@vltpkg/cli-js 1.1.1 → 1.3.0

package/cache-unzip-src-unzip.js

@@ -20,6 +20,1776 @@ function create(cls, defaultFrom, message, cause, from = defaultFrom) {
 function error(message, cause, from) {
   return create(Error, error, message, cause, from);
 }
+function typeError(message, cause, from) {
+  return create(TypeError, typeError, message, cause, from);
+}
+function syntaxError(message, cause, from) {
+  return create(
+    SyntaxError,
+    syntaxError,
+    message,
+    cause,
+    from
+  );
+}
+
+// ../../src/fast-split/src/index.ts
+function fastSplit(str, delim, limit = -1, onPart) {
+  let i = 0;
+  let p = 0;
+  const l = delim.length;
+  const parts = [];
+  while (i !== -1) {
+    i = str.indexOf(delim, p);
+    const part = i === -1 || parts.length === limit - 1 ? str.substring(p) : str.substring(p, i);
+    parts.push(onPart?.(part, parts, i) ?? part);
+    if (parts.length === limit) {
+      return parts;
+    }
+    p = i + l;
+  }
+  return parts;
+}
+
+// ../../src/semver/src/version.ts
+var maybeNumber = (s) => {
+  if (!/^[0-9]+$/.test(s)) return s;
+  const n7 = Number(s);
+  return n7 <= Number.MAX_SAFE_INTEGER ? n7 : s;
+};
+var safeNumber = (s, version, field) => {
+  const n7 = Number(s);
+  if (n7 > Number.MAX_SAFE_INTEGER) {
+    throw invalidVersion(
+      version,
+      `invalid ${field}, must be <= ${Number.MAX_SAFE_INTEGER}`
+    );
+  }
+  return n7;
+};
+var re = {
+  prefix: /^[ v=]+/,
+  main: /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)/,
+  prerelease: /-([0-9a-zA-Z_.-]+)(?:$|\+)/,
+  build: /\+([0-9a-zA-Z_.-]+)$/,
+  full: /^[ v=]*(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9a-zA-Z_.-]+))?(?:\+([0-9a-zA-Z_.-]+))?$/
+};
+var invalidVersion = (version, message) => {
+  const er = syntaxError(
+    `invalid version: ${message}`,
+    { version },
+    Version
+  );
+  return er;
+};
+var Version = class _Version {
+  /** raw string provided to create this Version */
+  raw;
+  /**  major version number */
+  major;
+  /** minor version number */
+  minor;
+  /** patch version number */
+  patch;
+  /**
+   * List of `'.'`-separated strings and numbers indicating that this
+   * version is a prerelease.
+   *
+   * This is undefined if the version does not have a prerelease section.
+   */
+  prerelease;
+  /**
+   * List of `'.'`-separated strings in the `build` section.
+   *
+   * This is undefined if the version does not have a build.
+   */
+  build;
+  /** Canonical strict form of this version */
+  toString() {
+    return `${this.major}.${this.minor}.${this.patch}${this.prerelease ? "-" + this.prerelease.join(".") : ""}${this.build ? "+" + this.build.join(".") : ""}`;
+  }
+  /** Generate a `Version` object from a SemVer string */
+  static parse(version) {
+    version = version.replace(re.prefix, "").trim();
+    if (version.length > 256) {
+      throw invalidVersion(
+        version,
+        "must be less than 256 characters"
+      );
+    }
+    const parsed = re.full.exec(version);
+    if (!parsed) {
+      const main2 = re.main.exec(version);
+      if (!main2) {
+        throw invalidVersion(
+          version,
+          "no Major.minor.patch tuple present"
+        );
+      } else {
+        throw invalidVersion(
+          version,
+          "invalid build or patch section"
+        );
+      }
+    }
+    const [_2, major_, minor_, patch_, prerelease, build] = parsed;
+    const major2 = safeNumber(major_, version, "major");
+    const minor2 = safeNumber(minor_, version, "minor");
+    const patch = safeNumber(patch_, version, "patch");
+    return new _Version(
+      version,
+      major2,
+      minor2,
+      patch,
+      prerelease,
+      build
+    );
+  }
+  constructor(version, major2, minor2, patch, prerelease, build) {
+    this.raw = version;
+    this.major = major2;
+    this.minor = minor2;
+    this.patch = patch;
+    if (prerelease) {
+      this.prerelease = fastSplit(prerelease, ".", -1, (c) => {
+        if (!c) {
+          throw invalidVersion(
+            version,
+            "invalid prerelease, empty identifiers not allowed"
+          );
+        }
+        return maybeNumber(c);
+      });
+    }
+    if (build) {
+      this.build = fastSplit(build, ".", -1, (c) => {
+        if (!c) {
+          throw invalidVersion(
+            version,
+            "invalid build metadata, empty identifiers not allowed"
+          );
+        }
+      });
+    }
+  }
+  /**
+   * Return 1 if this is > the provided version, -1 if we're less, or 0 if
+   * they are equal.
+   *
+   * No special handling for prerelease versions, this is just a precedence
+   * comparison.
+   *
+   * This can be used to sort a list of versions by precedence:
+   *
+   * ```ts
+   * const versions: Version[] = getVersionsSomehow()
+   * const sorted = versions.sort((a, b) => a.compare(b))
+   * ```
+   */
+  compare(v2) {
+    if (this.major > v2.major) return 1;
+    if (this.major < v2.major) return -1;
+    if (this.minor > v2.minor) return 1;
+    if (this.minor < v2.minor) return -1;
+    if (this.patch > v2.patch) return 1;
+    if (this.patch < v2.patch) return -1;
+    if (!v2.prerelease?.length)
+      return !this.prerelease?.length ? 0 : -1;
+    if (!this.prerelease?.length) return 1;
+    const len = Math.max(this.prerelease.length, v2.prerelease.length);
+    const me2 = this.prerelease;
+    const thee = v2.prerelease;
+    for (let i = 0; i < len; i++) {
+      const m = me2[i];
+      const t = thee[i];
+      if (m === t) continue;
+      if (t === void 0) return 1;
+      if (m === void 0) return -1;
+      if (typeof m !== typeof t) {
+        return typeof m === "string" ? 1 : -1;
+      }
+      return m > t ? 1 : -1;
+    }
+    return 0;
+  }
+  /**
+   * The inverse of compare, for sorting version lists in reverse order
+   */
+  rcompare(v2) {
+    return -1 * this.compare(v2);
+  }
+  /** true if this version is > the argument */
+  greaterThan(v2) {
+    return this.compare(v2) === 1;
+  }
+  /** true if this version is >= the argument */
+  greaterThanEqual(v2) {
+    return this.compare(v2) > -1;
+  }
+  /** true if this version is < the argument */
+  lessThan(v2) {
+    return this.compare(v2) === -1;
+  }
+  /** true if this version is &lt;= the argument */
+  lessThanEqual(v2) {
+    return this.compare(v2) < 1;
+  }
+  /** true if these two versions have equal SemVer precedence */
+  equals(v2) {
+    return this.compare(v2) === 0;
+  }
+  /** just compare the M.m.p parts of the version */
+  tupleEquals(v2) {
+    return this.major === v2.major && this.minor === v2.minor && this.patch === v2.patch;
+  }
+  /** true if this version satisfies the range */
+  satisfies(r) {
+    return r.test(this);
+  }
+  /**
+   * Increment the version in place, in the manner specified.
+   *
+   * Part behaviors:
+   *
+   * - `'major'` If the version is a `M.0.0-...` version with a prerelease, then
+   * simply drop the prerelease. Otherwise, set the minor and patch to 0, and
+   * increment the major. So `1.0.0-beta` becomes `1.0.0`, and `1.2.3` becomes
+   * `2.0.0`
+   *
+   * - `'minor'` If the version is a `M.m.0-...` version with a prerelease, then
+   * simply drop the prerelease. Otherwise, set the patch to 0, and increment the
+   * minor. So `1.2.0-beta` becomes `1.2.0`, and `1.2.3` becomes `1.3.0`.
+   *
+   * - `'patch'` If the version has a prerelease, then simply drop the
+   * prerelease. Otherwise, increment the patch value. So `1.2.3-beta` becomes
+   * `1.2.3` and `1.2.3` becomes `1.2.4`.
+   *
+   * - `'premajor'` Set the patch and minor versions to `0`, increment the major
+   * version, and add a prerelease, using the optional identifier.
+   *
+   * - `'preminor'` Set the patch version to `0`, increment the minor version,
+   * and add a prerelease, using the optional identifier.
+   *
+   * - `'prepatch'` If a prerelease is already present, increment the patch
+   * version, otherwise leave it untouched, and add a prerelease, using the
+   * optional identifier.
+   *
+   * - `'prerelease'` If a prerelease version is present, then behave the same as
+   * `'prepatch'`. Otherwise, add a prerelease, using the optional identifier.
+   *
+   * - `'pre'` This is mostly for use by the other prerelease incrementers.
+   *
+   *     - If a prerelease identifier is provided:
+   *
+   *        Update that named portion of the prerelease. For example,
+   *        `inc('1.2.3-beta.4', 'pre', 'beta')` would result in `1.2.3-beta.5`.
+   *
+   *        If there is no prerelease identifier by that name, then replace the
+   *        prerelease with `[name]`. So `inc('1.2.3-alpha.4', 'pre', 'beta')`
+   *        would result in `1.2.3-beta`.
+   *
+   *        If the prerelease identifer is present, but has no numeric value
+   *        following it, then add `0`. So `inc('1.2.3-beta', 'pre', 'beta')`
+   *        would result in `1.2.3-beta.0`.
+   *
+   *     - If no prerelease identifier is provided:
+   *
+   *       If there is no current prerelease, then set the prerelease to `0`. So,
+   *       `inc('1.2.3', 'pre')` becomes `1.2.3-0`.
+   *
+   *       If the last item in the prerelease is numeric, then increment it. So,
+   *       `inc('1.2.3-beta.3', 'pre')` becomes `1.2.3-beta.4`.
+   */
+  inc(part, prereleaseIdentifier) {
+    switch (part) {
+      case "premajor":
+        this.prerelease = void 0;
+        this.patch = 0;
+        this.minor = 0;
+        this.major++;
+        this.inc("pre", prereleaseIdentifier);
+        break;
+      case "preminor":
+        this.prerelease = void 0;
+        this.patch = 0;
+        this.minor++;
+        this.inc("pre", prereleaseIdentifier);
+        break;
+      case "prepatch":
+        this.prerelease = void 0;
+        this.inc("patch");
+        this.inc("pre", prereleaseIdentifier);
+        break;
+      case "prerelease":
+        if (!this.prerelease?.length)
+          this.inc("patch", prereleaseIdentifier);
+        this.inc("pre", prereleaseIdentifier);
+        break;
+      case "pre": {
+        if (!prereleaseIdentifier) {
+          if (!this.prerelease?.length) {
+            this.prerelease = [0];
+            break;
+          }
+          const last = this.prerelease[this.prerelease.length - 1];
+          if (typeof last === "number") {
+            this.prerelease[this.prerelease.length - 1] = last + 1;
+          } else {
+            this.prerelease.push(0);
+          }
+          break;
+        }
+        if (!this.prerelease?.length) {
+          this.prerelease = [prereleaseIdentifier];
+          break;
+        }
+        const i = this.prerelease.indexOf(
+          maybeNumber(prereleaseIdentifier)
+        );
+        if (i === -1) {
+          this.prerelease = [prereleaseIdentifier];
+          break;
+        }
+        const baseValue = this.prerelease[i + 1];
+        if (typeof baseValue === "number") {
+          this.prerelease[i + 1] = baseValue + 1;
+          break;
+        }
+        if (i === this.prerelease.length - 1) {
+          this.prerelease.push(0);
+          break;
+        }
+        this.prerelease.splice(i + 1, 0, 0);
+        break;
+      }
+      case "major":
+        if (!this.prerelease?.length || this.minor || this.patch)
+          this.major++;
+        this.prerelease = void 0;
+        this.patch = 0;
+        this.minor = 0;
+        break;
+      case "minor":
+        if (!this.prerelease?.length || this.patch) this.minor++;
+        this.prerelease = void 0;
+        this.patch = 0;
+        break;
+      case "patch":
+        if (!this.prerelease?.length) this.patch++;
+        this.prerelease = void 0;
+        break;
+      default:
+        throw typeError(
+          "Invalid increment identifier",
+          {
+            version: this,
+            found: part,
+            validOptions: [
+              "major",
+              "minor",
+              "patch",
+              "premajor",
+              "preminor",
+              "prepatch",
+              "prerelease",
+              "pre"
+            ]
+          },
+          this.inc
+        );
+    }
+    this.raw = this.toString();
+    return this;
+  }
+};
+
+// ../../src/semver/src/comparator.ts
+var isOperator = (o) => !!o && (o === ">" || o === "<" || o === ">=" || o === "<=" || o === "" || o === "~" || o === "^" || o === "~>");
+var preJunk = new Set("=v 	");
+var invalidComp = (c, message) => syntaxError(
+  `invalid comparator: '${c}' ${message}`,
+  { found: c },
+  Comparator
+);
+var assertNumber = (value, c, field) => {
+  const n7 = Number(value);
+  if (n7 !== n7) {
+    throw invalidComp(
+      c,
+      `${field} must be numeric or 'x', got: '${value}'`
+    );
+  }
+  return n7;
+};
+var assertVersion = (v2, comp) => {
+  if (!v2) {
+    throw invalidComp(comp, "no value provided for operator");
+  }
+};
+var assertMissing = (value, c, field) => {
+  if (value && !isX(value)) {
+    throw invalidComp(
+      c,
+      `cannot omit '${field}' and include subsequent fields`
+    );
+  }
+};
+var MAJOR = 0;
+var MINOR = 1;
+var PATCH = 2;
+var isX = (c) => !c || c === "X" || c === "x" || c === "*";
+var isFullVersion = (parsed) => void 0 !== parsed[PATCH];
+var isXPatch = (parsed) => void 0 !== parsed[MINOR] && void 0 === parsed[PATCH];
+var isXMinor = (parsed) => void 0 !== parsed[MAJOR] && void 0 === parsed[MINOR];
+var isXMajor = (parsed) => void 0 === parsed[MAJOR];
+var Comparator = class {
+  /**
+   * does this range include prereleases, even when they do not
+   * match the tuple in the comparator?
+   */
+  includePrerelease;
+  /** raw string used to create this comparator */
+  raw;
+  /** tokens extracted from the raw string input */
+  tokens;
+  /**
+   * Either the `any` comparator, the `none` comparator, or an operator
+   * and a {@link ParsedXRange}
+   */
+  tuples = [];
+  /** true if this comparator can not match anything */
+  isNone = false;
+  /**
+   * true if this comparator is a `'*'` type of range.
+   *
+   * Note that it still will not match versions with a prerelease value,
+   * unless the tuple in the version matches the tuple provided to the
+   * comparator, and the comparator version also has a prerelease value,
+   * unless `includePrerelease` is set.
+   */
+  isAny = false;
+  /** the canonical strict simplified parsed form of this constructor */
+  toString() {
+    return this.isNone ? "<0.0.0-0" : this.isAny ? "*" : (
+      /* c8 ignore next */
+      this.tuples.map((c) => isAny(c) ? "*" : c.join("")).join(" ")
+    );
+  }
+  constructor(comp, includePrerelease = false) {
+    this.includePrerelease = includePrerelease;
+    comp = comp.trim();
+    this.raw = comp;
+    let hyphen = false;
+    const rawComps = fastSplit(comp, " ", -1, (part, parts, i) => {
+      if (part === "-") {
+        if (hyphen) {
+          throw invalidComp(
+            comp,
+            "multiple hyphen ranges not allowed"
+          );
+        }
+        if (parts.length !== 1 || i === -1) {
+          throw invalidComp(
+            comp,
+            "hyphen must be between two versions"
+          );
+        }
+        hyphen = true;
+      } else if (hyphen && parts.length !== 2) {
+        throw invalidComp(comp, "hyphen range must be alone");
+      }
+    });
+    const comps = [];
+    let followingOperator = false;
+    let l = 0;
+    for (const c of rawComps) {
+      if (c === "") continue;
+      if (!followingOperator) {
+        followingOperator = isOperator(c);
+        comps.push(c);
+        l++;
+        continue;
+      }
+      comps[l - 1] += c;
+      followingOperator = false;
+    }
+    if (hyphen) {
+      const [min, _2, max] = comps;
+      if (!min || !max) {
+        throw invalidComp(comp, "hyphen must be between two versions");
+      }
+      this.#parseHyphenRange(min, max);
+    } else if (!comps.length || comps.length === 1 && isX(comps[0])) {
+      this.tuples.push(this.#getComparatorAny());
+    } else {
+      for (const c of comps) {
+        this.#parse(c);
+        if (this.isNone) break;
+      }
+    }
+    this.tokens = comps;
+    this.isAny = true;
+    for (const c of this.tuples) {
+      if (Array.isArray(c) || !c.isAny) {
+        this.isAny = false;
+        break;
+      }
+    }
+  }
+  // inclusive min
+  #xInclusiveMin(raw) {
+    const z = this.includePrerelease ? "0" : void 0;
+    const [M3, m = 0, p = 0, pr = z, build] = this.#parseX(raw);
+    return M3 === void 0 ? this.#getComparatorAny() : [">=", new Version(raw, M3, m, p, pr, build)];
+  }
+  // exclusive min
+  #xExclusiveMin(raw) {
+    const parsed = this.#parseX(raw);
+    if (isFullVersion(parsed)) {
+      return [">", new Version(raw, ...parsed)];
+    }
+    const z = this.includePrerelease ? "0" : void 0;
+    if (isXPatch(parsed)) {
+      return [
+        ">=",
+        new Version(
+          raw,
+          parsed[MAJOR],
+          parsed[MINOR] + 1,
+          0,
+          z,
+          void 0
+        )
+      ];
+    }
+    if (isXMinor(parsed)) {
+      return [
+        ">=",
+        new Version(raw, parsed[MAJOR] + 1, 0, 0, z, void 0)
+      ];
+    }
+    this.isNone = true;
+    this.tuples.length = 0;
+    return comparatorNone;
+  }
+  #xInclusiveMax(raw) {
+    const parsed = this.#parseX(raw);
+    return isFullVersion(parsed) ? ["<=", new Version(raw, ...parsed)] : isXPatch(parsed) ? [
+      "<",
+      new Version(
+        raw,
+        parsed[MAJOR],
+        parsed[MINOR] + 1,
+        0,
+        "0",
+        void 0
+      )
+    ] : isXMinor(parsed) ? [
+      "<",
+      new Version(raw, parsed[MAJOR] + 1, 0, 0, "0", void 0)
+    ] : this.#getComparatorAny();
+  }
+  #xExclusiveMax(raw) {
+    const z = this.includePrerelease ? "0" : void 0;
+    const [M3 = 0, m = 0, p = 0, pr = z, build] = this.#parseX(raw);
+    if (M3 === 0 && m === 0 && p === 0 && pr === "0") {
+      this.isNone = true;
+      this.tuples.length = 0;
+      return comparatorNone;
+    }
+    return ["<", new Version(raw, M3, m, p, pr, build)];
+  }
+  #validXM(raw, m, p) {
+    assertMissing(m, raw, "major");
+    assertMissing(p, raw, "major");
+    if (m === "" || p === "") {
+      throw invalidComp(raw, `(Did you mean '*'?)`);
+    }
+    return [];
+  }
+  #validXm(raw, M3, m, p) {
+    assertMissing(p, raw, "major");
+    if (m === "" || p === "") {
+      throw invalidComp(raw, `(Did you mean '${M3}'?)`);
+    }
+    return [assertNumber(M3, raw, "major")];
+  }
+  #validXp(raw, M3, m, p) {
+    if (p === "") {
+      throw invalidComp(raw, `(Did you mean '${M3}.${m}'?)`);
+    }
+    return [
+      assertNumber(M3, raw, "major"),
+      assertNumber(m, raw, "minor")
+    ];
+  }
+  #validTuple(raw, M3, m, p) {
+    return [
+      assertNumber(M3, raw, "major"),
+      assertNumber(m, raw, "minor"),
+      assertNumber(p, raw, "patch")
+    ];
+  }
+  #validXbuild(raw, M3, m, p, pl) {
+    const patch = p.substring(0, pl);
+    const build = p.substring(pl + 1);
+    if (!patch) {
+      throw invalidComp(raw, "cannot specify build without patch");
+    }
+    if (!build) {
+      throw invalidComp(raw, `encountered '+', but no build value`);
+    }
+    return [
+      assertNumber(M3, raw, "major"),
+      assertNumber(m, raw, "minor"),
+      assertNumber(patch, raw, "patch"),
+      void 0,
+      build
+    ];
+  }
+  #validXpr(raw, M3, m, p, hy) {
+    {
+      const patch = p.substring(0, hy);
+      const pr = p.substring(hy + 1);
+      if (!patch) {
+        throw invalidComp(
+          raw,
+          "cannot specify prerelease without patch"
+        );
+      }
+      if (!pr) {
+        throw invalidComp(
+          raw,
+          `encountered '-', but no prerelease value`
+        );
+      }
+      return [
+        assertNumber(M3, raw, "major"),
+        assertNumber(m, raw, "minor"),
+        assertNumber(patch, raw, "patch"),
+        pr,
+        void 0
+      ];
+    }
+  }
+  #validXprbuild(raw, M3, m, p, hy, pl) {
+    const patch = p.substring(0, hy);
+    const pr = p.substring(hy + 1, pl);
+    const build = p.substring(pl + 1);
+    if (!patch) {
+      throw invalidComp(
+        raw,
+        "cannot specify prerelease without patch"
+      );
+    }
+    if (!pr) {
+      throw invalidComp(
+        raw,
+        `encountered '-', but no prerelease value`
+      );
+    }
+    if (!build) {
+      throw invalidComp(raw, `encountered '+', but no build value`);
+    }
+    return [
+      assertNumber(M3, raw, "major"),
+      assertNumber(m, raw, "minor"),
+      assertNumber(patch, raw, "patch"),
+      pr,
+      build
+    ];
+  }
+  // pull the relevant values out of an X-range or version
+  // return the fields for creating a Version object.
+  // only call once operator is stripped off
+  #parseX(raw) {
+    let [M3, m, p] = fastSplit(raw, ".", 3);
+    let prune = 0;
+    while (M3 && preJunk.has(M3.charAt(prune))) prune++;
+    if (M3 !== void 0 && prune !== 0) M3 = M3.substring(prune);
+    if (!M3 || isX(M3)) return this.#validXM(raw, m, p);
+    if (!m || isX(m)) return this.#validXm(raw, M3, m, p);
+    if (!p || isX(p)) return this.#validXp(raw, M3, m, p);
+    const hy = p.indexOf("-");
+    const pl = p.indexOf("+");
+    if (pl === -1 && hy === -1) return this.#validTuple(raw, M3, m, p);
+    if (pl === -1) return this.#validXpr(raw, M3, m, p, hy);
+    if (hy === -1) return this.#validXbuild(raw, M3, m, p, pl);
+    return this.#validXprbuild(raw, M3, m, p, hy, pl);
+  }
+  #parseHyphenRange(min, max) {
+    const minv = this.#xInclusiveMin(min);
+    const maxv = this.#xInclusiveMax(max);
+    const minAny = isAny(minv);
+    const maxAny = isAny(maxv);
+    if (minAny && maxAny) this.tuples.push(this.#getComparatorAny());
+    else if (minAny) this.tuples.push(maxv);
+    else if (maxAny) this.tuples.push(minv);
+    else this.tuples.push(minv, maxv);
+  }
+  #parse(comp) {
+    const first = comp.charAt(0);
+    const first2 = comp.substring(0, 2);
+    const v1 = comp.substring(1);
+    const v2 = comp.substring(2);
+    switch (first2) {
+      case "~>":
+        assertVersion(v2, comp);
+        return this.#parseTilde(v2);
+      case ">=":
+        assertVersion(v2, comp);
+        return this.tuples.push(this.#xInclusiveMin(v2));
+      case "<=":
+        assertVersion(v2, comp);
+        return this.tuples.push(this.#xInclusiveMax(v2));
+    }
+    switch (first) {
+      case "~":
+        assertVersion(v1, comp);
+        return this.#parseTilde(v1);
+      case "^":
+        assertVersion(v1, comp);
+        return this.#parseCaret(v1);
+      case ">":
+        assertVersion(v1, comp);
+        return this.tuples.push(this.#xExclusiveMin(v1));
+      case "<":
+        assertVersion(v1, comp);
+        return this.tuples.push(this.#xExclusiveMax(v1));
+    }
+    return this.#parseEq(comp);
+  }
+  #parseTilde(comp) {
+    const parsed = this.#parseX(comp);
+    if (isXMajor(parsed)) {
+      this.tuples.push(this.#getComparatorAny());
+      return;
+    }
+    const z = this.includePrerelease ? "0" : void 0;
+    if (isXMinor(parsed)) {
+      const [M4] = parsed;
+      this.tuples.push(
+        [">=", new Version(comp, M4, 0, 0, z, void 0)],
+        ["<", new Version(comp, M4 + 1, 0, 0, "0", void 0)]
+      );
+      return;
+    }
+    if (isXPatch(parsed)) {
+      const [M4, m2] = parsed;
+      const z2 = this.includePrerelease ? "0" : void 0;
+      this.tuples.push(
+        [">=", new Version(comp, M4, m2, 0, z2, void 0)],
+        ["<", new Version(comp, M4, m2 + 1, 0, "0", void 0)]
+      );
+      return;
+    }
+    const [M3, m, p, pr = z, build] = parsed;
+    this.tuples.push(
+      [">=", new Version(comp, M3, m, p, pr, build)],
+      ["<", new Version(comp, M3, m + 1, 0, "0", build)]
+    );
+  }
+  #parseCaret(comp) {
+    const min = this.#xInclusiveMin(comp);
+    if (isAny(min)) {
+      this.tuples.push(min);
+      return;
+    }
+    const minv = min[1];
+    if (minv.major !== 0) {
+      this.tuples.push(min, [
+        "<",
+        new Version(comp, minv.major + 1, 0, 0, "0", void 0)
+      ]);
+    } else if (minv.minor !== 0) {
+      this.tuples.push(min, [
+        "<",
+        new Version(
+          comp,
+          minv.major,
+          minv.minor + 1,
+          0,
+          "0",
+          void 0
+        )
+      ]);
+    } else if (!minv.prerelease?.length) {
+      this.tuples.push(["", minv]);
+    } else {
+      this.tuples.push(min, [
+        "<",
+        new Version(
+          comp,
+          minv.major,
+          minv.minor,
+          minv.patch + 1,
+          "0",
+          void 0
+        )
+      ]);
+    }
+  }
+  #parseEq(comp) {
+    const parsed = this.#parseX(comp);
+    const z = this.includePrerelease ? "0" : void 0;
+    if (isFullVersion(parsed)) {
+      this.tuples.push(["", new Version(comp, ...parsed)]);
+    } else if (isXMajor(parsed)) {
+      this.tuples.push(this.#getComparatorAny());
+    } else if (isXMinor(parsed)) {
+      this.tuples.push([
+        ">=",
+        new Version(comp, parsed[MAJOR], 0, 0, z, void 0)
+      ]);
+      this.tuples.push([
+        "<",
+        new Version(comp, parsed[MAJOR] + 1, 0, 0, "0", void 0)
+      ]);
+    } else if (isXPatch(parsed)) {
+      this.tuples.push(
+        [
+          ">=",
+          new Version(
+            comp,
+            parsed[MAJOR],
+            parsed[MINOR],
+            0,
+            z,
+            void 0
+          )
+        ],
+        [
+          "<",
+          new Version(
+            comp,
+            parsed[MAJOR],
+            parsed[MINOR] + 1,
+            0,
+            "0",
+            void 0
+          )
+        ]
+      );
+    }
+  }
+  /** return true if the version is a match for this comparator */
+  test(v2) {
+    if (this.isNone) return false;
+    const ip = this.includePrerelease;
+    const hasPR = !!v2.prerelease?.length;
+    let prOK = ip || !hasPR;
+    for (const c of this.tuples) {
+      if (isAny(c)) {
+        continue;
+      }
+      const [op, cv] = c;
+      prOK ||= !!cv.prerelease?.length && v2.tupleEquals(cv);
+      switch (op) {
+        case "":
+          if (!v2.equals(cv)) return false;
+          continue;
+        case ">":
+          if (!v2.greaterThan(cv)) return false;
+          continue;
+        case ">=":
+          if (!v2.greaterThanEqual(cv)) return false;
+          continue;
+        case "<":
+          if (!v2.lessThan(cv)) return false;
+          continue;
+        case "<=":
+          if (!v2.lessThanEqual(cv)) return false;
+          continue;
+      }
+    }
+    return prOK;
+  }
+  #getComparatorAny() {
+    return this.includePrerelease ? comparatorAnyPR : comparatorAny;
+  }
+};
+var isAny = (c) => c === comparatorAny || c === comparatorAnyPR;
+var comparatorAny = {
+  isAny: true,
+  toString: () => "*",
+  includePrerelease: false,
+  test: (v2) => !v2.prerelease?.length
+};
+var comparatorAnyPR = {
+  isAny: true,
+  toString: () => "*",
+  includePrerelease: true,
+  test: (_2) => true
+};
+var comparatorNone = {
+  isNone: true,
+  toString: () => "<0.0.0-0",
+  includePrerelease: false,
+  test: (_2) => false
+};
+
+// ../../src/semver/src/range.ts
+var Range = class {
+  /** raw string used to create this Range */
+  raw;
+  /** true if the range is `*` */
+  isAny;
+  /** true if the range is a single semver version */
+  isSingle;
+  /** true if the range cannot match anything */
+  /**
+   * set of {@link Comparator} objects representing the `||`-separated sections
+   * of the range. If at least one of these matches, then the version is a
+   * match.
+   */
+  set = [];
+  /** true if all prerelease versions should be included */
+  includePrerelease;
+  /** cached toString */
+  #toString;
+  constructor(range, includePrerelease = false) {
+    this.raw = range;
+    this.includePrerelease = includePrerelease;
+    this.isAny = false;
+    let isFirst = true;
+    this.isSingle = false;
+    const comparatorErrors = [];
+    fastSplit(range, "||", -1, (part) => {
+      if (this.isAny) return;
+      const cmp = this.#maybeComparator(part, this.includePrerelease);
+      if (cmp instanceof Error) {
+        comparatorErrors.push(cmp);
+        return;
+      }
+      if (cmp.isAny) {
+        this.set = [cmp];
+        this.isAny = true;
+        return;
+      }
+      this.set.push(cmp);
+      if (!isFirst) this.isSingle = false;
+      else if (Array.isArray(cmp.tuples) && cmp.tuples.length === 1 && Array.isArray(cmp.tuples[0]) && cmp.tuples[0][0] === "") {
+        this.isSingle = true;
+      }
+      isFirst = false;
+    });
+    if (!this.set.length && comparatorErrors.length) {
+      if (comparatorErrors.length === 1 && comparatorErrors[0]) {
+        throw comparatorErrors[0];
+      }
+      throw new AggregateError(comparatorErrors);
+    }
+  }
+  #maybeComparator(part, includePrerelease) {
+    try {
+      return new Comparator(part, includePrerelease);
+    } catch (er) {
+      return asError(er);
+    }
+  }
+  /**
+   * test a {@link Version} against the range
+   */
+  test(v2) {
+    return this.set.some((c) => c.test(v2));
+  }
+  /** return the simplified canonical form of this range */
+  toString() {
+    if (this.#toString) return this.#toString;
+    if (this.isSingle) {
+      this.#toString = String(this.set[0]);
+      return this.#toString;
+    }
+    this.#toString = this.set.map((c) => String(c)).join(" || ");
+    return this.#toString;
+  }
+};
+
+// ../../src/semver/src/index.ts
+var rangeCache = /* @__PURE__ */ new Map();
+var MAX_RANGE_CACHE = 4096;
+var parseRange = (range, includePrerelease = false) => {
+  if (typeof range === "object") {
+    if (range.includePrerelease === includePrerelease) return range;
+    range = range.raw;
+  }
+  const key = `${+includePrerelease}\0${range}`;
+  const cached = rangeCache.get(key);
+  if (cached !== void 0 || rangeCache.has(key)) return cached;
+  let parsed;
+  try {
+    parsed = new Range(range, includePrerelease);
+  } catch {
+    parsed = void 0;
+  }
+  if (rangeCache.size >= MAX_RANGE_CACHE) rangeCache.clear();
+  rangeCache.set(key, parsed);
+  return parsed;
+};
+
+// ../../src/spec/src/valid-name.ts
+var pathSafeName = /^(?!(?:node_modules|\.vlt)$)(?![A-Za-z]:)(?:@(?!\.\.?\/)[^/\\\x00-\x1f\x7f]+\/)?(?!\.\.?$)[^/\\\x00-\x1f\x7f]+$/i;
+var isPathSafeName = (name2) => typeof name2 === "string" && pathSafeName.test(name2);
+var assertPathSafeName = (name2, from) => {
+  if (isPathSafeName(name2)) return;
+  throw error(
+    "Invalid package name: not usable as a path segment",
+    {
+      code: "EINVALIDNAME",
+      found: name2,
+      from,
+      wanted: "a single path segment, or a well-formed @scope/name"
+    },
+    assertPathSafeName
+  );
+};
+
+// ../../src/spec/src/browser.ts
+var kCustomInspect = /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom");
+var defaultRegistryName = "npm";
+var defaultRegistries = {
+  gh: "https://npm.pkg.github.com/"
+};
+var defaultJsrRegistries = { jsr: "https://npm.jsr.io/" };
+var defaultGitHosts = {
+  github: "git+ssh://git@github.com:$1/$2.git",
+  bitbucket: "git+ssh://git@bitbucket.org:$1/$2.git",
+  gitlab: "git+ssh://git@gitlab.com:$1/$2.git",
+  gist: "git+ssh://git@gist.github.com/$1.git"
+};
+var defaultGitHostArchives = {
+  github: "https://api.github.com/repos/$1/$2/tarball/$committish",
+  bitbucket: "https://bitbucket.org/$1/$2/get/$committish.tar.gz",
+  gist: "https://codeload.github.com/gist/$1/tar.gz/$committish",
+  gitlab: "https://gitlab.com/$1/$2/repository/archive.tar.gz?ref=$committish"
+};
+var gitHostWebsites = {
+  github: "https://github.com/",
+  bitbucket: "https://bitbucket.org/",
+  gist: "https://gist.github.com/",
+  gitlab: "https://gitlab.com/"
+};
+var getOptions = (options) => ({
+  catalog: {},
+  catalogs: {},
+  ...options,
+  // built-in aliases are user/service-overridable: user config wins
+  "jsr-registries": {
+    ...defaultJsrRegistries,
+    ...options?.["jsr-registries"] ?? {}
+  },
+  registry: options?.registry,
+  "default-registry-alias": options?.["default-registry-alias"] ?? defaultRegistryName,
+  "scoped-registries": options?.["scoped-registries"] ?? {},
+  "git-hosts": options?.["git-hosts"] ? {
+    ...defaultGitHosts,
+    ...options["git-hosts"]
+  } : defaultGitHosts,
+  registries: {
+    ...defaultRegistries,
+    ...options?.registries ?? {}
+  },
+  "git-host-archives": options?.["git-host-archives"] ? {
+    ...defaultGitHostArchives,
+    ...options["git-host-archives"]
+  } : defaultGitHostArchives
+});
+var protocolRE = /^([a-zA-Z][a-zA-Z0-9+-]+):/;
+var builtinProtocols = /* @__PURE__ */ new Set([
+  "catalog",
+  "workspace",
+  "registry",
+  "file",
+  "http",
+  "https",
+  "git",
+  "git+ssh",
+  "git+http",
+  "git+https",
+  "git+file"
+]);
+var unknownProtocol = (str, options) => {
+  const p = protocolRE.exec(str)?.[1];
+  return p === void 0 || builtinProtocols.has(p) || p === options["default-registry-alias"] || options.registries[p] !== void 0 || options["git-hosts"][p] !== void 0 || options["jsr-registries"][p] !== void 0 ? void 0 : p;
+};
+var startsWithSpecIdentifier = (spec, options) => spec.startsWith("/") || spec.startsWith("./") || spec.startsWith("../") || spec.startsWith("file:") || spec.startsWith("http:") || spec.startsWith("https:") || spec.startsWith("workspace:") || spec.startsWith("catalog:") || spec.startsWith("git@") || spec.startsWith("git://") || spec.startsWith("git+ssh://") || spec.startsWith("git+http://") || spec.startsWith("git+https://") || spec.startsWith("git+file://") || spec.startsWith("git@github.com") || spec.startsWith("registry:") || spec.startsWith("npm:") || spec.startsWith("jsr:") || spec.startsWith("gh:") || // anything that starts with a known git host key, or a
+// custom registered registry protocol e.g: `github:`, `custom:`
+[
+  ...Object.keys(options["git-hosts"]),
+  ...Object.keys(options.registries),
+  ...Object.keys(options["jsr-registries"])
+].some((key) => spec.startsWith(`${key}:`)) || unknownProtocol(spec, options) !== void 0;
+var findFirstAt = (spec, hasScope) => spec.indexOf("@", hasScope ? 1 : 0);
+var findGitIdentifier = (spec) => spec.indexOf("#") > 2;
+var findFileIdentifier = (spec) => spec.includes("/");
+var Spec = class _Spec {
+  static parse(spec, bareOrOptions, options) {
+    return typeof spec === "object" ? spec : new this(spec, bareOrOptions, options);
+  }
+  static parseArgs(specOrBareSpec, opts) {
+    const options = getOptions(opts ?? {});
+    if (startsWithSpecIdentifier(specOrBareSpec, options)) {
+      const parsed = this.parse("(unknown)", specOrBareSpec, options);
+      if (parsed.subspec) {
+        const { namedJsrRegistry: jsrHost } = parsed;
+        if (!jsrHost) {
+          parsed.name = parsed.subspec.name;
+        }
+        parsed.spec = `${parsed.name}@${parsed.bareSpec}`;
+        assertPathSafeName(parsed.name, parsed.spec);
+      }
+      return parsed;
+    } else {
+      const hasScope = specOrBareSpec.startsWith("@");
+      const at2 = findFirstAt(specOrBareSpec, hasScope);
+      if (at2 > -1) {
+        return this.parse(
+          specOrBareSpec.substring(0, at2),
+          specOrBareSpec.substring(at2 + 1),
+          options
+        );
+      } else if (findGitIdentifier(specOrBareSpec) || !hasScope && findFileIdentifier(specOrBareSpec)) {
+        return this.parse("(unknown)", specOrBareSpec, options);
+      } else {
+        return this.parse(`${specOrBareSpec}@`, options);
+      }
+    }
+  }
+  static nodejsDependencies;
+  type;
+  spec;
+  options;
+  name;
+  scope;
+  scopeRegistry;
+  bareSpec;
+  gitRemote;
+  gitSelector;
+  gitSelectorParsed;
+  gitCommittish;
+  namedGitHost;
+  namedGitHostPath;
+  workspaceSpec;
+  workspace;
+  namedRegistry;
+  namedJsrRegistry;
+  registry;
+  registrySpec;
+  conventionalRegistryTarball;
+  semver;
+  range;
+  distTag;
+  remoteURL;
+  file;
+  catalog;
+  subspec;
+  overridden = false;
+  #final;
+  #toString;
+  /**
+   * Return the final entry in the chain of subspecs
+   * When deciding which thing to actually fetch, spec.final is the thing
+   * to look at.
+   */
+  get final() {
+    if (this.#final) return this.#final;
+    const final = this.subspec ? this.subspec.final : this;
+    if (final.type === "catalog") {
+      throw error('invalid Spec.final value, type is "catalog"');
+    }
+    return this.#final = final;
+  }
+  /**
+   * Normally, the string value of a Spec is just the string passed in to
+   * be parsed. However, in the case of a chain of subspecs, like
+   * `foo@npm:bar@npm:baz@npm:quux@latest`, this simplifies out the middle
+   * parts of the chain, returning just `foo@npm:quux@latest`
+   */
+  toString() {
+    if (this.#toString !== void 0) return this.#toString;
+    let sub = this;
+    while (sub.subspec?.subspec) sub = sub.subspec;
+    if (sub.subspec && sub.subspec.type !== "registry")
+      sub = sub.subspec;
+    return this.#toString = this.name + "@" + sub.bareSpec;
+  }
+  constructor(spec, bareOrOptions, options = {}) {
+    if (bareOrOptions && typeof bareOrOptions === "object") {
+      options = bareOrOptions;
+      bareOrOptions = void 0;
+    }
+    this.options = getOptions(options);
+    if (typeof bareOrOptions === "string") {
+      this.name = spec;
+      this.#parseScope(spec);
+      this.bareSpec = bareOrOptions;
+      this.spec = `${this.name}@${bareOrOptions}`;
+      assertPathSafeName(this.name, this.spec);
+    } else {
+      this.spec = spec;
+      this.#assertKnownProtocol(spec);
+      if (!spec.startsWith("git@") && startsWithSpecIdentifier(spec, this.options) && spec.includes(":") && [
+        ...Object.keys(this.options.registries),
+        ...Object.keys(defaultRegistries)
+      ].some((key) => spec.startsWith(`${key}:`))) {
+        this.name = spec;
+        this.bareSpec = spec;
+      } else {
+        const hasScope = spec.startsWith("@");
+        let at2 = findFirstAt(spec, hasScope);
+        if (at2 === -1) {
+          at2 = spec.length;
+          spec += "@";
+        }
+        this.name = spec.substring(0, at2);
+        assertPathSafeName(this.name, spec);
+        if (hasScope) this.#parseScope(this.name);
+        this.bareSpec = spec.substring(at2 + 1);
+      }
+    }
+    if (this.bareSpec.startsWith("catalog:")) {
+      this.catalog = this.bareSpec.substring("catalog:".length);
+      const catalog = this.catalog ? this.options.catalogs?.[this.catalog] : this.options.catalog;
+      if (!catalog) {
+        throw this.#error("Named catalog not found", {
+          name: this.catalog,
+          validOptions: this.options.catalogs && Object.keys(this.options.catalogs)
+        });
+      }
+      const sub = catalog[this.name];
+      if (!sub) {
+        throw this.#error("Name not found in catalog", {
+          name: this.name,
+          validOptions: Object.keys(catalog)
+        });
+      }
+      this.subspec = _Spec.parse(this.name, sub, this.options);
+      this.type = "catalog";
+      this.registry = this.subspec.final.registry;
+      return;
+    }
+    if (this.bareSpec.startsWith("https://")) {
+      for (const [name2, origin] of Object.entries(gitHostWebsites)) {
+        if (this.bareSpec.startsWith(origin)) {
+          const parsed = new URL(this.bareSpec);
+          const [user, project] = parsed.pathname.replace(/\.git$/, "").replace(/\/+/g, " ").trim().split(" ");
+          if (user && project) {
+            this.bareSpec = `${name2}:${user}/${project}${parsed.hash}`;
+            this.spec = `${this.name}@${this.bareSpec}`;
+            break;
+          }
+        }
+      }
+    }
+    if (this.bareSpec.startsWith("workspace:")) {
+      this.type = "workspace";
+      const ws2 = this.bareSpec.substring("workspace:".length).trim();
+      const w = ws2.lastIndexOf("@");
+      if (w === -1) {
+        this.workspace = this.name;
+      } else {
+        const wsName = ws2.substring(0, w);
+        if (!wsName || wsName === "*" || wsName === "~" || wsName === "^" || (wsName.startsWith("@") ? wsName.split("/").length !== 2 || wsName.substring(1).includes("@") : wsName.includes("@"))) {
+          throw this.#error(
+            "workspace: name must be a path or valid package name",
+            { found: wsName }
+          );
+        }
+        this.workspace = wsName;
+      }
+      const wss = w === -1 ? ws2 : ws2.substring(w + 1) || "*";
+      const range2 = wss === "*" ? void 0 : parseRange(wss);
+      if (wss !== "*" && wss !== "~" && wss !== "^" && !range2) {
+        throw this.#error(
+          "workspace: spec must be one of *, ~, or ^, or a valid semver range",
+          {
+            found: wss,
+            wanted: `'*'|'~'|'^'|SemverRange`
+          }
+        );
+      }
+      this.workspaceSpec = wss;
+      if (range2) {
+        this.semver = wss;
+        this.range = range2;
+      }
+      return;
+    }
+    if (this.bareSpec.startsWith("git://") || this.bareSpec.startsWith("git+ssh://") || this.bareSpec.startsWith("git+http://") || this.bareSpec.startsWith("git+https://") || this.bareSpec.startsWith("git+file://") || // legacy affordance
+    this.bareSpec.startsWith("git@github.com")) {
+      if (this.bareSpec.startsWith("git@")) {
+        this.bareSpec = `git+ssh://${this.bareSpec}`;
+        this.spec = `${this.name}@${this.bareSpec}`;
+      }
+      this.type = "git";
+      for (const [name2, host] of Object.entries(
+        this.options["git-hosts"]
+      )) {
+        const s = host.indexOf("$");
+        if (s > 0 && this.bareSpec.startsWith(host.substring(0, s))) {
+          const p = this.bareSpec.substring(s).replace(/\.git(#.*)?$/, "$1");
+          this.bareSpec = `${name2}:${p}`;
+          this.spec = `${this.name}@${this.bareSpec}`;
+          this.#parseHostedGit(name2, host);
+          this.type = "git";
+          return;
+        }
+      }
+      this.#parseGitSelector(this.bareSpec);
+      return;
+    }
+    const regs = Object.entries(this.options.registries);
+    if (this.bareSpec.startsWith("registry:")) {
+      const reg = this.bareSpec.substring("registry:".length);
+      const h = reg.indexOf("#");
+      if (h === -1) {
+        throw this.#error("registry: must include name/version");
+      }
+      this.type = "registry";
+      let url = reg.substring(0, h);
+      if (!url.endsWith("/")) url += "/";
+      const regSpec = reg.substring(h + 1);
+      for (let [name2, u] of regs) {
+        if (!u.endsWith("/")) {
+          u += "/";
+          this.options.registries[name2] = u;
+        }
+        if (u === url) this.namedRegistry = name2;
+      }
+      this.#parseRegistrySpec(regSpec, url);
+      this.#guessRegistryTarball();
+      return;
+    }
+    for (const [host, url] of regs) {
+      const h = `${host}:`;
+      if (this.bareSpec.startsWith(h)) {
+        this.type = "registry";
+        this.namedRegistry = host;
+        this.#parseRegistrySpec(
+          this.bareSpec.substring(h.length),
+          url
+        ).namedRegistry ??= host;
+        if (this.subspec && this.name === this.bareSpec) {
+          this.name = this.subspec.name;
+          this.spec = `${this.name}@${this.bareSpec}`;
+          assertPathSafeName(this.name, this.spec);
+        }
+        this.#guessRegistryTarball();
+        return;
+      }
+    }
+    const ghosts = Object.entries(this.options["git-hosts"]);
+    for (const [name2, template] of ghosts) {
+      if (this.#parseHostedGit(name2, template)) {
+        this.type = "git";
+        return;
+      }
+    }
+    const jsrs = Object.entries(this.options["jsr-registries"]);
+    for (const [host, url] of jsrs) {
+      const h = `${host}:`;
+      if (this.bareSpec.startsWith(h)) {
+        this.type = "registry";
+        this.namedJsrRegistry = host;
+        this.#parseJsrRegistrySpec(
+          this.bareSpec.substring(h.length),
+          url
+        ).namedJsrRegistry ??= host;
+        return;
+      }
+    }
+    if (this.bareSpec.startsWith("https://") || this.bareSpec.startsWith("http://")) {
+      this.remoteURL = this.bareSpec;
+      this.type = "remote";
+      return;
+    }
+    if (this.bareSpec.startsWith("file:")) {
+      this.type = "file";
+      const [path, uri] = getNormalizeFile(
+        this.constructor.nodejsDependencies
+      )(this.bareSpec, this);
+      this.file = path;
+      this.bareSpec = uri.replace(/\/+$/, "");
+      this.spec = `${this.name}@${this.bareSpec}`;
+      return;
+    }
+    this.#assertKnownProtocol(this.bareSpec);
+    if (!this.bareSpec.startsWith("./") && !this.bareSpec.startsWith("../") && this.options["git-hosts"].github) {
+      const hash2 = this.bareSpec.indexOf("#");
+      const up = hash2 === -1 ? this.bareSpec : this.bareSpec.substring(0, hash2);
+      if (up.split("/").length === 2) {
+        this.bareSpec = `github:${this.bareSpec}`;
+        this.spec = `${this.name}@${this.bareSpec}`;
+        this.#parseHostedGit(
+          "github",
+          this.options["git-hosts"].github
+        );
+        this.type = "git";
+        return;
+      }
+    }
+    if (this.bareSpec.includes("/") || this.bareSpec === "." || this.bareSpec === "..") {
+      this.type = "file";
+      const [file, uri] = getNormalizeFile(
+        this.constructor.nodejsDependencies
+      )(`file:${this.bareSpec}`, this);
+      this.bareSpec = uri;
+      this.spec = `${this.name}@${this.bareSpec}`;
+      this.file = file;
+      return;
+    }
+    this.type = "registry";
+    const range = parseRange(this.bareSpec);
+    if (range) {
+      this.semver = this.bareSpec.trim();
+      this.range = range;
+    } else {
+      this.distTag = this.bareSpec;
+    }
+    this.registrySpec = this.bareSpec;
+    const {
+      "scoped-registries": scopeRegs,
+      registry,
+      registries,
+      "default-registry-alias": defaultAlias
+    } = this.options;
+    const scopeReg = this.scope && scopeRegs[this.scope];
+    this.registry = scopeReg ?? registry ?? registries[defaultAlias];
+    for (const r of Object.values(this.options["jsr-registries"])) {
+      if (this.registry === r) return;
+    }
+    this.#guessRegistryTarball();
+  }
+  #parseScope(name2) {
+    if (!name2.startsWith("@")) return;
+    const s = name2.indexOf("/");
+    if (s > 1 && s < name2.length - 1) {
+      const scope = name2.substring(0, s);
+      this.registry = this.scopeRegistry = this.options["scoped-registries"][scope];
+      this.scope = scope;
+    }
+  }
+  #parseHostedGit(name2, template) {
+    if (this.bareSpec.startsWith(`${name2}:`)) {
+      const h = this.bareSpec.indexOf("#");
+      const bare = h === -1 ? this.bareSpec : this.bareSpec.substring(0, h);
+      const hash2 = h === -1 ? "" : this.bareSpec.substring(h);
+      const hostPath = bare.substring(name2.length + 1);
+      if (!hostPath) {
+        throw this.#error("invalid named git host specifier");
+      }
+      const split = hostPath.split("/");
+      let t = template;
+      for (let i = 0; i < split.length; i++) {
+        t = t.split(`$${i + 1}`).join(split[i]);
+      }
+      t += hash2;
+      this.namedGitHost = name2;
+      this.namedGitHostPath = hostPath;
+      this.#parseGitSelector(t);
+      if (this.gitCommittish && !this.gitSelectorParsed?.path) {
+        const archiveHost = this.options["git-host-archives"][name2];
+        if (name2 === "github" && this.gitCommittish.startsWith("pull/") && this.gitCommittish.match(/\//g)?.length === 1) {
+          this.gitCommittish += "/head";
+        }
+        if (archiveHost) {
+          this.type = "remote";
+          let t2 = archiveHost;
+          t2 = t2.split("$committish").join(this.gitCommittish);
+          for (let i = 0; i < split.length; i++) {
+            t2 = t2.split(`$${i + 1}`).join(split[i]);
+          }
+          this.remoteURL = t2;
+        }
+      }
+      return true;
+    }
+    return false;
+  }
+  /* c8 ignore start */
+  [kCustomInspect]() {
+    return `@vltpkg/spec.Spec ${String(this)}`;
+  }
+  /* c8 ignore stop */
+  #guessRegistryTarball() {
+    const { name: name2, registry, range } = this.final;
+    if (!registry || !range?.isSingle) return;
+    const stripScope = /^@[^/]+\//;
+    const base = registry.endsWith("/") ? registry : registry + "/";
+    this.conventionalRegistryTarball = String(
+      new URL(
+        `${name2}/-/${name2.replace(stripScope, "")}-${range}.tgz`,
+        base
+      )
+    );
+  }
+  #parseRegistrySpec(s, url) {
+    this.registry = url;
+    this.subspec = this.constructor.parse(s, {
+      ...this.options,
+      registry: url
+    });
+    return this.subspec;
+  }
+  #parseJsrRegistrySpec(s, url) {
+    this.registry = url;
+    if (!s.startsWith("@")) s = `${this.name}@${s}`;
+    const name2 = s.startsWith("@jsr/") ? s : `@jsr/${s.replace(/^@/, "").replace(/\//, "__")}`;
+    this.subspec = this.constructor.parse(name2, {
+      ...this.options,
+      "scoped-registries": {
+        ...this.options["scoped-registries"],
+        "@jsr": url
+      }
+    });
+    if (this.name === "(unknown)") {
+      const nextAt = s.indexOf("@", 1);
+      if (nextAt === -1) {
+        this.name = s;
+      } else {
+        this.name = s.substring(0, s.indexOf("@", 1));
+      }
+      assertPathSafeName(this.name, s);
+    }
+    const reg = `${this.namedJsrRegistry}:`;
+    const n7 = `${reg}${this.name}`;
+    if (this.bareSpec.startsWith(n7 + "@")) {
+      this.bareSpec = reg + this.bareSpec.substring(n7.length + 1);
+    } else if (this.bareSpec === n7) {
+      this.bareSpec = reg;
+    }
+    this.spec = this.name + "@" + this.bareSpec;
+    return this.subspec;
+  }
+  #assertKnownProtocol(str) {
+    const proto = unknownProtocol(str, this.options);
+    if (proto === void 0) return;
+    throw this.#error(`Protocol ${proto}: is not defined`, {
+      found: `${proto}:`,
+      validOptions: [
+        .../* @__PURE__ */ new Set([
+          ...builtinProtocols,
+          this.options["default-registry-alias"],
+          ...Object.keys(this.options.registries),
+          ...Object.keys(this.options["git-hosts"]),
+          ...Object.keys(this.options["jsr-registries"])
+        ])
+      ].map((p) => `${p}:`)
+    });
+  }
+  #error(message, extra = {}) {
+    return error(message, { spec: this.spec, ...extra }, this.#error);
+  }
+  #parseGitSelector(s) {
+    const h = s.indexOf("#");
+    if (h === -1) {
+      this.gitRemote = s;
+      return;
+    }
+    this.gitRemote = s.substring(0, h);
+    this.gitSelector = s.substring(h + 1);
+    const [selectorParsed, committish, range] = this.constructor.parseGitSelector(this.gitSelector, this);
+    this.range = range;
+    this.gitCommittish = committish;
+    this.gitSelectorParsed = selectorParsed;
+  }
+  /**
+   * Should only ever be called with the bit that comes AFTER the #
+   * in the git remote url.
+   */
+  static parseGitSelector(selector, spec) {
+    if (!selector) return [{}];
+    const split = selector.split("::");
+    const first = split[0];
+    let committish = void 0;
+    let range = void 0;
+    const parsed = {};
+    if (typeof first !== "string") {
+      throw typeError("impossible", {
+        found: first,
+        wanted: String
+      });
+    }
+    if (!first.includes(":")) {
+      committish = first;
+      split.shift();
+    }
+    for (const kv of split) {
+      const c = kv.indexOf(":");
+      if (c === -1) continue;
+      const k3 = kv.substring(0, c);
+      const v2 = kv.substring(c + 1);
+      if (k3 === "semver") {
+        if (committish) {
+          throw error(
+            "Cannot specify a semver range and committish value",
+            { spec }
+          );
+        }
+        range = parseRange(v2);
+        if (!range) {
+          throw error(`Invalid git tag semver range: ${v2}`, { spec });
+        }
+      }
+      if (k3 === "semver" || k3 === "path") {
+        if (k3 === "path") {
+          if (
+            /* c8 ignore next */
+            this.nodejsDependencies?.isAbsolute(
+              v2
+            ) || /(^|\/|\\)\.\.($|\\|\/)/.test(v2)
+          ) {
+            throw error("Invalid path in git selector", { spec });
+          }
+          parsed.path = (this.nodejsDependencies ? this.nodejsDependencies.join("/", v2).substring(1) : v2).replace(/\\/g, "/");
+        } else {
+          parsed[k3] = v2;
+        }
+      }
+    }
+    return [parsed, committish, range];
+  }
+};
+var getNormalizeFile = (opts) => (bareSpec, spec) => {
+  const slashes = bareSpec.substring(
+    "file:".length,
+    "file://".length
+  );
+  const pref = `file:${slashes === "//" ? slashes : ""}`;
+  const rest = bareSpec.substring(pref.length);
+  const [a = "", b = "/", c = "/", d3 = "/"] = rest.split("", 4);
+  if (!a) {
+    return [".", "file:."];
+  }
+  if (a === "/" && b === "~" && c !== "/" || a === "~" && b !== "/") {
+    throw error(
+      `invalid file: specifier. '~username' not supported`,
+      { spec }
+    );
+  }
+  if (a === "~") {
+    return (
+      /* c8 ignore start */
+      opts ? [
+        opts.resolve(opts.homedir(), rest.substring(2)),
+        `file:${rest}`
+      ] : [rest, `file:${rest}`]
+    );
+  }
+  if (a === "/" && b === "~") {
+    return opts ? [
+      opts.resolve(opts.homedir(), rest.substring(3)),
+      `file:${rest.substring(1)}`
+    ] : (
+      /* c8 ignore stop */
+      [rest.substring(1), `file:${rest.substring(1)}`]
+    );
+  }
+  if (a === "/" && b === "." && (c === "/" || c === "." && d3 === "/")) {
+    return [rest.substring(1), `file:${rest.substring(1)}`];
+  }
+  if (a === "." && (b === "/" || b === "." && c === "/")) {
+    return [rest, `file:${rest}`];
+  }
+  if (slashes === "//") {
+    try {
+      const parsed = new URL(bareSpec);
+      if (parsed.host) {
+        if (parsed.host !== "localhost") {
+          throw error(
+            `invalid file:// specifier. host must be empty or 'localhost'`,
+            {
+              spec,
+              found: parsed.host,
+              validOptions: ["", "localhost"]
+            }
+          );
+        }
+      }
+      return [
+        parsed.pathname.replace(/^\/([a-zA-Z]:\/)/, "$1"),
+        `file://${parsed.pathname}`
+      ];
+    } catch (er) {
+      throw error("invalid file:// specifier", {
+        spec,
+        cause: er
+      });
+    }
+  }
+  if (opts?.winPath.isAbsolute(rest)) {
+    return [rest, `file://${rest}`];
+  }
+  return [`./${rest}`, `file:./${rest}`];
+};
+
+// ../../src/types/src/index.ts
+import { posix } from "node:path";
+import { debuglog } from "node:util";
+var debug = debuglog("vlt");
+var unixify = (ref) => ref.replace(/[\\:]/g, "/");
+var secure = (ref) => {
+  const s = unixify(posix.join(".", posix.join("/", unixify(ref))));
+  return s === "./" ? "" : s;
+};
+var secureBinPaths = (bin) => {
+  const res = {};
+  for (const [key, val] of Object.entries(bin)) {
+    const v2 = typeof val === "string" ? secure(val) : "";
+    const k3 = posix.basename(secure(key));
+    if (!k3 || !v2) {
+      debug("dropped unusable bin entry", key, val);
+      continue;
+    }
+    if (k3 !== key || v2 !== val) {
+      debug("rewrote unsafe bin entry", key, val, "->", k3, v2);
+    }
+    res[k3] = v2;
+  }
+  return res;
+};
+var normalizeBinPaths = (manifest) => {
+  const { name: name2, bin } = manifest;
+  if (bin) {
+    if (name2 && typeof bin === "string") {
+      const [_scope, pkg] = parseScope(name2);
+      return secureBinPaths({ [pkg]: bin });
+    } else if (typeof bin === "object") {
+      return secureBinPaths(bin);
+    }
+  }
+};
+var integrityRE = /^sha512-[a-zA-Z0-9/+]{86}==$/;
+var isIntegrity = (i) => typeof i === "string" && integrityRE.test(i);
+var integrityHex = (i) => isIntegrity(i) ? Buffer.from(i.slice(7), "base64").toString("hex") : void 0;
+var BROTLI_TARBALL_EXT = ".tar.br";
+var tarballFormat = (url) => {
+  const end = /[?#]/.exec(url)?.index ?? url.length;
+  return url.endsWith(BROTLI_TARBALL_EXT, end) ? "brotli" : void 0;
+};
+var asError = (er, fallbackMessage = "Unknown error") => er instanceof Error ? er : new Error(String(er) || fallbackMessage);
+var isObject = (v2) => !!v2 && typeof v2 === "object" && (v2.constructor === Object || v2.constructor === void 0);
+var maybeRecordStringString = (o) => o === void 0 || isRecordStringString(o);
+var isRecordStringString = (o) => isRecordStringT(o, (s) => typeof s === "string");
+var isRecordStringT = (o, check) => isObject(o) && Object.entries(o).every(
+  ([k3, v2]) => typeof k3 === "string" && check(v2)
+);
+var maybePeerDependenciesMetaSet = (o) => o === void 0 || isRecordStringT(
+  o,
+  (v2) => isPeerDependenciesMetaValue(v2)
+);
+var maybeBoolean = (o) => o === void 0 || typeof o === "boolean";
+var isPeerDependenciesMetaValue = (o) => isObject(o) && maybeBoolean(o.optional);
+var maybeString = (a) => a === void 0 || typeof a === "string";
+var maybeDist = (a) => a === void 0 || isObject(a) && maybeString(a.tarball);
+var isManifest = (m) => isObject(m) && !Array.isArray(m) && maybeString(m.name) && maybeString(m.version) && maybeRecordStringString(m.dependencies) && maybeRecordStringString(m.devDependencies) && maybeRecordStringString(m.optionalDependencies) && maybeRecordStringString(m.peerDependencies) && maybeRecordStringString(m.acceptDependencies) && maybePeerDependenciesMetaSet(m.peerDependenciesMeta) && maybeDist(m.dist);
+var parseScope = (scoped) => {
+  if (scoped.startsWith("@")) {
+    const [scope, name2, ...rest] = scoped.split("/");
+    if (scope && name2 && rest.length === 0) return [scope, name2];
+  }
+  return [void 0, scoped];
+};
 
 // ../../src/cache/src/index.ts
 import { createHash, randomBytes } from "node:crypto";
@@ -624,7 +2394,7 @@ import { resolve as resolve6, dirname } from "node:path";
 
 // ../../node_modules/.vlt/~npm~glob@13.0.6/node_modules/glob/dist/esm/index.min.js
 import { fileURLToPath as Wi } from "node:url";
-import { posix as mi, win32 as re } from "node:path";
+import { posix as mi, win32 as re2 } from "node:path";
 import { fileURLToPath as gi } from "node:url";
 import { lstatSync as wi, readdir as yi, readdirSync as bi, readlinkSync as Si, realpathSync as Ei } from "node:fs";
 import * as xi from "node:fs";
@@ -2748,7 +4518,7 @@ var Pt = class n2 extends R2 {
     return new n2(t, e, this.root, this.roots, this.nocase, this.childrenCache(), s);
   }
   getRootString(t) {
-    return re.parse(t).root;
+    return re2.parse(t).root;
   }
   getRoot(t) {
     if (t = Ri(t.toUpperCase()), t === this.root.name) return this.root;
@@ -3020,11 +4790,11 @@ var it = class extends It {
   sep = "\\";
   constructor(t = process.cwd(), e = {}) {
     let { nocase: s = true } = e;
-    super(t, re, "\\", { ...e, nocase: s }), this.nocase = s;
+    super(t, re2, "\\", { ...e, nocase: s }), this.nocase = s;
     for (let i = this.cwd; i; i = i.parent) i.nocase = this.nocase;
   }
   parseRootPath(t) {
-    return re.parse(t).root.toUpperCase();
+    return re2.parse(t).root.toUpperCase();
   }
   newRoot(t) {
     return new Pt(this.rootPath, U2, void 0, this.roots, this.nocase, this.childrenCache(), { fs: t });
@@ -3916,10 +5686,10 @@ var isDirSync = (path) => {
 var isDir = (path) => stat(path).then((st2) => st2.isDirectory(), () => false);
 var win32DefaultTmp = async (path) => {
   const { root } = parse3(path);
-  const tmp = tmpdir();
-  const { root: tmpRoot } = parse3(tmp);
+  const tmp2 = tmpdir();
+  const { root: tmpRoot } = parse3(tmp2);
   if (root.toLowerCase() === tmpRoot.toLowerCase()) {
-    return tmp;
+    return tmp2;
   }
   const driveTmp = resolve3(root, "/temp");
   if (await isDir(driveTmp)) {
@@ -3929,10 +5699,10 @@ var win32DefaultTmp = async (path) => {
 };
 var win32DefaultTmpSync = (path) => {
   const { root } = parse3(path);
-  const tmp = tmpdir();
-  const { root: tmpRoot } = parse3(tmp);
+  const tmp2 = tmpdir();
+  const { root: tmpRoot } = parse3(tmp2);
   if (root.toLowerCase() === tmpRoot.toLowerCase()) {
-    return tmp;
+    return tmp2;
   }
   const driveTmp = resolve3(root, "/temp");
   if (isDirSync(driveTmp)) {
@@ -3991,10 +5761,10 @@ var rimrafMoveRemoveDir = async (path, opt, ent) => {
   await ignoreENOENT(tmpUnlink(path, opt.tmp, rmdir2));
   return true;
 };
-var tmpUnlink = async (path, tmp, rm2) => {
-  const tmpFile = resolve4(tmp, uniqueFilename(path));
+var tmpUnlink = async (path, tmp2, rm3) => {
+  const tmpFile = resolve4(tmp2, uniqueFilename(path));
   await rename(path, tmpFile);
-  return await rm2(tmpFile);
+  return await rm3(tmpFile);
 };
 var rimrafMoveRemoveSync = (path, opt) => {
   opt?.signal?.throwIfAborted();
@@ -4005,7 +5775,7 @@ var rimrafMoveRemoveDirSync = (path, opt, ent) => {
   if (!opt.tmp) {
     return rimrafMoveRemoveDirSync(path, { ...opt, tmp: defaultTmpSync(path) }, ent);
   }
-  const tmp = opt.tmp;
+  const tmp2 = opt.tmp;
   if (path === opt.tmp && parse4(path).root !== path) {
     throw new Error("cannot delete temp directory used for deletion");
   }
@@ -4022,7 +5792,7 @@ var rimrafMoveRemoveDirSync = (path, opt, ent) => {
     if (opt.filter && !opt.filter(path, ent)) {
       return false;
     }
-    ignoreENOENTSync(() => tmpUnlinkSync(path, tmp, unlinkFixEPERMSync));
+    ignoreENOENTSync(() => tmpUnlinkSync(path, tmp2, unlinkFixEPERMSync));
     return true;
   }
   let removedAll = true;
@@ -4039,13 +5809,13 @@ var rimrafMoveRemoveDirSync = (path, opt, ent) => {
   if (opt.filter && !opt.filter(path, ent)) {
     return false;
   }
-  ignoreENOENTSync(() => tmpUnlinkSync(path, tmp, rmdirSync));
+  ignoreENOENTSync(() => tmpUnlinkSync(path, tmp2, rmdirSync));
   return true;
 };
-var tmpUnlinkSync = (path, tmp, rmSync2) => {
-  const tmpFile = resolve4(tmp, uniqueFilename(path));
+var tmpUnlinkSync = (path, tmp2, rmSync3) => {
+  const tmpFile = resolve4(tmp2, uniqueFilename(path));
   renameSync(path, tmpFile);
-  return rmSync2(tmpFile);
+  return rmSync3(tmpFile);
 };
 
 // ../../node_modules/.vlt/~npm~rimraf@6.1.3/node_modules/rimraf/dist/esm/rimraf-windows.js
@@ -4230,7 +6000,7 @@ var windows = Object.assign(wrap(rimrafWindows), {
   sync: windowsSync
 });
 var posixSync = wrapSync(rimrafPosixSync);
-var posix = Object.assign(wrap(rimrafPosix), { sync: posixSync });
+var posix2 = Object.assign(wrap(rimrafPosix), { sync: posixSync });
 var moveRemoveSync = wrapSync(rimrafMoveRemoveSync);
 var moveRemove = Object.assign(wrap(rimrafMoveRemove), {
   sync: moveRemoveSync
@@ -4245,7 +6015,7 @@ var rimraf = Object.assign(rimraf_, {
   manualSync,
   native,
   nativeSync,
-  posix,
+  posix: posix2,
   posixSync,
   windows,
   windowsSync,
@@ -4269,6 +6039,7 @@ var Cache = class _Cache extends I {
   #pending = /* @__PURE__ */ new Set();
   onDiskWrite;
   onDiskDelete;
+  store;
   /**
    * A list of the actions currently happening in the background
    */
@@ -4287,6 +6058,7 @@ var Cache = class _Cache extends I {
       onDiskWrite,
       onDiskDelete,
       path,
+      store,
       fetchMethod: _2,
       sizeCalculation = options.maxSize || options.maxEntrySize ? (v2, k3) => v2.length + k3.length : void 0,
       ...lruOpts
@@ -4310,6 +6082,7 @@ var Cache = class _Cache extends I {
     });
     this.onDiskWrite = onDiskWrite;
     this.onDiskDelete = onDiskDelete;
+    this.store = store;
     this.#path = path;
   }
   /**
@@ -4435,16 +6208,14 @@ var Cache = class _Cache extends I {
    */
   integrityPath(integrity) {
     if (!integrity) return void 0;
-    const m = /^sha512-([a-zA-Z0-9/+]{86}==)$/.exec(integrity);
-    const hash2 = m?.[1];
-    if (!hash2) {
+    const hex = integrityHex(integrity);
+    if (!hex) {
       throw error("invalid integrity value", {
         found: integrity,
-        wanted: /^sha512-([a-zA-Z0-9/+]{86}==)$/
+        wanted: integrityRE
       });
     }
-    const base = Buffer.from(hash2, "base64").toString("hex");
-    return resolve6(this.#path, base);
+    return resolve6(this.#path, hex);
   }
   /**
    * Read synchronously from the fs cache storage if not already
@@ -4471,13 +6242,20 @@ var Cache = class _Cache extends I {
   }
   /* c8 ignore stop */
   /**
-   * Delete path and path + '.key'
+   * Delete path and path + '.key', and with an integrity, its
+   * integrity link and global store entry
    */
   async #diskDelete(path, integrity) {
-    const intPath = this.#maybeIntegrityPath(integrity);
     const paths = [path, path + ".key"];
-    if (intPath) paths.push(intPath);
-    return await rimraf(paths);
+    const hex = integrityHex(integrity);
+    if (hex) paths.push(resolve6(this.#path, hex));
+    const deleted = await rimraf(paths);
+    if (hex && this.store) {
+      const entry = resolve6(this.store, hex);
+      await rimraf(entry);
+      await rimraf([entry + ".json", entry + ".copied"]);
+    }
+    return deleted;
   }
   #maybeIntegrityPath(i) {
     try {
@@ -4486,14 +6264,14 @@ var Cache = class _Cache extends I {
     }
   }
   async #writeFileAtomic(file, data) {
-    const tmp = `${file}.${this.#random}.${this.#i++}`;
-    await writeFile(tmp, data);
-    await rename2(tmp, file);
+    const tmp2 = `${file}.${this.#random}.${this.#i++}`;
+    await writeFile(tmp2, data);
+    await rename2(tmp2, file);
   }
   async #linkAtomic(src, dest) {
-    const tmp = `${dest}.${this.#random}.${this.#i++}`;
-    await link(src, tmp);
-    await rename2(tmp, dest);
+    const tmp2 = `${dest}.${this.#random}.${this.#i++}`;
+    await link(src, tmp2);
+    await rename2(tmp2, dest);
   }
   async #diskWrite(valFile, key, val, integrity) {
     const dir = dirname(valFile);
@@ -4543,9 +6321,600 @@ var Cache = class _Cache extends I {
 };
 
 // ../../src/cache-unzip/src/unzip.ts
+import { setPriority } from "node:os";
 import { pathToFileURL } from "node:url";
+import { debuglog as debuglog4 } from "node:util";
 import { gunzipSync } from "node:zlib";
-var __CODE_SPLIT_SCRIPT_NAME = import.meta.filename;
+
+// ../../src/tar/src/store-index.ts
+import { readFileSync as readFileSync2 } from "node:fs";
+import { debuglog as debuglog2 } from "node:util";
+var debug2 = debuglog2("vlt");
+var storeIndexPath = (storeEntry) => storeEntry + ".json";
+var isRecord2 = (x3) => !!x3 && typeof x3 === "object" && !Array.isArray(x3);
+var isOptString = (x3) => x3 === void 0 || typeof x3 === "string";
+var unsafePath = /(?:^|\/)\.{0,2}(?:\/|$)|\\/;
+var isRelPath = (p) => typeof p === "string" && !unsafePath.test(p);
+var isIndexFile = (f) => Array.isArray(f) && f.length === 3 && isRelPath(f[0]) && typeof f[1] === "number" && (f[2] === 0 || f[2] === 1);
+var isStoreIndex = (x3) => isRecord2(x3) && x3.v === 1 && typeof x3.scripts === "boolean" && isOptString(x3.name) && isOptString(x3.version) && (x3.bins === void 0 || isRecord2(x3.bins) && Object.values(x3.bins).every((b) => typeof b === "string")) && Array.isArray(x3.dirs) && x3.dirs.every(isRelPath) && Array.isArray(x3.files) && x3.files.every(isIndexFile) && isOptString(x3.manifest);
+var readStoreIndex = (storeEntry) => {
+  let index;
+  try {
+    index = JSON.parse(
+      readFileSync2(storeIndexPath(storeEntry), "utf8")
+    );
+  } catch (er) {
+    if (er.code !== "ENOENT") {
+      debug2("global store: invalid index", storeEntry);
+    }
+    return void 0;
+  }
+  if (isStoreIndex(index)) return index;
+  debug2("global store: invalid index", storeEntry);
+  return void 0;
+};
+var storeIndexManifest = (packageJson, bindingGyp) => {
+  let pkg;
+  try {
+    pkg = JSON.parse(
+      packageJson.toString("utf8").replace(/^\uFEFF/, "")
+    );
+  } catch (cause) {
+    throw error("invalid package.json in tarball", { cause });
+  }
+  if (!isRecord2(pkg)) {
+    throw error("invalid package.json in tarball", { found: pkg });
+  }
+  const { name: name2, version, scripts, bin } = pkg;
+  const s = isRecord2(scripts) ? scripts : {};
+  const result = {
+    scripts: !!(s.install || s.preinstall || s.postinstall) || bindingGyp
+  };
+  const bins = normalizeBinPaths({
+    name: typeof name2 === "string" ? name2 : void 0,
+    bin
+  });
+  if (bins && Object.keys(bins).length) result.bins = bins;
+  if (typeof name2 === "string") result.name = name2;
+  if (typeof version === "string") result.version = version;
+  if (isManifest(pkg)) result.manifest = JSON.stringify(pkg);
+  return result;
+};
+
+// ../../src/tar/src/unpack.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import {
+  chmodSync as chmodSync2,
+  lstatSync as lstatSync2,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync3,
+  renameSync as renameSync2,
+  statSync as statSync2,
+  writeFileSync
+} from "node:fs";
+import {
+  basename as basename3,
+  dirname as dirname2,
+  isAbsolute,
+  join,
+  relative,
+  resolve as resolve7,
+  sep
+} from "node:path";
+
+// ../../node_modules/.vlt/~npm~tar@7.5.22/node_modules/tar/dist/esm/header.js
+import { posix as pathModule } from "node:path";
+
+// ../../node_modules/.vlt/~npm~tar@7.5.22/node_modules/tar/dist/esm/large-numbers.js
+var encode = (num, buf) => {
+  if (!Number.isSafeInteger(num)) {
+    throw Error("cannot encode number outside of javascript safe integer range");
+  } else if (num < 0) {
+    encodeNegative(num, buf);
+  } else {
+    encodePositive(num, buf);
+  }
+  return buf;
+};
+var encodePositive = (num, buf) => {
+  buf[0] = 128;
+  for (var i = buf.length; i > 1; i--) {
+    buf[i - 1] = num & 255;
+    num = Math.floor(num / 256);
+  }
+};
+var encodeNegative = (num, buf) => {
+  buf[0] = 255;
+  var flipped = false;
+  num = num * -1;
+  for (var i = buf.length; i > 1; i--) {
+    var byte = num & 255;
+    num = Math.floor(num / 256);
+    if (flipped) {
+      buf[i - 1] = onesComp(byte);
+    } else if (byte === 0) {
+      buf[i - 1] = 0;
+    } else {
+      flipped = true;
+      buf[i - 1] = twosComp(byte);
+    }
+  }
+};
+var parse6 = (buf) => {
+  const pre = buf[0];
+  const value = pre === 128 ? pos(buf.subarray(1, buf.length)) : pre === 255 ? twos(buf) : null;
+  if (value === null) {
+    throw Error("invalid base256 encoding");
+  }
+  if (!Number.isSafeInteger(value)) {
+    throw Error("parsed number outside of javascript safe integer range");
+  }
+  return value;
+};
+var twos = (buf) => {
+  var len = buf.length;
+  var sum = 0;
+  var flipped = false;
+  for (var i = len - 1; i > -1; i--) {
+    var byte = Number(buf[i]);
+    var f;
+    if (flipped) {
+      f = onesComp(byte);
+    } else if (byte === 0) {
+      f = byte;
+    } else {
+      flipped = true;
+      f = twosComp(byte);
+    }
+    if (f !== 0) {
+      sum -= f * Math.pow(256, len - i - 1);
+    }
+  }
+  return sum;
+};
+var pos = (buf) => {
+  var len = buf.length;
+  var sum = 0;
+  for (var i = len - 1; i > -1; i--) {
+    var byte = Number(buf[i]);
+    if (byte !== 0) {
+      sum += byte * Math.pow(256, len - i - 1);
+    }
+  }
+  return sum;
+};
+var onesComp = (byte) => (255 ^ byte) & 255;
+var twosComp = (byte) => (255 ^ byte) + 1 & 255;
+
+// ../../node_modules/.vlt/~npm~tar@7.5.22/node_modules/tar/dist/esm/types.js
+var isCode = (c) => name.has(c);
+var normalFsTypes = /* @__PURE__ */ new Set([
+  "0",
+  "",
+  "1",
+  "2",
+  "3",
+  "4",
+  "5",
+  "6",
+  "7",
+  "D"
+]);
+var name = /* @__PURE__ */ new Map([
+  ["0", "File"],
+  // same as File
+  ["", "OldFile"],
+  ["1", "Link"],
+  ["2", "SymbolicLink"],
+  // Devices and FIFOs aren't fully supported
+  // they are parsed, but skipped when unpacking
+  ["3", "CharacterDevice"],
+  ["4", "BlockDevice"],
+  ["5", "Directory"],
+  ["6", "FIFO"],
+  // same as File
+  ["7", "ContiguousFile"],
+  // pax headers
+  ["g", "GlobalExtendedHeader"],
+  ["x", "ExtendedHeader"],
+  // vendor-specific stuff
+  // skip
+  ["A", "SolarisACL"],
+  // like 5, but with data, which should be skipped
+  ["D", "GNUDumpDir"],
+  // metadata only, skip
+  ["I", "Inode"],
+  // data = link path of next file
+  ["K", "NextFileHasLongLinkpath"],
+  // data = path of next file
+  ["L", "NextFileHasLongPath"],
+  // skip
+  ["M", "ContinuationFile"],
+  // like L
+  ["N", "OldGnuLongPath"],
+  // skip
+  ["S", "SparseFile"],
+  // skip
+  ["V", "TapeVolumeHeader"],
+  // like x
+  ["X", "OldExtendedHeader"]
+]);
+var code = new Map(Array.from(name).map((kv) => [kv[1], kv[0]]));
+
+// ../../node_modules/.vlt/~npm~tar@7.5.22/node_modules/tar/dist/esm/header.js
+var notNegative = (n7) => n7 === void 0 || n7 < 0 ? void 0 : n7;
+var Header = class {
+  cksumValid = false;
+  needPax = false;
+  nullBlock = false;
+  block;
+  path;
+  mode;
+  uid;
+  gid;
+  size;
+  cksum;
+  #type = "Unsupported";
+  linkpath;
+  uname;
+  gname;
+  devmaj = 0;
+  devmin = 0;
+  atime;
+  ctime;
+  mtime;
+  charset;
+  comment;
+  constructor(data, off = 0, ex, gex) {
+    if (Buffer.isBuffer(data)) {
+      this.decode(data, off || 0, ex, gex);
+    } else if (data) {
+      this.#slurp(data);
+    }
+  }
+  decode(buf, off, ex, gex) {
+    if (!off) {
+      off = 0;
+    }
+    if (!buf || !(buf.length >= off + 512)) {
+      throw new Error("need 512 bytes for header");
+    }
+    const t = decString(buf, off + 156, 1);
+    const isNormalFS = normalFsTypes.has(t);
+    const exForFields = isNormalFS ? ex : void 0;
+    const gexForFields = isNormalFS ? gex : void 0;
+    this.path = exForFields?.path ?? decString(buf, off, 100);
+    this.mode = exForFields?.mode ?? gexForFields?.mode ?? decNumber(buf, off + 100, 8);
+    this.uid = exForFields?.uid ?? gexForFields?.uid ?? decNumber(buf, off + 108, 8);
+    this.gid = exForFields?.gid ?? gexForFields?.gid ?? decNumber(buf, off + 116, 8);
+    this.size = notNegative(exForFields?.size ?? gexForFields?.size ?? decNumber(buf, off + 124, 12));
+    this.mtime = exForFields?.mtime ?? gexForFields?.mtime ?? decDate(buf, off + 136, 12);
+    this.cksum = decNumber(buf, off + 148, 12);
+    if (gexForFields)
+      this.#slurp(gexForFields, true);
+    if (exForFields)
+      this.#slurp(exForFields);
+    if (isCode(t)) {
+      this.#type = t || "0";
+    }
+    if (this.#type === "0" && this.path.slice(-1) === "/") {
+      this.#type = "5";
+    }
+    if (this.#type === "5") {
+      this.size = 0;
+    }
+    this.linkpath = decString(buf, off + 157, 100);
+    if (buf.subarray(off + 257, off + 265).toString() === "ustar\x0000") {
+      this.uname = exForFields?.uname ?? gexForFields?.uname ?? decString(buf, off + 265, 32);
+      this.gname = exForFields?.gname ?? gexForFields?.gname ?? decString(buf, off + 297, 32);
+      this.devmaj = exForFields?.devmaj ?? gexForFields?.devmaj ?? decNumber(buf, off + 329, 8) ?? 0;
+      this.devmin = exForFields?.devmin ?? gexForFields?.devmin ?? decNumber(buf, off + 337, 8) ?? 0;
+      if (buf[off + 475] !== 0) {
+        const prefix = decString(buf, off + 345, 155);
+        this.path = prefix + "/" + this.path;
+      } else {
+        const prefix = decString(buf, off + 345, 130);
+        if (prefix) {
+          this.path = prefix + "/" + this.path;
+        }
+        this.atime = ex?.atime ?? gex?.atime ?? decDate(buf, off + 476, 12);
+        this.ctime = ex?.ctime ?? gex?.ctime ?? decDate(buf, off + 488, 12);
+      }
+    }
+    let sum = 8 * 32;
+    for (let i = off; i < off + 148; i++) {
+      sum += buf[i];
+    }
+    for (let i = off + 156; i < off + 512; i++) {
+      sum += buf[i];
+    }
+    this.cksumValid = sum === this.cksum;
+    if (this.cksum === void 0 && sum === 8 * 32) {
+      this.nullBlock = true;
+    }
+  }
+  #slurp(ex, gex = false) {
+    Object.assign(this, Object.fromEntries(Object.entries(ex).filter(([k3, v2]) => {
+      return !(v2 === null || v2 === void 0 || k3 === "size" && Number(v2) < 0 || k3 === "path" && gex || k3 === "linkpath" && gex || k3 === "global");
+    })));
+  }
+  encode(buf, off = 0) {
+    if (!buf) {
+      buf = this.block = Buffer.alloc(512);
+    }
+    if (this.#type === "Unsupported") {
+      this.#type = "0";
+    }
+    if (!(buf.length >= off + 512)) {
+      throw new Error("need 512 bytes for header");
+    }
+    const prefixSize = this.ctime || this.atime ? 130 : 155;
+    const split = splitPrefix(this.path || "", prefixSize);
+    const path = split[0];
+    const prefix = split[1];
+    this.needPax = !!split[2];
+    this.needPax = encString(buf, off, 100, path) || this.needPax;
+    this.needPax = encNumber(buf, off + 100, 8, this.mode) || this.needPax;
+    this.needPax = encNumber(buf, off + 108, 8, this.uid) || this.needPax;
+    this.needPax = encNumber(buf, off + 116, 8, this.gid) || this.needPax;
+    this.needPax = encNumber(buf, off + 124, 12, this.size) || this.needPax;
+    this.needPax = encDate(buf, off + 136, 12, this.mtime) || this.needPax;
+    buf[off + 156] = Number(this.#type.codePointAt(0));
+    this.needPax = encString(buf, off + 157, 100, this.linkpath) || this.needPax;
+    buf.write("ustar\x0000", off + 257, 8);
+    this.needPax = encString(buf, off + 265, 32, this.uname) || this.needPax;
+    this.needPax = encString(buf, off + 297, 32, this.gname) || this.needPax;
+    this.needPax = encNumber(buf, off + 329, 8, this.devmaj) || this.needPax;
+    this.needPax = encNumber(buf, off + 337, 8, this.devmin) || this.needPax;
+    this.needPax = encString(buf, off + 345, prefixSize, prefix) || this.needPax;
+    if (buf[off + 475] !== 0) {
+      this.needPax = encString(buf, off + 345, 155, prefix) || this.needPax;
+    } else {
+      this.needPax = encString(buf, off + 345, 130, prefix) || this.needPax;
+      this.needPax = encDate(buf, off + 476, 12, this.atime) || this.needPax;
+      this.needPax = encDate(buf, off + 488, 12, this.ctime) || this.needPax;
+    }
+    let sum = 8 * 32;
+    for (let i = off; i < off + 148; i++) {
+      sum += buf[i];
+    }
+    for (let i = off + 156; i < off + 512; i++) {
+      sum += buf[i];
+    }
+    this.cksum = sum;
+    encNumber(buf, off + 148, 8, this.cksum);
+    this.cksumValid = true;
+    return this.needPax;
+  }
+  get type() {
+    return this.#type === "Unsupported" ? this.#type : name.get(this.#type);
+  }
+  get typeKey() {
+    return this.#type;
+  }
+  set type(type) {
+    const c = String(code.get(type));
+    if (isCode(c) || c === "Unsupported") {
+      this.#type = c;
+    } else if (isCode(type)) {
+      this.#type = type;
+    } else {
+      throw new TypeError("invalid entry type: " + type);
+    }
+  }
+};
+var splitPrefix = (p, prefixSize) => {
+  const pathSize = 100;
+  let pp = p;
+  let prefix = "";
+  let ret = void 0;
+  const root = pathModule.parse(p).root || ".";
+  if (Buffer.byteLength(pp) < pathSize) {
+    ret = [pp, prefix, false];
+  } else {
+    prefix = pathModule.dirname(pp);
+    pp = pathModule.basename(pp);
+    do {
+      if (Buffer.byteLength(pp) <= pathSize && Buffer.byteLength(prefix) <= prefixSize) {
+        ret = [pp, prefix, false];
+      } else if (Buffer.byteLength(pp) > pathSize && Buffer.byteLength(prefix) <= prefixSize) {
+        ret = [pp.slice(0, pathSize - 1), prefix, true];
+      } else {
+        pp = pathModule.join(pathModule.basename(prefix), pp);
+        prefix = pathModule.dirname(prefix);
+      }
+    } while (prefix !== root && ret === void 0);
+    if (!ret) {
+      ret = [p.slice(0, pathSize - 1), "", true];
+    }
+  }
+  return ret;
+};
+var decString = (buf, off, size) => buf.subarray(off, off + size).toString("utf8").replace(/\0.*/, "");
+var decDate = (buf, off, size) => numToDate(decNumber(buf, off, size));
+var numToDate = (num) => num === void 0 ? void 0 : new Date(num * 1e3);
+var decNumber = (buf, off, size) => Number(buf[off]) & 128 ? parse6(buf.subarray(off, off + size)) : decSmallNumber(buf, off, size);
+var nanUndef = (value) => isNaN(value) ? void 0 : value;
+var decSmallNumber = (buf, off, size) => nanUndef(parseInt(buf.subarray(off, off + size).toString("utf8").replace(/\0.*$/, "").trim(), 8));
+var MAXNUM = {
+  12: 8589934591,
+  8: 2097151
+};
+var encNumber = (buf, off, size, num) => num === void 0 ? false : num > MAXNUM[size] || num < 0 ? (encode(num, buf.subarray(off, off + size)), true) : (encSmallNumber(buf, off, size, num), false);
+var encSmallNumber = (buf, off, size, num) => buf.write(octalString(num, size), off, size, "ascii");
+var octalString = (num, size) => padOctal(Math.floor(num).toString(8), size);
+var padOctal = (str, size) => (str.length === size - 1 ? str : new Array(size - str.length - 1).join("0") + str + " ") + "\0";
+var encDate = (buf, off, size, date) => date === void 0 ? false : encNumber(buf, off, size, date.getTime() / 1e3);
+var NULLS = new Array(156).join("\0");
+var encString = (buf, off, size, str) => str === void 0 ? false : (buf.write(str + NULLS, off, size, "utf8"), str.length !== Buffer.byteLength(str) || str.length > size);
+
+// ../../node_modules/.vlt/~npm~tar@7.5.22/node_modules/tar/dist/esm/pax.js
+import { basename as basename2 } from "node:path";
+var Pax = class _Pax {
+  atime;
+  mtime;
+  ctime;
+  charset;
+  comment;
+  gid;
+  uid;
+  gname;
+  uname;
+  linkpath;
+  dev;
+  ino;
+  nlink;
+  path;
+  size;
+  mode;
+  global;
+  constructor(obj, global = false) {
+    this.atime = obj.atime;
+    this.charset = obj.charset;
+    this.comment = obj.comment;
+    this.ctime = obj.ctime;
+    this.dev = obj.dev;
+    this.gid = obj.gid;
+    this.global = global;
+    this.gname = obj.gname;
+    this.ino = obj.ino;
+    this.linkpath = obj.linkpath;
+    this.mtime = obj.mtime;
+    this.nlink = obj.nlink;
+    this.path = obj.path;
+    this.size = obj.size;
+    this.uid = obj.uid;
+    this.uname = obj.uname;
+  }
+  encode() {
+    const body = this.encodeBody();
+    if (body === "") {
+      return Buffer.allocUnsafe(0);
+    }
+    const bodyLen = Buffer.byteLength(body);
+    const bufLen = 512 * Math.ceil(1 + bodyLen / 512);
+    const buf = Buffer.allocUnsafe(bufLen);
+    for (let i = 0; i < 512; i++) {
+      buf[i] = 0;
+    }
+    new Header({
+      // XXX split the path
+      // then the path should be PaxHeader + basename, but less than 99,
+      // prepend with the dirname
+      /* c8 ignore start */
+      path: ("PaxHeader/" + basename2(this.path ?? "")).slice(0, 99),
+      /* c8 ignore stop */
+      mode: this.mode || 420,
+      uid: this.uid,
+      gid: this.gid,
+      size: bodyLen,
+      mtime: this.mtime,
+      type: this.global ? "GlobalExtendedHeader" : "ExtendedHeader",
+      linkpath: "",
+      uname: this.uname || "",
+      gname: this.gname || "",
+      devmaj: 0,
+      devmin: 0,
+      atime: this.atime,
+      ctime: this.ctime
+    }).encode(buf);
+    buf.write(body, 512, bodyLen, "utf8");
+    for (let i = bodyLen + 512; i < buf.length; i++) {
+      buf[i] = 0;
+    }
+    return buf;
+  }
+  encodeBody() {
+    return this.encodeField("path") + this.encodeField("ctime") + this.encodeField("atime") + this.encodeField("dev") + this.encodeField("ino") + this.encodeField("nlink") + this.encodeField("charset") + this.encodeField("comment") + this.encodeField("gid") + this.encodeField("gname") + this.encodeField("linkpath") + this.encodeField("mtime") + this.encodeField("size") + this.encodeField("uid") + this.encodeField("uname");
+  }
+  encodeField(field) {
+    if (this[field] === void 0) {
+      return "";
+    }
+    const r = this[field];
+    const v2 = r instanceof Date ? r.getTime() / 1e3 : r;
+    const s = " " + (field === "dev" || field === "ino" || field === "nlink" ? "SCHILY." : "") + field + "=" + v2 + "\n";
+    const byteLen = Buffer.byteLength(s);
+    let digits = Math.floor(Math.log(byteLen) / Math.log(10)) + 1;
+    if (byteLen + digits >= Math.pow(10, digits)) {
+      digits += 1;
+    }
+    const len = digits + byteLen;
+    return len + s;
+  }
+  static parse(str, ex, g = false) {
+    return new _Pax(merge(parseKV(str), ex), g);
+  }
+};
+var merge = (a, b) => b ? Object.assign({}, b, a) : a;
+var parseKV = (str) => str.replace(/\n$/, "").split("\n").reduce(parseKVLine, /* @__PURE__ */ Object.create(null));
+var parseKVLine = (set, line) => {
+  const n7 = parseInt(line, 10);
+  if (n7 !== Buffer.byteLength(line) + 1) {
+    return set;
+  }
+  line = line.slice((n7 + " ").length);
+  const kv = line.split("=");
+  const r = kv.shift();
+  if (!r) {
+    return set;
+  }
+  const k3 = r.replace(/^SCHILY\.(dev|ino|nlink)/, "$1");
+  const v2 = kv.join("=").replace(/\0.*/, "");
+  switch (k3) {
+    case "path":
+    case "linkpath":
+    case "type":
+    case "charset":
+    case "comment":
+    case "gname":
+    case "uname":
+      set[k3] = v2;
+      break;
+    case "ctime":
+    case "atime":
+    case "mtime":
+      set[k3] = new Date(Number(v2) * 1e3);
+      break;
+    case "size":
+      const s = +v2;
+      if (s >= 0)
+        set[k3] = s;
+      break;
+    case "gid":
+    case "uid":
+    case "dev":
+    case "ino":
+    case "nlink":
+    case "mode":
+      set[k3] = +v2;
+      break;
+  }
+  return set;
+};
+
+// ../../src/tar/src/unpack.ts
+import {
+  brotliDecompress as brotliCB,
+  brotliDecompressSync as brotliSyncCB,
+  unzip as unzipCB,
+  unzipSync as unzipSyncCB
+} from "node:zlib";
+
+// ../../src/tar/src/find-tar-dir.ts
+var findTarDir = (path, tarDir) => {
+  if (tarDir !== void 0) return tarDir;
+  if (!path) return void 0;
+  const i = path.indexOf("/", path.startsWith("./") ? 2 : 0);
+  if (i === -1) return void 0;
+  const chomp = path.substring(0, i);
+  if (chomp === "." || chomp === ".." || chomp === "" || chomp === "./." || chomp === "./.." || chomp === "./") {
+    return void 0;
+  }
+  return chomp + "/";
+};
+
+// ../../src/tar/src/unpack.ts
 var MAX_DECOMPRESSION_RATIO = 1e3;
 var defaultMaxUnpackedBytes = 2 * 1024 * 1024 * 1024;
 var parseMaxUnpackedBytes = (raw) => {
@@ -4555,12 +6924,405 @@ var parseMaxUnpackedBytes = (raw) => {
 var maxUnpackedBytes = parseMaxUnpackedBytes(
   process.env.VLT_TAR_MAX_UNPACKED_BYTES
 );
+var unzipMax = (len) => Math.min(maxUnpackedBytes, len * MAX_DECOMPRESSION_RATIO);
+var unzipError = (er, found, max) => er.code === "ERR_BUFFER_TOO_LARGE" ? error("tarball exceeds maximum unpacked size", {
+  found,
+  max,
+  cause: er
+}) : er;
+var unzipSync = (input) => {
+  const max = unzipMax(input.length);
+  try {
+    return unzipSyncCB(input, { maxOutputLength: max });
+  } catch (er) {
+    throw unzipError(er, input.length, max);
+  }
+};
+var isGzip = (b) => b[0] === 31 && b[1] === 139;
+var brotliSync = (input) => {
+  const max = unzipMax(input.length);
+  try {
+    return brotliSyncCB(input, { maxOutputLength: max });
+  } catch (er) {
+    throw unzipError(er, input.length, max);
+  }
+};
+var decompressSync = (input, format) => format === "brotli" ? brotliSync(input) : isGzip(input) ? unzipSync(input) : input;
+var tmp = randomBytes2(6).toString("hex") + ".";
+var foldKeys = process.platform === "darwin" || process.platform === "win32";
+var entryKey = (p) => foldKeys ? p.toLowerCase() : p;
+var parseWriteLanes = (raw) => {
+  const n7 = Number(raw);
+  return Number.isFinite(n7) && n7 >= 1 ? Math.floor(n7) : 64;
+};
+var writeLaneLimit = parseWriteLanes(
+  process.env.VLT_TAR_WRITE_LANES
+);
+var isClearlySafeRelPath = (sub) => {
+  const len = sub.length;
+  if (len === 0) return true;
+  if (sub.charCodeAt(0) === 47) return false;
+  if (len >= 2 && sub.charCodeAt(1) === 58) {
+    const c = sub.charCodeAt(0);
+    if (c >= 65 && c <= 90 || c >= 97 && c <= 122) {
+      return false;
+    }
+  }
+  let i = 0;
+  while (i < len) {
+    let j3 = i;
+    while (j3 < len && sub.charCodeAt(j3) !== 47) j3++;
+    const slen = j3 - i;
+    if (slen === 1 && sub.charCodeAt(i) === 46) return false;
+    if (slen === 2 && sub.charCodeAt(i) === 46 && sub.charCodeAt(i + 1) === 46) {
+      return false;
+    }
+    i = j3 + 1;
+  }
+  return true;
+};
+var checkFs = (h, tarDir, target) => {
+  if (!h.path) return false;
+  if (!tarDir) return false;
+  h.path = h.path.replace(/[\\/]+/g, "/");
+  if (!h.path.startsWith(tarDir)) return false;
+  const sub = h.path.slice(tarDir.length);
+  if (isClearlySafeRelPath(sub)) return true;
+  const rel = relative(target, resolve7(target, sub));
+  if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+    return false;
+  }
+  return true;
+};
+var parseTarball = (buffer, tmp2) => {
+  if (isGzip(buffer)) {
+    throw error("still gzipped after unzipping", {
+      found: true,
+      wanted: false
+    });
+  }
+  if (buffer.length % 512 !== 0) {
+    throw error("Invalid tarball: length not divisible by 512", {
+      found: buffer.length
+    });
+  }
+  if (buffer.length < 1024) {
+    throw error(
+      "Invalid tarball: not terminated by 1024 null bytes",
+      {
+        found: buffer.length
+      }
+    );
+  }
+  for (let i = buffer.length - 1024; i < buffer.length; i++) {
+    if (buffer[i] !== 0) {
+      throw error(
+        "Invalid tarball: not terminated by 1024 null bytes",
+        { found: buffer.subarray(i, i + 10) }
+      );
+    }
+  }
+  const entries = /* @__PURE__ */ new Map();
+  let tarDir = void 0;
+  let offset = 0;
+  let h;
+  let ex = void 0;
+  let gex = void 0;
+  while (offset < buffer.length && !(h = new Header(buffer, offset, ex, gex)).nullBlock) {
+    offset += 512;
+    ex = void 0;
+    gex = void 0;
+    const size = h.size ?? 0;
+    const body = buffer.subarray(offset, offset + size);
+    if (!h.cksumValid) continue;
+    offset += 512 * Math.ceil(size / 512);
+    switch (h.type) {
+      case "File":
+        if (!tarDir) tarDir = findTarDir(h.path, tarDir);
+        if (!tarDir) continue;
+        if (!checkFs(h, tarDir, tmp2)) continue;
+        {
+          const dest = resolve7(tmp2, h.path.substring(tarDir.length));
+          const key = entryKey(dest);
+          if (entries.get(key)?.dir === true) {
+            throw error("file/directory collision in tarball", {
+              path: dest
+            });
+          }
+          entries.set(key, {
+            path: dest,
+            body,
+            executable: 1 === ((h.mode ?? 1638) & 1),
+            dir: false
+          });
+        }
+        break;
+      case "Directory":
+        if (!tarDir) tarDir = findTarDir(h.path, tarDir);
+        if (!tarDir) continue;
+        if (!checkFs(h, tarDir, tmp2)) continue;
+        {
+          const dest = resolve7(tmp2, h.path.substring(tarDir.length));
+          const key = entryKey(dest);
+          if (entries.get(key)?.dir === false) {
+            throw error("file/directory collision in tarball", {
+              path: dest
+            });
+          }
+          entries.set(key, {
+            path: dest,
+            dir: true
+          });
+        }
+        break;
+      case "GlobalExtendedHeader":
+        gex = Pax.parse(body.toString(), gex, true);
+        break;
+      case "ExtendedHeader":
+      case "OldExtendedHeader":
+        ex = Pax.parse(body.toString(), ex, false);
+        break;
+      case "NextFileHasLongPath":
+      case "OldGnuLongPath":
+        ex ??= /* @__PURE__ */ Object.create(null);
+        ex.path = body.toString().replace(/\0.*/, "");
+        break;
+    }
+  }
+  const dirs = /* @__PURE__ */ new Set();
+  const files = [];
+  for (const e of entries.values()) {
+    if (e.dir) dirs.add(e.path);
+    else {
+      dirs.add(dirname2(e.path));
+      files.push(e);
+    }
+  }
+  return { dirs, files };
+};
+var storeLayout = (tarData, dir, format) => {
+  const { dirs, files } = parseTarball(
+    decompressSync(tarData, format),
+    dir
+  );
+  const rel = (p) => relative(dir, p).replace(/\\/g, "/");
+  const list = files.map((f) => [rel(f.path), f]);
+  const pj = list.find(([p]) => p === "package.json")?.[1];
+  if (!pj) throw error("no package.json in tarball", { path: dir });
+  const manifest = storeIndexManifest(
+    pj.body,
+    list.some(([p]) => p === "binding.gyp")
+  );
+  const bins = new Set(
+    Object.values(manifest.bins ?? {}).map(entryKey)
+  );
+  const indexFiles = [];
+  const binFiles = [];
+  for (const [p, f] of list) {
+    if (bins.has(entryKey(p))) {
+      f.executable = true;
+      binFiles.push(f.path);
+    }
+    indexFiles.push([p, f.body.length, f.executable ? 1 : 0]);
+  }
+  const allDirs = /* @__PURE__ */ new Set();
+  for (const d3 of dirs) {
+    for (let p = rel(d3); p && !allDirs.has(p); ) {
+      allDirs.add(p);
+      p = p.slice(0, Math.max(0, p.lastIndexOf("/")));
+    }
+  }
+  const indexDirs = [...allDirs].sort().sort((a, b) => a.length - b.length);
+  return {
+    index: {
+      v: 1,
+      files: indexFiles.sort((a, b) => a[0] < b[0] ? -1 : 1),
+      dirs: indexDirs,
+      ...manifest
+    },
+    files,
+    binFiles
+  };
+};
+var unpackToStoreSync = (tarData, dir, format) => {
+  const { index, files, binFiles } = storeLayout(tarData, dir, format);
+  mkdirSync2(dirname2(dir), { recursive: true });
+  mkdirSync2(dir, { mode: 511 });
+  let succeeded = false;
+  try {
+    for (const d3 of index.dirs) {
+      mkdirSync2(join(dir, d3), { recursive: true, mode: 511 });
+    }
+    for (const f of files) {
+      writeFileSync(f.path, f.body, {
+        mode: f.executable ? 511 : 438
+      });
+    }
+    let binMode = 0;
+    for (const p of binFiles) {
+      binMode ||= statSync2(p).mode & 511 | 73;
+      chmodSync2(p, binMode);
+    }
+    succeeded = true;
+  } finally {
+    if (!succeeded) rimrafSync(dir);
+  }
+  return { index };
+};
+
+// ../../src/cache-unzip/src/explode.ts
+import {
+  lstatSync as lstatSync3,
+  readdirSync as readdirSync2,
+  renameSync as renameSync3,
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import { join as join2 } from "node:path";
+import { performance as performance2 } from "node:perf_hooks";
+import { debuglog as debuglog3 } from "node:util";
+var debug3 = debuglog3("vlt");
+var linkers = /* @__PURE__ */ new Set(["auto", "hardlink", "copy"]);
+var storeEnabled = () => linkers.has(process.env.VLT_STORE_LINKER ?? "");
+var STALE_MS = 60 * 60 * 1e3;
+var parseConcurrency = (raw) => {
+  const n7 = Number(raw);
+  return Number.isFinite(n7) && n7 >= 1 ? Math.floor(n7) : 1;
+};
+var rm2 = (path) => rmSync2(path, { recursive: true, force: true });
+var entryIntegrity = (buf) => {
+  const headSize = buf.readUInt32BE(0);
+  let key;
+  for (let i = 7, size = 4; i + 4 <= headSize; i += size) {
+    size = Math.max(4, buf.readUInt32BE(i));
+    const h = buf.toString("utf8", i + 4, i + size);
+    if (key === void 0) key = h.toLowerCase();
+    else if (key === "integrity") return h;
+    else key = void 0;
+  }
+};
+var sweep = (tmp2) => {
+  let names;
+  try {
+    names = readdirSync2(tmp2);
+  } catch {
+    return;
+  }
+  const now = Date.now();
+  for (const name2 of names) {
+    const p = join2(tmp2, name2);
+    try {
+      if (now - lstatSync3(p).mtimeMs > STALE_MS) rm2(p);
+    } catch {
+    }
+  }
+};
+var seq = 0;
+var explodeEntry = (store, buf, format) => {
+  const hex = integrityHex(entryIntegrity(buf));
+  if (!hex) return "ignored";
+  const entry = join2(store, hex);
+  if (lstatSync3(entry, { throwIfNoEntry: false })) {
+    if (readStoreIndex(entry)) return "skipped";
+    rm2(entry);
+  }
+  const n7 = `${process.pid}.${seq++}`;
+  const tmp2 = join2(store, ".tmp", `${hex}.${n7}`);
+  const sideTmp = join2(store, ".tmp", `${hex}.json.${n7}`);
+  const { index } = unpackToStoreSync(
+    buf.subarray(buf.readUInt32BE(0)),
+    tmp2,
+    format
+  );
+  try {
+    writeFileSync2(sideTmp, JSON.stringify(index));
+    renameSync3(sideTmp, storeIndexPath(entry));
+    renameSync3(tmp2, entry);
+  } catch (er) {
+    rm2(tmp2);
+    rm2(sideTmp);
+    if (lstatSync3(entry, { throwIfNoEntry: false })) return "skipped";
+    throw er;
+  }
+  let bytes = 0;
+  for (const [, size] of index.files) bytes += size;
+  return bytes;
+};
+var explode = async (cache, store, keys, integrities) => {
+  if (!storeEnabled()) return;
+  const start = performance2.now();
+  const s = {
+    exploded: /* @__PURE__ */ new Set(),
+    written: 0,
+    skipped: 0,
+    ignored: 0,
+    failed: 0,
+    bytes: 0,
+    ms: 0
+  };
+  sweep(join2(store, ".tmp"));
+  let next = 0;
+  const lane = async () => {
+    for (; ; ) {
+      const key = keys[next++];
+      if (key === void 0) return;
+      const buf = await cache.fetch(key, {
+        context: { integrity: integrities?.get(key) }
+      });
+      cache.delete(key);
+      if (!buf) {
+        s.ignored++;
+        continue;
+      }
+      try {
+        const res = explodeEntry(store, buf, tarballFormat(key));
+        if (typeof res === "number") {
+          s.exploded.add(key);
+          s.written++;
+          s.bytes += res;
+        } else s[res]++;
+      } catch (er) {
+        s.failed++;
+        debug3("global store: explode failed", key, er);
+      }
+    }
+  };
+  const lanes = Math.min(
+    parseConcurrency(process.env.VLT_CACHE_EXPLODE_CONCURRENCY),
+    keys.length
+  );
+  await Promise.all(Array.from({ length: lanes }, lane));
+  s.ms = Math.round(performance2.now() - start);
+  debug3(
+    "global store: explode written=%d skipped=%d ignored=%d failed=%d bytes=%d ms=%d",
+    s.written,
+    s.skipped,
+    s.ignored,
+    s.failed,
+    s.bytes,
+    s.ms
+  );
+  return s;
+};
+
+// ../../src/cache-unzip/src/unzip.ts
+var __CODE_SPLIT_SCRIPT_NAME = import.meta.filename;
+var debug4 = debuglog4("vlt");
+var MAX_DECOMPRESSION_RATIO2 = 1e3;
+var defaultMaxUnpackedBytes2 = 2 * 1024 * 1024 * 1024;
+var parseMaxUnpackedBytes2 = (raw) => {
+  const n7 = Number(raw);
+  return Number.isFinite(n7) && n7 >= 1 ? Math.floor(n7) : defaultMaxUnpackedBytes2;
+};
+var maxUnpackedBytes2 = parseMaxUnpackedBytes2(
+  process.env.VLT_TAR_MAX_UNPACKED_BYTES
+);
 var isMain = (path) => path === __CODE_SPLIT_SCRIPT_NAME || path === pathToFileURL(__CODE_SPLIT_SCRIPT_NAME).toString();
-var main = async (path, input = process.stdin) => {
+var main = async (path, input = process.stdin, store) => {
   if (!path) {
     return false;
   }
-  const keys = await new Promise((res) => {
+  const items = await new Promise((res) => {
     const chunks = [];
     let chunkLen = 0;
     input.on("data", (chunk) => {
@@ -4573,142 +7335,169 @@ var main = async (path, input = process.stdin) => {
       );
     });
   });
+  const integrities = /* @__PURE__ */ new Map();
+  const keys = items.map((item) => {
+    const [key, integrity] = item.split("	");
+    if (integrity) integrities.set(key, integrity);
+    return key;
+  });
   if (!keys.length) {
-    return false;
+    return true;
   }
   const cache = new Cache({ path });
-  const readSize = (buf, offset) => {
-    const a = buf[offset];
-    const b = buf[offset + 1];
-    const c = buf[offset + 2];
-    const d3 = buf[offset + 3];
-    if (a === void 0 || b === void 0 || c === void 0 || d3 === void 0) {
-      throw error("Invalid buffer, not long enough to readSize", {
-        found: buf,
-        offset
-      });
+  const mode = process.env.VLT_CACHE_UNZIP;
+  const unzip = async (ks2) => mode === "0" ? [] : Promise.allSettled(
+    ks2.map((k3) => unzipEntry(cache, k3, integrities.get(k3)))
+  );
+  const all = mode === "1" ? await unzip(keys) : void 0;
+  const s = store ? await explode(cache, store, keys, integrities) : void 0;
+  const results = all ?? await unzip(keys.filter((k3) => !s?.exploded.has(k3)));
+  await cache.promise();
+  let unzipped = 0;
+  let rejected;
+  for (const r of results) {
+    if (r.status === "rejected") rejected ??= r;
+    else if (r.value) unzipped++;
+  }
+  debug4(
+    "cache-unzip: keys=%d exploded=%d unzipped=%d",
+    keys.length,
+    s?.written ?? 0,
+    unzipped
+  );
+  if (rejected) throw rejected.reason;
+  return !s?.failed;
+};
+var readSize = (buf, offset) => {
+  const a = buf[offset];
+  const b = buf[offset + 1];
+  const c = buf[offset + 2];
+  const d3 = buf[offset + 3];
+  if (a === void 0 || b === void 0 || c === void 0 || d3 === void 0) {
+    throw error("Invalid buffer, not long enough to readSize", {
+      found: buf,
+      offset
+    });
+  }
+  return a << 24 | b << 16 | c << 8 | d3;
+};
+var unzipEntry = async (cache, key, under) => {
+  const buffer = await cache.fetch(key, {
+    context: { integrity: under }
+  });
+  if (!buffer || buffer.length < 4) return false;
+  const headSizeOriginal = readSize(buffer, 0);
+  const body = buffer.subarray(headSizeOriginal);
+  if (body[0] !== 31 || body[1] !== 139) return false;
+  let unz;
+  try {
+    unz = gunzipSync(body, {
+      maxOutputLength: Math.min(
+        maxUnpackedBytes2,
+        body.length * MAX_DECOMPRESSION_RATIO2
+      )
+    });
+  } catch (er) {
+    if (er.code !== "ERR_BUFFER_TOO_LARGE") {
+      throw er;
     }
-    return a << 24 | b << 16 | c << 8 | d3;
-  };
-  const results = await Promise.all(
-    keys.map(async (key) => {
-      const buffer = await cache.fetch(key);
-      if (!buffer || buffer.length < 4) return null;
-      const headSizeOriginal = readSize(buffer, 0);
-      const body = buffer.subarray(headSizeOriginal);
-      if (body[0] === 31 && body[1] === 139) {
-        let unz;
-        try {
-          unz = gunzipSync(body, {
-            maxOutputLength: Math.min(
-              maxUnpackedBytes,
-              body.length * MAX_DECOMPRESSION_RATIO
-            )
-          });
-        } catch (er) {
-          if (er.code !== "ERR_BUFFER_TOO_LARGE") {
-            throw er;
-          }
-          return null;
-        }
-        const headersBuffer = buffer.subarray(7, headSizeOriginal);
-        const headers = [];
-        let i = 0;
-        let sawEncoding = false;
-        let isEncoding = false;
-        let isContentLength = false;
-        let isIntegrity = false;
-        let integrity = void 0;
-        while (i < headersBuffer.length - 4) {
-          const size = readSize(headersBuffer, i);
-          const h = headersBuffer.subarray(i + 4, i + size);
-          if (isEncoding) {
-            isEncoding = false;
-            headers.push(Buffer.from("identity"));
-          } else if (isContentLength) {
-            isContentLength = false;
-            i += size;
-            continue;
-          } else if (isIntegrity) {
-            isIntegrity = false;
-            integrity = h.toString();
-            headers.push(h);
-          } else {
-            if (headers.length % 2 === 0) {
-              if (h.toString().toLowerCase() === "content-length") {
-                isContentLength = true;
-                i += size;
-                continue;
-              }
-              if (!sawEncoding && h.toString().toLowerCase() === "content-encoding") {
-                sawEncoding = true;
-                isEncoding = true;
-              } else if (!integrity && h.toString().toLowerCase() === "integrity") {
-                isIntegrity = true;
-              }
-            }
-            headers.push(h);
-          }
+    return false;
+  }
+  const headersBuffer = buffer.subarray(7, headSizeOriginal);
+  const headers = [];
+  let i = 0;
+  let sawEncoding = false;
+  let isEncoding = false;
+  let isContentLength = false;
+  let isIntegrity2 = false;
+  let integrity = void 0;
+  while (i < headersBuffer.length - 4) {
+    const size = readSize(headersBuffer, i);
+    const h = headersBuffer.subarray(i + 4, i + size);
+    if (isEncoding) {
+      isEncoding = false;
+      headers.push(Buffer.from("identity"));
+    } else if (isContentLength) {
+      isContentLength = false;
+      i += size;
+      continue;
+    } else if (isIntegrity2) {
+      isIntegrity2 = false;
+      integrity = h.toString();
+      headers.push(h);
+    } else {
+      if (headers.length % 2 === 0) {
+        if (h.toString().toLowerCase() === "content-length") {
+          isContentLength = true;
           i += size;
+          continue;
         }
-        if (!sawEncoding) {
-          headers.push(
-            Buffer.from("content-encoding"),
-            Buffer.from("identity")
-          );
-        }
-        headers.push(
-          Buffer.from("content-length"),
-          Buffer.from(String(unz.byteLength))
-        );
-        const sb = buffer.subarray(4, 7);
-        const chunks = [sb];
-        let headLength = sb.byteLength + 4;
-        for (const h of headers) {
-          const hlBuf2 = Buffer.allocUnsafe(4);
-          const hl = h.byteLength + 4;
-          headLength += hl;
-          hlBuf2.set(
-            [
-              hl >> 24 & 255,
-              hl >> 16 & 255,
-              hl >> 8 & 255,
-              hl & 255
-            ],
-            0
-          );
-          chunks.push(hlBuf2, h);
+        if (!sawEncoding && h.toString().toLowerCase() === "content-encoding") {
+          sawEncoding = true;
+          isEncoding = true;
+        } else if (!integrity && h.toString().toLowerCase() === "integrity") {
+          isIntegrity2 = true;
         }
-        const hlBuf = Buffer.allocUnsafe(4);
-        hlBuf.set(
-          [
-            headLength >> 24 & 255,
-            headLength >> 16 & 255,
-            headLength >> 8 & 255,
-            headLength & 255
-          ],
-          0
-        );
-        chunks.unshift(hlBuf);
-        chunks.push(unz);
-        cache.set(
-          key,
-          Buffer.concat(chunks, headLength + unz.length),
-          {
-            integrity
-          }
-        );
       }
-      return true;
-    })
+      headers.push(h);
+    }
+    i += size;
+  }
+  if (!sawEncoding) {
+    headers.push(
+      Buffer.from("content-encoding"),
+      Buffer.from("identity")
+    );
+  }
+  headers.push(
+    Buffer.from("content-length"),
+    Buffer.from(String(unz.byteLength))
   );
-  await cache.promise();
-  return results.some(Boolean);
+  const sb = buffer.subarray(4, 7);
+  const chunks = [sb];
+  let headLength = sb.byteLength + 4;
+  for (const h of headers) {
+    const hlBuf2 = Buffer.allocUnsafe(4);
+    const hl = h.byteLength + 4;
+    headLength += hl;
+    hlBuf2.set(
+      [
+        hl >> 24 & 255,
+        hl >> 16 & 255,
+        hl >> 8 & 255,
+        hl & 255
+      ],
+      0
+    );
+    chunks.push(hlBuf2, h);
+  }
+  const hlBuf = Buffer.allocUnsafe(4);
+  hlBuf.set(
+    [
+      headLength >> 24 & 255,
+      headLength >> 16 & 255,
+      headLength >> 8 & 255,
+      headLength & 255
+    ],
+    0
+  );
+  chunks.unshift(hlBuf);
+  chunks.push(unz);
+  cache.set(key, Buffer.concat(chunks, headLength + unz.length), {
+    integrity
+  });
+  return true;
 };
 if (isMain(process.argv[1])) {
   process.title = "vlt-cache-unzip";
-  const path = process.argv.length === 2 ? void 0 : process.argv.at(-1);
-  const res = await main(path, process.stdin);
+  const [, , path, store] = process.argv;
+  if (store && storeEnabled()) {
+    try {
+      setPriority(19);
+    } catch {
+    }
+  }
+  const res = await main(path, process.stdin, store);
   if (!res) {
     process.exit(1);
   }