@dovocode/workstation 0.1.0 → 0.1.1

package/dist/index.d.ts

@@ -1,5 +1,11 @@
 type Platform = "darwin" | "linux";
-type PackageManager = "mise" | "brew" | "brew-cask" | "apt" | "system";
+type PackageManager = "mise" | "brew" | "brew-cask" | "apt" | "dnf" | "yum" | "pacman" | "flatpak" | "mas" | "system";
+/** Flatpak installation target; the selected remote must already be configured. */
+interface FlatpakOptions {
+    readonly scope?: "user" | "system";
+    readonly remote?: string;
+    readonly branch?: string;
+}
 /** Homebrew cask upgrade behavior. */
 interface BrewCaskUpgradeOptions {
     /** Include auto-updating casks and refresh their lock pins on each run. */
@@ -26,6 +32,7 @@ interface PackageResource {
     readonly name: string;
     readonly version?: string;
     readonly upgrade?: BrewCaskUpgradeOptions;
+    readonly flatpak?: FlatpakOptions;
 }
 interface ResolvedPackageResource extends PackageResource {
     /** Concrete version resolved into workstation.lock. */
@@ -163,10 +170,14 @@ interface CommandResult {
 }
 /** Command execution boundary, replaceable in tests or embedded integrations. */
 interface Runner {
+    /** Report a resource-level progress message when supported by the host. */
+    report?(message: string): void;
     /** Execute a command directly and return captured output and its exit code; spawn failures reject. */
     run(command: string, args: readonly string[], options?: RunOptions): Promise<CommandResult>;
 }
 interface RunOptions {
+    /** Stream captured output when the process runner has progress logging enabled. */
+    readonly streamOutput?: boolean;
     readonly cwd?: string;
     readonly environment?: Readonly<Record<string, string>>;
 }
@@ -239,7 +250,17 @@ declare const tools: {
     brewCask: (packages: readonly string[], upgrade?: BrewCaskUpgradeOptions) => PackageResource[];
     /** Install Debian/Ubuntu packages through APT. Mutations request sudo. */
     apt: (packages: readonly string[]) => PackageResource[];
-    /** Use the configured platform manager; defaults to Homebrew on macOS and APT on Linux. */
+    /** Install RPM packages through DNF. Mutations request sudo. */
+    dnf: (packages: readonly string[]) => PackageResource[];
+    /** Install RPM packages through legacy YUM. Mutations request sudo. */
+    yum: (packages: readonly string[]) => PackageResource[];
+    /** Install Arch Linux repository packages through pacman; does not refresh databases or upgrade the whole system. */
+    pacman: (packages: readonly string[]) => PackageResource[];
+    /** Install Flatpak app IDs; defaults to the user's flathub remote and stable branch. */
+    flatpak: (packages: readonly string[], options?: FlatpakOptions) => PackageResource[];
+    /** Install previously acquired Mac App Store apps by numeric ID; follows available updates without version pins. */
+    mas: (ids: readonly (string | number)[]) => PackageResource[];
+    /** Use the configured manager, Homebrew on macOS, or detect APT/DNF/YUM/pacman on Linux. */
     system: (packages: readonly string[]) => PackageResource[];
 };
 /**
@@ -518,8 +539,16 @@ declare function lockConfig(configPath: string, config: ResolvedConfig, runner:
 
 /** Run child processes directly, inheriting stdin and capturing stdout/stderr. No implicit shell is used. */
 declare class ProcessRunner implements Runner {
+    private readonly logging;
+    /** Opt into command progress and streaming; verbose also prints captured query output. */
+    constructor(logging?: {
+        readonly progress?: boolean;
+        readonly verbose?: boolean;
+    });
+    /** Print resource progress only when logging is enabled. */
+    report(message: string): void;
     /** Execute a command directly and return captured output and its exit code; spawn failures reject. */
     run(command: string, args: readonly string[], options?: RunOptions): Promise<CommandResult>;
 }
 
-export { type Action, type ActionType, type BrewCaskUpgradeOptions, type CommandResult, type CommandSpec, type ConfigDefinition, type ConfigFactory, type ConfigInput, type ConfigValue, type Context, type CustomToolResource, type GeneratedFileOptions, type GeneratedFileResource, type IfExistsPolicy, type JsoncCommand, JsoncDocument, type JsoncLine, type LaunchAgentResource, type LockedConfigResult, type OriginalFile, type PackageManager, type PackageResource, type Platform, ProcessRunner, type ResolvedConfig, type ResolvedPackageResource, type ResolvedResource, type Resource, type ResourceInput, type RunOptions, type Runner, type Shell, type ShellCommand, type ShellCondition, type ShellExpression, type ShellFileOptions, type ShellStatement, type ShellValue, type StateEntry, type StructuredFormat, type SymlinkResource, type SystemdScope, type SystemdServiceResource, type TaskDefinition, type WorkstationConfig, type WorkstationState, bash, configure, customTool, darwin, defineConfig, files, findConfig, fingerprint, jsonc, launchAgent, linux, loadConfig, lockConfig, lockPath, machine, manifestPath, readManifest, renderShell, resourceId, runTask, shell, symlink, systemdService, task, tools, when, writeManifest, zsh };
+export { type Action, type ActionType, type BrewCaskUpgradeOptions, type CommandResult, type CommandSpec, type ConfigDefinition, type ConfigFactory, type ConfigInput, type ConfigValue, type Context, type CustomToolResource, type FlatpakOptions, type GeneratedFileOptions, type GeneratedFileResource, type IfExistsPolicy, type JsoncCommand, JsoncDocument, type JsoncLine, type LaunchAgentResource, type LockedConfigResult, type OriginalFile, type PackageManager, type PackageResource, type Platform, ProcessRunner, type ResolvedConfig, type ResolvedPackageResource, type ResolvedResource, type Resource, type ResourceInput, type RunOptions, type Runner, type Shell, type ShellCommand, type ShellCondition, type ShellExpression, type ShellFileOptions, type ShellStatement, type ShellValue, type StateEntry, type StructuredFormat, type SymlinkResource, type SystemdScope, type SystemdServiceResource, type TaskDefinition, type WorkstationConfig, type WorkstationState, bash, configure, customTool, darwin, defineConfig, files, findConfig, fingerprint, jsonc, launchAgent, linux, loadConfig, lockConfig, lockPath, machine, manifestPath, readManifest, renderShell, resourceId, runTask, shell, symlink, systemdService, task, tools, when, writeManifest, zsh };

package/dist/index.js

@@ -109,11 +109,11 @@ function resolveTasks(definition, context) {
     const cwd = value.cwd?.replace(/^~(?=\/|$)/, context.home) ?? context.configDir;
     tasks[name] = { ...value, cwd: isAbsolute(cwd) ? cwd : resolve(context.configDir, cwd) };
   }
-  for (const [name, target] of Object.entries(definition.aliases ?? {})) {
+  for (const [name, target2] of Object.entries(definition.aliases ?? {})) {
     validateName(name);
     if (Object.hasOwn(tasks, name)) throw new Error(`Task and alias share a name: ${name}`);
-    if (typeof target !== "string") throw new Error(`Invalid alias target: ${name}`);
-    aliases[name] = target;
+    if (typeof target2 !== "string") throw new Error(`Invalid alias target: ${name}`);
+    aliases[name] = target2;
   }
   for (const name of Object.keys(aliases)) resolveTaskName(name, tasks, aliases);
   return { tasks, aliases };
@@ -124,9 +124,9 @@ function resolveTaskName(name, tasks, aliases) {
   while (Object.hasOwn(aliases, current)) {
     if (visited.has(current)) throw new Error(`Task alias cycle: ${[...visited, current].join(" -> ")}`);
     visited.add(current);
-    const target = aliases[current];
-    if (target === void 0) throw new Error(`Invalid alias: ${current}`);
-    current = target;
+    const target2 = aliases[current];
+    if (target2 === void 0) throw new Error(`Invalid alias: ${current}`);
+    current = target2;
   }
   if (!Object.hasOwn(tasks, current)) throw new Error(`Unknown task: ${current}`);
   return current;
@@ -179,20 +179,35 @@ var tools = {
   brewCask: (packages, upgrade) => packageList("brew-cask", packages, upgrade),
   /** Install Debian/Ubuntu packages through APT. Mutations request sudo. */
   apt: (packages) => packageList("apt", packages),
-  /** Use the configured platform manager; defaults to Homebrew on macOS and APT on Linux. */
+  /** Install RPM packages through DNF. Mutations request sudo. */
+  dnf: (packages) => packageList("dnf", packages),
+  /** Install RPM packages through legacy YUM. Mutations request sudo. */
+  yum: (packages) => packageList("yum", packages),
+  /** Install Arch Linux repository packages through pacman; does not refresh databases or upgrade the whole system. */
+  pacman: (packages) => packageList("pacman", packages),
+  /** Install Flatpak app IDs; defaults to the user's flathub remote and stable branch. */
+  flatpak: (packages, options = {}) => packages.map((name) => ({ kind: "package", manager: "flatpak", name, flatpak: { ...options } })),
+  /** Install previously acquired Mac App Store apps by numeric ID; follows available updates without version pins. */
+  mas: (ids) => ids.map((id) => {
+    if (typeof id === "number" && !Number.isSafeInteger(id) || !/^[1-9]\d*$/.test(String(id))) {
+      throw new Error(`Invalid Mac App Store ID: ${id}`);
+    }
+    return { kind: "package", manager: "mas", name: String(id) };
+  }),
+  /** Use the configured manager, Homebrew on macOS, or detect APT/DNF/YUM/pacman on Linux. */
   system: (packages) => packageList("system", packages)
 };
-function symlink(source, target) {
-  return { kind: "symlink", source, target };
+function symlink(source, target2) {
+  return { kind: "symlink", source, target: target2 };
 }
 function launchAgent(label, options) {
   return { kind: "launch-agent", label, ...options };
 }
-function generatedFile(format, target, value, options = {}) {
+function generatedFile(format, target2, value, options = {}) {
   return {
     kind: "generated-file",
     format,
-    target,
+    target: target2,
     value,
     ifExists: options.ifExists ?? "overwrite",
     ...options.mode !== void 0 ? { mode: options.mode } : {}
@@ -203,16 +218,16 @@ var files = {
    * Generate TOML. Values must be representable in TOML (for example, no null).
    * @example files.toml("~/.config/app/config.toml", { server: { port: 3000 } })
    */
-  toml: (target, value, options) => generatedFile("toml", target, value, options),
+  toml: (target2, value, options) => generatedFile("toml", target2, value, options),
   /** Generate YAML with the standard overwrite/restore policy. */
-  yaml: (target, value, options) => generatedFile("yaml", target, value, options),
+  yaml: (target2, value, options) => generatedFile("yaml", target2, value, options),
   /**
    * Generate formatted JSON.
    * @example files.json("~/.config/app/config.json", { enabled: true })
    */
-  json: (target, value, options) => generatedFile("json", target, value, options),
+  json: (target2, value, options) => generatedFile("json", target2, value, options),
   /** Generate JSONC from plain data or jsonc.concat/object commands with comments. */
-  jsonc: (target, value, options) => value instanceof JsoncDocument ? { ...generatedFile("jsonc", target, null, options), renderedContent: value.content } : generatedFile("jsonc", target, value, options)
+  jsonc: (target2, value, options) => value instanceof JsoncDocument ? { ...generatedFile("jsonc", target2, null, options), renderedContent: value.content } : generatedFile("jsonc", target2, value, options)
 };
 function systemdService(name, options) {
   return { kind: "systemd-service", name, scope: options.scope ?? "user", ...options };
@@ -392,21 +407,21 @@ var bash = {
   /** Generate ~/.profile using Bash syntax; use only where Bash will read it. */
   profile: (statements, options) => shellFile("bash", "~/.profile", statements, options)
 };
-function renderShell(statements, target) {
-  return `${statements.map((statement) => renderStatement(statement, target, 0)).join("\n")}
+function renderShell(statements, target2) {
+  return `${statements.map((statement) => renderStatement(statement, target2, 0)).join("\n")}
 `;
 }
-function shellFile(format, target, statements, options = {}) {
+function shellFile(format, target2, statements, options = {}) {
   return {
     kind: "generated-file",
-    target,
+    target: target2,
     format,
     value: renderShell(statements, format),
     ifExists: options.ifExists ?? "overwrite",
     mode: options.mode ?? 420
   };
 }
-function renderStatement(statement, target, depth) {
+function renderStatement(statement, target2, depth) {
   const indent = "  ".repeat(depth);
   switch (statement.kind) {
     case "export":
@@ -428,11 +443,11 @@ function renderStatement(statement, target, depth) {
     case "if":
       return [
         `${indent}if ${renderCondition(statement.condition)}; then`,
-        ...statement.statements.map((child) => renderStatement(child, target, depth + 1)),
+        ...statement.statements.map((child) => renderStatement(child, target2, depth + 1)),
         `${indent}fi`
       ].join("\n");
     case "zsh-setopt":
-      if (target !== "zsh") throw new Error("setopt is only valid in Zsh configuration");
+      if (target2 !== "zsh") throw new Error("setopt is only valid in Zsh configuration");
       return `${indent}setopt ${statement.options.join(" ")}`;
     case "raw":
       return statement.code.split("\n").map((line) => `${indent}${line}`).join("\n");
@@ -495,14 +510,15 @@ function validateVariable(name) {
 
 // src/config/load.ts
 import { hostname as readHostname, homedir, platform as readPlatform } from "os";
-import { dirname, isAbsolute as isAbsolute2, resolve as resolve3 } from "path";
-import { access } from "fs/promises";
+import { dirname, isAbsolute as isAbsolute2, resolve as resolve4 } from "path";
+import { access as access2 } from "fs/promises";
 
 // src/config/identity.ts
 import { createHash } from "crypto";
 function resourceId(resource) {
   switch (resource.kind) {
     case "package":
+      if (resource.manager === "flatpak") return `package:flatpak:${resource.flatpak?.scope ?? "user"}:${resource.name}:${resource.flatpak?.branch ?? "stable"}`;
       return `package:${resource.manager}:${resource.name}`;
     case "symlink":
       return `file:${resource.target}`;
@@ -557,6 +573,20 @@ async function addPathToHash(hash, path, relativePath) {
   }
 }
 
+// src/config/package-options.ts
+function isFlatpakOptions(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const options = value;
+  return Object.keys(options).every((key) => ["scope", "remote", "branch"].includes(key)) && (options.scope === void 0 || options.scope === "user" || options.scope === "system") && [options.remote, options.branch].every((field) => field === void 0 || typeof field === "string" && /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(field));
+}
+function isPackageName(manager, name) {
+  if (typeof name !== "string" || name.length === 0) return false;
+  if (manager === "mas") return /^[1-9]\d*$/.test(name);
+  if (manager === "flatpak") return /^[A-Za-z_][A-Za-z0-9_-]*(?:\.[A-Za-z_][A-Za-z0-9_-]*){2,}$/.test(name);
+  if (manager === "pacman") return /^[A-Za-z0-9@_+][A-Za-z0-9@._+-]*$/.test(name);
+  return true;
+}
+
 // src/config/validation.ts
 function validateResource(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
@@ -565,7 +595,7 @@ function validateResource(value) {
   const candidate = value;
   switch (candidate.kind) {
     case "package":
-      if (!["mise", "brew", "brew-cask", "apt", "system"].includes(String(candidate.manager)) || typeof candidate.name !== "string" || candidate.name.length === 0 || candidate.version !== void 0 && typeof candidate.version !== "string" || !isBrewCaskUpgradeOptions(candidate.upgrade)) {
+      if (!["mise", "brew", "brew-cask", "apt", "dnf", "yum", "pacman", "flatpak", "mas", "system"].includes(String(candidate.manager)) || !isPackageName(candidate.manager, candidate.name) || candidate.flatpak !== void 0 && (!["flatpak", "system"].includes(String(candidate.manager)) || !isFlatpakOptions(candidate.flatpak)) || candidate.version !== void 0 && typeof candidate.version !== "string" || !isBrewCaskUpgradeOptions(candidate.upgrade)) {
         throw new Error("Invalid package resource");
       }
       return;
@@ -622,12 +652,33 @@ function isBrewCaskUpgradeOptions(value) {
 
 // src/config/load.ts
 import { createJiti } from "jiti/static";
+
+// src/config/system-manager.ts
+import { access, stat } from "fs/promises";
+import { constants } from "fs";
+import { delimiter, resolve as resolve3 } from "path";
+async function detectLinuxManager(searchPath = process.env.PATH ?? "") {
+  for (const [manager, command] of [["apt", "apt-get"], ["dnf", "dnf"], ["yum", "yum"], ["pacman", "pacman"]]) {
+    for (const directory of searchPath.split(delimiter).filter(Boolean)) {
+      const path = resolve3(directory, command);
+      try {
+        await access(path, constants.X_OK);
+        if ((await stat(path)).isFile()) return manager;
+      } catch (error) {
+        if (!(error instanceof Error && "code" in error && ["ENOENT", "ENOTDIR", "EACCES"].includes(String(error.code)))) throw error;
+      }
+    }
+  }
+  throw new Error("No supported Linux package manager found on PATH (apt-get, dnf, yum, pacman). Install one or set managers.linux explicitly.");
+}
+
+// src/config/load.ts
 var DEFAULT_CONFIG_FILE = "workstation.config.ts";
 async function findConfig(explicit) {
-  if (explicit) return resolve3(explicit);
-  const path = resolve3(DEFAULT_CONFIG_FILE);
+  if (explicit) return resolve4(explicit);
+  const path = resolve4(DEFAULT_CONFIG_FILE);
   try {
-    await access(path);
+    await access2(path);
     return path;
   } catch {
     throw new Error(`No configuration found (${DEFAULT_CONFIG_FILE})`);
@@ -673,7 +724,11 @@ async function loadConfig(configPath, machineOverride) {
 }
 async function resolveResource(resource, definition, context) {
   if (resource.kind === "package") {
-    const manager = resolveManager(resource.manager, definition, context);
+    const manager = await resolveManager(resource.manager, definition, context);
+    if (!isPackageName(manager, resource.name)) throw new Error(`Invalid ${manager} package ID: ${resource.name}`);
+    if ((manager === "pacman" || manager === "flatpak") && context.platform !== "linux") throw new Error(`${manager} requires Linux`);
+    if (manager === "mas" && context.platform !== "darwin") throw new Error("mas requires macOS");
+    if (resource.flatpak !== void 0 && manager !== "flatpak") throw new Error(`Flatpak options require the flatpak backend (${resource.name})`);
     if (resource.upgrade !== void 0 && manager !== "brew-cask") {
       throw new Error(`Upgrade options are only supported for Homebrew casks (${resource.name})`);
     }
@@ -683,7 +738,11 @@ async function resolveResource(resource, definition, context) {
     if (resource.version !== void 0) {
       throw new Error(`${manager} package ${resource.name} cannot declare a version`);
     }
-    return { ...resource, manager };
+    return { ...resource, manager, ...manager === "flatpak" ? { flatpak: {
+      scope: resource.flatpak?.scope ?? "user",
+      remote: resource.flatpak?.remote ?? "flathub",
+      branch: resource.flatpak?.branch ?? "stable"
+    } } : {} };
   }
   if (resource.kind === "symlink") {
     return {
@@ -707,11 +766,11 @@ async function resolveResource(resource, definition, context) {
   }
   if (resource.kind === "custom-tool") {
     const source = expandPath(resource.source, context, true);
-    const target = expandPath(resource.target, context, false);
+    const target2 = expandPath(resource.target, context, false);
     return {
       ...resource,
       source,
-      target,
+      target: target2,
       sourceHash: await hashSource(source),
       build: {
         ...resource.build,
@@ -729,14 +788,16 @@ async function resolveResource(resource, definition, context) {
     ...resource.stderrPath ? { stderrPath: expandPath(resource.stderrPath, context, false) } : {}
   };
 }
-function resolveManager(manager, definition, context) {
+async function resolveManager(manager, definition, context) {
   if (manager !== "system") return manager;
-  return definition.managers?.[context.platform] ?? (context.platform === "darwin" ? "brew" : "apt");
+  const configured = definition.managers?.[context.platform];
+  if (configured !== void 0) return configured;
+  return context.platform === "darwin" ? "brew" : await detectLinuxManager();
 }
 function expandPath(path, context, relativeToConfig) {
   const expanded = path === "~" ? context.home : path.replace(/^~\//, `${context.home}/`);
-  if (isAbsolute2(expanded)) return resolve3(expanded);
-  return resolve3(relativeToConfig ? context.configDir : context.home, expanded);
+  if (isAbsolute2(expanded)) return resolve4(expanded);
+  return resolve4(relativeToConfig ? context.configDir : context.home, expanded);
 }
 function flatten2(input) {
   if (!input) return [];
@@ -774,11 +835,11 @@ function mergeDefinitions(definitions) {
 
 // src/persistence/manifest.ts
 import { mkdir, readFile as readFile2, rename, writeFile } from "fs/promises";
-import { dirname as dirname2, resolve as resolve4 } from "path";
+import { dirname as dirname2, resolve as resolve5 } from "path";
 import { parse, stringify } from "smol-toml";
 var MANIFEST_VERSION = 1;
 function manifestPath(config) {
-  return resolve4(dirname2(config.stateFile), "config.toml");
+  return resolve5(dirname2(config.stateFile), "config.toml");
 }
 async function writeManifest(path, config) {
   const document = {
@@ -820,6 +881,11 @@ function toTomlResource(resource) {
         name: resource.name,
         ...resource.version ? { version: resource.version } : {},
         ...resource.lockedVersion ? { locked_version: resource.lockedVersion } : {},
+        ...resource.flatpak ? { flatpak: {
+          ...resource.flatpak.scope ? { scope: resource.flatpak.scope } : {},
+          ...resource.flatpak.remote ? { remote: resource.flatpak.remote } : {},
+          ...resource.flatpak.branch ? { branch: resource.flatpak.branch } : {}
+        } } : {},
         ...resource.upgrade ? {
           upgrade: {
             ...resource.upgrade.greedy !== void 0 ? { greedy: resource.upgrade.greedy } : {},
@@ -970,6 +1036,9 @@ function parsePackage(value) {
   if (!isPackageManager(manager)) {
     throw new Error(`Invalid manifest package manager: ${manager}`);
   }
+  if (!isPackageName(manager, value.name)) throw new Error(`Invalid ${manager} package ID`);
+  if (value.flatpak !== void 0 && (manager !== "flatpak" || !isFlatpakOptions(value.flatpak))) throw new Error("Invalid Flatpak options");
+  if (manager === "mas" && value.locked_version !== void 0) throw new Error("mas does not support version pins");
   const upgrade = value.upgrade === void 0 ? void 0 : requireTable(value.upgrade, "package.upgrade");
   if (value.version !== void 0 && manager !== "mise") {
     throw new Error(`Manifest ${manager} package cannot declare a version`);
@@ -981,6 +1050,7 @@ function parsePackage(value) {
     kind: "package",
     manager,
     name: requireString(value.name, "package.name"),
+    ...isFlatpakOptions(value.flatpak) ? { flatpak: value.flatpak } : {},
     ...value.version !== void 0 ? { version: requireString(value.version, "package.version") } : {},
     ...value.locked_version !== void 0 ? { lockedVersion: requireString(value.locked_version, "package.locked_version") } : {},
     ...upgrade ? {
@@ -1000,13 +1070,13 @@ function parseSymlink(value) {
 }
 function parseLaunchAgent(value) {
   const args = value.args === void 0 ? void 0 : requireStringArray(value.args, "launch-agent.args");
-  const environment = value.environment === void 0 ? void 0 : requireStringTable(value.environment, "launch-agent.environment");
+  const environment3 = value.environment === void 0 ? void 0 : requireStringTable(value.environment, "launch-agent.environment");
   return {
     kind: "launch-agent",
     label: requireString(value.label, "launch-agent.label"),
     program: requireString(value.program, "launch-agent.program"),
     ...args ? { args } : {},
-    ...environment ? { environment } : {},
+    ...environment3 ? { environment: environment3 } : {},
     ...value.run_at_load !== void 0 ? { runAtLoad: requireBoolean(value.run_at_load, "launch-agent.run_at_load") } : {},
     ...value.keep_alive !== void 0 ? { keepAlive: requireBoolean(value.keep_alive, "launch-agent.keep_alive") } : {},
     ...value.stdout_path !== void 0 ? { stdoutPath: requireString(value.stdout_path, "launch-agent.stdout_path") } : {},
@@ -1043,7 +1113,7 @@ function requireStringTable(value, field) {
   return result;
 }
 function isPackageManager(value) {
-  return value === "mise" || value === "brew" || value === "brew-cask" || value === "apt";
+  return value === "mise" || value === "brew" || value === "brew-cask" || value === "apt" || value === "dnf" || value === "yum" || value === "pacman" || value === "flatpak" || value === "mas";
 }
 function isConfigValue2(value) {
   if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) {
@@ -1055,7 +1125,7 @@ function isConfigValue2(value) {
 
 // src/persistence/lock.ts
 import { readFile as readFile3, rename as rename3, writeFile as writeFile3 } from "fs/promises";
-import { dirname as dirname3, resolve as resolve5 } from "path";
+import { dirname as dirname3, resolve as resolve6 } from "path";
 import { parse as parse2, stringify as stringify2 } from "smol-toml";
 
 // src/resources/shared.ts
@@ -1103,6 +1173,69 @@ function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+// src/resources/rpm.ts
+var environment = { LC_ALL: "C" };
+var versionPattern = /^\d+:[A-Za-z0-9._+~^]+-[A-Za-z0-9._+~^]+\.[A-Za-z0-9_]+$/;
+async function resolveRpmVersion(resource, runner) {
+  const architecture = (await requireSuccess(runner, "rpm", ["--eval", "%{_arch}"], { environment })).stdout.trim();
+  if (!/^[A-Za-z0-9_]+$/.test(architecture)) throw new Error("RPM did not report a valid native architecture");
+  const result = await requireSuccess(runner, resource.manager, ["--quiet", "--color=never", "list", resource.name], { environment });
+  const candidates = [];
+  let available = false;
+  const lines = result.stdout.replace(/^(\S+\.\S+)\n[ \t]+(?=\S+\s+\S+)/gm, "$1 ").split("\n");
+  for (const line of lines) {
+    if (/^Available packages\s*$/i.test(line.trim())) {
+      available = true;
+      continue;
+    }
+    if (/^Installed packages\s*$/i.test(line.trim())) {
+      available = false;
+      continue;
+    }
+    const [nameArch, evr, repository] = line.trim().split(/\s+/);
+    if (!nameArch || !evr || !repository) continue;
+    const dot = nameArch.lastIndexOf(".");
+    const name = nameArch.slice(0, dot);
+    const arch = nameArch.slice(dot + 1);
+    if (nameArch !== resource.name && (name !== resource.name || arch !== architecture && arch !== "noarch")) continue;
+    const version = `${evr.includes(":") ? evr : `0:${evr}`}.${arch}`;
+    if (!versionPattern.test(version)) throw new Error(`${resource.manager} reported an invalid RPM version for ${resource.name}: ${version}`);
+    candidates.push({ version, native: arch === architecture, available });
+  }
+  candidates.sort((left, right) => Number(right.available) - Number(left.available) || Number(right.native) - Number(left.native));
+  const candidate = candidates[0];
+  if (!candidate) throw new Error(`${resource.manager} has no installation candidate for ${resource.name}`);
+  return candidate.version;
+}
+
+// src/resources/pacman.ts
+var environment2 = { LC_ALL: "C" };
+async function resolvePacmanVersion(resource, runner) {
+  const result = await requireSuccess(runner, "pacman", ["-Sp", "--print-format", "%n	%v", resource.name], { environment: environment2 });
+  const versions = result.stdout.trim().split("\n").flatMap((line) => {
+    const [name, version, extra] = line.trim().split(/\s+/);
+    return name === resource.name && version && !extra ? [version] : [];
+  });
+  if (versions.length !== 1 || !versions[0]) throw new Error(`pacman did not report a unique version for ${resource.name}`);
+  return versions[0];
+}
+
+// src/resources/flatpak.ts
+function target(resource) {
+  const scope = resource.flatpak?.scope ?? "user";
+  const branch = resource.flatpak?.branch ?? "stable";
+  return { scope, branch, flag: `--${scope}`, remote: resource.flatpak?.remote ?? "flathub", ref: `app/${resource.name}//${branch}` };
+}
+function commit(value) {
+  const hash = value.trim();
+  if (!/^[a-f0-9]{64}$/.test(hash)) throw new Error(`Flatpak did not report a full commit ID: ${hash}`);
+  return hash;
+}
+async function resolveFlatpakVersion(resource, runner) {
+  const { flag, remote, ref } = target(resource);
+  return commit((await requireSuccess(runner, "flatpak", ["remote-info", flag, "--show-commit", remote, ref])).stdout);
+}
+
 // src/resources/package-version.ts
 async function resolvePackageVersion(resource, runner) {
   if (resource.kind !== "package") return void 0;
@@ -1127,22 +1260,31 @@ async function resolvePackageVersion(resource, runner) {
       const version = await readAvailableBrewVersion(resource, runner);
       return version === "latest" ? void 0 : version;
     }
+    case "dnf":
+    case "yum":
+      return await resolveRpmVersion(resource, runner);
     case "system":
       throw new Error("System package manager must be resolved before locking");
+    case "pacman":
+      return await resolvePacmanVersion(resource, runner);
+    case "flatpak":
+      return await resolveFlatpakVersion(resource, runner);
+    case "mas":
+      return void 0;
   }
 }
 
 // src/persistence/lock.ts
 var LOCK_VERSION = 1;
 function lockPath(configPath) {
-  return resolve5(dirname3(configPath), "workstation.lock");
+  return resolve6(dirname3(configPath), "workstation.lock");
 }
 async function lockConfig(configPath, config, runner) {
   const path = lockPath(configPath);
   const previousText = await readOptional(path);
   const previous = previousText === void 0 ? emptyLock() : parseLock(previousText, path);
-  const target = previous.targets.find(({ machine: machine2 }) => machine2 === config.context.machine);
-  const existing = new Map(target?.resources.map((entry) => [entry.id, entry]));
+  const target2 = previous.targets.find(({ machine: machine2 }) => machine2 === config.context.machine);
+  const existing = new Map(target2?.resources.map((entry) => [entry.id, entry]));
   const resources = [];
   const entries = [];
   for (const resource of config.resources) {
@@ -1186,10 +1328,10 @@ function emptyLock() {
 function stringifyLock(lock) {
   return stringify2({
     version: lock.version,
-    targets: lock.targets.map((target) => ({
-      machine: target.machine,
-      platform: target.platform,
-      resources: target.resources.map((entry) => ({
+    targets: lock.targets.map((target2) => ({
+      machine: target2.machine,
+      platform: target2.platform,
+      resources: target2.resources.map((entry) => ({
         id: entry.id,
         fingerprint: entry.fingerprint,
         ...entry.lockedVersion ? { locked_version: entry.lockedVersion } : {}
@@ -1205,19 +1347,19 @@ function parseLock(text, path) {
   if (!Array.isArray(document.targets)) throw new Error(`Lock targets must be an array in ${path}`);
   const machines = /* @__PURE__ */ new Set();
   const targets = document.targets.map((value, targetIndex) => {
-    const target = requireTable2(value, `targets[${targetIndex}]`);
-    const machine2 = requireString2(target.machine, `targets[${targetIndex}].machine`);
+    const target2 = requireTable2(value, `targets[${targetIndex}]`);
+    const machine2 = requireString2(target2.machine, `targets[${targetIndex}].machine`);
     if (machines.has(machine2)) throw new Error(`Duplicate machine ${machine2} in ${path}`);
     machines.add(machine2);
-    const platform = requireString2(target.platform, `targets[${targetIndex}].platform`);
+    const platform = requireString2(target2.platform, `targets[${targetIndex}].platform`);
     if (platform !== "darwin" && platform !== "linux") {
       throw new Error(`Invalid platform for ${machine2} in ${path}`);
     }
-    if (!Array.isArray(target.resources)) {
+    if (!Array.isArray(target2.resources)) {
       throw new Error(`Lock resources for ${machine2} must be an array in ${path}`);
     }
     const ids = /* @__PURE__ */ new Set();
-    const resources = target.resources.map((value2, resourceIndex) => {
+    const resources = target2.resources.map((value2, resourceIndex) => {
       const entry = requireTable2(value2, `targets[${targetIndex}].resources[${resourceIndex}]`);
       const id = requireString2(entry.id, "lock resource id");
       if (ids.has(id)) throw new Error(`Duplicate resource ${id} for ${machine2} in ${path}`);
@@ -1261,9 +1403,24 @@ async function atomicWrite(path, contents) {
 // src/resources/runner.ts
 import { spawn } from "child_process";
 var ProcessRunner = class {
+  /** Opt into command progress and streaming; verbose also prints captured query output. */
+  constructor(logging = {}) {
+    this.logging = logging;
+  }
+  /** Print resource progress only when logging is enabled. */
+  report(message) {
+    if (this.logging.progress || this.logging.verbose) process.stderr.write(`  ${message}
+`);
+  }
   /** Execute a command directly and return captured output and its exit code; spawn failures reject. */
   async run(command, args, options) {
-    return await new Promise((resolve6, reject) => {
+    const started = Date.now();
+    if (this.logging.progress || this.logging.verbose) {
+      process.stderr.write(`  $ ${[command, ...args].map((value) => /^[\w./:@=+-]+$/.test(value) ? value : JSON.stringify(value)).join(" ")}${options?.cwd ? ` (in ${options.cwd})` : ""}
+`);
+    }
+    const stream = this.logging.verbose || this.logging.progress && options?.streamOutput;
+    return await new Promise((resolve7, reject) => {
       const child = spawn(command, [...args], {
         cwd: options?.cwd,
         env: { ...process.env, ...options?.environment },
@@ -1273,13 +1430,22 @@ var ProcessRunner = class {
       let stderr = "";
       child.stdout.setEncoding("utf8");
       child.stderr.setEncoding("utf8");
-      child.stdout.on("data", (chunk) => stdout += chunk);
-      child.stderr.on("data", (chunk) => stderr += chunk);
+      child.stdout.on("data", (chunk) => {
+        stdout += chunk;
+        if (stream) process.stdout.write(chunk);
+      });
+      child.stderr.on("data", (chunk) => {
+        stderr += chunk;
+        if (stream || this.logging.progress) process.stderr.write(chunk);
+      });
       child.once("error", reject);
-      child.once(
-        "close",
-        (exitCode) => resolve6({ exitCode: exitCode ?? 1, stdout, stderr })
-      );
+      child.once("close", (exitCode) => {
+        if (this.logging.progress || this.logging.verbose) {
+          process.stderr.write(`  -> exit ${exitCode ?? 1} (${((Date.now() - started) / 1e3).toFixed(1)}s)
+`);
+        }
+        resolve7({ exitCode: exitCode ?? 1, stdout, stderr });
+      });
     });
   }
 };