@gjsify/cli 0.4.4 → 0.4.5

package/dist/cli.gjs.mjs

@@ -779,12 +779,12 @@ jobs:
           manifest-path: ${n.manifest}
           bundle: ${n.bundle}
           cache-key: ${n.cacheKey}
-`}const $T={command:`flatpak <subcommand>`,description:`Flatpak toolchain: init/build/deps/ci subcommands for shipping GJS apps and CLIs as Flatpaks.`,builder:n=>n.command(YT.command,YT.description,YT.builder,YT.handler).command(XT.command,XT.description,XT.builder,XT.handler).command(ZT.command,ZT.description,ZT.builder,ZT.handler).command(QT.command,QT.description,QT.builder,QT.handler).demandCommand(1).strict()};Fs(),Wo();const eE=/^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;function parseSpec$1(n){if(!n)throw Error(`dlx: empty package spec`);if(n.startsWith(`./`)||n.startsWith(`../`)||Mo(n)||existsSync(n))return{kind:`local`,path:Ao(n)};let a=n,S,C=n.lastIndexOf(`@`);if(C>0&&(a=n.slice(0,C),S=n.slice(C+1)),!eE.test(a))throw Error(`dlx: invalid package name "${a}"`);return{kind:`registry`,name:a,version:S,spec:n}}__name$1(parseSpec$1,`parseSpec`),Fs(),Wo();function resolveGjsEntry(n,a){let S=No(n,`package.json`);if(!existsSync(S))throw Error(`dlx: no package.json found at ${n}`);let C=JSON.parse(readFileSync(S,`utf-8`)),N=C.gjsify?.bin,F=C.gjsify?.main,I=C.main,H,W=null,K=!1;if(a!==null){if(!N||!N[a]){let S=N?Object.keys(N).join(`, `):`(none)`;throw Error(`dlx: package "${C.name??n}" has no GJS bin named "${a}" — known: ${S}`)}H=N[a],W=a}else if(N&&Object.keys(N).length===1){let n=Object.keys(N)[0];H=N[n],W=n}else F?H=F:I&&(H=I,K=!0);if(N&&Object.keys(N).length>1&&a===null){let a=Object.keys(N).join(`, `);throw Error(`dlx: package "${C.name??n}" defines multiple GJS bins — pass one of: ${a}`)}if(!H)throw Error(`dlx: package "${C.name??n}" has no GJS entry — set \`gjsify.main\` (or \`gjsify.bin\`) in its package.json`);let q=Ao(n,H);if(!existsSync(q))throw Error(`dlx: GJS entry not found: ${q}`);return{bundlePath:q,binName:W,fromFallback:K}}ka(),Fs(),rp(),Wo();function lexCompare(n,a){return n<a?-1:+(n>a)}function createCacheKey(n){let a=[...n.packages].sort(lexCompare),S=Object.entries(n.registries??{}).sort(([n],[a])=>lexCompare(n,a)),C=JSON.stringify([a,S]);return createHash(`sha256`).update(C).digest(`hex`)}function dlxCacheRoot(){let n=process.env.XDG_CACHE_HOME,a=No(n&&n.length>0?n:No(homedir(),`.cache`),`gjsify`,`dlx`);return mkdirSync(a,{recursive:!0}),a}function cacheDirFor(n){let a=No(dlxCacheRoot(),n);return mkdirSync(a,{recursive:!0}),a}function makePrepareDir(n){let a=No(n,`${Date.now().toString(16)}-${process.pid.toString(16)}`);return mkdirSync(a,{recursive:!0}),a}function getValidCachedPkg(n,a=10080){let S=No(n,`pkg`),C;try{C=lstatSync(S)}catch(n){if(n.code===`ENOENT`)return;throw n}if(!C.isSymbolicLink())return;let N;try{N=realpathSync(S)}catch{return}return Date.now()-C.mtime.getTime()<=a*6e4?N:void 0}function symlinkSwap(n,a){let S=No(n,`pkg`),C=No(n,`pkg.tmp-${Date.now().toString(16)}-${process.pid.toString(16)}`);try{symlinkSync(a,C,`dir`)}catch(n){throw n}try{renameSync(C,S)}catch(n){let a=n.code;if(a===`EBUSY`||a===`EPERM`||a===`EEXIST`){try{rmSync(C)}catch{}return realpathSync(S)}throw n}return realpathSync(S)}function resolveInstalledPkgDir(n,a){return Ao(n,`node_modules`,a)}function parse(n){try{return new SemVer(n)}catch{return null}}function satisfies(n,a){let S=a instanceof rE?a:new rE(a),C=n instanceof SemVer?n:parse(String(n));return C?S.test(C):!1}function maxSatisfying(n,a){let S=a instanceof rE?a:new rE(a),C=null;for(let a of n){let n=parse(a);!n||!S.test(n)||(C===null||n.compare(C)>0)&&(C=n)}return C?C.version:null}function testComparator(n,a){if(n.semver===null)return!0;let S=a.compare(n.semver);switch(n.operator){case``:case`=`:return S===0;case`<`:return S<0;case`<=`:return S<=0;case`>`:return S>0;case`>=`:return S>=0}}function formatComparator(n){return n.semver===null?`*`:`${n.operator}${n.semver.version}`}function parseRangePart(n){let a=n.trim();if(a===``||a===`*`||a.toLowerCase()===`latest`)return[{operator:`>=`,semver:new SemVer(`0.0.0`)}];let S=a.match(/^\s*(\S+)\s+-\s+(\S+)\s*$/);if(S)return hyphenRange(S[1],S[2]);let C=a.replace(/(<=|>=|<|>|=)\s+(?=\S)/g,`$1`).split(/\s+/),N=[];for(let n of C)N.push(...parseSimple(n));return N}function parseSimple(n){if(n===`*`||n===``||n.toLowerCase()===`latest`)return[{operator:`>=`,semver:new SemVer(`0.0.0`)}];if(n.startsWith(`^`))return caretRange(n.slice(1));if(n.startsWith(`~`))return tildeRange(n.slice(1).replace(/^>/,``));let a=n.match(/^(<=|>=|<|>|=)\s*(.+)$/);if(a){let n=a[1];return primitiveRange(n,a[2])}return partialRange(n)}function parsePartial(n){let a=n.trim().replace(/^v/,``);if(a===``||a===`*`)return{major:null,minor:null,patch:null,pre:``,build:``};let S=``,C=``,N=a,F=N.indexOf(`+`);F>=0&&(C=N.slice(F+1),N=N.slice(0,F));let I=N.indexOf(`-`);I>=0&&(S=N.slice(I+1),N=N.slice(0,I));let H=N.split(`.`),xr=a=>{if(a===void 0||a===``||a===`x`||a===`X`||a===`*`)return null;if(!/^\d+$/.test(a))throw TypeError(`Invalid partial version: ${n}`);return Number(a)};return{major:xr(H[0]),minor:xr(H[1]),patch:xr(H[2]),pre:S,build:C}}function partialToVersion(n){return`${n.major??0}.${n.minor??0}.${n.patch??0}${n.pre?`-${n.pre}`:``}${n.build?`+${n.build}`:``}`}function partialRange(n){let a=parsePartial(n);return a.major===null?[{operator:`>=`,semver:new SemVer(`0.0.0`)}]:a.minor===null?[{operator:`>=`,semver:new SemVer(`${a.major}.0.0`)},{operator:`<`,semver:new SemVer(`${a.major+1}.0.0`)}]:a.patch===null?[{operator:`>=`,semver:new SemVer(`${a.major}.${a.minor}.0`)},{operator:`<`,semver:new SemVer(`${a.major}.${a.minor+1}.0`)}]:[{operator:`=`,semver:new SemVer(partialToVersion(a))}]}function caretRange(n){let a=parsePartial(n);if(a.major===null)return[{operator:`>=`,semver:new SemVer(`0.0.0`)}];let S=`${a.major}.${a.minor??0}.${a.patch??0}${a.pre?`-${a.pre}`:``}`,C;return C=a.major>0||a.minor===null?`${a.major+1}.0.0`:a.minor>0||a.patch===null?`0.${a.minor+1}.0`:`0.0.${a.patch+1}`,[{operator:`>=`,semver:new SemVer(S)},{operator:`<`,semver:new SemVer(C)}]}function tildeRange(n){let a=parsePartial(n);if(a.major===null)return[{operator:`>=`,semver:new SemVer(`0.0.0`)}];let S=`${a.major}.${a.minor??0}.${a.patch??0}${a.pre?`-${a.pre}`:``}`,C=a.minor===null?`${a.major+1}.0.0`:`${a.major}.${a.minor+1}.0`;return[{operator:`>=`,semver:new SemVer(S)},{operator:`<`,semver:new SemVer(C)}]}function primitiveRange(n,a){let S=parsePartial(a);return S.major===null?[{operator:`>=`,semver:new SemVer(`0.0.0`)}]:n===`=`||n===``?partialRange(a):n===`>`?S.minor===null?[{operator:`>=`,semver:new SemVer(`${S.major+1}.0.0`)}]:S.patch===null?[{operator:`>=`,semver:new SemVer(`${S.major}.${S.minor+1}.0`)}]:[{operator:`>`,semver:new SemVer(partialToVersion(S))}]:n===`<`?S.minor===null?[{operator:`<`,semver:new SemVer(`${S.major}.0.0`)}]:S.patch===null?[{operator:`<`,semver:new SemVer(`${S.major}.${S.minor}.0`)}]:[{operator:`<`,semver:new SemVer(partialToVersion(S))}]:n===`>=`?[{operator:`>=`,semver:new SemVer(partialToVersion(S))}]:S.minor===null?[{operator:`<`,semver:new SemVer(`${S.major+1}.0.0`)}]:S.patch===null?[{operator:`<`,semver:new SemVer(`${S.major}.${S.minor+1}.0`)}]:[{operator:`<=`,semver:new SemVer(partialToVersion(S))}]}function hyphenRange(n,a){let S=parsePartial(n),C=parsePartial(a),N=S.major===null?{operator:`>=`,semver:new SemVer(`0.0.0`)}:{operator:`>=`,semver:new SemVer(`${S.major}.${S.minor??0}.${S.patch??0}${S.pre?`-${S.pre}`:``}`)},F;return F=C.major===null?{operator:`>=`,semver:new SemVer(`0.0.0`)}:C.minor===null?{operator:`<`,semver:new SemVer(`${C.major+1}.0.0`)}:C.patch===null?{operator:`<`,semver:new SemVer(`${C.major}.${C.minor+1}.0`)}:{operator:`<=`,semver:new SemVer(`${C.major}.${C.minor}.${C.patch}${C.pre?`-${C.pre}`:``}`)},[N,F]}var tE,nE,SemVer,rE,iE=__esmMin(()=>{tE=/^(0|[1-9]\d*)$/,nE=/^(\d+)\.(\d+)\.(\d+)(?:-((?:[0-9A-Za-z-]+)(?:\.[0-9A-Za-z-]+)*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/,SemVer=class{major;minor;patch;prerelease;build;version;constructor(n){let a=String(n).trim().replace(/^v/,``),S=nE.exec(a);if(!S)throw TypeError(`Invalid Version: ${n}`);this.major=Number(S[1]),this.minor=Number(S[2]),this.patch=Number(S[3]),this.prerelease=S[4]?S[4].split(`.`).map(n=>tE.test(n)?Number(n):n):[],this.build=S[5]?S[5].split(`.`):[],this.version=`${this.major}.${this.minor}.${this.patch}`+(this.prerelease.length?`-${this.prerelease.join(`.`)}`:``)+(this.build.length?`+${this.build.join(`.`)}`:``)}compare(n){return this.major===n.major?this.minor===n.minor?this.patch===n.patch?this.comparePre(n):this.patch<n.patch?-1:1:this.minor<n.minor?-1:1:this.major<n.major?-1:1}comparePre(n){let a=this.prerelease,S=n.prerelease;if(a.length===0&&S.length===0)return 0;if(a.length===0)return 1;if(S.length===0)return-1;for(let n=0;;n++){let C=a[n],N=S[n];if(C===void 0&&N===void 0)return 0;if(N===void 0)return 1;if(C===void 0)return-1;if(C===N)continue;let F=typeof C==`number`,I=typeof N==`number`;return F&&!I?-1:!F&&I?1:C<N?-1:1}}toString(){return this.version}},rE=class Range{raw;set;constructor(n){if(n instanceof Range){this.raw=n.raw,this.set=n.set;return}this.raw=String(n).trim();let a=this.raw.split(/\s*\|\|\s*/),S=[];for(let n of a){let a=parseRangePart(n);if(a.length===0)throw TypeError(`Invalid range: ${this.raw}`);S.push(a)}if(S.length===0)throw TypeError(`Invalid range: ${this.raw}`);this.set=S}test(n){let a=n instanceof SemVer?n:parse(String(n));if(!a)return!1;for(let n of this.set)if(n.every(n=>testComparator(n,a))){if(a.prerelease.length>0&&!n.some(n=>n.semver!==null&&n.semver.prerelease.length>0&&n.semver.major===a.major&&n.semver.minor===a.minor&&n.semver.patch===a.patch))continue;return!0}return!1}format(){return this.set.map(n=>n.map(formatComparator).join(` `)).join(` || `)}toString(){return this.format()}}});function assertPackument(n,a){if(!a||typeof a!=`object`)throw TypeError(`registry: ${n} packument is not an object`);let S=a;if(typeof S.name!=`string`)throw TypeError(`registry: ${n} packument missing string name`);if(!S.versions||typeof S.versions!=`object`)throw TypeError(`registry: ${n} packument missing versions map`)}function registryFor(n,a){if(a&&n.startsWith(`@`)){let S=n.slice(0,n.indexOf(`/`)),C=a.scopes[S];if(C)return ensureTrailingSlash(C)}return a?.registry?ensureTrailingSlash(a.registry):aE}function packumentUrl(n,a){let S=ensureTrailingSlash(a);if(n.startsWith(`@`)){let a=n.indexOf(`/`);if(a<0)throw TypeError(`Invalid scoped package name: ${n}`);let C=n.slice(0,a),N=n.slice(a+1);return`${S}${encodeURIComponent(C)}/${encodeURIComponent(N)}`}return`${S}${encodeURIComponent(n)}`}async function fetchPackument(n,a={}){let S=packumentUrl(n,a.registry??registryFor(n,a.npmrc)),C=buildHeaders(S,a);C.accept??=`application/vnd.npm.install-v1+json`;let N=a.fetch??globalThis.fetch;if(!N)throw Error(`@gjsify/npm-registry: globalThis.fetch is missing`);let F=await N(S,{headers:C,signal:a.signal});if(!F.ok)throw F.status===404?new PackageNotFoundError(n,S):Error(`registry GET ${S} -> ${F.status} ${F.statusText}`);let I=await F.json();return assertPackument(n,I),I}async function fetchTarball(n,a={}){let S=buildHeaders(n,a);S.accept??=`application/octet-stream`;let C=a.fetch??globalThis.fetch;if(!C)throw Error(`@gjsify/npm-registry: globalThis.fetch is missing`);let N=await C(n,{headers:S,signal:a.signal});if(!N.ok)throw Error(`tarball GET ${n} -> ${N.status} ${N.statusText}`);let F=new Uint8Array(await N.arrayBuffer());if(a.integrity&&!await verifyIntegrity(F,a.integrity))throw new IntegrityError(n,a.integrity);return F}async function verifyIntegrity(n,a){let S=a.trim().split(/\s+/);for(let a of S){let S=a.indexOf(`-`);if(S<0)continue;let C=a.slice(0,S).toLowerCase(),N=a.slice(S+1),F=globalThis.crypto?.subtle;if(!F)throw Error(`@gjsify/npm-registry: globalThis.crypto.subtle is missing`);let I=subriToWebCryptoAlgo(C);if(!I)continue;let H=await F.digest(I,dataAsArrayBuffer(n));if(bytesToBase64(new Uint8Array(H))===N)return!0}return!1}function subriToWebCryptoAlgo(n){switch(n){case`sha1`:return`SHA-1`;case`sha256`:return`SHA-256`;case`sha384`:return`SHA-384`;case`sha512`:return`SHA-512`;default:return null}}function dataAsArrayBuffer(n){if(n.byteOffset===0&&n.byteLength===n.buffer.byteLength)return n.buffer;let a=new Uint8Array(n.byteLength);return a.set(n),a.buffer}function bytesToBase64(n){let a=``;for(let S=0;S<n.length;S++)a+=String.fromCharCode(n[S]);return btoa(a)}function parseNpmrc(n){let a={registry:aE,scopes:{},authTokens:{},basicAuth:{}},S=n.split(/\r?\n/),C={};for(let n of S){let S=n.replace(/^\s+|\s+$/g,``);if(!S||S.startsWith(`#`)||S.startsWith(`;`))continue;let N=S.indexOf(`=`);if(N<0)continue;let F=S.slice(0,N).trim(),I=expandEnv(stripQuotes(S.slice(N+1).trim()));if(F===`registry`){a.registry=ensureTrailingSlash(I);continue}let H=F.match(/^(@[^:]+):registry$/);if(H){a.scopes[H[1]]=ensureTrailingSlash(I);continue}let W=F.match(/^\/\/(.+):_authToken$/);if(W){a.authTokens[normalizeAuthHost(W[1])]=I;continue}let K=F.match(/^\/\/(.+):username$/);if(K){(C[normalizeAuthHost(K[1])]??={}).user=I;continue}let q=F.match(/^\/\/(.+):_password$/);if(q){let n=base64Decode(I);(C[normalizeAuthHost(q[1])]??={}).pass=n;continue}}for(let[n,S]of Object.entries(C))S.user&&S.pass!==void 0&&(a.basicAuth[n]={username:S.user,password:S.pass});return a}function buildHeaders(n,a){let S={"user-agent":`gjsify-install/0.3.7`};if(a.npmrc){let C=resolveAuthForUrl(n,a.npmrc);C&&(S.authorization=C)}if(a.headers)for(let[n,C]of Object.entries(a.headers))S[n.toLowerCase()]=C;return S}function resolveAuthForUrl(n,a){let S=pathPrefixes(new URL(n));for(let n of S){let S=a.authTokens[n];if(S)return`Bearer ${S}`;let C=a.basicAuth[n];if(C)return`Basic ${btoa(`${C.username}:${C.password}`)}`}return null}function pathPrefixes(n){let a=n.pathname.split(`/`).filter(Boolean),S=[];for(let C=a.length;C>=0;C--){let N=a.slice(0,C).join(`/`);S.push(N?`//${n.host}/${N}`:`//${n.host}`)}return S}function normalizeAuthHost(n){return`//${n.replace(/\/+$/,``)}`}function ensureTrailingSlash(n){return n.endsWith(`/`)?n:n+`/`}function stripQuotes(n){return n.startsWith(`"`)&&n.endsWith(`"`)||n.startsWith(`'`)&&n.endsWith(`'`)?n.slice(1,-1):n}function expandEnv(n){return n.replace(/\$\{([A-Z0-9_]+)\}/gi,(n,a)=>globalThis.process?.env?.[a]??``)}function base64Decode(n){return atob(n)}var aE,PackageNotFoundError,IntegrityError,oE=__esmMin(()=>{aE=`https://registry.npmjs.org/`,PackageNotFoundError=class extends Error{name;url;constructor(n,a){super(`Package not found in registry: ${n} (${a})`),this.name=n,this.url=a,this.name=`PackageNotFoundError`}},IntegrityError=class extends Error{url;integrity;constructor(n,a){super(`Tarball integrity mismatch for ${n} (expected ${a})`),this.url=n,this.integrity=a,this.name=`IntegrityError`}}});function parseTar(n){let a=[],S=null,C=null,N=null,F=0;for(;F+512<=n.length;){let I=n.subarray(F,F+512);if(allZeros(I)){let a=n.subarray(F+512,F+2*512);if(a.length===512&&allZeros(a))break;F+=512;continue}if(!validateChecksum(I))throw new TarParseError(`Bad header checksum at offset ${F} — file is not a valid tar archive`);let H=readString(I,0,100),W=parseOctal(I,100,8),K=parseOctal(I,124,12),q=parseOctal(I,136,12),Y=String.fromCharCode(I[156]||0),X=readString(I,157,100),te=readString(I,257,6),ne=readString(I,345,155),re=readString(I,265,32),ie=readString(I,297,32);F+=512;let ae=n.subarray(F,F+K);if(F+=alignToBlock(K),Y===`x`){S=parsePaxRecords(ae);continue}if(Y===`g`)continue;if(Y===`L`){C=bytesToString(ae).replace(/\0+$/,``);continue}if(Y===`K`){N=bytesToString(ae).replace(/\0+$/,``);continue}let oe=H;te===`ustar`&&ne!==``&&(oe=`${ne}/${H}`),C!==null&&(oe=C,C=null);let Z=X;if(N!==null&&(Z=N,N=null),S!==null){let C=S.get(`path`);C!==void 0&&(oe=C);let N=S.get(`linkpath`);N!==void 0&&(Z=N);let I=S.get(`size`);if(I!==void 0){let C=Number(I);if(Number.isFinite(C)){let N=F-alignToBlock(K),I=n.subarray(N,N+C);F=N+alignToBlock(C),S=null,a.push(buildEntry(oe,Z,Y,W,q,re,ie,I));continue}}S=null}a.push(buildEntry(oe,Z,Y,W,q,re,ie,ae))}return a}function buildEntry(n,a,S,C,N,F,I,H){return{name:n,linkname:a,type:typeflagToType(S,n),mode:C,mtime:N,body:H,uname:F,gname:I}}function typeflagToType(n,a){switch(n){case`0`:case`\0`:case``:return a.endsWith(`/`)?`directory`:`file`;case`1`:return`hardlink`;case`2`:return`symlink`;case`5`:return`directory`;case`x`:return`pax-header`;case`g`:return`pax-global`;case`L`:return`gnu-longname`;case`K`:return`gnu-longlink`;default:return`unknown`}}function parsePaxRecords(n){let a=new Map,S=0;for(;S<n.length;){let C=S;for(;C<n.length&&n[C]!==32;)C++;if(C>=n.length)break;let N=bytesToString(n.subarray(S,C)),F=Number(N);if(!Number.isFinite(F)||F<=0)break;let I=S+F;if(I>n.length)break;let H=bytesToString(n.subarray(C+1,I-1)),W=H.indexOf(`=`);if(W>0){let n=H.slice(0,W),S=H.slice(W+1);a.set(n,S)}S=I}return a}function readString(n,a,S){let C=a,N=a+S;for(;C<N&&n[C]!==0;)C++;return bytesToString(n.subarray(a,C))}function bytesToString(n){return new TextDecoder(`utf-8`,{fatal:!1}).decode(n)}function parseOctal(n,a,S){if(S>0&&n[a]&128){let C=n[a]&127;for(let N=1;N<S;N++)C=C*256+n[a+N];return C}let C=``;for(let N=0;N<S;N++){let S=n[a+N];S===0||S===32||(C+=String.fromCharCode(S))}return C===``?0:parseInt(C,8)}function alignToBlock(n){return Math.ceil(n/512)*512}function allZeros(n){for(let a=0;a<n.length;a++)if(n[a]!==0)return!1;return!0}function validateChecksum(n){let a=parseOctal(n,148,8),S=0,C=0;for(let a=0;a<512;a++){let N=a>=148&&a<156?32:n[a];S+=N,C+=N>127?N-256:N}return a===S||a===C}var TarParseError,sE=__esmMin(()=>{TarParseError=class extends Error{constructor(n){super(n),this.name=`TarParseError`}}});async function extractTarball(n,a,S={}){let C=n instanceof Uint8Array?n:new Uint8Array(n),N=parseTar(S.gzip??(C.length>=2&&C[0]===31&&C[1]===139)?await gunzip(C):C);mkdirSync(a,{recursive:!0});let F=S.strip??1,I=S.preventEscape??!0,H={files:[],directories:[],symlinks:[],skipped:0};for(let n of N){let C=stripComponents(n.name,F);if(C===null||C===``){H.skipped++;continue}let N=Ao(a,C);if(I&&!isInside(N,a))throw Error(`tar: refusing to extract ${n.name} outside ${a} (resolved=${N})`);if(S.filter&&!S.filter(n,N)){H.skipped++;continue}if(n.type===`directory`){mkdirSync(N,{recursive:!0}),H.directories.push(N);continue}if(n.type===`file`){mkdirSync(Io(N),{recursive:!0}),writeFileSync(N,n.body);let a=S.chmod?.(n,N)??n.mode&511;if(a>0)try{chmodSync(N,a)}catch{}H.files.push(N);continue}if(n.type===`symlink`){mkdirSync(Io(N),{recursive:!0});try{symlinkSync(n.linkname,N),H.symlinks.push(N)}catch{writeFileSync(N,n.linkname),H.files.push(N)}continue}H.skipped++}return H}async function gunzip(n){let a=globalThis.DecompressionStream;if(typeof a!=`function`)throw Error(`@gjsify/tar: globalThis.DecompressionStream is not available — import '@gjsify/compression-streams/register' on GJS to register it`);let S=new Blob([new Uint8Array(n)]).stream().pipeThrough(new a(`gzip`)),C=[],N=0,F=S.getReader();for(;;){let{value:n,done:a}=await F.read();if(a)break;let S=n instanceof Uint8Array?n:new Uint8Array(n);C.push(S),N+=S.length}let I=new Uint8Array(N),H=0;for(let n of C)I.set(n,H),H+=n.length;return I}function stripComponents(n,a){if(a<=0)return n;let S=n.split(`/`).filter(n=>n!==``);return S.length<=a?null:S.slice(a).join(`/`)}function isInside(n,a){let S=Po(a,n);return S!==``&&!S.startsWith(`..`)&&!Mo(S)}var cE=__esmMin(()=>{sE(),Fs(),Wo()}),lE=__esmMin(()=>{cE()}),uE=__exportAll$3({installPackagesNative:()=>installPackagesNative});async function installPackagesNative(n){if(n.specs.length===0)throw Error(`installPackagesNative: empty specs list`);mkdirSync(n.prefix,{recursive:!0});let a=await loadNpmrc(n),S=makeLogger(n.verbose??!1),C=No(n.prefix,fE),N=readLockfile(C),F;if(n.frozen){if(!N)throw Error(`install: --immutable requires ${fE} at ${n.prefix} — none found. Run \`gjsify install\` (without --immutable) to generate one and commit it.`);let a=describeLockfileDrift(N,n.specs);if(a)throw Error(`install: --immutable but ${C} is stale.\n${a}\nRe-run \`gjsify install\` (without --immutable) to refresh the lockfile.`);S(`install: --immutable, using lockfile (%d package(s))`,Object.keys(N.packages).length),F=lockfileToNodes(N)}else N&&lockfileMatchesRequest(N,n.specs)?(S(`install: using lockfile (%d package(s))`,Object.keys(N.packages).length),F=lockfileToNodes(N)):(S(`install: resolving %d top-level spec(s) → %s`,n.specs.length,n.prefix),F=await resolveDeps(n.specs,a,S),n.lockfile&&(writeLockfile(C,n.specs,F),S(`install: wrote %s (%d entries)`,fE,F.length)));return S(`install: downloading %d tarball(s)`,F.length),await downloadAndExtractAll(F,n.prefix,a,S),await linkBins(F,n.prefix,S),S(`install: done`),topLevelResolutions(n.specs,F)}function topLevelResolutions(n,a){let S=new Map;for(let n of a)n.installPath===`node_modules/${n.name}`&&S.set(n.name,n);let C=[];for(let a of n){let n=parseSpecName(a),N=S.get(n);N&&C.push({name:N.name,version:N.version})}return C}function parseSpecName(n){if(n.startsWith(`@`)){let a=n.indexOf(`/`);if(a===-1)return n;let S=n.indexOf(`@`,a+1);return S===-1?n:n.slice(0,S)}let a=n.indexOf(`@`);return a===-1?n:n.slice(0,a)}async function resolveDeps(n,a,S){let C=new Map,fetchPkg=n=>{let S=C.get(n);if(S)return S;let N=fetchPackument(n,{npmrc:a});return C.set(n,N),N},N=new Map,F=new Map,I=n.map(parseSpec).map(n=>({from:null,name:n.name,range:n.range,required:!0}));for(;I.length>0;){let n=I.shift(),a=findVisible(n.from,n.name,N);if(a&&satisfiesRange(a.version,n.range))continue;let C=null;try{let a=await fetchPkg(n.name);if(C=pickVersion(a,n.range),!C){if(!n.required)continue;throw Error(`No version of ${n.name} satisfies ${n.range}`)}let H=a.versions[C];if(!H)throw Error(`Packument for ${n.name} promised ${C} but no entry exists`);let W=decidePlacement(n.from,n.name,C,F),K={name:n.name,version:C,tarballUrl:H.dist.tarball,integrity:H.dist.integrity,installPath:W,dependencies:H.dependencies??{},optionalDependencies:H.optionalDependencies??{},bin:H.bin};N.set(W,K),W===`node_modules/${n.name}`&&F.set(n.name,K),S(`resolve: %s@%s ← %s (at %s)`,n.name,C,n.range,W);for(let[n,a]of Object.entries(K.dependencies))I.push({from:W,name:n,range:a,required:!0});for(let[n,a]of Object.entries(K.optionalDependencies))I.push({from:W,name:n,range:a,required:!1})}catch(a){if(!n.required){S(`resolve: optional dep %s@%s skipped (%s)`,n.name,n.range,a.message);continue}throw a}}return Array.from(N.values())}function findVisible(n,a,S){let C=[];if(n!==null){C.push(`${n}/node_modules/${a}`);let S=n;for(;;){let n=S.lastIndexOf(`/node_modules/`);if(n<0||(S=S.slice(0,n),C.push(`${S}/node_modules/${a}`),S===``))break}}C.push(`node_modules/${a}`);for(let n of C){let a=S.get(n);if(a)return a}return null}function decidePlacement(n,a,S,C){let N=C.get(a);return!N||N.version===S||n===null?`node_modules/${a}`:`${n}/node_modules/${a}`}function satisfiesRange(n,a){try{return satisfies(n,new rE(a))}catch{return!1}}function readLockfile(n){if(!existsSync(n))return null;try{let a=JSON.parse(readFileSync(n,`utf-8`));return a.lockfileVersion!==pE||!a.packages||typeof a.packages!=`object`?null:a}catch{return null}}function writeLockfile(n,a,S){let C={},N=[...S].sort((n,a)=>n.installPath<a.installPath?-1:+(n.installPath>a.installPath));for(let n of N)C[n.installPath]={version:n.version,resolved:n.tarballUrl,integrity:n.integrity,dependencies:Object.keys(n.dependencies).length>0?n.dependencies:void 0,bin:n.bin};let F={lockfileVersion:pE,requested:[...a],packages:C};writeFileSync(n,JSON.stringify(F,null,2)+`
+`}const $T={command:`flatpak <subcommand>`,description:`Flatpak toolchain: init/build/deps/ci subcommands for shipping GJS apps and CLIs as Flatpaks.`,builder:n=>n.command(YT.command,YT.description,YT.builder,YT.handler).command(XT.command,XT.description,XT.builder,XT.handler).command(ZT.command,ZT.description,ZT.builder,ZT.handler).command(QT.command,QT.description,QT.builder,QT.handler).demandCommand(1).strict()};Fs(),Wo();const eE=/^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;function parseSpec$1(n){if(!n)throw Error(`dlx: empty package spec`);if(n.startsWith(`./`)||n.startsWith(`../`)||Mo(n)||existsSync(n))return{kind:`local`,path:Ao(n)};let a=n,S,C=n.lastIndexOf(`@`);if(C>0&&(a=n.slice(0,C),S=n.slice(C+1)),!eE.test(a))throw Error(`dlx: invalid package name "${a}"`);return{kind:`registry`,name:a,version:S,spec:n}}__name$1(parseSpec$1,`parseSpec`),Fs(),Wo();function resolveGjsEntry(n,a){let S=No(n,`package.json`);if(!existsSync(S))throw Error(`dlx: no package.json found at ${n}`);let C=JSON.parse(readFileSync(S,`utf-8`)),N=C.gjsify?.bin,F=C.gjsify?.main,I=C.main,H,W=null,K=!1;if(a!==null){if(!N||!N[a]){let S=N?Object.keys(N).join(`, `):`(none)`;throw Error(`dlx: package "${C.name??n}" has no GJS bin named "${a}" — known: ${S}`)}H=N[a],W=a}else if(N&&Object.keys(N).length===1){let n=Object.keys(N)[0];H=N[n],W=n}else F?H=F:I&&(H=I,K=!0);if(N&&Object.keys(N).length>1&&a===null){let a=Object.keys(N).join(`, `);throw Error(`dlx: package "${C.name??n}" defines multiple GJS bins — pass one of: ${a}`)}if(!H)throw Error(`dlx: package "${C.name??n}" has no GJS entry — set \`gjsify.main\` (or \`gjsify.bin\`) in its package.json`);let q=Ao(n,H);if(!existsSync(q))throw Error(`dlx: GJS entry not found: ${q}`);return{bundlePath:q,binName:W,fromFallback:K}}ka(),Fs(),rp(),Wo();function lexCompare(n,a){return n<a?-1:+(n>a)}function createCacheKey(n){let a=[...n.packages].sort(lexCompare),S=Object.entries(n.registries??{}).sort(([n],[a])=>lexCompare(n,a)),C=JSON.stringify([a,S]);return createHash(`sha256`).update(C).digest(`hex`)}function dlxCacheRoot(){let n=process.env.XDG_CACHE_HOME,a=No(n&&n.length>0?n:No(homedir(),`.cache`),`gjsify`,`dlx`);return mkdirSync(a,{recursive:!0}),a}function cacheDirFor(n){let a=No(dlxCacheRoot(),n);return mkdirSync(a,{recursive:!0}),a}function makePrepareDir(n){let a=No(n,`${Date.now().toString(16)}-${process.pid.toString(16)}`);return mkdirSync(a,{recursive:!0}),a}function getValidCachedPkg(n,a=10080){let S=No(n,`pkg`),C;try{C=lstatSync(S)}catch(n){if(n.code===`ENOENT`)return;throw n}if(!C.isSymbolicLink())return;let N;try{N=realpathSync(S)}catch{return}return Date.now()-C.mtime.getTime()<=a*6e4?N:void 0}function symlinkSwap(n,a){let S=No(n,`pkg`),C=No(n,`pkg.tmp-${Date.now().toString(16)}-${process.pid.toString(16)}`);try{symlinkSync(a,C,`dir`)}catch(n){throw n}try{renameSync(C,S)}catch(n){let a=n.code;if(a===`EBUSY`||a===`EPERM`||a===`EEXIST`){try{rmSync(C)}catch{}return realpathSync(S)}throw n}return realpathSync(S)}function resolveInstalledPkgDir(n,a){return Ao(n,`node_modules`,a)}function parse(n){try{return new SemVer(n)}catch{return null}}function satisfies(n,a){let S=a instanceof rE?a:new rE(a),C=n instanceof SemVer?n:parse(String(n));return C?S.test(C):!1}function maxSatisfying(n,a){let S=a instanceof rE?a:new rE(a),C=null;for(let a of n){let n=parse(a);!n||!S.test(n)||(C===null||n.compare(C)>0)&&(C=n)}return C?C.version:null}function testComparator(n,a){if(n.semver===null)return!0;let S=a.compare(n.semver);switch(n.operator){case``:case`=`:return S===0;case`<`:return S<0;case`<=`:return S<=0;case`>`:return S>0;case`>=`:return S>=0}}function formatComparator(n){return n.semver===null?`*`:`${n.operator}${n.semver.version}`}function parseRangePart(n){let a=n.trim();if(a===``||a===`*`||a.toLowerCase()===`latest`)return[{operator:`>=`,semver:new SemVer(`0.0.0`)}];let S=a.match(/^\s*(\S+)\s+-\s+(\S+)\s*$/);if(S)return hyphenRange(S[1],S[2]);let C=a.replace(/(<=|>=|<|>|=)\s+(?=\S)/g,`$1`).split(/\s+/),N=[];for(let n of C)N.push(...parseSimple(n));return N}function parseSimple(n){if(n===`*`||n===``||n.toLowerCase()===`latest`)return[{operator:`>=`,semver:new SemVer(`0.0.0`)}];if(n.startsWith(`^`))return caretRange(n.slice(1));if(n.startsWith(`~`))return tildeRange(n.slice(1).replace(/^>/,``));let a=n.match(/^(<=|>=|<|>|=)\s*(.+)$/);if(a){let n=a[1];return primitiveRange(n,a[2])}return partialRange(n)}function parsePartial(n){let a=n.trim().replace(/^v/,``);if(a===``||a===`*`)return{major:null,minor:null,patch:null,pre:``,build:``};let S=``,C=``,N=a,F=N.indexOf(`+`);F>=0&&(C=N.slice(F+1),N=N.slice(0,F));let I=N.indexOf(`-`);I>=0&&(S=N.slice(I+1),N=N.slice(0,I));let H=N.split(`.`),xr=a=>{if(a===void 0||a===``||a===`x`||a===`X`||a===`*`)return null;if(!/^\d+$/.test(a))throw TypeError(`Invalid partial version: ${n}`);return Number(a)};return{major:xr(H[0]),minor:xr(H[1]),patch:xr(H[2]),pre:S,build:C}}function partialToVersion(n){return`${n.major??0}.${n.minor??0}.${n.patch??0}${n.pre?`-${n.pre}`:``}${n.build?`+${n.build}`:``}`}function partialRange(n){let a=parsePartial(n);return a.major===null?[{operator:`>=`,semver:new SemVer(`0.0.0`)}]:a.minor===null?[{operator:`>=`,semver:new SemVer(`${a.major}.0.0`)},{operator:`<`,semver:new SemVer(`${a.major+1}.0.0`)}]:a.patch===null?[{operator:`>=`,semver:new SemVer(`${a.major}.${a.minor}.0`)},{operator:`<`,semver:new SemVer(`${a.major}.${a.minor+1}.0`)}]:[{operator:`=`,semver:new SemVer(partialToVersion(a))}]}function caretRange(n){let a=parsePartial(n);if(a.major===null)return[{operator:`>=`,semver:new SemVer(`0.0.0`)}];let S=`${a.major}.${a.minor??0}.${a.patch??0}${a.pre?`-${a.pre}`:``}`,C;return C=a.major>0||a.minor===null?`${a.major+1}.0.0`:a.minor>0||a.patch===null?`0.${a.minor+1}.0`:`0.0.${a.patch+1}`,[{operator:`>=`,semver:new SemVer(S)},{operator:`<`,semver:new SemVer(C)}]}function tildeRange(n){let a=parsePartial(n);if(a.major===null)return[{operator:`>=`,semver:new SemVer(`0.0.0`)}];let S=`${a.major}.${a.minor??0}.${a.patch??0}${a.pre?`-${a.pre}`:``}`,C=a.minor===null?`${a.major+1}.0.0`:`${a.major}.${a.minor+1}.0`;return[{operator:`>=`,semver:new SemVer(S)},{operator:`<`,semver:new SemVer(C)}]}function primitiveRange(n,a){let S=parsePartial(a);return S.major===null?[{operator:`>=`,semver:new SemVer(`0.0.0`)}]:n===`=`||n===``?partialRange(a):n===`>`?S.minor===null?[{operator:`>=`,semver:new SemVer(`${S.major+1}.0.0`)}]:S.patch===null?[{operator:`>=`,semver:new SemVer(`${S.major}.${S.minor+1}.0`)}]:[{operator:`>`,semver:new SemVer(partialToVersion(S))}]:n===`<`?S.minor===null?[{operator:`<`,semver:new SemVer(`${S.major}.0.0`)}]:S.patch===null?[{operator:`<`,semver:new SemVer(`${S.major}.${S.minor}.0`)}]:[{operator:`<`,semver:new SemVer(partialToVersion(S))}]:n===`>=`?[{operator:`>=`,semver:new SemVer(partialToVersion(S))}]:S.minor===null?[{operator:`<`,semver:new SemVer(`${S.major+1}.0.0`)}]:S.patch===null?[{operator:`<`,semver:new SemVer(`${S.major}.${S.minor+1}.0`)}]:[{operator:`<=`,semver:new SemVer(partialToVersion(S))}]}function hyphenRange(n,a){let S=parsePartial(n),C=parsePartial(a),N=S.major===null?{operator:`>=`,semver:new SemVer(`0.0.0`)}:{operator:`>=`,semver:new SemVer(`${S.major}.${S.minor??0}.${S.patch??0}${S.pre?`-${S.pre}`:``}`)},F;return F=C.major===null?{operator:`>=`,semver:new SemVer(`0.0.0`)}:C.minor===null?{operator:`<`,semver:new SemVer(`${C.major+1}.0.0`)}:C.patch===null?{operator:`<`,semver:new SemVer(`${C.major}.${C.minor+1}.0`)}:{operator:`<=`,semver:new SemVer(`${C.major}.${C.minor}.${C.patch}${C.pre?`-${C.pre}`:``}`)},[N,F]}var tE,nE,SemVer,rE,iE=__esmMin(()=>{tE=/^(0|[1-9]\d*)$/,nE=/^(\d+)\.(\d+)\.(\d+)(?:-((?:[0-9A-Za-z-]+)(?:\.[0-9A-Za-z-]+)*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/,SemVer=class{major;minor;patch;prerelease;build;version;constructor(n){let a=String(n).trim().replace(/^v/,``),S=nE.exec(a);if(!S)throw TypeError(`Invalid Version: ${n}`);this.major=Number(S[1]),this.minor=Number(S[2]),this.patch=Number(S[3]),this.prerelease=S[4]?S[4].split(`.`).map(n=>tE.test(n)?Number(n):n):[],this.build=S[5]?S[5].split(`.`):[],this.version=`${this.major}.${this.minor}.${this.patch}`+(this.prerelease.length?`-${this.prerelease.join(`.`)}`:``)+(this.build.length?`+${this.build.join(`.`)}`:``)}compare(n){return this.major===n.major?this.minor===n.minor?this.patch===n.patch?this.comparePre(n):this.patch<n.patch?-1:1:this.minor<n.minor?-1:1:this.major<n.major?-1:1}comparePre(n){let a=this.prerelease,S=n.prerelease;if(a.length===0&&S.length===0)return 0;if(a.length===0)return 1;if(S.length===0)return-1;for(let n=0;;n++){let C=a[n],N=S[n];if(C===void 0&&N===void 0)return 0;if(N===void 0)return 1;if(C===void 0)return-1;if(C===N)continue;let F=typeof C==`number`,I=typeof N==`number`;return F&&!I?-1:!F&&I?1:C<N?-1:1}}toString(){return this.version}},rE=class Range{raw;set;constructor(n){if(n instanceof Range){this.raw=n.raw,this.set=n.set;return}this.raw=String(n).trim();let a=this.raw.split(/\s*\|\|\s*/),S=[];for(let n of a){let a=parseRangePart(n);if(a.length===0)throw TypeError(`Invalid range: ${this.raw}`);S.push(a)}if(S.length===0)throw TypeError(`Invalid range: ${this.raw}`);this.set=S}test(n){let a=n instanceof SemVer?n:parse(String(n));if(!a)return!1;for(let n of this.set)if(n.every(n=>testComparator(n,a))){if(a.prerelease.length>0&&!n.some(n=>n.semver!==null&&n.semver.prerelease.length>0&&n.semver.major===a.major&&n.semver.minor===a.minor&&n.semver.patch===a.patch))continue;return!0}return!1}format(){return this.set.map(n=>n.map(formatComparator).join(` `)).join(` || `)}toString(){return this.format()}}});function assertPackument(n,a){if(!a||typeof a!=`object`)throw TypeError(`registry: ${n} packument is not an object`);let S=a;if(typeof S.name!=`string`)throw TypeError(`registry: ${n} packument missing string name`);if(!S.versions||typeof S.versions!=`object`)throw TypeError(`registry: ${n} packument missing versions map`)}function registryFor(n,a){if(a&&n.startsWith(`@`)){let S=n.slice(0,n.indexOf(`/`)),C=a.scopes[S];if(C)return ensureTrailingSlash(C)}return a?.registry?ensureTrailingSlash(a.registry):aE}function packumentUrl(n,a){let S=ensureTrailingSlash(a);if(n.startsWith(`@`)){let a=n.indexOf(`/`);if(a<0)throw TypeError(`Invalid scoped package name: ${n}`);let C=n.slice(0,a),N=n.slice(a+1);return`${S}${encodeURIComponent(C)}/${encodeURIComponent(N)}`}return`${S}${encodeURIComponent(n)}`}async function fetchPackument(n,a={}){let S=packumentUrl(n,a.registry??registryFor(n,a.npmrc)),C=buildHeaders(S,a);C.accept??=`application/vnd.npm.install-v1+json`;let N=a.fetch??globalThis.fetch;if(!N)throw Error(`@gjsify/npm-registry: globalThis.fetch is missing`);let F=await N(S,{headers:C,signal:a.signal});if(!F.ok)throw F.status===404?new PackageNotFoundError(n,S):Error(`registry GET ${S} -> ${F.status} ${F.statusText}`);let I=await F.json();return assertPackument(n,I),I}async function fetchTarball(n,a={}){let S=buildHeaders(n,a);S.accept??=`application/octet-stream`;let C=a.fetch??globalThis.fetch;if(!C)throw Error(`@gjsify/npm-registry: globalThis.fetch is missing`);let N=await C(n,{headers:S,signal:a.signal});if(!N.ok)throw Error(`tarball GET ${n} -> ${N.status} ${N.statusText}`);let F=new Uint8Array(await N.arrayBuffer());if(a.integrity&&!await verifyIntegrity(F,a.integrity))throw new IntegrityError(n,a.integrity);return F}async function verifyIntegrity(n,a){let S=a.trim().split(/\s+/);for(let a of S){let S=a.indexOf(`-`);if(S<0)continue;let C=a.slice(0,S).toLowerCase(),N=a.slice(S+1),F=globalThis.crypto?.subtle;if(!F)throw Error(`@gjsify/npm-registry: globalThis.crypto.subtle is missing`);let I=subriToWebCryptoAlgo(C);if(!I)continue;let H=await F.digest(I,dataAsArrayBuffer(n));if(bytesToBase64(new Uint8Array(H))===N)return!0}return!1}function subriToWebCryptoAlgo(n){switch(n){case`sha1`:return`SHA-1`;case`sha256`:return`SHA-256`;case`sha384`:return`SHA-384`;case`sha512`:return`SHA-512`;default:return null}}function dataAsArrayBuffer(n){if(n.byteOffset===0&&n.byteLength===n.buffer.byteLength)return n.buffer;let a=new Uint8Array(n.byteLength);return a.set(n),a.buffer}function bytesToBase64(n){let a=``;for(let S=0;S<n.length;S++)a+=String.fromCharCode(n[S]);return btoa(a)}function parseNpmrc(n){let a={registry:aE,scopes:{},authTokens:{},basicAuth:{}},S=n.split(/\r?\n/),C={};for(let n of S){let S=n.replace(/^\s+|\s+$/g,``);if(!S||S.startsWith(`#`)||S.startsWith(`;`))continue;let N=S.indexOf(`=`);if(N<0)continue;let F=S.slice(0,N).trim(),I=expandEnv(stripQuotes(S.slice(N+1).trim()));if(F===`registry`){a.registry=ensureTrailingSlash(I);continue}let H=F.match(/^(@[^:]+):registry$/);if(H){a.scopes[H[1]]=ensureTrailingSlash(I);continue}let W=F.match(/^\/\/(.+):_authToken$/);if(W){a.authTokens[normalizeAuthHost(W[1])]=I;continue}let K=F.match(/^\/\/(.+):username$/);if(K){(C[normalizeAuthHost(K[1])]??={}).user=I;continue}let q=F.match(/^\/\/(.+):_password$/);if(q){let n=base64Decode(I);(C[normalizeAuthHost(q[1])]??={}).pass=n;continue}}for(let[n,S]of Object.entries(C))S.user&&S.pass!==void 0&&(a.basicAuth[n]={username:S.user,password:S.pass});return a}function buildHeaders(n,a){let S={"user-agent":`gjsify-install/0.3.7`};if(a.npmrc){let C=resolveAuthForUrl(n,a.npmrc);C&&(S.authorization=C)}if(a.headers)for(let[n,C]of Object.entries(a.headers))S[n.toLowerCase()]=C;return S}function resolveAuthForUrl(n,a){let S=pathPrefixes(new URL(n));for(let n of S){let S=a.authTokens[n];if(S)return`Bearer ${S}`;let C=a.basicAuth[n];if(C)return`Basic ${btoa(`${C.username}:${C.password}`)}`}return null}function pathPrefixes(n){let a=n.pathname.split(`/`).filter(Boolean),S=[];for(let C=a.length;C>=0;C--){let N=a.slice(0,C).join(`/`);S.push(N?`//${n.host}/${N}`:`//${n.host}`)}return S}function normalizeAuthHost(n){return`//${n.replace(/\/+$/,``)}`}function ensureTrailingSlash(n){return n.endsWith(`/`)?n:n+`/`}function stripQuotes(n){return n.startsWith(`"`)&&n.endsWith(`"`)||n.startsWith(`'`)&&n.endsWith(`'`)?n.slice(1,-1):n}function expandEnv(n){return n.replace(/\$\{([A-Z0-9_]+)\}/gi,(n,a)=>globalThis.process?.env?.[a]??``)}function base64Decode(n){return atob(n)}var aE,PackageNotFoundError,IntegrityError,oE=__esmMin(()=>{aE=`https://registry.npmjs.org/`,PackageNotFoundError=class extends Error{name;url;constructor(n,a){super(`Package not found in registry: ${n} (${a})`),this.name=n,this.url=a,this.name=`PackageNotFoundError`}},IntegrityError=class extends Error{url;integrity;constructor(n,a){super(`Tarball integrity mismatch for ${n} (expected ${a})`),this.url=n,this.integrity=a,this.name=`IntegrityError`}}});function parseTar(n){let a=[],S=null,C=null,N=null,F=0;for(;F+512<=n.length;){let I=n.subarray(F,F+512);if(allZeros(I)){let a=n.subarray(F+512,F+2*512);if(a.length===512&&allZeros(a))break;F+=512;continue}if(!validateChecksum(I))throw new TarParseError(`Bad header checksum at offset ${F} — file is not a valid tar archive`);let H=readString(I,0,100),W=parseOctal(I,100,8),K=parseOctal(I,124,12),q=parseOctal(I,136,12),Y=String.fromCharCode(I[156]||0),X=readString(I,157,100),te=readString(I,257,6),ne=readString(I,345,155),re=readString(I,265,32),ie=readString(I,297,32);F+=512;let ae=n.subarray(F,F+K);if(F+=alignToBlock(K),Y===`x`){S=parsePaxRecords(ae);continue}if(Y===`g`)continue;if(Y===`L`){C=bytesToString(ae).replace(/\0+$/,``);continue}if(Y===`K`){N=bytesToString(ae).replace(/\0+$/,``);continue}let oe=H;te===`ustar`&&ne!==``&&(oe=`${ne}/${H}`),C!==null&&(oe=C,C=null);let Z=X;if(N!==null&&(Z=N,N=null),S!==null){let C=S.get(`path`);C!==void 0&&(oe=C);let N=S.get(`linkpath`);N!==void 0&&(Z=N);let I=S.get(`size`);if(I!==void 0){let C=Number(I);if(Number.isFinite(C)){let N=F-alignToBlock(K),I=n.subarray(N,N+C);F=N+alignToBlock(C),S=null,a.push(buildEntry(oe,Z,Y,W,q,re,ie,I));continue}}S=null}a.push(buildEntry(oe,Z,Y,W,q,re,ie,ae))}return a}function buildEntry(n,a,S,C,N,F,I,H){return{name:n,linkname:a,type:typeflagToType(S,n),mode:C,mtime:N,body:H,uname:F,gname:I}}function typeflagToType(n,a){switch(n){case`0`:case`\0`:case``:return a.endsWith(`/`)?`directory`:`file`;case`1`:return`hardlink`;case`2`:return`symlink`;case`5`:return`directory`;case`x`:return`pax-header`;case`g`:return`pax-global`;case`L`:return`gnu-longname`;case`K`:return`gnu-longlink`;default:return`unknown`}}function parsePaxRecords(n){let a=new Map,S=0;for(;S<n.length;){let C=S;for(;C<n.length&&n[C]!==32;)C++;if(C>=n.length)break;let N=bytesToString(n.subarray(S,C)),F=Number(N);if(!Number.isFinite(F)||F<=0)break;let I=S+F;if(I>n.length)break;let H=bytesToString(n.subarray(C+1,I-1)),W=H.indexOf(`=`);if(W>0){let n=H.slice(0,W),S=H.slice(W+1);a.set(n,S)}S=I}return a}function readString(n,a,S){let C=a,N=a+S;for(;C<N&&n[C]!==0;)C++;return bytesToString(n.subarray(a,C))}function bytesToString(n){return new TextDecoder(`utf-8`,{fatal:!1}).decode(n)}function parseOctal(n,a,S){if(S>0&&n[a]&128){let C=n[a]&127;for(let N=1;N<S;N++)C=C*256+n[a+N];return C}let C=``;for(let N=0;N<S;N++){let S=n[a+N];S===0||S===32||(C+=String.fromCharCode(S))}return C===``?0:parseInt(C,8)}function alignToBlock(n){return Math.ceil(n/512)*512}function allZeros(n){for(let a=0;a<n.length;a++)if(n[a]!==0)return!1;return!0}function validateChecksum(n){let a=parseOctal(n,148,8),S=0,C=0;for(let a=0;a<512;a++){let N=a>=148&&a<156?32:n[a];S+=N,C+=N>127?N-256:N}return a===S||a===C}var TarParseError,sE=__esmMin(()=>{TarParseError=class extends Error{constructor(n){super(n),this.name=`TarParseError`}}});async function extractTarball(n,a,S={}){let C=n instanceof Uint8Array?n:new Uint8Array(n),N=parseTar(S.gzip??(C.length>=2&&C[0]===31&&C[1]===139)?await gunzip(C):C);mkdirSync(a,{recursive:!0});let F=S.strip??1,I=S.preventEscape??!0,H={files:[],directories:[],symlinks:[],skipped:0};for(let n of N){let C=stripComponents(n.name,F);if(C===null||C===``){H.skipped++;continue}let N=Ao(a,C);if(I&&!isInside(N,a))throw Error(`tar: refusing to extract ${n.name} outside ${a} (resolved=${N})`);if(S.filter&&!S.filter(n,N)){H.skipped++;continue}if(n.type===`directory`){mkdirSync(N,{recursive:!0}),H.directories.push(N);continue}if(n.type===`file`){mkdirSync(Io(N),{recursive:!0}),writeFileSync(N,n.body);let a=S.chmod?.(n,N)??n.mode&511;if(a>0)try{chmodSync(N,a)}catch{}H.files.push(N);continue}if(n.type===`symlink`){mkdirSync(Io(N),{recursive:!0});try{symlinkSync(n.linkname,N),H.symlinks.push(N)}catch{writeFileSync(N,n.linkname),H.files.push(N)}continue}H.skipped++}return H}async function gunzip(n){let a=globalThis.DecompressionStream;if(typeof a!=`function`)throw Error(`@gjsify/tar: globalThis.DecompressionStream is not available — import '@gjsify/compression-streams/register' on GJS to register it`);let S=new Blob([new Uint8Array(n)]).stream().pipeThrough(new a(`gzip`)),C=[],N=0,F=S.getReader();for(;;){let{value:n,done:a}=await F.read();if(a)break;let S=n instanceof Uint8Array?n:new Uint8Array(n);C.push(S),N+=S.length}let I=new Uint8Array(N),H=0;for(let n of C)I.set(n,H),H+=n.length;return I}function stripComponents(n,a){if(a<=0)return n;let S=n.split(`/`).filter(n=>n!==``);return S.length<=a?null:S.slice(a).join(`/`)}function isInside(n,a){let S=Po(a,n);return S!==``&&!S.startsWith(`..`)&&!Mo(S)}var cE=__esmMin(()=>{sE(),Fs(),Wo()}),lE=__esmMin(()=>{cE()}),uE=__exportAll$3({installPackagesNative:()=>installPackagesNative});async function installPackagesNative(n){if(n.specs.length===0)throw Error(`installPackagesNative: empty specs list`);mkdirSync(n.prefix,{recursive:!0});let a=await loadNpmrc(n),S=makeLogger(n.verbose??!1),C=No(n.prefix,fE),N=readLockfile(C),F;if(n.frozen){if(!N)throw Error(`install: --immutable requires ${fE} at ${n.prefix} — none found. Run \`gjsify install\` (without --immutable) to generate one and commit it.`);let a=describeLockfileDrift(N,n.specs);if(a)throw Error(`install: --immutable but ${C} is stale.\n${a}\nRe-run \`gjsify install\` (without --immutable) to refresh the lockfile.`);S(`install: --immutable, using lockfile (%d package(s))`,Object.keys(N.packages).length),F=lockfileToNodes(N)}else N&&lockfileMatchesRequest(N,n.specs)?(S(`install: using lockfile (%d package(s))`,Object.keys(N.packages).length),F=lockfileToNodes(N)):(S(`install: resolving %d top-level spec(s) → %s`,n.specs.length,n.prefix),F=await resolveDeps(n.specs,a,S,n.overrides),n.lockfile&&(writeLockfile(C,n.specs,F),S(`install: wrote %s (%d entries)`,fE,F.length)));return S(`install: downloading %d tarball(s)`,F.length),await downloadAndExtractAll(F,n.prefix,a,S),await linkBins(F,n.prefix,S),S(`install: done`),topLevelResolutions(n.specs,F)}function topLevelResolutions(n,a){let S=new Map;for(let n of a)n.installPath===`node_modules/${n.name}`&&S.set(n.name,n);let C=[];for(let a of n){let n=parseSpecName(a),N=S.get(n);N&&C.push({name:N.name,version:N.version})}return C}function parseSpecName(n){if(n.startsWith(`@`)){let a=n.indexOf(`/`);if(a===-1)return n;let S=n.indexOf(`@`,a+1);return S===-1?n:n.slice(0,S)}let a=n.indexOf(`@`);return a===-1?n:n.slice(0,a)}async function resolveDeps(n,a,S,C){let applyOverride=(n,a)=>{if(!C)return a;let N=C[n];return typeof N!=`string`||N.length===0||N===a?a:(S(`install: override %s %s → %s`,n,a,N),N)},N=new Map,fetchPkg=n=>{let S=N.get(n);if(S)return S;let C=fetchPackument(n,{npmrc:a});return N.set(n,C),C},F=new Map,I=new Map,H=n.map(parseSpec).map(n=>({from:null,name:n.name,range:applyOverride(n.name,n.range),required:!0}));for(;H.length>0;){let n=H.shift(),a=findVisible(n.from,n.name,F);if(a&&satisfiesRange(a.version,n.range))continue;let C=null;try{let a=await fetchPkg(n.name);if(C=pickVersion(a,n.range),!C){if(!n.required)continue;throw Error(`No version of ${n.name} satisfies ${n.range}`)}let N=a.versions[C];if(!N)throw Error(`Packument for ${n.name} promised ${C} but no entry exists`);let W=decidePlacement(n.from,n.name,C,I),K={name:n.name,version:C,tarballUrl:N.dist.tarball,integrity:N.dist.integrity,installPath:W,dependencies:N.dependencies??{},optionalDependencies:N.optionalDependencies??{},bin:N.bin};F.set(W,K),W===`node_modules/${n.name}`&&I.set(n.name,K),S(`resolve: %s@%s ← %s (at %s)`,n.name,C,n.range,W);for(let[n,a]of Object.entries(K.dependencies))H.push({from:W,name:n,range:applyOverride(n,a),required:!0});for(let[n,a]of Object.entries(K.optionalDependencies))H.push({from:W,name:n,range:applyOverride(n,a),required:!1})}catch(a){if(!n.required){S(`resolve: optional dep %s@%s skipped (%s)`,n.name,n.range,a.message);continue}throw a}}return Array.from(F.values())}function findVisible(n,a,S){let C=[];if(n!==null){C.push(`${n}/node_modules/${a}`);let S=n;for(;;){let n=S.lastIndexOf(`/node_modules/`);if(n<0||(S=S.slice(0,n),C.push(`${S}/node_modules/${a}`),S===``))break}}C.push(`node_modules/${a}`);for(let n of C){let a=S.get(n);if(a)return a}return null}function decidePlacement(n,a,S,C){let N=C.get(a);return!N||N.version===S||n===null?`node_modules/${a}`:`${n}/node_modules/${a}`}function satisfiesRange(n,a){try{return satisfies(n,new rE(a))}catch{return!1}}function readLockfile(n){if(!existsSync(n))return null;try{let a=JSON.parse(readFileSync(n,`utf-8`));return a.lockfileVersion!==pE||!a.packages||typeof a.packages!=`object`?null:a}catch{return null}}function writeLockfile(n,a,S){let C={},N=[...S].sort((n,a)=>n.installPath<a.installPath?-1:+(n.installPath>a.installPath));for(let n of N)C[n.installPath]={version:n.version,resolved:n.tarballUrl,integrity:n.integrity,dependencies:Object.keys(n.dependencies).length>0?n.dependencies:void 0,bin:n.bin};let F={lockfileVersion:pE,requested:[...a],packages:C};writeFileSync(n,JSON.stringify(F,null,2)+`
 `)}function lockfileToNodes(n){return Object.entries(n.packages).map(([n,a])=>({name:nameFromInstallPath(n),version:a.version,tarballUrl:a.resolved,integrity:a.integrity,installPath:n,dependencies:a.dependencies??{},optionalDependencies:{},bin:a.bin}))}function nameFromInstallPath(n){let a=n.lastIndexOf(`/node_modules/`);return a<0?n.replace(/^node_modules\//,``):n.slice(a+14)}function lockfileMatchesRequest(n,a){if(n.requested.length!==a.length)return!1;let S=[...n.requested].sort(),C=[...a].sort();return S.every((n,a)=>n===C[a])}function describeLockfileDrift(n,a){let S=new Set(n.requested),C=new Set(a),N=[],F=[];for(let n of C)S.has(n)||N.push(n);for(let n of S)C.has(n)||F.push(n);if(N.length===0&&F.length===0)return null;let I=[];return N.length>0&&I.push(`  + ${N.sort().join(`
   + `)}`),F.length>0&&I.push(`  - ${F.sort().join(`
   - `)}`),I.join(`
 `)}function parseSpec(n){if(n.startsWith(`@`)){let a=n.indexOf(`/`);if(a<0)throw Error(`Invalid spec (scoped name without slash): ${n}`);let S=n.indexOf(`@`,a);return S<0?{name:n,range:`*`}:{name:n.slice(0,S),range:n.slice(S+1)||`*`}}let a=n.indexOf(`@`);return a<0?{name:n,range:`*`}:{name:n.slice(0,a),range:n.slice(a+1)||`*`}}function pickVersion(n,a){if(n[`dist-tags`][a])return n[`dist-tags`][a];let S;try{S=new rE(a)}catch{throw Error(`Invalid version range for ${n.name}: ${a}`)}return maxSatisfying(Object.keys(n.versions).filter(n=>{try{return new SemVer(n),!0}catch{return!1}}),S)}async function downloadAndExtractAll(n,a,S,C){let N=[...n].sort((n,a)=>depth(n.installPath)-depth(a.installPath)||(n.installPath<a.installPath?-1:1)),F=[],I=Math.max(1,Math.min(dE,N.length)),H=0,W=N.findIndex(n=>depth(n.installPath)>1),K=W<0?N.length:W;for(;H<K;){let n=N[H++];if(!n)break;await extractOne(n,a,S,C)}for(let n=0;n<I;n++)F.push((async()=>{for(;;){let n=H++;if(n>=N.length)return;let F=N[n];if(!F)return;await extractOne(F,a,S,C)}})());await Promise.all(F)}async function extractOne(n,a,S,C){let N=No(a,n.installPath);C(`fetch: %s@%s ← %s (→ %s)`,n.name,n.version,n.tarballUrl,n.installPath);let F=await fetchTarball(n.tarballUrl,{npmrc:S,integrity:n.integrity});rmSync(N,{recursive:!0,force:!0}),mkdirSync(N,{recursive:!0}),await extractTarball(F,N)}function depth(n){return n.split(`/node_modules/`).length}async function linkBins(n,a,S){let C=No(a,`node_modules`,`.bin`),N=0;for(let S of n){if(!S.bin||depth(S.installPath)!==1)continue;let n=normalizeBin$1(S.name,S.bin);if(n.size!==0){mkdirSync(C,{recursive:!0});for(let[F,I]of n){let n=No(a,S.installPath,I);if(!existsSync(n))continue;try{chmodSync(n,493)}catch{}let H=No(C,F);rmSync(H,{force:!0});let W=Po(C,n);try{symlinkSync(W,H),N++}catch{copyFileSync(n,H),chmodSync(H,493),N++}}}}N>0&&S(`bin: linked %d entry(ies) under .bin/`,N)}function normalizeBin$1(n,a){let S=new Map;if(typeof a==`string`){let C=n.startsWith(`@`)?n.slice(n.indexOf(`/`)+1):n;return S.set(C,a),S}for(let[n,C]of Object.entries(a))S.set(n,C);return S}async function loadNpmrc(n){let a=homedir(),S={registry:n.registry??aE,scopes:{},authTokens:{},basicAuth:{}};for(let C of[No(a,`.npmrc`),No(n.prefix,`.npmrc`)])if(existsSync(C))try{let n=parseNpmrc(readFileSync(C,`utf-8`));S={...S,...n,scopes:{...S.scopes,...n.scopes}}}catch(n){ze.warn(`gjsify install: ignoring malformed ${C}: ${n.message}`)}let C=process.env.npm_config_registry;return C&&(S.registry=C),n.registry&&(S.registry=n.registry),S}function makeLogger(n){return n?(n,...a)=>{let S=n.replace(/%s|%d/g,()=>String(a.shift()));process.stderr.write(`gjsify install: ${S}\n`)}:()=>{}}var dE,fE,pE,mE=__esmMin(()=>{Be(),Fs(),Wo(),rp(),iE(),oE(),lE(),dE=Number(process.env.GJSIFY_INSTALL_CONCURRENCY??`8`)||8,fE=`gjsify-lock.json`,pE=2,__name$1(normalizeBin$1,`normalizeBin`)});px(),Fs(),Wo();const hE=process.env.GJSIFY_INSTALL_BACKEND??`native`;async function installPackages(n){if(hE===`npm`)return await installViaNpm(n),{installed:[]};let{installPackagesNative:a}=await Promise.resolve().then(()=>(mE(),uE));return{installed:await a(n)}}async function installViaNpm({prefix:n,specs:a,verbose:S,registry:C}){if(a.length===0)throw Error(`installPackages: empty specs list`);writeFileSync(No(n,`package.json`),JSON.stringify({name:`gjsify-dlx-cache`,version:`0.0.0`,private:!0},null,2)),C&&writeFileSync(No(n,`.npmrc`),`registry=${C}\n`);let N=[`install`,`--no-package-lock`,`--no-audit`,`--no-fund`,`--prefix`,n,...S?[`--loglevel`,`verbose`]:[`--loglevel`,`warn`],...a];await new Promise((n,a)=>{let S=spawn(`npm`,N,{stdio:`inherit`});S.on(`close`,S=>{S===0?n():a(Error(`npm install exited with code ${S}`))}),S.on(`error`,n=>{let S=n.code===`ENOENT`?`npm not found on PATH — install Node.js or set GJSIFY_INSTALL_BACKEND=native (not yet supported)`:`npm install failed: ${n.message}`;a(Error(S))})})}Be(),Fs(),Wo();const gE={command:`dlx <spec> [binOrArg] [extraArgs..]`,description:`Run the GJS bundle of an npm-published package without installing it locally.`,builder:n=>n.positional(`spec`,{description:"Package spec (`name`, `name@version`, `@scope/name@spec`, or local path).",type:`string`,demandOption:!0}).positional(`binOrArg`,{description:"Optional bin name when the package defines `gjsify.bin` with multiple entries; otherwise treated as the first argument forwarded to the bundle.",type:`string`}).positional(`extraArgs`,{description:"Extra args forwarded to `gjs -m <bundle>`.",type:`string`,array:!0}).option(`cache-max-age`,{description:`Cache TTL in minutes. Defaults to 7 days. Use 0 to bypass cache.`,type:`number`,default:1440*7}).option(`reinstall`,{description:`Bypass the cache for this run (alias for --cache-max-age=0).`,type:`boolean`,default:!1}).option(`frozen`,{description:`Use the project-local gjsify-lock.json verbatim — fail if missing or stale (no resolver pass).`,type:`boolean`,default:!1}).option(`verbose`,{description:`Verbose logging (passes --loglevel verbose to npm).`,type:`boolean`,default:!1}).option(`registry`,{description:`Registry URL override.`,type:`string`}),handler:async n=>{let a=parseSpec$1(n.spec),S=n.reinstall?0:n[`cache-max-age`],{pkgDir:C,cachedPkgName:N}=await ensurePkgDir(a,{verbose:n.verbose,registry:n.registry,cacheMaxAge:S,frozen:n.frozen}),{binName:F,extraArgs:I}=splitBinAndArgs(C,n.binOrArg,n.extraArgs??[]),H=resolveGjsEntry(C,F);H.fromFallback&&ze.warn(`[gjsify dlx] package "${N??a.kind}" has no \`gjsify\` field — falling back to package.json#main. Add \`gjsify.main\` to silence.`),await runGjsBundle(H.bundlePath,I)}};async function ensurePkgDir(n,a){if(n.kind===`local`)return{pkgDir:n.path,cachedPkgName:null};let S=cacheDirFor(createCacheKey({packages:[n.spec]})),C=a.cacheMaxAge>0?getValidCachedPkg(S,a.cacheMaxAge):void 0;if(C)return{pkgDir:resolveInstalledPkgDir(C,n.name),cachedPkgName:n.name};let N=makePrepareDir(S);return await installPackages({prefix:N,specs:[n.spec],verbose:a.verbose,registry:a.registry,lockfile:!0,frozen:a.frozen}),{pkgDir:resolveInstalledPkgDir(symlinkSwap(S,N),n.name),cachedPkgName:n.name}}function splitBinAndArgs(n,a,S){if(!a)return{binName:null,extraArgs:S};let C=No(n,`package.json`);if(existsSync(C))try{let n=JSON.parse(readFileSync(C,`utf-8`)).gjsify?.bin;if(n&&Object.prototype.hasOwnProperty.call(n,a))return{binName:a,extraArgs:S}}catch{}return{binName:null,extraArgs:[a,...S]}}Fs(),rp(),Wo();function defaultGlobalLayout(){let n=process.env.GJSIFY_GLOBAL_PREFIX,a=process.env.GJSIFY_GLOBAL_BIN_DIR,S=homedir(),C=process.env.XDG_DATA_HOME??No(S,`.local`,`share`);return{prefix:n??No(C,`gjsify`,`global`),binDir:a??No(S,`.local`,`bin`)}}function linkGlobalBins(n,a){mkdirSync(a.binDir,{recursive:!0});let S=[];for(let C of n){let n=No(a.prefix,`node_modules`,C),N=No(n,`package.json`);if(!existsSync(N))continue;let F=pickBinMap(C,readJson(N));if(!(!F||F.size===0))for(let[C,N]of F){let F=No(n,N);if(!existsSync(F))continue;try{chmodSync(F,493)}catch{}let I=No(a.binDir,C);rmSync(I,{force:!0}),writeFileSync(I,`#!/bin/sh\nexec ${shQuote(F)} "$@"\n`),chmodSync(I,493),S.push({name:C,target:F,link:I})}}return S}function shQuote(n){return`'${n.replace(/'/g,`'\\''`)}'`}function pickBinMap(n,a){let S=a.gjsify;if(S?.bin!==void 0)return normalizeBin(n,S.bin);let C=a.bin;return C===void 0?null:normalizeBin(n,C)}function normalizeBin(n,a){let S=new Map;if(typeof a==`string`){let C=n.startsWith(`@`)?n.slice(n.indexOf(`/`)+1):n;return S.set(C,a),S}for(let[n,C]of Object.entries(a))S.set(n,C);return S}function readJson(n){return JSON.parse(readFileSync(n,`utf-8`))}function binDirOnPath(n){let a=process.env.PATH??``,S=process.platform===`win32`?`;`:`:`,C=Ao(n);return a.split(S).some(n=>n&&Ao(n)===C)}function specToPackageName(n){if(n.startsWith(`@`)){let a=n.indexOf(`/`);if(a<0)return n;let S=n.indexOf(`@`,a);return S<0?n:n.slice(0,S)}let a=n.indexOf(`@`);return a<0?n:n.slice(0,a)}Be(),Fs(),Wo(),px();const _E={command:`install [packages..]`,description:`Install npm dependencies in the current project (or globally with -g), then run gjsify-aware post-checks.`,builder:n=>n.positional(`packages`,{description:`Optional package specs. With none, runs a full project install.`,type:`string`,array:!0}).option(`global`,{description:`Install into the user-global XDG location and symlink bins into ~/.local/bin.`,type:`boolean`,alias:`g`,default:!1}).option(`save-dev`,{type:`boolean`,alias:`D`}).option(`save-peer`,{type:`boolean`}).option(`save-optional`,{type:`boolean`,alias:`O`}).option(`immutable`,{description:`CI mode: install strictly from gjsify-lock.json, fail if the lockfile is missing or stale. Equivalent to yarn --immutable / npm ci --frozen-lockfile.`,type:`boolean`,default:!1}).option(`verbose`,{description:`Verbose install logging.`,type:`boolean`,default:!1}),handler:async n=>{if(n.immutable&&(n.packages&&n.packages.length>0&&(ze.error(`gjsify install --immutable does not accept package arguments. Remove the package names or drop --immutable.`),process.exit(1)),n.global&&(ze.error(`gjsify install --immutable is incompatible with --global.`),process.exit(1))),n.global){(!n.packages||n.packages.length===0)&&(ze.error(`gjsify install --global requires at least one <pkg> argument.`),process.exit(1));for(let a of[`save-dev`,`save-peer`,`save-optional`])n[a]&&ze.warn(`gjsify install --global ignores --${a}: global installs do not modify a project package.json.`);await installGlobalAndLink(n.packages,{verbose:n.verbose});return}if(process.env.GJSIFY_INSTALL_BACKEND===`npm`){await projectInstallViaNpm(n),await runPostInstallChecks();return}await projectInstallNative(n),await runPostInstallChecks()}};function isWorkspaceRoot(n){let a=readPackageJson$2(No(n,`package.json`));return a?a.workspaces!==void 0:!1}function depKindFromArgs(n){return n[`save-dev`]?`devDependencies`:n[`save-peer`]?`peerDependencies`:n[`save-optional`]?`optionalDependencies`:`dependencies`}async function projectInstallNative(n){let a=process.cwd(),S=No(a,`package.json`);if(existsSync(No(a,`.pnp.cjs`))||existsSync(No(a,`.pnp.loader.mjs`)))throw Error("gjsify install: detected Yarn PnP (.pnp.cjs) — native install is not PnP-aware yet. Use `yarn install` or set GJSIFY_INSTALL_BACKEND=npm.");if((!n.packages||n.packages.length===0)&&isWorkspaceRoot(a)){await workspaceInstall(a,n);return}let C,N=readPackageJson$2(S),F=N?projectSpecsFromPackageJson(N):[];if(n.packages&&n.packages.length>0){let a=new Set(n.packages.map(n=>parseSpec$2(n).name));C=[...F.filter(n=>!a.has(parseSpec$2(n).name)),...n.packages]}else{if(!N)throw Error(`gjsify install: no package.json in ${a}`);if(C=F,C.length===0){ze.log(`gjsify install: no dependencies declared in package.json — nothing to do.`);return}}mkdirSync(a,{recursive:!0});let I=await installPackages({prefix:a,specs:C,verbose:n.verbose,lockfile:!n.immutable,frozen:n.immutable});if(n.packages&&n.packages.length>0&&N){let C=depKindFromArgs(n);for(let a of n.packages){let{name:n,range:S}=parseSpec$2(a),F=I.installed.find(a=>a.name===n);addDependencyEntry(N,n,S??(F?defaultRangeFromVersion(F.version):`latest`),C)}writePackageJson(S,N),n.immutable||syncLockfileRequested(a,projectSpecsFromPackageJson(N))}}function syncLockfileRequested(n,a){let S=No(n,`gjsify-lock.json`);if(existsSync(S))try{let n=JSON.parse(readFileSync(S,`utf-8`)),C=[...a].sort(),N=[...n.requested??[]].sort();if(C.length===N.length&&C.every((n,a)=>n===N[a]))return;n.requested=a,writeFileSync(S,JSON.stringify(n,null,2)+`
-`)}catch{}}async function workspaceInstall(n,a){let S=discoverWorkspaces(n,{includeRoot:!0});if(S.length===0)throw Error(`gjsify install: ${n} has a "workspaces" field but no workspaces were discovered`);let C=new Map(S.map(n=>[n.name,n])),N=new Set,F=[];for(let n of S){let a=n.manifest;for(let S of[`dependencies`,`devDependencies`,`optionalDependencies`]){let I=a[S];if(I){for(let[a,S]of Object.entries(I))if(typeof S==`string`){if(S.startsWith(`workspace:`)){let N=C.get(a);if(!N)throw Error(`gjsify install: ${n.name} declares "${a}: ${S}" but no workspace with that name exists`);F.push({fromWorkspaceName:n.name,depName:a,targetLocation:N.location});continue}/^(link|file|portal|git\+|https?):/.test(S)||N.add(`${a}@${S}`)}}}}ze.log(`gjsify install: ${S.length} workspace(s), ${N.size} external dep spec(s), ${F.length} workspace symlink(s)`),N.size>0?await installPackages({prefix:n,specs:[...N],verbose:a.verbose,lockfile:!a.immutable,frozen:a.immutable}):a.verbose&&ze.log(`gjsify install: no external deps to fetch`);for(let n of F){let a=C.get(n.fromWorkspaceName);if(!a)continue;let S=No(a.location,`node_modules`,n.depName);mkdirSync(Io(S),{recursive:!0});try{let n=lstatSync(S);n.isSymbolicLink()||n.isFile()?rmSync(S,{force:!0}):n.isDirectory()&&rmSync(S,{recursive:!0,force:!0})}catch{}symlinkSync(Po(Io(S),n.targetLocation),S)}F.length>0&&ze.log(`gjsify install: wired ${F.length} workspace symlink(s)`);let I=No(n,`node_modules`),H=0;for(let a of S){if(a.location===n||!a.name)continue;let S=No(I,a.name),C=!1;try{lstatSync(S),C=!0}catch{}C||(mkdirSync(Io(S),{recursive:!0}),symlinkSync(Po(Io(S),a.location),S),H++)}H>0&&ze.log(`gjsify install: hoisted ${H} workspace(s) to root node_modules/`);let W=No(n,`node_modules`,`.bin`),K=0;for(let n of S){let a=n.manifest,S=a.gjsify?.bin,C=a.bin,N=mergeWorkspaceBins(n.name,S,C);if(N.size!==0){mkdirSync(W,{recursive:!0});for(let[a,{nodeTarget:S,gjsTarget:C}]of N){let N=No(W,a);try{rmSync(N,{force:!0})}catch{}writeFileSync(N,buildBinShim(n.location,S,C),{mode:493}),chmodSync(N,493),K++}}}K>0&&ze.log(`gjsify install: linked ${K} workspace bin(s) into node_modules/.bin/`)}function buildBinShim(n,a,S){let C=a?No(n,a):null,N=S?No(n,S):null;if(C&&N)return`#!/bin/sh\nif [ -f "${C}" ]; then\n  exec node "${C}" "$@"\nfi\nexec gjs -m "${N}" "$@"\n`;if(C)return`#!/bin/sh\nexec node "${C}" "$@"\n`;if(N)return`#!/bin/sh\nexec gjs -m "${N}" "$@"\n`;throw Error(`buildBinShim: either nodeTarget or gjsTarget must be provided`)}function mergeWorkspaceBins(n,a,S){let C=new Map,N=n.startsWith(`@`)?n.slice(n.indexOf(`/`)+1):n,get=n=>{let a=C.get(n);return a||(a={},C.set(n,a)),a};if(typeof S==`string`)get(N).nodeTarget=S;else if(S&&typeof S==`object`)for(let[n,a]of Object.entries(S))typeof a==`string`&&a.length>0&&(get(n).nodeTarget=a);if(typeof a==`string`)get(N).gjsTarget=a;else if(a&&typeof a==`object`)for(let[n,S]of Object.entries(a))typeof S==`string`&&S.length>0&&(get(n).gjsTarget=S);return C}async function projectInstallViaNpm(n){let a=[`install`];n[`save-dev`]&&a.push(`--save-dev`),n[`save-peer`]&&a.push(`--save-peer`),n[`save-optional`]&&a.push(`--save-optional`),n.verbose&&a.push(`--loglevel`,`verbose`),n.packages&&n.packages.length>0&&a.push(...n.packages),await spawnNpm(a)}async function spawnNpm(n){return new Promise((a,S)=>{let C=spawn(`npm`,n,{stdio:`inherit`});C.on(`close`,n=>{n===0?a():S(Error(`npm install exited with code ${n}`))}),C.on(`error`,n=>{let a=n.code===`ENOENT`?`npm not found on PATH — install Node.js first.`:`npm install failed: ${n.message}`;S(Error(a))})}).catch(n=>{ze.error(n.message),process.exit(1)})}async function installGlobalAndLink(n,a){let S=defaultGlobalLayout();mkdirSync(S.prefix,{recursive:!0}),ze.log(`gjsify install --global  → ${S.prefix}`),ze.log(`                  bins → ${S.binDir}`),await installPackages({prefix:S.prefix,specs:n,verbose:a.verbose});let C=linkGlobalBins(n.map(specToPackageName),S);if(C.length===0)ze.warn("\nNo bins declared (neither `gjsify.bin` nor `bin` in package.json) — nothing was symlinked.");else{ze.log(`\nLinked ${C.length} bin(s):`);for(let n of C)ze.log(`  • ${n.link}  →  ${n.target}`)}C.length>0&&!binDirOnPath(S.binDir)&&ze.warn(`\nNote: ${S.binDir} is not on your PATH.\nAdd it to your shell rc file:\n  export PATH="${S.binDir}:$PATH"`)}async function runPostInstallChecks(){ze.log(`
+`)}catch{}}async function workspaceInstall(n,a){let S=discoverWorkspaces(n,{includeRoot:!0});if(S.length===0)throw Error(`gjsify install: ${n} has a "workspaces" field but no workspaces were discovered`);let C=new Map(S.map(n=>[n.name,n])),N=new Set,F=[];for(let n of S){let a=n.manifest;for(let S of[`dependencies`,`devDependencies`,`optionalDependencies`]){let I=a[S];if(I){for(let[a,S]of Object.entries(I))if(typeof S==`string`){if(S.startsWith(`workspace:`)){let N=C.get(a);if(!N)throw Error(`gjsify install: ${n.name} declares "${a}: ${S}" but no workspace with that name exists`);F.push({fromWorkspaceName:n.name,depName:a,targetLocation:N.location});continue}/^(link|file|portal|git\+|https?):/.test(S)||N.add(`${a}@${S}`)}}}}ze.log(`gjsify install: ${S.length} workspace(s), ${N.size} external dep spec(s), ${F.length} workspace symlink(s)`);let I=S.find(a=>a.location===n)?.manifest,H=extractOverrides(I);N.size>0?await installPackages({prefix:n,specs:[...N],verbose:a.verbose,lockfile:!a.immutable,frozen:a.immutable,overrides:H}):a.verbose&&ze.log(`gjsify install: no external deps to fetch`);for(let n of F){let a=C.get(n.fromWorkspaceName);if(!a)continue;let S=No(a.location,`node_modules`,n.depName);mkdirSync(Io(S),{recursive:!0});try{let n=lstatSync(S);n.isSymbolicLink()||n.isFile()?rmSync(S,{force:!0}):n.isDirectory()&&rmSync(S,{recursive:!0,force:!0})}catch{}symlinkSync(Po(Io(S),n.targetLocation),S)}F.length>0&&ze.log(`gjsify install: wired ${F.length} workspace symlink(s)`);let W=No(n,`node_modules`),K=0;for(let a of S){if(a.location===n||!a.name)continue;let S=No(W,a.name),C=!1;try{lstatSync(S),C=!0}catch{}C||(mkdirSync(Io(S),{recursive:!0}),symlinkSync(Po(Io(S),a.location),S),K++)}K>0&&ze.log(`gjsify install: hoisted ${K} workspace(s) to root node_modules/`);let q=No(n,`node_modules`,`.bin`),Y=0;for(let n of S){let a=n.manifest,S=a.gjsify?.bin,C=a.bin,N=mergeWorkspaceBins(n.name,S,C);if(N.size!==0){mkdirSync(q,{recursive:!0});for(let[a,{nodeTarget:S,gjsTarget:C}]of N){let N=No(q,a);try{rmSync(N,{force:!0})}catch{}writeFileSync(N,buildBinShim(n.location,S,C),{mode:493}),chmodSync(N,493),Y++}}}Y>0&&ze.log(`gjsify install: linked ${Y} workspace bin(s) into node_modules/.bin/`)}function extractOverrides(n){if(!n)return;let a={},merge=(n,S)=>{if(n)for(let[C,N]of Object.entries(n)){if(C.startsWith(`_`))continue;if(typeof N!=`string`){ze.warn(`gjsify install: ${S}["${C}"] is not a string — nested override shape isn't supported yet, skipping`);continue}let n=C,F=C.startsWith(`@`)?C.indexOf(`@`,1):C.indexOf(`@`);F>0&&(n=C.slice(0,F)),a[n]=N}};return merge(n.overrides,`overrides`),merge(n.resolutions,`resolutions`),Object.keys(a).length>0?a:void 0}function buildBinShim(n,a,S){let C=a?No(n,a):null,N=S?No(n,S):null;if(C&&N)return`#!/bin/sh\nif [ -f "${C}" ]; then\n  exec node "${C}" "$@"\nfi\nexec gjs -m "${N}" "$@"\n`;if(C)return`#!/bin/sh\nexec node "${C}" "$@"\n`;if(N)return`#!/bin/sh\nexec gjs -m "${N}" "$@"\n`;throw Error(`buildBinShim: either nodeTarget or gjsTarget must be provided`)}function mergeWorkspaceBins(n,a,S){let C=new Map,N=n.startsWith(`@`)?n.slice(n.indexOf(`/`)+1):n,get=n=>{let a=C.get(n);return a||(a={},C.set(n,a)),a};if(typeof S==`string`)get(N).nodeTarget=S;else if(S&&typeof S==`object`)for(let[n,a]of Object.entries(S))typeof a==`string`&&a.length>0&&(get(n).nodeTarget=a);if(typeof a==`string`)get(N).gjsTarget=a;else if(a&&typeof a==`object`)for(let[n,S]of Object.entries(a))typeof S==`string`&&S.length>0&&(get(n).gjsTarget=S);return C}async function projectInstallViaNpm(n){let a=[`install`];n[`save-dev`]&&a.push(`--save-dev`),n[`save-peer`]&&a.push(`--save-peer`),n[`save-optional`]&&a.push(`--save-optional`),n.verbose&&a.push(`--loglevel`,`verbose`),n.packages&&n.packages.length>0&&a.push(...n.packages),await spawnNpm(a)}async function spawnNpm(n){return new Promise((a,S)=>{let C=spawn(`npm`,n,{stdio:`inherit`});C.on(`close`,n=>{n===0?a():S(Error(`npm install exited with code ${n}`))}),C.on(`error`,n=>{let a=n.code===`ENOENT`?`npm not found on PATH — install Node.js first.`:`npm install failed: ${n.message}`;S(Error(a))})}).catch(n=>{ze.error(n.message),process.exit(1)})}async function installGlobalAndLink(n,a){let S=defaultGlobalLayout();mkdirSync(S.prefix,{recursive:!0}),ze.log(`gjsify install --global  → ${S.prefix}`),ze.log(`                  bins → ${S.binDir}`),await installPackages({prefix:S.prefix,specs:n,verbose:a.verbose});let C=linkGlobalBins(n.map(specToPackageName),S);if(C.length===0)ze.warn("\nNo bins declared (neither `gjsify.bin` nor `bin` in package.json) — nothing was symlinked.");else{ze.log(`\nLinked ${C.length} bin(s):`);for(let n of C)ze.log(`  • ${n.link}  →  ${n.target}`)}C.length>0&&!binDirOnPath(S.binDir)&&ze.warn(`\nNote: ${S.binDir} is not on your PATH.\nAdd it to your shell rc file:\n  export PATH="${S.binDir}:$PATH"`)}async function runPostInstallChecks(){ze.log(`
 --- gjsify post-install checks ---`);let n=runMinimalChecks().filter(n=>!n.found&&n.severity===`required`);if(n.length>0){ze.warn(`Missing required system dependencies:
 `);for(let a of n)ze.warn(`  ✗  ${a.name}`);let a=buildInstallCommand(detectPackageManager$2(),n);a&&ze.warn(`\nInstall with:\n  ${a}`)}else ze.log(`System dependencies OK.`);let a=detectNativePackages(process.cwd());if(a.length>0){ze.log(`\nDetected ${a.length} @gjsify/* package(s) with native prebuilds:`);for(let n of a)ze.log(`  • ${n.name}`);ze.log("\nUse `gjsify run <bundle>` to launch with LD_LIBRARY_PATH/GI_TYPELIB_PATH set.")}}Be(),px(),rp();const vE={command:`foreach [script] [args..]`,description:"Run a workspace script across all (or filtered) workspaces. Drop-in for `yarn workspaces foreach`: -A/--all, -p/--parallel, -t/--topological, --include, --exclude, --no-private. Pass --exec to run an arbitrary command instead of a script.",builder:n=>n.positional(`script`,{description:"Script name to run in each workspace (`run <name>`-equivalent). With --exec, the command to run instead.",type:`string`}).positional(`args`,{description:`Extra arguments forwarded to each child invocation.`,type:`string`,array:!0}).option(`all`,{description:"Include workspaces declared as `private: true`.",type:`boolean`,alias:`A`,default:!1}).option(`parallel`,{description:`Run workspaces in parallel (capped by --jobs).`,type:`boolean`,alias:`p`,default:!1}).option(`topological`,{description:`Wait for each workspace's deps to finish before starting it (production deps only).`,type:`boolean`,alias:`t`,default:!1}).option(`topological-dev`,{description:`Like --topological but also respects devDependencies (often cyclic — use sparingly).`,type:`boolean`,default:!1}).option(`include`,{description:`Glob pattern to include workspaces by name (repeatable).`,type:`string`,array:!0}).option(`exclude`,{description:`Glob pattern to exclude workspaces by name (repeatable).`,type:`string`,array:!0}).option(`private`,{description:`Include private workspaces (default true). Pass --no-private to skip them.`,type:`boolean`,default:!0}).option(`verbose`,{description:`Echo every spawned command before running it.`,type:`boolean`,alias:`v`,default:!1}).option(`jobs`,{description:`Maximum concurrent workspaces in --parallel mode (default: cpu count).`,type:`number`,alias:`j`}).option(`exec`,{description:"Treat <script> [args..] as an arbitrary command (yarn `workspaces foreach exec`-equivalent) instead of a package.json script lookup. Workspace filtering by script presence is skipped. Use `-- <cmd> <args...>` to pass flags to the command without yargs intercepting them.",type:`boolean`,default:!1}).parserConfiguration({"populate--":!0}),handler:async n=>{let a=discoverWorkspaces(findWorkspaceRoot(process.cwd())??process.cwd()),S=n.exec===!0,C=n.script,N=n.args??[];if(S){let a=(n[`--`]??[]).filter(n=>typeof n==`string`);a.length>0&&(C?N=[...N,...a]:(C=a[0],N=[...N,...a.slice(1)])),C||(ze.error("gjsify foreach --exec: missing command. Pass it after `--`, e.g. `gjsify foreach --exec -- npm publish --tag latest`."),process.exit(1))}let F=filterWorkspaces(a,{include:n.include,exclude:n.exclude,noPrivate:n.private===!1});if(!S){C||(ze.error(`gjsify foreach: missing <script> positional. Pass --exec to run an arbitrary command instead.`),process.exit(1));let n=C;F=F.filter(a=>typeof(a.manifest.scripts??{})[n]==`string`)}if(F.length===0){ze.log(`gjsify foreach: no workspaces match (${S?`exec`:`script`}="${C}", include=${JSON.stringify(n.include??[])}, exclude=${JSON.stringify(n.exclude??[])})`);return}(n.topological||n[`topological-dev`])&&(F=topologicalSort(buildDependencyGraph(F,{includeDev:n[`topological-dev`]===!0})));let I=n.verbose===!0,H=C;try{if(n.parallel&&!n.topological&&!n[`topological-dev`]){let a=n.jobs&&n.jobs>0?n.jobs:cpus().length;await runParallel(F,H,N,a,I,S)}else if(n.parallel){let a=n.jobs&&n.jobs>0?n.jobs:cpus().length;await runTopologicalParallel(F,H,N,a,I,n[`topological-dev`]===!0,S)}else await runSequential(F,H,N,I,S)}catch(n){ze.error(n.message),process.exit(1)}process.exit(0)}};async function runSequential(n,a,S,C,N){for(let F of n)await runOne(F,a,S,!1,C,N)}async function runParallel(n,a,S,C,N,F){let I=0,H=[];for(let W=0;W<C;W++)H.push((async()=>{for(;I<n.length;)await runOne(n[I++],a,S,!0,N,F)})());await Promise.all(H)}async function runTopologicalParallel(n,a,S,C,N,F,I){let H=new Set(n.map(n=>n.name)),W=new Map;for(let a of n){let n=new Set,S=a.manifest;for(let a of[S.dependencies,F?S.devDependencies:void 0,S.optionalDependencies])if(a)for(let[S,C]of Object.entries(a))typeof C==`string`&&C.startsWith(`workspace:`)&&H.has(S)&&n.add(S);W.set(a.name,n)}let K=new Map(n.map(n=>[n.name,n])),q=new Set,Y=0;return new Promise((n,F)=>{let H=null,pump=()=>{if(!H){for(;Y<C;){let C=[...W.entries()].filter(([,n])=>[...n].every(n=>q.has(n))).map(([n])=>n);if(C.length===0)break;let X=C.sort()[0];W.delete(X),Y++,runOne(K.get(X),a,S,!0,N,I).then(()=>{if(Y--,q.add(X),W.size===0&&Y===0){n();return}pump()}).catch(n=>{H=n instanceof Error?n:Error(String(n)),Y===0&&F(H)})}W.size>0&&Y===0&&!H&&F(Error(`gjsify foreach --topological: stuck — workspaces ${[...W.keys()].join(`, `)} have unsatisfied deps in the selected set`))}};pump()})}async function runOne(n,a,S,C,N,F){if(F){N&&ze.error(`[${n.name}] $ ${a} ${S.join(` `)}`),await spawnPrefixed(a,S,n.location,C?`[${n.name}] `:null);return}let I=detectPackageManager$1(),H=I===`gjsify`?[`run`,a,...S]:[`run`,a,...S.length>0?[`--`,...S]:[]];N&&ze.error(`[${n.name}] $ ${I} ${H.join(` `)}`),await spawnPrefixed(I,H,n.location,C?`[${n.name}] `:null)}function detectPackageManager$1(){let n=process.env.npm_config_user_agent??``;return n.startsWith(`yarn/`)?`yarn`:n.startsWith(`gjsify/`)?`gjsify`:`npm`}__name$1(detectPackageManager$1,`detectPackageManager`);function spawnPrefixed(n,a,S,C){return new Promise((N,F)=>{let I=spawn(n,a,{cwd:S,stdio:C?[`ignore`,`pipe`,`pipe`]:`inherit`,env:process.env});C&&I.stdout&&I.stderr&&(prefixLines(I.stdout,process.stdout,C),prefixLines(I.stderr,process.stderr,C)),I.on(`close`,S=>{S===0?N():F(Error(`${n} ${a.join(` `)} exited with code ${S}`))}),I.on(`error`,n=>F(n))})}function prefixLines(n,a,S){let C=``;n.setEncoding(`utf-8`),n.on(`data`,n=>{C+=n;let N;for(;(N=C.indexOf(`
 `))!==-1;)a.write(S+C.slice(0,N+1)),C=C.slice(N+1)}),n.on(`end`,()=>{C.length>0&&a.write(S+C+`

package/lib/commands/install.js

@@ -248,6 +248,13 @@ async function workspaceInstall(cwd, args) {
         }
     }
     console.log(`gjsify install: ${workspaces.length} workspace(s), ${externalSpecs.size} external dep spec(s), ${symlinks.length} workspace symlink(s)`);
+    // Read top-level package.json's `overrides` (npm-native) or `resolutions`
+    // (yarn-native, kept as the existing field name in pre-Phase-D.8 repos).
+    // Both are flattened to a name → version map and passed to the install
+    // backend. Pattern keys like `typescript@*` are normalised to bare names —
+    // we don't yet support per-parent scoping (npm's nested overrides shape).
+    const rootManifest = workspaces.find((w) => w.location === cwd)?.manifest;
+    const overrides = extractOverrides(rootManifest);
     if (externalSpecs.size > 0) {
         await installPackages({
             prefix: cwd,
@@ -255,6 +262,7 @@ async function workspaceInstall(cwd, args) {
             verbose: args.verbose,
             lockfile: !args.immutable,
             frozen: args.immutable,
+            overrides,
         });
     }
     else if (args.verbose) {
@@ -386,6 +394,51 @@ async function workspaceInstall(cwd, args) {
  * different cwds that consumers (`yarn run`, `npm run`, direct PATH
  * invocation) call us from.
  */
+/**
+ * Flatten npm `overrides` or yarn `resolutions` into a bare name → range map.
+ *
+ * Supports two input shapes:
+ *
+ *   "overrides": { "typescript": "~5.9.2" }                       (npm)
+ *   "resolutions": { "typescript@*": "~5.9.2" }                   (yarn pattern)
+ *
+ * Pattern keys with a version glob (`name@*`, `name@^x`) are normalised to the
+ * bare name — gjsify's resolver doesn't yet support per-incoming-range
+ * scoping. Object-valued nested overrides (npm's per-parent shape, e.g.
+ * `"foo": { ".": "1.0", "bar": "2.0" }`) are intentionally ignored; they would
+ * silently misbehave without per-parent support, so we surface a warning
+ * instead of half-applying them.
+ *
+ * Keys beginning with `_` are skipped (convention for documentation entries
+ * like `"_comment_typescript"` used in the wild).
+ */
+function extractOverrides(rootManifest) {
+    if (!rootManifest)
+        return undefined;
+    const out = {};
+    const merge = (source, fieldName) => {
+        if (!source)
+            return;
+        for (const [key, value] of Object.entries(source)) {
+            if (key.startsWith('_'))
+                continue;
+            if (typeof value !== 'string') {
+                console.warn(`gjsify install: ${fieldName}["${key}"] is not a string — nested override shape isn't supported yet, skipping`);
+                continue;
+            }
+            // Normalise pattern keys (`name@*`, `name@^range`) → bare name.
+            // For scoped packages preserve the leading `@`.
+            let name = key;
+            const atIdx = key.startsWith('@') ? key.indexOf('@', 1) : key.indexOf('@');
+            if (atIdx > 0)
+                name = key.slice(0, atIdx);
+            out[name] = value;
+        }
+    };
+    merge(rootManifest.overrides, 'overrides');
+    merge(rootManifest.resolutions, 'resolutions');
+    return Object.keys(out).length > 0 ? out : undefined;
+}
 function buildBinShim(wsLocation, nodeTarget, gjsTarget) {
     const nodeAbs = nodeTarget ? join(wsLocation, nodeTarget) : null;
     const gjsAbs = gjsTarget ? join(wsLocation, gjsTarget) : null;

package/lib/utils/install-backend-native.js

@@ -56,7 +56,7 @@ export async function installPackagesNative(opts) {
     }
     else {
         log("install: resolving %d top-level spec(s) → %s", opts.specs.length, opts.prefix);
-        nodes = await resolveDeps(opts.specs, npmrc, log);
+        nodes = await resolveDeps(opts.specs, npmrc, log, opts.overrides);
         if (opts.lockfile) {
             writeLockfile(lockfilePath, opts.specs, nodes);
             log("install: wrote %s (%d entries)", LOCKFILE_NAME, nodes.length);
@@ -114,7 +114,18 @@ function parseSpecName(spec) {
  * the root. Each placement returns a `ResolvedNode` whose `installPath`
  * captures where it lives in the tree.
  */
-async function resolveDeps(specs, npmrc, log) {
+async function resolveDeps(specs, npmrc, log, overrides) {
+    const applyOverride = (name, range) => {
+        if (!overrides)
+            return range;
+        const override = overrides[name];
+        if (typeof override !== 'string' || override.length === 0)
+            return range;
+        if (override === range)
+            return range;
+        log("install: override %s %s → %s", name, range, override);
+        return override;
+    };
     const packumentCache = new Map();
     const fetchPkg = (name) => {
         const cached = packumentCache.get(name);
@@ -131,7 +142,7 @@ async function resolveDeps(specs, npmrc, log) {
     const queue = specs.map(parseSpec).map((s) => ({
         from: null,
         name: s.name,
-        range: s.range,
+        range: applyOverride(s.name, s.range),
         required: true,
     }));
     while (queue.length > 0) {
@@ -181,10 +192,10 @@ async function resolveDeps(specs, npmrc, log) {
             }
             log("resolve: %s@%s ← %s (at %s)", edge.name, version, edge.range, installPath);
             for (const [depName, depRange] of Object.entries(node.dependencies)) {
-                queue.push({ from: installPath, name: depName, range: depRange, required: true });
+                queue.push({ from: installPath, name: depName, range: applyOverride(depName, depRange), required: true });
             }
             for (const [depName, depRange] of Object.entries(node.optionalDependencies)) {
-                queue.push({ from: installPath, name: depName, range: depRange, required: false });
+                queue.push({ from: installPath, name: depName, range: applyOverride(depName, depRange), required: false });
             }
         }
         catch (e) {

package/lib/utils/install-backend.d.ts

@@ -15,6 +15,18 @@ export interface InstallOptions {
     lockfile?: boolean;
     /** Use `<prefix>/gjsify-lock.json` as the source of truth — fail if missing. */
     frozen?: boolean;
+    /**
+     * Per-package version overrides — `<name> → <range>`. Applied to every
+     * edge during dependency resolution, irrespective of the requester.
+     * Mirrors npm's top-level `overrides` field and yarn's `resolutions`
+     * (the simple, name-only flavour; pattern keys like `typescript@*` are
+     * normalised to bare `typescript` by the caller before passing in).
+     *
+     * Lets a workspace root pin a transitive dep version when the
+     * deduplicated tree would otherwise pick a different one — e.g. for
+     * forcing `typescript@~5.9` across every `typescript@*` devDep.
+     */
+    overrides?: Record<string, string>;
 }
 export interface InstallResult {
     /** Top-level packages that were requested, with the version each

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/cli",
-    "version": "0.4.4",
+    "version": "0.4.5",
     "description": "CLI for Gjsify",
     "type": "module",
     "main": "lib/index.js",
@@ -37,18 +37,18 @@
         "cli"
     ],
     "dependencies": {
-        "@gjsify/buffer": "^0.4.4",
-        "@gjsify/create-app": "^0.4.4",
-        "@gjsify/node-globals": "^0.4.4",
-        "@gjsify/node-polyfills": "^0.4.4",
-        "@gjsify/npm-registry": "^0.4.4",
-        "@gjsify/resolve-npm": "^0.4.4",
-        "@gjsify/rolldown-plugin-gjsify": "^0.4.4",
-        "@gjsify/rolldown-plugin-pnp": "^0.4.4",
-        "@gjsify/semver": "^0.4.4",
-        "@gjsify/tar": "^0.4.4",
-        "@gjsify/web-polyfills": "^0.4.4",
-        "@gjsify/workspace": "^0.4.4",
+        "@gjsify/buffer": "^0.4.5",
+        "@gjsify/create-app": "^0.4.5",
+        "@gjsify/node-globals": "^0.4.5",
+        "@gjsify/node-polyfills": "^0.4.5",
+        "@gjsify/npm-registry": "^0.4.5",
+        "@gjsify/resolve-npm": "^0.4.5",
+        "@gjsify/rolldown-plugin-gjsify": "^0.4.5",
+        "@gjsify/rolldown-plugin-pnp": "^0.4.5",
+        "@gjsify/semver": "^0.4.5",
+        "@gjsify/tar": "^0.4.5",
+        "@gjsify/web-polyfills": "^0.4.5",
+        "@gjsify/workspace": "^0.4.5",
         "cosmiconfig": "^9.0.1",
         "get-tsconfig": "^4.14.0",
         "pkg-types": "^2.3.1",
@@ -56,12 +56,12 @@
         "yargs": "^18.0.0"
     },
     "devDependencies": {
-        "@gjsify/unit": "^0.4.4",
+        "@gjsify/unit": "^0.4.5",
         "@types/yargs": "^17.0.35",
         "typescript": "^6.0.3"
     },
     "peerDependencies": {
-        "@gjsify/rolldown-native": "^0.4.4"
+        "@gjsify/rolldown-native": "^0.4.5"
     },
     "peerDependenciesMeta": {
         "@gjsify/rolldown-native": {