@gjsify/cli 0.4.27 → 0.4.29

package/lib/templates/oxfmtrc.tmpl

@@ -0,0 +1,54 @@
+{
+    "$schema": "./node_modules/oxfmt/configuration_schema.json",
+    "useTabs": false,
+    "tabWidth": 4,
+    "printWidth": 120,
+    "singleQuote": true,
+    "jsxSingleQuote": false,
+    "quoteProps": "as-needed",
+    "trailingComma": "all",
+    "semi": true,
+    "arrowParens": "always",
+    "bracketSameLine": false,
+    "bracketSpacing": true,
+    "ignorePatterns": [
+        "**/*.json",
+        "**/*.jsonc",
+        "**/*.json5",
+        "**/*.css",
+        "**/*.scss",
+        "**/*.sass",
+        "**/*.less",
+        "**/*.html",
+        "**/*.htm",
+        "**/*.md",
+        "**/*.mdx",
+        "**/*.yml",
+        "**/*.yaml",
+        "**/*.vue",
+        "**/*.svelte",
+        "**/*.toml",
+        "**/*.graphql",
+        "**/*.gql",
+        "**/node_modules",
+        "**/dist",
+        "**/lib",
+        "**/build",
+        "**/build-dir",
+        "**/builddir",
+        "**/flatpak-build",
+        "**/.flatpak-builder",
+        "**/repo",
+        "**/coverage",
+        "**/refs",
+        "**/@types",
+        "**/templates",
+        "**/prebuilds",
+        "**/cli.gjs.mjs",
+        "**/test.gjs.mjs",
+        "**/test.node.mjs",
+        "**/*.gresource",
+        "**/*.compiled",
+        "**/*.metainfo.xml"
+    ]
+}

package/lib/templates/oxlintrc.json.tmpl

@@ -0,0 +1,35 @@
+{
+    "$schema": "./node_modules/oxlint/configuration_schema.json",
+    "categories": {
+        "correctness": "error"
+    },
+    "rules": {
+        "typescript/consistent-type-imports": "warn",
+        "typescript/no-explicit-any": "warn",
+        "typescript/no-non-null-assertion": "off",
+        "unicorn/prefer-node-protocol": "error",
+        "eslint/no-unused-vars": "warn"
+    },
+    "ignorePatterns": [
+        "**/node_modules",
+        "**/dist",
+        "**/lib",
+        "**/build",
+        "**/build-dir",
+        "**/builddir",
+        "**/flatpak-build",
+        "**/.flatpak-builder",
+        "**/repo",
+        "**/coverage",
+        "**/refs",
+        "**/@types",
+        "**/templates",
+        "**/prebuilds",
+        "**/cli.gjs.mjs",
+        "**/test.gjs.mjs",
+        "**/test.node.mjs",
+        "**/*.gresource",
+        "**/*.compiled",
+        "**/*.metainfo.xml"
+    ]
+}

package/lib/types/config-data.d.ts

@@ -165,20 +165,30 @@ export interface ConfigData {
     }>;
     /**
      * Extension → loader-kind map for files Rolldown does not classify
-     * natively. Currently only `'text'` is implemented — the file's content
-     * becomes the JS string default export (`export default "<content>"`).
-     * Replaces the legacy esbuild `loader: { '.ui': 'text' }` pattern.
+     * natively. Replaces the legacy esbuild `loader: { '.ui': 'text', '.png': 'dataurl' }`
+     * pattern.
+     *
+     * Loader kinds:
+     *   `'text'`    — file contents as a JS string default export
+     *                 (`export default "<source>"`). Good for GLSL shaders,
+     *                 `.ui` GtkBuilder XML, `.asm`, etc.
+     *   `'dataurl'` — `data:<mime>;base64,<b64>` string default export.
+     *                 MIME is inferred from the extension (.png → image/png,
+     *                 .jpg → image/jpeg, .gif → image/gif, .svg → image/svg+xml,
+     *                 .webp → image/webp, fallback application/octet-stream).
+     *                 Good for Excalibur's `ImageSource` and any library that
+     *                 accepts a data: URL rather than a separate asset file.
      *
      * Example:
      * ```jsonc
-     * "loaders": { ".ui": "text", ".asm": "text" }
+     * "loaders": { ".ui": "text", ".glsl": "text", ".png": "dataurl" }
      * ```
      *
      * Lives at the top level (not under `bundler`) so it doesn't leak into
-     * Rolldown's options on pass-through; the CLI converts it into a
-     * `text-loader` plugin prepended to the bundler's plugin chain.
+     * Rolldown's options on pass-through; the CLI converts it into a plugin
+     * prepended to the bundler's plugin chain.
      */
-    loaders?: Record<string, 'text'>;
+    loaders?: Record<string, 'text' | 'dataurl'>;
     /**
      * Flatpak-related configuration consumed by `gjsify flatpak <sub>`.
      * Lives in its own top-level namespace so the bundler config doesn't
@@ -188,8 +198,8 @@ export interface ConfigData {
     flatpak?: ConfigDataFlatpak;
     /**
      * Format/lint config consumed by `gjsify format` / `gjsify lint` /
-     * `gjsify fix`. Thin shell — Biome's own `biome.json` is the real
-     * configuration file; we only need a pointer here.
+     * `gjsify fix`. Thin shell — oxc's own `.oxfmtrc.json` / `.oxlintrc.json`
+     * are the real configuration files; we only need a pointer here.
      */
     format?: ConfigDataFormat;
     /**
@@ -198,12 +208,12 @@ export interface ConfigData {
      */
     test?: ConfigDataTest;
 }
-/** Optional pointer to a non-default biome.json. */
+/** Optional pointer to a non-default oxc config file. */
 export interface ConfigDataFormat {
     /**
-     * Path to biome.json. Default: walks up from cwd to find one;
-     * falls back to the recommended template shipped with `gjsify`
-     * (writable via `gjsify format --init`).
+     * Path to an `.oxfmtrc.json` / `.oxlintrc.json`. Default: walks up from
+     * cwd to find one; falls back to the recommended templates shipped with
+     * `gjsify` (writable via `gjsify format --init`).
      */
     configPath?: string;
 }

package/lib/utils/check-system-deps.js

@@ -29,7 +29,7 @@ function checkBinary(id, name, binary, versionArgs, severity, parseVersion, requ
     const out = tryExecFile(binary, versionArgs);
     if (out === null)
         return { id, name, found: false, severity, requiredBy };
-    const version = parseVersion ? parseVersion(out) : out.split('\n')[0] ?? out;
+    const version = parseVersion ? parseVersion(out) : (out.split('\n')[0] ?? out);
     return { id, name, found: true, version, severity, requiredBy };
 }
 /** Check a pkg-config library. pkg-config --modversion returns version on stdout. */
@@ -51,7 +51,9 @@ function checkNpmPackage(id, name, packageName, cwd, severity, requiredBy) {
         requireFromCwd.resolve(packageName);
         return { id, name, found: true, severity, requiredBy };
     }
-    catch { /* not in project, try CLI fallback */ }
+    catch {
+        /* not in project, try CLI fallback */
+    }
     // 2. Fallback: CLI's own node_modules
     try {
         const requireFromCli = createRequire(import.meta.url);
@@ -156,7 +158,9 @@ function discoverGjsifyPackages(cwd) {
     try {
         topPkg = JSON.parse(readFileSync(pkgJsonPath, 'utf-8'));
     }
-    catch { /* ignore */ }
+    catch {
+        /* ignore */
+    }
     const directDeps = {
         ...topPkg.dependencies,
         ...topPkg.devDependencies,
@@ -169,7 +173,9 @@ function discoverGjsifyPackages(cwd) {
             }
         }
     }
-    catch { /* ignore */ }
+    catch {
+        /* ignore */
+    }
     // Also include direct deps even if node_modules walk failed
     for (const dep of Object.keys(directDeps)) {
         if (dep.startsWith('@gjsify/'))

package/lib/utils/detect-native-packages.js

@@ -131,7 +131,7 @@ export function detectNativePackages(startDir) {
  * Prepends the new paths to any existing values from the environment.
  */
 export function buildNativeEnv(packages) {
-    const dirs = packages.map(p => p.prebuildsDir);
+    const dirs = packages.map((p) => p.prebuildsDir);
     const existing_ld = process.env['LD_LIBRARY_PATH'] ?? '';
     const existing_gi = process.env['GI_TYPELIB_PATH'] ?? '';
     const LD_LIBRARY_PATH = [...dirs, ...(existing_ld ? [existing_ld] : [])].join(':');

package/lib/utils/dlx-cache.js

@@ -84,13 +84,8 @@ export function symlinkSwap(cacheDir, prepareDir) {
     const linkPath = join(cacheDir, 'pkg');
     const tmpName = `pkg.tmp-${Date.now().toString(16)}-${process.pid.toString(16)}`;
     const tmpLink = join(cacheDir, tmpName);
-    try {
-        symlinkSync(prepareDir, tmpLink, 'dir');
-    }
-    catch (err) {
-        // If we cannot even create the tmp link, give up.
-        throw err;
-    }
+    // If we cannot even create the tmp link, give up (the error propagates).
+    symlinkSync(prepareDir, tmpLink, 'dir');
     try {
         renameSync(tmpLink, linkPath);
     }

package/lib/utils/install-backend-native.d.ts

@@ -1,5 +1,5 @@
-import { type Packument } from "@gjsify/npm-registry";
-import type { InstallOptions } from "./install-backend.ts";
+import { type Packument } from '@gjsify/npm-registry';
+import type { InstallOptions } from './install-backend.ts';
 interface ParsedSpec {
     name: string;
     range: string;

package/lib/utils/install-backend-native.js

@@ -13,18 +13,18 @@
 //
 // Out of scope (still deferred): peerDependencies validation,
 // lifecycle scripts, git/file specs.
-import * as fs from "node:fs";
-import * as path from "node:path";
-import * as os from "node:os";
-import { Range, SemVer, maxSatisfying, satisfies, } from "@gjsify/semver";
-import { DEFAULT_REGISTRY, fetchPackument, fetchTarball, parseNpmrc, } from "@gjsify/npm-registry";
-import { extractTarball } from "@gjsify/tar";
-const DEFAULT_CONCURRENCY = Number(process.env.GJSIFY_INSTALL_CONCURRENCY ?? "8") || 8;
-const LOCKFILE_NAME = "gjsify-lock.json";
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { Range, SemVer, maxSatisfying, satisfies } from '@gjsify/semver';
+import { DEFAULT_REGISTRY, fetchPackument, fetchTarball, parseNpmrc, } from '@gjsify/npm-registry';
+import { extractTarball } from '@gjsify/tar';
+const DEFAULT_CONCURRENCY = Number(process.env.GJSIFY_INSTALL_CONCURRENCY ?? '8') || 8;
+const LOCKFILE_NAME = 'gjsify-lock.json';
 const LOCKFILE_VERSION = 2;
 export async function installPackagesNative(opts) {
     if (opts.specs.length === 0) {
-        throw new Error("installPackagesNative: empty specs list");
+        throw new Error('installPackagesNative: empty specs list');
     }
     fs.mkdirSync(opts.prefix, { recursive: true });
     const npmrc = await loadNpmrc(opts);
@@ -47,25 +47,25 @@ export async function installPackagesNative(opts) {
             throw new Error(`install: --immutable but ${lockfilePath} is stale.\n${drift}\n` +
                 `Re-run \`gjsify install\` (without --immutable) to refresh the lockfile.`);
         }
-        log("install: --immutable, using lockfile (%d package(s))", Object.keys(existingLock.packages).length);
+        log('install: --immutable, using lockfile (%d package(s))', Object.keys(existingLock.packages).length);
         nodes = lockfileToNodes(existingLock);
     }
     else if (existingLock && lockfileMatchesRequest(existingLock, opts.specs)) {
-        log("install: using lockfile (%d package(s))", Object.keys(existingLock.packages).length);
+        log('install: using lockfile (%d package(s))', Object.keys(existingLock.packages).length);
         nodes = lockfileToNodes(existingLock);
     }
     else {
-        log("install: resolving %d top-level spec(s) → %s", opts.specs.length, opts.prefix);
-        nodes = await resolveDeps(opts.specs, npmrc, log, opts.overrides);
+        log('install: resolving %d top-level spec(s) → %s', opts.specs.length, opts.prefix);
+        nodes = await resolveDeps(opts.specs, npmrc, log, opts.overrides, opts.skipDeps);
         if (opts.lockfile) {
             writeLockfile(lockfilePath, opts.specs, nodes);
-            log("install: wrote %s (%d entries)", LOCKFILE_NAME, nodes.length);
+            log('install: wrote %s (%d entries)', LOCKFILE_NAME, nodes.length);
         }
     }
-    log("install: downloading %d tarball(s)", nodes.length);
+    log('install: downloading %d tarball(s)', nodes.length);
     await downloadAndExtractAll(nodes, opts.prefix, npmrc, log);
     await linkBins(nodes, opts.prefix, log);
-    log("install: done");
+    log('install: done');
     // Surface the top-level requested packages so callers can update
     // package.json with the resolved version (mirrors `npm install --save`
     // behavior). Sub-deps are not included.
@@ -94,14 +94,14 @@ function topLevelResolutions(specs, nodes) {
     return out;
 }
 function parseSpecName(spec) {
-    if (spec.startsWith("@")) {
-        const slash = spec.indexOf("/");
+    if (spec.startsWith('@')) {
+        const slash = spec.indexOf('/');
         if (slash === -1)
             return spec;
-        const at = spec.indexOf("@", slash + 1);
+        const at = spec.indexOf('@', slash + 1);
         return at === -1 ? spec : spec.slice(0, at);
     }
-    const at = spec.indexOf("@");
+    const at = spec.indexOf('@');
     return at === -1 ? spec : spec.slice(0, at);
 }
 /**
@@ -119,7 +119,7 @@ function parseSpecName(spec) {
  * the root. Each placement returns a `ResolvedNode` whose `installPath`
  * captures where it lives in the tree.
  */
-async function resolveDeps(specs, npmrc, log, overrides) {
+async function resolveDeps(specs, npmrc, log, overrides, skipDeps) {
     const applyOverride = (name, range) => {
         if (!overrides)
             return range;
@@ -128,7 +128,7 @@ async function resolveDeps(specs, npmrc, log, overrides) {
             return range;
         if (override === range)
             return range;
-        log("install: override %s %s → %s", name, range, override);
+        log('install: override %s %s → %s', name, range, override);
         return override;
     };
     const packumentCache = new Map();
@@ -139,7 +139,7 @@ async function resolveDeps(specs, npmrc, log, overrides) {
         const fresh = fetchPackument(name, {
             npmrc,
             onRetry: ({ attempt, error, delayMs }) => {
-                log("packument %s: retry %d after %dms (%s)", name, attempt, delayMs, errMsg(error));
+                log('packument %s: retry %d after %dms (%s)', name, attempt, delayMs, errMsg(error));
             },
         });
         packumentCache.set(name, fresh);
@@ -200,19 +200,31 @@ async function resolveDeps(specs, npmrc, log, overrides) {
             if (installPath === `node_modules/${edge.name}`) {
                 root.set(edge.name, node);
             }
-            log("resolve: %s@%s ← %s (at %s)", edge.name, version, edge.range, installPath);
-            for (const [depName, depRange] of Object.entries(node.dependencies)) {
-                queue.push({ from: installPath, name: depName, range: applyOverride(depName, depRange), required: true });
-            }
-            for (const [depName, depRange] of Object.entries(node.optionalDependencies)) {
-                queue.push({ from: installPath, name: depName, range: applyOverride(depName, depRange), required: false });
+            log('resolve: %s@%s ← %s (at %s)', edge.name, version, edge.range, installPath);
+            if (!skipDeps) {
+                for (const [depName, depRange] of Object.entries(node.dependencies)) {
+                    queue.push({
+                        from: installPath,
+                        name: depName,
+                        range: applyOverride(depName, depRange),
+                        required: true,
+                    });
+                }
+                for (const [depName, depRange] of Object.entries(node.optionalDependencies)) {
+                    queue.push({
+                        from: installPath,
+                        name: depName,
+                        range: applyOverride(depName, depRange),
+                        required: false,
+                    });
+                }
             }
         }
         catch (e) {
             // Optional deps that fail to resolve are skipped — yarn/npm
             // behavior. Required deps re-throw.
             if (!edge.required) {
-                log("resolve: optional dep %s@%s skipped (%s)", edge.name, edge.range, e.message);
+                log('resolve: optional dep %s@%s skipped (%s)', edge.name, edge.range, e.message);
                 continue;
             }
             throw e;
@@ -243,12 +255,12 @@ function findVisible(requesterPath, name, byPath) {
         // eslint-disable-next-line no-constant-condition
         while (true) {
             // Find the deepest `/node_modules/<pkg>` in `p`, strip it.
-            const idx = p.lastIndexOf("/node_modules/");
+            const idx = p.lastIndexOf('/node_modules/');
             if (idx < 0)
                 break;
             p = p.slice(0, idx);
             candidates.push(`${p}/node_modules/${name}`);
-            if (p === "")
+            if (p === '')
                 break;
         }
     }
@@ -299,10 +311,10 @@ function readLockfile(lockfilePath) {
     if (!fs.existsSync(lockfilePath))
         return null;
     try {
-        const parsed = JSON.parse(fs.readFileSync(lockfilePath, "utf-8"));
+        const parsed = JSON.parse(fs.readFileSync(lockfilePath, 'utf-8'));
         if (parsed.lockfileVersion !== LOCKFILE_VERSION)
             return null;
-        if (!parsed.packages || typeof parsed.packages !== "object")
+        if (!parsed.packages || typeof parsed.packages !== 'object')
             return null;
         return parsed;
     }
@@ -328,7 +340,7 @@ function writeLockfile(lockfilePath, specs, nodes) {
         requested: [...specs],
         packages,
     };
-    fs.writeFileSync(lockfilePath, JSON.stringify(lockfile, null, 2) + "\n");
+    fs.writeFileSync(lockfilePath, JSON.stringify(lockfile, null, 2) + '\n');
 }
 function lockfileToNodes(lockfile) {
     return Object.entries(lockfile.packages).map(([installPath, entry]) => ({
@@ -347,8 +359,8 @@ function lockfileToNodes(lockfile) {
 function nameFromInstallPath(installPath) {
     // Last `node_modules/` boundary, then the rest is the package name
     // (single segment unscoped, or `@scope/pkg` scoped).
-    const idx = installPath.lastIndexOf("/node_modules/");
-    const after = idx < 0 ? installPath.replace(/^node_modules\//, "") : installPath.slice(idx + "/node_modules/".length);
+    const idx = installPath.lastIndexOf('/node_modules/');
+    const after = idx < 0 ? installPath.replace(/^node_modules\//, '') : installPath.slice(idx + '/node_modules/'.length);
     return after;
 }
 function lockfileMatchesRequest(lockfile, specs) {
@@ -379,10 +391,10 @@ function describeLockfileDrift(lockfile, specs) {
         return null;
     const lines = [];
     if (added.length > 0)
-        lines.push(`  + ${added.sort().join("\n  + ")}`);
+        lines.push(`  + ${added.sort().join('\n  + ')}`);
     if (removed.length > 0)
-        lines.push(`  - ${removed.sort().join("\n  - ")}`);
-    return lines.join("\n");
+        lines.push(`  - ${removed.sort().join('\n  - ')}`);
+    return lines.join('\n');
 }
 // Exported for unit-testing — keep the function name + signature
 // stable, the install-backend itself still calls it via the local
@@ -398,25 +410,25 @@ export function parseSpec(raw) {
     // shipped only prereleases (4.0.0-rc.17 is the `latest` tag, no
     // stable 4.x yet) and `*` was selecting the abandoned 3.3.0
     // instead.
-    if (raw.startsWith("@")) {
-        const slash = raw.indexOf("/");
+    if (raw.startsWith('@')) {
+        const slash = raw.indexOf('/');
         if (slash < 0)
             throw new Error(`Invalid spec (scoped name without slash): ${raw}`);
-        const at = raw.indexOf("@", slash);
+        const at = raw.indexOf('@', slash);
         if (at < 0)
-            return { name: raw, range: "latest" };
-        return { name: raw.slice(0, at), range: raw.slice(at + 1) || "latest" };
+            return { name: raw, range: 'latest' };
+        return { name: raw.slice(0, at), range: raw.slice(at + 1) || 'latest' };
     }
-    const at = raw.indexOf("@");
+    const at = raw.indexOf('@');
     if (at < 0)
-        return { name: raw, range: "latest" };
-    return { name: raw.slice(0, at), range: raw.slice(at + 1) || "latest" };
+        return { name: raw, range: 'latest' };
+    return { name: raw.slice(0, at), range: raw.slice(at + 1) || 'latest' };
 }
 // Exported for unit-testing. Internal API.
 export function pickVersion(packument, range) {
     // dist-tag fast path: `latest`, `next`, ...
-    if (packument["dist-tags"][range])
-        return packument["dist-tags"][range];
+    if (packument['dist-tags'][range])
+        return packument['dist-tags'][range];
     // Validate range early so a typo fails loudly.
     let parsedRange;
     try {
@@ -440,8 +452,7 @@ async function downloadAndExtractAll(nodes, prefix, npmrc, log) {
     // Sort by install-path depth ascending so parents extract before
     // children. Extracting a parent on top of an existing child would
     // wipe out the child.
-    const queue = [...nodes].sort((a, b) => depth(a.installPath) - depth(b.installPath) ||
-        (a.installPath < b.installPath ? -1 : 1));
+    const queue = [...nodes].sort((a, b) => depth(a.installPath) - depth(b.installPath) || (a.installPath < b.installPath ? -1 : 1));
     const workers = [];
     const concurrency = Math.max(1, Math.min(DEFAULT_CONCURRENCY, queue.length));
     // Parents (depth 1) are extracted serially first to avoid concurrent
@@ -475,12 +486,12 @@ async function downloadAndExtractAll(nodes, prefix, npmrc, log) {
 }
 async function extractOne(node, prefix, npmrc, log) {
     const dest = path.join(prefix, node.installPath);
-    log("fetch: %s@%s ← %s (→ %s)", node.name, node.version, node.tarballUrl, node.installPath);
+    log('fetch: %s@%s ← %s (→ %s)', node.name, node.version, node.tarballUrl, node.installPath);
     const bytes = await fetchTarball(node.tarballUrl, {
         npmrc,
         integrity: node.integrity,
         onRetry: ({ attempt, error, delayMs }) => {
-            log("tarball %s@%s: retry %d after %dms (%s)", node.name, node.version, attempt, delayMs, errMsg(error));
+            log('tarball %s@%s: retry %d after %dms (%s)', node.name, node.version, attempt, delayMs, errMsg(error));
         },
     });
     fs.rmSync(dest, { recursive: true, force: true });
@@ -490,7 +501,7 @@ async function extractOne(node, prefix, npmrc, log) {
 function depth(installPath) {
     // Count `node_modules/` segments to know nesting depth.
     // `node_modules/foo` = 1, `node_modules/foo/node_modules/bar` = 2, etc.
-    return installPath.split("/node_modules/").length;
+    return installPath.split('/node_modules/').length;
 }
 async function linkBins(nodes, prefix, log) {
     // Only root-level packages publish bins into the top-level
@@ -498,7 +509,7 @@ async function linkBins(nodes, prefix, log) {
     // direct dependents through the nested .bin (npm matches this) — we
     // omit nested-bin linking for now since no consumer of the install
     // backend depends on it (gjsify's own use cases all hit root bins).
-    const binDir = path.join(prefix, "node_modules", ".bin");
+    const binDir = path.join(prefix, 'node_modules', '.bin');
     let created = 0;
     for (const node of nodes) {
         if (!node.bin)
@@ -534,15 +545,13 @@ async function linkBins(nodes, prefix, log) {
         }
     }
     if (created > 0)
-        log("bin: linked %d entry(ies) under .bin/", created);
+        log('bin: linked %d entry(ies) under .bin/', created);
 }
 function normalizeBin(pkgName, bin) {
     const out = new Map();
-    if (typeof bin === "string") {
+    if (typeof bin === 'string') {
         // String form is shorthand for `{ <last-segment-of-pkgName>: <bin> }`.
-        const baseName = pkgName.startsWith("@")
-            ? pkgName.slice(pkgName.indexOf("/") + 1)
-            : pkgName;
+        const baseName = pkgName.startsWith('@') ? pkgName.slice(pkgName.indexOf('/') + 1) : pkgName;
         out.set(baseName, bin);
         return out;
     }
@@ -563,11 +572,11 @@ async function loadNpmrc(opts) {
     // workspace-root one too; the gjsify project-local case is what users
     // hit most often (mock-registry tests, scoped-registry overrides), so
     // we cover that explicitly.
-    for (const candidate of [path.join(home, ".npmrc"), path.join(opts.prefix, ".npmrc")]) {
+    for (const candidate of [path.join(home, '.npmrc'), path.join(opts.prefix, '.npmrc')]) {
         if (!fs.existsSync(candidate))
             continue;
         try {
-            const projectParsed = parseNpmrc(fs.readFileSync(candidate, "utf-8"));
+            const projectParsed = parseNpmrc(fs.readFileSync(candidate, 'utf-8'));
             parsed = { ...parsed, ...projectParsed, scopes: { ...parsed.scopes, ...projectParsed.scopes } };
         }
         catch (e) {

package/lib/utils/install-backend.d.ts

@@ -27,6 +27,19 @@ export interface InstallOptions {
      * forcing `typescript@~5.9` across every `typescript@*` devDep.
      */
     overrides?: Record<string, string>;
+    /**
+     * Native backend only: skip transitive dependency resolution and only
+     * install the top-level requested packages. Use this when the packages
+     * are self-contained bundles whose declared `dependencies` are either
+     * bundled into the artifact (e.g. `@gjsify/cli`'s GJS bundle) or
+     * workspace-only packages not published to npm separately. Setting this
+     * avoids spurious packument fetches for workspace-internal packages.
+     *
+     * Has no effect when `frozen: true` (the lockfile already contains the
+     * full resolved tree and is used verbatim) or when `GJSIFY_INSTALL_BACKEND=npm`
+     * (npm does its own resolution and does not consult this flag).
+     */
+    skipDeps?: boolean;
 }
 export interface InstallResult {
     /** Top-level packages that were requested, with the version each

package/lib/utils/install-backend.js

@@ -40,7 +40,8 @@ async function installViaNpm({ prefix, specs, verbose, registry }) {
         '--no-package-lock',
         '--no-audit',
         '--no-fund',
-        '--prefix', prefix,
+        '--prefix',
+        prefix,
         ...(verbose ? ['--loglevel', 'verbose'] : ['--loglevel', 'warn']),
         ...specs,
     ];

package/lib/utils/install-global.js

@@ -161,9 +161,7 @@ function pickBinMap(pkgName, pkgJson) {
 function normalizeBin(pkgName, bin) {
     const out = new Map();
     if (typeof bin === 'string') {
-        const baseName = pkgName.startsWith('@')
-            ? pkgName.slice(pkgName.indexOf('/') + 1)
-            : pkgName;
+        const baseName = pkgName.startsWith('@') ? pkgName.slice(pkgName.indexOf('/') + 1) : pkgName;
         out.set(baseName, bin);
         return out;
     }