fyn 2.1.2 → 2.1.4

package/dist/fyn.js

@@ -143,6 +143,7 @@ const myPkg = __webpack_require__("./cli/mypkg.ts");
 const { cleanErrorStack } = __webpack_require__("./node_modules/.f/_/@jchip/error/1.0.3/@jchip/error/dist/index.js");
 const { setupNodeGypEnv } = __webpack_require__("./lib/util/setup-node-gyp.ts");
 const hardLinkDir = __webpack_require__("./lib/util/hard-link-dir.ts");
+const { syncLocalExports, localExportsScanIgnores } = __webpack_require__("./lib/local-exports.ts");
 const xsh = __webpack_require__("./node_modules/.f/_/xsh/0.4.6/xsh/lib/index.js");
 function checkNewVersion(npmConfig) {
   checkPkgNewVersionEngine({
@@ -417,13 +418,21 @@ class FynCli {
   }
   async syncLocalLinks() {
     await this.fyn._initializePkg();
-    const { localPkgLinks } = this.fyn._installConfig;
+    const { localPkgLinks, localExports } = this.fyn._installConfig;
+    let refreshed = false;
     if (!_.isEmpty(localPkgLinks)) {
       for (const vdir in localPkgLinks) {
         const tgtDir = Path.join(this.fyn._cwd, vdir);
         const srcDir = Path.join(this.fyn._cwd, localPkgLinks[vdir].srcDir);
         await hardLinkDir.link(srcDir, tgtDir, { sourceMaps: localPkgLinks[vdir].sourceMaps });
       }
+      refreshed = true;
+    }
+    if (localExports) {
+      await syncLocalExports({ cwd: this.fyn._cwd, manifest: localExports });
+      refreshed = true;
+    }
+    if (refreshed) {
       logger.info(`refreshed linked files for local packages`);
     } else {
       logger.info(`There are no local packages`);
@@ -444,7 +453,9 @@ class FynCli {
     return Promise.try(() => this.fyn._initializePkg()).then(async () => {
       checkNewVersion(this.fyn._options);
       if (!this.fyn._changeProdMode && !this.fyn._options.forceInstall && this.fyn._installConfig.time) {
-        const stats = await scanFileStats(this.fyn.cwd);
+        const stats = await scanFileStats(this.fyn.cwd, {
+          moreIgnores: localExportsScanIgnores(this.fyn._pkg)
+        });
         const { latestMtimeMs } = stats;
         logger.debug(
           "time check from install config - last install time",
@@ -616,16 +627,13 @@ class FynCli {
     }
     script = script || argv.args?.script;
     if (argv.opts?.list || !script) {
-      try {
-        await this.fyn.loadPkg();
-        if (!argv.opts?.list) {
-          console.log(`Lifecycle scripts included in ${this.fyn._pkg.name}:
+      await this.fyn.loadPkg();
+      if (!argv.opts?.list) {
+        console.log(`Lifecycle scripts included in ${this.fyn._pkg.name}:
 `);
-        }
-        console.log(Object.keys(_.get(this.fyn._pkg, "scripts", {})).join("\n"));
-      } finally {
-        fyntil.exit(0);
       }
+      console.log(Object.keys(_.get(this.fyn._pkg, "scripts", {})).join("\n"));
+      fyntil.exit(0);
     }
     await this.fyn.loadPkg();
     if (!_.get(this.fyn._pkg, ["scripts", script])) {
@@ -786,8 +794,15 @@ const pickEnvOptions = () => {
       cfg[m.optKey] = ev === m.checkValue;
       logger.info(`setting option ${m.optKey} to ${cfg[m.optKey]} by env ${envKey} value ${ev}`);
     }
+    return cfg;
   }, {});
 };
+const getRunExitCode = (err) => err.code !== void 0 ? err.code : err.errno || 1;
+const setLockfile = (config, lockfile) => {
+  const previous = config.opts.lockfile;
+  config.opts.lockfile = lockfile;
+  return previous;
+};
 const pickOptions = async (cmd, checkFynpo = true) => {
   const meta = cmd.jsonMeta;
   const rootOpts = cmd.rootCmd?.opts || {};
@@ -830,6 +845,11 @@ const pickOptions = async (cmd, checkFynpo = true) => {
   if (allOpts.progress) logger.setItemType(allOpts.progress);
   return { opts: allOpts, rcData, _cliSource: meta.source, _fynpo: fynpo };
 };
+const makeFynGlobal = async (cmd, extra = {}) => {
+  const { opts } = await pickOptions(cmd, false);
+  const tag = cmd.getParent()?.opts?.tag;
+  return new FynGlobal({ globalDir: cmd.opts?.dir, tag, fynOpts: opts, ...extra });
+};
 const options = {
   fynlocal: {
     args: "<flag boolean>",
@@ -930,6 +950,10 @@ const options = {
     args: "<flag boolean>",
     desc: "Ignore host in tarball URL from meta dist."
   },
+  "enforce-registry-deps": {
+    args: "<flag boolean>",
+    desc: "Require transitive deps to be from a registry (default on). --no-enforce-registry-deps to disable."
+  },
   "show-deprecated": {
     alias: "s",
     args: "<flag boolean>",
@@ -1030,13 +1054,12 @@ const commands = {
         Object.assign(meta.opts, cmd.rootCmd.opts);
       }
       const config = await pickOptions(cmd);
-      const lockFile = config.lockfile;
-      config.lockfile = false;
+      const lockFile = setLockfile(config, false);
       const cli = new FynCli(config);
       const opts = Object.assign({}, meta.opts, meta.args);
       return cli.add(opts).then((added) => {
         if (!added || !meta.opts.install) return;
-        config.lockfile = lockFile;
+        setLockfile(config, lockFile);
         config.noStartupInfo = true;
         logger.info("installing...");
         fynTil.resetFynpo();
@@ -1080,14 +1103,13 @@ const commands = {
         Object.assign(meta.opts, cmd.rootCmd.opts);
       }
       const options2 = await pickOptions(cmd);
-      const lockFile = options2.lockfile;
-      options2.lockfile = false;
+      const lockFile = setLockfile(options2, false);
       const cli = new FynCli(options2);
       const opts = Object.assign({}, meta.opts, meta.args);
       const removed = await cli.remove(opts);
       if (removed) {
         if (!meta.opts.install) return;
-        options2.lockfile = lockFile;
+        setLockfile(options2, lockFile);
         options2.noStartupInfo = true;
         fynTil.resetFynpo();
         logger.info("installing...");
@@ -1121,7 +1143,7 @@ const commands = {
         const options2 = await pickOptions(cmd, !meta.opts.list);
         return await new FynCli(options2).run(meta, void 0, cmd, parsed);
       } catch (err) {
-        const exitCode = err.errno !== void 0 ? err.errno : err.code || 1;
+        const exitCode = getRunExitCode(err);
         if (err.event && err.script) {
           logger.error(chalk.red(`Script '${err.event}' failed${err.pkgid ? ` for ${err.pkgid}` : ""}`));
           if (err.path) {
@@ -1202,9 +1224,7 @@ const commands = {
           "new-tag": { args: "<flag boolean>", desc: "Install as new tag even if same version exists" }
         },
         async exec(cmd) {
-          setLogLevel(cmd.opts?.logLevel || cmd.rootCmd?.opts?.logLevel);
-          const tag = cmd.getParent()?.opts?.tag;
-          const fynGlobal = new FynGlobal({ globalDir: cmd.opts?.dir, yes: cmd.opts?.yes, tag });
+          const fynGlobal = await makeFynGlobal(cmd, { yes: cmd.opts?.yes });
           const packages = cmd.args?.packages || [];
           if (packages.length === 0) {
             logger.error("No packages specified");
@@ -1229,11 +1249,9 @@ const commands = {
           "yes": { alias: "y", desc: "Auto-confirm all prompts" }
         },
         async exec(cmd) {
-          setLogLevel(cmd.opts?.logLevel || cmd.rootCmd?.opts?.logLevel);
-          const tag = cmd.getParent()?.opts?.tag;
-          const fynGlobal = new FynGlobal({ globalDir: cmd.opts?.dir, yes: cmd.opts?.yes, tag });
+          const fynGlobal = await makeFynGlobal(cmd, { yes: cmd.opts?.yes });
           const packageSpec = cmd.args?.package;
-          if (!packageSpec && !tag) {
+          if (!packageSpec && !fynGlobal.tag) {
             logger.error("No package specified");
             logger.info("Usage: fyn global remove <name>[@<version>]");
             logger.info("   Or: fyn global --tag=<tag> remove");
@@ -1252,11 +1270,9 @@ const commands = {
           "dir": { args: "<dir string>", desc: "Directory for global packages (default: ~/.fyn/global)" }
         },
         async exec(cmd) {
-          setLogLevel(cmd.opts?.logLevel || cmd.rootCmd?.opts?.logLevel);
-          const tag = cmd.getParent()?.opts?.tag;
-          const fynGlobal = new FynGlobal({ globalDir: cmd.opts?.dir, tag });
+          const fynGlobal = await makeFynGlobal(cmd);
           const packageSpec = cmd.args?.package;
-          if (!packageSpec && !tag) {
+          if (!packageSpec && !fynGlobal.tag) {
             logger.error("No package specified");
             logger.info("Usage: fyn global link <name>@<version>");
             logger.info("   Or: fyn global --tag=<tag> link");
@@ -1276,9 +1292,7 @@ const commands = {
           "dir": { args: "<dir string>", desc: "Directory for global packages (default: ~/.fyn/global)" }
         },
         async exec(cmd) {
-          setLogLevel(cmd.opts?.logLevel || cmd.rootCmd?.opts?.logLevel);
-          const tag = cmd.getParent()?.opts?.tag;
-          const fynGlobal = new FynGlobal({ globalDir: cmd.opts?.dir, tag });
+          const fynGlobal = await makeFynGlobal(cmd);
           await fynGlobal.listGlobalPackages(cmd.args?.name);
         }
       },
@@ -1289,9 +1303,7 @@ const commands = {
           "dir": { args: "<dir string>", desc: "Directory for global packages (default: ~/.fyn/global)" }
         },
         async exec(cmd) {
-          setLogLevel(cmd.opts?.logLevel || cmd.rootCmd?.opts?.logLevel);
-          const tag = cmd.getParent()?.opts?.tag;
-          const fynGlobal = new FynGlobal({ globalDir: cmd.opts?.dir, tag });
+          const fynGlobal = await makeFynGlobal(cmd);
           const packageSpec = cmd.args?.package;
           const updated = await fynGlobal.updateGlobalPackage(packageSpec);
           if (!updated) {
@@ -1306,9 +1318,7 @@ const commands = {
           "dir": { args: "<dir string>", desc: "Directory for global packages (default: ~/.fyn/global)" }
         },
         async exec(cmd) {
-          setLogLevel(cmd.opts?.logLevel || cmd.rootCmd?.opts?.logLevel);
-          const tag = cmd.getParent()?.opts?.tag;
-          const fynGlobal = new FynGlobal({ globalDir: cmd.opts?.dir, tag });
+          const fynGlobal = await makeFynGlobal(cmd);
           await fynGlobal.useNodeVersion(cmd.args?.version);
         }
       },
@@ -1319,8 +1329,7 @@ const commands = {
           "dir": { args: "<dir string>", desc: "Directory for global packages (default: ~/.fyn/global)" }
         },
         async exec(cmd) {
-          setLogLevel(cmd.opts?.logLevel || cmd.rootCmd?.opts?.logLevel);
-          const fynGlobal = new FynGlobal({ globalDir: cmd.opts?.dir });
+          const fynGlobal = await makeFynGlobal(cmd);
           const packageName = cmd.args?.package;
           const removed = await fynGlobal.cleanupPackage(packageName);
           if (removed === 0) {
@@ -1336,9 +1345,7 @@ const commands = {
           "dir": { args: "<dir string>", desc: "Directory for global packages (default: ~/.fyn/global)" }
         },
         async exec(cmd) {
-          setLogLevel(cmd.opts?.logLevel || cmd.rootCmd?.opts?.logLevel);
-          const tag = cmd.getParent()?.opts?.tag;
-          const fynGlobal = new FynGlobal({ globalDir: cmd.opts?.dir, tag });
+          const fynGlobal = await makeFynGlobal(cmd);
           fynGlobal.showPathSetup();
         }
       }
@@ -1420,6 +1427,9 @@ module.exports = {
   run,
   fun,
   nodeGyp,
+  getRunExitCode,
+  pickEnvOptions,
+  setLockfile,
   hardLinkDir
 };
 
@@ -1686,6 +1696,7 @@ class ShowStat {
       return this._show(pkgIds);
     }).catch((err) => {
       logger.error(err);
+      throw err;
     }).finally(() => {
       logger.removeItem(FETCH_META);
     });
@@ -1977,10 +1988,26 @@ module.exports.__TEST__ = {
 /***/ "./lib/cacache-util.ts":
 /***/ ((module, __unused_webpack_exports, __webpack_require__) => {
 
+"use strict";
+
 const cacache = __webpack_require__("./node_modules/.f/_/cacache/20.0.1/cacache/lib/index.js");
 const fs = (__webpack_require__("fs").promises);
 const path = __webpack_require__("path");
 const crypto = __webpack_require__("crypto");
+function hashKey(key) {
+  return crypto.createHash("sha256").update(key).digest("hex");
+}
+function getBucketPath(cache, key) {
+  const hashed = hashKey(key);
+  const indexV = (__webpack_require__("./node_modules/.f/_/cacache/20.0.1/cacache/package.json")["cache-version"].index);
+  return path.join(
+    cache,
+    `index-v${indexV}`,
+    hashed.slice(0, 2),
+    hashed.slice(2, 4),
+    hashed.slice(4)
+  );
+}
 async function refreshCacheEntry(cache, key) {
   const bucket = getBucketPath(cache, key);
   const time = /* @__PURE__ */ new Date();
@@ -2007,20 +2034,6 @@ async function getCacheInfoWithRefreshTime(cache, key) {
     throw err;
   }
 }
-function getBucketPath(cache, key) {
-  const hashed = hashKey(key);
-  const indexV = (__webpack_require__("./node_modules/.f/_/cacache/20.0.1/cacache/package.json")["cache-version"].index);
-  return path.join(
-    cache,
-    `index-v${indexV}`,
-    hashed.slice(0, 2),
-    hashed.slice(2, 4),
-    hashed.slice(4)
-  );
-}
-function hashKey(key) {
-  return crypto.createHash("sha256").update(key).digest("hex");
-}
 module.exports = {
   refreshCacheEntry,
   getCacheInfoWithRefreshTime,
@@ -2105,9 +2118,12 @@ class DepData {
     return this.getPkgsData(item.optFailed)[item.name];
   }
   getPkgById(id) {
-    const splits = id.split("@");
-    const x = this.getPkgsData()[splits[0]];
-    return splits[1] ? x[splits[1]] : x;
+    const lastAt = id.lastIndexOf("@");
+    const sep = lastAt > 0 ? lastAt : -1;
+    const name = sep > 0 ? id.slice(0, sep) : id;
+    const version = sep > 0 ? id.slice(sep + 1) : void 0;
+    const x = this.getPkgsData()[name];
+    return version ? x[version] : x;
   }
   eachVersion(cb) {
     const pkgs = this.pkgs;
@@ -2740,6 +2756,7 @@ const unlock = util.promisify(lockfile.unlock);
 class FynGlobal {
   /**
    * Create a FynGlobal instance
+   *
    * @param {Object} options - Configuration options
    * @param {string} [options.globalDir] - Root directory for global packages (default: ~/.fyn/global)
    * @param {string} [options.registry] - NPM registry URL (default: https://registry.npmjs.org)
@@ -2764,21 +2781,24 @@ class FynGlobal {
   }
   /**
    * Create a Fyn instance for global package installation
+   *
    * @param {string} cwd - Working directory for the install
    * @param {boolean} fynlocal - Whether this is a local package
    * @returns {Fyn} Configured Fyn instance
    */
   _createFyn(cwd, fynlocal) {
     process.env.FYN_CENTRAL_DIR = Path.join(this.globalRoot, "_central-storage");
+    const fynOpts = this.options.fynOpts || {};
     return new Fyn({
       opts: {
+        ...fynOpts,
         cwd,
         targetDir: "node_modules",
         centralStore: true,
         lockfile: true,
         fynlocal,
         sourceMaps: false,
-        registry: this.options.registry || "https://registry.npmjs.org",
+        registry: this.options.registry || fynOpts.registry || "https://registry.npmjs.org",
         layout: "normal",
         flattenTop: true
       },
@@ -2801,6 +2821,7 @@ class FynGlobal {
   }
   /**
    * Read the installed.json registry
+   *
    * @returns {Object} Registry object with packages info
    */
   async readInstalledJson() {
@@ -2820,6 +2841,7 @@ class FynGlobal {
   }
   /**
    * Get all versions of a package from the registry
+   *
    * @param {string} packageName
    * @returns {Array} Array of version info objects
    */
@@ -2829,6 +2851,7 @@ class FynGlobal {
   }
   /**
    * Get the linked version of a package
+   *
    * @param {string} packageName
    * @returns {Object|null} Version info or null
    */
@@ -2838,6 +2861,7 @@ class FynGlobal {
   }
   /**
    * Find package info by tag (e.g., g1, g2)
+   *
    * @param {string} tag - The tag to find
    * @returns {Object|null} Object with packageName and versionInfo, or null if not found
    */
@@ -2854,6 +2878,7 @@ class FynGlobal {
   }
   /**
    * Validate that the tag option points to an existing installation
+   *
    * @returns {Object} Object with packageName and versionInfo
    * @throws {Error} If tag is set but doesn't exist
    */
@@ -2884,14 +2909,19 @@ class FynGlobal {
   }
   /**
    * Remove a version from the registry
+   *
+   * @param {string} packageName - package name
+   * @param {string} dir - the tag dir (e.g. "g1"); the unique key of an entry.
+   *   The same version can exist under multiple tag dirs (--new-tag), so entries
+   *   must be identified by dir, not by version string.
    */
-  async removeFromRegistry(packageName, version) {
+  async removeFromRegistry(packageName, dir) {
     const registry = await this.readInstalledJson();
     if (!registry.packages[packageName]) {
       return;
     }
     const versions = registry.packages[packageName].versions;
-    const idx = versions.findIndex((v) => v.version === version);
+    const idx = versions.findIndex((v) => v.dir === dir);
     if (idx >= 0) {
       versions.splice(idx, 1);
       if (versions.length === 0) {
@@ -3125,6 +3155,7 @@ class FynGlobal {
   }
   /**
    * Link bin executables to global bin directory
+   *
    * @param {string} gId - Package directory ID (e.g., "g1")
    * @param {Object} bins - Map of binName -> binPath
    * @param {boolean} force - If true, overwrite existing bins
@@ -3158,6 +3189,7 @@ class FynGlobal {
    * - Latest version wins (becomes linked)
    * - Prompts if newer version available when installing older
    * - Prompts to remove old versions after installing new
+   *
    * @param {string} packageSpec - Package spec to install
    * @param {Object} [options] - Install options
    * @param {boolean} [options.newTag] - Install as new tag even if same version exists
@@ -3209,7 +3241,7 @@ class FynGlobal {
           if (!existingExact.linked) {
             const linkIt = await this.promptYesNo(`Link this version to make it active?`);
             if (linkIt) {
-              await this.linkPackageVersion(packageName, existingExact.version);
+              await this.linkPackageVersion(`${packageName}@${existingExact.version}`);
             }
           }
           return false;
@@ -3256,7 +3288,7 @@ class FynGlobal {
       if (shouldLink) {
         for (const existing of existingVersions) {
           if (existing.linked) {
-            await this.unlinkBinsForVersion(packageName, existing.version);
+            await this.unlinkBinsForVersion(packageName, existing.dir);
             existing.linked = false;
             await this.addToRegistry(packageName, existing);
           }
@@ -3291,7 +3323,7 @@ class FynGlobal {
           if (removeOld) {
             for (const existing of existingVersions) {
               if (existing.version !== installedVersion) {
-                await this.removeVersion(packageName, existing.version);
+                await this.removeVersion(packageName, existing.dir);
                 logger.info(`Removed ${packageName}@${existing.version}`);
               }
             }
@@ -3315,9 +3347,9 @@ class FynGlobal {
   /**
    * Unlink bins for a specific version
    */
-  async unlinkBinsForVersion(packageName, version) {
+  async unlinkBinsForVersion(packageName, dir) {
     const versions = await this.getPackageVersions(packageName);
-    const versionInfo = versions.find((v) => v.version === version);
+    const versionInfo = versions.find((v) => v.dir === dir);
     if (!versionInfo) return;
     const binLinker = this._getBinLinker();
     const bins = this._getVersionBinTargets(versionInfo);
@@ -3331,24 +3363,30 @@ class FynGlobal {
     }
   }
   /**
-   * Remove a specific version of a package
+   * Remove a specific installed entry of a package, identified by its tag dir
+   * (the unique key — the same version may exist under several tag dirs).
+   *
+   * @param {string} packageName - package name
+   * @param {string} dir - the entry's tag dir (e.g. "g1")
+   * @returns {boolean} true if an entry was removed
    */
-  async removeVersion(packageName, version) {
+  async removeVersion(packageName, dir) {
     const versions = await this.getPackageVersions(packageName);
-    const versionInfo = versions.find((v) => v.version === version);
+    const versionInfo = versions.find((v) => v.dir === dir);
     if (!versionInfo) {
       return false;
     }
     if (versionInfo.linked) {
-      await this.unlinkBinsForVersion(packageName, version);
+      await this.unlinkBinsForVersion(packageName, dir);
     }
     const pkgDir = Path.join(this.packagesDir, versionInfo.dir);
     await Fs.$.rimraf(pkgDir);
-    await this.removeFromRegistry(packageName, version);
+    await this.removeFromRegistry(packageName, dir);
     return true;
   }
   /**
    * Remove globally installed package version(s)
+   *
    * @param {string} packageSpec - Package name or name@semver pattern
    *   - name: remove all versions (warns if multiple, won't remove linked unless only one)
    *   - name@version: remove exact version
@@ -3359,11 +3397,12 @@ class FynGlobal {
     if (this.tag) {
       const found = await this.validateTag();
       logger.info(`Removing ${found.packageName}@${found.versionInfo.version} (${this.tag})`);
-      await this.removeVersion(found.packageName, found.versionInfo.version);
+      await this.removeVersion(found.packageName, found.versionInfo.dir);
       logger.info(`Removed ${found.packageName}@${found.versionInfo.version}`);
       return true;
     }
-    let packageName, versionSpec;
+    let packageName;
+    let versionSpec;
     if (packageSpec.startsWith("@")) {
       const lastAt = packageSpec.lastIndexOf("@");
       if (lastAt > 0 && lastAt !== packageSpec.indexOf("@")) {
@@ -3418,13 +3457,14 @@ class FynGlobal {
       }
     }
     for (const versionInfo of toRemove) {
-      await this.removeVersion(packageName, versionInfo.version);
+      await this.removeVersion(packageName, versionInfo.dir);
       logger.info(`Removed ${packageName}@${versionInfo.version}`);
     }
     return true;
   }
   /**
    * List globally installed packages
+   *
    * @param {string} [filterName] - Optional package name to filter by
    */
   async listGlobalPackages(filterName) {
@@ -3482,10 +3522,13 @@ ${packageName}:`);
   }
   /**
    * Link (activate) a specific version of a package
+   *
    * @param {string} packageSpec - Package name@version to link, or ignored if --tag is specified
    */
   async linkPackageVersion(packageSpec) {
-    let packageName, version, targetVersion;
+    let packageName;
+    let version;
+    let targetVersion;
     if (this.tag) {
       const found = await this.validateTag();
       packageName = found.packageName;
@@ -3539,7 +3582,7 @@ Use: fyn global link ${packageName}@<version>`);
     const versions = await this.getPackageVersions(packageName);
     const currentLinked = versions.find((v) => v.linked);
     if (currentLinked) {
-      await this.unlinkBinsForVersion(packageName, currentLinked.version);
+      await this.unlinkBinsForVersion(packageName, currentLinked.dir);
     }
     const pkgDir = Path.join(this.packagesDir, targetVersion.dir);
     const bins = await this.discoverBins(pkgDir, packageName);
@@ -3553,6 +3596,7 @@ Use: fyn global link ${packageName}@<version>`);
   }
   /**
    * Find a package by its local path
+   *
    * @param {string} localPath - The local path to search for
    * @returns {Object|null} Object with packageName and versions, or null
    */
@@ -3572,6 +3616,7 @@ Use: fyn global link ${packageName}@<version>`);
   }
   /**
    * Update a globally installed package (linked version or specific tag)
+   *
    * @param {string} packageSpec - Package name or local path
    */
   async updateGlobalPackage(packageSpec) {
@@ -3697,6 +3742,7 @@ Use: fyn global link ${packageName}@<version>`);
   }
   /**
    * Cleanup non-linked versions of a package
+   *
    * @param {string} [packageName] - Package name to cleanup, or all packages if not specified
    * @returns {number} Number of versions removed
    */
@@ -3726,7 +3772,7 @@ Use: fyn global link ${packageName}@<version>`);
         continue;
       }
       for (const v of nonLinked) {
-        await this.removeVersion(pkgName, v.version);
+        await this.removeVersion(pkgName, v.dir);
         logger.info(`Removed ${pkgName}@${v.version} (${v.dir})`);
         totalRemoved++;
       }
@@ -3782,6 +3828,7 @@ const fynTil = __webpack_require__("./lib/util/fyntil.ts");
 const FynCentral = __webpack_require__("./lib/fyn-central.ts");
 const xaa = __webpack_require__("./lib/util/xaa.ts");
 const { checkPkgNeedInstall } = __webpack_require__("./lib/util/check-pkg-need-install.ts");
+const { localExportsNeedInstall } = __webpack_require__("./lib/local-exports.ts");
 const lockfile = __webpack_require__("./node_modules/.f/_/lockfile/1.0.4/lockfile/lockfile.js");
 const createLock = util.promisify(lockfile.lock);
 const unlock = util.promisify(lockfile.unlock);
@@ -3907,7 +3954,13 @@ class Fyn {
     } else {
       centralDir = this._fynpo.config.centralDir;
       if (!centralDir) {
-        centralDir = Path.join(this._fynpo.dir, ".fynpo", "_store");
+        const storeBaseDir = await fynTil.resolveGitMainWorktreeDir(this._fynpo.dir);
+        if (storeBaseDir !== this._fynpo.dir) {
+          logger.info(
+            `fynpo monorepo is a git worktree; sharing central store from main worktree ${storeBaseDir}`
+          );
+        }
+        centralDir = Path.join(storeBaseDir, ".fynpo", "_store");
       }
       logger.info(`Enabling central store by fynpo monorepo using dir ${centralDir}`);
     }
@@ -3922,6 +3975,7 @@ class Fyn {
   }
   /**
    * Check user production mode option against saved install config in node_modules
+   *
    * @remarks - this._installConfig must've been initialized
    * @returns nothing
    */
@@ -3979,13 +4033,13 @@ class Fyn {
         const fynInstallConfig = JSON.parse(await Fs.readFile(filename));
         logger.debug("loaded fynInstallConfig", fynInstallConfig);
         const { layout } = fynInstallConfig;
-        if (layout && layout !== this._layout) {
+        if (layout && layout !== this._options.layout) {
           if (this._cliSource.layout !== "default") {
             logger.warn(
-              `Forcing layout to ${layout} from ${this._layout} because your existing node_modules uses that. To change it, please remove node_modules first.`
+              `Forcing layout to ${layout} from ${this._options.layout} because your existing node_modules uses that. To change it, please remove node_modules first.`
             );
           }
-          this._layout = layout;
+          this._options.layout = layout;
         }
         const recordedShort = fynInstallConfig.shortPkgDir === void 0 ? true : fynInstallConfig.shortPkgDir;
         if (recordedShort !== this._shortPkgDir) {
@@ -4106,6 +4160,7 @@ class Fyn {
   }
   /**
    * Get the version of a direct dependency from package.json
+   *
    * @param {string} pkgName - Package name to look up
    * @returns {string|null} The version or null if not found
    */
@@ -4180,6 +4235,12 @@ class Fyn {
         return true;
       }
     }
+    if (await localExportsNeedInstall({
+      cwd: this._cwd,
+      manifest: this._installConfig.localExports
+    })) {
+      return true;
+    }
     return false;
   }
   setLocalDeps(localsByDepth) {
@@ -4194,6 +4255,9 @@ class Fyn {
   setLocalPkgLinks(localLinks) {
     this._installConfig.localPkgLinks = localLinks;
   }
+  setLocalExports(manifest) {
+    this._installConfig.localExports = manifest;
+  }
   // save the config to outputDir
   async saveInstallConfig() {
     const outputDir = this.getOutputDir();
@@ -4210,7 +4274,7 @@ class Fyn {
         time: Date.now() + 5,
         centralDir,
         production: this.production,
-        layout: this._layout,
+        layout: this._options.layout,
         shortPkgDir: this._shortPkgDir
         // not a good idea to save --run-npm options to install config because
         // future fyn install will automatically run them and would be unexpected.
@@ -4247,7 +4311,7 @@ class Fyn {
       let pkgFile;
       if (options.pkgFile === "package.json") {
         let foundDir = null;
-        const paths = pathUpEach(this._cwd, (path) => {
+        pathUpEach(this._cwd, (path) => {
           const testPath = Path.join(path, "package.json");
           if (Fs.existsSync(testPath)) {
             foundDir = path;
@@ -4331,6 +4395,46 @@ class Fyn {
   get showDeprecated() {
     return this._options.showDeprecated && "show-deprecated";
   }
+  // package.json `fyn.allowScripts` whitelist - maps `name@spec` or
+  // `name@version` to the lifecycle scripts allowed for packages that did not
+  // come from a configured registry (github/git/url tarball deps).
+  get allowScripts() {
+    if (this._allowScripts === void 0 && this._pkg) {
+      this._allowScripts = _.get(this._pkg, ["fyn", "allowScripts"]) || {};
+    }
+    return this._allowScripts || {};
+  }
+  // package.json `fyn.allowTopLevelScripts` - opt-in (default off) to trust the
+  // lifecycle scripts of non-registry packages (github/git/url tarball) that are
+  // declared directly in the top-level package.json, without per-package
+  // `fyn.allowScripts` entries. `true`/`"*"` allows all lifecycle scripts; an
+  // array allows only those script names. Transitive deps stay blocked.
+  get allowTopLevelScripts() {
+    if (this._allowTopLevelScripts === void 0 && this._pkg) {
+      this._allowTopLevelScripts = _.get(this._pkg, ["fyn", "allowTopLevelScripts"]) || false;
+    }
+    return this._allowTopLevelScripts || false;
+  }
+  // Security policy: transitive (non-top-level) dependencies must resolve from
+  // a published registry. git/github/url-tarball sources and unparseable semver
+  // are rejected (hard error). Local (file:/link:/symlink, incl. fynpo
+  // siblings) and `npm:` aliases are accepted. Only the top-level package.json
+  // may declare non-registry deps.
+  //
+  // Default ON. Disable explicitly with the CLI flag
+  // `--no-enforce-registry-deps` or package.json `fyn.enforceRegistryDeps:false`.
+  // Precedence: CLI option (when given) > package.json fyn flag > default (on).
+  get enforceRegistryDeps() {
+    const cliOpt = this._options.enforceRegistryDeps;
+    if (cliOpt !== void 0) {
+      return Boolean(cliOpt);
+    }
+    if (this._enforceRegistryDeps === void 0 && this._pkg) {
+      const pkgOpt = _.get(this._pkg, ["fyn", "enforceRegistryDeps"]);
+      this._enforceRegistryDeps = pkgOpt === void 0 ? true : Boolean(pkgOpt);
+    }
+    return this._enforceRegistryDeps === void 0 ? true : this._enforceRegistryDeps;
+  }
   get refreshOptionals() {
     return this._options.refreshOptionals;
   }
@@ -4522,6 +4626,7 @@ class Fyn {
   }
   /**
    * Scan FV_DIR for modules saved in the ${name}/${version} format
+   *
    * @returns {*} pkgs under fv dir with their versions
    */
   async loadFvVersions() {
@@ -4559,7 +4664,7 @@ class Fyn {
   async createPkgOutDir(dir, keep) {
     try {
       const r = await Fs.$.mkdirp(dir);
-      if (r === null && !keep && dir !== this.getOutputDir()) {
+      if (r === void 0 && !keep && dir !== this.getOutputDir()) {
         await this.clearPkgOutDir(dir);
       }
     } catch (err) {
@@ -4823,6 +4928,373 @@ class LifecycleScripts {
 module.exports = LifecycleScripts;
 
 
+/***/ }),
+
+/***/ "./lib/local-exports.ts":
+/***/ ((module, __unused_webpack_exports, __webpack_require__) => {
+
+"use strict";
+
+const Path = __webpack_require__("path");
+const Fs = __webpack_require__("./lib/util/file-ops.ts");
+const fynTil = __webpack_require__("./lib/util/fyntil.ts");
+const { getUrlType } = __webpack_require__("./lib/util/lifecycle-script-policy.ts");
+const DEFAULT_ROOT_DIR = "_fyn";
+const MANIFEST_FILE = ".fyn-local-exports.json";
+const MANIFEST_VERSION = 1;
+const SAFE_NAME = /^[A-Za-z0-9_][A-Za-z0-9._-]*$/;
+const posixify = (value) => value.split(Path.sep).join("/");
+const rootOfEntry = (entry) => entry.root || DEFAULT_ROOT_DIR;
+const emptyManifest = () => ({ version: MANIFEST_VERSION, exports: {} });
+const packagePathParts = (name) => {
+  const parts = typeof name === "string" ? name.split("/") : [];
+  const scoped = parts.length === 2 && parts[0][0] === "@";
+  const safe = scoped ? SAFE_NAME.test(parts[0].slice(1)) && SAFE_NAME.test(parts[1]) : parts.length === 1 && SAFE_NAME.test(parts[0]);
+  if (!safe) {
+    throw new Error(`Invalid package name for fyn.localExports: ${name}`);
+  }
+  return parts;
+};
+const checkExportName = (packageName, exportName) => {
+  if (!SAFE_NAME.test(exportName) || exportName === "." || exportName === "..") {
+    throw new Error(
+      `Invalid fyn.localExports export name ${JSON.stringify(exportName)} in ${packageName}`
+    );
+  }
+};
+const normalizeRootDir = (value, ctx) => {
+  if (typeof value !== "string" || !value.trim()) {
+    throw new Error(`${ctx} must be a non-empty relative directory`);
+  }
+  if (Path.isAbsolute(value) || Path.posix.isAbsolute(value) || Path.win32.isAbsolute(value)) {
+    throw new Error(`${ctx} must not be absolute: ${value}`);
+  }
+  const parts = value.split(/[\\/]+/).filter((part) => part && part !== ".");
+  if (parts.length === 0 || parts.includes("..") || parts.includes("node_modules") || parts.includes(".git")) {
+    throw new Error(`Unsafe ${ctx}: ${value}`);
+  }
+  return parts.join("/");
+};
+const nestsWithin = (parent, child) => {
+  const relative = Path.posix.relative(parent, child);
+  return relative !== "" && !relative.startsWith("..");
+};
+const assertNoNestedRoots = (roots) => {
+  const uniq = [...new Set(roots)];
+  for (const a of uniq) {
+    for (const b of uniq) {
+      if (a !== b && nestsWithin(a, b)) {
+        throw new Error(`fyn local export directories must not nest: ${a} contains ${b}`);
+      }
+    }
+  }
+};
+const resolveLocalExportsConfig = (pkg) => {
+  const fyn = pkg && pkg.fyn || {};
+  const defaultDir = fyn.localExportsDir === void 0 ? DEFAULT_ROOT_DIR : normalizeRootDir(fyn.localExportsDir, "fyn.localExportsDir");
+  const byPackage = {};
+  const dirs = fyn.localExportsDirs;
+  if (dirs !== void 0 && dirs !== null) {
+    if (typeof dirs !== "object" || Array.isArray(dirs)) {
+      throw new Error("fyn.localExportsDirs must be an object of package name to directory");
+    }
+    for (const name of Object.keys(dirs)) {
+      packagePathParts(name);
+      byPackage[name] = normalizeRootDir(dirs[name], `fyn.localExportsDirs[${JSON.stringify(name)}]`);
+    }
+  }
+  assertNoNestedRoots([defaultDir, ...Object.values(byPackage)]);
+  return { defaultDir, byPackage };
+};
+const rootDirForPackage = (config, name) => config.byPackage && config.byPackage[name] || config.defaultDir;
+const localExportsScanIgnores = (pkg) => {
+  let config;
+  try {
+    config = resolveLocalExportsConfig(pkg);
+  } catch (err) {
+    return [];
+  }
+  const roots = [config.defaultDir, ...Object.values(config.byPackage)];
+  return [...new Set(roots)].map((root) => `**/${root}`);
+};
+const groupByRoot = (exportsMap) => {
+  const byRoot = /* @__PURE__ */ new Map();
+  for (const target of Object.keys(exportsMap)) {
+    const root = rootOfEntry(exportsMap[target]);
+    if (!byRoot.has(root)) {
+      byRoot.set(root, {});
+    }
+    byRoot.get(root)[target] = exportsMap[target];
+  }
+  return byRoot;
+};
+const normalizeManifest = (manifest) => {
+  if (!manifest) {
+    return emptyManifest();
+  }
+  if (manifest.version !== MANIFEST_VERSION || !manifest.exports || Array.isArray(manifest.exports) || typeof manifest.exports !== "object") {
+    throw new Error("Invalid fyn local exports manifest");
+  }
+  for (const target of Object.keys(manifest.exports)) {
+    const entry = manifest.exports[target];
+    if (!entry || typeof entry !== "object" || typeof entry.source !== "string" || !entry.source) {
+      throw new Error("Invalid fyn local exports manifest entry");
+    }
+    const root = normalizeRootDir(rootOfEntry(entry), "fyn local exports manifest root");
+    const expectedTarget = posixify(
+      Path.join(root, ...packagePathParts(entry.package), entry.export)
+    );
+    checkExportName(entry.package, entry.export);
+    if (target !== expectedTarget || entry.target !== expectedTarget) {
+      throw new Error(`Invalid fyn local exports manifest target: ${target}`);
+    }
+  }
+  return manifest;
+};
+const checkSourcePath = (packageName, sourcePath) => {
+  if (typeof sourcePath !== "string" || !sourcePath.trim()) {
+    throw new Error(`fyn.localExports source for ${packageName} must be a relative directory`);
+  }
+  if (Path.isAbsolute(sourcePath) || Path.posix.isAbsolute(sourcePath) || Path.win32.isAbsolute(sourcePath)) {
+    throw new Error(`fyn.localExports source for ${packageName} must not be absolute`);
+  }
+  const parts = sourcePath.split(/[\\/]+/);
+  if (parts.includes("..") || parts.includes("node_modules") || parts.includes(".git")) {
+    throw new Error(`Unsafe fyn.localExports source ${sourcePath} in ${packageName}`);
+  }
+};
+const isInside = (root, child) => {
+  const relative = Path.relative(root, child);
+  return relative !== "" && relative !== ".." && !relative.startsWith(`..${Path.sep}`);
+};
+const readOwnedManifest = async (cwd, root) => {
+  const marker = Path.join(cwd, root, MANIFEST_FILE);
+  try {
+    const value = JSON.parse(await Fs.readFile(marker, "utf8"));
+    return normalizeManifest(value);
+  } catch (err) {
+    if (err.code === "ENOENT" || err.code === "ENOTDIR") {
+      return null;
+    }
+    throw new Error(`Invalid ${root} ownership manifest: ${err.message}`);
+  }
+};
+const sourcePathFor = (cwd, entry) => Path.resolve(cwd, entry.source);
+const linkMatches = async (cwd, entry) => {
+  try {
+    const target = await Fs.realpath(Path.resolve(cwd, entry.target));
+    const source = await Fs.realpath(sourcePathFor(cwd, entry));
+    return target === source;
+  } catch (err) {
+    return false;
+  }
+};
+async function makeLocalExportsManifest({ cwd, depInfos, config: exportsConfig }) {
+  const resolved = exportsConfig || { defaultDir: DEFAULT_ROOT_DIR, byPackage: {} };
+  const entries = {};
+  const consumerRoot = await Fs.realpath(cwd);
+  for (const depInfo of depInfos) {
+    if (depInfo.local !== "hard" || getUrlType(depInfo) || depInfo.optFailed || depInfo._removed) {
+      continue;
+    }
+    const config = depInfo.json && depInfo.json.fyn && depInfo.json.fyn.localExports;
+    if (config === void 0 || config === false) {
+      continue;
+    }
+    if (!config || Array.isArray(config) || typeof config !== "object") {
+      throw new Error(`fyn.localExports for ${depInfo.name} must be an object or false`);
+    }
+    const packageParts = packagePathParts(depInfo.name);
+    const packageRoot = await Fs.realpath(depInfo.dir);
+    for (const exportName of Object.keys(config).sort()) {
+      const configuredSource = config[exportName];
+      if (configuredSource === false) {
+        continue;
+      }
+      checkExportName(depInfo.name, exportName);
+      checkSourcePath(depInfo.name, configuredSource);
+      const unresolvedSource = Path.resolve(packageRoot, configuredSource);
+      let source;
+      let sourceStat;
+      try {
+        source = await Fs.realpath(unresolvedSource);
+        sourceStat = await Fs.stat(source);
+      } catch (err) {
+        throw new Error(
+          `fyn.localExports source ${configuredSource} in ${depInfo.name} does not exist`
+        );
+      }
+      if (!isInside(packageRoot, source)) {
+        throw new Error(
+          `fyn.localExports source ${configuredSource} in ${depInfo.name} escapes the package`
+        );
+      }
+      if (!sourceStat.isDirectory()) {
+        throw new Error(
+          `fyn.localExports source ${configuredSource} in ${depInfo.name} is not a directory`
+        );
+      }
+      const root = rootDirForPackage(resolved, depInfo.name);
+      const target = posixify(Path.join(root, ...packageParts, exportName));
+      const relativeSource = posixify(Path.relative(consumerRoot, source));
+      const prior = entries[target];
+      if (prior && (prior.source !== relativeSource || prior.version !== depInfo.version)) {
+        throw new Error(
+          `Local export destination collision for ${depInfo.name}@${depInfo.version}: ${target}`
+        );
+      }
+      const targetPath = Path.resolve(consumerRoot, target);
+      entries[target] = {
+        package: depInfo.name,
+        version: depInfo.version,
+        export: exportName,
+        source: relativeSource,
+        target,
+        root,
+        linkTarget: fynTil.isWin32 ? source : posixify(Path.relative(Path.dirname(targetPath), source))
+      };
+    }
+  }
+  const sortedEntries = {};
+  for (const target of Object.keys(entries).sort()) {
+    sortedEntries[target] = entries[target];
+  }
+  return { version: MANIFEST_VERSION, exports: sortedEntries };
+}
+async function rootNeedsInstall(cwd, root, exportsForRoot) {
+  const rootManifest = { version: MANIFEST_VERSION, exports: exportsForRoot };
+  let realized;
+  try {
+    realized = await readOwnedManifest(cwd, root);
+  } catch (err) {
+    return true;
+  }
+  if (!realized || JSON.stringify(realized) !== JSON.stringify(rootManifest)) {
+    return true;
+  }
+  for (const target of Object.keys(exportsForRoot)) {
+    if (!await linkMatches(cwd, exportsForRoot[target])) {
+      return true;
+    }
+  }
+  return false;
+}
+async function localExportsNeedInstall({ cwd, manifest }) {
+  const desired = normalizeManifest(manifest);
+  const byRoot = groupByRoot(desired.exports);
+  if (byRoot.size === 0) {
+    try {
+      return Boolean(await readOwnedManifest(cwd, DEFAULT_ROOT_DIR));
+    } catch (err) {
+      return false;
+    }
+  }
+  for (const [root, exportsForRoot] of byRoot) {
+    if (await rootNeedsInstall(cwd, root, exportsForRoot)) {
+      return true;
+    }
+  }
+  return false;
+}
+async function reconcileOneRoot(cwd, root, exportsForRoot) {
+  const targets = Object.keys(exportsForRoot);
+  const rootPath = Path.join(cwd, root);
+  let owned;
+  try {
+    owned = await readOwnedManifest(cwd, root);
+  } catch (err) {
+    if (targets.length === 0) {
+      return;
+    }
+    throw err;
+  }
+  if (targets.length === 0) {
+    if (owned) {
+      await Fs.$.rimraf(rootPath);
+    }
+    return;
+  }
+  if (await Fs.exists(rootPath) && !owned) {
+    throw new Error(`Refusing to modify ${rootPath} without a fyn ownership manifest`);
+  }
+  if (owned && !await rootNeedsInstall(cwd, root, exportsForRoot)) {
+    return;
+  }
+  const desiredRootManifest = { version: MANIFEST_VERSION, exports: exportsForRoot };
+  const suffix = `${process.pid}-${Date.now()}`;
+  const staging = `${rootPath}.fyn-tmp-${suffix}`;
+  const backup = `${rootPath}.fyn-old-${suffix}`;
+  let movedExisting = false;
+  try {
+    await Fs.$.rimraf(staging);
+    await Fs.$.mkdirp(staging);
+    for (const target of targets) {
+      const entry = exportsForRoot[target];
+      const stagedTarget = Path.join(staging, Path.relative(root, target));
+      const source = sourcePathFor(cwd, entry);
+      const stat = await Fs.stat(source);
+      if (!stat.isDirectory()) {
+        throw new Error(`Local export source is not a directory: ${source}`);
+      }
+      await Fs.$.mkdirp(Path.dirname(stagedTarget));
+      await fynTil.symlinkDir(stagedTarget, source, !fynTil.isWin32);
+    }
+    await Fs.writeFile(
+      Path.join(staging, MANIFEST_FILE),
+      `${JSON.stringify(desiredRootManifest, null, 2)}
+`
+    );
+    if (owned) {
+      await Fs.$.rimraf(backup);
+      await Fs.rename(rootPath, backup);
+      movedExisting = true;
+    }
+    await Fs.$.mkdirp(Path.dirname(rootPath));
+    await Fs.rename(staging, rootPath);
+    if (movedExisting) {
+      movedExisting = false;
+      await Fs.$.rimraf(backup);
+    }
+  } catch (err) {
+    await Fs.$.rimraf(staging);
+    if (movedExisting) {
+      await Fs.$.rimraf(rootPath);
+      await Fs.rename(backup, rootPath);
+    }
+    throw err;
+  }
+}
+async function reconcileLocalExports({ cwd, manifest, previous }) {
+  const desired = normalizeManifest(manifest);
+  const byRoot = groupByRoot(desired.exports);
+  const allRoots = /* @__PURE__ */ new Set([DEFAULT_ROOT_DIR, ...byRoot.keys()]);
+  if (previous) {
+    for (const root of groupByRoot(normalizeManifest(previous).exports).keys()) {
+      allRoots.add(root);
+    }
+  }
+  for (const root of [...allRoots].sort()) {
+    if (!byRoot.has(root)) {
+      await reconcileOneRoot(cwd, root, {});
+    }
+  }
+  for (const root of [...byRoot.keys()].sort()) {
+    await reconcileOneRoot(cwd, root, byRoot.get(root));
+  }
+}
+async function syncLocalExports(options) {
+  return reconcileLocalExports(options);
+}
+module.exports = {
+  makeLocalExportsManifest,
+  reconcileLocalExports,
+  syncLocalExports,
+  localExportsNeedInstall,
+  resolveLocalExportsConfig,
+  localExportsScanIgnores
+};
+
+
 /***/ }),
 
 /***/ "./lib/local-pkg-builder.ts":
@@ -4891,7 +5363,12 @@ class LocalPkgBuilder {
     }, {});
     logger.debug("local pkgs for build all paths", allPaths, "uniq paths", uniqPaths);
     for (const path of uniqPaths) {
-      await this.addItem(byPathLookup[path]);
+      try {
+        await this.addItem(byPathLookup[path]);
+      } catch (error) {
+        this._startError = error;
+        break;
+      }
     }
     logger.debug("resolving build local _started promise");
     this._started.resolve();
@@ -4930,6 +5407,9 @@ class LocalPkgBuilder {
       logger.debug("waiting for local build item start, fullPath:", fullPath);
       await this._started.promise;
     }
+    if (this._startError) {
+      return { error: this._startError };
+    }
     const x = this._waitItems[fullPath];
     if (x && x.promise) {
       logger.debug("waiting for build local item", fullPath, x);
@@ -5386,6 +5866,7 @@ module.exports = PkgBinLinker;
 "use strict";
 
 const Fs = __webpack_require__("./lib/util/file-ops.ts");
+const Path = __webpack_require__("path");
 const PkgBinLinkerBase = __webpack_require__("./lib/pkg-bin-linker-base.ts");
 const CYGWIN_LINK = `#!/bin/sh
 basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
@@ -5441,6 +5922,31 @@ class PkgBinLinkerWin32 extends PkgBinLinkerBase {
     await this._unlinkFile(symlink);
     await this._unlinkFile(symlink + ".cmd");
   }
+  // Extract the {{TARGET}} path baked into a generated .cmd wrapper (the path
+  // after `%~dp0\`, ignoring the node.exe reference).
+  async _readBinLinkTarget(symlink) {
+    const content = (await Fs.readFile(symlink + ".cmd")).toString();
+    const matches = [...content.matchAll(/%~dp0[\\/]+([^"\r\n]+)/g)].map((m) => m[1]);
+    return matches.find((m) => m !== "node.exe");
+  }
+  //
+  // Platform specific: the "bin" is a pair of regular script files (cygwin +
+  // .cmd), not a symlink, so the base _cleanLink's Fs.access on the wrapper
+  // always succeeds and never cleans a stale bin. Instead, read the wrapper and
+  // remove it only if the target it points to no longer exists.
+  //
+  async _cleanLink(sym) {
+    const symlink = Path.join(this._binDir, sym);
+    try {
+      const target = await this._readBinLinkTarget(symlink);
+      if (target && await Fs.exists(Path.join(this._binDir, target))) {
+        return false;
+      }
+    } catch (e) {
+    }
+    await this._rmBinLink(symlink);
+    return true;
+  }
   async _readBinLinks() {
     return (await Fs.readdir(this._binDir)).filter((x) => !x.endsWith(".cmd"));
   }
@@ -5636,6 +6142,7 @@ const Fs = __webpack_require__("./lib/util/file-ops.ts");
 const _ = __webpack_require__("./node_modules/.f/_/lodash/4.17.21/lodash/lodash.min.js");
 const chalk = __webpack_require__("./node_modules/.f/_/chalk/4.1.2/chalk/source/index.js");
 const simpleSemverCompare = (__webpack_require__("./lib/util/semver.ts").simpleCompare);
+const Semver = __webpack_require__("./node_modules/.f/_/semver/7.8.0/semver/index.js");
 const Yaml = __webpack_require__("./node_modules/.f/_/yamljs/0.3.0/yamljs/lib/Yaml.js");
 const sortObjKeys = __webpack_require__("./lib/util/sort-obj-keys.ts");
 const {
@@ -5830,7 +6337,10 @@ class PkgDepLocker {
       const versions = {};
       _.each(sorted, (version) => {
         const vpkg = locked[version];
-        if (!_.isEmpty(vpkg) && vpkg._valid !== false) {
+        const isLocalVpkg = vpkg && vpkg.$ === "local";
+        const badVersionKey = !isLocalVpkg && !Semver.valid(version);
+        const badDeps = vpkg && vpkg.dependencies && !this._depsResolvable(vpkg.dependencies);
+        if (!_.isEmpty(vpkg) && vpkg._valid !== false && !badVersionKey && !badDeps) {
           if (vpkg.$ === "local") {
             vpkg.local = true;
             vpkg.dist = {
@@ -5853,6 +6363,15 @@ class PkgDepLocker {
           }
           versions[version] = vpkg;
         } else {
+          if (badVersionKey) {
+            logger.error(
+              `lockfile entry for ${item.name} has invalid version key "${version}" - ignoring and re-resolving from registry`
+            );
+          } else if (badDeps) {
+            logger.error(
+              `lockfile entry ${item.name}@${version} has dependencies not satisfiable within the lock (corrupt lock) - ignoring and re-resolving from registry`
+            );
+          }
           valid = false;
         }
       });
@@ -5874,6 +6393,37 @@ class PkgDepLocker {
     }
     return valid && locked;
   }
+  //
+  // Check that every recorded dependency pin can be resolved within the lock data.
+  // A healthy fyn lock is self-contained: every locked package's dependency specs are
+  // satisfied by some version that also has a lock entry. A pin that points at a version
+  // absent from the lock signals corruption (e.g. a version block's deps got swapped
+  // during a rebase/merge), so the entry must be dropped and re-resolved.
+  //
+  _depsResolvable(deps) {
+    for (const depName in deps) {
+      if (!this._isDepResolvable(depName, deps[depName])) {
+        return false;
+      }
+    }
+    return true;
+  }
+  _isDepResolvable(depName, spec) {
+    const depLock = this._lockData[depName];
+    if (!depLock) return true;
+    let versions;
+    let rangeMap;
+    if (depLock.versions) {
+      versions = Object.keys(depLock.versions);
+      rangeMap = depLock[LOCK_RSEMVERS] || {};
+    } else {
+      versions = Object.keys(depLock).filter((k) => !k.startsWith("_"));
+      rangeMap = depLock._ || {};
+    }
+    if (Object.prototype.hasOwnProperty.call(rangeMap, spec)) return true;
+    if (!Semver.validRange(spec)) return true;
+    return versions.some((v) => Semver.valid(v) && Semver.satisfies(v, spec));
+  }
   /**
    * Set the package.json's dependencies items and check if they changed from
    * lock data.
@@ -5881,6 +6431,7 @@ class PkgDepLocker {
    * - dependencies
    * - optionalDependencies
    * - devDependencies
+   *
    * @param {*} pkgDepItems - dep items generated by makePkgDepItems in pkg-dep-resolver.js
    *
    * @returns {*} none
@@ -6044,6 +6595,14 @@ class PkgDepLocker {
       if (!Path.isAbsolute(filename)) filename = Path.resolve(filename);
       const data = (await Fs.readFile(filename)).toString();
       this._shaSum = this.shasum(data);
+      if (/^(<<<<<<<|=======|>>>>>>>)/m.test(data)) {
+        logger.error(
+          `lockfile ${filename} has git conflict markers - ignoring it and re-resolving from registry`
+        );
+        this._shaSum = Date.now();
+        this._lockData = {};
+        return false;
+      }
       this._lockData = Yaml.parse(data);
       const basedir = Path.dirname(filename);
       this._fullLocalPath(basedir);
@@ -6102,6 +6661,7 @@ const logFormat = __webpack_require__("./lib/util/log-format.ts");
 const { LONG_WAIT_META } = __webpack_require__("./lib/log-items.ts");
 const { checkPkgOsCpu, relativePath, unSlashNpmScope } = __webpack_require__("./lib/util/fyntil.ts");
 const { getDepSection, makeDepStep } = __webpack_require__("./node_modules/.f/_/@fynpo/base/1.1.22-fynlocal_h/@fynpo/base/dist/index.js");
+const { violatesRegistryPolicy } = __webpack_require__("./lib/util/registry-dep-policy.ts");
 const xaa = __webpack_require__("./lib/util/xaa.ts");
 const { AggregateError } = __webpack_require__("./node_modules/.f/_/@jchip/error/1.0.3/@jchip/error/dist/index.js");
 const Promise = __webpack_require__("./node_modules/.f/_/aveazul/1.1.0/aveazul/cjs-entry.cjs");
@@ -6368,6 +6928,31 @@ class PkgDepResolver {
     }
     return semver;
   }
+  /**
+   * Enforce the `fyn.enforceRegistryDeps` policy on a transitive dep item.
+   * Throws (aborting the install) when the item is a non-registry source or has
+   * an unparseable semver.
+   *
+   * @param {object} item - the (transitive) dep item being added
+   * @param {object} parent - the dep item that requires `item`
+   * @returns {void}
+   */
+  _enforceRegistryDep(item, parent) {
+    const violation = violatesRegistryPolicy(item);
+    if (!violation) {
+      return;
+    }
+    const depId = `${item.name}@${item.semver}`;
+    let reason = `has an invalid/unparseable version "${violation.semver}"`;
+    if (violation.kind === "url") {
+      reason = `is from a non-registry source (${violation.urlType})`;
+    } else if (violation.kind === "local") {
+      reason = `is a local dependency declared below a non-registry source (${violation.urlType})`;
+    }
+    throw new Error(
+      `fyn.enforceRegistryDeps: transitive dependency "${depId}" required by "${parent.id}" ${reason}. Only the top-level package.json may use git/github/URL dependencies - transitive dependencies must come from a registry.`
+    );
+  }
   /**
    * create the dep relation items for a package
    *
@@ -6403,6 +6988,9 @@ class PkgDepResolver {
             deepResolve
           };
           const newItem = new DepItem(opt, depItem);
+          if (this._fyn.enforceRegistryDeps && depItem.depth >= 1) {
+            this._enforceRegistryDep(newItem, depItem);
+          }
           if (noPrefetch !== true) this.prefetchMeta(newItem);
           items.push(newItem);
         }
@@ -6574,6 +7162,15 @@ class PkgDepResolver {
       }
     }
     const metaJson = meta.versions[resolved];
+    const localFromMeta = meta.local || metaJson.local;
+    if (localFromMeta) {
+      if (!item.localType) {
+        item.localType = localFromMeta;
+      }
+      if (this._fyn.enforceRegistryDeps && item.parent.depth >= 1) {
+        this._enforceRegistryDep(item, item.parent);
+      }
+    }
     const platformCheck = () => {
       const sysCheck2 = checkPkgOsCpu(metaJson);
       if (sysCheck2 !== true) {
@@ -6630,11 +7227,7 @@ class PkgDepResolver {
         pkgV.hasI = 1;
       }
     }
-    const localFromMeta = meta.local || metaJson.local;
     if (localFromMeta) {
-      if (!item.localType) {
-        item.localType = localFromMeta;
-      }
       pkgV.local = item.localType;
       item.fullPath = pkgV.dir = pkgV.dist.fullPath;
       pkgV.str = meta.jsonStr;
@@ -7108,9 +7701,9 @@ ${item.depPath.join(" > ")}`
           throw new Error(failMetaMsg(item.name));
         }
         const updated = this._fyn.depLocker.update(item, meta);
-        const r2 = this._resolveWithMeta({ item, meta: updated, force: false, noLocal: true });
-        if (r2) {
-          return r2;
+        const resolved = this._resolveWithMeta({ item, meta: updated, force: false, noLocal: true });
+        if (resolved) {
+          return resolved;
         }
         logger.debug(
           `cached meta for ${item.name} has no version satisfying ${item.semver}; refetching from registry`
@@ -7128,7 +7721,7 @@ ${item.depPath.join(" > ")}`
           });
         });
       }).catch((err) => {
-        if (item.dsrc !== "opt") {
+        if (!item.dsrc || !item.dsrc.includes("opt")) {
           if (err.message.includes("Unable to retrieve meta")) {
             throw err;
           } else {
@@ -7186,7 +7779,13 @@ class PkgDistExtractor {
     });
     this._fyn = options.fyn;
     this._promiseQ.on("done", (x) => this.done(x));
-    this._promiseQ.on("failItem", (x) => logger.error("dist extractor failed item", x.error));
+    this._promiseQ.on("failItem", (x) => {
+      logger.error("dist extractor failed item", x.error);
+      const listener = _.get(x, "item.listener");
+      if (listener) {
+        setTimeout(() => listener.emit("fail", x.error), 0);
+      }
+    });
   }
   addPkgDist(data) {
     this._promiseQ.addItem(data);
@@ -7244,6 +7843,10 @@ class PkgDistExtractor {
     } else {
       const json = await this._fyn.ensureProperPkgDir(pkg, fullOutDir);
       if (json) {
+        if (data.listener) {
+          const listener = data.listener;
+          setTimeout(() => listener.emit("done", json), 0);
+        }
         return json;
       }
       await this._fyn.createPkgOutDir(fullOutDir);
@@ -7451,6 +8054,7 @@ class PkgDistFetcher {
   }
   /**
    * Check if pkg already has a copy extracted to node_modules
+   *
    * @param {*} pkg - package info
    * @returns {*} pkg in FV_DIR and its package.json
    */
@@ -7533,8 +8137,14 @@ const logger = __webpack_require__("./lib/logger.ts");
 const logFormat = __webpack_require__("./lib/util/log-format.ts");
 const fynTil = __webpack_require__("./lib/util/fyntil.ts");
 const hardLinkDir = __webpack_require__("./lib/util/hard-link-dir.ts");
+const {
+  makeLocalExportsManifest,
+  reconcileLocalExports,
+  resolveLocalExportsConfig
+} = __webpack_require__("./lib/local-exports.ts");
 const { INSTALL_PACKAGE } = __webpack_require__("./lib/log-items.ts");
 const { runNpmScript } = __webpack_require__("./lib/util/run-npm-script.ts");
+const { evaluateScriptPolicy, isScriptAllowed } = __webpack_require__("./lib/util/lifecycle-script-policy.ts");
 const xaa = __webpack_require__("./lib/util/xaa.ts");
 const { AggregateError } = __webpack_require__("./node_modules/.f/_/@jchip/error/1.0.3/@jchip/error/dist/index.js");
 const { RESOLVE_ORDER, RSEMVERS, LOCK_RSEMVERS, SEMVER } = __webpack_require__("./lib/symbols.ts");
@@ -7616,7 +8226,7 @@ class PkgInstaller {
       } catch (err) {
         if (err.code === "EPERM") {
           const st = await Fs.stat(pkgJsonFp);
-          await Fs.chmod(pkgJsonFp, st.mode + 384);
+          await Fs.chmod(pkgJsonFp, st.mode | 384);
           await Fs.writeFile(pkgJsonFp, `${outputStr}
 `);
         }
@@ -7688,7 +8298,7 @@ class PkgInstaller {
     if (depInfo._removing) return;
     depInfo._removing = true;
     const optReqs = depInfo.requests.map((req) => {
-      return req.reverse().find((r) => r.startsWith("opt"));
+      return req.slice().reverse().find((r) => r.startsWith("opt"));
     });
     const failedId = `${depInfo.name}@${depInfo.version}`;
     for (const r of optReqs) {
@@ -7811,12 +8421,27 @@ class PkgInstaller {
       if (this._fyn.showDeprecated && _.isEmpty(warned)) {
         logger.info(chalk.green("HOORAY!!! None of your dependencies are marked deprecated."));
       }
-    }).then(() => this._saveLockData()).then(() => {
+    }).then(() => this._installLocalExports()).then(() => this._saveLockData()).then(() => {
       logger.info(`${chalk.green("done install")} ${logFormat.time(Date.now() - start)}`);
     }).finally(() => {
       logger.removeItem(INSTALL_PACKAGE);
     });
   }
+  async _installLocalExports() {
+    const pkgsData = this._data.getPkgsData();
+    const config = resolveLocalExportsConfig(this._fyn._pkg);
+    const manifest = await makeLocalExportsManifest({
+      cwd: this._fyn._cwd,
+      config,
+      depInfos: this.toLink.filter((depInfo) => {
+        const versions = pkgsData[depInfo.name];
+        return versions && versions[depInfo.version] === depInfo;
+      })
+    });
+    const previous = this._fyn._installConfig.localExports;
+    await reconcileLocalExports({ cwd: this._fyn._cwd, manifest, previous });
+    this._fyn.setLocalExports(manifest);
+  }
   async _buildLocalPkg(depInfo) {
     if (this._fyn._options.buildLocal && this._fyn._localPkgBuilder) {
       const itemRes = await this._fyn._localPkgBuilder.waitForItem(depInfo.dir);
@@ -7848,25 +8473,60 @@ class PkgInstaller {
     }
     json._fyn = {};
     const scripts = json.scripts || {};
+    const scriptPolicy = evaluateScriptPolicy(depInfo, this._fyn.allowScripts, {
+      allowTopLevel: this._fyn.allowTopLevelScripts
+    });
+    const blockedScripts = [];
+    const isAllowed = (scriptName) => {
+      if (isScriptAllowed(scriptPolicy, scriptName)) {
+        return true;
+      }
+      blockedScripts.push(scriptName);
+      return false;
+    };
     const hasPI = json.hasPI || Boolean(scripts.preinstall);
     const piExed = Boolean(depInfo.preinstall);
     if (!piExed && hasPI) {
       if (depInfo.preInstalled) {
         json._fyn.preinstall = true;
-      } else {
+      } else if (isAllowed("preinstall")) {
         logger.debug("adding preinstall step for", depInfo.dir);
         this.preInstall.push(depInfo);
       }
     }
     this.toLink.push(depInfo);
     const install = ["install", "postinstall"].filter((x) => {
-      return Boolean(scripts[x]) && !json._fyn[x];
+      return Boolean(scripts[x]) && !json._fyn[x] && isAllowed(x);
     });
     if (install.length > 0) {
       logger.debug("adding install step for", depInfo.dir, install);
       depInfo.install = install;
       this.postInstall.push(depInfo);
     }
+    if (blockedScripts.length > 0) {
+      this._warnBlockedScripts(depInfo, scriptPolicy, blockedScripts);
+    }
+  }
+  _warnBlockedScripts(depInfo, policy, blocked) {
+    const id = logFormat.pkgId(depInfo);
+    logger.warn(
+      `${chalk.black.bgYellow("WARN")} ${chalk.magenta("scripts blocked")} ${id}`,
+      chalk.yellow(
+        `skipped lifecycle [${blocked.join(", ")}] for non-registry (${policy.urlType}) package - not in fyn.allowScripts`
+      )
+    );
+    logger.verbose(
+      chalk.blue("  To allow, add to package.json:"),
+      chalk.cyan(
+        `"fyn": { "allowScripts": { "${policy.key}": [${blocked.map((s) => `"${s}"`).join(", ")}] } }`
+      )
+    );
+    if (policy.topLevel) {
+      logger.verbose(
+        chalk.blue("  Or trust all direct deps' scripts with:"),
+        chalk.cyan(`"fyn": { "allowTopLevelScripts": true }`)
+      );
+    }
   }
   _cleanBin() {
     logger.updateItem(INSTALL_PACKAGE, "cleaning node_modules/.bin");
@@ -8068,6 +8728,8 @@ const PkgDepLinker = __webpack_require__("./lib/pkg-dep-linker.ts");
 const semverUtil = __webpack_require__("./lib/util/semver.ts");
 const { readPkgJson } = __webpack_require__("./lib/util/fyntil.ts");
 const { OPTIONAL_RESOLVER } = __webpack_require__("./lib/log-items.ts");
+const { DEP_ITEM, SEMVER } = __webpack_require__("./lib/symbols.ts");
+const { evaluateScriptPolicy, isScriptAllowed } = __webpack_require__("./lib/util/lifecycle-script-policy.ts");
 xsh.Promise = Promise;
 class PkgOptResolver {
   constructor(options) {
@@ -8130,6 +8792,32 @@ class PkgOptResolver {
   // - 0: add item back to resolve
   // - not: add item to queue for logging at end
   //
+  /**
+   * Evaluate the lifecycle-script policy for an optional dep's preinstall.
+   *
+   * Non-registry (github/git/url) optional deps do not run preinstall unless
+   * whitelisted via `fyn.allowScripts` / `fyn.allowTopLevelScripts` - the same
+   * deny-by-default policy the regular installer enforces (FPM-41). Registry
+   * and local deps are trusted and always allowed.
+   *
+   * @param {object} item the optional dep's DepItem
+   * @param {string} name package name
+   * @param {string} version resolved version
+   * @returns {{allowed:boolean, policy:object}} the policy decision
+   */
+  checkPreinstallPolicy(item, name, version) {
+    const optDepInfo = {
+      [DEP_ITEM]: item,
+      [SEMVER]: item.semver,
+      name,
+      version,
+      top: !_.get(item, ["parent", "depth"])
+    };
+    const policy = evaluateScriptPolicy(optDepInfo, this._fyn.allowScripts, {
+      allowTopLevel: this._fyn.allowTopLevelScripts
+    });
+    return { allowed: isScriptAllowed(policy, "preinstall"), policy };
+  }
   /* eslint-disable max-statements */
   optCheck(data) {
     const name = data.item.name;
@@ -8248,6 +8936,17 @@ class PkgOptResolver {
         );
         return { passed: true };
       } else if (_.get(res, "pkg.scripts.preinstall")) {
+        const { allowed, policy } = this.checkPreinstallPolicy(data.item, name, version);
+        if (!allowed) {
+          logger.warn(
+            `${chalk.black.bgYellow("WARN")} ${chalk.magenta("scripts blocked")} ${displayId}`,
+            chalk.yellow(
+              `skipped optional preinstall for non-registry (${policy.urlType}) package - not in fyn.allowScripts`
+            )
+          );
+          logPass("preinstall blocked by script policy - keeping optional package");
+          return { passed: true };
+        }
         data.runningScript = true;
         logger.updateItem(OPTIONAL_RESOLVER, `running preinstall for ${displayId}`);
         const ls = new LifecycleScripts({
@@ -8346,12 +9045,19 @@ const { PackageRef } = __webpack_require__("./node_modules/.f/_/@fynpo/base/1.1.
 const Arborist = __webpack_require__("./node_modules/.f/_/@npmcli/arborist/9.1.6/@npmcli/arborist/lib/index.js");
 const WATCH_TIME = 5e3;
 const META_CACHE_STALE_TIME = 24 * 60 * 60 * 1e3;
+const SAFE_GIT_TOKEN = /^[A-Za-z0-9._/~^-]+$/;
+function isSafeGitToken(s) {
+  return typeof s === "string" && s.length > 0 && s.length < 256 && SAFE_GIT_TOKEN.test(s) && !s.startsWith("-");
+}
+function isPinnedGitCommit(semver) {
+  if (!semver) return false;
+  const committish = semver.includes("#") ? semver.split("#")[1] : semver;
+  return /^[a-f0-9]{40}$/.test(committish);
+}
 async function checkGitRepoHasNewCommits(gitUrl, ref, cachedCommitHash) {
   if (!cachedCommitHash) return true;
   try {
-    const { execSync } = __webpack_require__("child_process");
-    const Path2 = __webpack_require__("path");
-    const fs2 = __webpack_require__("fs");
+    const { execFileSync } = __webpack_require__("child_process");
     let actualGitUrl = gitUrl;
     let isLocalRepo = false;
     let localRepoPath = null;
@@ -8363,10 +9069,15 @@ async function checkGitRepoHasNewCommits(gitUrl, ref, cachedCommitHash) {
       }
     } else if (!gitUrl.includes("://")) {
       isLocalRepo = true;
-      localRepoPath = Path2.resolve(gitUrl);
+      localRepoPath = Path.resolve(gitUrl);
     }
     if (isLocalRepo && localRepoPath) {
-      const output = execSync(`git rev-parse ${ref || "HEAD"}`, {
+      const safeRef = ref || "HEAD";
+      if (!isSafeGitToken(safeRef)) {
+        logger.debug(`refusing potentially unsafe git ref: ${safeRef}`);
+        return null;
+      }
+      const output = execFileSync("git", ["rev-parse", safeRef], {
         cwd: localRepoPath,
         stdio: "pipe",
         encoding: "utf8",
@@ -8389,7 +9100,12 @@ async function checkGitRepoHasNewCommits(gitUrl, ref, cachedCommitHash) {
       } else {
         actualGitUrl = gitUrl;
       }
-      const output = execSync(`git ls-remote ${actualGitUrl} ${ref || "HEAD"}`, {
+      const safeRef = ref || "HEAD";
+      if (!isSafeGitToken(safeRef) || actualGitUrl.startsWith("-")) {
+        logger.debug(`refusing potentially unsafe git url/ref: ${actualGitUrl}#${safeRef}`);
+        return null;
+      }
+      const output = execFileSync("git", ["ls-remote", actualGitUrl, safeRef], {
         stdio: "pipe",
         encoding: "utf8",
         timeout: 1e4
@@ -8626,16 +9342,17 @@ class PkgSrcManager {
       logger.debug(`pacote.packument ${qItem.packumentUrl}`);
       const promise2 = pacote.packument(
         pkgName,
+        // pacote 21 / npm-registry-fetch 19 read camelCase options; the old
+        // kebab-case names were silently ignored. preferOnline forces a server
+        // revalidation (cache mode "no-cache") for this refresh path.
         this.getPacoteOpts({
-          "full-metadata": true,
-          "fetch-retries": 3,
-          "cache-policy": "ignore",
-          "cache-key": qItem.cacheKey,
+          fullMetadata: true,
+          fetchRetries: 3,
+          preferOnline: true,
           memoize: false
         })
       );
       return promise2.then((x) => {
-        this._metaStat.inTx--;
         if (!x) {
           const msg = `pacote returned null/undefined for packument of ${pkgName}`;
           logger.error(chalk.yellow(msg));
@@ -8656,6 +9373,7 @@ class PkgSrcManager {
     this.updateFetchMetaStatus(false);
     const promise = qItem.item.urlType ? this.fetchUrlSemverMeta(qItem.item) : pacoteRequest();
     return promise.then((x) => {
+      this._metaStat.inTx--;
       const time = Date.now() - startTime;
       if (time > 20 * 1e3) {
         logger.info(
@@ -8670,10 +9388,11 @@ class PkgSrcManager {
         qItem.defer.reject(new AggregateError([new Error(msg)], msg));
         return;
       }
-      refreshCacheEntry(this._fyn._fynCacheDir, qItem.cacheKey).catch(() => {
+      refreshCacheEntry(this._cacheDir, qItem.cacheKey).catch(() => {
       });
       qItem.defer.resolve(x);
     }).catch((err) => {
+      this._metaStat.inTx--;
       qItem.defer.reject(err);
     });
   }
@@ -8715,19 +9434,7 @@ class PkgSrcManager {
     } else {
       dirPacker = this._getPacoteDirPacker();
     }
-    let pacoteOpts = { dirPacker };
-    if (item.urlType.startsWith("git") && item.semver && !item.semver.match(/^[a-f0-9]{40}$/)) {
-      const potentialCacheKeys = [
-        // Try common cache key patterns based on semver
-        `fyn-tarball-for-git+https://github.com/${item.semver.replace(/^github:/, "").split("#")[0]}.git#`,
-        `fyn-tarball-for-git+ssh://git@github.com/${item.semver.replace(/^github:/, "").split("#")[0]}.git#`
-      ];
-      for (const baseKey of potentialCacheKeys) {
-        try {
-        } catch (e) {
-        }
-      }
-    }
+    const pacoteOpts = { dirPacker };
     return pacote.manifest(`${item.name}@${item.semver}`, this.getPacoteOpts(pacoteOpts)).then((manifest) => {
       manifest = Object.assign({}, manifest);
       return {
@@ -8751,9 +9458,10 @@ class PkgSrcManager {
     let integrity;
     let shouldRefresh = false;
     if (tgzCacheInfo) {
-      const cachedResolved = tgzCacheInfo.metadata?._resolved || (tgzCacheInfo.metadata?.dist?.tarball?.match(/MARK_URL_SPEC(.+)/)?.[1] ? JSON.parse(tgzCacheInfo.metadata.dist.tarball.match(/MARK_URL_SPEC(.+)/)[1])._resolved : null);
+      const cachedTarball = tgzCacheInfo.metadata?.dist?.tarball;
+      const cachedResolved = tgzCacheInfo.metadata?._resolved || (cachedTarball?.startsWith(MARK_URL_SPEC) ? JSON.parse(cachedTarball.slice(MARK_URL_SPEC.length))._resolved : null);
       const cachedCommitHash = cachedResolved?.match(/#([a-f0-9]{40})$/)?.[1];
-      if (!shouldRefresh && cachedCommitHash && item.semver && !item.semver.match(/^[a-f0-9]{40}$/)) {
+      if (!shouldRefresh && cachedCommitHash && item.semver && !isPinnedGitCommit(item.semver)) {
         let gitUrl = item.semver;
         let ref = "HEAD";
         if (gitUrl.includes("#")) {
@@ -8776,17 +9484,15 @@ class PkgSrcManager {
           logger.debug(
             `git cache for '${item.name}' has new commits (cached: ${cachedCommitHash.substring(0, 8)}, checking ${ref}), forcing refresh`
           );
-        } else {
-          if (tgzCacheInfo.refreshTime) {
-            const stale = Date.now() - tgzCacheInfo.refreshTime;
-            const staleByTime = stale >= META_CACHE_STALE_TIME;
-            if (staleByTime) {
-              shouldRefresh = true;
-              const reason = hasNewCommits === null ? "ls-remote failed" : "no new commits";
-              logger.debug(
-                `git cache for '${item.name}' (${reason}), cache is stale by time (${(stale / 1e3 / 60 / 60).toFixed(1)}h old), forcing refresh`
-              );
-            }
+        } else if (tgzCacheInfo.refreshTime) {
+          const stale = Date.now() - tgzCacheInfo.refreshTime;
+          const staleByTime = stale >= META_CACHE_STALE_TIME;
+          if (staleByTime) {
+            shouldRefresh = true;
+            const reason = hasNewCommits === null ? "ls-remote failed" : "no new commits";
+            logger.debug(
+              `git cache for '${item.name}' (${reason}), cache is stale by time (${(stale / 1e3 / 60 / 60).toFixed(1)}h old), forcing refresh`
+            );
           }
         }
       } else if (!shouldRefresh && tgzCacheInfo.refreshTime) {
@@ -8860,6 +9566,7 @@ class PkgSrcManager {
     const cacheKey = `make-fetch-happen:request-cache:${packumentUrl}`;
     const legacyCacheKey = `make-fetch-happen:request-cache:full:${packumentUrl}`;
     const cacheKeys = [cacheKey, legacyCacheKey];
+    let cacheMemoized = false;
     const loadCachedPackument = async (key, memoize = true) => {
       try {
         const cached = await cacache.get(this._cacheDir, key, { memoize });
@@ -8882,6 +9589,33 @@ class PkgSrcManager {
       }
       return _.maxBy(cachedEntries, (cached) => cached.refreshTime || 0) || cachedEntries[0];
     };
+    const loadPreparedUrlMeta = async () => {
+      const info = await getCacheInfoWithRefreshTime(
+        this._cacheDir,
+        `fyn-tarball-for-${item.semver}`
+      );
+      const cachedManifest = info && info.metadata;
+      if (!(cachedManifest && cachedManifest.version)) {
+        return void 0;
+      }
+      const tarball = JSON.stringify(
+        Object.assign(
+          _.pick(item, ["urlType", "semver"]),
+          _.pick(cachedManifest, ["_resolved", "_id"])
+        )
+      );
+      const manifest = Object.assign({}, cachedManifest, {
+        dist: {
+          integrity: info.integrity,
+          tarball: `${MARK_URL_SPEC}${tarball}`
+        }
+      });
+      return {
+        name: item.name,
+        versions: { [manifest.version]: manifest },
+        urlVersions: { [item.semver]: manifest }
+      };
+    };
     const readMemoizedPackument = async () => {
       const memoized = await loadBestCachedPackument(false);
       if (!(memoized && memoized.data)) {
@@ -8892,7 +9626,11 @@ class PkgSrcManager {
       this._metaStat.wait--;
       return JSON.parse(memoized.data.toString());
     };
+    let fetchAttempted = false;
+    let foundCache;
+    let foundPackument;
     const queueMetaFetchRequest = (cached) => {
+      fetchAttempted = true;
       const offline = this._fyn.remoteMetaDisabled;
       if (cached && this._fyn.forceCache) {
         this._metaStat.wait--;
@@ -8917,18 +9655,24 @@ class PkgSrcManager {
       return netQItem.defer.promise;
     };
     this._metaStat.wait++;
-    let foundCache;
-    let cacheMemoized = false;
     const metaMemoizeUrl = this._fyn._options.metaMemoize;
-    const promise = (item.urlType || forceRefresh ? (
-      // when the semver is a url then the meta is not from npm registry and
-      // we can't use the cache for registry.
-      // when forceRefresh, skip the local cacache + meta-mem path so we go
-      // straight to a fresh registry fetch via queueMetaFetchRequest.
-      Promise.resolve()
-    ) : loadBestCachedPackument(true)).then((cached) => {
-      const packument = cached && cached.data && JSON.parse(cached.data);
+    let cacheLookup;
+    if (item.urlType) {
+      cacheLookup = this._fyn.remoteMetaDisabled ? loadPreparedUrlMeta().then((preparedUrlMeta) => ({ preparedUrlMeta })) : Promise.resolve();
+    } else if (forceRefresh) {
+      cacheLookup = Promise.resolve();
+    } else {
+      cacheLookup = loadBestCachedPackument(true);
+    }
+    const promise = cacheLookup.then((cached) => {
+      if (cached && cached.preparedUrlMeta) {
+        cacheMemoized = true;
+        this._metaStat.wait--;
+        return cached.preparedUrlMeta;
+      }
       foundCache = cached;
+      const packument = cached && cached.data && JSON.parse(cached.data);
+      foundPackument = packument;
       if (cached && cached.refreshTime) {
         const stale = Date.now() - cached.refreshTime;
         const since = (stale / 1e3).toFixed(2);
@@ -8971,10 +9715,19 @@ class PkgSrcManager {
         return queueMetaFetchRequest(packument);
       }
     }).catch((err) => {
+      if (fetchAttempted) {
+        if (foundPackument) {
+          cacheMemoized = true;
+          logger.warn(
+            `failed to refresh packument for '${pkgName}', using stale cached metadata: ${err.message}`
+          );
+          return foundPackument;
+        }
+        throw err;
+      }
       if (foundCache) {
         const data = foundCache.data && foundCache.data.toString();
         logger.debug(`fail to process packument cache - ${err.message}; data ${data}`);
-        throw err;
       }
       return queueMetaFetchRequest();
     }).then((meta) => {
@@ -9038,7 +9791,7 @@ class PkgSrcManager {
       return passthrough2;
     }
     const opts = this.getPacoteOpts({
-      fullMeta: true,
+      fullMetadata: true,
       integrity,
       resolved: tarballUrl
     });
@@ -9155,6 +9908,7 @@ class PkgSrcManager {
 }
 module.exports = PkgSrcManager;
 module.exports.META_CACHE_STALE_TIME = META_CACHE_STALE_TIME;
+module.exports.isPinnedGitCommit = isPinnedGitCommit;
 
 
 /***/ }),
@@ -9267,7 +10021,8 @@ async function checkPkgNeedInstall(dir, checkCtime = 0) {
       hasScript
     };
   } catch (error) {
-    return { install: false, error };
+    logger.warn(`unable to determine if local package at ${dir} needs install: ${error.message}`);
+    throw error;
   }
 }
 exports.checkPkgNeedInstall = checkPkgNeedInstall;
@@ -9402,6 +10157,67 @@ const fyntil = {
       return fyntil.fynpoConfig = {};
     }
   },
+  /**
+   * Detect if `dir` lives inside a git linked worktree and, if so, resolve the
+   * equivalent directory in the repo's main worktree.
+   *
+   * fynpo uses `<monorepo>/.fynpo/_store` as the central package store. When the
+   * monorepo is checked out as a git linked worktree, each worktree would
+   * otherwise get its own `.fynpo` store - wasteful and slow. Pointing them at
+   * the main worktree's store lets all worktrees share one central store.
+   *
+   * @param dir directory to resolve (typically the fynpo monorepo top dir)
+   * @returns the equivalent directory in the main worktree, or `dir` unchanged
+   *          when it's not in a git repo or already in the main worktree.
+   */
+  async resolveGitMainWorktreeDir(dir) {
+    const startDir = Path.resolve(dir);
+    let treeTop = startDir;
+    let gitPath;
+    let gitStat;
+    for (; ; ) {
+      try {
+        const p = Path.join(treeTop, ".git");
+        gitStat = await Fs.stat(p);
+        gitPath = p;
+        break;
+      } catch (err) {
+        if (err.code !== "ENOENT") {
+          throw err;
+        }
+      }
+      const parent = Path.dirname(treeTop);
+      if (parent === treeTop) {
+        break;
+      }
+      treeTop = parent;
+    }
+    if (!gitPath || gitStat.isDirectory()) {
+      return dir;
+    }
+    try {
+      const gitFile = await Fs.readFile(gitPath, "utf8");
+      const m = gitFile.match(/^gitdir:\s*(.+)$/m);
+      if (!m) {
+        return dir;
+      }
+      let worktreeGitDir = m[1].trim();
+      if (!Path.isAbsolute(worktreeGitDir)) {
+        worktreeGitDir = Path.resolve(treeTop, worktreeGitDir);
+      }
+      const commondir = (await Fs.readFile(Path.join(worktreeGitDir, "commondir"), "utf8")).trim();
+      const commonGitDir = Path.isAbsolute(commondir) ? commondir : Path.resolve(worktreeGitDir, commondir);
+      if (Path.basename(commonGitDir) !== ".git") {
+        return dir;
+      }
+      const mainTreeTop = Path.dirname(commonGitDir);
+      const rel = Path.relative(treeTop, startDir);
+      return Path.join(mainTreeTop, rel);
+    } catch (err) {
+      logger.debug(`resolveGitMainWorktreeDir failed for ${dir}: ${err.message}`);
+      return dir;
+    }
+  },
   removeAuthInfo(rcObj) {
     const rmObj = {};
     for (const key in rcObj) {
@@ -9413,7 +10229,10 @@ const fyntil = {
     return rmObj;
   },
   exit(err) {
-    process.exit(err ? 1 : 0);
+    if (typeof err === "number") {
+      return process.exit(err);
+    }
+    return process.exit(err ? 1 : 0);
   },
   async readJson(file, defaultData) {
     try {
@@ -9807,7 +10626,7 @@ async function linkPackTree({ tree, src, dest, sym1, sourceMaps }) {
   const files = tree[SYM_FILES];
   const destFiles = await prepDestDir(dest);
   for (const file of files) {
-    if (!ci.isCI && file.match(/.+\..+\.map$/)) {
+    if (!ci.isCI && file.match(/\.(js|mjs)\.map$/)) {
       continue;
     }
     destFiles[file] = true;
@@ -9868,6 +10687,133 @@ module.exports = {
 module.exports = __webpack_require__("./node_modules/.f/_/item-queue/1.1.2/item-queue/lib/inflight.js");
 
 
+/***/ }),
+
+/***/ "./lib/util/lifecycle-script-policy.ts":
+/***/ ((module, __unused_webpack_exports, __webpack_require__) => {
+
+"use strict";
+
+const semverUtil = __webpack_require__("./lib/util/semver.ts");
+const { DEP_ITEM, SEMVER } = __webpack_require__("./lib/symbols.ts");
+const TRUSTED_URL_TYPES = /* @__PURE__ */ new Set(["npm"]);
+function getSourceUrlType(depItem) {
+  let item = depItem;
+  while (item) {
+    const analyzed = item.semver ? semverUtil.analyze(item.semver) : {};
+    const urlType = item.urlType || analyzed.urlType;
+    if (urlType) {
+      return urlType;
+    }
+    if (!(item.localType || analyzed.localType)) {
+      return void 0;
+    }
+    item = item.parent;
+  }
+  return void 0;
+}
+function getUrlType(depInfo) {
+  const depItem = depInfo[DEP_ITEM];
+  if (depItem) {
+    return getSourceUrlType(depItem);
+  }
+  const spec = depInfo[SEMVER];
+  if (spec) {
+    return semverUtil.analyze(spec).urlType;
+  }
+  return void 0;
+}
+function isTrustedScriptSource(depInfo) {
+  const urlType = getUrlType(depInfo);
+  return !urlType || TRUSTED_URL_TYPES.has(urlType);
+}
+function makeAllowKeys(depInfo) {
+  const depItem = depInfo[DEP_ITEM];
+  const spec = depItem && depItem.semver || depInfo[SEMVER];
+  const keys = [];
+  if (spec) {
+    keys.push(`${depInfo.name}@${spec}`);
+  }
+  if (depInfo.version && depInfo.version !== spec) {
+    keys.push(`${depInfo.name}@${depInfo.version}`);
+  }
+  return keys;
+}
+function normalizeAllowEntry(value, acc) {
+  if (value === true || value === "*") {
+    acc.allowAll = true;
+    return acc;
+  }
+  let list = [];
+  if (Array.isArray(value)) {
+    list = value;
+  } else if (value !== void 0) {
+    list = [value];
+  }
+  for (const s of list) {
+    if (s === true || s === "*") {
+      acc.allowAll = true;
+    } else if (typeof s === "string") {
+      acc.scripts.add(s.toLowerCase());
+    }
+  }
+  return acc;
+}
+function foldAllowScripts(keys, allowScripts, acc) {
+  let matchedKey;
+  for (const key of keys) {
+    const value = allowScripts && allowScripts[key];
+    if (value !== void 0) {
+      if (!matchedKey) matchedKey = key;
+      normalizeAllowEntry(value, acc);
+    }
+  }
+  return matchedKey;
+}
+function isTopLevelDep(depInfo) {
+  return Boolean(depInfo && depInfo.top);
+}
+function evaluateScriptPolicy(depInfo, allowScripts, options = {}) {
+  const urlType = getUrlType(depInfo);
+  const keys = makeAllowKeys(depInfo);
+  const topLevel = isTopLevelDep(depInfo);
+  if (!urlType || TRUSTED_URL_TYPES.has(urlType)) {
+    return { trusted: true, urlType, allowAll: true, allowed: /* @__PURE__ */ new Set(), key: keys[0], topLevel };
+  }
+  const acc = { allowAll: false, scripts: /* @__PURE__ */ new Set() };
+  const matchedKey = foldAllowScripts(keys, allowScripts, acc);
+  const { allowTopLevel } = options;
+  if (topLevel && allowTopLevel !== void 0 && allowTopLevel !== false) {
+    normalizeAllowEntry(allowTopLevel, acc);
+  }
+  return {
+    trusted: false,
+    urlType,
+    allowAll: acc.allowAll,
+    allowed: acc.scripts,
+    // key to suggest when warning - prefer a matched key, else the spec form
+    key: matchedKey || keys[0],
+    topLevel
+  };
+}
+function isScriptAllowed(policy, scriptName) {
+  if (policy.trusted || policy.allowAll) {
+    return true;
+  }
+  return policy.allowed.has(String(scriptName).toLowerCase());
+}
+module.exports = {
+  TRUSTED_URL_TYPES,
+  getSourceUrlType,
+  getUrlType,
+  isTrustedScriptSource,
+  isTopLevelDep,
+  makeAllowKeys,
+  evaluateScriptPolicy,
+  isScriptAllowed
+};
+
+
 /***/ }),
 
 /***/ "./lib/util/log-format.ts":
@@ -9888,6 +10834,7 @@ module.exports = {
    *  - the part before package name blue
    *  - the package name part magenta
    *  - remaining as is
+   *
    * @param {*} name - package name
    * @param {*} path - path to highlight
    * @returns
@@ -9987,7 +10934,7 @@ function makeNpmEnv(data, opts, prefix, env) {
       if (minimalConfigKeys.includes(normalizedKey) || minimalConfigKeys.includes(key)) {
         const envKey = `npm_config_${normalizedKey}`;
         const val = opts.config[key];
-        if (val != null && typeof val !== "function") {
+        if (val !== null && val !== void 0 && typeof val !== "function") {
           env[envKey] = String(val);
         }
       }
@@ -10054,6 +11001,61 @@ ItemQueue.Promise = __webpack_require__("./lib/util/aveazul.ts");
 module.exports = ItemQueue;
 
 
+/***/ }),
+
+/***/ "./lib/util/registry-dep-policy.ts":
+/***/ ((module, __unused_webpack_exports, __webpack_require__) => {
+
+"use strict";
+
+const Semver = __webpack_require__("./node_modules/.f/_/semver/7.8.0/semver/index.js");
+const { TRUSTED_URL_TYPES, getSourceUrlType } = __webpack_require__("./lib/util/lifecycle-script-policy.ts");
+function isNonRegistryUrlType(urlType) {
+  return Boolean(urlType) && !TRUSTED_URL_TYPES.has(urlType);
+}
+function isValidRegistrySpec(spec) {
+  if (spec === void 0 || spec === null) {
+    return false;
+  }
+  const s = String(spec).trim();
+  if (s === "" || s === "*" || s === "x") {
+    return true;
+  }
+  if (Semver.validRange(s) !== null) {
+    return true;
+  }
+  if (Semver.coerce(s)) {
+    return true;
+  }
+  return /^[a-zA-Z][\w.-]*$/.test(s);
+}
+function violatesRegistryPolicy(dep) {
+  const urlType = dep.urlType;
+  if (urlType) {
+    if (TRUSTED_URL_TYPES.has(urlType)) {
+      return null;
+    }
+    return { kind: "url", urlType };
+  }
+  if (dep.localType) {
+    const sourceUrlType = getSourceUrlType(dep);
+    if (isNonRegistryUrlType(sourceUrlType)) {
+      return { kind: "local", urlType: sourceUrlType };
+    }
+    return null;
+  }
+  if (!isValidRegistrySpec(dep.semver)) {
+    return { kind: "semver", semver: dep.semver };
+  }
+  return null;
+}
+module.exports = {
+  isNonRegistryUrlType,
+  isValidRegistrySpec,
+  violatesRegistryPolicy
+};
+
+
 /***/ }),
 
 /***/ "./lib/util/run-npm-script.ts":
@@ -10160,11 +11162,14 @@ function simpleCompare(a, b) {
   }
   if (partsA[1]) {
     if (partsB[1]) {
+      if (Semver.valid(a) && Semver.valid(b)) {
+        return Semver.rcompare(a, b);
+      }
       return partsA[1] > partsB[1] ? -1 : 1;
     }
-    return -1;
-  } else if (partsB[1]) {
     return 1;
+  } else if (partsB[1]) {
+    return -1;
   } else {
     return 0;
   }
@@ -10448,7 +11453,7 @@ async function _scanFileStats(dir, ignores, baseDir = "") {
 }
 function scanFileStats(dir, options = {}) {
   const ignores = [
-    `**/?(node_modules|.vscode|.DS_Store|coverage|.nyc_output|.fynpo|.git|.github|.gitignore)`,
+    `**/?(node_modules|_fyn|.vscode|.DS_Store|coverage|.nyc_output|.fynpo|.git|.github|.gitignore)`,
     "**/*.?(log|md)"
   ].concat(options.ignores || `**/?(docs|docusaurus|packages|tmp|.etmp|samples|dist)`).concat(options.moreIgnores).filter((x) => x);
   return _scanFileStats(dir, ignores, "");