@drops-it/dpm 1.0.6 → 1.1.5

package/dist/install.js

@@ -1,63 +1,39 @@
-import { createHash } from "node:crypto";
-import { execFile, exec } from "node:child_process";
-import { access, mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import { homedir, tmpdir } from "node:os";
+import { access, readdir, readFile, rm, stat } from "node:fs/promises";
+import { homedir } from "node:os";
 import path from "node:path";
-import { promisify } from "node:util";
 import * as tar from "tar";
-import semver from "semver";
 import { auditPackages, formatAuditReport, proposeFixes, } from "./audit.js";
 import { c } from "./colors.js";
-import { loadLockfile, readPackageJson, saveLockfile, writePackageJson, } from "./config.js";
+import { loadConfig, loadLockfile, readPackageJson, saveLockfile, writePackageJson, } from "./config.js";
+import { ensureInstallConfig, runtimeInstallEnv, spawnRuntime, } from "./runtime.js";
 import { createUi } from "./ui.js";
-const execFileAsync = promisify(execFile);
-const execAsync = promisify(exec);
-function quoteNpmArg(value) {
-    if (!/[ \t"&<>|^]/.test(value))
-        return value;
-    return `"${value.replace(/"/g, '\\"')}"`;
-}
-async function runNpm(args) {
-    if (process.platform === "win32") {
-        const cmdline = ["npm", ...args.map(quoteNpmArg)].join(" ");
-        return execAsync(cmdline, {
-            windowsHide: true,
-            maxBuffer: 10 * 1024 * 1024,
-        });
-    }
-    return execFileAsync("npm", args, {
-        windowsHide: true,
-        maxBuffer: 10 * 1024 * 1024,
-    });
-}
+import { hasWindowsExeInstall, uninstallWindowsExe, updateWindowsExe, } from "./windowsInstall.js";
 function asUi(log) {
     if ("status" in log && typeof log.status === "function" && "clearStatus" in log) {
         return log;
     }
     return createUi();
 }
-function integrityOf(buf) {
-    return `sha512-${createHash("sha512").update(buf).digest("base64")}`;
+function setStatus(log, msg) {
+    if (log.status)
+        log.status(msg);
+    else
+        log.info(msg);
 }
-async function extractToNodeModules(name, tarball, cwd) {
-    const target = path.join(cwd, "node_modules", ...name.split("/"));
-    await rm(target, { recursive: true, force: true });
-    await mkdir(target, { recursive: true });
-    const tmp = path.join(cwd, "node_modules", `.dpm-tmp-${Date.now()}-${Math.random().toString(16).slice(2)}.tgz`);
-    await writeFile(tmp, tarball);
-    await tar.x({ file: tmp, cwd: target, strip: 1 });
-    await rm(tmp, { force: true });
+function topLevelDeps(pkg) {
+    return {
+        ...(pkg.dependencies || {}),
+        ...(pkg.devDependencies || {}),
+    };
 }
-function pickVersion(versions, range, distTags, preferred) {
-    // Audit-fix preferred versions always win when present in the registry.
-    if (preferred && versions.includes(preferred))
-        return preferred;
-    if (range === "latest" || range === "*" || range === "") {
-        return distTags.latest ?? semver.maxSatisfying(versions, "*");
-    }
-    if (semver.valid(range))
-        return versions.includes(range) ? range : null;
-    return semver.maxSatisfying(versions, range);
+function readOverrides(pkg) {
+    const raw = pkg.overrides || {};
+    const out = {};
+    for (const [name, value] of Object.entries(raw)) {
+        if (typeof value === "string")
+            out[name] = value;
+    }
+    return out;
 }
 /** Parse `name`, `name@1.2.3`, `name@^1`, `@scope/name`, `@scope/name@1.0.0`. */
 export function parsePackageSpec(spec) {
@@ -89,196 +65,207 @@ async function ensurePackageJson(cwd, log) {
         return pkg;
     }
 }
-async function resolveRange(api, name, range) {
-    const meta = await api.getPackage(name);
-    if (!meta)
-        throw new Error(`Package not found: ${name}`);
-    if (range === "latest" || range === "*") {
-        const latest = meta.latest || meta["dist-tags"]?.latest;
-        if (!latest)
-            throw new Error(`No versions for ${name}`);
-        return `^${latest}`;
-    }
-    if (semver.valid(range))
-        return range;
-    return range;
-}
-function setStatus(log, msg) {
-    if (log.status)
-        log.status(msg);
-    else
-        log.info(msg);
-}
-function topLevelDeps(pkg) {
-    return {
-        ...(pkg.dependencies || {}),
-        ...(pkg.devDependencies || {}),
-    };
-}
-function readOverrides(pkg) {
-    const raw = pkg.overrides || {};
-    const out = {};
-    for (const [name, value] of Object.entries(raw)) {
-        if (typeof value === "string")
-            out[name] = value;
+/**
+ * Builds a DPM lock snapshot from installed node_modules for audit tooling.
+ */
+export async function syncLockFromNodeModules(cwd) {
+    const lock = { lockfileVersion: 1, packages: {} };
+    const root = path.join(cwd, "node_modules");
+    try {
+        await access(root);
     }
-    return out;
+    catch {
+        await saveLockfile(lock, cwd);
+        return lock;
+    }
+    async function visit(dir, scope) {
+        let entries;
+        try {
+            entries = await readdir(dir);
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (entry === ".bin" || entry.startsWith("."))
+                continue;
+            const full = path.join(dir, entry);
+            let st;
+            try {
+                st = await stat(full);
+            }
+            catch {
+                continue;
+            }
+            if (!st.isDirectory())
+                continue;
+            if (entry.startsWith("@") && !scope) {
+                await visit(full, entry);
+                continue;
+            }
+            const name = scope ? `${scope}/${entry}` : entry;
+            try {
+                const raw = await readFile(path.join(full, "package.json"), "utf8");
+                const meta = JSON.parse(raw);
+                lock.packages[name] = {
+                    version: meta.version || "0.0.0",
+                    resolved: name,
+                    integrity: "",
+                    source: "dpm",
+                    dependencies: meta.dependencies,
+                };
+            }
+            catch {
+                /* skip broken packages */
+            }
+        }
+    }
+    await visit(root);
+    await saveLockfile(lock, cwd);
+    return lock;
+}
+async function prepareRuntimeInstall(cwd) {
+    const config = await loadConfig();
+    await ensureInstallConfig(config, cwd);
+    return { config, env: runtimeInstallEnv(config, cwd) };
 }
-export async function installAll(api, cwd = process.cwd(), log = createUi(), options = {}) {
+/** Installs package.json dependencies via the managed DPM runtime. */
+export async function installAll(_api, cwd = process.cwd(), log = createUi(), options = {}) {
     const ui = asUi(log);
-    const pkg = await ensurePackageJson(cwd, ui);
-    const deps = topLevelDeps(pkg);
-    const entries = Object.entries(deps);
-    if (entries.length === 0) {
-        ui.warn("package.json has no dependencies");
-        await saveLockfile({ lockfileVersion: 1, packages: {} }, cwd);
-        return { lockfileVersion: 1, packages: {} };
-    }
-    ui.info(`${c.cyan("→")} resolving ${c.bold(String(entries.length))} top-level dependenc${entries.length === 1 ? "y" : "ies"}`);
-    const lock = { lockfileVersion: 1, packages: {} };
-    const queue = [...entries];
-    let installed = 0;
-    const started = Date.now();
-    const preferred = {
-        ...readOverrides(pkg),
-        ...(options.preferredVersions || {}),
-    };
-    while (queue.length) {
-        const [name, range] = queue.pop();
-        if (lock.packages[name])
-            continue;
-        const progress = () => {
-            const pending = queue.length + 1;
-            return `${c.dim(`${installed} done · ${pending} left`)}`;
+    await ensurePackageJson(cwd, ui);
+    if (options.preferredVersions && Object.keys(options.preferredVersions).length > 0) {
+        const pkg = await readPackageJson(cwd);
+        const overrides = {
+            ...readOverrides(pkg),
+            ...options.preferredVersions,
         };
-        setStatus(ui, `resolve ${c.bold(name)}@${range}  ${progress()}`);
-        const meta = await api.getPackage(name);
-        if (!meta)
-            throw new Error(`Package not found: ${name}`);
-        const versions = meta.versions.map((v) => v.version);
-        const version = pickVersion(versions, range, meta["dist-tags"] || {}, preferred[name]);
-        if (!version)
-            throw new Error(`No version of ${name} matches ${range}`);
-        const ver = meta.versions.find((v) => v.version === version);
-        const source = meta.source || "dpm";
-        const sourceTag = source === "npm" ? c.magenta("[npm]") : c.blue("[dpm]");
-        setStatus(ui, `download ${c.bold(name)}@${c.green(version)} ${sourceTag}  ${progress()}`);
-        const tarball = await api.downloadTarball(ver.dist.tarball);
-        const integrity = ver.dist.integrity || integrityOf(tarball);
-        setStatus(ui, `extract ${c.bold(name)}@${c.green(version)}  ${progress()}`);
-        await extractToNodeModules(name, tarball, cwd);
-        installed += 1;
-        lock.packages[name] = {
-            version,
-            resolved: ver.dist.tarball,
-            integrity,
-            source,
-            dependencies: ver.dependencies,
-        };
-        for (const [dep, depRange] of Object.entries(ver.dependencies || {})) {
-            if (!lock.packages[dep])
-                queue.push([dep, depRange]);
-        }
+        pkg.overrides = overrides;
+        await writePackageJson(pkg, cwd);
     }
+    const { env } = await prepareRuntimeInstall(cwd);
     ui.clearStatus();
-    await saveLockfile(lock, cwd);
+    ui.info(`${c.dim("→")} installing dependencies…`);
+    const started = Date.now();
+    const code = await spawnRuntime({
+        cwd,
+        args: ["install"],
+        env,
+        brandOutput: true,
+    });
+    if (code !== 0) {
+        throw new Error(`install failed (exit ${code})`);
+    }
+    const lock = await syncLockFromNodeModules(cwd);
     const elapsed = ((Date.now() - started) / 1000).toFixed(1);
+    const count = Object.keys(lock.packages).length;
     if (ui.success) {
-        ui.success(`added ${c.bold(String(installed))} package${installed === 1 ? "" : "s"} in ${elapsed}s`);
+        ui.success(`added ${c.bold(String(count))} package${count === 1 ? "" : "s"} in ${elapsed}s`);
     }
     else {
-        ui.info(`added ${installed} package${installed === 1 ? "" : "s"} in ${elapsed}s`);
+        ui.info(`added ${count} package${count === 1 ? "" : "s"} in ${elapsed}s`);
     }
     if (!options.skipAudit) {
         setStatus(ui, "checking vulnerabilities…");
         const hits = await auditPackages(lock.packages);
+        const pkg = await readPackageJson(cwd);
+        const deps = topLevelDeps(pkg);
         const fixes = hits.length
-            ? await proposeFixes(api, lock, hits, deps, true)
+            ? await proposeFixes(_api, lock, hits, deps, true)
             : [];
         ui.clearStatus();
         ui.info(formatAuditReport(hits, fixes));
     }
     return lock;
 }
+/** Adds packages then installs via the managed DPM runtime. */
 export async function addPackages(api, specs, cwd = process.cwd(), log = createUi()) {
     if (specs.length === 0)
         return installAll(api, cwd, log);
     const ui = asUi(log);
-    const pkg = await ensurePackageJson(cwd, ui);
-    const deps = pkg.dependencies || {};
+    await ensurePackageJson(cwd, ui);
+    const { env } = await prepareRuntimeInstall(cwd);
+    ui.clearStatus();
+    ui.info(`${c.dim("→")} add ${specs.join(", ")}`);
+    const code = await spawnRuntime({
+        cwd,
+        args: ["add", ...specs],
+        env,
+        brandOutput: true,
+    });
+    if (code !== 0)
+        throw new Error(`add failed (exit ${code})`);
     for (const spec of specs) {
-        const { name, range } = parsePackageSpec(spec);
-        setStatus(ui, `add ${c.bold(name)}`);
-        const savedRange = await resolveRange(api, name, range);
-        deps[name] = savedRange;
-        ui.info(`${c.green("+")} ${c.bold(name)}@${c.cyan(savedRange)}`);
+        const { name } = parsePackageSpec(spec);
+        ui.info(`${c.green("+")} ${c.bold(name)}`);
     }
-    pkg.dependencies = deps;
-    await writePackageJson(pkg, cwd);
-    return installAll(api, cwd, ui);
+    return syncLockFromNodeModules(cwd);
+}
+const CLI_SELF_NAMES = ["@drops-it/dpm", "dpm"];
+function isCliSelfName(name) {
+    return CLI_SELF_NAMES.includes(name);
 }
 /**
- * Installs packages into the npm global prefix (bins linked by npm).
- * Downloads through the DPM registry so installs count as DPM downloads.
- * Used for CLI self-updates: `dpm i -g dpm` / `dpm i -g @drops-it/dpm`.
+ * Installs packages into the global prefix via the managed DPM runtime.
+ * Self-update of the Windows exe uses `/download/dpm.exe` instead of bun -g.
  */
-export async function installGlobalPackages(api, specs, log = createUi()) {
+export async function installGlobalPackages(_api, specs, log = createUi()) {
     if (specs.length === 0) {
         throw new Error("global install requires at least one package name");
     }
     const ui = asUi(log);
-    for (const spec of specs) {
-        let { name, range } = parsePackageSpec(spec);
-        // CLI lives on DPM as unscoped `dpm` — map the npm name away.
-        if (name === "@drops-it/dpm")
-            name = "dpm";
-        setStatus(ui, `resolve ${c.bold(name)}`);
-        const meta = await api.getPackage(name);
-        if (!meta)
-            throw new Error(`Package not found: ${name}`);
-        const versions = meta.versions.map((v) => v.version);
-        const version = pickVersion(versions, range, meta["dist-tags"] || {});
-        if (!version)
-            throw new Error(`No version of ${name} matches ${range}`);
-        const ver = meta.versions.find((v) => v.version === version);
-        // Prefer the DPM tarball URL so the registry records the download.
-        const tarballUrl = ver.dist.tarball.includes("/dpm/v1/packages/")
-            ? ver.dist.tarball
-            : `/dpm/v1/packages/${encodeURIComponent(name)}/-/${encodeURIComponent(name)}-${version}.tgz`;
-        setStatus(ui, `download ${c.bold(name)}@${c.green(version)}`);
-        const tarball = await api.downloadTarball(tarballUrl);
-        const tmp = path.join(tmpdir(), `dpm-global-${Date.now()}-${Math.random().toString(16).slice(2)}.tgz`);
-        await writeFile(tmp, tarball);
-        try {
-            setStatus(ui, `install ${c.bold(name)}@${c.green(version)} ${c.dim("[global]")}`);
-            await runNpm(["install", "-g", tmp]);
-        }
-        finally {
-            await rm(tmp, { force: true });
-        }
+    const parsed = specs.map((spec) => {
+        const { name, range } = parsePackageSpec(spec);
+        const real = name === "@drops-it/dpm" ? "dpm" : name;
+        return { real, range, original: spec };
+    });
+    const selfSpecs = parsed.filter((p) => isCliSelfName(p.real));
+    const otherSpecs = parsed.filter((p) => !isCliSelfName(p.real));
+    if (selfSpecs.length > 0 && (await hasWindowsExeInstall())) {
+        await updateWindowsExe(ui);
+    }
+    else if (selfSpecs.length > 0) {
+        // npm/bun global CLI install
+        const mapped = selfSpecs.map((p) => p.range === "latest" ? p.real : `${p.real}@${p.range}`);
+        const config = await loadConfig();
+        await ensureInstallConfig(config, process.cwd());
+        const env = runtimeInstallEnv(config);
         ui.clearStatus();
+        ui.info(`${c.dim("→")} install -g ${mapped.join(", ")}`);
+        const code = await spawnRuntime({
+            args: ["add", "-g", ...mapped],
+            env,
+            brandOutput: true,
+        });
+        if (code !== 0)
+            throw new Error(`global install failed (exit ${code})`);
         if (ui.success)
-            ui.success(`installed ${c.bold(name)}@${c.green(version)} globally`);
+            ui.success(`installed ${mapped.join(", ")} globally`);
         else
-            ui.info(`installed ${name}@${version} globally`);
+            ui.info(`installed ${mapped.join(", ")} globally`);
     }
+    if (otherSpecs.length === 0)
+        return;
+    const mapped = otherSpecs.map((p) => p.range === "latest" ? p.real : `${p.real}@${p.range}`);
+    const config = await loadConfig();
+    await ensureInstallConfig(config, process.cwd());
+    const env = runtimeInstallEnv(config);
+    ui.clearStatus();
+    ui.info(`${c.dim("→")} install -g ${mapped.join(", ")}`);
+    const code = await spawnRuntime({
+        args: ["add", "-g", ...mapped],
+        env,
+        brandOutput: true,
+    });
+    if (code !== 0)
+        throw new Error(`global install failed (exit ${code})`);
+    if (ui.success)
+        ui.success(`installed ${mapped.join(", ")} globally`);
+    else
+        ui.info(`installed ${mapped.join(", ")} globally`);
 }
-async function npmGlobalPrefix() {
-    const { stdout } = await runNpm(["prefix", "-g"]);
-    return stdout.toString().trim();
-}
-async function tryNpmUninstallGlobal(name) {
-    try {
-        await runNpm(["uninstall", "-g", name]);
-    }
-    catch {
-        try {
-            await runNpm(["unlink", "-g", name]);
-        }
-        catch {
-            // Package may already be gone.
-        }
-    }
+async function runtimeGlobalPrefix() {
+    // Best-effort: common user global paths when removing the CLI.
+    return path.join(homedir(), ".dpm", "global");
 }
 /** Removes leftover Windows/Unix bin shims for a command name. */
 async function removeGlobalBinShims(binName, prefix) {
@@ -286,80 +273,156 @@ async function removeGlobalBinShims(binName, prefix) {
         path.join(prefix, binName),
         path.join(prefix, `${binName}.cmd`),
         path.join(prefix, `${binName}.ps1`),
+        path.join(prefix, "bin", binName),
         path.join(prefix, "node_modules", ".bin", binName),
         path.join(prefix, "node_modules", ".bin", `${binName}.cmd`),
         path.join(prefix, "node_modules", ".bin", `${binName}.ps1`),
     ];
     await Promise.all(candidates.map((p) => rm(p, { force: true })));
 }
-const CLI_SELF_NAMES = ["@drops-it/dpm", "dpm"];
+/** Deletes leftover global package trees for the CLI (npm/bun prefixes). */
+async function scrubCliGlobalLeftovers() {
+    const prefix = await runtimeGlobalPrefix();
+    await removeGlobalBinShims("dpm", prefix);
+    const roaming = path.join(homedir(), "AppData", "Roaming", "npm");
+    await removeGlobalBinShims("dpm", roaming);
+    await rm(path.join(prefix, "node_modules", "dpm"), {
+        recursive: true,
+        force: true,
+    });
+    await rm(path.join(homedir(), ".bun", "install", "global", "node_modules", "dpm"), { recursive: true, force: true }).catch(() => undefined);
+    await rm(path.join(homedir(), "AppData", "Roaming", "npm", "node_modules", "@drops-it", "dpm"), { recursive: true, force: true }).catch(() => undefined);
+    await rm(path.join(homedir(), "AppData", "Roaming", "npm", "node_modules", "dpm"), { recursive: true, force: true }).catch(() => undefined);
+}
 /**
  * Uninstalls global packages (and cleans dpm bin shims when removing the CLI).
- * `dpm rm -g` with no names removes the dpm CLI itself.
+ * `dpm rm -g` with no names removes the dpm CLI itself (Windows exe + bun/npm globals).
  */
 export async function removeGlobalPackages(specs, log = createUi()) {
     const ui = asUi(log);
     const targets = specs.length > 0
-        ? specs.map((s) => parsePackageSpec(s).name)
-        : [...CLI_SELF_NAMES];
-    const prefix = await npmGlobalPrefix();
-    const removingSelf = targets.some((n) => CLI_SELF_NAMES.includes(n));
-    for (const name of targets) {
-        setStatus(ui, `uninstall -g ${c.bold(name)}`);
-        await tryNpmUninstallGlobal(name);
-        // Scoped packages may leave the unscoped alias around.
-        if (name === "@drops-it/dpm")
-            await tryNpmUninstallGlobal("dpm");
-        if (name === "dpm")
-            await tryNpmUninstallGlobal("@drops-it/dpm");
+        ? [
+            ...new Set(specs
+                .map((s) => parsePackageSpec(s).name)
+                .map((n) => (n === "@drops-it/dpm" ? "dpm" : n))),
+        ]
+        : ["dpm"];
+    const config = await loadConfig();
+    const env = runtimeInstallEnv(config);
+    const removingSelf = targets.some(isCliSelfName);
+    const otherTargets = targets.filter((n) => !isCliSelfName(n));
+    let didWindowsUninstall = false;
+    if (removingSelf && (await hasWindowsExeInstall())) {
+        await uninstallWindowsExe(ui);
+        didWindowsUninstall = true;
     }
-    if (removingSelf) {
-        await removeGlobalBinShims("dpm", prefix);
-        // Also clear a linked/local leftover under the user npm folder on Windows.
-        const roaming = path.join(homedir(), "AppData", "Roaming", "npm");
-        if (roaming.toLowerCase() !== prefix.toLowerCase()) {
-            await removeGlobalBinShims("dpm", roaming);
-        }
-        await rm(path.join(prefix, "node_modules", "dpm"), { recursive: true, force: true });
-        await rm(path.join(prefix, "node_modules", "@drops-it", "dpm"), {
-            recursive: true,
-            force: true,
+    // bun -g only for non-exe packages (and for self when not an exe install).
+    const bunTargets = didWindowsUninstall
+        ? otherTargets
+        : removingSelf
+            ? [...new Set([...otherTargets, "dpm"])]
+            : otherTargets;
+    for (const name of bunTargets) {
+        ui.clearStatus();
+        ui.info(`${c.dim("→")} uninstall -g ${c.bold(name)}`);
+        await spawnRuntime({
+            args: ["remove", "-g", name],
+            env,
+            brandOutput: true,
         });
     }
+    if (removingSelf) {
+        await scrubCliGlobalLeftovers();
+    }
     ui.clearStatus();
-    if (ui.success) {
-        ui.success(removingSelf && specs.length === 0
-            ? "removed global dpm (bins + package)"
-            : `removed global ${targets.join(", ")}`);
+    if (didWindowsUninstall && otherTargets.length === 0) {
+        // uninstallWindowsExe already reported success
+        return;
     }
-    else {
-        ui.info(`removed global ${targets.join(", ")}`);
+    if (removingSelf && specs.length === 0) {
+        if (ui.success)
+            ui.success("removed global dpm");
+        else
+            ui.info("removed global dpm");
+        return;
     }
+    if (ui.success)
+        ui.success(`removed global ${targets.join(", ")}`);
+    else
+        ui.info(`removed global ${targets.join(", ")}`);
 }
 export async function addPackage(api, name, range = "latest", cwd = process.cwd(), log = createUi()) {
     const spec = range === "latest" ? name : `${name}@${range}`;
     return addPackages(api, [spec], cwd, log);
 }
+/** Drops a package name from package.json dependency maps. */
+async function stripFromPackageJson(name, cwd) {
+    const pkg = await readPackageJson(cwd);
+    let changed = false;
+    for (const field of [
+        "dependencies",
+        "devDependencies",
+        "optionalDependencies",
+        "peerDependencies",
+    ]) {
+        const bag = pkg[field];
+        if (bag && typeof bag === "object" && !Array.isArray(bag) && name in bag) {
+            delete bag[name];
+            changed = true;
+        }
+    }
+    if (changed)
+        await writePackageJson(pkg, cwd);
+    return changed;
+}
+/** Module folder under node_modules for a bare or scoped package name. */
+function nodeModulesPath(cwd, name) {
+    if (name.startsWith("@")) {
+        const [scope, pkg] = name.split("/");
+        return path.join(cwd, "node_modules", scope, pkg);
+    }
+    return path.join(cwd, "node_modules", name);
+}
+/**
+ * Removes a local dependency via the managed runtime.
+ * If Bun fails (e.g. ENOENT on an unrelated cached tarball), falls back to
+ * editing package.json + reinstall.
+ */
 export async function removePackage(name, cwd = process.cwd(), log = createUi()) {
     const ui = asUi(log);
-    const pkg = await readPackageJson(cwd);
-    const deps = pkg.dependencies || {};
-    const dev = pkg.devDependencies || {};
-    if (!deps[name] && !dev[name]) {
-        ui.warn(`${name} is not in package.json`);
-    }
-    delete deps[name];
-    delete dev[name];
-    pkg.dependencies = deps;
-    pkg.devDependencies = dev;
-    await writePackageJson(pkg, cwd);
-    await rm(path.join(cwd, "node_modules", ...name.split("/")), {
-        recursive: true,
-        force: true,
+    const { env } = await prepareRuntimeInstall(cwd);
+    ui.clearStatus();
+    ui.info(`${c.dim("→")} remove ${c.bold(name)}`);
+    const code = await spawnRuntime({
+        cwd,
+        args: ["remove", name],
+        env,
+        brandOutput: true,
     });
-    const lock = await loadLockfile(cwd);
-    delete lock.packages[name];
-    await saveLockfile(lock, cwd);
+    if (code === 0) {
+        await syncLockFromNodeModules(cwd);
+        if (ui.success)
+            ui.success(`removed ${c.bold(name)}`);
+        else
+            ui.info(`removed ${name}`);
+        return;
+    }
+    ui.warn("runtime remove failed (often a missing cache tarball) — updating package.json and reinstalling");
+    const stripped = await stripFromPackageJson(name, cwd);
+    if (!stripped) {
+        throw new Error(`remove failed: ${name} is not listed in package.json`);
+    }
+    await rm(nodeModulesPath(cwd, name), { recursive: true, force: true });
+    const installCode = await spawnRuntime({
+        cwd,
+        args: ["install"],
+        env,
+        brandOutput: true,
+    });
+    if (installCode !== 0) {
+        throw new Error(`remove failed (exit ${code}); reinstall also failed. Try deleting node_modules and the lockfile, then dpm i`);
+    }
+    await syncLockFromNodeModules(cwd);
     if (ui.success)
         ui.success(`removed ${c.bold(name)}`);
     else
@@ -384,7 +447,7 @@ export async function runAudit(api, cwd = process.cwd(), log = createUi()) {
     return { hits, fixes: fixes.filter((f) => !f.breaking) };
 }
 /**
- * Applies available advisory fixes (like `npm audit fix`), then reinstalls.
+ * Applies available advisory fixes, then reinstalls via the DPM runtime.
  */
 export async function auditFix(api, cwd = process.cwd(), log = createUi(), force = false) {
     const ui = asUi(log);
@@ -418,7 +481,6 @@ export async function auditFix(api, cwd = process.cwd(), log = createUi(), force
             devDependencies[fix.name] = `^${fix.to}`;
         }
         else {
-            // Persist transitive fixes so the next plain install keeps them.
             overrides[fix.name] = fix.to;
         }
     }
@@ -433,8 +495,26 @@ export async function auditFix(api, cwd = process.cwd(), log = createUi(), force
     });
     return { fixed: applicable, lock: next };
 }
+async function readLocalReadme(cwd) {
+    for (const name of ["README.md", "readme.md", "README", "readme.txt", "README.txt"]) {
+        try {
+            const text = await readFile(path.join(cwd, name), "utf8");
+            if (text.trim())
+                return text;
+        }
+        catch {
+            /* try next */
+        }
+    }
+    return "";
+}
+/** Packs the current package into a gzipped tarball for publish. */
 export async function packTarball(cwd = process.cwd()) {
     const manifest = await readPackageJson(cwd);
+    const readme = await readLocalReadme(cwd);
+    if (readme && !String(manifest.readme ?? "").trim()) {
+        manifest.readme = readme;
+    }
     const out = path.join(cwd, `.dpm-pack-${Date.now()}.tgz`);
     await tar.c({
         gzip: true,
@@ -444,7 +524,10 @@ export async function packTarball(cwd = process.cwd()) {
         filter: (p) => !p.includes("node_modules") &&
             !p.startsWith(".git") &&
             !p.endsWith(".tgz") &&
-            p !== "dpm-lock.yaml",
+            p !== "dpm-lock.yaml" &&
+            p !== "bun.lock" &&
+            p !== "bun.lockb" &&
+            p !== "bunfig.toml",
     }, ["."]);
     const buf = await readFile(out);
     await rm(out, { force: true });