          Ignore advisories at these severity levels (`low`, `medium`, `high`, `critical`)
  -d, --project-dir <PROJECT_DIR>
          Project directory holding `composer.json`/`composer.lock` [default: .]
  -h, --help
          Print help

viv validate

Catches a malformed composer.json, or a lock file that's out of sync with it, before you commit it.

Validate a composer.json (and composer.lock) against Composer's own hand-written rules

Usage: viv validate [OPTIONS] [FILE]

Arguments:
  [FILE]  Path to the `composer.json` file to validate (default: `composer.json` in the current directory). Combining this with `--project-dir` is an error: a `FILE` picks the manifest, `--project-dir` picks the directory `FILE` and `composer.lock` both default from, and giving both leaves it ambiguous which lock the freshness check should read

Options:
  -d, --project-dir <PROJECT_DIR>  Run as though invoked from this directory (#234): `composer.json`, `composer.lock` and (with `--with-dependencies`) `vendor/` all resolve from here instead of the current directory [default: .]
  -v, --verbose                    Raise logging to debug
      --cache-dir <CACHE_DIR>      Store location (default `$XDG_CACHE_HOME/vivace`, or `~/.cache/vivace`)
      --no-check-all               Skip the unbound-version-constraint warning
      --check-lock                 Check the lock file is up to date even when `config.lock` is off (vivace has no `config.lock` support, so this only affects the error/warning split, not whether the check runs)
      --offline                    Fail fast on any request instead of connecting: install errors, naming every package not already in the store; update solves from cached repository metadata only, erroring on an uncached package. Also set by `COMPOSER_DISABLE_NETWORK` (any value but unset, empty or `0`; Composer's own git-priming `prime` value is not special-cased here, since neither `install` nor `update` touch a git source)
      --no-check-lock              Don't check whether the lock file is up to date
      --no-check-publish           Don't check for publish errors (name best-practice violations)
  -A, --with-dependencies          Also validate the `composer.json` of every installed dependency
      --strict                     Exit non-zero for warnings too, not just errors
  -h, --help                       Print help

viv normalize

Tidies composer.json's key order and formatting, the same result add, rm and init already apply automatically when they write.

Normalize composer.json's key order and formatting, a native `composer normalize` (ergebnis/composer-normalize)

Usage: viv normalize [OPTIONS]

Options:
  -d, --project-dir <PROJECT_DIR>  Project directory holding `composer.json` [default: .]
  -v, --verbose                    Raise logging to debug
      --cache-dir <CACHE_DIR>      Store location (default `$XDG_CACHE_HOME/vivace`, or `~/.cache/vivace`)
      --check                      Check whether `composer.json` is normalized without writing; exits 1 and prints a diff if it is not
      --indent-size <INDENT_SIZE>  Spaces per indent level. Defaults to the file's own indent (`detect_indent`), same as Composer's `JsonManipulator` and `ergebnis/composer-normalize`
      --offline                    Fail fast on any request instead of connecting: install errors, naming every package not already in the store; update solves from cached repository metadata only, erroring on an uncached package. Also set by `COMPOSER_DISABLE_NETWORK` (any value but unset, empty or `0`; Composer's own git-priming `prime` value is not special-cased here, since neither `install` nor `update` touch a git source)
  -h, --help                       Print help

viv run

Runs a scripts entry from the root composer.json, the same as composer run-script.

Run a `scripts` entry from the root composer.json

Usage: viv run [OPTIONS] [SCRIPT] [ARGS]...

Arguments:
  [SCRIPT]   Script name from the root `composer.json`'s `scripts` section; omit with `--list`
  [ARGS]...  Arguments appended to the script's own command line

Options:
      --list                       List every script declared in `scripts`
  -v, --verbose                    Raise logging to debug
      --cache-dir <CACHE_DIR>      Store location (default `$XDG_CACHE_HOME/vivace`, or `~/.cache/vivace`)
  -d, --project-dir <PROJECT_DIR>  Project directory holding `composer.json` [default: .]
      --offline                    Fail fast on any request instead of connecting: install errors, naming every package not already in the store; update solves from cached repository metadata only, erroring on an uncached package. Also set by `COMPOSER_DISABLE_NETWORK` (any value but unset, empty or `0`; Composer's own git-priming `prime` value is not special-cased here, since neither `install` nor `update` touch a git source)
  -h, --help                       Print help

viv exec

Runs a vendor/bin binary with vendor/bin prepended to PATH, so you don't need the full path.

Exec a `vendor/bin` binary with `vendor/bin` prepended to `PATH`

Usage: viv exec [OPTIONS] <BIN> [ARGS]...

Arguments:
  <BIN>      `vendor/bin/<name>` to exec
  [ARGS]...  Arguments passed through to the executed bin

Options:
  -d, --project-dir <PROJECT_DIR>  Project directory holding `composer.json` [default: .]
  -v, --verbose                    Raise logging to debug
      --cache-dir <CACHE_DIR>      Store location (default `$XDG_CACHE_HOME/vivace`, or `~/.cache/vivace`)
      --offline                    Fail fast on any request instead of connecting: install errors, naming every package not already in the store; update solves from cached repository metadata only, erroring on an uncached package. Also set by `COMPOSER_DISABLE_NETWORK` (any value but unset, empty or `0`; Composer's own git-priming `prime` value is not special-cased here, since neither `install` nor `update` touch a git source)
  -h, --help                       Print help

viv x

Installs a package into an isolated, cached environment and runs its binary, npx-style, without touching your composer.json or vendor/. Handy for a one-off tool like PHPUnit or PHP CS Fixer.

Install (if needed) and run a package's bin in an isolated, content-hashed env, npx-style (#85)

Usage: viv x [OPTIONS] [PACKAGE] [ARGS]...

Arguments:
  [PACKAGE]  `vendor/package` or `vendor/package:constraint`; omit with `--list` or `--uninstall`
  [ARGS]...  Arguments passed through to the executed bin

Options:
      --bin <BIN>              Which bin to exec, when the package ships more than one
  -v, --verbose                Raise logging to debug
      --cache-dir <CACHE_DIR>  Store location (default `$XDG_CACHE_HOME/vivace`, or `~/.cache/vivace`)
      --refresh                Re-resolve and reinstall even if this constraint is already cached
      --list                   List every package cached by a previous `viv x` run
      --offline                Fail fast on any request instead of connecting: install errors, naming every package not already in the store; update solves from cached repository metadata only, erroring on an uncached package. Also set by `COMPOSER_DISABLE_NETWORK` (any value but unset, empty or `0`; Composer's own git-priming `prime` value is not special-cased here, since neither `install` nor `update` touch a git source)
      --uninstall <UNINSTALL>  Remove a cached tool env (every constraint cached for it)
  -h, --help                   Print help

viv cache

Manages viv's shared store: prune stale entries, check its size, or remove it outright.

Cache maintenance: prune stale entries, or remove the cache outright

Usage: viv cache [OPTIONS] <COMMAND>

Commands:
  prune  Remove stale buckets, orphan temp dirs, orphan `.ok` markers, and any archive no dist pointer references any more
  clean  Remove the whole cache after confirming it looks like a vivace cache (only our own bucket names, or empty); refuses otherwise
  size   Print archive and dist-pointer counts and total size
  help   Print this message or the help of the given subcommand(s)

Options:
  -v, --verbose                Raise logging to debug
      --cache-dir <CACHE_DIR>  Store location (default `$XDG_CACHE_HOME/vivace`, or `~/.cache/vivace`)
      --offline                Fail fast on any request instead of connecting: install errors, naming every package not already in the store; update solves from cached repository metadata only, erroring on an uncached package. Also set by `COMPOSER_DISABLE_NETWORK` (any value but unset, empty or `0`; Composer's own git-priming `prime` value is not special-cased here, since neither `install` nor `update` touch a git source)
  -h, --help                   Print help

viv diagnose

Prints an environment and configuration report to paste into a bug report.

Environment and configuration report to paste into a bug report: cache, auth sources (names only), PHP/git/Composer, platform packages and the plugin decision per lock entry

Usage: viv diagnose [OPTIONS]

Options:
  -d, --project-dir <PROJECT_DIR>  Project directory holding `composer.json`/`composer.lock` [default: .]
  -v, --verbose                    Raise logging to debug
      --cache-dir <CACHE_DIR>      Store location (default `$XDG_CACHE_HOME/vivace`, or `~/.cache/vivace`)
      --offline                    Fail fast on any request instead of connecting: install errors, naming every package not already in the store; update solves from cached repository metadata only, erroring on an uncached package. Also set by `COMPOSER_DISABLE_NETWORK` (any value but unset, empty or `0`; Composer's own git-priming `prime` value is not special-cased here, since neither `install` nor `update` touch a git source)
  -h, --help                       Print help