@dovocode/workstation 0.1.0 → 0.1.1

package/dist/cli.js

@@ -24,12 +24,12 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+var __toESM = (mod, isNodeMode, target2) => (target2 = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
   // If the importer is in node compatibility mode or this is not an ESM
   // file that has been converted to a CommonJS file using a Babel-
   // compatible transform (i.e. "__esModule" has not been set), then set
   // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target2, "default", { value: mod, enumerable: true }) : target2,
   mod
 ));
 
@@ -2960,8 +2960,8 @@ var require_jiti = __commonJS({
         }
         const He = /^[/\\]{2}/, ze = /^[/\\](?![/\\])|^[/\\]{2}(?!\.)|^[A-Za-z]:[/\\]/, Je = /^[A-Za-z]:$/, Ye = /.(\.[^./]+|\.)$/, pathe_M_eThtNZ_normalize = function(e3) {
           if (0 === e3.length) return ".";
-          const t3 = (e3 = pathe_M_eThtNZ_normalizeWindowsPath(e3)).match(He), i2 = isAbsolute3(e3), n2 = "/" === e3[e3.length - 1];
-          return 0 === (e3 = normalizeString(e3, !i2)).length ? i2 ? "/" : n2 ? "./" : "." : (n2 && (e3 += "/"), Je.test(e3) && (e3 += "/"), t3 ? i2 ? `//${e3}` : `//./${e3}` : i2 && !isAbsolute3(e3) ? `/${e3}` : e3);
+          const t3 = (e3 = pathe_M_eThtNZ_normalizeWindowsPath(e3)).match(He), i2 = isAbsolute4(e3), n2 = "/" === e3[e3.length - 1];
+          return 0 === (e3 = normalizeString(e3, !i2)).length ? i2 ? "/" : n2 ? "./" : "." : (n2 && (e3 += "/"), Je.test(e3) && (e3 += "/"), t3 ? i2 ? `//${e3}` : `//./${e3}` : i2 && !isAbsolute4(e3) ? `/${e3}` : e3);
         }, pathe_M_eThtNZ_join = function(...e3) {
           let t3 = "";
           for (const i2 of e3) if (i2) if (t3.length > 0) {
@@ -2977,9 +2977,9 @@ var require_jiti = __commonJS({
           let t3 = "", i2 = false;
           for (let n2 = (e3 = e3.map((e4) => pathe_M_eThtNZ_normalizeWindowsPath(e4))).length - 1; n2 >= -1 && !i2; n2--) {
             const a2 = n2 >= 0 ? e3[n2] : pathe_M_eThtNZ_cwd();
-            a2 && 0 !== a2.length && (t3 = `${a2}/${t3}`, i2 = isAbsolute3(a2));
+            a2 && 0 !== a2.length && (t3 = `${a2}/${t3}`, i2 = isAbsolute4(a2));
           }
-          return t3 = normalizeString(t3, !i2), i2 && !isAbsolute3(t3) ? `/${t3}` : t3.length > 0 ? t3 : ".";
+          return t3 = normalizeString(t3, !i2), i2 && !isAbsolute4(t3) ? `/${t3}` : t3.length > 0 ? t3 : ".";
         };
         function normalizeString(e3, t3) {
           let i2 = "", n2 = 0, a2 = -1, c2 = 0, l2 = null;
@@ -3010,7 +3010,7 @@ var require_jiti = __commonJS({
           }
           return i2;
         }
-        const isAbsolute3 = function(e3) {
+        const isAbsolute4 = function(e3) {
           return ze.test(e3);
         }, extname = function(e3) {
           if (".." === e3) return "";
@@ -3018,8 +3018,8 @@ var require_jiti = __commonJS({
           return t3 && t3[1] || "";
         }, pathe_M_eThtNZ_dirname = function(e3) {
           const t3 = pathe_M_eThtNZ_normalizeWindowsPath(e3).replace(/\/$/, "").split("/").slice(0, -1);
-          return 1 === t3.length && Je.test(t3[0]) && (t3[0] += "/"), t3.join("/") || (isAbsolute3(e3) ? "/" : ".");
-        }, basename = function(e3, t3) {
+          return 1 === t3.length && Je.test(t3[0]) && (t3[0] += "/"), t3.join("/") || (isAbsolute4(e3) ? "/" : ".");
+        }, basename2 = function(e3, t3) {
           const i2 = pathe_M_eThtNZ_normalizeWindowsPath(e3).split("/");
           let n2 = "";
           for (let e4 = i2.length - 1; e4 >= 0; e4--) {
@@ -3494,7 +3494,7 @@ Default "index" lookups for the main are deprecated for ES modules.`, "Deprecati
           }
           if (/(?:node|data|http|https):/.test(e3)) return e3;
           if (st.has(e3)) return "node:" + e3;
-          if (e3.startsWith("file://") && (e3 = fileURLToPath(e3)), isAbsolute3(e3)) try {
+          if (e3.startsWith("file://") && (e3 = fileURLToPath(e3)), isAbsolute4(e3)) try {
             if ((0, $e.statSync)(e3).isFile()) return pathToFileURL(e3);
           } catch (e4) {
             if ("ENOENT" !== e4?.code) throw e4;
@@ -3732,7 +3732,7 @@ Default "index" lookups for the main are deprecated for ES modules.`, "Deprecati
         }
         function nativeImportOrRequire(e3, t3, i2) {
           return i2 && e3.nativeImport ? e3.nativeImport((function(e4) {
-            return ni && isAbsolute3(e4) ? pathToFileURL(e4) : e4;
+            return ni && isAbsolute4(e4) ? pathToFileURL(e4) : e4;
           })(t3)).then((t4) => jitiInteropDefault(e3, t4)) : jitiInteropDefault(e3, e3.nativeRequire(t3));
         }
         const Ti = "9";
@@ -3740,7 +3740,7 @@ Default "index" lookups for the main are deprecated for ES modules.`, "Deprecati
           if (!e3.opts.fsCache || !t3.filename) return i2();
           const n2 = ` /* v${Ti}-${utils_hash(t3.source, 16)} */
 `;
-          let a2 = `${basename(pathe_M_eThtNZ_dirname(t3.filename))}-${(function(e4) {
+          let a2 = `${basename2(pathe_M_eThtNZ_dirname(t3.filename))}-${(function(e4) {
             const t4 = e4.split(Wt).pop();
             if (!t4) return;
             const i3 = t4.lastIndexOf(".");
@@ -3786,7 +3786,7 @@ Default "index" lookups for the main are deprecated for ES modules.`, "Deprecati
           return i2.startsWith("#!") && (i2 = "// " + i2), i2;
         }
         function eval_evalModule(t3, i2, n2 = {}) {
-          const a2 = n2.id || (n2.filename ? basename(n2.filename) : `_jitiEval.${n2.ext || (n2.async ? "mjs" : "js")}`), c2 = n2.filename || jitiResolve(t3, a2, { async: n2.async }), l2 = n2.ext || extname(c2), y2 = n2.cache || t3.parentCache || {}, E2 = /\.[cm]?tsx?$/.test(l2), w2 = ".mjs" === l2 || ".js" === l2 && "module" === (function(e3) {
+          const a2 = n2.id || (n2.filename ? basename2(n2.filename) : `_jitiEval.${n2.ext || (n2.async ? "mjs" : "js")}`), c2 = n2.filename || jitiResolve(t3, a2, { async: n2.async }), l2 = n2.ext || extname(c2), y2 = n2.cache || t3.parentCache || {}, E2 = /\.[cm]?tsx?$/.test(l2), w2 = ".mjs" === l2 || ".js" === l2 && "module" === (function(e3) {
             for (; e3 && "." !== e3 && "/" !== e3; ) {
               e3 = pathe_M_eThtNZ_join(e3, "..");
               try {
@@ -3834,7 +3834,7 @@ Default "index" lookups for the main are deprecated for ES modules.`, "Deprecati
                     (0, $e.mkdirSync)(n4, { recursive: true });
                   } catch {
                   }
-                  const a4 = pathe_M_eThtNZ_join(n4, `${basename(i6, extname(i6))}-${Date.now()}-${Math.random().toString(36).slice(2)}.mjs`);
+                  const a4 = pathe_M_eThtNZ_join(n4, `${basename2(i6, extname(i6))}-${Date.now()}-${Math.random().toString(36).slice(2)}.mjs`);
                   return (0, $e.writeFileSync)(a4, t5), a4;
                 })(l3, n3), debug(t4, "[esm]", "[tempfile]", c4), a3(pathToFileURL(c4))), E3 = y3 ? a3(y3).catch((e3) => {
                   if ("ENAMETOOLONG" !== e3?.code) throw e3;
@@ -4210,7 +4210,7 @@ Did you specify these with the most recent transformation maps first?`);
             for (let e5 = 1; e5 < s; e5++) a += "/" + n[e5];
             (!a || o && !a.endsWith("/..")) && (a += "/"), e4.path = a;
           }
-          function resolve10(e4, t3) {
+          function resolve12(e4, t3) {
             if (!e4 && !t3) return "";
             const r3 = parseUrl(e4);
             let n = r3.type;
@@ -4247,7 +4247,7 @@ Did you specify these with the most recent transformation maps first?`);
                 return r3.scheme + "//" + r3.user + r3.host + r3.port + r3.path + s;
             }
           }
-          return resolve10;
+          return resolve12;
         })();
       }, "./node_modules/.pnpm/@jridgewell+sourcemap-codec@1.5.5/node_modules/@jridgewell/sourcemap-codec/dist/sourcemap-codec.umd.js"(e2, t2, r2) {
         var n;
@@ -7368,7 +7368,7 @@ ${yield* s.optionsAndDescriptors(e3.content)}`;
             return e3;
           }, e3;
         }
-        Object.defineProperty(t2, "__esModule", { value: true }), t2.access = access2, t2.assertArray = assertArray, t2.assertAssumptions = function(e3, t3) {
+        Object.defineProperty(t2, "__esModule", { value: true }), t2.access = access3, t2.assertArray = assertArray, t2.assertAssumptions = function(e3, t3) {
           if (void 0 === t3) return;
           if ("object" != typeof t3 || null === t3) throw new Error(`${msg(e3)} must be an object or undefined.`);
           let r3 = e3;
@@ -7377,7 +7377,7 @@ ${yield* s.optionsAndDescriptors(e3.content)}`;
           } while ("root" !== r3.type);
           const s = "preset" === r3.source;
           for (const r4 of Object.keys(t3)) {
-            const i = access2(e3, r4);
+            const i = access3(e3, r4);
             if (!n.assumptionsNames.has(r4)) throw new Error(`${msg(i)} is not a supported assumption.`);
             if ("boolean" != typeof t3[r4]) throw new Error(`${msg(i)} must be a boolean.`);
             if (s && false === t3[r4]) throw new Error(`${msg(i)} cannot be set to 'false' inside presets.`);
@@ -7386,7 +7386,7 @@ ${yield* s.optionsAndDescriptors(e3.content)}`;
         }, t2.assertBabelrcSearch = function(e3, t3) {
           if (void 0 === t3 || "boolean" == typeof t3) return t3;
           if (Array.isArray(t3)) t3.forEach((t4, r3) => {
-            if (!checkValidTest(t4)) throw new Error(`${msg(access2(e3, r3))} must be a string/Function/RegExp.`);
+            if (!checkValidTest(t4)) throw new Error(`${msg(access3(e3, r3))} must be a string/Function/RegExp.`);
           });
           else if (!checkValidTest(t3)) throw new Error(`${msg(e3)} must be a undefined, a boolean, a string/Function/RegExp or an array of those, got ${JSON.stringify(t3)}`);
           return t3;
@@ -7395,7 +7395,7 @@ ${yield* s.optionsAndDescriptors(e3.content)}`;
           if (r3) {
             if ("string" != typeof r3.name) throw new Error(`${msg(e3)} set but does not contain "name" property string`);
             for (const t4 of Object.keys(r3)) {
-              const n2 = access2(e3, t4), s = r3[t4];
+              const n2 = access3(e3, t4), s = r3[t4];
               if (null != s && "boolean" != typeof s && "string" != typeof s && "number" != typeof s) throw new Error(`${msg(n2)} must be null, undefined, a boolean, a string, or a number.`);
             }
           }
@@ -7406,7 +7406,7 @@ ${yield* s.optionsAndDescriptors(e3.content)}`;
         }, t2.assertConfigApplicableTest = function(e3, t3) {
           if (void 0 === t3) return t3;
           if (Array.isArray(t3)) t3.forEach((t4, r3) => {
-            if (!checkValidTest(t4)) throw new Error(`${msg(access2(e3, r3))} must be a string/Function/RegExp.`);
+            if (!checkValidTest(t4)) throw new Error(`${msg(access3(e3, r3))} must be a string/Function/RegExp.`);
           });
           else if (!checkValidTest(t3)) throw new Error(`${msg(e3)} must be a string/Function/RegExp, or an array of those`);
           return t3;
@@ -7421,7 +7421,7 @@ ${yield* s.optionsAndDescriptors(e3.content)}`;
           return null == r3 || r3.forEach((t4, r4) => (function(e4, t5) {
             if ("string" != typeof t5 && "function" != typeof t5 && !(t5 instanceof RegExp)) throw new Error(`${msg(e4)} must be an array of string/Function/RegExp values, or undefined`);
             return t5;
-          })(access2(e3, r4), t4)), r3;
+          })(access3(e3, r4), t4)), r3;
         }, t2.assertInputSourceMap = function(e3, t3) {
           if (void 0 !== t3 && "boolean" != typeof t3 && ("object" != typeof t3 || !t3)) throw new Error(`${msg(e3)} must be a boolean, object, or undefined`);
           return t3;
@@ -7431,17 +7431,17 @@ ${yield* s.optionsAndDescriptors(e3.content)}`;
             if (Array.isArray(t5)) {
               if (0 === t5.length) throw new Error(`${msg(e4)} must include an object`);
               if (t5.length > 3) throw new Error(`${msg(e4)} may only be a two-tuple or three-tuple`);
-              if (assertPluginTarget(access2(e4, 0), t5[0]), t5.length > 1) {
+              if (assertPluginTarget(access3(e4, 0), t5[0]), t5.length > 1) {
                 const r5 = t5[1];
-                if (void 0 !== r5 && false !== r5 && ("object" != typeof r5 || Array.isArray(r5) || null === r5)) throw new Error(`${msg(access2(e4, 1))} must be an object, false, or undefined`);
+                if (void 0 !== r5 && false !== r5 && ("object" != typeof r5 || Array.isArray(r5) || null === r5)) throw new Error(`${msg(access3(e4, 1))} must be an object, false, or undefined`);
               }
               if (3 === t5.length) {
                 const r5 = t5[2];
-                if (void 0 !== r5 && "string" != typeof r5) throw new Error(`${msg(access2(e4, 2))} must be a string, or undefined`);
+                if (void 0 !== r5 && "string" != typeof r5) throw new Error(`${msg(access3(e4, 2))} must be a string, or undefined`);
               }
             } else assertPluginTarget(e4, t5);
             return t5;
-          })(access2(e3, r4), t4));
+          })(access3(e3, r4), t4));
           return r3;
         }, t2.assertRootMode = function(e3, t3) {
           if (void 0 !== t3 && "root" !== t3 && "upward" !== t3 && "upward-optional" !== t3) throw new Error(`${msg(e3)} must be a "root", "upward", "upward-optional" or undefined`);
@@ -7458,10 +7458,10 @@ ${yield* s.optionsAndDescriptors(e3.content)}`;
         }, t2.assertTargets = function(e3, t3) {
           if ((0, _helperCompilationTargets().isBrowsersQueryValid)(t3)) return t3;
           if ("object" != typeof t3 || !t3 || Array.isArray(t3)) throw new Error(`${msg(e3)} must be a string, an array of strings or an object`);
-          const r3 = access2(e3, "browsers"), n2 = access2(e3, "esmodules");
+          const r3 = access3(e3, "browsers"), n2 = access3(e3, "esmodules");
           assertBrowsersList(r3, t3.browsers), assertBoolean(n2, t3.esmodules);
           for (const r4 of Object.keys(t3)) {
-            const n3 = t3[r4], s = access2(e3, r4);
+            const n3 = t3[r4], s = access3(e3, r4);
             if ("esmodules" === r4) assertBoolean(s, n3);
             else if ("browsers" === r4) assertBrowsersList(s, n3);
             else {
@@ -7491,7 +7491,7 @@ ${yield* s.optionsAndDescriptors(e3.content)}`;
               throw new Error(`Assertion failure: Unknown type ${e3.type}`);
           }
         }
-        function access2(e3, t3) {
+        function access3(e3, t3) {
           return { type: "access", name: t3, parent: e3 };
         }
         function assertBoolean(e3, t3) {
@@ -39080,12 +39080,12 @@ var require_parser = __commonJS({
       }
       return prev.splice(i, prev.length);
     }
-    function arrayPushArray(target, source) {
+    function arrayPushArray(target2, source) {
       if (source.length < 1e5)
-        Array.prototype.push.apply(target, source);
+        Array.prototype.push.apply(target2, source);
       else
         for (let i = 0; i < source.length; ++i)
-          target.push(source[i]);
+          target2.push(source[i]);
     }
     function fixFlowSeqItems(fc) {
       if (fc.start.type === "flow-seq-start") {
@@ -40034,14 +40034,15 @@ var require_dist = __commonJS({
 
 // src/config/load.ts
 import { hostname as readHostname, homedir, platform as readPlatform } from "os";
-import { dirname, isAbsolute as isAbsolute2, resolve as resolve3 } from "path";
-import { access } from "fs/promises";
+import { dirname, isAbsolute as isAbsolute2, resolve as resolve4 } from "path";
+import { access as access2 } from "fs/promises";
 
 // src/config/identity.ts
 import { createHash } from "crypto";
 function resourceId(resource) {
   switch (resource.kind) {
     case "package":
+      if (resource.manager === "flatpak") return `package:flatpak:${resource.flatpak?.scope ?? "user"}:${resource.name}:${resource.flatpak?.branch ?? "stable"}`;
       return `package:${resource.manager}:${resource.name}`;
     case "symlink":
       return `file:${resource.target}`;
@@ -40096,6 +40097,20 @@ async function addPathToHash(hash, path, relativePath) {
   }
 }
 
+// src/config/package-options.ts
+function isFlatpakOptions(value2) {
+  if (typeof value2 !== "object" || value2 === null || Array.isArray(value2)) return false;
+  const options = value2;
+  return Object.keys(options).every((key) => ["scope", "remote", "branch"].includes(key)) && (options.scope === void 0 || options.scope === "user" || options.scope === "system") && [options.remote, options.branch].every((field) => field === void 0 || typeof field === "string" && /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(field));
+}
+function isPackageName(manager, name) {
+  if (typeof name !== "string" || name.length === 0) return false;
+  if (manager === "mas") return /^[1-9]\d*$/.test(name);
+  if (manager === "flatpak") return /^[A-Za-z_][A-Za-z0-9_-]*(?:\.[A-Za-z_][A-Za-z0-9_-]*){2,}$/.test(name);
+  if (manager === "pacman") return /^[A-Za-z0-9@_+][A-Za-z0-9@._+-]*$/.test(name);
+  return true;
+}
+
 // src/config/validation.ts
 function validateResource(value2) {
   if (typeof value2 !== "object" || value2 === null || Array.isArray(value2)) {
@@ -40104,7 +40119,7 @@ function validateResource(value2) {
   const candidate = value2;
   switch (candidate.kind) {
     case "package":
-      if (!["mise", "brew", "brew-cask", "apt", "system"].includes(String(candidate.manager)) || typeof candidate.name !== "string" || candidate.name.length === 0 || candidate.version !== void 0 && typeof candidate.version !== "string" || !isBrewCaskUpgradeOptions(candidate.upgrade)) {
+      if (!["mise", "brew", "brew-cask", "apt", "dnf", "yum", "pacman", "flatpak", "mas", "system"].includes(String(candidate.manager)) || !isPackageName(candidate.manager, candidate.name) || candidate.flatpak !== void 0 && (!["flatpak", "system"].includes(String(candidate.manager)) || !isFlatpakOptions(candidate.flatpak)) || candidate.version !== void 0 && typeof candidate.version !== "string" || !isBrewCaskUpgradeOptions(candidate.upgrade)) {
         throw new Error("Invalid package resource");
       }
       return;
@@ -40191,11 +40206,11 @@ function resolveTasks(definition, context) {
     const cwd = value2.cwd?.replace(/^~(?=\/|$)/, context.home) ?? context.configDir;
     tasks[name] = { ...value2, cwd: isAbsolute(cwd) ? cwd : resolve2(context.configDir, cwd) };
   }
-  for (const [name, target] of Object.entries(definition.aliases ?? {})) {
+  for (const [name, target2] of Object.entries(definition.aliases ?? {})) {
     validateName(name);
     if (Object.hasOwn(tasks, name)) throw new Error(`Task and alias share a name: ${name}`);
-    if (typeof target !== "string") throw new Error(`Invalid alias target: ${name}`);
-    aliases[name] = target;
+    if (typeof target2 !== "string") throw new Error(`Invalid alias target: ${name}`);
+    aliases[name] = target2;
   }
   for (const name of Object.keys(aliases)) resolveTaskName(name, tasks, aliases);
   return { tasks, aliases };
@@ -40206,9 +40221,9 @@ function resolveTaskName(name, tasks, aliases) {
   while (Object.hasOwn(aliases, current)) {
     if (visited.has(current)) throw new Error(`Task alias cycle: ${[...visited, current].join(" -> ")}`);
     visited.add(current);
-    const target = aliases[current];
-    if (target === void 0) throw new Error(`Invalid alias: ${current}`);
-    current = target;
+    const target2 = aliases[current];
+    if (target2 === void 0) throw new Error(`Invalid alias: ${current}`);
+    current = target2;
   }
   if (!Object.hasOwn(tasks, current)) throw new Error(`Unknown task: ${current}`);
   return current;
@@ -40217,13 +40232,32 @@ function validateName(name) {
   if (!/^[a-zA-Z0-9][a-zA-Z0-9:_-]*$/.test(name) || name === "help" || name === "init") throw new Error(`Invalid or reserved task name: ${name}`);
 }
 
+// src/config/system-manager.ts
+import { access, stat } from "fs/promises";
+import { constants } from "fs";
+import { delimiter, resolve as resolve3 } from "path";
+async function detectLinuxManager(searchPath = process.env.PATH ?? "") {
+  for (const [manager, command] of [["apt", "apt-get"], ["dnf", "dnf"], ["yum", "yum"], ["pacman", "pacman"]]) {
+    for (const directory of searchPath.split(delimiter).filter(Boolean)) {
+      const path = resolve3(directory, command);
+      try {
+        await access(path, constants.X_OK);
+        if ((await stat(path)).isFile()) return manager;
+      } catch (error) {
+        if (!(error instanceof Error && "code" in error && ["ENOENT", "ENOTDIR", "EACCES"].includes(String(error.code)))) throw error;
+      }
+    }
+  }
+  throw new Error("No supported Linux package manager found on PATH (apt-get, dnf, yum, pacman). Install one or set managers.linux explicitly.");
+}
+
 // src/config/load.ts
 var DEFAULT_CONFIG_FILE = "workstation.config.ts";
 async function findConfig(explicit) {
-  if (explicit) return resolve3(explicit);
-  const path = resolve3(DEFAULT_CONFIG_FILE);
+  if (explicit) return resolve4(explicit);
+  const path = resolve4(DEFAULT_CONFIG_FILE);
   try {
-    await access(path);
+    await access2(path);
     return path;
   } catch {
     throw new Error(`No configuration found (${DEFAULT_CONFIG_FILE})`);
@@ -40269,7 +40303,11 @@ async function loadConfig(configPath, machineOverride) {
 }
 async function resolveResource(resource, definition, context) {
   if (resource.kind === "package") {
-    const manager = resolveManager(resource.manager, definition, context);
+    const manager = await resolveManager(resource.manager, definition, context);
+    if (!isPackageName(manager, resource.name)) throw new Error(`Invalid ${manager} package ID: ${resource.name}`);
+    if ((manager === "pacman" || manager === "flatpak") && context.platform !== "linux") throw new Error(`${manager} requires Linux`);
+    if (manager === "mas" && context.platform !== "darwin") throw new Error("mas requires macOS");
+    if (resource.flatpak !== void 0 && manager !== "flatpak") throw new Error(`Flatpak options require the flatpak backend (${resource.name})`);
     if (resource.upgrade !== void 0 && manager !== "brew-cask") {
       throw new Error(`Upgrade options are only supported for Homebrew casks (${resource.name})`);
     }
@@ -40279,7 +40317,11 @@ async function resolveResource(resource, definition, context) {
     if (resource.version !== void 0) {
       throw new Error(`${manager} package ${resource.name} cannot declare a version`);
     }
-    return { ...resource, manager };
+    return { ...resource, manager, ...manager === "flatpak" ? { flatpak: {
+      scope: resource.flatpak?.scope ?? "user",
+      remote: resource.flatpak?.remote ?? "flathub",
+      branch: resource.flatpak?.branch ?? "stable"
+    } } : {} };
   }
   if (resource.kind === "symlink") {
     return {
@@ -40303,11 +40345,11 @@ async function resolveResource(resource, definition, context) {
   }
   if (resource.kind === "custom-tool") {
     const source = expandPath(resource.source, context, true);
-    const target = expandPath(resource.target, context, false);
+    const target2 = expandPath(resource.target, context, false);
     return {
       ...resource,
       source,
-      target,
+      target: target2,
       sourceHash: await hashSource(source),
       build: {
         ...resource.build,
@@ -40325,14 +40367,16 @@ async function resolveResource(resource, definition, context) {
     ...resource.stderrPath ? { stderrPath: expandPath(resource.stderrPath, context, false) } : {}
   };
 }
-function resolveManager(manager, definition, context) {
+async function resolveManager(manager, definition, context) {
   if (manager !== "system") return manager;
-  return definition.managers?.[context.platform] ?? (context.platform === "darwin" ? "brew" : "apt");
+  const configured = definition.managers?.[context.platform];
+  if (configured !== void 0) return configured;
+  return context.platform === "darwin" ? "brew" : await detectLinuxManager();
 }
 function expandPath(path, context, relativeToConfig) {
   const expanded = path === "~" ? context.home : path.replace(/^~\//, `${context.home}/`);
-  if (isAbsolute2(expanded)) return resolve3(expanded);
-  return resolve3(relativeToConfig ? context.configDir : context.home, expanded);
+  if (isAbsolute2(expanded)) return resolve4(expanded);
+  return resolve4(relativeToConfig ? context.configDir : context.home, expanded);
 }
 function flatten(input) {
   if (!input) return [];
@@ -40370,7 +40414,7 @@ function mergeDefinitions(definitions) {
 
 // src/persistence/manifest.ts
 import { mkdir, readFile as readFile2, rename, writeFile } from "fs/promises";
-import { dirname as dirname2, resolve as resolve4 } from "path";
+import { dirname as dirname2, resolve as resolve5 } from "path";
 
 // node_modules/.pnpm/smol-toml@1.8.0/node_modules/smol-toml/dist/date.js
 var DATE_TIME_RE = /^(\d{4}-\d{2}-\d{2})?[T ]?(?:(\d{2}):\d{2}(?::\d{2}(?:\.\d+)?)?)?(Z|[-+]\d{2}:\d{2})?$/i;
@@ -41169,7 +41213,7 @@ function stringify(obj, { maxDepth = 1e3, numbersAsFloat = false } = {}) {
 // src/persistence/manifest.ts
 var MANIFEST_VERSION = 1;
 function manifestPath(config) {
-  return resolve4(dirname2(config.stateFile), "config.toml");
+  return resolve5(dirname2(config.stateFile), "config.toml");
 }
 async function writeManifest(path, config) {
   const document2 = {
@@ -41211,6 +41255,11 @@ function toTomlResource(resource) {
         name: resource.name,
         ...resource.version ? { version: resource.version } : {},
         ...resource.lockedVersion ? { locked_version: resource.lockedVersion } : {},
+        ...resource.flatpak ? { flatpak: {
+          ...resource.flatpak.scope ? { scope: resource.flatpak.scope } : {},
+          ...resource.flatpak.remote ? { remote: resource.flatpak.remote } : {},
+          ...resource.flatpak.branch ? { branch: resource.flatpak.branch } : {}
+        } } : {},
         ...resource.upgrade ? {
           upgrade: {
             ...resource.upgrade.greedy !== void 0 ? { greedy: resource.upgrade.greedy } : {},
@@ -41361,6 +41410,9 @@ function parsePackage(value2) {
   if (!isPackageManager(manager)) {
     throw new Error(`Invalid manifest package manager: ${manager}`);
   }
+  if (!isPackageName(manager, value2.name)) throw new Error(`Invalid ${manager} package ID`);
+  if (value2.flatpak !== void 0 && (manager !== "flatpak" || !isFlatpakOptions(value2.flatpak))) throw new Error("Invalid Flatpak options");
+  if (manager === "mas" && value2.locked_version !== void 0) throw new Error("mas does not support version pins");
   const upgrade = value2.upgrade === void 0 ? void 0 : requireTable(value2.upgrade, "package.upgrade");
   if (value2.version !== void 0 && manager !== "mise") {
     throw new Error(`Manifest ${manager} package cannot declare a version`);
@@ -41372,6 +41424,7 @@ function parsePackage(value2) {
     kind: "package",
     manager,
     name: requireString(value2.name, "package.name"),
+    ...isFlatpakOptions(value2.flatpak) ? { flatpak: value2.flatpak } : {},
     ...value2.version !== void 0 ? { version: requireString(value2.version, "package.version") } : {},
     ...value2.locked_version !== void 0 ? { lockedVersion: requireString(value2.locked_version, "package.locked_version") } : {},
     ...upgrade ? {
@@ -41391,13 +41444,13 @@ function parseSymlink(value2) {
 }
 function parseLaunchAgent(value2) {
   const args = value2.args === void 0 ? void 0 : requireStringArray(value2.args, "launch-agent.args");
-  const environment = value2.environment === void 0 ? void 0 : requireStringTable(value2.environment, "launch-agent.environment");
+  const environment3 = value2.environment === void 0 ? void 0 : requireStringTable(value2.environment, "launch-agent.environment");
   return {
     kind: "launch-agent",
     label: requireString(value2.label, "launch-agent.label"),
     program: requireString(value2.program, "launch-agent.program"),
     ...args ? { args } : {},
-    ...environment ? { environment } : {},
+    ...environment3 ? { environment: environment3 } : {},
     ...value2.run_at_load !== void 0 ? { runAtLoad: requireBoolean(value2.run_at_load, "launch-agent.run_at_load") } : {},
     ...value2.keep_alive !== void 0 ? { keepAlive: requireBoolean(value2.keep_alive, "launch-agent.keep_alive") } : {},
     ...value2.stdout_path !== void 0 ? { stdoutPath: requireString(value2.stdout_path, "launch-agent.stdout_path") } : {},
@@ -41434,7 +41487,7 @@ function requireStringTable(value2, field) {
   return result;
 }
 function isPackageManager(value2) {
-  return value2 === "mise" || value2 === "brew" || value2 === "brew-cask" || value2 === "apt";
+  return value2 === "mise" || value2 === "brew" || value2 === "brew-cask" || value2 === "apt" || value2 === "dnf" || value2 === "yum" || value2 === "pacman" || value2 === "flatpak" || value2 === "mas";
 }
 function isConfigValue2(value2) {
   if (value2 === null || typeof value2 === "string" || typeof value2 === "boolean" || typeof value2 === "number" && Number.isFinite(value2)) {
@@ -41445,7 +41498,7 @@ function isConfigValue2(value2) {
 }
 
 // src/reconciliation/plan.ts
-import { lstat as lstat5 } from "fs/promises";
+import { lstat as lstat6 } from "fs/promises";
 
 // src/resources/generated-file.ts
 import { lstat as lstat2, mkdir as mkdir2, readFile as readFile3, readlink as readlink2, rename as rename3, symlink, unlink } from "fs/promises";
@@ -41637,29 +41690,325 @@ function isRecord2(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
 
-// src/resources/package.ts
-async function reconcilePackage(resource, runner) {
-  if ((resource.manager === "brew" || resource.manager === "brew-cask") && resource.lockedVersion !== void 0) {
-    const before = await inspectPackage(resource, runner);
-    if (!before.present) {
-      await installPackage(resource, runner);
-    } else if (!before.matches) {
-      await upgradeLockedBrewPackage(resource, runner);
+// src/resources/mise-cask.ts
+import { lstat as lstat3, mkdtemp, readFile as readFile4, readdir as readdir2, realpath, rename as rename4, readlink as readlink3, symlink as symlink2 } from "fs/promises";
+import { basename, dirname as dirname4, isAbsolute as isAbsolute3, join, resolve as resolve6 } from "path";
+async function inspectMiseCask(resource, runner) {
+  const result = await requireSuccess(runner, "brew", ["--caskroom", resource.name]);
+  const path = result.stdout.trim();
+  if (!isAbsolute3(path) || basename(path) !== resource.name.split("/").at(-1) || dirname4(path) === path) {
+    throw new Error(`Homebrew returned an invalid cask directory for ${resource.name}`);
+  }
+  try {
+    const stat2 = await lstat3(path);
+    if (!stat2.isDirectory() || stat2.isSymbolicLink()) return void 0;
+    const entries = await readdir2(path, { withFileTypes: true });
+    if (entries.length !== 1 || !entries[0]?.isDirectory()) return void 0;
+    const version = entries[0].name;
+    const receiptPath = join(path, version, ".mise-cask.toml");
+    if (!(await lstat3(receiptPath)).isFile()) return void 0;
+    const receipt = parse(await readFile4(receiptPath, "utf8"));
+    if (receipt.schema_version !== 3 || receipt.version !== version || !Array.isArray(receipt.apps) || !Array.isArray(receipt.fonts) || !Array.isArray(receipt.binaries) || receipt.apps.length + receipt.fonts.length + receipt.binaries.length === 0 || !["flight_directories", "generic", "pkg_ids"].every((key) => Array.isArray(receipt[key]) && receipt[key].length === 0)) return void 0;
+    const apps = [];
+    for (const app of receipt.apps) {
+      if (typeof app !== "string" || !isAbsolute3(app) || !app.endsWith(".app") || resolve6(app) !== app) return void 0;
+      const staged = join(path, version, basename(app));
+      if (!(await lstat3(staged)).isSymbolicLink() || await realpath(staged) !== await realpath(app) || !(await lstat3(app)).isDirectory() || app.startsWith(`${dirname4(path)}/`)) return void 0;
+      apps.push(app);
+    }
+    const fonts = [];
+    for (const font of receipt.fonts) {
+      if (typeof font !== "string" || !isAbsolute3(font) || resolve6(font) !== font || !/\.(ttf|otf|ttc|dfont)$/i.test(font) || !dirname4(font).endsWith("/Library/Fonts") || font.startsWith(`${dirname4(path)}/`) || !(await lstat3(font)).isFile()) return void 0;
+      const staged = join(path, version, basename(font));
+      if (!(await lstat3(staged)).isFile() || !(await readFile4(staged)).equals(await readFile4(font))) return void 0;
+      fonts.push(font);
     }
-  } else if (resource.manager === "brew-cask" && resource.upgrade !== void 0) {
-    const before = await inspectPackage(resource, runner);
-    if (before.present && !before.matches) {
-      await upgradePackage(resource, runner);
-    } else if (!before.present) {
-      await installPackage(resource, runner);
+    const links = [];
+    const linkRoots = [await realpath(join(path, version)), ...await Promise.all(apps.map((app) => realpath(app)))];
+    if (!Array.isArray(receipt.completions)) return void 0;
+    for (const completion of [...receipt.binaries, ...receipt.completions]) {
+      if (typeof completion !== "string" || !isAbsolute3(completion) || resolve6(completion) !== completion || completion.startsWith(`${path}/`) || !(await lstat3(completion)).isSymbolicLink()) return void 0;
+      const target2 = await readlink3(completion);
+      const destination = await realpath(completion);
+      if (!resolve6(dirname4(completion), target2).startsWith(`${path}/${version}/`) || !linkRoots.some((root) => destination.startsWith(`${root}/`))) return void 0;
+      links.push({ path: completion, target: target2 });
     }
+    return { path, version, apps: [...new Set(apps)], fonts: [...new Set(fonts)], links };
+  } catch (error) {
+    if (isMissingFile(error)) return void 0;
+    throw error;
+  }
+}
+async function migrateMiseCask(resource, mise, runner) {
+  const backup = await mkdtemp(join(dirname4(dirname4(mise.path)), `.workstation-mise-${basename(mise.path)}-`));
+  runner.report?.(`Migrating ${resource.name} from mise to Homebrew; backups: ${backup}`);
+  for (const [index, app] of mise.apps.entries()) {
+    await requireSuccess(runner, "/usr/bin/ditto", [app, join(backup, `app-${index}.app`)], { streamOutput: true });
+  }
+  for (const [index, font] of mise.fonts.entries()) {
+    await requireSuccess(runner, "/usr/bin/ditto", [font, join(backup, `font-${index}`)], { streamOutput: true });
+  }
+  await rename4(mise.path, join(backup, "original-cask"));
+  try {
+    await requireSuccess(runner, "brew", [
+      "install",
+      "--cask",
+      resource.lockedVersion === mise.version ? "--adopt" : "--force",
+      resource.name
+    ], {
+      streamOutput: true,
+      environment: { HOMEBREW_NO_AUTO_UPDATE: "1" }
+    });
+    const installed = await readInstalledBrewVersion(resource, runner);
+    if (!installed || resource.lockedVersion !== void 0 && installed !== resource.lockedVersion) {
+      throw new Error(`Homebrew migration expected ${resource.lockedVersion ?? "an installed version"}; reported ${installed ?? "no installed version"}`);
+    }
+  } catch (error) {
+    try {
+      try {
+        await rename4(mise.path, join(backup, "failed-cask"));
+      } catch (moveError) {
+        if (!isMissingFile(moveError)) throw moveError;
+      }
+      await rename4(join(backup, "original-cask"), mise.path);
+      for (const [index, link] of mise.links.entries()) {
+        try {
+          const stat2 = await lstat3(link.path);
+          if (stat2.isSymbolicLink()) {
+            const current = await readlink3(link.path);
+            const destination = resolve6(dirname4(link.path), current);
+            if (current !== link.target && [mise.path, ...mise.apps].some((root) => destination.startsWith(`${root}/`))) {
+              await rename4(link.path, join(backup, `failed-link-${index}`));
+              await symlink2(link.target, link.path);
+            }
+          }
+        } catch (linkError) {
+          if (!isMissingFile(linkError)) throw linkError;
+          await symlink2(link.target, link.path);
+        }
+      }
+      for (const [index, app] of mise.apps.entries()) {
+        try {
+          await lstat3(app);
+        } catch (appError) {
+          if (!isMissingFile(appError)) throw appError;
+          await requireSuccess(runner, "/usr/bin/ditto", [join(backup, `app-${index}.app`), app], { streamOutput: true });
+        }
+      }
+      for (const [index, font] of mise.fonts.entries()) {
+        try {
+          await lstat3(font);
+        } catch (fontError) {
+          if (!isMissingFile(fontError)) throw fontError;
+          await requireSuccess(runner, "/usr/bin/ditto", [join(backup, `font-${index}`), font], { streamOutput: true });
+        }
+      }
+    } catch (restoreError) {
+      throw new AggregateError([error, restoreError], `Migration and recovery failed for ${resource.name}. Backups: ${backup}`, { cause: restoreError });
+    }
+    throw new Error(`Migration failed for ${resource.name}: ${error instanceof Error ? error.message : String(error)}. Mise staging restored; artifact backups: ${backup}`, { cause: error });
+  }
+  runner.report?.(`Migrated ${resource.name} from mise to Homebrew. Backups: ${backup}. Remove brew-cask:${resource.name} from your mise configuration; do not run mise uninstall for this cask.`);
+}
+
+// src/resources/package-command.ts
+async function runPackageCommand(mutation, runner) {
+  if (!mutation) return;
+  await requireSuccess(runner, mutation.command, [...mutation.args, ...mutation.targets], { ...mutation.options, streamOutput: true });
+}
+function packageCommandKey(mutation) {
+  return mutation.single ? void 0 : JSON.stringify([mutation.command, mutation.args, mutation.options]);
+}
+
+// src/resources/rpm.ts
+var environment = { LC_ALL: "C" };
+var versionPattern = /^\d+:[A-Za-z0-9._+~^]+-[A-Za-z0-9._+~^]+\.[A-Za-z0-9_]+$/;
+async function resolveRpmVersion(resource, runner) {
+  const architecture = (await requireSuccess(runner, "rpm", ["--eval", "%{_arch}"], { environment })).stdout.trim();
+  if (!/^[A-Za-z0-9_]+$/.test(architecture)) throw new Error("RPM did not report a valid native architecture");
+  const result = await requireSuccess(runner, resource.manager, ["--quiet", "--color=never", "list", resource.name], { environment });
+  const candidates = [];
+  let available = false;
+  const lines = result.stdout.replace(/^(\S+\.\S+)\n[ \t]+(?=\S+\s+\S+)/gm, "$1 ").split("\n");
+  for (const line of lines) {
+    if (/^Available packages\s*$/i.test(line.trim())) {
+      available = true;
+      continue;
+    }
+    if (/^Installed packages\s*$/i.test(line.trim())) {
+      available = false;
+      continue;
+    }
+    const [nameArch, evr, repository] = line.trim().split(/\s+/);
+    if (!nameArch || !evr || !repository) continue;
+    const dot = nameArch.lastIndexOf(".");
+    const name = nameArch.slice(0, dot);
+    const arch = nameArch.slice(dot + 1);
+    if (nameArch !== resource.name && (name !== resource.name || arch !== architecture && arch !== "noarch")) continue;
+    const version = `${evr.includes(":") ? evr : `0:${evr}`}.${arch}`;
+    if (!versionPattern.test(version)) throw new Error(`${resource.manager} reported an invalid RPM version for ${resource.name}: ${version}`);
+    candidates.push({ version, native: arch === architecture, available });
+  }
+  candidates.sort((left, right) => Number(right.available) - Number(left.available) || Number(right.native) - Number(left.native));
+  const candidate = candidates[0];
+  if (!candidate) throw new Error(`${resource.manager} has no installation candidate for ${resource.name}`);
+  return candidate.version;
+}
+async function inspectRpmPackage(resource, runner) {
+  const result = await runner.run("rpm", ["-q", "--qf", "%{EPOCHNUM}:%{VERSION}-%{RELEASE}.%{ARCH}\n", resource.name], { environment });
+  if (result.exitCode !== 0) {
+    if (result.exitCode === 1 && result.stdout.trim() === `package ${resource.name} is not installed` && !result.stderr.trim()) {
+      return { present: false, matches: false };
+    }
+    throw new Error(`rpm query failed for ${resource.name} (${result.exitCode}): ${(result.stderr || result.stdout).trim()}`);
+  }
+  const versions = result.stdout.trim().split("\n");
+  if (!versions.every((version) => versionPattern.test(version))) throw new Error(`RPM returned invalid installed versions for ${resource.name}`);
+  const requestedArch = resource.lockedVersion?.slice(resource.lockedVersion.lastIndexOf(".") + 1);
+  const installedVersion = versions.find((version) => version === resource.lockedVersion) ?? versions.find((version) => requestedArch !== void 0 && version.endsWith(`.${requestedArch}`)) ?? versions[0];
+  if (!installedVersion) throw new Error(`RPM reported no installed version for ${resource.name}`);
+  return { present: true, matches: resource.lockedVersion === void 0 || installedVersion === resource.lockedVersion, installedVersion };
+}
+async function prepareRpmPackage(resource, runner, inspection) {
+  const before = inspection ?? await inspectRpmPackage(resource, runner);
+  if (before.matches) return;
+  let operation = "install";
+  let spec = resource.name;
+  if (resource.lockedVersion !== void 0) {
+    const desired = resource.lockedVersion;
+    if (!versionPattern.test(desired)) throw new Error(`Invalid RPM lock version for ${resource.name}: ${desired}`);
+    const arch = desired.slice(desired.lastIndexOf(".") + 1);
+    const name = resource.name.endsWith(`.${arch}`) ? resource.name.slice(0, -arch.length - 1) : resource.name;
+    spec = `${name}-${desired}`;
+    if (before.installedVersion?.endsWith(`.${arch}`)) {
+      const current = before.installedVersion.slice(0, before.installedVersion.lastIndexOf("."));
+      const target2 = desired.slice(0, desired.lastIndexOf("."));
+      const comparison = (await requireSuccess(runner, "rpm", ["--eval", `%{lua:print(rpm.vercmp("${current}", "${target2}"))}`], { environment })).stdout.trim();
+      if (!["-1", "0", "1"].includes(comparison)) throw new Error(`RPM could not compare versions for ${resource.name}`);
+      if (comparison === "1") operation = "downgrade";
+    }
+  }
+  return { command: "sudo", args: [resource.manager, operation, "-y"], targets: [spec] };
+}
+
+// src/resources/pacman.ts
+var environment2 = { LC_ALL: "C" };
+async function resolvePacmanVersion(resource, runner) {
+  const result = await requireSuccess(runner, "pacman", ["-Sp", "--print-format", "%n	%v", resource.name], { environment: environment2 });
+  const versions = result.stdout.trim().split("\n").flatMap((line) => {
+    const [name, version, extra] = line.trim().split(/\s+/);
+    return name === resource.name && version && !extra ? [version] : [];
+  });
+  if (versions.length !== 1 || !versions[0]) throw new Error(`pacman did not report a unique version for ${resource.name}`);
+  return versions[0];
+}
+async function inspectPacman(resource, runner) {
+  const result = await runner.run("pacman", ["-Q", resource.name], { environment: environment2 });
+  if (result.exitCode !== 0) {
+    if (result.exitCode === 1 && !result.stdout.trim() && result.stderr.trim() === `error: package '${resource.name}' was not found`) {
+      return { present: false, matches: false };
+    }
+    throw new Error(`pacman query failed for ${resource.name} (${result.exitCode}): ${(result.stderr || result.stdout).trim()}`);
+  }
+  const [name, installedVersion, extra] = result.stdout.trim().split(/\s+/);
+  if (name !== resource.name || !installedVersion || extra) throw new Error(`pacman returned invalid installed information for ${resource.name}`);
+  return { present: true, matches: resource.lockedVersion === void 0 || resource.lockedVersion === installedVersion, installedVersion };
+}
+async function preparePacman(resource, runner, inspection) {
+  if ((inspection ?? await inspectPacman(resource, runner)).matches) return;
+  const available = await resolvePacmanVersion(resource, runner);
+  if (resource.lockedVersion !== void 0 && available !== resource.lockedVersion) {
+    throw new Error(`pacman offers ${resource.name} ${available}, but workstation.lock pins ${resource.lockedVersion}. Refresh the pin after your normal full system upgrade; Workstation does not fetch archived packages.`);
+  }
+  return { command: "sudo", args: ["pacman", "-S", "--needed", "--noconfirm"], targets: [resource.name] };
+}
+
+// src/resources/flatpak.ts
+function target(resource) {
+  const scope = resource.flatpak?.scope ?? "user";
+  const branch = resource.flatpak?.branch ?? "stable";
+  return { scope, branch, flag: `--${scope}`, remote: resource.flatpak?.remote ?? "flathub", ref: `app/${resource.name}//${branch}` };
+}
+function commit(value2) {
+  const hash = value2.trim();
+  if (!/^[a-f0-9]{64}$/.test(hash)) throw new Error(`Flatpak did not report a full commit ID: ${hash}`);
+  return hash;
+}
+async function resolveFlatpakVersion(resource, runner) {
+  const { flag, remote, ref } = target(resource);
+  return commit((await requireSuccess(runner, "flatpak", ["remote-info", flag, "--show-commit", remote, ref])).stdout);
+}
+async function inspectFlatpak(resource, runner) {
+  const { flag, remote, ref, branch } = target(resource);
+  const result = await requireSuccess(runner, "flatpak", ["list", flag, "--app", "--columns=application,branch,origin"]);
+  const rows = result.stdout.trim() === "" ? [] : result.stdout.trim().split("\n").map((line) => line.split("	"));
+  if (rows.some((row) => row.length !== 3 || row.some((value2) => value2 === ""))) throw new Error("Flatpak returned an invalid application list");
+  const installed = rows.find(([id, installedBranch]) => id === resource.name && installedBranch === branch);
+  if (!installed) return { present: false, matches: false };
+  if (installed[2] !== remote) return { present: true, matches: false, conflict: `${resource.name} is installed from ${installed[2]}, but the configuration requests ${remote}. Migrate its remote explicitly.` };
+  const installedVersion = commit((await requireSuccess(runner, "flatpak", ["info", flag, "--show-commit", ref])).stdout);
+  return { present: true, matches: resource.lockedVersion === void 0 || installedVersion === resource.lockedVersion, installedVersion };
+}
+async function prepareFlatpak(resource, runner, inspection) {
+  const before = inspection ?? await inspectFlatpak(resource, runner);
+  if (before.conflict) throw new Error(before.conflict);
+  if (before.matches) return;
+  const { flag, scope, remote, ref } = target(resource);
+  if (resource.lockedVersion !== void 0) commit(resource.lockedVersion);
+  if (!before.present && resource.lockedVersion !== void 0 && await resolveFlatpakVersion(resource, runner) !== resource.lockedVersion) {
+    throw new Error(`Flatpak's current ${resource.name} commit differs from workstation.lock. Refresh its pin before a fresh install; existing installations can update to retained historical commits.`);
+  }
+  const args = before.present ? ["update", flag, "--noninteractive", "--assumeyes", ...resource.lockedVersion ? [`--commit=${resource.lockedVersion}`] : []] : ["install", flag, "--noninteractive", "--assumeyes", "--app", remote];
+  return {
+    command: scope === "system" ? "sudo" : "flatpak",
+    args: scope === "system" ? ["flatpak", ...args] : args,
+    targets: [ref],
+    ...before.present && resource.lockedVersion ? { single: true } : {}
+  };
+}
+function prepareFlatpakRemoval(resource) {
+  const { flag, scope, ref } = target(resource);
+  const args = ["uninstall", flag, "--noninteractive", "--assumeyes", "--app"];
+  return { command: scope === "system" ? "sudo" : "flatpak", args: scope === "system" ? ["flatpak", ...args] : args, targets: [ref] };
+}
+
+// src/resources/mas.ts
+function appRows(output) {
+  return output.trim() === "" ? [] : output.trim().split("\n").map((line) => {
+    const match = /^\s*(\d+)\s+.+\s+\(([^()]+)\)\s*$/.exec(line);
+    if (!match?.[1] || !match[2]) throw new Error(`mas returned an unrecognized app row: ${line}`);
+    return { id: match[1], version: match[2] };
+  });
+}
+async function inspectMas(resource, runner) {
+  if (resource.lockedVersion !== void 0) throw new Error("mas does not support version pins");
+  const installed = appRows((await requireSuccess(runner, "mas", ["list"])).stdout).find((app) => app.id === resource.name);
+  if (!installed) return { present: false, matches: false };
+  const outdated = appRows((await requireSuccess(runner, "mas", ["outdated"])).stdout);
+  return { present: true, matches: !outdated.some((app) => app.id === resource.name), installedVersion: installed.version };
+}
+async function prepareMas(resource, runner, inspection) {
+  const before = inspection ?? await inspectMas(resource, runner);
+  if (before.matches) return;
+  return { command: "mas", args: [before.present ? "upgrade" : "install"], targets: [resource.name] };
+}
+
+// src/resources/package.ts
+async function reconcilePackage(resource, runner) {
+  const before = await inspectPackage(resource, runner);
+  if (before.conflict) throw new Error(before.conflict);
+  if (before.migration === "mise-cask") {
+    await assertBrewVersionAvailable(resource, runner);
+    const mise = await inspectMiseCask(resource, runner);
+    if (!mise) throw new Error(`Mise installation changed during inspection: ${resource.name}`);
+    await migrateMiseCask(resource, mise, runner);
   } else {
-    await installPackage(resource, runner);
+    await runPackageCommand(await preparePackageInstallation(resource, runner, before), runner);
   }
   const inspection = await inspectPackage(resource, runner);
   if (!inspection.matches) {
     throw new Error(
-      inspection.conflict ?? `${resource.manager} reported success but ${resource.name} does not match the requested version`
+      inspection.conflict ?? `${resource.manager} reported success but ${resource.name} did not converge: expected ${resource.lockedVersion ?? resource.version ?? "no available upgrades"}; installed ${inspection.installedVersion ?? (inspection.present ? "version unknown" : "not present")}. Check the package manager output above for skipped upgrades or warnings.`
     );
   }
   return inspection;
@@ -41685,10 +42034,17 @@ async function inspectPackage(resource, runner) {
       const installed = result.exitCode === 0;
       if (installed && resource.lockedVersion !== void 0) {
         const installedVersion = await readInstalledBrewVersion(resource, runner);
+        if (installedVersion === void 0 && resource.manager === "brew-cask") {
+          const mise = await inspectMiseCask(resource, runner);
+          if (mise) return { present: true, matches: false, installedVersion: mise.version, migration: "mise-cask" };
+        }
         return {
           present: true,
           matches: installedVersion === resource.lockedVersion,
-          ...installedVersion ? { installedVersion } : {}
+          ...installedVersion ? { installedVersion } : {},
+          ...installedVersion === void 0 ? {
+            conflict: `Homebrew lists ${resource.name} but reports no installed version. Its installation metadata may be incomplete; inspect brew info --json=v2 ${flag} ${resource.name} and repair the Homebrew installation before retrying.`
+          } : {}
         };
       }
       if (!installed || resource.manager !== "brew-cask" || resource.upgrade === void 0) {
@@ -41716,52 +42072,54 @@ async function inspectPackage(resource, runner) {
         ...installedVersion ? { installedVersion } : {}
       };
     }
+    case "dnf":
+    case "yum":
+      return await inspectRpmPackage(resource, runner);
+    case "pacman":
+      return await inspectPacman(resource, runner);
+    case "flatpak":
+      return await inspectFlatpak(resource, runner);
+    case "mas":
+      return await inspectMas(resource, runner);
     case "system":
       throw new Error("System package manager must be resolved before inspection");
   }
 }
-async function upgradePackage(resource, runner) {
-  if (resource.manager !== "brew-cask" || resource.upgrade === void 0) {
-    throw new Error(`Upgrade policy is not configured for ${resource.name}`);
-  }
-  await assertBrewVersionAvailable(resource, runner);
-  const args = ["upgrade", "--cask", "--no-ask"];
-  if (resource.upgrade.greedy) args.push("--greedy");
-  if (resource.upgrade.force) args.push("--force");
-  args.push(resource.name);
-  await requireSuccess(runner, "brew", args);
-}
-async function upgradeLockedBrewPackage(resource, runner) {
-  if (resource.manager !== "brew" && resource.manager !== "brew-cask") {
-    throw new Error(`Cannot upgrade non-Homebrew package ${resource.name}`);
-  }
-  await assertBrewVersionAvailable(resource, runner);
-  const args = ["upgrade"];
-  if (resource.manager === "brew-cask") {
-    args.push("--cask", "--no-ask");
-    if (resource.upgrade?.greedy) args.push("--greedy");
-    if (resource.upgrade?.force) args.push("--force");
-  }
-  args.push(resource.name);
-  await requireSuccess(runner, "brew", args);
-}
-async function installPackage(resource, runner) {
+async function preparePackageInstallation(resource, runner, before) {
+  if (before.conflict) throw new Error(before.conflict);
+  if (before.migration) throw new Error(`Cask migration must run separately: ${resource.name}`);
+  if (before.matches) return;
   let command;
   let args;
+  let spec = resource.name;
   switch (resource.manager) {
     case "mise":
       command = "mise";
-      args = ["install", `${resource.name}@${resource.lockedVersion ?? resource.version ?? "latest"}`];
+      args = ["install"];
+      spec = `${resource.name}@${resource.lockedVersion ?? resource.version ?? "latest"}`;
       break;
+    case "dnf":
+    case "yum":
+      return await prepareRpmPackage(resource, runner, before);
+    case "pacman":
+      return await preparePacman(resource, runner, before);
+    case "flatpak":
+      return await prepareFlatpak(resource, runner, before);
+    case "mas":
+      return await prepareMas(resource, runner, before);
     case "brew":
-      await assertBrewVersionAvailable(resource, runner);
-      command = "brew";
-      args = ["install", resource.name];
-      break;
     case "brew-cask":
       await assertBrewVersionAvailable(resource, runner);
       command = "brew";
-      args = ["install", "--cask", resource.name];
+      args = [before.present ? "upgrade" : "install"];
+      if (resource.manager === "brew-cask") {
+        args.push("--cask");
+        if (before.present) {
+          args.push("--no-ask");
+          if (resource.lockedVersion || resource.upgrade?.greedy) args.push("--greedy");
+          if (resource.upgrade?.force) args.push("--force");
+        }
+      }
       break;
     case "apt":
       command = "sudo";
@@ -41769,14 +42127,20 @@ async function installPackage(resource, runner) {
         "apt-get",
         "install",
         "-y",
-        ...resource.lockedVersion ? ["--allow-downgrades"] : [],
-        resource.lockedVersion ? `${resource.name}=${resource.lockedVersion}` : resource.name
+        ...resource.lockedVersion ? ["--allow-downgrades"] : []
       ];
+      spec = resource.lockedVersion ? `${resource.name}=${resource.lockedVersion}` : resource.name;
       break;
     case "system":
       throw new Error("System package manager must be resolved before installation");
   }
-  await requireSuccess(runner, command, args);
+  return { command, args, targets: [spec], options: brewMutationOptions(resource) };
+}
+function brewMutationOptions(resource) {
+  return {
+    streamOutput: true,
+    ...(resource.manager === "brew" || resource.manager === "brew-cask") && resource.lockedVersion ? { environment: { HOMEBREW_NO_AUTO_UPDATE: "1" } } : {}
+  };
 }
 async function assertBrewVersionAvailable(resource, runner) {
   if (!resource.lockedVersion) return;
@@ -41788,41 +42152,60 @@ async function assertBrewVersionAvailable(resource, runner) {
   }
 }
 async function removePackage(resource, runner, installedVersion) {
+  await runPackageCommand(preparePackageRemoval(resource, installedVersion), runner);
+}
+function preparePackageRemoval(resource, installedVersion) {
   let command;
   let args;
+  let spec = resource.name;
   switch (resource.manager) {
     case "mise":
       command = "mise";
       args = [
         "uninstall",
-        "--yes",
-        `${resource.name}@${installedVersion ?? resource.lockedVersion ?? resource.version ?? "latest"}`
+        "--yes"
       ];
+      spec = `${resource.name}@${installedVersion ?? resource.lockedVersion ?? resource.version ?? "latest"}`;
       break;
     case "brew":
       command = "brew";
-      args = ["uninstall", resource.name];
+      args = ["uninstall"];
       break;
     case "brew-cask":
       command = "brew";
-      args = ["uninstall", "--cask", resource.name];
+      args = ["uninstall", "--cask"];
       break;
     case "apt":
       command = "sudo";
-      args = ["apt-get", "remove", "-y", resource.name];
+      args = ["apt-get", "remove", "-y"];
+      break;
+    case "dnf":
+    case "yum":
+      command = "sudo";
+      args = [resource.manager, "remove", "-y"];
+      break;
+    case "pacman":
+      command = "sudo";
+      args = ["pacman", "-R", "--noconfirm"];
+      break;
+    case "flatpak":
+      return prepareFlatpakRemoval(resource);
+    case "mas":
+      command = "mas";
+      args = ["uninstall"];
       break;
     case "system":
       throw new Error("System package manager must be resolved before removal");
   }
-  await requireSuccess(runner, command, args);
+  return { command, args, targets: [spec] };
 }
 
 // src/resources/symlink.ts
-import { lstat as lstat3, mkdir as mkdir3, readlink as readlink3, symlink as symlink2, unlink as unlink2 } from "fs/promises";
-import { dirname as dirname4, resolve as resolve5 } from "path";
+import { lstat as lstat4, mkdir as mkdir3, readlink as readlink4, symlink as symlink3, unlink as unlink2 } from "fs/promises";
+import { dirname as dirname5, resolve as resolve7 } from "path";
 async function inspectSymlink(resource) {
   try {
-    const stats = await lstat3(resource.target);
+    const stats = await lstat4(resource.target);
     if (!stats.isSymbolicLink()) {
       return {
         present: true,
@@ -41830,8 +42213,8 @@ async function inspectSymlink(resource) {
         conflict: `${resource.target} exists and is not a symbolic link`
       };
     }
-    const target = await readlink3(resource.target);
-    const actual = resolve5(dirname4(resource.target), target);
+    const target2 = await readlink4(resource.target);
+    const actual = resolve7(dirname5(resource.target), target2);
     const matches = actual === resource.source;
     return {
       present: true,
@@ -41847,12 +42230,12 @@ async function installSymlink(resource) {
   const inspection = await inspectSymlink(resource);
   if (inspection.conflict) throw new Error(inspection.conflict);
   if (inspection.matches) return;
-  await lstat3(resource.source).catch((error) => {
+  await lstat4(resource.source).catch((error) => {
     if (isMissingFile(error)) throw new Error(`Symlink source does not exist: ${resource.source}`);
     throw error;
   });
-  await mkdir3(dirname4(resource.target), { recursive: true });
-  await symlink2(resource.source, resource.target);
+  await mkdir3(dirname5(resource.target), { recursive: true });
+  await symlink3(resource.source, resource.target);
 }
 async function removeSymlink(resource) {
   const inspection = await inspectSymlink(resource);
@@ -41864,13 +42247,13 @@ async function removeSymlink(resource) {
 }
 
 // src/resources/launch-agent.ts
-import { mkdir as mkdir4, readFile as readFile4, unlink as unlink3 } from "fs/promises";
-import { dirname as dirname5, resolve as resolve6 } from "path";
+import { mkdir as mkdir4, readFile as readFile5, unlink as unlink3 } from "fs/promises";
+import { dirname as dirname6, resolve as resolve8 } from "path";
 
 // src/rendering/plist.ts
 function renderLaunchAgent(resource) {
   const args = resource.args ?? [];
-  const environment = Object.entries(resource.environment ?? {}).sort(
+  const environment3 = Object.entries(resource.environment ?? {}).sort(
     ([left], [right]) => left.localeCompare(right)
   );
   const lines = [
@@ -41888,9 +42271,9 @@ function renderLaunchAgent(resource) {
   ];
   if (resource.runAtLoad ?? true) lines.push("  <key>RunAtLoad</key>", "  <true/>");
   if (resource.keepAlive ?? false) lines.push("  <key>KeepAlive</key>", "  <true/>");
-  if (environment.length > 0) {
+  if (environment3.length > 0) {
     lines.push("  <key>EnvironmentVariables</key>", "  <dict>");
-    for (const [key, value2] of environment) {
+    for (const [key, value2] of environment3) {
       lines.push(`    <key>${escapeXml(key)}</key>`, `    <string>${escapeXml(value2)}</string>`);
     }
     lines.push("  </dict>");
@@ -41918,7 +42301,7 @@ function escapeXml(value2) {
 async function inspectLaunchAgent(resource) {
   const path = launchAgentPath(resource);
   try {
-    const current = await readFile4(path, "utf8");
+    const current = await readFile5(path, "utf8");
     const matches = current === renderLaunchAgent(resource);
     return {
       present: true,
@@ -41935,7 +42318,7 @@ async function installLaunchAgent(resource, runner) {
   if (inspection.present && !inspection.matches) throw new Error(inspection.conflict);
   if (!inspection.present) {
     const path = launchAgentPath(resource);
-    await mkdir4(dirname5(path), { recursive: true });
+    await mkdir4(dirname6(path), { recursive: true });
     await atomicWrite(path, renderLaunchAgent(resource));
   }
   const domain = `gui/${process.getuid?.() ?? 0}`;
@@ -41959,13 +42342,13 @@ async function removeLaunchAgent(resource, runner) {
 function launchAgentPath(resource) {
   const home = process.env.HOME;
   if (!home) throw new Error("HOME is required to manage LaunchAgents");
-  return resolve6(home, "Library", "LaunchAgents", `${resource.label}.plist`);
+  return resolve8(home, "Library", "LaunchAgents", `${resource.label}.plist`);
 }
 
 // src/resources/systemd-service.ts
-import { mkdir as mkdir5, readFile as readFile5, unlink as unlink4, writeFile as writeFile3 } from "fs/promises";
+import { mkdir as mkdir5, readFile as readFile6, unlink as unlink4, writeFile as writeFile3 } from "fs/promises";
 import { tmpdir } from "os";
-import { dirname as dirname6, resolve as resolve7 } from "path";
+import { dirname as dirname7, resolve as resolve9 } from "path";
 
 // src/rendering/systemd.ts
 function renderSystemdService(resource) {
@@ -41978,7 +42361,7 @@ function renderSystemdService(resource) {
   if (!/^[A-Za-z0-9_.@-]+\.(?:target|service)$/.test(wantedBy)) {
     throw new Error(`Invalid systemd WantedBy unit: ${wantedBy}`);
   }
-  const environment = Object.entries(resource.environment ?? {}).map(
+  const environment3 = Object.entries(resource.environment ?? {}).map(
     ([key, value2]) => {
       if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
         throw new Error(`Invalid systemd environment variable: ${key}`);
@@ -41992,7 +42375,7 @@ function renderSystemdService(resource) {
     "",
     "[Service]",
     `ExecStart=${[resource.program, ...resource.args ?? []].map(quote).join(" ")}`,
-    ...environment,
+    ...environment3,
     `Restart=${restart}`,
     "",
     "[Install]",
@@ -42008,7 +42391,7 @@ function quote(value2) {
 async function inspectSystemdService(resource) {
   const path = systemdServicePath(resource);
   try {
-    const current = await readFile5(path, "utf8");
+    const current = await readFile6(path, "utf8");
     const matches = current === renderSystemdService(resource);
     return {
       present: true,
@@ -42046,11 +42429,11 @@ async function writeSystemdService(resource, runner) {
   const path = systemdServicePath(resource);
   const content = renderSystemdService(resource);
   if (resource.scope === "user") {
-    await mkdir5(dirname6(path), { recursive: true });
+    await mkdir5(dirname7(path), { recursive: true });
     await atomicWrite(path, content, 420);
     return;
   }
-  const temporary = resolve7(tmpdir(), `workstation-${process.pid}-${resource.name}`);
+  const temporary = resolve9(tmpdir(), `workstation-${process.pid}-${resource.name}`);
   await writeFile3(temporary, content, { mode: 384 });
   try {
     await requireSuccess(runner, "sudo", ["install", "-m", "0644", temporary, path]);
@@ -42066,26 +42449,26 @@ async function systemctl(resource, runner, args) {
   }
 }
 function systemdServicePath(resource) {
-  if (resource.scope === "system") return resolve7("/etc/systemd/system", resource.name);
+  if (resource.scope === "system") return resolve9("/etc/systemd/system", resource.name);
   const home = process.env.HOME;
   if (!home) throw new Error("HOME is required to manage user systemd services");
-  return resolve7(home, ".config", "systemd", "user", resource.name);
+  return resolve9(home, ".config", "systemd", "user", resource.name);
 }
 
 // src/resources/custom-tool.ts
-import { chmod as chmod2, lstat as lstat4, mkdir as mkdir6, readFile as readFile6, rename as rename4, unlink as unlink5 } from "fs/promises";
-import { dirname as dirname7 } from "path";
+import { chmod as chmod2, lstat as lstat5, mkdir as mkdir6, readFile as readFile7, rename as rename5, unlink as unlink5 } from "fs/promises";
+import { dirname as dirname8 } from "path";
 import { createHash as createHash3 } from "crypto";
 async function inspectCustomTool(resource) {
   try {
-    const stats = await lstat4(resource.target);
+    const stats = await lstat5(resource.target);
     if (!stats.isFile()) {
       return { present: true, matches: false, conflict: `${resource.target} is not a regular file` };
     }
     return {
       present: true,
       matches: true,
-      installedHash: createHash3("sha256").update(await readFile6(resource.target)).digest("hex")
+      installedHash: createHash3("sha256").update(await readFile7(resource.target)).digest("hex")
     };
   } catch (error) {
     if (isMissingFile(error)) return { present: false, matches: false };
@@ -42093,7 +42476,7 @@ async function inspectCustomTool(resource) {
   }
 }
 async function installCustomTool(resource, runner) {
-  await mkdir6(dirname7(resource.target), { recursive: true });
+  await mkdir6(dirname8(resource.target), { recursive: true });
   const output = `${resource.target}.${process.pid}.workstation.tmp`;
   await unlink5(output).catch((error) => {
     if (!isMissingFile(error)) throw error;
@@ -42106,11 +42489,12 @@ async function installCustomTool(resource, runner) {
       resource.build.command,
       (resource.build.args ?? []).map(replace),
       {
+        streamOutput: true,
         ...resource.build.cwd ? { cwd: replace(resource.build.cwd) } : {},
         ...resource.build.environment ? { environment: Object.fromEntries(Object.entries(resource.build.environment).map(([key, value2]) => [key, replace(value2)])) } : {}
       }
     );
-    const stats = await lstat4(output).catch((error) => {
+    const stats = await lstat5(output).catch((error) => {
       if (isMissingFile(error)) {
         throw new Error(`Custom tool build did not create {output}: ${resource.name}`);
       }
@@ -42118,7 +42502,7 @@ async function installCustomTool(resource, runner) {
     });
     if (!stats.isFile()) throw new Error(`Custom tool output is not a regular file: ${output}`);
     await chmod2(output, 493);
-    await rename4(output, resource.target);
+    await rename5(output, resource.target);
   } finally {
     await unlink5(output).catch(() => void 0);
   }
@@ -42200,11 +42584,11 @@ async function removeResource(resource, runner, installedVersion, originalFile,
 }
 
 // src/persistence/state.ts
-import { mkdir as mkdir7, readFile as readFile7, rename as rename5, writeFile as writeFile4 } from "fs/promises";
-import { dirname as dirname8 } from "path";
+import { mkdir as mkdir7, readFile as readFile8, rename as rename6, writeFile as writeFile4 } from "fs/promises";
+import { dirname as dirname9 } from "path";
 async function readState(path, machine) {
   try {
-    const parsed = JSON.parse(await readFile7(path, "utf8"));
+    const parsed = JSON.parse(await readFile8(path, "utf8"));
     if (!isState(parsed)) {
       throw new Error(`Unsupported or invalid state file: ${path}`);
     }
@@ -42222,11 +42606,11 @@ async function readState(path, machine) {
   }
 }
 async function writeState(path, state) {
-  await mkdir7(dirname8(path), { recursive: true, mode: 448 });
+  await mkdir7(dirname9(path), { recursive: true, mode: 448 });
   const temporary = `${path}.${process.pid}.tmp`;
   await writeFile4(temporary, `${JSON.stringify(state, null, 2)}
 `, { mode: 384 });
-  await rename5(temporary, path);
+  await rename6(temporary, path);
 }
 function isMissingFile2(error) {
   return error instanceof Error && "code" in error && error.code === "ENOENT";
@@ -42252,7 +42636,7 @@ function isResolvedResource(value2) {
   const candidate = value2;
   switch (candidate.kind) {
     case "package":
-      return ["mise", "brew", "brew-cask", "apt"].includes(String(candidate.manager)) && typeof candidate.name === "string" && (candidate.version === void 0 || typeof candidate.version === "string") && (candidate.lockedVersion === void 0 || typeof candidate.lockedVersion === "string") && (candidate.upgrade === void 0 || candidate.manager === "brew-cask" && isBrewCaskUpgradeOptions2(candidate.upgrade));
+      return ["mise", "brew", "brew-cask", "apt", "dnf", "yum", "pacman", "flatpak", "mas"].includes(String(candidate.manager)) && isPackageName(candidate.manager, candidate.name) && (candidate.flatpak === void 0 || candidate.manager === "flatpak" && isFlatpakOptions(candidate.flatpak)) && (candidate.manager !== "mas" || candidate.lockedVersion === void 0) && (candidate.version === void 0 || typeof candidate.version === "string") && (candidate.lockedVersion === void 0 || typeof candidate.lockedVersion === "string") && (candidate.upgrade === void 0 || candidate.manager === "brew-cask" && isBrewCaskUpgradeOptions2(candidate.upgrade));
     case "symlink":
       return typeof candidate.source === "string" && typeof candidate.target === "string";
     case "launch-agent":
@@ -42295,24 +42679,25 @@ function isBrewCaskUpgradeOptions2(value2) {
 }
 
 // src/reconciliation/plan.ts
-async function createPlan(config, runner) {
+async function createPlan(config, runner, onProgress) {
   const state = await readState(config.stateFile, config.context.machine);
   const desired = new Map(config.resources.map((resource) => [resourceId(resource), resource]));
   const actions = [];
   for (const [id, resource] of desired) {
+    onProgress?.(`  Inspect: ${id}`);
     const previous = state.resources[id];
     const inspection = await inspectResource(resource, runner);
     if (resource.kind === "custom-tool" && inspection.present && previous?.installedHash !== void 0 && inspection.installedHash !== previous.installedHash) {
       throw new Error(`Managed custom tool ${id} was changed outside Workstation`);
     }
-    if (resource.kind === "symlink" && !inspection.matches) await lstat5(resource.source);
+    if (resource.kind === "symlink" && !inspection.matches) await lstat6(resource.source);
     if (!previous) {
       if (inspection.matches) {
         actions.push({ type: "adopt", id, resource, reason: "already present" });
       } else if (inspection.conflict) {
         throw new Error(`Cannot manage ${id}: ${inspection.conflict}`);
       } else if (inspection.present) {
-        actions.push({ type: "update", id, resource, reason: "upgrade available" });
+        actions.push({ type: "update", id, resource, reason: inspection.migration ? "migrate from mise to Homebrew" : "upgrade available" });
       } else {
         actions.push({ type: "create", id, resource, reason: "not present" });
       }
@@ -42335,12 +42720,13 @@ async function createPlan(config, runner) {
         id,
         resource,
         previous,
-        reason: inspection.present ? "upgrade available" : "managed resource is missing"
+        reason: inspection.migration ? "migrate from mise to Homebrew" : inspection.present ? "upgrade available" : "managed resource is missing"
       });
     }
   }
   for (const [id, previous] of Object.entries(state.resources)) {
     if (desired.has(id)) continue;
+    onProgress?.(`  Inspect removed declaration: ${id}`);
     const removable = previous.owned || previous.originalFile !== void 0;
     if (!removable) {
       actions.push({
@@ -42372,7 +42758,7 @@ async function createPlan(config, runner) {
   );
 }
 function canUpdateAdoptedInPlace(resource) {
-  return resource.kind === "package" && resource.manager === "brew-cask" || resource.kind === "generated-file" && resource.ifExists === "overwrite" || resource.kind === "custom-tool";
+  return resource.kind === "package" && ["brew-cask", "flatpak", "mas", "pacman"].includes(resource.manager) || resource.kind === "generated-file" && resource.ifExists === "overwrite" || resource.kind === "custom-tool";
 }
 function canRepairManagedFile(resource, previous) {
   return resource.kind === "generated-file" && (previous.owned || previous.originalFile !== void 0 && resource.ifExists === "overwrite");
@@ -42390,11 +42776,66 @@ function actionOrder(action) {
   return 6;
 }
 
+// src/reconciliation/package-batch.ts
+function isPackageMutation(action) {
+  return action.resource.kind === "package" && ["create", "update", "remove"].includes(action.type);
+}
+async function applyPackageBatch(actions, runner, checkpoint, onAction, onProgress) {
+  const groups = [];
+  const byCommand = /* @__PURE__ */ new Map();
+  for (const action of actions) {
+    const before = await inspectPackage(action.resource, runner);
+    if (before.conflict) throw new Error(`Cannot manage ${action.id}: ${before.conflict}`);
+    const mutation = action.type === "remove" ? before.present ? preparePackageRemoval(action.resource, action.previous?.installedVersion) : void 0 : before.migration ? void 0 : await preparePackageInstallation(action.resource, runner, before);
+    const prepared = { action, before, ...mutation ? { mutation } : {} };
+    const key = mutation ? packageCommandKey(mutation) : void 0;
+    const group = key === void 0 ? void 0 : byCommand.get(key);
+    if (group) group.push(prepared);
+    else {
+      const next = [prepared];
+      groups.push(next);
+      if (key !== void 0) byCommand.set(key, next);
+    }
+  }
+  for (const group of groups) {
+    const first = group[0];
+    if (!first) continue;
+    for (const item of group) onAction?.(item.action);
+    onProgress?.(`  ${group.length > 1 ? "Batch" : "Package"}: ${first.action.resource.manager} ${first.mutation?.args.join(" ") ?? first.action.type} (${group.length} package(s))`);
+    const errors = [];
+    try {
+      if (first.before.migration && first.action.type !== "remove") {
+        await reconcilePackage(first.action.resource, runner);
+      } else if (first.mutation) {
+        await runPackageCommand({ ...first.mutation, targets: group.flatMap((item) => item.mutation?.targets ?? []) }, runner);
+      }
+    } catch (error) {
+      errors.push(error);
+    }
+    for (const { action, before } of group) {
+      try {
+        const after = await inspectPackage(action.resource, runner);
+        const converged = action.type === "remove" ? !after.present : after.matches;
+        if (converged || action.type !== "remove" && after.present && !after.conflict && !after.migration) {
+          await checkpoint(action, before, after);
+          onProgress?.(`  ${converged ? "Done" : "Partial"}: ${action.type} ${action.id} (state saved)`);
+        }
+        if (!converged) errors.push(new Error(`${action.id} did not converge: expected ${action.type === "remove" ? "absent" : action.resource.lockedVersion ?? "no available upgrades"}; installed ${after.installedVersion ?? (after.present ? "version unknown" : "not present")}${after.conflict ? `; ${after.conflict}` : ""}`));
+      } catch (error) {
+        errors.push(error);
+      }
+    }
+    if (errors.length > 0) {
+      throw new AggregateError(errors, `Package batch failed; verified results were saved. ${errors.map((error) => error instanceof Error ? error.message : String(error)).join("; ")}`);
+    }
+  }
+}
+
 // src/reconciliation/apply.ts
 import { mkdir as mkdir8, rmdir } from "fs/promises";
-import { dirname as dirname9 } from "path";
-async function applyPlan(config, runner, onAction) {
-  await mkdir8(dirname9(config.stateFile), { recursive: true, mode: 448 });
+import { dirname as dirname10 } from "path";
+async function applyPlan(config, runner, onAction, onProgress) {
+  await mkdir8(dirname10(config.stateFile), { recursive: true, mode: 448 });
   const guard = `${config.stateFile}.lock`;
   try {
     await mkdir8(guard, { mode: 448 });
@@ -42405,15 +42846,42 @@ async function applyPlan(config, runner, onAction) {
     throw error;
   }
   try {
-    return await reconcile(config, runner, onAction);
+    return await reconcile(config, runner, onAction, onProgress);
   } finally {
     await rmdir(guard);
   }
 }
-async function reconcile(config, runner, onAction) {
-  const actions = await createPlan(config, runner);
+async function reconcile(config, runner, onAction, onProgress) {
+  onProgress?.("Inspecting resources...");
+  const actions = await createPlan(config, runner, onProgress);
+  onProgress?.(`Plan: ${actions.length} action(s).`);
   let state = await readState(config.stateFile, config.context.machine);
-  for (const action of actions) {
+  for (let index = 0; index < actions.length; index++) {
+    const action = actions[index];
+    if (!action) continue;
+    if (isPackageMutation(action)) {
+      const batch = [action];
+      while (index + 1 < actions.length) {
+        const next = actions[index + 1];
+        if (!next || !isPackageMutation(next) || next.type === "remove" !== (action.type === "remove")) break;
+        batch.push(next);
+        index++;
+      }
+      await applyPackageBatch(batch, runner, async (completed, before, after) => {
+        if (completed.type === "update" && after.matches) await removeReplacedMiseVersion(completed, runner);
+        const resources2 = { ...state.resources };
+        if (completed.type === "remove") delete resources2[completed.id];
+        else {
+          resources2[completed.id] = entry(completed, {
+            owned: completed.previous?.owned === true || !before.present,
+            inspection: after
+          });
+        }
+        state = { ...state, resources: resources2 };
+        await writeState(config.stateFile, state);
+      }, onAction, onProgress);
+      continue;
+    }
     onAction?.(action);
     const resources = { ...state.resources };
     switch (action.type) {
@@ -42486,6 +42954,7 @@ async function reconcile(config, runner, onAction) {
     }
     state = { ...state, resources };
     await writeState(config.stateFile, state);
+    onProgress?.(`  Done: ${action.type} ${action.id} (state saved)`);
   }
   return actions;
 }
@@ -42522,9 +42991,24 @@ function entry(action, options) {
 // src/resources/runner.ts
 import { spawn } from "child_process";
 var ProcessRunner = class {
+  /** Opt into command progress and streaming; verbose also prints captured query output. */
+  constructor(logging = {}) {
+    this.logging = logging;
+  }
+  /** Print resource progress only when logging is enabled. */
+  report(message) {
+    if (this.logging.progress || this.logging.verbose) process.stderr.write(`  ${message}
+`);
+  }
   /** Execute a command directly and return captured output and its exit code; spawn failures reject. */
   async run(command, args, options) {
-    return await new Promise((resolve10, reject) => {
+    const started = Date.now();
+    if (this.logging.progress || this.logging.verbose) {
+      process.stderr.write(`  $ ${[command, ...args].map((value2) => /^[\w./:@=+-]+$/.test(value2) ? value2 : JSON.stringify(value2)).join(" ")}${options?.cwd ? ` (in ${options.cwd})` : ""}
+`);
+    }
+    const stream = this.logging.verbose || this.logging.progress && options?.streamOutput;
+    return await new Promise((resolve12, reject) => {
       const child = spawn(command, [...args], {
         cwd: options?.cwd,
         env: { ...process.env, ...options?.environment },
@@ -42534,20 +43018,29 @@ var ProcessRunner = class {
       let stderr = "";
       child.stdout.setEncoding("utf8");
       child.stderr.setEncoding("utf8");
-      child.stdout.on("data", (chunk) => stdout += chunk);
-      child.stderr.on("data", (chunk) => stderr += chunk);
+      child.stdout.on("data", (chunk) => {
+        stdout += chunk;
+        if (stream) process.stdout.write(chunk);
+      });
+      child.stderr.on("data", (chunk) => {
+        stderr += chunk;
+        if (stream || this.logging.progress) process.stderr.write(chunk);
+      });
       child.once("error", reject);
-      child.once(
-        "close",
-        (exitCode) => resolve10({ exitCode: exitCode ?? 1, stdout, stderr })
-      );
+      child.once("close", (exitCode) => {
+        if (this.logging.progress || this.logging.verbose) {
+          process.stderr.write(`  -> exit ${exitCode ?? 1} (${((Date.now() - started) / 1e3).toFixed(1)}s)
+`);
+        }
+        resolve12({ exitCode: exitCode ?? 1, stdout, stderr });
+      });
     });
   }
 };
 
 // src/persistence/lock.ts
-import { readFile as readFile8, rename as rename6, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname10, resolve as resolve8 } from "path";
+import { readFile as readFile9, rename as rename7, writeFile as writeFile5 } from "fs/promises";
+import { dirname as dirname11, resolve as resolve10 } from "path";
 
 // src/resources/package-version.ts
 async function resolvePackageVersion(resource, runner) {
@@ -42573,22 +43066,31 @@ async function resolvePackageVersion(resource, runner) {
       const version = await readAvailableBrewVersion(resource, runner);
       return version === "latest" ? void 0 : version;
     }
+    case "dnf":
+    case "yum":
+      return await resolveRpmVersion(resource, runner);
     case "system":
       throw new Error("System package manager must be resolved before locking");
+    case "pacman":
+      return await resolvePacmanVersion(resource, runner);
+    case "flatpak":
+      return await resolveFlatpakVersion(resource, runner);
+    case "mas":
+      return void 0;
   }
 }
 
 // src/persistence/lock.ts
 var LOCK_VERSION = 1;
 function lockPath(configPath) {
-  return resolve8(dirname10(configPath), "workstation.lock");
+  return resolve10(dirname11(configPath), "workstation.lock");
 }
 async function lockConfig(configPath, config, runner) {
   const path = lockPath(configPath);
   const previousText = await readOptional(path);
   const previous = previousText === void 0 ? emptyLock() : parseLock(previousText, path);
-  const target = previous.targets.find(({ machine }) => machine === config.context.machine);
-  const existing = new Map(target?.resources.map((entry2) => [entry2.id, entry2]));
+  const target2 = previous.targets.find(({ machine }) => machine === config.context.machine);
+  const existing = new Map(target2?.resources.map((entry2) => [entry2.id, entry2]));
   const resources = [];
   const entries = [];
   for (const resource of config.resources) {
@@ -42632,10 +43134,10 @@ function emptyLock() {
 function stringifyLock(lock) {
   return stringify({
     version: lock.version,
-    targets: lock.targets.map((target) => ({
-      machine: target.machine,
-      platform: target.platform,
-      resources: target.resources.map((entry2) => ({
+    targets: lock.targets.map((target2) => ({
+      machine: target2.machine,
+      platform: target2.platform,
+      resources: target2.resources.map((entry2) => ({
         id: entry2.id,
         fingerprint: entry2.fingerprint,
         ...entry2.lockedVersion ? { locked_version: entry2.lockedVersion } : {}
@@ -42651,19 +43153,19 @@ function parseLock(text, path) {
   if (!Array.isArray(document2.targets)) throw new Error(`Lock targets must be an array in ${path}`);
   const machines = /* @__PURE__ */ new Set();
   const targets = document2.targets.map((value2, targetIndex) => {
-    const target = requireTable2(value2, `targets[${targetIndex}]`);
-    const machine = requireString2(target.machine, `targets[${targetIndex}].machine`);
+    const target2 = requireTable2(value2, `targets[${targetIndex}]`);
+    const machine = requireString2(target2.machine, `targets[${targetIndex}].machine`);
     if (machines.has(machine)) throw new Error(`Duplicate machine ${machine} in ${path}`);
     machines.add(machine);
-    const platform = requireString2(target.platform, `targets[${targetIndex}].platform`);
+    const platform = requireString2(target2.platform, `targets[${targetIndex}].platform`);
     if (platform !== "darwin" && platform !== "linux") {
       throw new Error(`Invalid platform for ${machine} in ${path}`);
     }
-    if (!Array.isArray(target.resources)) {
+    if (!Array.isArray(target2.resources)) {
       throw new Error(`Lock resources for ${machine} must be an array in ${path}`);
     }
     const ids = /* @__PURE__ */ new Set();
-    const resources = target.resources.map((value3, resourceIndex) => {
+    const resources = target2.resources.map((value3, resourceIndex) => {
       const entry2 = requireTable2(value3, `targets[${targetIndex}].resources[${resourceIndex}]`);
       const id = requireString2(entry2.id, "lock resource id");
       if (ids.has(id)) throw new Error(`Duplicate resource ${id} for ${machine} in ${path}`);
@@ -42690,7 +43192,7 @@ function requireString2(value2, field) {
 }
 async function readOptional(path) {
   try {
-    return await readFile8(path, "utf8");
+    return await readFile9(path, "utf8");
   } catch (error) {
     if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") {
       return void 0;
@@ -42701,7 +43203,7 @@ async function readOptional(path) {
 async function atomicWrite2(path, contents) {
   const temporary = `${path}.${process.pid}.tmp`;
   await writeFile5(temporary, contents, { mode: 420 });
-  await rename6(temporary, path);
+  await rename7(temporary, path);
 }
 
 // src/resources/tasks.ts
@@ -42718,7 +43220,7 @@ async function runTask(config, name, args, runner) {
 
 // src/config/init.ts
 import { mkdir as mkdir9, writeFile as writeFile6 } from "fs/promises";
-import { dirname as dirname11, resolve as resolve9 } from "path";
+import { dirname as dirname12, resolve as resolve11 } from "path";
 var starter = `import type { ConfigDefinition } from "@dovocode/workstation";
 
 export default {
@@ -42739,17 +43241,17 @@ export default {
 } satisfies ConfigDefinition;
 `;
 async function initConfig(path = "workstation.config.ts") {
-  const target = resolve9(path);
-  await mkdir9(dirname11(target), { recursive: true });
+  const target2 = resolve11(path);
+  await mkdir9(dirname12(target2), { recursive: true });
   try {
-    await writeFile6(target, starter, { encoding: "utf8", flag: "wx" });
+    await writeFile6(target2, starter, { encoding: "utf8", flag: "wx" });
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "EEXIST") {
-      throw new Error(`Configuration already exists: ${target}. No changes made.`, { cause: error });
+      throw new Error(`Configuration already exists: ${target2}. No changes made.`, { cause: error });
     }
     throw error;
   }
-  return target;
+  return target2;
 }
 
 // src/cli.ts
@@ -42763,27 +43265,27 @@ async function main() {
     return;
   }
   const sourcePath = await findConfig(options.config);
+  if (!options.listTasks && !options.task) console.log(`Loading configuration: ${sourcePath}`);
   const sourceConfig = await loadConfig(sourcePath, options.machine);
-  const runner = new ProcessRunner();
+  const runner = new ProcessRunner({ progress: !options.listTasks, verbose: options.verbose });
   if (options.listTasks) {
     for (const [name, task] of Object.entries(sourceConfig.tasks ?? {})) console.log(`${name}${task.description ? `  ${task.description}` : ""}`);
-    for (const [name, target] of Object.entries(sourceConfig.aliases ?? {})) console.log(`${name} -> ${target}`);
+    for (const [name, target2] of Object.entries(sourceConfig.aliases ?? {})) console.log(`${name} -> ${target2}`);
     return;
   }
   if (options.task) {
-    const result = await runTask(sourceConfig, options.task, options.taskArgs, runner);
-    process.stdout.write(result.stdout);
-    process.stderr.write(result.stderr);
+    const result = await runTask(sourceConfig, options.task, options.taskArgs, new ProcessRunner({ progress: true, verbose: true }));
     process.exitCode = result.exitCode;
     return;
   }
+  console.log(`Resolving package versions for ${sourceConfig.context.machine} (${sourceConfig.resources.length} resources)...`);
   const locked = await lockConfig(sourcePath, sourceConfig, runner);
+  console.log(`Lock: ${locked.path}${locked.changed ? " (updated)" : " (unchanged)"}`);
   const outputPath = manifestPath(locked.config);
   await writeManifest(outputPath, locked.config);
-  const config = await readManifest(outputPath);
-  const actions = await applyPlan(config, runner, printAction);
-  console.log(`Lock: ${locked.path}${locked.changed ? " (updated)" : ""}`);
   console.log(`Manifest: ${outputPath}`);
+  const config = await readManifest(outputPath);
+  const actions = await applyPlan(config, runner, printAction, (message) => console.log(message));
   console.log(
     actions.length === 0 ? "Workstation is already converged." : `Reconciled ${actions.length} action(s).`
   );
@@ -42795,11 +43297,14 @@ function parseArguments(args) {
   let taskArgs = [];
   let listTasks = false;
   let init = false;
+  let verbose = false;
   for (let index = 0; index < args.length; index += 1) {
     const argument = args[index];
     if (argument === "init") {
       if (init) throw new Error("init may only be specified once");
       init = true;
+    } else if (argument === "--verbose" || argument === "-v") {
+      verbose = true;
     } else if (argument === "--list-tasks") {
       listTasks = true;
     } else if (argument && !argument.startsWith("-") && argument !== "help") {
@@ -42820,7 +43325,7 @@ function parseArguments(args) {
   }
   if (listTasks && task) throw new Error("--list-tasks cannot be combined with a task name");
   if (init && (task || listTasks || machine)) throw new Error("init supports only --config PATH and --help");
-  return { init, taskArgs, listTasks, ...task ? { task } : {}, ...config ? { config } : {}, ...machine ? { machine } : {} };
+  return { init, verbose, taskArgs, listTasks, ...task ? { task } : {}, ...config ? { config } : {}, ...machine ? { machine } : {} };
 }
 function requireValue(args, index, option) {
   const value2 = args[index];
@@ -42843,6 +43348,7 @@ Options:
   --config PATH    Configuration entry point (default: workstation.config.ts)
   --machine NAME   Override the short hostname
   --list-tasks     List configured tasks and aliases
+  -v, --verbose    Also stream inspection and version-query output
   -h, --help       Show this help`);
 }
 main().catch((error) => {