fyn 3.0.4 → 3.1.0

package/dist/fyn.mjs

@@ -2098,7 +2098,7 @@ var require_signal_exit = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		return function() {};
 	};
 	else {
-		var assert$2 = __require("assert");
+		var assert$3 = __require("assert");
 		var signals$1 = require_signals$3();
 		var isWin = /^win/i.test(process.platform);
 		var EE$7 = __require("events");
@@ -2118,7 +2118,7 @@ var require_signal_exit = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		module.exports = function(cb, opts) {
 			/* istanbul ignore if */
 			if (!processOk(global.process)) return function() {};
-			assert$2.equal(typeof cb, "function", "a callback must be provided for exit handler");
+			assert$3.equal(typeof cb, "function", "a callback must be provided for exit handler");
 			if (loaded === false) load$1();
 			var ev = "exit";
 			if (opts && opts.alwaysLast) ev = "afterexit";
@@ -5782,7 +5782,7 @@ var file_ops_default = wrapWin32Fs(fileOps);
 
 //#endregion
 //#region node_modules/semver/internal/constants.js
-var require_constants$8 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+var require_constants$7 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const SEMVER_SPEC_VERSION = "2.0.0";
 	const MAX_LENGTH = 256;
 	const MAX_SAFE_INTEGER = Number.MAX_SAFE_INTEGER || 
@@ -5820,7 +5820,7 @@ var require_debug$2 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region node_modules/semver/internal/re.js
 var require_re = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const { MAX_SAFE_COMPONENT_LENGTH, MAX_SAFE_BUILD_LENGTH, MAX_LENGTH } = require_constants$8();
+	const { MAX_SAFE_COMPONENT_LENGTH, MAX_SAFE_BUILD_LENGTH, MAX_LENGTH } = require_constants$7();
 	const debug = require_debug$2();
 	exports = module.exports = {};
 	const re = exports.re = [];
@@ -5935,7 +5935,7 @@ var require_identifiers = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#region node_modules/semver/classes/semver.js
 var require_semver$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const debug = require_debug$2();
-	const { MAX_LENGTH, MAX_SAFE_INTEGER } = require_constants$8();
+	const { MAX_LENGTH, MAX_SAFE_INTEGER } = require_constants$7();
 	const { safeRe: re, t } = require_re();
 	const parseOptions = require_parse_options();
 	const { compareIdentifiers } = require_identifiers();
@@ -6121,7 +6121,7 @@ var require_semver$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 
 //#endregion
 //#region node_modules/semver/functions/parse.js
-var require_parse$7 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+var require_parse$6 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const SemVer = require_semver$1();
 	const parse = (version, options, throwErrors = false) => {
 		if (version instanceof SemVer) return version;
@@ -6138,7 +6138,7 @@ var require_parse$7 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region node_modules/semver/functions/valid.js
 var require_valid$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const parse = require_parse$7();
+	const parse = require_parse$6();
 	const valid = (version, options) => {
 		const v = parse(version, options);
 		return v ? v.version : null;
@@ -6149,7 +6149,7 @@ var require_valid$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region node_modules/semver/functions/clean.js
 var require_clean = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const parse = require_parse$7();
+	const parse = require_parse$6();
 	const clean = (version, options) => {
 		const s = parse(version.trim().replace(/^[=v]+/, ""), options);
 		return s ? s.version : null;
@@ -6179,7 +6179,7 @@ var require_inc = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region node_modules/semver/functions/diff.js
 var require_diff$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const parse = require_parse$7();
+	const parse = require_parse$6();
 	const diff = (version1, version2) => {
 		const v1 = parse(version1, null, true);
 		const v2 = parse(version2, null, true);
@@ -6232,7 +6232,7 @@ var require_patch$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region node_modules/semver/functions/prerelease.js
 var require_prerelease = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const parse = require_parse$7();
+	const parse = require_parse$6();
 	const prerelease = (version, options) => {
 		const parsed = parse(version, options);
 		return parsed && parsed.prerelease.length ? parsed.prerelease : null;
@@ -6377,7 +6377,7 @@ var require_cmp = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#region node_modules/semver/functions/coerce.js
 var require_coerce = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const SemVer = require_semver$1();
-	const parse = require_parse$7();
+	const parse = require_parse$6();
 	const { safeRe: re, t } = require_re();
 	const coerce = (version, options) => {
 		if (version instanceof SemVer) return version;
@@ -6409,8 +6409,8 @@ var require_coerce = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region node_modules/semver/functions/truncate.js
 var require_truncate = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const parse = require_parse$7();
-	const constants = require_constants$8();
+	const parse = require_parse$6();
+	const constants = require_constants$7();
 	const SemVer = require_semver$1();
 	const truncate = (version, truncation, options) => {
 		if (!constants.RELEASE_TYPES.includes(truncation)) return null;
@@ -6591,7 +6591,7 @@ var require_range = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const debug = require_debug$2();
 	const SemVer = require_semver$1();
 	const { safeRe: re, src, t, comparatorTrimReplace, tildeTrimReplace, caretTrimReplace } = require_re();
-	const { FLAG_INCLUDE_PRERELEASE, FLAG_LOOSE } = require_constants$8();
+	const { FLAG_INCLUDE_PRERELEASE, FLAG_LOOSE } = require_constants$7();
 	const BUILDSTRIPRE = new RegExp(src[t.BUILD], "g");
 	const isNullSet = (c) => c.value === "<0.0.0-0";
 	const isAny = (c) => c.value === "";
@@ -7181,10 +7181,10 @@ var require_subset = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#region node_modules/semver/index.js
 var require_semver = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const internalRe = require_re();
-	const constants = require_constants$8();
+	const constants = require_constants$7();
 	const SemVer = require_semver$1();
 	const identifiers = require_identifiers();
-	const parse = require_parse$7();
+	const parse = require_parse$6();
 	const valid = require_valid$1();
 	const clean = require_clean();
 	const inc = require_inc();
@@ -10410,6 +10410,9 @@ const FYN_LOCAL_HARD_TAG = "-fynlocal_h";
 function isLocal(v) {
 	return v.indexOf(FYN_LOCAL_TAG) > 0;
 }
+function isLocalHard(v) {
+	return v.indexOf(FYN_LOCAL_HARD_TAG) > 0;
+}
 function localify(v, localType, hash = "") {
 	return `${v}${localType === "hard" ? FYN_LOCAL_HARD_TAG : FYN_LOCAL_TAG}${hash}`;
 }
@@ -10497,12 +10500,13 @@ function equal(v1, v2) {
 //#region lib/dep-item.ts
 var DepItem = class {
 	name;
-	/** Optional dependency failure flag (truthy = failed, number for failure code) */
+	/** Optional dependency failure code - truthy means failed; never assigned a boolean */
 	optFailed;
 	/** Version string (may be set during resolution) */
 	version;
 	/** Was optional check performed */
 	optChecked;
+	/** read by the dep locker's `makeDep`, so not private (FJM-154) */
 	_semver;
 	/** Original top level package.json dep section (dep, dev, per, opt) */
 	src;
@@ -10676,137 +10680,108 @@ var DepItem = class {
 };
 
 //#endregion
-//#region node_modules/item-queue/dist/inflight.js
+//#region node_modules/xflight/dist/index.js
+/** Simple assert that works in browser and Node.js */
+function assert$2(condition, message) {
+	if (!condition) throw new Error(message);
+}
 /**
-* async inflight operation memoizer
+* Keyed store of in-progress work, with start-time and last-check-time tracking.
+*
+* This is the generic core: it stores any value type `V` under any {@link RecordKey} and
+* knows nothing about promises. {@link Inflight} builds promise deduplication on top of it.
+*
+* `item-queue` uses this directly - it tracks `{ item, promise }` records keyed by an
+* incrementing number, which is neither a promise nor a string, so it needs the core rather
+* than {@link Inflight} (FJM-26).
+*
+* @template V The type of the tracked value.
 */
-var Inflight = class {
-	constructor() {
-		this._count = 0;
-		this._inflights = {};
-	}
+var InflightStore = class {
+	/** Map of inflight items by key */
+	_inflights = /* @__PURE__ */ new Map();
+	/**
+	* Track a value under a key.
+	*
+	* @throws If key already exists.
+	*/
 	add(key, value, now) {
-		assert(this._inflights[key] === void 0, `Already has inflight item ${String(key)}`);
-		this._count++;
-		now = now || Date.now();
-		this._inflights[key] = {
-			start: now,
-			lastXTime: now,
+		assert$2(!this._inflights.has(key), `xflight: item ${String(key)} already exist`);
+		const timestamp = now ?? Date.now();
+		this._inflights.set(key, {
+			start: timestamp,
+			lastXTime: timestamp,
 			value
-		};
+		});
 		return value;
 	}
-	/**
-	* return internal inflights records object
-	*/
-	get inflights() {
-		return this._inflights;
-	}
-	/**
-	* get an inflight record
-	*
-	* @param key
-	* @returns
-	*/
+	/** Get the tracked value for a key, or undefined. */
 	get(key) {
-		const x = this._inflights[key];
-		return x && x.value;
+		return this._inflights.get(key)?.value;
 	}
 	/**
-	* remove an inflight record
+	* Remove the inflight item for a key.
 	*
-	* @param key
+	* @throws If key does not exist.
 	*/
 	remove(key) {
-		assert(this._inflights[key] !== void 0, `Removing non-existing inflight item ${String(key)}`);
-		assert(this._count > 0, `Removing inflight item ${String(key)} but count is ${this._count}`);
-		this._count--;
-		if (this._count === 0) this._inflights = {};
-		else this._inflights[key] = void 0;
+		assert$2(this._inflights.has(key), `xflight: removing non-existing item ${String(key)}`);
+		this._inflights.delete(key);
 	}
 	/**
-	* Check if inflight record is empty (ie: no inflight operations)
+	* Iterate the tracked items as `[key, record]` pairs.
+	*
+	* Prefer this over reaching for the internal map - it is what lets a caller sweep every
+	* in-progress entry, which is what item-queue's overdue-work watcher does.
 	*/
+	entries() {
+		return this._inflights.entries();
+	}
+	/** Whether there are no inflight items. */
 	get isEmpty() {
-		return this._count === 0;
+		return this._inflights.size === 0;
 	}
-	/**
-	* get number of operations inflight
-	*/
+	/** The number of inflight items. */
 	get count() {
-		return this._count;
+		return this._inflights.size;
 	}
-	/**
-	* Get the start time of a inflight operation
-	*
-	* @param key
-	* @returns
-	*/
+	/** Get the start time (ms since epoch) for a key, or undefined. */
 	getStartTime(key) {
-		const x = this._inflights[key];
-		return x && x.start;
+		return this._inflights.get(key)?.start;
 	}
-	/**
-	* Get the time an inflight operation has elapsed
-	* @param key
-	* @param now
-	* @returns
-	*/
+	/** Elapsed ms since the start for a key, or -1 if not found. */
 	time(key, now) {
-		const x = this._inflights[key];
-		if (x) return (now || Date.now()) - x.start;
-		return -1;
+		const item = this._inflights.get(key);
+		return item ? (now ?? Date.now()) - item.start : -1;
 	}
-	/**
-	* Get the time an inflight operation has elapsed
-	* @param key
-	* @param now
-	* @returns
-	*/
+	/** Alias for {@link time}. */
 	elapseTime(key, now) {
 		return this.time(key, now);
 	}
-	/**
-	* Get the time the inflight operation was last checked
-	* @param key
-	* @returns
-	*/
+	/** Get the last check time (ms since epoch) for a key, or undefined. */
 	getCheckTime(key) {
-		const x = this._inflights[key];
-		return x && x.lastXTime;
+		return this._inflights.get(key)?.lastXTime;
 	}
-	/**
-	* Get the time elapsed since last check
-	*
-	* @param key
-	* @param now
-	* @returns
-	*/
+	/** Elapsed ms since the last check for a key, or -1 if not found. */
 	lastCheckTime(key, now) {
-		const x = this._inflights[key];
-		if (x) return (now || Date.now()) - x.lastXTime;
-		return -1;
+		const item = this._inflights.get(key);
+		return item ? (now ?? Date.now()) - item.lastXTime : -1;
 	}
-	/**
-	* Get the time elapsed since last check
-	*
-	* @param key
-	* @param now
-	* @returns
-	*/
+	/** Alias for {@link lastCheckTime}. */
 	elapseCheckTime(key, now) {
 		return this.lastCheckTime(key, now);
 	}
 	/**
-	* Reset last check time to `now` or `Date.now()`
+	* Reset the last check time for a key, or for all inflight items if no key is given.
 	*
-	* @param key
-	* @param now
-	* @returns
+	* @returns This instance for chaining.
 	*/
 	resetCheckTime(key, now) {
-		const x = this._inflights[key];
-		if (x) x.lastXTime = now || Date.now();
+		const timestamp = now ?? Date.now();
+		if (key !== void 0) {
+			const item = this._inflights.get(key);
+			if (item) item.lastXTime = timestamp;
+		} else for (const item of this._inflights.values()) item.lastXTime = timestamp;
 		return this;
 	}
 };
@@ -10826,7 +10801,7 @@ var ItemQueue = class ItemQueue extends EventEmitter$1 {
 		super();
 		this.Promise = options.Promise || ItemQueue.Promise;
 		assert(this.Promise, "ItemQueue: No Promise implementation available");
-		this._pending = new Inflight();
+		this._pending = new InflightStore();
 		this._itemQ = [];
 		if (options.itemQ) this.addItems(options.itemQ, true);
 		this._concurrency = options.concurrency || 15;
@@ -11046,7 +11021,7 @@ var ItemQueue = class ItemQueue extends EventEmitter$1 {
 		const watched = [];
 		const still = [];
 		const now = Date.now();
-		for (const [id, v] of Object.entries(this._pending.inflights)) if (v) {
+		for (const [id, v] of this._pending.entries()) {
 			const lastXTime = this._pending.lastCheckTime(id, now);
 			const time = this._pending.time(id, now);
 			const overdue = time >= this._watchTime;
@@ -12983,6 +12958,13 @@ function groupMM(mms, groups) {
 	return groups;
 }
 
+//#endregion
+//#region node_modules/@fynpo/base/dist/util.js
+/**
+* ensure a path uses `/` for separator
+*/
+const posixify$4 = Path.sep === "/" ? (x) => x : (path) => path.replace(/\\/g, "/");
+
 //#endregion
 //#region node_modules/@fynpo/base/dist/packages-config.js
 const DEFAULT_INCLUDE = ["packages/*"];
@@ -13566,13 +13548,6 @@ function makeGitignoreMatcher(cwd) {
 	};
 }
 
-//#endregion
-//#region node_modules/@fynpo/base/dist/util.js
-/**
-* ensure a path uses `/` for separator
-*/
-const posixify$4 = Path.sep === "/" ? (x) => x : (path) => path.replace(/\\/g, "/");
-
 //#endregion
 //#region node_modules/@fynpo/base/dist/fynpo-dep-graph.js
 /**
@@ -14762,6 +14737,161 @@ const spinner = VisualLogger.spinners[1];
 //#endregion
 //#region lib/util/lifecycle-script-policy.ts
 const TRUSTED_URL_TYPES = /* @__PURE__ */ new Set(["npm"]);
+/** The install-time lifecycle scripts this policy gates. */
+const LIFECYCLE_SCRIPTS = [
+	"preinstall",
+	"install",
+	"postinstall"
+];
+/** Valid `fyn.scriptPolicy` modes, loosest to strictest. */
+const SCRIPT_POLICY_MODES = [
+	"all",
+	"source",
+	"review",
+	"off"
+];
+/**
+* The default. Nothing runs its install scripts without an approval, workspace
+* packages excepted - npm 12's model. `--script-policy=source` is the opt-out
+* back to trusting a package because of where it came from.
+*/
+const DEFAULT_SCRIPT_POLICY = "review";
+/**
+* Split a range union into its parts. Accepts npm's `||` and the single `|` a
+* hand-written config may use.
+*
+* @param {string} range a semver range, possibly a union
+* @returns {string[]} the parts, trimmed
+*/
+function splitRange(range) {
+	return String(range).split(/\s*\|\|?\s*/).map((part) => part.trim()).filter(Boolean);
+}
+/**
+* Read an allowScripts key's spec as a semver range.
+*
+* A key's spec is a range (`^1.2.3`, `1.2.3`, `^1.2.3 || ^2.0.0`) or it is not
+* a range at all - a git/URL spec such as `github:user/repo#v1`, which matches
+* the requested spec literally instead.
+*
+* @param {string} spec the part of the key after the package name
+* @returns {(string|undefined)} the range in `||` form, or undefined
+*/
+function asRange(spec) {
+	if (!spec) return;
+	const normalized = splitRange(spec).join(" || ");
+	return import_semver.default.validRange(normalized) ? normalized : void 0;
+}
+/**
+* Normalize a `fyn.scriptPolicy` value.
+*
+* @param {*} mode the configured value
+* @param {string} [dflt] mode to use when unset
+* @returns {string} one of {@link SCRIPT_POLICY_MODES}
+* @throws {Error} when the value is set but not a known mode
+*/
+function normalizeScriptPolicy(mode, dflt = DEFAULT_SCRIPT_POLICY) {
+	if (mode === void 0 || mode === null || mode === "") return dflt;
+	const normalized = String(mode).toLowerCase();
+	if (!SCRIPT_POLICY_MODES.includes(normalized)) throw new Error(`fyn scriptPolicy "${mode}" is not valid - expected one of ${SCRIPT_POLICY_MODES.join(", ")}`);
+	return normalized;
+}
+/**
+* Normalize a `fyn.scriptPolicy` value, keeping "not configured" distinct from
+* the default so scopes can be merged before the default is applied.
+*
+* @param {*} mode the configured value
+* @returns {(string|undefined)} the mode, or undefined when unset
+* @throws {Error} when the value is set but not a known mode
+*/
+function normalizeScriptPolicyIfSet(mode) {
+	if (mode === void 0 || mode === null || mode === "") return;
+	return normalizeScriptPolicy(mode);
+}
+/**
+* Pick the stricter of two policy modes. Used to merge a package's setting with
+* the monorepo's: a package may tighten what the repo asked for, never loosen
+* it.
+*
+* @param {...string} modes modes to compare, unset values ignored
+* @returns {string} the strictest mode given, or the default when none are
+*/
+function strictestScriptPolicy(...modes) {
+	const given = modes.filter((mode) => mode !== void 0);
+	if (given.length === 0) return DEFAULT_SCRIPT_POLICY;
+	return given.reduce((strictest, mode) => SCRIPT_POLICY_MODES.indexOf(mode) > SCRIPT_POLICY_MODES.indexOf(strictest) ? mode : strictest);
+}
+/**
+* Normalize a configured allowScripts value into a map.
+*
+* A map is used as-is. A list of package names - the `--allow-scripts=a,b` CLI
+* form - becomes a blanket approval for each name, matching npm's flag.
+*
+* @param {(object|string[]|string)} value the configured value
+* @returns {object} an allowScripts map
+*/
+function normalizeAllowScriptsConfig(value) {
+	if (!value) return {};
+	const list = Array.isArray(value) ? value : typeof value === "string" ? [value] : void 0;
+	if (list === void 0) return value;
+	return list.flatMap((name) => String(name).split(",")).reduce((map, name) => {
+		const key = name.trim();
+		if (key) map[key] = true;
+		return map;
+	}, {});
+}
+/**
+* Merge allowScripts maps from loosest to tightest scope - fynpo config, then
+* package.json, then CLI.
+*
+* Approvals accumulate, but a `false` at any level is final: a package cannot
+* approve what the monorepo denied. Cross-key denials (a bare-name `false`
+* against a version-pinned approval) are resolved at evaluation time, where
+* every matching key is folded together.
+*
+* @param {...object} maps allowScripts maps, loosest scope first
+* @returns {object} the merged map
+*/
+function mergeAllowScripts(...maps) {
+	const merged = {};
+	for (const map of maps) {
+		const normalized = normalizeAllowScriptsConfig(map);
+		for (const key of Object.keys(normalized)) {
+			if (merged[key] === false) continue;
+			merged[key] = normalized[key];
+		}
+	}
+	return merged;
+}
+/**
+* Fold the `fyn.denyScripts` map for a package.
+*
+* The map has the same shape and key grammar as `fyn.allowScripts` -
+* `{ semver, scripts }` with both fields optional, plus the shorthand forms -
+* because it answers the same two questions. The only difference is that a
+* match denies: an absent `semver` denies every version, an absent `scripts`
+* denies every install script.
+*
+* Entries need no `!` markers; every entry in this map is already negative.
+*
+* @param {object} depInfo resolved package data
+* @param {object} denyScripts the effective `fyn.denyScripts` map
+* @returns {{denyAll:boolean, scripts:Set<string>, key:(string|undefined)}} what
+*   this map denies for this package
+*/
+function foldDenyScripts(depInfo, denyScripts) {
+	const acc = makeAcc();
+	if (!denyScripts) return {
+		denyAll: false,
+		scripts: acc.deny,
+		key: void 0
+	};
+	const key = foldAllowScripts(depInfo, denyScripts, acc, { version: depInfo.version });
+	return {
+		denyAll: acc.allowAll || acc.denyAll || acc.denied,
+		scripts: /* @__PURE__ */ new Set([...acc.scripts, ...acc.deny]),
+		key
+	};
+}
 /**
 * Derive the effective source urlType for a dependency item.
 *
@@ -14799,9 +14929,28 @@ function getUrlType(depInfo) {
 	if (spec) return analyze(spec).urlType;
 }
 /**
+* Whether a resolved package came from the workspace itself - a file:/link:
+* dependency or a fynpo sibling - rather than from a registry or a URL.
+*
+* Under `"review"` these are exempt: an allowlist is a review gate on code you
+* did not write, and monorepo source is reviewed by the PR that changed it.
+*
+* @param {object} depInfo resolved package data
+* @returns {boolean} true if the package is a workspace-local dependency
+*/
+function isLocalSource(depInfo) {
+	if (!depInfo) return false;
+	if (depInfo.local) return true;
+	const depItem = depInfo[DEP_ITEM];
+	if (depItem && depItem.localType) return true;
+	const spec = depItem && depItem.semver || depInfo[SEMVER];
+	return Boolean(spec && analyze(spec).localType);
+}
+/**
 * Build the candidate whitelist keys for a package. Matching accepts BOTH the
 * original requested spec and the resolved version, e.g. `foo@github:user/repo`
-* and `foo@2.3.0`.
+* and `foo@2.3.0`, plus the bare package name - npm's key form, where the
+* version it approved lives on the value side.
 *
 * @param {object} depInfo resolved package data
 * @returns {string[]} candidate keys, spec form first
@@ -14812,46 +14961,153 @@ function makeAllowKeys(depInfo) {
 	const keys = [];
 	if (spec) keys.push(`${depInfo.name}@${spec}`);
 	if (depInfo.version && depInfo.version !== spec) keys.push(`${depInfo.name}@${depInfo.version}`);
+	keys.push(depInfo.name);
 	return keys;
 }
 /**
-* Fold a single allowScripts entry value into an accumulator. Accepts an array
-* of script names, a single script name, or the wildcard `true`/`"*"` to allow
-* all scripts for the package. Script names are normalized to lowercase.
+* Classify a string allowScripts value. A lifecycle script name allows just
+* that script (fyn's form); anything that parses as a semver range is npm's
+* version pin, allowing all scripts for the matching version only.
+*
+* @param {string} value the string value
+* @returns {string} "script" or "version"
+*/
+function classifyStringEntry(value) {
+	if (LIFECYCLE_SCRIPTS.includes(value.toLowerCase())) return "script";
+	return import_semver.default.validRange(value) ? "version" : "script";
+}
+/**
+* Fold a single allowScripts entry value into an accumulator.
+*
+* Every form is accepted, though fyn only ever writes the object one:
+*
+* | value | meaning |
+* |---|---|
+* | `{ semver, scripts }` | fyn's form - either field absent means "all" |
+* | `true` / `"*"` | all install scripts |
+* | `["install"]` / `"install"` | only those scripts |
+* | `"1.2.3"` / `"^1.2.3"` | npm's form - all scripts, only matching versions |
+* | `false` | denied outright |
 *
 * @param {(string[]|string|boolean)} value the allowScripts entry value
-* @param {{allowAll:boolean, scripts:Set<string>}} acc accumulator to fold into
-* @returns {{allowAll:boolean, scripts:Set<string>}} the accumulator
+* @param {{allowAll:boolean, scripts:Set<string>, denied:boolean}} acc
+*   accumulator to fold into
+* @param {object} [ctx] matching context
+* @param {string} [ctx.version] the package's resolved version, for version pins
+* @returns {{allowAll:boolean, scripts:Set<string>, denied:boolean}} the accumulator
 */
-function normalizeAllowEntry(value, acc) {
+function normalizeAllowEntry(value, acc, ctx = {}) {
+	if (value === false) {
+		acc.denied = true;
+		return acc;
+	}
 	if (value === true || value === "*") {
 		acc.allowAll = true;
 		return acc;
 	}
+	if (value && typeof value === "object" && !Array.isArray(value)) {
+		const range = asRange(value.semver);
+		if (value.semver && !(range && ctx.version && satisfies(ctx.version, range))) return acc;
+		if (value.scripts === void 0) {
+			acc.allowAll = true;
+			return acc;
+		}
+		return normalizeAllowEntry(value.scripts, acc, ctx);
+	}
 	let list = [];
 	if (Array.isArray(value)) list = value;
 	else if (value !== void 0) list = [value];
-	for (const s of list) if (s === true || s === "*") acc.allowAll = true;
-	else if (typeof s === "string") acc.scripts.add(s.toLowerCase());
+	for (const s of list) {
+		if (s === false) {
+			acc.denied = true;
+			continue;
+		}
+		if (s === true || s === "*") {
+			acc.allowAll = true;
+			continue;
+		}
+		if (typeof s !== "string") continue;
+		const negated = s.startsWith("!");
+		const name = negated || s.startsWith("+") ? s.slice(1) : s;
+		if (negated) {
+			if (name === "*") acc.denyAll = true;
+			else acc.deny.add(name.toLowerCase());
+			continue;
+		}
+		if (classifyStringEntry(name) === "version") {
+			if (ctx.version && satisfies(ctx.version, name)) acc.allowAll = true;
+		} else acc.scripts.add(name.toLowerCase());
+	}
 	return acc;
 }
 /**
-* Fold any matching `fyn.allowScripts` entries (by spec or resolved-version key)
-* into the accumulator.
+* A fresh accumulator for folding allow or deny entries.
+*
+* @returns {{allowAll:boolean, scripts:Set<string>, deny:Set<string>,
+*   denyAll:boolean, denied:boolean}} the accumulator
+*/
+function makeAcc() {
+	return {
+		allowAll: false,
+		scripts: /* @__PURE__ */ new Set(),
+		deny: /* @__PURE__ */ new Set(),
+		denyAll: false,
+		denied: false
+	};
+}
+const allowIndexCache = /* @__PURE__ */ new WeakMap();
+/**
+* Group an allowScripts map by package name, parsing each key once.
 *
-* @param {string[]} keys candidate keys from {@link makeAllowKeys}
+* @param {object} allowScripts the map
+* @returns {Map<string, object[]>} entries by package name
+*/
+function indexAllowScripts(allowScripts) {
+	if (!allowScripts) return /* @__PURE__ */ new Map();
+	const cached = allowIndexCache.get(allowScripts);
+	if (cached) return cached;
+	const index = /* @__PURE__ */ new Map();
+	for (const key of Object.keys(allowScripts)) {
+		const at = key.indexOf("@", key.startsWith("@") ? 1 : 0);
+		const name = at < 0 ? key : key.slice(0, at);
+		const spec = at < 0 ? void 0 : key.slice(at + 1);
+		const entries = index.get(name) || [];
+		entries.push({
+			key,
+			spec,
+			range: asRange(spec),
+			value: allowScripts[key]
+		});
+		index.set(name, entries);
+	}
+	allowIndexCache.set(allowScripts, index);
+	return index;
+}
+/**
+* Fold every `fyn.allowScripts` entry that matches this package into the
+* accumulator.
+*
+* A key matches when it is the bare package name (every version), when its
+* spec is a semver range the resolved version satisfies (`sharp@^0.34.0`,
+* `sharp@^0.34.0 || ^0.35.0`), or - for a git/URL dependency, where there is no
+* version to range over - when its spec is literally the requested spec.
+*
+* @param {object} depInfo resolved package data
 * @param {object} allowScripts the project's `fyn.allowScripts` map
-* @param {{allowAll:boolean, scripts:Set<string>}} acc accumulator to fold into
+* @param {{allowAll:boolean, scripts:Set<string>, denied:boolean}} acc
+*   accumulator to fold into
+* @param {object} [ctx] matching context passed to {@link normalizeAllowEntry}
 * @returns {(string|undefined)} the first matched key, if any
 */
-function foldAllowScripts(keys, allowScripts, acc) {
+function foldAllowScripts(depInfo, allowScripts, acc, ctx) {
+	const entries = indexAllowScripts(allowScripts).get(depInfo.name);
+	if (!entries) return;
+	const depItem = depInfo[DEP_ITEM];
+	const requestedSpec = depItem && depItem.semver || depInfo[SEMVER];
 	let matchedKey;
-	for (const key of keys) {
-		const value = allowScripts && allowScripts[key];
-		if (value !== void 0) {
-			if (!matchedKey) matchedKey = key;
-			normalizeAllowEntry(value, acc);
-		}
+	for (const entry of entries) if (entry.spec === void 0 || entry.spec === requestedSpec || entry.range !== void 0 && Boolean(depInfo.version) && satisfies(depInfo.version, entry.range)) {
+		if (!matchedKey) matchedKey = entry.key;
+		normalizeAllowEntry(entry.value, acc, ctx);
 	}
 	return matchedKey;
 }
@@ -14870,42 +15126,104 @@ function isTopLevelDep(depInfo) {
 * Evaluate the lifecycle-script policy for a resolved package.
 *
 * @param {object} depInfo resolved package data
-* @param {object} allowScripts the project's package.json `fyn.allowScripts` map
+* @param {object} allowScripts the effective `fyn.allowScripts` map
 * @param {object} [options] additional policy options
 * @param {(boolean|string|string[])} [options.allowTopLevel] the project's
-*   `fyn.allowTopLevelScripts` config. When truthy, non-registry packages that
-*   are declared directly in the top-level package.json are allowed to run the
-*   given lifecycle scripts (`true`/`"*"` = all, or a list of script names).
-* @returns {{trusted:boolean, urlType:(string|undefined), allowAll:boolean,
+*   `fyn.allowTopLevelScripts` config. When truthy, packages that are declared
+*   directly in the top-level package.json are allowed to run the given
+*   lifecycle scripts (`true`/`"*"` = all, or a list of script names).
+* @param {string} [options.mode] the `fyn.scriptPolicy` mode in effect
+* @param {boolean} [options.reviewLocalPackages] when true, workspace-local
+*   packages lose their exemption and need an allowlist entry like any other
+* @returns {{trusted:boolean, denied:boolean, urlType:(string|undefined),
+*   local:boolean, mode:string, reason:string, allowAll:boolean,
 *   allowed:Set<string>, key:(string|undefined), topLevel:boolean}} the
 *   resolved script policy
 */
 function evaluateScriptPolicy(depInfo, allowScripts, options = {}) {
+	const { allowTopLevel, reviewLocalPackages = false, denyScripts } = options;
+	const mode = normalizeScriptPolicy(options.mode);
 	const urlType = getUrlType(depInfo);
 	const keys = makeAllowKeys(depInfo);
 	const topLevel = isTopLevelDep(depInfo);
-	if (!urlType || TRUSTED_URL_TYPES.has(urlType)) return {
-		trusted: true,
+	const local = isLocalSource(depInfo);
+	const base = {
 		urlType,
+		local,
+		mode,
+		topLevel,
+		key: keys[0]
+	};
+	const nothing = {
+		trusted: false,
+		allowAll: false,
+		allowed: /* @__PURE__ */ new Set(),
+		deniedScripts: /* @__PURE__ */ new Set()
+	};
+	const deny = foldDenyScripts(depInfo, denyScripts);
+	if (mode === "off") return {
+		...base,
+		...nothing,
+		denied: true,
+		reason: "off"
+	};
+	if (deny.denyAll) return {
+		...base,
+		...nothing,
+		key: deny.key || keys[0],
+		denied: true,
+		reason: "denied"
+	};
+	const acc = makeAcc();
+	const key = foldAllowScripts(depInfo, allowScripts, acc, { version: depInfo.version }) || keys[0];
+	if (acc.denied || acc.denyAll) return {
+		...base,
+		...nothing,
+		key,
+		denied: true,
+		reason: "denied"
+	};
+	const denied = /* @__PURE__ */ new Set([...deny.scripts, ...acc.deny]);
+	if (mode === "all") return {
+		...base,
+		key,
+		trusted: true,
+		denied: false,
 		allowAll: true,
 		allowed: /* @__PURE__ */ new Set(),
-		key: keys[0],
-		topLevel
+		deniedScripts: denied,
+		reason: "all"
 	};
-	const acc = {
-		allowAll: false,
-		scripts: /* @__PURE__ */ new Set()
+	if (local && !urlType && !reviewLocalPackages) return {
+		...base,
+		key,
+		trusted: true,
+		denied: false,
+		allowAll: true,
+		allowed: /* @__PURE__ */ new Set(),
+		deniedScripts: denied,
+		reason: "local"
+	};
+	if (mode === "source" && (!urlType || TRUSTED_URL_TYPES.has(urlType))) return {
+		...base,
+		key,
+		trusted: true,
+		denied: false,
+		allowAll: true,
+		allowed: /* @__PURE__ */ new Set(),
+		deniedScripts: denied,
+		reason: "registry"
 	};
-	const matchedKey = foldAllowScripts(keys, allowScripts, acc);
-	const { allowTopLevel } = options;
-	if (topLevel && allowTopLevel !== void 0 && allowTopLevel !== false) normalizeAllowEntry(allowTopLevel, acc);
+	if (mode === "source" && topLevel && allowTopLevel !== void 0 && allowTopLevel !== false) normalizeAllowEntry(allowTopLevel, acc, { version: depInfo.version });
 	return {
+		...base,
 		trusted: false,
-		urlType,
+		denied: acc.denied,
 		allowAll: acc.allowAll,
 		allowed: acc.scripts,
-		key: matchedKey || keys[0],
-		topLevel
+		deniedScripts: /* @__PURE__ */ new Set([...denied, ...acc.deny]),
+		key,
+		reason: mode === "review" ? "review" : "untrusted-source"
 	};
 }
 /**
@@ -14914,8 +15232,11 @@ function evaluateScriptPolicy(depInfo, allowScripts, options = {}) {
 * @returns {boolean} whether the script is allowed to run
 */
 function isScriptAllowed(policy, scriptName) {
+	if (policy.denied) return false;
+	const name = String(scriptName).toLowerCase();
+	if (policy.deniedScripts && policy.deniedScripts.has(name)) return false;
 	if (policy.trusted || policy.allowAll) return true;
-	return policy.allowed.has(String(scriptName).toLowerCase());
+	return policy.allowed.has(name);
 }
 
 //#endregion
@@ -14995,15 +15316,38 @@ function getPackageRawInfo(obj) {
 //#region lib/pkg-dep-resolver.ts
 const simpleSemverCompare = simpleCompare;
 const { checkPkgOsCpu, relativePath, unSlashNpmScope } = fyntil;
+/**
+* Decide whether a lock entry that records no package.json still needs a real meta fetch.
+*
+* `_missingJson` says the lock never captured the package's json, so its dependencies are
+* unknown rather than absent. Normally that has to be fetched for real before the package can be
+* resolved into the tree.
+*
+* The exception is a package this platform cannot use. An optional dep skipped on os/cpu is
+* recorded from its registry meta alone (pkg-dep-resolver synthesizes an os/cpu-only json for
+* it), so every such entry is `_missingJson` by construction - and on a machine that will never
+* install it, its dependencies do not matter. Fetching them anyway would cost a packument for
+* every platform variant in the tree on every install, which is the whole reason those entries
+* are in the lock (FPM-63, FPM-93).
+*
+* @param metaJson locked version metadata
+* @returns true when the real meta has to be fetched before this item can resolve
+*/
+function lockedMetaNeedsFetch(metaJson) {
+	if (!metaJson || !metaJson._missingJson) return false;
+	return checkPkgOsCpu(metaJson) === true;
+}
 const failMetaMsg = (name) => `Unable to retrieve meta for package ${name} - If you've updated its version recently, try to run fyn with '--refresh-meta' again`;
 var PkgDepResolver = class {
 	_options;
 	_fyn;
 	_pkgSrcMgr;
+	/** read by `Fyn` when it starts the dist fetcher, so not private (FJM-154) */
 	_data;
 	_promiseQ;
 	_defer;
 	_optResolver;
+	/** `Fyn.lockOnly` - the mode string "lock-only", or false; only read for truth */
 	_lockOnly;
 	_depthResolving;
 	_localsByDepth;
@@ -15093,6 +15437,11 @@ var PkgDepResolver = class {
 			this._defer.resolve();
 		}
 	}
+	/**
+	* @param depInfo where the peer resolutions are stashed - anything carrying a `res` bag.
+	*   The installer passes the whole `DepData` for the app's own peer deps ("your app"),
+	*   `resolvePeerDep` passes one package's info (FJM-154).
+	*/
 	resolvePkgPeerDep(json, pkgId, depInfo) {
 		const peerDepMeta = json.peerDependenciesMeta || {};
 		import_lodash_min.default.each(json.peerDependencies || json.peerDepenencies, (semver, name) => {
@@ -15414,7 +15763,8 @@ var PkgDepResolver = class {
 	findVersionFromDistTag(meta, semver) {
 		if (import_semver.default.validRange(semver) === null) {
 			const lockRsv = meta[LOCK_RSEMVERS];
-			if (lockRsv && lockRsv[semver]) return lockRsv[semver];
+			const locked = lockRsv && lockRsv[semver];
+			if (locked) return Array.isArray(locked) ? locked[0] : locked;
 			const dtags = meta["dist-tags"];
 			if (dtags && dtags.hasOwnProperty(semver)) return dtags[semver];
 		}
@@ -15431,7 +15781,6 @@ var PkgDepResolver = class {
 			if (!item.localType) item.localType = localFromMeta;
 			if (this._fyn.enforceRegistryDeps && item.parent.depth >= 1) this._enforceRegistryDep(item, item.parent);
 		}
-		const OPT_FAILED_PLATFORM = 3;
 		const platformCheck = () => {
 			const sysCheck = checkPkgOsCpu(metaJson);
 			if (sysCheck !== true) return `package ${log_format_default.pkgId(item)} platform check failed: ${sysCheck}`;
@@ -15441,7 +15790,7 @@ var PkgDepResolver = class {
 		if (item.dsrc && item.dsrc.includes("opt") && !item.optChecked) {
 			if (sysCheck !== true) {
 				logger$1.verbose(`optional dependencies ${sysCheck}`);
-				if (!item.optFailed) item.optFailed = OPT_FAILED_PLATFORM;
+				if (!item.optFailed) item.optFailed = 3;
 				item.optChecked = true;
 			} else {
 				logger$1.verbose("adding package to opt check:", item.name, item.semver, item.resolved);
@@ -15456,7 +15805,7 @@ var PkgDepResolver = class {
 			logger$1.error(sysCheck);
 			throw new Error(sysCheck);
 		}
-		const pkgsData = this._data.getPkgsData(item.optFailed);
+		const pkgsData = this._data.getPkgsData(Boolean(item.optFailed));
 		let pkgV;
 		let kpkg = pkgsData[item.name];
 		if (kpkg) {
@@ -15501,10 +15850,17 @@ var PkgDepResolver = class {
 			if (metaJson.hasPI || scripts.preinstall || scripts.preInstall) pkgV.hasPI = 1;
 			if (metaJson.hasI || scripts.install || scripts.postinstall || scripts.postInstall) pkgV.hasI = 1;
 		}
-		if (item.optFailed === OPT_FAILED_PLATFORM && !pkgV.json && (metaJson.os || metaJson.cpu)) pkgV.json = {
-			os: metaJson.os,
-			cpu: metaJson.cpu
-		};
+		if (item.optFailed === 3 && !pkgV.json && (metaJson.os || metaJson.cpu)) pkgV.json = import_lodash_min.default.pick(metaJson, [
+			"os",
+			"cpu",
+			"dependencies",
+			"optionalDependencies",
+			"peerDependencies",
+			"bundleDependencies",
+			"bundledDependencies",
+			"_hasShrinkwrap",
+			"_missingJson"
+		]);
 		if (localFromMeta) {
 			pkgV.local = item.localType;
 			item.fullPath = pkgV.dir = pkgV.dist.fullPath;
@@ -15530,8 +15886,8 @@ var PkgDepResolver = class {
 				}
 			}
 		}
+		if (metaJson.deprecated) pkgV.deprecated = metaJson.deprecated;
 		if (!optFailed) {
-			if (metaJson.deprecated) pkgV.deprecated = metaJson.deprecated;
 			let deepRes = false;
 			if (firstSeenVersion || (deepRes = this._shouldDeepResolve(pkgV))) {
 				const pkgDepth = this._depthResolving[item.depth][item.name];
@@ -15592,7 +15948,7 @@ var PkgDepResolver = class {
 		const getKnownSemver = () => {
 			const find = (rsv) => {
 				let x = rsv && rsv[item.semver];
-				if (!x) return x;
+				if (!x) return void 0;
 				if (Array.isArray(x)) x = x[0];
 				if (noLocal && isLocal(x)) return false;
 				return x;
@@ -15860,13 +16216,12 @@ ${item.depPath.join(" > ")}`);
 		this._applyOverrides(item);
 		this._replaceWithResolutionsData(item);
 		return (!item.semverPath || this._fyn.preferLock ? tryLock().then((r) => r || item.semverPath && tryLocal() || false) : tryLocal().then((r) => r || tryLock())).then((r) => {
-			if (r && !import_lodash_min.default.get(r, [
+			if (r && !lockedMetaNeedsFetch(import_lodash_min.default.get(r, [
 				"meta",
 				"versions",
-				r.resolved,
-				"_missingJson"
-			])) return r;
-			if (this._lockOnly || item.localType) return;
+				r.resolved
+			]))) return r;
+			if (this._lockOnly || item.localType) return r || void 0;
 			return this._pkgSrcMgr.fetchMeta(item).then((meta) => {
 				if (!meta) throw new Error(failMetaMsg(item.name));
 				const updated = this._fyn.depLocker.update(item, meta);
@@ -15947,7 +16302,7 @@ var Qt = Symbol("paused");
 var Bt = Symbol("resume");
 var b = Symbol("buffer");
 var N = Symbol("pipes");
-var _$22 = Symbol("bufferLength");
+var _$23 = Symbol("bufferLength");
 var bi = Symbol("bufferPush");
 var Ie = Symbol("bufferShift");
 var L = Symbol("objectMode");
@@ -16007,7 +16362,7 @@ var A = class extends EventEmitter$2 {
 	[De] = !1;
 	[Ne] = !1;
 	[qt] = null;
-	[_$22] = 0;
+	[_$23] = 0;
 	[S] = !1;
 	[Jt];
 	[Ce] = !1;
@@ -16023,7 +16378,7 @@ var A = class extends EventEmitter$2 {
 		i && (this[Jt] = i, i.aborted ? this[xi]() : i.addEventListener("abort", () => this[xi]()));
 	}
 	get bufferLength() {
-		return this[_$22];
+		return this[_$23];
 	}
 	get encoding() {
 		return this[z];
@@ -16064,12 +16419,12 @@ var A = class extends EventEmitter$2 {
 			else if (Vr(t)) t = Buffer.from(t);
 			else if (typeof t != "string") throw new Error("Non-contiguous data written to non-objectMode stream");
 		}
-		return this[L] ? (this[g$1] && this[_$22] !== 0 && this[Ae](!0), this[g$1] ? this.emit("data", t) : this[bi](t), this[_$22] !== 0 && this.emit("readable"), i && r(i), this[g$1]) : t.length ? (typeof t == "string" && !(e === this[z] && !this[Mt]?.lastNeed) && (t = Buffer.from(t, e)), Buffer.isBuffer(t) && this[z] && (t = this[Mt].write(t)), this[g$1] && this[_$22] !== 0 && this[Ae](!0), this[g$1] ? this.emit("data", t) : this[bi](t), this[_$22] !== 0 && this.emit("readable"), i && r(i), this[g$1]) : (this[_$22] !== 0 && this.emit("readable"), i && r(i), this[g$1]);
+		return this[L] ? (this[g$1] && this[_$23] !== 0 && this[Ae](!0), this[g$1] ? this.emit("data", t) : this[bi](t), this[_$23] !== 0 && this.emit("readable"), i && r(i), this[g$1]) : t.length ? (typeof t == "string" && !(e === this[z] && !this[Mt]?.lastNeed) && (t = Buffer.from(t, e)), Buffer.isBuffer(t) && this[z] && (t = this[Mt].write(t)), this[g$1] && this[_$23] !== 0 && this[Ae](!0), this[g$1] ? this.emit("data", t) : this[bi](t), this[_$23] !== 0 && this.emit("readable"), i && r(i), this[g$1]) : (this[_$23] !== 0 && this.emit("readable"), i && r(i), this[g$1]);
 	}
 	read(t) {
 		if (this[S]) return null;
-		if (this[C] = !1, this[_$22] === 0 || t === 0 || t && t > this[_$22]) return this[J](), null;
-		this[L] && (t = null), this[b].length > 1 && !this[L] && (this[b] = [this[z] ? this[b].join("") : Buffer.concat(this[b], this[_$22])]);
+		if (this[C] = !1, this[_$23] === 0 || t === 0 || t && t > this[_$23]) return this[J](), null;
+		this[L] && (t = null), this[b].length > 1 && !this[L] && (this[b] = [this[z] ? this[b].join("") : Buffer.concat(this[b], this[_$23])]);
 		let e = this[Ns](t || null, this[b][0]);
 		return this[J](), e;
 	}
@@ -16077,7 +16432,7 @@ var A = class extends EventEmitter$2 {
 		if (this[L]) this[Ie]();
 		else {
 			let i = e;
-			t === i.length || t === null ? this[Ie]() : typeof i == "string" ? (this[b][0] = i.slice(t), e = i.slice(0, t), this[_$22] -= t) : (this[b][0] = i.subarray(t), e = i.subarray(0, t), this[_$22] -= t);
+			t === i.length || t === null ? this[Ie]() : typeof i == "string" ? (this[b][0] = i.slice(t), e = i.slice(0, t), this[_$23] -= t) : (this[b][0] = i.subarray(t), e = i.subarray(0, t), this[_$23] -= t);
 		}
 		return this.emit("data", e), !this[b].length && !this[Q] && this.emit("drain"), e;
 	}
@@ -16103,10 +16458,10 @@ var A = class extends EventEmitter$2 {
 		return this[Qt];
 	}
 	[bi](t) {
-		this[L] ? this[_$22] += 1 : this[_$22] += t.length, this[b].push(t);
+		this[L] ? this[_$23] += 1 : this[_$23] += t.length, this[b].push(t);
 	}
 	[Ie]() {
-		return this[L] ? this[_$22] -= 1 : this[_$22] -= this[b][0].length, this[b].shift();
+		return this[L] ? this[_$23] -= 1 : this[_$23] -= this[b][0].length, this[b].shift();
 	}
 	[Ae](t = !1) {
 		do		;
@@ -16132,7 +16487,7 @@ while (this[As](this[Ie]()) && this[b].length);
 	on(t, e) {
 		let i = super.on(t, e);
 		if (t === "data") this[C] = !1, this[Rt]++, !this[N].length && !this[g$1] && this[Bt]();
-		else if (t === "readable" && this[_$22] !== 0) super.emit("readable");
+		else if (t === "readable" && this[_$23] !== 0) super.emit("readable");
 		else if (Kr(t) && this[nt]) super.emit(t), this.removeAllListeners(t);
 		else if (t === "error" && this[qt]) {
 			let r = e;
@@ -16283,7 +16638,7 @@ while (this[As](this[Ie]()) && this[b].length);
 	}
 	destroy(t) {
 		if (this[S]) return t ? this.emit("error", t) : this.emit(S), this;
-		this[S] = !0, this[C] = !0, this[b].length = 0, this[_$22] = 0;
+		this[S] = !0, this[C] = !0, this[b].length = 0, this[_$23] = 0;
 		let e = this;
 		return typeof e.close == "function" && !this[Ne] && e.close(), t ? this.emit("error", t) : this.emit(S), this;
 	}
@@ -18102,7 +18457,7 @@ var Ee = Symbol("processing");
 var ai = Symbol("processJob");
 var G = Symbol("jobs");
 var ls = Symbol("jobDone");
-var ci$2 = Symbol("addFSEntry");
+var ci$3 = Symbol("addFSEntry");
 var or = Symbol("addTarEntry");
 var ds$1 = Symbol("stat");
 var us = Symbol("readdir");
@@ -18161,7 +18516,7 @@ var wt = class extends A {
 	}
 	write(t) {
 		if (this[me]) throw new Error("write after end");
-		return typeof t == "string" ? this[ci$2](t) : this[or](t), this.flowing;
+		return typeof t == "string" ? this[ci$3](t) : this[or](t), this.flowing;
 	}
 	[or](t) {
 		let e = f(Path.resolve(this.cwd, t.path));
@@ -18172,7 +18527,7 @@ var wt = class extends A {
 		}
 		this[Ft]();
 	}
-	[ci$2](t) {
+	[ci$3](t) {
 		let e = f(Path.resolve(this.cwd, t));
 		this[W].push(new pi(t, e)), this[Ft]();
 	}
@@ -18281,7 +18636,7 @@ var wt = class extends A {
 	[di](t) {
 		t.piped = !0, t.readdir && t.readdir.forEach((r) => {
 			let n = t.path, o = n === "./" ? "" : n.replace(/\/*$/, "/");
-			this[ci$2](o + r);
+			this[ci$3](o + r);
 		});
 		let e = t.entry, i = this.zip;
 		if (!e) throw new Error("cannot pipe without source");
@@ -18316,7 +18671,7 @@ var kt = class extends wt {
 		let e = t.entry, i = this.zip;
 		if (t.readdir && t.readdir.forEach((r) => {
 			let n = t.path, o = n === "./" ? "" : n.replace(/\/*$/, "/");
-			this[ci$2](o + r);
+			this[ci$3](o + r);
 		}), !e) throw new Error("Cannot pipe without source");
 		i ? e.on("data", (r) => {
 			i.write(r);
@@ -27372,7 +27727,7 @@ var require_scan$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 
 //#endregion
 //#region node_modules/spdx-expression-parse/parse.js
-var require_parse$6 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+var require_parse$5 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = function(tokens) {
 		var index = 0;
 		function hasMore() {
@@ -27464,7 +27819,7 @@ var require_parse$6 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#region node_modules/spdx-expression-parse/index.js
 var require_spdx_expression_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var scan = require_scan$1();
-	var parse = require_parse$6();
+	var parse = require_parse$5();
 	module.exports = function(source) {
 		return parse(scan(source));
 	};
@@ -27659,7 +28014,7 @@ var require_normalize_data = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 //#region node_modules/isexe/dist/commonjs/index.min.js
 var require_index_min$1 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	var a = (t, e) => () => (e || t((e = { exports: {} }).exports, e), e.exports);
-	var _$19 = a((i) => {
+	var _$20 = a((i) => {
 		"use strict";
 		Object.defineProperty(i, "__esModule", { value: !0 });
 		i.sync = i.isexe = void 0;
@@ -27772,7 +28127,7 @@ var require_index_min$1 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	};
 	Object.defineProperty(exports, "__esModule", { value: !0 });
 	exports.sync = exports.isexe = exports.posix = exports.win32 = void 0;
-	var E = w(_$19());
+	var E = w(_$20());
 	exports.posix = E;
 	var O = w(g());
 	exports.win32 = O;
@@ -28188,7 +28543,7 @@ var require_lib$31 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 
 //#endregion
 //#region node_modules/@npmcli/git/lib/errors.js
-var require_errors$5 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+var require_errors$4 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const maxRetry = 3;
 	var GitError = class extends Error {
 		shouldRetry() {
@@ -28223,7 +28578,7 @@ var require_errors$5 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region node_modules/@npmcli/git/lib/make-error.js
 var require_make_error = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const { GitConnectionError, GitPathspecError, GitUnknownError } = require_errors$5();
+	const { GitConnectionError, GitPathspecError, GitUnknownError } = require_errors$4();
 	const connectionErrorRe = new RegExp([
 		"remote error: Internal Server Error",
 		"The remote end hung up unexpectedly",
@@ -29478,7 +29833,7 @@ var require_clone = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		"bitbucket.com",
 		"bitbucket.org"
 	]);
-	const { parse: parse$2 } = __require("url");
+	const { parse: parse$3 } = __require("url");
 	const path$44 = __require("path");
 	const getRevs = require_revs();
 	const spawn = require_spawn();
@@ -29488,7 +29843,7 @@ var require_clone = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = (repo, ref = "HEAD", target = null, opts = {}) => getRevs(repo, opts).then((revs) => clone(repo, revs, ref, resolveRef(revs, ref, opts), target || defaultTarget(repo, opts.cwd), opts));
 	const maybeShallow = (repo, opts) => {
 		if (opts.gitShallow === false || opts.gitShallow) return opts.gitShallow;
-		return shallowHosts.has(parse$2(repo).host);
+		return shallowHosts.has(parse$3(repo).host);
 	};
 	const defaultTarget = (repo, cwd = process.cwd()) => path$44.resolve(cwd, path$44.basename(repo.replace(/[/\\]?\.git$/, "")));
 	const clone = (repo, revs, ref, revDoc, target, opts) => {
@@ -29633,7 +29988,7 @@ var require_lib$26 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		is: require_is(),
 		find: require_find$1(),
 		isClean: require_is_clean(),
-		errors: require_errors$5()
+		errors: require_errors$4()
 	};
 }));
 
@@ -32547,7 +32902,7 @@ var require_node$3 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 
 //#endregion
 //#region node_modules/@npmcli/fs/lib/cp/errors.js
-var require_errors$4 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+var require_errors$3 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const { inspect } = __require("util");
 	var SystemError = class {
 		constructor(code, prefix, context) {
@@ -32655,10 +33010,10 @@ var require_errors$4 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region node_modules/@npmcli/fs/lib/cp/polyfill.js
 var require_polyfill = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const { ERR_FS_CP_DIR_TO_NON_DIR, ERR_FS_CP_EEXIST, ERR_FS_CP_EINVAL, ERR_FS_CP_FIFO_PIPE, ERR_FS_CP_NON_DIR_TO_DIR, ERR_FS_CP_SOCKET, ERR_FS_CP_SYMLINK_TO_SUBDIRECTORY, ERR_FS_CP_UNKNOWN, ERR_FS_EISDIR, ERR_INVALID_ARG_TYPE } = require_errors$4();
+	const { ERR_FS_CP_DIR_TO_NON_DIR, ERR_FS_CP_EEXIST, ERR_FS_CP_EINVAL, ERR_FS_CP_FIFO_PIPE, ERR_FS_CP_NON_DIR_TO_DIR, ERR_FS_CP_SOCKET, ERR_FS_CP_SYMLINK_TO_SUBDIRECTORY, ERR_FS_CP_UNKNOWN, ERR_FS_EISDIR, ERR_INVALID_ARG_TYPE } = require_errors$3();
 	const { constants: { errno: { EEXIST, EISDIR, EINVAL, ENOTDIR } } } = __require("os");
 	const { chmod: chmod$3, copyFile: copyFile$1, lstat: lstat$5, mkdir: mkdir$6, readdir: readdir$5, readlink: readlink$6, stat: stat$6, symlink: symlink$2, unlink: unlink$1, utimes } = __require("fs/promises");
-	const { dirname: dirname$24, isAbsolute: isAbsolute$3, join: join$8, parse: parse$1, resolve: resolve$27, sep: sep$8, toNamespacedPath } = __require("path");
+	const { dirname: dirname$24, isAbsolute: isAbsolute$3, join: join$8, parse: parse$2, resolve: resolve$27, sep: sep$8, toNamespacedPath } = __require("path");
 	const { fileURLToPath: fileURLToPath$2 } = __require("url");
 	const defaultOptions = {
 		dereference: false,
@@ -32747,7 +33102,7 @@ var require_polyfill = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	async function checkParentPaths(src, srcStat, dest) {
 		const srcParent = resolve$27(dirname$24(src));
 		const destParent = resolve$27(dirname$24(dest));
-		if (destParent === srcParent || destParent === parse$1(destParent).root) return;
+		if (destParent === srcParent || destParent === parse$2(destParent).root) return;
 		let destStat;
 		try {
 			destStat = await stat$6(destParent, { bigint: true });
@@ -39236,7 +39591,7 @@ var require_dir = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 
 //#endregion
 //#region node_modules/npm-registry-fetch/lib/errors.js
-var require_errors$3 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+var require_errors$2 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const { URL: URL$8 } = __require("node:url");
 	function packageName(href) {
 		try {
@@ -39306,7 +39661,7 @@ var require_errors$3 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 
 //#endregion
 //#region node_modules/minizlib/dist/commonjs/constants.js
-var require_constants$7 = /* @__PURE__ */ __commonJSMin(((exports) => {
+var require_constants$6 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	var __importDefault = exports && exports.__importDefault || function(mod) {
 		return mod && mod.__esModule ? mod : { "default": mod };
 	};
@@ -39478,8 +39833,8 @@ var require_commonjs$4 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	const buffer_1$1 = __require("buffer");
 	const minipass_1 = require_commonjs$5();
 	const realZlib = __importStar(__require("zlib"));
-	const constants_js_1 = require_constants$7();
-	var constants_js_2 = require_constants$7();
+	const constants_js_1 = require_constants$6();
+	var constants_js_2 = require_constants$6();
 	Object.defineProperty(exports, "constants", {
 		enumerable: true,
 		get: function() {
@@ -41187,7 +41542,7 @@ var require_lib$15 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region node_modules/npm-registry-fetch/lib/check-response.js
 var require_check_response = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const errors = require_errors$3();
+	const errors = require_errors$2();
 	const { Response } = require_lib$16();
 	const defaultOpts = require_default_opts();
 	const { log } = require_lib$39();
@@ -42862,7 +43217,7 @@ var require_policy$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 
 //#endregion
 //#region node_modules/make-fetch-happen/lib/cache/errors.js
-var require_errors$2 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+var require_errors$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var NotCachedError = class extends Error {
 		constructor(url) {
 			super(`request to ${url} failed: cache mode is 'only-if-cached' but no cached response is available.`);
@@ -44688,7 +45043,7 @@ var require_smartbuffer = /* @__PURE__ */ __commonJSMin(((exports) => {
 
 //#endregion
 //#region node_modules/socks/build/common/constants.js
-var require_constants$6 = /* @__PURE__ */ __commonJSMin(((exports) => {
+var require_constants$5 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.SOCKS5_NO_ACCEPTABLE_AUTH = exports.SOCKS5_CUSTOM_AUTH_END = exports.SOCKS5_CUSTOM_AUTH_START = exports.SOCKS_INCOMING_PACKET_SIZES = exports.SocksClientState = exports.Socks5Response = exports.Socks5HostType = exports.Socks5Auth = exports.Socks4Response = exports.SocksCommand = exports.ERRORS = exports.DEFAULT_TIMEOUT = void 0;
 	const DEFAULT_TIMEOUT = 3e4;
@@ -44954,7 +45309,7 @@ var require_common$4 = /* @__PURE__ */ __commonJSMin(((exports) => {
 
 //#endregion
 //#region node_modules/ip-address/dist/v4/constants.js
-var require_constants$5 = /* @__PURE__ */ __commonJSMin(((exports) => {
+var require_constants$4 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.SPECIAL_PURPOSE = exports.RE_SUBNET_STRING = exports.RE_ADDRESS = exports.GROUPS = exports.BITS = void 0;
 	exports.BITS = 32;
@@ -45143,7 +45498,7 @@ var require_ipv4 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.Address4 = void 0;
 	const common = __importStar(require_common$4());
-	const constants = __importStar(require_constants$5());
+	const constants = __importStar(require_constants$4());
 	const address_error_1 = require_address_error();
 	const isCorrect4 = common.isCorrect(constants.BITS);
 	/**
@@ -45651,7 +46006,7 @@ var require_ipv4 = /* @__PURE__ */ __commonJSMin(((exports) => {
 
 //#endregion
 //#region node_modules/ip-address/dist/v6/constants.js
-var require_constants$4 = /* @__PURE__ */ __commonJSMin(((exports) => {
+var require_constants$3 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.SPECIAL_PURPOSE = exports.RE_URL_WITH_PORT = exports.RE_URL = exports.RE_ZONE_STRING = exports.RE_SUBNET_STRING = exports.RE_BAD_ADDRESS = exports.RE_BAD_CHARACTERS = exports.TYPES = exports.SCOPES = exports.GROUPS = exports.BITS = void 0;
 	exports.BITS = 128;
@@ -45965,7 +46320,7 @@ var require_regular_expressions = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.padGroup = padGroup;
 	exports.simpleRegularExpression = simpleRegularExpression;
 	exports.possibleElisions = possibleElisions;
-	const v6 = __importStar(require_constants$4());
+	const v6 = __importStar(require_constants$3());
 	function groupPossibilities(possibilities) {
 		return `(${possibilities.join("|")})`;
 	}
@@ -46041,8 +46396,8 @@ var require_ipv6 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.Address6 = void 0;
 	const common = __importStar(require_common$4());
-	const constants4 = __importStar(require_constants$5());
-	const constants6 = __importStar(require_constants$4());
+	const constants4 = __importStar(require_constants$4());
+	const constants6 = __importStar(require_constants$3());
 	const helpers = __importStar(require_helpers$1());
 	const ipv4_1 = require_ipv4();
 	const regular_expressions_1 = require_regular_expressions();
@@ -47254,7 +47609,7 @@ var require_helpers = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.ipToBuffer = exports.int32ToIpv4 = exports.ipv4ToInt32 = exports.validateSocksClientChainOptions = exports.validateSocksClientOptions = void 0;
 	const util_1 = require_util$3();
-	const constants_1 = require_constants$6();
+	const constants_1 = require_constants$5();
 	const stream$1 = __require("stream");
 	const ip_address_1 = require_ip_address();
 	const net$2 = __require("net");
@@ -47421,7 +47776,7 @@ var require_socksclient = /* @__PURE__ */ __commonJSMin(((exports) => {
 	const events_1$1 = __require("events");
 	const net$1 = __require("net");
 	const smart_buffer_1 = require_smartbuffer();
-	const constants_1 = require_constants$6();
+	const constants_1 = require_constants$5();
 	const helpers_1 = require_helpers();
 	const receivebuffer_1 = require_receivebuffer();
 	const util_1 = require_util$3();
@@ -48176,7 +48531,7 @@ var init_dist = __esmMin((() => {
 
 //#endregion
 //#region node_modules/@npmcli/agent/lib/errors.js
-var require_errors$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+var require_errors = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var InvalidProxyProtocolError = class extends Error {
 		constructor(url) {
 			super(`Invalid protocol \`${url.protocol}\` connecting to proxy \`${url.host}\``);
@@ -48236,7 +48591,7 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const { HttpsProxyAgent } = (init_dist$1(), __toCommonJS(dist_exports$1));
 	const { SocksProxyAgent } = (init_dist(), __toCommonJS(dist_exports));
 	const { LRUCache } = require_index_min$2();
-	const { InvalidProxyProtocolError } = require_errors$1();
+	const { InvalidProxyProtocolError } = require_errors();
 	const PROXY_CACHE = new LRUCache({ max: 20 });
 	const SOCKS_PROTOCOLS = new Set(SocksProxyAgent.protocols);
 	const PROXY_ENV_KEYS = /* @__PURE__ */ new Set([
@@ -48291,7 +48646,7 @@ var require_agents = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const timers = __require("timers/promises");
 	const { normalizeOptions, cacheOptions } = require_options();
 	const { getProxy, getProxyAgent, proxyCache } = require_proxy();
-	const Errors = require_errors$1();
+	const Errors = require_errors();
 	const { Agent: AgentBase } = (init_dist$4(), __toCommonJS(dist_exports$3));
 	module.exports = class Agent extends AgentBase {
 		#options;
@@ -48926,7 +49281,7 @@ var require_entry$4 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region node_modules/make-fetch-happen/lib/cache/index.js
 var require_cache = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const { NotCachedError } = require_errors$2();
+	const { NotCachedError } = require_errors$1();
 	const CacheEntry = require_entry$4();
 	const remote = require_remote$1();
 	const cacheFetch = async (request, options) => {
@@ -49564,7 +49919,7 @@ var require_json_stream = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region node_modules/npm-registry-fetch/lib/index.js
 var require_lib$12 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const { HttpErrorAuthOTP } = require_errors$3();
+	const { HttpErrorAuthOTP } = require_errors$2();
 	const checkResponse = require_check_response();
 	const getAuth = require_auth$1();
 	const fetch = require_lib$13();
@@ -51746,7 +52101,7 @@ var require_length = /* @__PURE__ */ __commonJSMin(((exports) => {
 
 //#endregion
 //#region node_modules/@sigstore/core/dist/asn1/parse.js
-var require_parse$5 = /* @__PURE__ */ __commonJSMin(((exports) => {
+var require_parse$4 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.parseInteger = parseInteger;
 	exports.parseStringASCII = parseStringASCII;
@@ -51901,7 +52256,7 @@ var require_obj = /* @__PURE__ */ __commonJSMin(((exports) => {
 	const stream_1 = require_stream$5();
 	const error_1 = require_error$10();
 	const length_1 = require_length();
-	const parse_1 = require_parse$5();
+	const parse_1 = require_parse$4();
 	const tag_1 = require_tag$1();
 	var ASN1Obj = class {
 		tag;
@@ -68295,7 +68650,7 @@ var require_line_endings = /* @__PURE__ */ __commonJSMin(((exports) => {
 
 //#endregion
 //#region node_modules/diff/libcjs/patch/parse.js
-var require_parse$4 = /* @__PURE__ */ __commonJSMin(((exports) => {
+var require_parse$3 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.parsePatch = parsePatch;
 	/**
@@ -68411,7 +68766,7 @@ var require_apply = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.applyPatches = applyPatches;
 	var string_js_1 = require_string$2();
 	var line_endings_js_1 = require_line_endings();
-	var parse_js_1 = require_parse$4();
+	var parse_js_1 = require_parse$3();
 	var distance_iterator_js_1 = require_distance_iterator();
 	/**
 	* attempts to apply a unified diff patch.
@@ -69012,7 +69367,7 @@ var require_libcjs = /* @__PURE__ */ __commonJSMin(((exports) => {
 			return apply_js_1.applyPatches;
 		}
 	});
-	var parse_js_1 = require_parse$4();
+	var parse_js_1 = require_parse$3();
 	Object.defineProperty(exports, "parsePatch", {
 		enumerable: true,
 		get: function() {
@@ -77598,7 +77953,7 @@ async function getCacheInfoWithRefreshTime(cache, key) {
 //#endregion
 //#region lib/util/inflight.ts
 var import_lib$2 = /* @__PURE__ */ __toESM(require_lib$10());
-var inflight_default = Inflight;
+var inflight_default = InflightStore;
 
 //#endregion
 //#region node_modules/pkg-preper/dist/index.js
@@ -78543,7 +78898,7 @@ var require_expand = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 
 //#endregion
 //#region node_modules/braces/lib/constants.js
-var require_constants$3 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+var require_constants$2 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = {
 		MAX_LENGTH: 1e4,
 		CHAR_0: "0",
@@ -78595,12 +78950,12 @@ var require_constants$3 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 
 //#endregion
 //#region node_modules/braces/lib/parse.js
-var require_parse$3 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+var require_parse$2 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const stringify = require_stringify();
 	/**
 	* Constants
 	*/
-	const { MAX_LENGTH, CHAR_BACKSLASH, CHAR_BACKTICK, CHAR_COMMA, CHAR_DOT, CHAR_LEFT_PARENTHESES, CHAR_RIGHT_PARENTHESES, CHAR_LEFT_CURLY_BRACE, CHAR_RIGHT_CURLY_BRACE, CHAR_LEFT_SQUARE_BRACKET, CHAR_RIGHT_SQUARE_BRACKET, CHAR_DOUBLE_QUOTE, CHAR_SINGLE_QUOTE, CHAR_NO_BREAK_SPACE, CHAR_ZERO_WIDTH_NOBREAK_SPACE } = require_constants$3();
+	const { MAX_LENGTH, CHAR_BACKSLASH, CHAR_BACKTICK, CHAR_COMMA, CHAR_DOT, CHAR_LEFT_PARENTHESES, CHAR_RIGHT_PARENTHESES, CHAR_LEFT_CURLY_BRACE, CHAR_RIGHT_CURLY_BRACE, CHAR_LEFT_SQUARE_BRACKET, CHAR_RIGHT_SQUARE_BRACKET, CHAR_DOUBLE_QUOTE, CHAR_SINGLE_QUOTE, CHAR_NO_BREAK_SPACE, CHAR_ZERO_WIDTH_NOBREAK_SPACE } = require_constants$2();
 	/**
 	* parse
 	*/
@@ -78887,7 +79242,7 @@ var require_braces = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const stringify = require_stringify();
 	const compile = require_compile();
 	const expand = require_expand();
-	const parse = require_parse$3();
+	const parse = require_parse$2();
 	/**
 	* Expand the given pattern or create a regex-compatible string.
 	*
@@ -79011,7 +79366,7 @@ var require_braces = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 
 //#endregion
 //#region node_modules/picomatch/lib/constants.js
-var require_constants$2 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+var require_constants$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const path$28 = __require("path");
 	const WIN_SLASH = "\\\\/";
 	const WIN_NO_SLASH = `[^${WIN_SLASH}]`;
@@ -79188,7 +79543,7 @@ var require_constants$2 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 var require_utils$3 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	const path$27 = __require("path");
 	const win32 = process.platform === "win32";
-	const { REGEX_BACKSLASH, REGEX_REMOVE_BACKSLASH, REGEX_SPECIAL_CHARS, REGEX_SPECIAL_CHARS_GLOBAL } = require_constants$2();
+	const { REGEX_BACKSLASH, REGEX_REMOVE_BACKSLASH, REGEX_SPECIAL_CHARS, REGEX_SPECIAL_CHARS_GLOBAL } = require_constants$1();
 	exports.isObject = (val) => val !== null && typeof val === "object" && !Array.isArray(val);
 	exports.hasRegexChars = (str) => REGEX_SPECIAL_CHARS.test(str);
 	exports.isRegexChar = (str) => str.length === 1 && exports.hasRegexChars(str);
@@ -79233,7 +79588,7 @@ var require_utils$3 = /* @__PURE__ */ __commonJSMin(((exports) => {
 //#region node_modules/picomatch/lib/scan.js
 var require_scan = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const utils = require_utils$3();
-	const { CHAR_ASTERISK, CHAR_AT, CHAR_BACKWARD_SLASH, CHAR_COMMA, CHAR_DOT, CHAR_EXCLAMATION_MARK, CHAR_FORWARD_SLASH, CHAR_LEFT_CURLY_BRACE, CHAR_LEFT_PARENTHESES, CHAR_LEFT_SQUARE_BRACKET, CHAR_PLUS, CHAR_QUESTION_MARK, CHAR_RIGHT_CURLY_BRACE, CHAR_RIGHT_PARENTHESES, CHAR_RIGHT_SQUARE_BRACKET } = require_constants$2();
+	const { CHAR_ASTERISK, CHAR_AT, CHAR_BACKWARD_SLASH, CHAR_COMMA, CHAR_DOT, CHAR_EXCLAMATION_MARK, CHAR_FORWARD_SLASH, CHAR_LEFT_CURLY_BRACE, CHAR_LEFT_PARENTHESES, CHAR_LEFT_SQUARE_BRACKET, CHAR_PLUS, CHAR_QUESTION_MARK, CHAR_RIGHT_CURLY_BRACE, CHAR_RIGHT_PARENTHESES, CHAR_RIGHT_SQUARE_BRACKET } = require_constants$1();
 	const isPathSeparator = (code) => {
 		return code === CHAR_FORWARD_SLASH || code === CHAR_BACKWARD_SLASH;
 	};
@@ -79519,8 +79874,8 @@ var require_scan = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 
 //#endregion
 //#region node_modules/picomatch/lib/parse.js
-var require_parse$2 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const constants = require_constants$2();
+var require_parse$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const constants = require_constants$1();
 	const utils = require_utils$3();
 	/**
 	* Constants
@@ -80585,9 +80940,9 @@ var require_parse$2 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 var require_picomatch$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const path$26 = __require("path");
 	const scan = require_scan();
-	const parse = require_parse$2();
+	const parse = require_parse$1();
 	const utils = require_utils$3();
-	const constants = require_constants$2();
+	const constants = require_constants$1();
 	const isObject = (val) => val && typeof val === "object" && !Array.isArray(val);
 	/**
 	* Creates a matcher function from one or more glob patterns. The
@@ -81883,7 +82238,7 @@ var require_run_parallel = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 
 //#endregion
 //#region node_modules/@nodelib/fs.scandir/out/constants.js
-var require_constants$1 = /* @__PURE__ */ __commonJSMin(((exports) => {
+var require_constants = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.IS_SUPPORT_READDIR_WITH_FILE_TYPES = void 0;
 	const NODE_PROCESS_VERSION_PARTS = process.versions.node.split(".");
@@ -81954,7 +82309,7 @@ var require_async$4 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.readdir = exports.readdirWithFileTypes = exports.read = void 0;
 	const fsStat = require_out$3();
 	const rpl = require_run_parallel();
-	const constants_1 = require_constants$1();
+	const constants_1 = require_constants();
 	const utils = require_utils$1();
 	const common = require_common$3();
 	function read(directory, settings, callback) {
@@ -82059,7 +82414,7 @@ var require_sync$4 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.readdir = exports.readdirWithFileTypes = exports.read = void 0;
 	const fsStat = require_out$3();
-	const constants_1 = require_constants$1();
+	const constants_1 = require_constants();
 	const utils = require_utils$1();
 	const common = require_common$3();
 	function read(directory, settings) {
@@ -84270,7 +84625,7 @@ var require_readShebang = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 
 //#endregion
 //#region node_modules/cross-spawn/lib/parse.js
-var require_parse$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const path$17 = __require("path");
 	const resolveCommand = require_resolveCommand();
 	const escape = require_escape();
@@ -84374,7 +84729,7 @@ var require_enoent = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#region node_modules/cross-spawn/index.js
 var require_cross_spawn = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const cp = __require("child_process");
-	const parse = require_parse$1();
+	const parse = require_parse();
 	const enoent = require_enoent();
 	function spawn(command, args, options) {
 		const parsed = parse(command, args, options);
@@ -87772,6 +88127,13 @@ var VisualExec = class {
 	kill(signal) {
 		this.abort(signal);
 	}
+	/**
+	* Attach to an already-started child and render its output.
+	*
+	* Resolves with the command's `ExecOutput`, unless an `onComplete` callback returned a
+	* value - that value is passed through instead. `T` names what the caller expects back;
+	* it defaults to `ExecOutput`, which is what a run without an `onComplete` produces.
+	*/
 	show(child) {
 		this._stdoutKey = Symbol("visual-exec-stdout");
 		this._stderrKey = Symbol("visual-exec-stderr");
@@ -87815,13 +88177,14 @@ var VisualExec = class {
 		let timeoutId;
 		const startTime = Date.now();
 		let execPromise = child.promise.catch((err) => {
-			var _a, _b, _c, _d;
-			const output = (_a = err.output) !== null && _a !== void 0 ? _a : {
+			var _a;
+			var _b, _c, _d;
+			const output = (_b = err.output) !== null && _b !== void 0 ? _b : {
 				stdout: "",
 				stderr: ""
 			};
-			const exitCode = (_c = (_b = err.exitCode) !== null && _b !== void 0 ? _b : err.code) !== null && _c !== void 0 ? _c : 1;
-			(_d = this._onComplete) === null || _d === void 0 || _d.call(this, output, exitCode);
+			const exitCode = (_d = (_c = err.exitCode) !== null && _c !== void 0 ? _c : err.code) !== null && _d !== void 0 ? _d : 1;
+			(_a = this._onComplete) === null || _a === void 0 || _a.call(this, output, exitCode);
 			this.logResult(err);
 			throw err;
 		}).then((output) => {
@@ -87922,6 +88285,12 @@ var VisualExec = class {
 		logs.push(chalk.blue("\n<<<"), `End of output from ${this._outputLabel} ---`);
 		this._logger.prefix(false)[level](...logs);
 	}
+	/**
+	* Run the command and render its output.
+	*
+	* Resolves with `ExecOutput`, or with whatever an `onComplete` callback returned in its
+	* place. `T` defaults to `ExecOutput` so the common case needs no cast at the call site.
+	*/
 	execute(command) {
 		this._startTime = Date.now();
 		this._aborted = false;
@@ -87951,13 +88320,14 @@ var VisualExec = class {
 			};
 		};
 		child.promise = child.promise.catch((err) => {
-			var _a, _b, _c, _d, _e;
-			const output = (_a = err.output) !== null && _a !== void 0 ? _a : {
+			var _a;
+			var _b, _c, _d, _e;
+			const output = (_b = err.output) !== null && _b !== void 0 ? _b : {
 				stdout: "",
 				stderr: ""
 			};
-			const exitCode = (_b = err.code) !== null && _b !== void 0 ? _b : 1;
-			const signal = (_e = (_c = err.signal) !== null && _c !== void 0 ? _c : ((_d = result.child) === null || _d === void 0 ? void 0 : _d.killed) ? "SIGTERM" : null) !== null && _e !== void 0 ? _e : null;
+			const exitCode = (_c = err.code) !== null && _c !== void 0 ? _c : 1;
+			const signal = (_e = (_d = err.signal) !== null && _d !== void 0 ? _d : ((_a = result.child) === null || _a === void 0 ? void 0 : _a.killed) ? "SIGTERM" : null) !== null && _e !== void 0 ? _e : null;
 			const context = {
 				...baseContext(output),
 				exitCode,
@@ -89509,7 +89879,7 @@ var PkgSrcManager = class {
 	}
 	pkgPreperInstallDep(dir, displayTitle) {
 		const node = process.env.NODE || process.execPath;
-		const fyn = Path.join(__dirname, "../bin/fyn.js");
+		const fyn = Path.join(__dirname, "../bin/fyn.mjs");
 		return new VisualExec({
 			displayTitle,
 			cwd: dir,
@@ -91393,9 +91763,9 @@ var PkgDepLocker = class {
 					const dist = vpkg.dist || {};
 					if (vpkg.top) meta.top = 1;
 					const scripts = json.scripts || {};
-					if (vpkg.optFailed) meta.optFailed = vpkg.optFailed;
+					if (vpkg.optFailed && vpkg.optFailed !== 3) meta.optFailed = vpkg.optFailed;
 					else if (scripts.preinstall || vpkg.hasPI) meta.hasPI = 1;
-					if (scripts.install || scripts.postinstall || scripts.postInstall) meta.hasI = 1;
+					if (scripts.install || scripts.postinstall || scripts.postInstall || vpkg.hasI) meta.hasI = 1;
 					if (vpkg.local) {
 						meta.$ = "local";
 						meta._ = dist.fullPath;
@@ -91404,7 +91774,7 @@ var PkgDepLocker = class {
 						meta._ = dist.tarball;
 					}
 					if (!meta.optFailed) {
-						if (import_lodash_min.default.isEmpty(json)) meta._missingJson = true;
+						if (import_lodash_min.default.isEmpty(json) || json._missingJson) meta._missingJson = true;
 						else {
 							if (!import_lodash_min.default.isEmpty(json.dependencies)) meta.dependencies = json.dependencies;
 							if (!import_lodash_min.default.isEmpty(json.optionalDependencies)) meta.optionalDependencies = json.optionalDependencies;
@@ -91501,26 +91871,28 @@ var PkgDepLocker = class {
 				const badVersionKey = !(vpkg && vpkg.$ === "local") && !import_semver.default.valid(version);
 				const badDeps = vpkg && vpkg.dependencies && !this._depsResolvable(vpkg.dependencies);
 				if (!import_lodash_min.default.isEmpty(vpkg) && vpkg._valid !== false && !badVersionKey && !badDeps) {
+					const { $: _dollar, _: _under, top: _top, _valid: _v, ...carried } = vpkg;
+					const expanded = {
+						...carried,
+						fromLocked: true,
+						name: item.name,
+						version,
+						_hasShrinkwrap: Boolean(vpkg._hasShrinkwrap)
+					};
 					if (vpkg.$ === "local") {
-						vpkg.local = true;
-						vpkg.dist = {
+						expanded.local = isLocalHard(version) ? "hard" : "sym";
+						expanded.dist = {
 							integrity: "local",
 							fullPath: vpkg._
 						};
 					} else {
 						const tarballUrl = this.normalizeTarballUrl(item, vpkg._);
-						vpkg.dist = {
+						expanded.dist = {
 							integrity: fyntil.shaToIntegrity(vpkg.$),
 							tarball: tarballUrl
 						};
 					}
-					vpkg.$ = void 0;
-					vpkg._ = void 0;
-					vpkg.fromLocked = true;
-					vpkg.name = item.name;
-					vpkg.version = version;
-					if (vpkg._hasShrinkwrap) vpkg._hasShrinkwrap = true;
-					versions[version] = vpkg;
+					versions[version] = expanded;
 				} else {
 					if (badVersionKey) logger$1.error(`lockfile entry for ${item.name} has invalid version key "${version}" - ignoring and re-resolving from registry`);
 					else if (badDeps) logger$1.error(`lockfile entry ${item.name}@${version} has dependencies not satisfiable within the lock (corrupt lock) - ignoring and re-resolving from registry`);
@@ -91558,7 +91930,10 @@ var PkgDepLocker = class {
 		}
 		if (Object.prototype.hasOwnProperty.call(rangeMap, spec)) return true;
 		if (!import_semver.default.validRange(spec)) return true;
-		return versions.some((v) => import_semver.default.valid(v) && import_semver.default.satisfies(v, spec));
+		return versions.some((v) => {
+			const base = unlocalify(v);
+			return import_semver.default.valid(base) && import_semver.default.satisfies(base, spec);
+		});
 	}
 	/**
 	* Set the package.json's dependencies items and check if they changed from
@@ -91778,7 +92153,7 @@ var DepData = class {
 		return bad ? this.badPkgs : this.pkgs;
 	}
 	getPkg(item) {
-		return this.getPkgsData(item.optFailed)[item.name];
+		return this.getPkgsData(Boolean(item.optFailed))[item.name];
 	}
 	getPkgById(id) {
 		const lastAt = id.lastIndexOf("@");
@@ -94267,434 +94642,333 @@ var require_invariant = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 
 //#endregion
 //#region node_modules/strip-bom/index.js
-var strip_bom_exports = /* @__PURE__ */ __exportAll({ default: () => stripBom });
+var import_invariant = /* @__PURE__ */ __toESM(require_invariant());
 function stripBom(string) {
 	if (typeof string !== "string") throw new TypeError(`Expected a string, got ${typeof string}`);
 	if (string.charCodeAt(0) === 65279) return string.slice(1);
 	return string;
 }
-var init_strip_bom = __esmMin((() => {}));
 
 //#endregion
-//#region yarn/lib/constants.js
-var require_constants = /* @__PURE__ */ __commonJSMin(((exports) => {
-	Object.defineProperty(exports, "__esModule", { value: true });
-	exports.LOCKFILE_VERSION = void 0;
-	exports.LOCKFILE_VERSION = 1;
-}));
-
-//#endregion
-//#region yarn/lib/errors.js
-var require_errors = /* @__PURE__ */ __commonJSMin(((exports) => {
-	Object.defineProperty(exports, "__esModule", { value: true });
-	exports.SecurityError = exports.ResponseError = exports.ProcessTermError = exports.ProcessSpawnError = exports.OneTimePasswordError = exports.MessageError = void 0;
-	function _defineProperty(e, r, t) {
-		return (r = _toPropertyKey(r)) in e ? Object.defineProperty(e, r, {
-			value: t,
-			enumerable: !0,
-			configurable: !0,
-			writable: !0
-		}) : e[r] = t, e;
-	}
-	function _toPropertyKey(t) {
-		var i = _toPrimitive(t, "string");
-		return "symbol" == typeof i ? i : i + "";
-	}
-	function _toPrimitive(t, r) {
-		if ("object" != typeof t || !t) return t;
-		var e = t[Symbol.toPrimitive];
-		if (void 0 !== e) {
-			var i = e.call(t, r || "default");
-			if ("object" != typeof i) return i;
-			throw new TypeError("@@toPrimitive must return a primitive value.");
-		}
-		return ("string" === r ? String : Number)(t);
-	}
-	var MessageError = class extends Error {
-		constructor(msg, code) {
-			super(msg);
-			_defineProperty(this, "code", void 0);
-			this.code = code;
-		}
-	};
-	exports.MessageError = MessageError;
-	var ProcessSpawnError = class extends MessageError {
-		constructor(msg, code, process) {
-			super(msg, code);
-			_defineProperty(this, "process", void 0);
-			this.process = process;
-		}
-	};
-	exports.ProcessSpawnError = ProcessSpawnError;
-	var SecurityError = class extends MessageError {};
-	exports.SecurityError = SecurityError;
-	var ProcessTermError = class extends MessageError {
-		constructor(...args) {
-			super(...args);
-			_defineProperty(this, "EXIT_CODE", void 0);
-			_defineProperty(this, "EXIT_SIGNAL", void 0);
-		}
-	};
-	exports.ProcessTermError = ProcessTermError;
-	var ResponseError = class extends Error {
-		constructor(msg, responseCode) {
-			super(msg);
-			_defineProperty(this, "responseCode", void 0);
-			this.responseCode = responseCode;
-		}
-	};
-	exports.ResponseError = ResponseError;
-	var OneTimePasswordError = class extends Error {};
-	exports.OneTimePasswordError = OneTimePasswordError;
-}));
+//#region yarn/src/errors.ts
+var MessageError = class extends Error {
+	constructor(msg, code) {
+		super(msg);
+		this.code = code;
+	}
+	code;
+};
 
 //#endregion
-//#region yarn/lib/util/map.js
-var require_map = /* @__PURE__ */ __commonJSMin(((exports) => {
-	Object.defineProperty(exports, "__esModule", { value: true });
-	exports.default = nullify;
-	function nullify(obj = {}) {
-		if (Array.isArray(obj)) for (const item of obj) nullify(item);
-		else if (obj !== null && typeof obj === "object" || typeof obj === "function") {
-			Object.setPrototypeOf(obj, null);
-			if (typeof obj === "object") for (const key in obj) nullify(obj[key]);
-		}
-		return obj;
+//#region yarn/src/util/map.ts
+function nullify(obj = {}) {
+	if (Array.isArray(obj)) for (const item of obj) nullify(item);
+	else if (obj !== null && typeof obj === "object" || typeof obj === "function") {
+		Object.setPrototypeOf(obj, null);
+		if (typeof obj === "object") for (const key in obj) nullify(obj[key]);
 	}
-}));
+	return obj;
+}
 
 //#endregion
-//#region yarn/lib/lockfile/parse.js
-var require_parse = /* @__PURE__ */ __commonJSMin(((exports) => {
-	Object.defineProperty(exports, "__esModule", { value: true });
-	exports.default = _default;
-	var _util = _interopRequireDefault(__require("util"));
-	var _invariant = _interopRequireDefault(require_invariant());
-	var _stripBom = _interopRequireDefault((init_strip_bom(), __toCommonJS(strip_bom_exports)));
-	var _constants = require_constants();
-	var _errors = require_errors();
-	var _map = _interopRequireDefault(require_map());
-	var _yamljs = _interopRequireDefault(require_Yaml());
-	function _interopRequireDefault(e) {
-		return e && e.__esModule ? e : { default: e };
-	}
-	function _defineProperty(e, r, t) {
-		return (r = _toPropertyKey(r)) in e ? Object.defineProperty(e, r, {
-			value: t,
-			enumerable: !0,
-			configurable: !0,
-			writable: !0
-		}) : e[r] = t, e;
-	}
-	function _toPropertyKey(t) {
-		var i = _toPrimitive(t, "string");
-		return "symbol" == typeof i ? i : i + "";
-	}
-	function _toPrimitive(t, r) {
-		if ("object" != typeof t || !t) return t;
-		var e = t[Symbol.toPrimitive];
-		if (void 0 !== e) {
-			var i = e.call(t, r || "default");
-			if ("object" != typeof i) return i;
-			throw new TypeError("@@toPrimitive must return a primitive value.");
-		}
-		return ("string" === r ? String : Number)(t);
-	}
-	const VERSION_REGEX = /^yarn lockfile v(\d+)$/;
-	const TOKEN_TYPES = {
-		boolean: "BOOLEAN",
-		string: "STRING",
-		identifier: "IDENTIFIER",
-		eof: "EOF",
-		colon: "COLON",
-		newline: "NEWLINE",
-		comment: "COMMENT",
-		indent: "INDENT",
-		invalid: "INVALID",
-		number: "NUMBER",
-		comma: "COMMA"
-	};
-	const VALID_PROP_VALUE_TOKENS = [
-		TOKEN_TYPES.boolean,
-		TOKEN_TYPES.string,
-		TOKEN_TYPES.number
-	];
-	function isValidPropValueToken(token) {
-		return VALID_PROP_VALUE_TOKENS.indexOf(token.type) >= 0;
+//#region yarn/src/lockfile/parse.ts
+const VERSION_REGEX = /^yarn lockfile v(\d+)$/;
+const TOKEN_TYPES = {
+	boolean: "BOOLEAN",
+	string: "STRING",
+	identifier: "IDENTIFIER",
+	eof: "EOF",
+	colon: "COLON",
+	newline: "NEWLINE",
+	comment: "COMMENT",
+	indent: "INDENT",
+	invalid: "INVALID",
+	number: "NUMBER",
+	comma: "COMMA"
+};
+const VALID_PROP_VALUE_TOKENS = [
+	TOKEN_TYPES.boolean,
+	TOKEN_TYPES.string,
+	TOKEN_TYPES.number
+];
+function isValidPropValueToken(token) {
+	return VALID_PROP_VALUE_TOKENS.indexOf(token.type) >= 0;
+}
+function* tokenise(input) {
+	let lastNewline = false;
+	let line = 1;
+	let col = 0;
+	function buildToken(type, value) {
+		return {
+			line,
+			col,
+			type,
+			value
+		};
 	}
-	function* tokenise(input) {
-		let lastNewline = false;
-		let line = 1;
-		let col = 0;
-		function buildToken(type, value) {
-			return {
-				line,
-				col,
-				type,
-				value
-			};
-		}
-		while (input.length) {
-			let chop = 0;
-			if (input[0] === "\n" || input[0] === "\r") {
-				chop++;
-				if (input[1] === "\n") chop++;
-				line++;
-				col = 0;
-				yield buildToken(TOKEN_TYPES.newline);
-			} else if (input[0] === "#") {
-				chop++;
-				let nextNewline = input.indexOf("\n", chop);
-				if (nextNewline === -1) nextNewline = input.length;
-				const val = input.substring(chop, nextNewline);
-				chop = nextNewline;
-				yield buildToken(TOKEN_TYPES.comment, val);
-			} else if (input[0] === " ") {
-				if (lastNewline) {
-					let indentSize = 1;
-					for (let i = 1; input[i] === " "; i++) indentSize++;
-					if (indentSize % 2) throw new TypeError("Invalid number of spaces");
-					else {
-						chop = indentSize;
-						yield buildToken(TOKEN_TYPES.indent, indentSize / 2);
-					}
-				} else chop++;
-			} else if (input[0] === "\"") {
-				let i = 1;
-				for (; i < input.length; i++) if (input[i] === "\"") {
-					if (!(input[i - 1] === "\\" && input[i - 2] !== "\\")) {
-						i++;
-						break;
-					}
+	while (input.length) {
+		let chop = 0;
+		if (input[0] === "\n" || input[0] === "\r") {
+			chop++;
+			if (input[1] === "\n") chop++;
+			line++;
+			col = 0;
+			yield buildToken(TOKEN_TYPES.newline);
+		} else if (input[0] === "#") {
+			chop++;
+			let nextNewline = input.indexOf("\n", chop);
+			if (nextNewline === -1) nextNewline = input.length;
+			const val = input.substring(chop, nextNewline);
+			chop = nextNewline;
+			yield buildToken(TOKEN_TYPES.comment, val);
+		} else if (input[0] === " ") {
+			if (lastNewline) {
+				let indentSize = 1;
+				for (let i = 1; input[i] === " "; i++) indentSize++;
+				if (indentSize % 2) throw new TypeError("Invalid number of spaces");
+				else {
+					chop = indentSize;
+					yield buildToken(TOKEN_TYPES.indent, indentSize / 2);
+				}
+			} else chop++;
+		} else if (input[0] === "\"") {
+			let i = 1;
+			for (; i < input.length; i++) if (input[i] === "\"") {
+				if (!(input[i - 1] === "\\" && input[i - 2] !== "\\")) {
+					i++;
+					break;
 				}
-				const val = input.substring(0, i);
-				chop = i;
-				try {
-					yield buildToken(TOKEN_TYPES.string, JSON.parse(val));
-				} catch (err) {
-					if (err instanceof SyntaxError) yield buildToken(TOKEN_TYPES.invalid);
-					else throw err;
-				}
-			} else if (/^[0-9]/.test(input)) {
-				const val = /^[0-9]+/.exec(input)[0];
-				chop = val.length;
-				yield buildToken(TOKEN_TYPES.number, +val);
-			} else if (/^true/.test(input)) {
-				yield buildToken(TOKEN_TYPES.boolean, true);
-				chop = 4;
-			} else if (/^false/.test(input)) {
-				yield buildToken(TOKEN_TYPES.boolean, false);
-				chop = 5;
-			} else if (input[0] === ":") {
-				yield buildToken(TOKEN_TYPES.colon);
-				chop++;
-			} else if (input[0] === ",") {
-				yield buildToken(TOKEN_TYPES.comma);
-				chop++;
-			} else if (/^[a-zA-Z\/.-]/g.test(input)) {
-				let i = 0;
-				for (; i < input.length; i++) {
-					const char = input[i];
-					if (char === ":" || char === " " || char === "\n" || char === "\r" || char === ",") break;
-				}
-				const name = input.substring(0, i);
-				chop = i;
-				yield buildToken(TOKEN_TYPES.string, name);
-			} else yield buildToken(TOKEN_TYPES.invalid);
-			if (!chop) yield buildToken(TOKEN_TYPES.invalid);
-			col += chop;
-			lastNewline = input[0] === "\n" || input[0] === "\r" && input[1] === "\n";
-			input = input.slice(chop);
-		}
-		yield buildToken(TOKEN_TYPES.eof);
-	}
-	var Parser = class {
-		constructor(input, fileLoc = "lockfile") {
-			_defineProperty(this, "fileLoc", void 0);
-			_defineProperty(this, "token", void 0);
-			_defineProperty(this, "tokens", void 0);
-			_defineProperty(this, "comments", void 0);
-			this.comments = [];
-			this.tokens = tokenise(input);
-			this.fileLoc = fileLoc;
-		}
-		onComment(token) {
-			const value = token.value;
-			(0, _invariant.default)(typeof value === "string", "expected token value to be a string");
-			const comment = value.trim();
-			const versionMatch = comment.match(VERSION_REGEX);
-			if (versionMatch) {
-				const version = +versionMatch[1];
-				if (version > _constants.LOCKFILE_VERSION) throw new _errors.MessageError(`Can't install from a lockfile of version ${version} as you're on an old yarn version that only supports versions up to ${_constants.LOCKFILE_VERSION}. Run \`$ yarn self-update\` to upgrade to the latest version.`);
-			}
-			this.comments.push(comment);
-		}
-		next() {
-			const item = this.tokens.next();
-			(0, _invariant.default)(item, "expected a token");
-			const { done, value } = item;
-			if (done || !value) throw new Error("No more tokens");
-			else if (value.type === TOKEN_TYPES.comment) {
-				this.onComment(value);
-				return this.next();
-			} else return this.token = value;
-		}
-		unexpected(msg = "Unexpected token") {
-			throw new SyntaxError(`${msg} ${this.token.line}:${this.token.col} in ${this.fileLoc}`);
-		}
-		expect(tokType) {
-			if (this.token.type === tokType) this.next();
-			else this.unexpected();
-		}
-		eat(tokType) {
-			if (this.token.type === tokType) {
+			}
+			const val = input.substring(0, i);
+			chop = i;
+			try {
+				yield buildToken(TOKEN_TYPES.string, JSON.parse(val));
+			} catch (err) {
+				if (err instanceof SyntaxError) yield buildToken(TOKEN_TYPES.invalid);
+				else throw err;
+			}
+		} else if (/^[0-9]/.test(input)) {
+			const val = /^[0-9]+/.exec(input)[0];
+			chop = val.length;
+			yield buildToken(TOKEN_TYPES.number, +val);
+		} else if (/^true/.test(input)) {
+			yield buildToken(TOKEN_TYPES.boolean, true);
+			chop = 4;
+		} else if (/^false/.test(input)) {
+			yield buildToken(TOKEN_TYPES.boolean, false);
+			chop = 5;
+		} else if (input[0] === ":") {
+			yield buildToken(TOKEN_TYPES.colon);
+			chop++;
+		} else if (input[0] === ",") {
+			yield buildToken(TOKEN_TYPES.comma);
+			chop++;
+		} else if (/^[a-zA-Z\/.-]/g.test(input)) {
+			let i = 0;
+			for (; i < input.length; i++) {
+				const char = input[i];
+				if (char === ":" || char === " " || char === "\n" || char === "\r" || char === ",") break;
+			}
+			const name = input.substring(0, i);
+			chop = i;
+			yield buildToken(TOKEN_TYPES.string, name);
+		} else yield buildToken(TOKEN_TYPES.invalid);
+		if (!chop) yield buildToken(TOKEN_TYPES.invalid);
+		col += chop;
+		lastNewline = input[0] === "\n" || input[0] === "\r" && input[1] === "\n";
+		input = input.slice(chop);
+	}
+	yield buildToken(TOKEN_TYPES.eof);
+}
+var Parser$1 = class {
+	constructor(input, fileLoc = "lockfile") {
+		this.comments = [];
+		this.tokens = tokenise(input);
+		this.fileLoc = fileLoc;
+	}
+	fileLoc;
+	token;
+	tokens;
+	comments;
+	onComment(token) {
+		const value = token.value;
+		(0, import_invariant.default)(typeof value === "string", "expected token value to be a string");
+		const comment = value.trim();
+		const versionMatch = comment.match(VERSION_REGEX);
+		if (versionMatch) {
+			const version = +versionMatch[1];
+			if (version > 1) throw new MessageError(`Can't install from a lockfile of version ${version} as you're on an old yarn version that only supports versions up to ${1}. Run \`$ yarn self-update\` to upgrade to the latest version.`);
+		}
+		this.comments.push(comment);
+	}
+	next() {
+		const item = this.tokens.next();
+		(0, import_invariant.default)(item, "expected a token");
+		const { done, value } = item;
+		if (done || !value) throw new Error("No more tokens");
+		else if (value.type === TOKEN_TYPES.comment) {
+			this.onComment(value);
+			return this.next();
+		} else return this.token = value;
+	}
+	unexpected(msg = "Unexpected token") {
+		throw new SyntaxError(`${msg} ${this.token.line}:${this.token.col} in ${this.fileLoc}`);
+	}
+	expect(tokType) {
+		if (this.token.type === tokType) this.next();
+		else this.unexpected();
+	}
+	eat(tokType) {
+		if (this.token.type === tokType) {
+			this.next();
+			return true;
+		} else return false;
+	}
+	parse(indent = 0) {
+		const obj = nullify();
+		while (true) {
+			const propToken = this.token;
+			if (propToken.type === TOKEN_TYPES.newline) {
+				const nextToken = this.next();
+				if (!indent) continue;
+				if (nextToken.type !== TOKEN_TYPES.indent) break;
+				if (nextToken.value === indent) this.next();
+				else break;
+			} else if (propToken.type === TOKEN_TYPES.indent) {
+				if (propToken.value === indent) this.next();
+				else break;
+			} else if (propToken.type === TOKEN_TYPES.eof) break;
+			else if (propToken.type === TOKEN_TYPES.string) {
+				const key = propToken.value;
+				(0, import_invariant.default)(key, "Expected a key");
+				const keys = [key];
 				this.next();
-				return true;
-			} else return false;
-		}
-		parse(indent = 0) {
-			const obj = (0, _map.default)();
-			while (true) {
-				const propToken = this.token;
-				if (propToken.type === TOKEN_TYPES.newline) {
-					const nextToken = this.next();
-					if (!indent) continue;
-					if (nextToken.type !== TOKEN_TYPES.indent) break;
-					if (nextToken.value === indent) this.next();
-					else break;
-				} else if (propToken.type === TOKEN_TYPES.indent) {
-					if (propToken.value === indent) this.next();
-					else break;
-				} else if (propToken.type === TOKEN_TYPES.eof) break;
-				else if (propToken.type === TOKEN_TYPES.string) {
-					const key = propToken.value;
-					(0, _invariant.default)(key, "Expected a key");
-					const keys = [key];
+				while (this.token.type === TOKEN_TYPES.comma) {
+					this.next();
+					const keyToken = this.token;
+					if (keyToken.type !== TOKEN_TYPES.string) this.unexpected("Expected string");
+					const key = keyToken.value;
+					(0, import_invariant.default)(key, "Expected a key");
+					keys.push(key);
 					this.next();
-					while (this.token.type === TOKEN_TYPES.comma) {
-						this.next();
-						const keyToken = this.token;
-						if (keyToken.type !== TOKEN_TYPES.string) this.unexpected("Expected string");
-						const key = keyToken.value;
-						(0, _invariant.default)(key, "Expected a key");
-						keys.push(key);
-						this.next();
-					}
-					const wasColon = this.token.type === TOKEN_TYPES.colon;
-					if (wasColon) this.next();
-					if (isValidPropValueToken(this.token)) {
-						for (const key of keys) obj[key] = this.token.value;
-						this.next();
-					} else if (wasColon) {
-						const val = this.parse(indent + 1);
-						for (const key of keys) obj[key] = val;
-						if (indent && this.token.type !== TOKEN_TYPES.indent) break;
-					} else this.unexpected("Invalid value type");
-				} else this.unexpected(`Unknown token: ${_util.default.inspect(propToken)}`);
-			}
-			return obj;
-		}
-	};
-	const MERGE_CONFLICT_ANCESTOR = "|||||||";
-	const MERGE_CONFLICT_END = ">>>>>>>";
-	const MERGE_CONFLICT_SEP = "=======";
-	const MERGE_CONFLICT_START = "<<<<<<<";
-	/**
-	* Extract the two versions of the lockfile from a merge conflict.
-	*/
-	function extractConflictVariants(str) {
-		const variants = [[], []];
-		const lines = str.split(/\r?\n/g);
-		let skip = false;
-		while (lines.length) {
-			const line = lines.shift();
-			if (line.startsWith(MERGE_CONFLICT_START)) {
-				while (lines.length) {
-					const conflictLine = lines.shift();
-					if (conflictLine === MERGE_CONFLICT_SEP) {
-						skip = false;
-						break;
-					} else if (skip || conflictLine.startsWith(MERGE_CONFLICT_ANCESTOR)) {
-						skip = true;
-						continue;
-					} else variants[0].push(conflictLine);
-				}
-				while (lines.length) {
-					const conflictLine = lines.shift();
-					if (conflictLine.startsWith(MERGE_CONFLICT_END)) break;
-					else variants[1].push(conflictLine);
 				}
-			} else {
-				variants[0].push(line);
-				variants[1].push(line);
-			}
+				const wasColon = this.token.type === TOKEN_TYPES.colon;
+				if (wasColon) this.next();
+				if (isValidPropValueToken(this.token)) {
+					for (const key of keys) obj[key] = this.token.value;
+					this.next();
+				} else if (wasColon) {
+					const val = this.parse(indent + 1);
+					for (const key of keys) obj[key] = val;
+					if (indent && this.token.type !== TOKEN_TYPES.indent) break;
+				} else this.unexpected("Invalid value type");
+			} else this.unexpected(`Unknown token: ${Util.inspect(propToken)}`);
 		}
-		return [variants[0].join("\n"), variants[1].join("\n")];
-	}
-	/**
-	* Check if a lockfile has merge conflicts.
-	*/
-	function hasMergeConflicts(str) {
-		return str.includes(MERGE_CONFLICT_START) && str.includes(MERGE_CONFLICT_SEP) && str.includes(MERGE_CONFLICT_END);
+		return obj;
 	}
-	/**
-	* Parse the lockfile.
-	*/
-	function parse(str, fileLoc) {
-		const parser = new Parser(str, fileLoc);
-		parser.next();
-		if (!fileLoc.endsWith(`.yml`)) try {
-			return parser.parse();
-		} catch (error1) {
-			try {
-				return _yamljs.default.parse(str);
-			} catch (error2) {
-				throw error1;
+};
+const MERGE_CONFLICT_ANCESTOR = "|||||||";
+const MERGE_CONFLICT_END = ">>>>>>>";
+const MERGE_CONFLICT_SEP = "=======";
+const MERGE_CONFLICT_START = "<<<<<<<";
+/**
+* Extract the two versions of the lockfile from a merge conflict.
+*/
+function extractConflictVariants(str) {
+	const variants = [[], []];
+	const lines = str.split(/\r?\n/g);
+	let skip = false;
+	while (lines.length) {
+		const line = lines.shift();
+		if (line.startsWith(MERGE_CONFLICT_START)) {
+			while (lines.length) {
+				const conflictLine = lines.shift();
+				if (conflictLine === MERGE_CONFLICT_SEP) {
+					skip = false;
+					break;
+				} else if (skip || conflictLine.startsWith(MERGE_CONFLICT_ANCESTOR)) {
+					skip = true;
+					continue;
+				} else variants[0].push(conflictLine);
 			}
-		}
-		else {
-			const result = _yamljs.default.parse(str);
-			if (typeof result === "object") return result;
-			else return {};
+			while (lines.length) {
+				const conflictLine = lines.shift();
+				if (conflictLine.startsWith(MERGE_CONFLICT_END)) break;
+				else variants[1].push(conflictLine);
+			}
+		} else {
+			variants[0].push(line);
+			variants[1].push(line);
 		}
 	}
-	/**
-	* Parse and merge the two variants in a conflicted lockfile.
-	*/
-	function parseWithConflict(str, fileLoc) {
-		const variants = extractConflictVariants(str);
+	return [variants[0].join("\n"), variants[1].join("\n")];
+}
+/**
+* Check if a lockfile has merge conflicts.
+*/
+function hasMergeConflicts(str) {
+	return str.includes(MERGE_CONFLICT_START) && str.includes(MERGE_CONFLICT_SEP) && str.includes(MERGE_CONFLICT_END);
+}
+/**
+* Parse the lockfile.
+*/
+function parse$1(str, fileLoc) {
+	const parser = new Parser$1(str, fileLoc);
+	parser.next();
+	if (!fileLoc.endsWith(`.yml`)) try {
+		return parser.parse();
+	} catch (error1) {
 		try {
-			return {
-				type: "merge",
-				object: Object.assign({}, parse(variants[0], fileLoc), parse(variants[1], fileLoc))
-			};
-		} catch (err) {
-			if (err instanceof SyntaxError) return {
-				type: "conflict",
-				object: {}
-			};
-			else throw err;
+			return import_Yaml.default.parse(str);
+		} catch (error2) {
+			throw error1;
 		}
 	}
-	function _default(str, fileLoc = "lockfile") {
-		str = (0, _stripBom.default)(str);
-		return hasMergeConflicts(str) ? parseWithConflict(str, fileLoc) : {
-			type: "success",
-			object: parse(str, fileLoc)
+	else {
+		const result = import_Yaml.default.parse(str);
+		if (typeof result === "object") return result;
+		else return {};
+	}
+}
+/**
+* Parse and merge the two variants in a conflicted lockfile.
+*/
+function parseWithConflict(str, fileLoc) {
+	const variants = extractConflictVariants(str);
+	try {
+		return {
+			type: "merge",
+			object: Object.assign({}, parse$1(variants[0], fileLoc), parse$1(variants[1], fileLoc))
 		};
+	} catch (err) {
+		if (err instanceof SyntaxError) return {
+			type: "conflict",
+			object: {}
+		};
+		else throw err;
 	}
-}));
+}
+function parse_default(str, fileLoc = "lockfile") {
+	str = stripBom(str);
+	return hasMergeConflicts(str) ? parseWithConflict(str, fileLoc) : {
+		type: "success",
+		object: parse$1(str, fileLoc)
+	};
+}
 
 //#endregion
-//#region yarn/index.js
-var require_yarn = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const parse = require_parse().default;
-	module.exports = { parseYarnLock: (str, filename) => parse(str, filename).object };
-}));
+//#region yarn/index.ts
+/**
+* @param {string} str the yarn.lock contents
+* @param {string} [filename] name to report in parse errors
+* @returns {object} the lockfile as a map of `name@spec` to its resolution
+*/
+function parseYarnLock(str, filename) {
+	return parse_default(str, filename).object;
+}
 
 //#endregion
 //#region lib/util/make-npm-env.ts
-var import_yarn = require_yarn();
 /**
 * Helper functions for creating npm environment variables.
 * Matches npm 11+ minimal approach.
@@ -94715,8 +94989,9 @@ function initEnv(fromEnv, production) {
 }
 /**
 * Create npm_package_* and npm_config_* environment variables
-* Matches npm 11's minimal approach - only adds npm_package_name, npm_package_version, npm_package_json
-* and minimal npm_config_* variables
+* Matches npm 11's minimal approach - only adds npm_package_name and npm_package_version
+* (npm_package_json is added by the caller, which knows the manifest path) and minimal
+* npm_config_* variables
 *
 * @param {Object} data - Package.json or config object
 * @param {Object} opts - Options object
@@ -95114,8 +95389,31 @@ const readPkgJson$1 = (dir) => {
 		return {};
 	});
 };
-const fynInstalledDir = Path.dirname(optionalRequire.resolve("../package.json"));
-const fynCli = createRequire(Path.join(fynInstalledDir, "_")).resolve("./bin/fyn.js");
+let fynCliPath;
+const findFynCli = () => {
+	if (fynCliPath) return fynCliPath;
+	const candidates = [];
+	const resolveFrom = (dir, spec) => {
+		try {
+			return createRequire(Path.join(dir, "_")).resolve(spec);
+		} catch {
+			return;
+		}
+	};
+	const ownDir = optionalRequire.resolve("../package.json");
+	if (ownDir) candidates.push(Path.dirname(ownDir));
+	const asDep = resolveFrom(Path.dirname(fileURLToPath(import.meta.url)), "fyn/package.json");
+	if (asDep) candidates.push(Path.dirname(asDep));
+	for (const dir of candidates) {
+		const cli = resolveFrom(dir, "./bin/fyn.mjs");
+		if (cli) {
+			fynCliPath = cli;
+			return cli;
+		}
+	}
+	fynCliPath = Path.join(candidates[0] || process.cwd(), "bin", "fyn.mjs");
+	return fynCliPath;
+};
 const ONE_MB = 1048576;
 var LifecycleScripts = class {
 	_fyn;
@@ -95139,7 +95437,8 @@ var LifecycleScripts = class {
 		if (this._appDir) xsh.envPath.addToFront(Path.join(this._appDir, "node_modules/.bin"), env);
 		xsh.envPath.addToFront(Path.join(this._pkgDir, "node_modules/.bin"), env);
 		env.npm_node_execpath = env.NODE = env.NODE || process.execPath;
-		env.npm_execpath = fynCli;
+		env.npm_execpath = findFynCli();
+		env.npm_package_json = Path.join(this._pkgDir, "package.json");
 		env.INIT_CWD = this._fyn.initCwd || this._fyn.cwd || process.cwd();
 		return env;
 	}
@@ -95170,7 +95469,11 @@ var LifecycleScripts = class {
 		const scriptName = chalk.magenta(name);
 		const script = `"${chalk.cyan(scriptCommand)}"`;
 		const pkgDir = log_format_default.pkgPath(this._pkg.name, this._pkgDir.replace(this._fyn.cwd || "", "."));
-		const env = this.makeEnv({ PWD: this._pkgDir });
+		const env = this.makeEnv({
+			PWD: this._pkgDir,
+			npm_lifecycle_event: name,
+			npm_lifecycle_script: scriptCommand
+		});
 		logger$1.verbose(`running npm script '${scriptName}' of ${dimPkgName}: ${script} - at dir ${pkgDir}`);
 		const child = xsh.exec({
 			silent,
@@ -95416,8 +95719,6 @@ var PkgDepLinker = class {
 //#endregion
 //#region lib/pkg-opt-resolver.ts
 const { readPkgJson } = fyntil;
-/** `optFailed` value meaning the package's os/cpu did not match the machine that checked it */
-const OPT_FAILED_PLATFORM = 3;
 /**
 * Decide what a lockfile's `optFailed` record means for the machine running *this* install.
 *
@@ -95446,6 +95747,7 @@ var PkgOptResolver = class {
 	_resolving;
 	_failedChecks;
 	_failedPkgs;
+	/** assigned by `PkgDepResolver` right after it is constructed, so not private (FJM-154) */
 	_depResolver;
 	_inflights;
 	_fyn;
@@ -95512,7 +95814,7 @@ var PkgOptResolver = class {
 			version,
 			top: !import_lodash_min.default.get(item, ["parent", "depth"])
 		};
-		const policy = evaluateScriptPolicy(optDepInfo, this._fyn.allowScripts, { allowTopLevel: this._fyn.allowTopLevelScripts });
+		const policy = evaluateScriptPolicy(optDepInfo, this._fyn.allowScripts, this._fyn.scriptPolicyOptions);
 		return {
 			allowed: isScriptAllowed(policy, "preinstall"),
 			policy
@@ -95798,7 +96100,7 @@ var LocalPkgBuilder = class {
 		});
 		const cliFynJs = Path.join(__dirname, "../cli/fyn.js");
 		if (await file_ops_default.exists(cliFynJs)) this._fynJs = cliFynJs;
-		else this._fynJs = Path.join(__dirname, "../bin/fyn.js");
+		else this._fynJs = Path.join(__dirname, "../bin/fyn.mjs");
 		const { localsByDepth } = this._options;
 		this._promiseQ.on("doneItem", (data) => {
 			this._waitItems[data.item.fullPath].resolve({});
@@ -96341,7 +96643,7 @@ async function syncLocalExports(options) {
 const createLock$1 = Util.promisify(import_lockfile.lock);
 const unlock$1 = Util.promisify(import_lockfile.unlock);
 const { posixify } = fyntil;
-var Fyn = class {
+var Fyn = class Fyn {
 	_cliSource;
 	_shownMissingFiles;
 	_options;
@@ -96356,9 +96658,12 @@ var Fyn = class {
 	_pkgFyn;
 	_pkgSrcMgr;
 	_depLocker;
+	/** set in `resolveDependencies`, before the collaborators that read it exist */
 	_distFetcher;
+	/** set in `resolveDependencies`, before the collaborators that read it exist */
 	_depResolver;
 	_optResolver;
+	/** set in `resolveDependencies`, before any collaborator that reads it exists */
 	_data;
 	_central;
 	_npmLockData;
@@ -96375,9 +96680,14 @@ var Fyn = class {
 	_npmConfigEnv;
 	_shortPkgDir;
 	_allowScripts;
+	_denyScripts;
 	_allowTopLevelScripts;
 	_enforceRegistryDeps;
-	/** Local packages with nested dependencies */
+	_scriptPolicy;
+	_reviewLocalPackages;
+	_blockedScripts;
+	_pendingScripts;
+	/** Local packages with nested dependencies - written by the dep linker, never read back */
 	localPkgWithNestedDep;
 	constructor({ opts = {}, _cliSource = {}, _fynpo = true }) {
 		this._cliSource = { ..._cliSource };
@@ -96444,7 +96754,7 @@ var Fyn = class {
 		if (file_ops_default.existsSync(yarnLockName)) {
 			logger$1.info("Reading yarn.lock");
 			const yarnLockData = await file_ops_default.readFile(yarnLockName, "utf-8");
-			this._yarnLock = (0, import_yarn.parseYarnLock)(yarnLockData);
+			this._yarnLock = parseYarnLock(yarnLockData);
 		}
 		return false;
 	}
@@ -96529,15 +96839,60 @@ var Fyn = class {
 		if (this._fynpo?.config) return this._fynpo.dir === this._cwd;
 		return false;
 	}
+	/**
+	* Options a fynpo config must never supply. `cwd`/`initCwd` are where fyn was
+	* invoked; a monorepo config that relocated the install would be changing
+	* which package.json is being installed.
+	*/
+	static FYNPO_OPTIONS_DENY = ["cwd", "initCwd"];
+	/**
+	* Options with precedence rules of their own - allowlists union across scopes
+	* with a denial winning at any level, the blacklist only ever unions, and the
+	* policy mode may only be tightened by a package. The `allowScripts` /
+	* `denyScripts` / `scriptPolicy` / `reviewLocalPackages` getters read the
+	* fynpo config directly, so the generic merge must leave these alone rather
+	* than flattening them here.
+	*/
+	static FYNPO_OPTIONS_OWN_MERGE = [
+		"allowScripts",
+		"denyScripts",
+		"allowTopLevelScripts",
+		"scriptPolicy",
+		"reviewLocalPackages"
+	];
+	/**
+	* Merge the monorepo's `fyn.options` (from fynpo.json / fynpo.config.js) into
+	* this instance's options.
+	*
+	* Precedence is CLI > rc > fynpo config: `_cliSource[key]` records where each
+	* option came from, and anything other than `"default"` means the user asked
+	* for that value, so the monorepo config must not override it.
+	*/
+	mergeFynpoOptions() {
+		const fynpoOptions = import_lodash_min.default.get(this, [
+			"_fynpo",
+			"config",
+			"fyn",
+			"options"
+		]);
+		if (import_lodash_min.default.isEmpty(fynpoOptions)) return;
+		for (const key of Object.keys(fynpoOptions)) {
+			if (Fyn.FYNPO_OPTIONS_DENY.includes(key) || Fyn.FYNPO_OPTIONS_OWN_MERGE.includes(key)) continue;
+			const source = this._cliSource[key];
+			if (source && source !== "default") {
+				logger$1.debug(`fynpo config option ${key} ignored - already set by ${source}`);
+				continue;
+			}
+			const value = fynpoOptions[key];
+			const existing = this._options[key];
+			this._options[key] = import_lodash_min.default.isPlainObject(value) && import_lodash_min.default.isPlainObject(existing) ? import_lodash_min.default.merge({}, value, existing) : value;
+		}
+		logger$1.debug("applied fynpo fyn.options", JSON.stringify(fynpoOptions));
+	}
 	async _initializePkg() {
 		if (!this._fynpo) {
 			this._fynpo = await fyntil.loadFynpo(this._cwd);
-			const savedCwd = this._options.cwd;
-			import_lodash_min.default.merge(this._options, import_lodash_min.default.get(this, "_fynpo.fyn.options"));
-			if (savedCwd) {
-				this._options.cwd = savedCwd;
-				this._cwd = savedCwd;
-			}
+			this.mergeFynpoOptions();
 		}
 		this.checkLayoutOption();
 		if (!this._pkg) {
@@ -96571,6 +96926,7 @@ var Fyn = class {
 				}
 			}
 			this.checkProductionMode();
+			logger$1.debug("install script policy", this.scriptPolicy);
 			let fynpoNpmRun;
 			if (this._fynpo?.config) {
 				if (this._fynpo.graph?.getPackageAtDir(this._cwd)) {
@@ -96755,7 +97111,9 @@ var Fyn = class {
 				centralDir,
 				production: this.production,
 				layout: this._options.layout,
-				shortPkgDir: this._shortPkgDir
+				shortPkgDir: this._shortPkgDir,
+				blockedScripts: this._blockedScripts || this._installConfig.blockedScripts || [],
+				pendingScripts: this._pendingScripts || this._installConfig.pendingScripts || []
 			};
 			await file_ops_default.writeFile(filename, `${JSON.stringify(outputConfig, null, 2)}\n`);
 		} catch (err) {
@@ -96774,7 +97132,8 @@ var Fyn = class {
 		const options = _options || this._options;
 		if (options.pkgFile) {
 			let pkgFile;
-			if (options.pkgFile === "package.json") {
+			const cwdIsExplicit = Boolean(this._cliSource.cwd) && this._cliSource.cwd !== "default";
+			if (options.pkgFile === "package.json" && !cwdIsExplicit) {
 				let foundDir = null;
 				pathUpEach(this._cwd, (path) => {
 					const testPath = Path.join(path, "package.json");
@@ -96796,6 +97155,7 @@ var Fyn = class {
 			} catch (err) {
 				logger$1.error("failed to read package.json file", pkgFile);
 				logger$1.error(err.message);
+				if (cwdIsExplicit) logger$1.error(`cwd was set explicitly by ${this._cliSource.cwd}, so fyn did not search parent directories for a package.json`);
 				fyntil.exit(err);
 			}
 			const pkgFyn = await this.loadPkgFyn();
@@ -96857,14 +97217,112 @@ var Fyn = class {
 	get showDeprecated() {
 		return this._options.showDeprecated && "show-deprecated";
 	}
+	/**
+	* The monorepo's `fyn.options` block, when installing inside a fynpo repo.
+	* This is the repo-wide baseline for the script policy - one allowlist,
+	* reviewed once, instead of a copy in every package.
+	*
+	* @returns {object} the fynpo `fyn.options`, or an empty object
+	*/
+	get fynpoFynOptions() {
+		return import_lodash_min.default.get(this, [
+			"_fynpo",
+			"config",
+			"fyn",
+			"options"
+		]) || {};
+	}
 	get allowScripts() {
-		if (this._allowScripts === void 0 && this._pkg) this._allowScripts = import_lodash_min.default.get(this._pkg, ["fyn", "allowScripts"]) || {};
+		if (this._allowScripts === void 0 && this._pkg) this._allowScripts = mergeAllowScripts(this.fynpoFynOptions.allowScripts, import_lodash_min.default.get(this._pkg, ["fyn", "allowScripts"]), this._options.allowScripts);
 		return this._allowScripts || {};
 	}
+	get denyScripts() {
+		if (this._denyScripts === void 0 && this._pkg) this._denyScripts = mergeAllowScripts(this.fynpoFynOptions.denyScripts, import_lodash_min.default.get(this._pkg, ["fyn", "denyScripts"]), this._options.denyScripts);
+		return this._denyScripts || {};
+	}
 	get allowTopLevelScripts() {
-		if (this._allowTopLevelScripts === void 0 && this._pkg) this._allowTopLevelScripts = import_lodash_min.default.get(this._pkg, ["fyn", "allowTopLevelScripts"]) || false;
+		if (this._allowTopLevelScripts === void 0 && this._pkg) {
+			const values = [
+				this._options.allowTopLevelScripts,
+				import_lodash_min.default.get(this._pkg, ["fyn", "allowTopLevelScripts"]),
+				this.fynpoFynOptions.allowTopLevelScripts
+			];
+			this._allowTopLevelScripts = values.find((v) => v !== void 0) || false;
+		}
 		return this._allowTopLevelScripts || false;
 	}
+	get scriptPolicy() {
+		if (this._scriptPolicy === void 0) {
+			const cliOpt = this._options.scriptPolicy;
+			if (cliOpt) this._scriptPolicy = normalizeScriptPolicy(cliOpt);
+			else if (this._pkg) this._scriptPolicy = strictestScriptPolicy(normalizeScriptPolicyIfSet(this.fynpoFynOptions.scriptPolicy), normalizeScriptPolicyIfSet(import_lodash_min.default.get(this._pkg, ["fyn", "scriptPolicy"])));
+		}
+		return this._scriptPolicy || "review";
+	}
+	get reviewLocalPackages() {
+		if (this._reviewLocalPackages === void 0 && this._pkg) this._reviewLocalPackages = Boolean(this._options.reviewLocalPackages || import_lodash_min.default.get(this._pkg, ["fyn", "reviewLocalPackages"]) || this.fynpoFynOptions.reviewLocalPackages);
+		return Boolean(this._reviewLocalPackages);
+	}
+	/**
+	* The options every lifecycle-script policy evaluation needs, so the two
+	* enforcement points (installer and optional-dep probe) cannot drift.
+	*
+	* @returns {object} options for `evaluateScriptPolicy`
+	*/
+	get scriptPolicyOptions() {
+		return {
+			mode: this.scriptPolicy,
+			allowTopLevel: this.allowTopLevelScripts,
+			reviewLocalPackages: this.reviewLocalPackages,
+			denyScripts: this.denyScripts
+		};
+	}
+	get allowScriptsPin() {
+		const opt = this._options.allowScriptsPin;
+		return opt === void 0 ? true : Boolean(opt);
+	}
+	/**
+	* Forget the merged allowlist, so it is rebuilt from disk. Used after the
+	* install-time review prompt writes new approvals.
+	*
+	* @returns {void}
+	*/
+	resetAllowScripts() {
+		this._allowScripts = void 0;
+		this._denyScripts = void 0;
+		this._pkg = this._pkg && { ...this._pkg };
+	}
+	get allowScriptsPending() {
+		return Boolean(this._options.allowScriptsPending);
+	}
+	/**
+	* Record the packages whose install scripts were blocked, and those that
+	* would need approval under `"review"`, so they are saved with the install
+	* config and `fyn install-scripts ls` can list them without re-resolving the
+	* tree.
+	*
+	* @param {object[]} blocked blocked-scripts records
+	* @param {object[]} [pending] would-be-blocked-under-review records
+	* @returns {void}
+	*/
+	setBlockedScripts(blocked, pending) {
+		this._blockedScripts = blocked || [];
+		if (pending !== void 0) this._pendingScripts = pending;
+	}
+	/**
+	* @returns {object[]} packages whose install scripts were blocked - from this
+	*   run when there was one, else what the last install recorded
+	*/
+	get blockedScripts() {
+		return this._blockedScripts || this._installConfig.blockedScripts || [];
+	}
+	/**
+	* @returns {object[]} packages that would need approval under `"review"` -
+	*   only populated when the install ran with `--allow-scripts-pending`
+	*/
+	get pendingScripts() {
+		return this._pendingScripts || this._installConfig.pendingScripts || [];
+	}
 	get enforceRegistryDeps() {
 		const cliOpt = this._options.enforceRegistryDeps;
 		if (cliOpt !== void 0) return Boolean(cliOpt);
@@ -97517,6 +97975,696 @@ var PkgBinLinker$1 = class extends PkgBinLinkerBase {
 /* istanbul ignore next */
 const PkgBinLinker = process.platform === "win32" ? PkgBinLinkerWin32 : PkgBinLinker$1;
 
+//#endregion
+//#region lib/util/script-policy-report.ts
+/**
+* Build the record of one package whose install scripts were blocked.
+*
+* @param {object} depInfo resolved package data
+* @param {object} policy result of `evaluateScriptPolicy`
+* @param {string[]} blocked the lifecycle scripts that were skipped
+* @returns {object} a blocked-scripts record
+*/
+function makeBlockedRecord(depInfo, policy, blocked) {
+	return {
+		name: depInfo.name,
+		version: depInfo.version,
+		key: policy.key,
+		scripts: [...blocked],
+		urlType: policy.urlType,
+		reason: policy.reason,
+		topLevel: Boolean(policy.topLevel),
+		local: Boolean(policy.local)
+	};
+}
+/**
+* The allowScripts key to write for a record: always the bare package name.
+*
+* The constraints live in the value, so one package is one entry however many
+* versions and scripts it accumulates - see {@link makeAllowEntry}.
+*
+* @param {object} record a blocked-scripts record
+* @returns {string} the allowScripts key
+*/
+function allowScriptsKey(record) {
+	return record.name;
+}
+/**
+* The allowScripts value fyn writes: `{ semver, scripts }`, with either field
+* omitted when it would not narrow anything.
+*
+* Pinned (the default) `semver` is a caret range of the reviewed version, so
+* the approval follows that release line and a jump past it comes back for
+* review. Unpinned there is no `semver`, which covers every version. `scripts`
+* is omitted when every install script is approved.
+*
+* @param {object} record a blocked-scripts record
+* @param {boolean} [pin] whether to scope the approval to the reviewed version
+* @returns {object} the allowScripts value
+*/
+function makeAllowEntry(record, pin = true) {
+	const entry = {};
+	if (pin && record.version) entry.semver = caretRange(record.version);
+	const scripts = normalizeScriptsValue(record.scripts);
+	if (scripts.length > 0 && scripts[0] !== "*") entry.scripts = scripts;
+	return entry;
+}
+/**
+* Fold a record into an entry a previous approval already wrote.
+*
+* One key per package means a second version widens `semver` rather than adding
+* a near-duplicate key. When the two approvals cover different scripts the
+* union is taken - with a single entry there is nowhere to record "these
+* scripts for that range, those for this one".
+*
+* @param {*} existing the value already in the map, any accepted form
+* @param {object} record a blocked-scripts record
+* @param {boolean} [pin] whether to scope the approval to the reviewed version
+* @returns {object} the merged entry
+*/
+function mergeAllowEntry(existing, record, pin = true) {
+	const added = makeAllowEntry(record, pin);
+	if (existing === void 0) return added;
+	const prior = toAllowEntry(existing);
+	const entry = {};
+	if (prior.semver !== void 0 && added.semver !== void 0) entry.semver = addVersionToRange(prior.semver, record.version);
+	if (prior.scripts !== void 0 && added.scripts !== void 0) {
+		const scripts = normalizeScriptsValue([...prior.scripts, ...added.scripts]);
+		if (scripts[0] !== "*") entry.scripts = scripts;
+	}
+	return entry;
+}
+/**
+* Read any accepted allowScripts value as the object form, so a map written by
+* hand - or by npm - can be merged into.
+*
+* @param {*} value an allowScripts value
+* @returns {object} the value as `{ semver?, scripts? }`
+*/
+function toAllowEntry(value) {
+	if (value && typeof value === "object" && !Array.isArray(value)) return value;
+	if (value === true || value === "*" || value === void 0) return {};
+	const strings = (Array.isArray(value) ? value : [value]).filter((item) => typeof item === "string");
+	if (strings.length === 1 && !LIFECYCLE_SCRIPTS.includes(strings[0].toLowerCase())) {
+		const range = asRange(strings[0]);
+		if (range) return { semver: range };
+	}
+	const scripts = normalizeScriptsValue(strings);
+	return scripts[0] === "*" ? {} : { scripts };
+}
+/**
+* The range an approval of one reviewed version covers.
+*
+* @param {string} version the resolved version
+* @returns {string} a caret range, or the version itself when it is not semver
+*/
+function caretRange(version) {
+	const clean = unlocalify(String(version));
+	return asRange(`^${clean}`) ? `^${clean}` : clean;
+}
+/**
+* Widen a range so it also covers a version, leaving it alone when it already
+* does. This is how a second approval of the same package becomes
+* `pkg@^1.2.3 || ^2.0.0` instead of a second key.
+*
+* @param {string} range the existing range
+* @param {string} version the version to cover
+* @returns {string} the range
+*/
+function addVersionToRange(range, version) {
+	const parts = splitRange(range);
+	const added = caretRange(version);
+	if (parts.includes(added) || parts.some((part) => satisfies(version, part))) return parts.join(" || ");
+	return [...parts, added].join(" || ");
+}
+/**
+* Normalize a list of script names into the value fyn writes: `["*"]` when it
+* covers every install script, otherwise the names in lifecycle order.
+*
+* @param {(string[]|string|boolean)} scripts script names, or a wildcard
+* @returns {string[]} the value to write
+*/
+function normalizeScriptsValue(scripts) {
+	const names = new Set((Array.isArray(scripts) ? scripts : scripts === void 0 ? [] : [scripts]).map((name) => String(name).toLowerCase()));
+	if (names.has("*") || names.has("true") || LIFECYCLE_SCRIPTS.every((name) => names.has(name))) return ["*"];
+	const known = LIFECYCLE_SCRIPTS.filter((name) => names.has(name));
+	const extra = [...names].filter((name) => !LIFECYCLE_SCRIPTS.includes(name));
+	return [...known, ...extra];
+}
+/**
+* Build the `fyn.allowScripts` fragment that would let these packages run the
+* scripts they were blocked from.
+*
+* fyn's per-script form is kept rather than npm's blanket `"pkg": "1.2.3"`:
+* it approves the same version but only the scripts the package actually has,
+* so a later release that adds a `preinstall` still comes back for review.
+*
+* @param {object[]} records blocked-scripts records
+* @param {object} [options] options
+* @param {boolean} [options.pin] pin each approval to the resolved version
+* @returns {object} an allowScripts map
+*/
+function buildAllowScriptsPatch(records, { pin = true } = {}) {
+	const patch = {};
+	for (const record of records) {
+		const key = allowScriptsKey(record);
+		patch[key] = mergeAllowEntry(patch[key], record, pin);
+	}
+	return patch;
+}
+/**
+* @param {object[]} records blocked-scripts records
+* @returns {object[]} the records, deduplicated by name@version and with their
+*   script lists merged
+*/
+function dedupeBlockedRecords(records) {
+	const byId = /* @__PURE__ */ new Map();
+	for (const record of records) {
+		const id = `${record.name}@${record.version}`;
+		const existing = byId.get(id);
+		if (existing) existing.scripts = [.../* @__PURE__ */ new Set([...existing.scripts, ...record.scripts])];
+		else byId.set(id, {
+			...record,
+			scripts: [...record.scripts]
+		});
+	}
+	return [...byId.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+/**
+* Why a package was blocked, in a few words for the summary table.
+*
+* @param {object} record a blocked-scripts record
+* @returns {string} the reason
+*/
+function blockedReasonText(record) {
+	switch (record.reason) {
+		case "off": return "scriptPolicy is off";
+		case "denied": return "denied (denyScripts / allowScripts false)";
+		case "review": return "not reviewed";
+		default: return `non-registry (${record.urlType})`;
+	}
+}
+/**
+* Render the end-of-install summary for the packages that were blocked.
+*
+* @param {object[]} records blocked-scripts records
+* @param {object} [options] options
+* @param {string} [options.mode] the scriptPolicy mode in effect
+* @param {boolean} [options.pin] pin suggested approvals to the resolved version
+* @param {boolean} [options.anyTopLevel] whether any record is a direct dep
+* @returns {string[]} lines to log, empty when nothing was blocked
+*/
+function formatBlockedScriptsSummary(records, { mode = "source", pin = true } = {}) {
+	const blocked = dedupeBlockedRecords(records);
+	if (blocked.length === 0) return [];
+	const lines = [`${chalk.black.bgYellow("WARN")} ${chalk.magenta("install scripts blocked")} ` + chalk.yellow(`${blocked.length} package${blocked.length > 1 ? "s" : ""} did not run their install scripts`)];
+	const width = blocked.reduce((w, r) => Math.max(w, `${r.name}@${r.version}`.length), 0);
+	for (const record of blocked) {
+		const id = `${record.name}@${record.version}`.padEnd(width);
+		lines.push(`  ${chalk.cyan(id)}  ${chalk.yellow(record.scripts.join(", "))}  ${chalk.gray(blockedReasonText(record))}`);
+	}
+	if (mode !== "off") {
+		const patch = buildAllowScriptsPatch(blocked.filter((r) => r.reason !== "denied"), { pin });
+		if (Object.keys(patch).length > 0) lines.push(chalk.blue("  To allow them, add to package.json:"), `  ${chalk.cyan(JSON.stringify({ fyn: { allowScripts: patch } }))}`, chalk.blue(`  Or run: ${chalk.cyan("fyn install-scripts approve <package>")}`));
+		if (blocked.some((r) => r.topLevel && r.reason !== "denied")) lines.push(chalk.blue("  Direct dependencies can also be trusted as a group with:"), `  ${chalk.cyan(`{ "fyn": { "allowTopLevelScripts": true } }`)}`);
+	}
+	return lines;
+}
+/**
+* Render the summary for packages that would need approval under `"review"`,
+* shown with `--allow-scripts-pending` while the install still runs under the
+* mode in effect. This is what switching to `"review"` would cost.
+*
+* @param {object[]} records pending-review records
+* @param {object} [options] options
+* @param {string} [options.mode] the scriptPolicy mode in effect
+* @param {boolean} [options.pin] pin suggested approvals to the resolved version
+* @returns {string[]} lines to log, empty when nothing is pending
+*/
+function formatPendingScriptsSummary(records, { mode = "source", pin = true } = {}) {
+	const pending = dedupeBlockedRecords(records);
+	if (pending.length === 0) return [];
+	const lines = [chalk.blue(`${pending.length} package${pending.length > 1 ? "s" : ""} would need approval under ${chalk.cyan("scriptPolicy: \"review\"")} (currently ${chalk.cyan(mode)})`)];
+	const width = pending.reduce((w, r) => Math.max(w, `${r.name}@${r.version}`.length), 0);
+	for (const record of pending) lines.push(`  ${chalk.cyan(`${record.name}@${record.version}`.padEnd(width))}  ` + chalk.yellow(record.scripts.join(", ")));
+	const patch = buildAllowScriptsPatch(pending.filter((r) => r.reason !== "denied"), { pin });
+	if (Object.keys(patch).length > 0) lines.push(chalk.blue("  To approve them now:"), `  ${chalk.cyan(JSON.stringify({ fyn: { allowScripts: patch } }))}`);
+	return lines;
+}
+
+//#endregion
+//#region lib/install-scripts.ts
+/**
+* Split an allowScripts key into its package name and optional spec.
+*
+* Keys are `name`, `name@spec` or `@scope/name@spec`, so the separator is the
+* `@` after the scope, not the first one.
+*
+* @param {string} key an allowScripts key
+* @returns {{name:string, spec:(string|undefined)}} the parts
+*/
+function parseAllowKey(key) {
+	const at = key.indexOf("@", key.startsWith("@") ? 1 : 0);
+	if (at < 0) return {
+		name: key,
+		spec: void 0
+	};
+	return {
+		name: key.slice(0, at),
+		spec: key.slice(at + 1)
+	};
+}
+/**
+* Add approvals to an allowScripts map.
+*
+* A package already denied is left alone: a denial is a decision someone made,
+* and an approve - `--all` included - must not quietly undo it. Both spellings
+* of a denial count, the `denyScripts` list and a `false` in the map.
+*
+* One package is one entry, keyed by its bare name, so approving a second
+* version widens the entry's `semver` instead of adding a near-duplicate key.
+*
+* @param {object} allowScripts the current map
+* @param {object[]} records packages to approve, as blocked-scripts records
+* @param {object} [options] options
+* @param {boolean} [options.pin] scope each approval to the reviewed version
+* @param {string[]} [options.denyScripts] the configured deny list
+* @returns {{allowScripts:object, approved:string[], skipped:string[]}} result
+*/
+function approveEntries(allowScripts, records, { pin = true, denyScripts = {} } = {}) {
+	const updated = { ...allowScripts };
+	const approved = [];
+	const skipped = [];
+	const denyNames = new Set(Object.keys(denyScripts || {}).map((key) => parseAllowKey(key).name));
+	for (const record of records) {
+		const key = allowScriptsKey(record);
+		if (denyNames.has(record.name) || Object.keys(updated).some((k) => updated[k] === false && parseAllowKey(k).name === record.name)) {
+			skipped.push(key);
+			continue;
+		}
+		updated[key] = mergeAllowEntry(updated[key], record, pin);
+		approved.push(key);
+	}
+	return {
+		allowScripts: updated,
+		approved,
+		skipped
+	};
+}
+/**
+* Record explicit denials.
+*
+* A denial is written against the bare package name so it covers every version,
+* with an empty entry - `{}` - meaning "every version, every script", the same
+* defaults the allowlist uses for an absent `semver` / `scripts`. A hand-edited
+* entry can narrow either.
+*
+* @param {object} denyScripts the current deny map
+* @param {string[]} names package names to deny
+* @returns {{denyScripts:object, denied:string[], already:string[]}} result
+*/
+function denyEntries(denyScripts, names) {
+	const updated = { ...denyScripts || {} };
+	const denied = [];
+	const already = [];
+	for (const name of names) {
+		const { name: pkgName } = parseAllowKey(name);
+		if (updated[pkgName] !== void 0) {
+			already.push(pkgName);
+			continue;
+		}
+		updated[pkgName] = {};
+		denied.push(pkgName);
+	}
+	return {
+		denyScripts: updated,
+		denied,
+		already
+	};
+}
+/**
+* Drop entries for packages that are no longer installed.
+*
+* @param {object} allowScripts the current map
+* @param {string[]} installedNames names of the installed packages
+* @returns {{allowScripts:object, removed:string[]}} result
+*/
+function pruneEntries(allowScripts, installedNames) {
+	const installed = new Set(installedNames);
+	const updated = {};
+	const removed = [];
+	for (const key of Object.keys(allowScripts)) if (installed.has(parseAllowKey(key).name)) updated[key] = allowScripts[key];
+	else removed.push(key);
+	return {
+		allowScripts: updated,
+		removed
+	};
+}
+/**
+* Match the packages named on the command line against the records an install
+* recorded, so an approval can be pinned to the version that was reviewed.
+*
+* @param {string[]} names package names, optionally `name@version`
+* @param {object[]} records blocked / pending records from the last install
+* @returns {{matched:object[], unknown:string[]}} the records to act on
+*/
+function selectRecords(names, records) {
+	const byName = /* @__PURE__ */ new Map();
+	for (const record of records) if (!byName.has(record.name)) byName.set(record.name, record);
+	const matched = [];
+	const unknown = [];
+	for (const arg of names) {
+		const { name, spec } = parseAllowKey(arg);
+		const record = byName.get(name);
+		if (spec) matched.push({
+			name,
+			version: spec,
+			scripts: record ? record.scripts : [
+				"preinstall",
+				"install",
+				"postinstall"
+			]
+		});
+		else if (record) matched.push(record);
+		else unknown.push(arg);
+	}
+	return {
+		matched,
+		unknown
+	};
+}
+/**
+* Where an allowlist change should be written.
+*
+* In a fynpo repo the monorepo root is the default: one allowlist, reviewed
+* once. `--local` writes to the package's own package.json instead.
+*
+* @param {object} fyn the Fyn instance
+* @param {boolean} [local] force the package's own package.json
+* @returns {{file:string, fynpo:boolean}} the target
+*/
+function resolveTarget(fyn, local = false) {
+	const fynpoDir = import_lodash_min.default.get(fyn, ["_fynpo", "dir"]);
+	if (!local && fynpoDir) return {
+		file: Path.join(fynpoDir, "fynpo.json"),
+		fynpo: true
+	};
+	return {
+		file: Path.join(fyn.cwd, "package.json"),
+		fynpo: false
+	};
+}
+/**
+* Where one fyn option lives in a target file. A fynpo.json keeps fyn's options
+* under `fyn.options`, a package.json directly under `fyn`.
+*
+* @param {object} target from {@link resolveTarget}
+* @param {string} key the option name
+* @returns {string[]} the path into the file's JSON
+*/
+function targetOptionPath(target, key) {
+	return target.fynpo ? [
+		"fyn",
+		"options",
+		key
+	] : ["fyn", key];
+}
+/**
+* Whether this run can stop and ask a person.
+*
+* @returns {boolean} true when there is a terminal and no CI environment
+*/
+function canPrompt() {
+	return Boolean(!import_ci_info.isCI && process.stdin.isTTY && process.stdout.isTTY);
+}
+/**
+* Ask a question on the terminal.
+*
+* @param {string} question the prompt
+* @returns {Promise<string>} the trimmed, lowercased answer
+*/
+function ask(question) {
+	const rl = readline.createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	return new Promise((resolve) => {
+		rl.question(question, (answer) => {
+			rl.close();
+			resolve(String(answer).trim().toLowerCase());
+		});
+	});
+}
+/**
+* `fyn install-scripts` - list, approve, deny and prune install-script
+* approvals.
+*/
+var InstallScripts = class {
+	/**
+	* @param {object} options options
+	* @param {object} options.fyn the Fyn instance
+	*/
+	constructor({ fyn }) {
+		this._fyn = fyn;
+	}
+	/**
+	* The packages awaiting review: what the last install blocked, plus what it
+	* recorded as pending when run with `--allow-scripts-pending`.
+	*
+	* @returns {object[]} deduplicated records
+	*/
+	get records() {
+		return dedupeBlockedRecords([...this._fyn.blockedScripts, ...this._fyn.pendingScripts]);
+	}
+	/**
+	* Read the script-policy lists from the file a change would be written to.
+	*
+	* The deny list is normalized on the way in, so an entry written by hand in
+	* any of the accepted forms is still recognized as already denied.
+	*
+	* @param {object} target from {@link resolveTarget}
+	* @returns {Promise<{json:object, allowScripts:object, denyScripts:object}>} the file contents
+	*/
+	async readTarget(target) {
+		let json = {};
+		try {
+			json = JSON.parse(await file_ops_default.readFile(target.file));
+		} catch (err) {
+			if (target.fynpo) throw new Error(`cannot read ${target.file} - the monorepo allowlist needs a fynpo.json. Use --local to write to this package's package.json instead.`);
+			throw err;
+		}
+		return {
+			json,
+			allowScripts: import_lodash_min.default.get(json, targetOptionPath(target, "allowScripts")) || {},
+			denyScripts: import_lodash_min.default.get(json, targetOptionPath(target, "denyScripts")) || {}
+		};
+	}
+	/**
+	* Write script-policy lists back to their file. Only the keys named in
+	* `values` are touched, so approving does not rewrite the deny list.
+	*
+	* @param {object} target from {@link resolveTarget}
+	* @param {object} read result of {@link readTarget}
+	* @param {object} values the option values to write, keyed by option name
+	* @returns {Promise<void>} nothing
+	*/
+	async writeTarget(target, read, values) {
+		for (const key of Object.keys(values)) import_lodash_min.default.set(read.json, targetOptionPath(target, key), values[key]);
+		await file_ops_default.writeFile(target.file, `${JSON.stringify(read.json, null, 2)}\n`);
+		logger$1.info(`updated ${chalk.cyan(target.file)}`);
+	}
+	/**
+	* List the packages awaiting review.
+	*
+	* @param {object} [options] options
+	* @param {boolean} [options.json] emit JSON instead of a table
+	* @returns {Promise<object[]>} the records listed
+	*/
+	async ls({ json = false } = {}) {
+		const records = this.records;
+		if (json) {
+			process.stdout.write(`${JSON.stringify(records, null, 2)}\n`);
+			return records;
+		}
+		if (records.length === 0) {
+			logger$1.info(chalk.green("No packages are awaiting install-script review."));
+			if (this._fyn.scriptPolicy !== "review") logger$1.info(`Run ${chalk.cyan("fyn install --allow-scripts-pending")} to see what ${chalk.cyan("scriptPolicy: \"review\"")} would ask you to approve.`);
+			return records;
+		}
+		logger$1.info(`${records.length} package${records.length > 1 ? "s" : ""} awaiting install-script review:`);
+		const width = records.reduce((w, r) => Math.max(w, `${r.name}@${r.version}`.length), 0);
+		for (const record of records) logger$1.info(`  ${chalk.cyan(`${record.name}@${record.version}`.padEnd(width))}  ${chalk.yellow(record.scripts.join(", "))}  ${chalk.gray(blockedReasonText(record))}`);
+		logger$1.info(`Approve with ${chalk.cyan("fyn install-scripts approve <package>")}`);
+		return records;
+	}
+	/**
+	* Approve packages to run their install scripts.
+	*
+	* @param {string[]} names packages to approve, optionally `name@version`
+	* @param {object} [options] options
+	* @param {boolean} [options.all] approve everything awaiting review
+	* @param {boolean} [options.local] write to this package's package.json
+	* @returns {Promise<string[]>} the keys written
+	*/
+	async approve(names = [], { all = false, local = false } = {}) {
+		const pin = this._fyn.allowScriptsPin;
+		let toApprove;
+		if (all) toApprove = this.records;
+		else {
+			const { matched, unknown } = selectRecords(names, this.records);
+			if (unknown.length > 0) {
+				logger$1.error(`not awaiting review: ${unknown.join(", ")} - run ${chalk.cyan("fyn install-scripts ls")} to see what is, or name an explicit version`);
+				return [];
+			}
+			toApprove = matched;
+		}
+		if (toApprove.length === 0) {
+			logger$1.info("nothing to approve");
+			return [];
+		}
+		const target = resolveTarget(this._fyn, local);
+		const read = await this.readTarget(target);
+		const { allowScripts, approved, skipped } = approveEntries(read.allowScripts, toApprove, {
+			pin,
+			denyScripts: {
+				...read.denyScripts || {},
+				...this._fyn.denyScripts || {}
+			}
+		});
+		if (skipped.length > 0) logger$1.warn(`${chalk.magenta("denied, not approved")}: ${skipped.join(", ")} - remove the ${chalk.cyan("denyScripts")} entry, or the ${chalk.cyan("allowScripts")} ${chalk.cyan("false")}, first if that was not intended`);
+		if (approved.length === 0) return [];
+		await this.writeTarget(target, read, { allowScripts });
+		logger$1.info(`approved ${chalk.cyan(approved.join(", "))}`);
+		logger$1.info(`Install scripts do not run retroactively - run ${chalk.cyan("fyn install")} to run them.`);
+		return approved;
+	}
+	/**
+	* Deny packages outright, on the `denyScripts` blacklist. The denial wins
+	* over any approval, at any scope.
+	*
+	* @param {string[]} names packages to deny
+	* @param {object} [options] options
+	* @param {boolean} [options.local] write to this package's package.json
+	* @returns {Promise<string[]>} the names newly denied
+	*/
+	async deny(names = [], { local = false } = {}) {
+		if (names.length === 0) {
+			logger$1.error("no packages named to deny");
+			return [];
+		}
+		const target = resolveTarget(this._fyn, local);
+		const read = await this.readTarget(target);
+		const { denyScripts, denied, already } = denyEntries(read.denyScripts, names);
+		if (already.length > 0) logger$1.info(`already denied ${chalk.cyan(already.join(", "))}`);
+		if (denied.length === 0) return [];
+		await this.writeTarget(target, read, { denyScripts });
+		logger$1.info(`denied ${chalk.cyan(denied.join(", "))}`);
+		return denied;
+	}
+	/**
+	* Drop approvals for packages that are no longer installed.
+	*
+	* @param {object} [options] options
+	* @param {boolean} [options.local] write to this package's package.json
+	* @returns {Promise<string[]>} the keys removed
+	*/
+	/**
+	* Every package this project actually has installed.
+	*
+	* Not `loadFvVersions()` alone, which reads `<node_modules>/.f/_` - the store
+	* for versions that had to be isolated. Under the default hoisted layout that
+	* is a small slice of the tree, and pruning against it deleted the approvals
+	* of every package sitting in `node_modules` proper.
+	*
+	* @returns {Promise<Set<string>>} installed package names, scoped names included
+	*/
+	async installedPackageNames() {
+		const names = new Set(Object.keys(await this._fyn.loadFvVersions()));
+		const outputDir = this._fyn.getOutputDir();
+		const readDir = async (dir) => {
+			try {
+				return await file_ops_default.readdir(dir);
+			} catch {
+				return [];
+			}
+		};
+		for (const entry of await readDir(outputDir)) {
+			if (entry.startsWith(".")) continue;
+			if (entry.startsWith("@")) {
+				for (const scoped of await readDir(Path.join(outputDir, entry))) if (!scoped.startsWith(".")) names.add(`${entry}/${scoped}`);
+			} else names.add(entry);
+		}
+		return names;
+	}
+	async prune({ local = false } = {}) {
+		const installed = [...await this.installedPackageNames()];
+		if (installed.length === 0) {
+			logger$1.error(`no installed packages found - run ${chalk.cyan("fyn install")} before pruning, otherwise every approval would look unused`);
+			return [];
+		}
+		const target = resolveTarget(this._fyn, local);
+		const read = await this.readTarget(target);
+		const { allowScripts, removed } = pruneEntries(read.allowScripts, installed);
+		if (removed.length === 0) {
+			logger$1.info(chalk.green("nothing to prune"));
+			return [];
+		}
+		await this.writeTarget(target, read, { allowScripts });
+		logger$1.info(`pruned ${chalk.cyan(removed.join(", "))}`);
+		return removed;
+	}
+	/**
+	* Stop an install that wants to run install scripts nobody has approved.
+	*
+	* On a terminal this asks; anywhere else - CI, a pipe, a hook - there is
+	* nobody to ask, so the install fails rather than quietly producing a tree
+	* whose native packages were never built. `--script-policy=source` is the
+	* documented way out.
+	*
+	* @param {object[]} records blocked-scripts records from this install
+	* @returns {Promise<object[]>} the records approved, empty when none were
+	* @throws {Error} when there is no terminal to ask on
+	*/
+	async review(records) {
+		const pending = dedupeBlockedRecords(records);
+		if (pending.length === 0) return [];
+		if (!canPrompt()) {
+			const err = /* @__PURE__ */ new Error(`${pending.length} package(s) need approval to run their install scripts, and there is no terminal to ask on: ${pending.map((r) => `${r.name}@${r.version}`).join(", ")}.\n  Approve them where you can review the code:\n    ${chalk.cyan("fyn install-scripts approve <package>")}\n  Or record the approvals in your package.json / fynpo.json before installing.\n  To go back to trusting packages by where they came from, install with ${chalk.cyan("--script-policy=source")}.`);
+			err._fynAlreadyLogged = true;
+			logger$1.error(err.message);
+			throw err;
+		}
+		logger$1.info(`${pending.length} package${pending.length > 1 ? "s" : ""} want to run install scripts that have not been approved:`);
+		const width = pending.reduce((w, r) => Math.max(w, `${r.name}@${r.version}`.length), 0);
+		for (const record of pending) logger$1.info(`  ${chalk.cyan(`${record.name}@${record.version}`.padEnd(width))}  ` + chalk.yellow(record.scripts.join(", ")));
+		const answer = await ask(`Approve? ${chalk.cyan("[a]")}ll / ${chalk.cyan("[s]")}elect / ${chalk.cyan("[n]")}one (default) `);
+		let approve = [];
+		if (answer === "a" || answer === "all" || answer === "y" || answer === "yes") approve = pending;
+		else if (answer === "s" || answer === "select") for (const record of pending) {
+			const yn = await ask(`  ${record.name}@${record.version} (${record.scripts.join(", ")})? [y/N] `);
+			if (yn === "y" || yn === "yes") approve.push(record);
+		}
+		if (approve.length === 0) {
+			logger$1.info("no approvals recorded - install scripts will not run");
+			return [];
+		}
+		const target = resolveTarget(this._fyn, false);
+		const read = await this.readTarget(target);
+		const { allowScripts, approved, skipped } = approveEntries(read.allowScripts, approve, {
+			pin: this._fyn.allowScriptsPin,
+			denyScripts: {
+				...read.denyScripts || {},
+				...this._fyn.denyScripts || {}
+			}
+		});
+		if (skipped.length > 0) logger$1.warn(`${chalk.magenta("denied, not approved")}: ${skipped.join(", ")} - remove the ${chalk.cyan("denyScripts")} entry, or the ${chalk.cyan("allowScripts")} ${chalk.cyan("false")}, first if that was not intended`);
+		if (approved.length === 0) return [];
+		await this.writeTarget(target, read, { allowScripts });
+		logger$1.info(`approved ${chalk.cyan(approved.join(", "))}`);
+		return approve.filter((record) => approved.includes(record.name));
+	}
+};
+
 //#endregion
 //#region lib/pkg-installer.ts
 var PkgInstaller = class {
@@ -97531,6 +98679,12 @@ var PkgInstaller = class {
 	preInstall;
 	postInstall;
 	toLink;
+	/** packages whose install scripts the policy blocked, reported once at the end */
+	blockedScripts = [];
+	/** packages that would need approval under "review" - only with --allow-scripts-pending */
+	pendingScripts = [];
+	/** the blocked packages themselves, so an approval at the prompt can queue their scripts */
+	_blockedDeps = [];
 	constructor(options) {
 		this._fyn = options.fyn;
 		this._data = this._fyn._data;
@@ -97548,6 +98702,9 @@ var PkgInstaller = class {
 		this.preInstall = [];
 		this.postInstall = [];
 		this.toLink = [];
+		this.blockedScripts = [];
+		this.pendingScripts = [];
+		this._blockedDeps = [];
 		this._data.cleanLinked();
 		this._fyn._depResolver.resolvePkgPeerDep(this._fyn._pkg, "your app", this._data);
 		const pkgsData = this._data.getPkgsData();
@@ -97557,6 +98714,7 @@ var PkgInstaller = class {
 			logger$1.debug("queuing", depInfo.name, depInfo.version, "for install");
 			await this._gatherPkg(depInfo);
 		}
+		await this._reviewBlockedScripts();
 		return this._doInstall().finally(() => {
 			this.preInstall = void 0;
 			this.postInstall = void 0;
@@ -97587,11 +98745,14 @@ var PkgInstaller = class {
 				const pkgJson = depInfo.json;
 				logger$1.debug("linked dependencies for", pkgJson.name, pkgJson.version);
 			}
-			if (depInfo.str.trim() === outputStr.trim()) continue;
+			const hardLocalPkgJson = depInfo.local === "hard" ? Path.join(this._fyn.getInstalledPkgDir(depInfo.name, depInfo.version, depInfo), "package.json") : void 0;
+			if (depInfo.str.trim() === outputStr.trim()) {
+				if (hardLocalPkgJson) await this._detachPkgJsonLink(hardLocalPkgJson);
+				continue;
+			}
 			let pkgJsonFp;
-			if (depInfo.local === "hard") {
-				const vdir = this._fyn.getInstalledPkgDir(depInfo.name, depInfo.version, depInfo);
-				pkgJsonFp = Path.join(vdir, "package.json");
+			if (hardLocalPkgJson) {
+				pkgJsonFp = hardLocalPkgJson;
 				await xaa_default.try(() => file_ops_default.unlink(pkgJsonFp));
 			} else pkgJsonFp = Path.join(depInfo.dir, "package.json");
 			depInfo.str = outputStr;
@@ -97606,6 +98767,24 @@ var PkgInstaller = class {
 			}
 		}
 	}
+	/**
+	* Give an installed package.json its own inode if it is still hardlinked to the local
+	* package it was replicated from.
+	*
+	* Same content, new physical file: unlink the directory entry and write the bytes back.
+	* Cheap - it only touches manifests that actually still share an inode.
+	*
+	* @param pkgJsonFp - installed package.json to detach
+	*/
+	async _detachPkgJsonLink(pkgJsonFp) {
+		const stat = await xaa_default.try(() => file_ops_default.stat(pkgJsonFp));
+		if (!stat || stat.nlink < 2) return;
+		const data = await xaa_default.try(() => file_ops_default.readFile(pkgJsonFp));
+		if (data === void 0) return;
+		logger$1.debug("detaching hardlinked package.json from its local source", pkgJsonFp);
+		await xaa_default.try(() => file_ops_default.unlink(pkgJsonFp));
+		await file_ops_default.writeFile(pkgJsonFp, data);
+	}
 	_isDepSrcOptionalOnly(depInfo) {
 		if ((!depInfo.src || depInfo.src === "opt") && (!depInfo.dsrc || depInfo.dsrc === "opt")) return true;
 		return depInfo.requests.filter((req) => req.find((r) => r.startsWith("opt"))).length === depInfo.requests.length;
@@ -97748,6 +98927,7 @@ var PkgInstaller = class {
 			if (this._fyn.showDeprecated && import_lodash_min.default.isEmpty(warned)) logger$1.info(chalk.green("HOORAY!!! None of your dependencies are marked deprecated."));
 		}).then(() => this._installLocalExports()).then(() => this._saveLockData()).then(() => {
 			this._fyn._depResolver._logConsolidatedPeerDepWarnings();
+			this._reportBlockedScripts();
 			logger$1.info(`${chalk.green("done install")} ${log_format_default.time(Date.now() - start)}`);
 		}).finally(() => {
 			logger$1.removeItem(INSTALL_PACKAGE);
@@ -97805,37 +98985,157 @@ var PkgInstaller = class {
 		}
 		json._fyn = {};
 		const scripts = json.scripts || {};
-		const scriptPolicy = evaluateScriptPolicy(depInfo, this._fyn.allowScripts, { allowTopLevel: this._fyn.allowTopLevelScripts });
-		const blockedScripts = [];
-		const isAllowed = (scriptName) => {
-			if (isScriptAllowed(scriptPolicy, scriptName)) return true;
-			blockedScripts.push(scriptName);
-			return false;
-		};
+		const scriptPolicy = evaluateScriptPolicy(depInfo, this._fyn.allowScripts, this._fyn.scriptPolicyOptions);
 		const hasPI = json.hasPI || Boolean(scripts.preinstall);
-		if (!Boolean(depInfo.preinstall) && hasPI) {
+		const piExed = Boolean(depInfo.preinstall);
+		const candidates = [];
+		if (!piExed && hasPI) {
 			if (depInfo.preInstalled) json._fyn.preinstall = true;
-			else if (isAllowed("preinstall")) {
-				logger$1.debug("adding preinstall step for", depInfo.dir);
-				this.preInstall.push(depInfo);
-			}
+			else candidates.push("preinstall");
 		}
+		for (const name of ["install", "postinstall"]) if (Boolean(scripts[name]) && !json._fyn[name]) candidates.push(name);
 		this.toLink.push(depInfo);
-		const install = ["install", "postinstall"].filter((x) => {
-			return Boolean(scripts[x]) && !json._fyn[x] && isAllowed(x);
+		const blockedScripts = candidates.filter((name) => !isScriptAllowed(scriptPolicy, name));
+		this._queueScripts(depInfo, candidates.filter((name) => isScriptAllowed(scriptPolicy, name)));
+		if (blockedScripts.length > 0) {
+			const byName = scriptPolicy.deniedScripts || /* @__PURE__ */ new Set();
+			const denied = blockedScripts.filter((name) => byName.has(name));
+			const pending = blockedScripts.filter((name) => !byName.has(name));
+			if (denied.length > 0) this._recordBlockedScripts(depInfo, {
+				...scriptPolicy,
+				reason: "denied"
+			}, denied);
+			if (pending.length > 0) {
+				this._recordBlockedScripts(depInfo, scriptPolicy, pending);
+				this._blockedDeps.push({
+					depInfo,
+					candidates: pending
+				});
+			}
+		}
+		this._recordPendingReview(depInfo, {
+			hasPI,
+			...scripts
 		});
+	}
+	/**
+	* Queue a package's allowed install scripts.
+	*
+	* Idempotent per package, because the review prompt re-queues after an
+	* approval and a package may already have had some of its scripts allowed.
+	*
+	* @param {object} depInfo resolved package data
+	* @param {string[]} names the lifecycle scripts to run
+	* @returns {void}
+	*/
+	_queueScripts(depInfo, names) {
+		if (names.includes("preinstall") && !this.preInstall.includes(depInfo)) {
+			logger$1.debug("adding preinstall step for", depInfo.dir);
+			this.preInstall.push(depInfo);
+		}
+		const install = ["install", "postinstall"].filter((name) => names.includes(name));
 		if (install.length > 0) {
 			logger$1.debug("adding install step for", depInfo.dir, install);
-			depInfo.install = install;
-			this.postInstall.push(depInfo);
+			depInfo.install = import_lodash_min.default.union(depInfo.install || [], install);
+			if (!this.postInstall.includes(depInfo)) this.postInstall.push(depInfo);
 		}
-		if (blockedScripts.length > 0) this._warnBlockedScripts(depInfo, scriptPolicy, blockedScripts);
 	}
-	_warnBlockedScripts(depInfo, policy, blocked) {
-		const id = log_format_default.pkgId(depInfo);
-		logger$1.warn(`${chalk.black.bgYellow("WARN")} ${chalk.magenta("scripts blocked")} ${id}`, chalk.yellow(`skipped lifecycle [${blocked.join(", ")}] for non-registry (${policy.urlType}) package - not in fyn.allowScripts`));
-		logger$1.verbose(chalk.blue("  To allow, add to package.json:"), chalk.cyan(`"fyn": { "allowScripts": { "${policy.key}": [${blocked.map((s) => `"${s}"`).join(", ")}] } }`));
-		if (policy.topLevel) logger$1.verbose(chalk.blue("  Or trust all direct deps' scripts with:"), chalk.cyan(`"fyn": { "allowTopLevelScripts": true }`));
+	/**
+	* Stop before running anything when packages want to run install scripts
+	* nobody has approved. On a terminal this asks and re-queues whatever the
+	* person approves; anywhere else it throws.
+	*
+	* Only under `"review"`: `"source"` is the documented opt-out and keeps
+	* warning-and-continuing, and under `"off"` nothing running is the point.
+	*
+	* @returns {Promise<void>} nothing
+	*/
+	async _reviewBlockedScripts() {
+		if (this._fyn.scriptPolicy !== "review" || this._blockedDeps.length === 0) return;
+		const pending = this.blockedScripts.filter((record) => record.reason !== "denied");
+		if (pending.length === 0) return;
+		if ((await new InstallScripts({ fyn: this._fyn }).review(pending)).length === 0) return;
+		this._fyn.resetAllowScripts();
+		this._requeueApproved();
+	}
+	/**
+	* Re-evaluate the packages that were blocked, after the allowlist on disk
+	* changed, and queue whatever is now allowed.
+	*
+	* @returns {void}
+	*/
+	_requeueApproved() {
+		const blockedDeps = this._blockedDeps;
+		const stillBlocked = [];
+		this._blockedDeps = [];
+		this.blockedScripts = [];
+		for (const { depInfo, candidates } of blockedDeps) {
+			const policy = evaluateScriptPolicy(depInfo, this._fyn.allowScripts, this._fyn.scriptPolicyOptions);
+			const blocked = candidates.filter((name) => !isScriptAllowed(policy, name));
+			this._queueScripts(depInfo, candidates.filter((name) => isScriptAllowed(policy, name)));
+			if (blocked.length > 0) {
+				this._recordBlockedScripts(depInfo, policy, blocked);
+				stillBlocked.push({
+					depInfo,
+					candidates
+				});
+			}
+		}
+		this._blockedDeps = stillBlocked;
+	}
+	/**
+	* With `--allow-scripts-pending`, also answer the question `"review"` would
+	* ask - which packages have install scripts that nobody has approved - while
+	* still running the install under the mode in effect. That is how a project
+	* sees what switching to `"review"` would cost before switching.
+	*
+	* @param {object} depInfo resolved package data
+	* @param {object} scripts the package's scripts, plus `hasPI`
+	* @returns {void}
+	*/
+	_recordPendingReview(depInfo, scripts) {
+		if (!this._fyn.allowScriptsPending) return;
+		const has = LIFECYCLE_SCRIPTS.filter((name) => Boolean(scripts[name]) || name === "preinstall" && scripts.hasPI);
+		if (has.length === 0) return;
+		const policy = evaluateScriptPolicy(depInfo, this._fyn.allowScripts, {
+			...this._fyn.scriptPolicyOptions,
+			mode: strictestScriptPolicy(this._fyn.scriptPolicy, "review")
+		});
+		const pending = has.filter((name) => !isScriptAllowed(policy, name));
+		if (pending.length > 0) this.pendingScripts.push(makeBlockedRecord(depInfo, policy, pending));
+	}
+	/**
+	* Record a package whose install scripts the policy blocked. Reported as one
+	* summary at the end of the install rather than a warning per package - under
+	* "review" mode every native dependency blocks on a first install.
+	*
+	* @param {object} depInfo resolved package data
+	* @param {object} policy result of `evaluateScriptPolicy`
+	* @param {string[]} blocked the lifecycle scripts that were skipped
+	* @returns {void}
+	*/
+	_recordBlockedScripts(depInfo, policy, blocked) {
+		logger$1.debug("scripts blocked", log_format_default.pkgId(depInfo), `[${blocked.join(", ")}]`, policy.reason);
+		this.blockedScripts.push(makeBlockedRecord(depInfo, policy, blocked));
+	}
+	/**
+	* Report every package whose install scripts were blocked, with the exact
+	* config to paste to allow them, and hand the same records to fyn so they are
+	* saved for `fyn install-scripts ls`.
+	*
+	* @returns {void}
+	*/
+	_reportBlockedScripts() {
+		const records = this.blockedScripts;
+		this._fyn.setBlockedScripts(records, this.pendingScripts);
+		for (const line of formatBlockedScriptsSummary(records, {
+			mode: this._fyn.scriptPolicy,
+			pin: this._fyn.allowScriptsPin
+		})) logger$1.warn(line);
+		for (const line of formatPendingScriptsSummary(this.pendingScripts, {
+			mode: this._fyn.scriptPolicy,
+			pin: this._fyn.allowScriptsPin
+		})) logger$1.info(line);
 	}
 	_cleanBin() {
 		logger$1.updateItem(INSTALL_PACKAGE, "cleaning node_modules/.bin");
@@ -98475,6 +99775,18 @@ const OMIT_SRC = {
 	optional: "opt",
 	peer: "per"
 };
+/**
+* How long to wait on npm's bulk advisories endpoint before giving up, in ms.
+*
+* That endpoint intermittently accepts the connection and never answers. npm-registry-fetch
+* would apply its own defaults here - a 5 minute timeout over 3 attempts - which turns a
+* stalled endpoint into a ~15 minute silent install hang. Audit is advisory and its caller
+* already degrades to cached data or a warning, so bound it tightly instead: one attempt,
+* ten seconds, then fall through.
+*/
+const AUDIT_FETCH_TIMEOUT = 1e4;
+/** No retries on the audit fetch - an endpoint that just stalled is unlikely to answer the retry. */
+const AUDIT_FETCH_RETRY = { retries: 0 };
 var AuditReport = class {
 	_fyn;
 	_depData;
@@ -98574,7 +99886,9 @@ var AuditReport = class {
 				...fetchOpts,
 				method: "POST",
 				body: payload,
-				gzip: true
+				gzip: true,
+				timeout: AUDIT_FETCH_TIMEOUT,
+				retry: AUDIT_FETCH_RETRY
 			})).json();
 			const result = {
 				advisories,
@@ -99740,6 +101054,38 @@ var FynCli = class {
 			return this._opts.saveLogs && this.saveLogs(this._opts.saveLogs);
 		});
 	}
+	/**
+	* `fyn install-scripts <action>` - review and record which packages may run
+	* their install scripts.
+	*
+	* @param {string} action one of ls / approve / deny / prune
+	* @param {object} argv parsed command args and options
+	* @returns {Promise<unknown>} the action's result
+	*/
+	async installScripts(action, argv = {}) {
+		const opts = argv.opts || {};
+		const packages = (argv.args || {}).packages || [];
+		await this.fyn._initializePkg();
+		const cmd = new InstallScripts({ fyn: this.fyn });
+		try {
+			switch (action) {
+				case "ls": return await cmd.ls({ json: Boolean(opts.json) });
+				case "approve": return await cmd.approve(packages, {
+					all: Boolean(opts.all),
+					local: Boolean(opts.local)
+				});
+				case "deny": return await cmd.deny(packages, { local: Boolean(opts.local) });
+				case "prune": return await cmd.prune({ local: Boolean(opts.local) });
+				default: throw new Error(`unknown install-scripts action "${action}"`);
+			}
+		} catch (err) {
+			logger$1.error(err.message);
+			fyntil.exit(1);
+			return;
+		} finally {
+			if (this._opts.saveLogs) await this.saveLogs(this._opts.saveLogs);
+		}
+	}
 	audit(argv) {
 		const opts = {
 			json: argv.opts?.json || false,
@@ -99784,7 +101130,7 @@ var FynCli = class {
 		if (this._config._fynpo.config) xsh.envPath.addToFront(Path.join(this._config._fynpo.dir, "node_modules/.bin"), env);
 		setupNodeGypEnv(env);
 		env.npm_node_execpath = env.NODE = env.NODE || process.execPath;
-		env.npm_execpath = fileURLToPath$1(new URL("../bin/fyn.js", import.meta.url));
+		env.npm_execpath = findFynCli();
 		env.INIT_CWD = this.fyn.cwd;
 		const mainScript = scripts[scripts.length - 1];
 		return dist_default.each(_scripts, (s) => {
@@ -100053,6 +101399,85 @@ function getTerminalWidth() {
 	return process.stdout.columns || 80;
 }
 
+//#endregion
+//#region node_modules/@fynjs/cli-args/dist/symbols.js
+const _PARENT = Symbol("parent");
+const _PREV = Symbol("prev");
+const _NEXT = Symbol("next");
+/** commands whose sync `exec` returned a promise - see NixClap.runExec */
+const _ASYNC_EXEC = Symbol("asyncExec");
+
+//#endregion
+//#region node_modules/@fynjs/cli-args/dist/clap-node.js
+/**
+* Represents a node in a command-line application parser.
+*
+* @remarks
+* This class is used to represent commands or options in a CLI application. Each node can have a parent node,
+* which represents a hierarchical relationship (e.g., command -> sub-command, option).
+*
+* @example
+* ```typescript
+* const rootNode = new ClapNode('root', 'rootAlias');
+* const childNode = new ClapNode('child', 'childAlias', rootNode);
+* rootNode.addArg('arg1');
+* childNode.addError(new Error('An error occurred'));
+* ```
+*
+* @public
+*/
+var ClapNode = class {
+	/**
+	*
+	* @param name - idiomatic name of the command
+	* @param inputName - name that was specified by user to trigger this command
+	* @param parent
+	*/
+	constructor(name, alias, parent) {
+		this.name = name;
+		this.alias = alias;
+		this.argsList = [];
+		this.argv = [];
+		this.argsMap = {};
+		if (parent) Object.defineProperty(this, _PARENT, {
+			value: parent,
+			configurable: true,
+			enumerable: false,
+			writable: true
+		});
+		this._errors = [];
+	}
+	/**
+	* Add an arg to this node
+	* @param arg
+	* @returns
+	*/
+	addArg(arg) {
+		this.argsList.push(arg);
+	}
+	addVerbatimArg(arg) {
+		this.argv.push(arg);
+	}
+	addError(e) {
+		this._errors.push(e);
+	}
+	get hasErrors() {
+		return this._errors.length > 0;
+	}
+	get error() {
+		return this._errors[0];
+	}
+	get errors() {
+		return this._errors;
+	}
+	get parent() {
+		return this[_PARENT];
+	}
+	getParent() {
+		return this.parent;
+	}
+};
+
 //#endregion
 //#region node_modules/@fynjs/cli-args/dist/base.js
 const SUPPORT_TYPES = [
@@ -100183,336 +101608,6 @@ var CliBase = class {
 	}
 };
 
-//#endregion
-//#region node_modules/@fynjs/cli-args/dist/symbols.js
-const _PARENT = Symbol("parent");
-const _PREV = Symbol("prev");
-const _NEXT = Symbol("next");
-/** commands whose sync `exec` returned a promise - see NixClap.runExec */
-const _ASYNC_EXEC = Symbol("asyncExec");
-
-//#endregion
-//#region node_modules/@fynjs/cli-args/dist/clap-node.js
-/**
-* Represents a node in a command-line application parser.
-*
-* @remarks
-* This class is used to represent commands or options in a CLI application. Each node can have a parent node,
-* which represents a hierarchical relationship (e.g., command -> sub-command, option).
-*
-* @example
-* ```typescript
-* const rootNode = new ClapNode('root', 'rootAlias');
-* const childNode = new ClapNode('child', 'childAlias', rootNode);
-* rootNode.addArg('arg1');
-* childNode.addError(new Error('An error occurred'));
-* ```
-*
-* @public
-*/
-var ClapNode = class {
-	/**
-	*
-	* @param name - idiomatic name of the command
-	* @param inputName - name that was specified by user to trigger this command
-	* @param parent
-	*/
-	constructor(name, alias, parent) {
-		this.name = name;
-		this.alias = alias;
-		this.argsList = [];
-		this.argv = [];
-		this.argsMap = {};
-		if (parent) Object.defineProperty(this, _PARENT, {
-			value: parent,
-			configurable: true,
-			enumerable: false,
-			writable: true
-		});
-		this._errors = [];
-	}
-	/**
-	* Add an arg to this node
-	* @param arg
-	* @returns
-	*/
-	addArg(arg) {
-		this.argsList.push(arg);
-	}
-	addVerbatimArg(arg) {
-		this.argv.push(arg);
-	}
-	addError(e) {
-		this._errors.push(e);
-	}
-	get hasErrors() {
-		return this._errors.length > 0;
-	}
-	get error() {
-		return this._errors[0];
-	}
-	get errors() {
-		return this._errors;
-	}
-	get parent() {
-		return this[_PARENT];
-	}
-	getParent() {
-		return this.parent;
-	}
-};
-
-//#endregion
-//#region node_modules/@fynjs/cli-args/dist/command-node.js
-/**
-* Object representation for an instance of a command on the CLI
-*/
-var CommandNode = class extends ClapNode {
-	constructor(name, alias, cmdBase) {
-		super(name, alias);
-		this.argv.push(name);
-		this.cmdBase = cmdBase;
-		this.subCmdNodes = {};
-		this.optNodes = {};
-		this.optCount = {};
-		this.isGreedy = false;
-	}
-	/** get the options with full values for this command */
-	get options() {
-		return this.jsonMeta.optsFull;
-	}
-	/** get the options for this command */
-	get opts() {
-		return this.jsonMeta.opts;
-	}
-	/** get the arguments for this command */
-	get args() {
-		return this.jsonMeta.args;
-	}
-	get source() {
-		return this.jsonMeta.source;
-	}
-	get optsFull() {
-		return this.jsonMeta.optsFull;
-	}
-	get subCommands() {
-		return this.jsonMeta.subCommands;
-	}
-	getParent() {
-		return super.getParent();
-	}
-	/**
-	* Get the root command by traversing up the parent chain until no more parent exists.
-	* @returns The root CommandNode
-	*/
-	get rootCmd() {
-		let current = this;
-		while (current.getParent()) current = current.getParent();
-		return current;
-	}
-	/**
-	* Get array of all commands that have exec callback
-	*
-	* Root command execution is handled specially:
-	* - This method filters out the root command (returns false for isRootCommand)
-	* - Root command execution is determined by _shouldExecuteRootCommand() in nix-clap.ts
-	* - Root command is executed in runExec/runExecAsync methods when conditions are met
-	*
-	* @param cmds - Array to accumulate command nodes with exec handlers
-	* @param includeSubCommands - Whether to recursively include sub-commands
-	* @returns Array of command nodes that have exec handlers (excluding root command)
-	*/
-	getExecCommands(cmds, includeSubCommands) {
-		if (this.cmdBase.exec && !isRootCommand(this.alias)) cmds.push(this);
-		if (includeSubCommands) for (const _key in this.subCmdNodes) this.subCmdNodes[_key].getExecCommands(cmds, includeSubCommands);
-		return cmds;
-	}
-	/**
-	* Get the command chain (sequence from root to this command, including itself)
-	* @returns Array of CommandNodes from root to this command
-	*/
-	get cmdChain() {
-		let parent = this;
-		const nodes = [];
-		while (parent && (parent = parent.getParent())) nodes.push(parent);
-		return nodes.reverse().concat(this);
-	}
-	/**
-	* Invoke the command's exec handler
-	*
-	* @param includeSubCommands - if true, then also do sub commands
-	* @param parsed - The parsed result containing remaining args after --
-	*/
-	invokeExec(includeSubCommands, parsed) {
-		let count = 0;
-		const cmds = this.getExecCommands([], includeSubCommands);
-		for (const cmd of cmds) {
-			const result = cmd.cmdBase.exec(cmd, parsed);
-			if (parsed) {
-				if (isThenable(result)) (parsed[_ASYNC_EXEC] || (parsed[_ASYNC_EXEC] = [])).push(cmd.name);
-				if (!parsed.execCmd) parsed.execCmd = cmd;
-			}
-			count++;
-		}
-		return count;
-	}
-	/**
-	*
-	* @param includeSubCommands
-	* @param parsed - The parsed result containing remaining args after --
-	* @returns
-	*/
-	async invokeExecAsync(includeSubCommands, parsed) {
-		let count = 0;
-		const cmds = this.getExecCommands([], includeSubCommands);
-		for (const cmd of cmds) {
-			await cmd.cmdBase.exec(cmd, parsed);
-			if (parsed && !parsed.execCmd) parsed.execCmd = cmd;
-			count++;
-		}
-		return count;
-	}
-	/**
-	* Add a sub command to this node
-	* @param name
-	* @returns node for the new command
-	*/
-	addCommandNode(node) {
-		node[_PARENT] = this;
-		this.subCmdNodes[node.name] = node;
-		return node;
-	}
-	getErrorNodes(errorNodes = []) {
-		if (this.hasErrors) errorNodes.push(this);
-		for (const _key in this.optNodes) {
-			const _optNode = this.optNodes[_key];
-			if (_optNode.hasErrors) errorNodes.push(_optNode);
-		}
-		for (const _key in this.subCmdNodes) this.subCmdNodes[_key].getErrorNodes(errorNodes);
-		return errorNodes;
-	}
-	/**
-	* Add a option to this node
-	* @param name
-	* @returns node for the new option
-	*/
-	addOptionNode(node) {
-		node[_PARENT] = this;
-		const name = node.option.name || node.name;
-		this.optNodes[name] = node;
-		if (!this.optCount[name]) this.optCount[name] = 0;
-		this.optCount[name]++;
-		return node;
-	}
-	removeOptionNode(name) {
-		if (this.optNodes[name]) {
-			delete this.optNodes[name];
-			delete this.optCount[name];
-		}
-	}
-	/**
-	*
-	*/
-	applyDefaults() {
-		for (const optName in this.optNodes) this.optNodes[optName].applyDefaults();
-		const options = this.cmdBase.options._options;
-		for (const optName in options) {
-			const opt = options[optName];
-			if (opt.spec.hasOwnProperty("argDefault") && !this.optNodes[optName]) new ClapNodeGenerator(this).addOptionWithArgs(optName, [].concat(opt.spec.argDefault), opt);
-		}
-		for (const subCmdName in this.subCmdNodes) this.subCmdNodes[subCmdName].applyDefaults();
-	}
-	/**
-	* Allow you to apply extra config to the parsed object, overriding any `opts` with `source` not start with `cli`.
-	*
-	* For example, you can allow user to specify options in their `package.json` file, and apply those after the command line is parsed.
-	* @param config - Config object containing user options config
-	* @param src - Name of the source that provided the config.  Default to `user`
-	* @returns
-	*/
-	applyConfig(config, src = "user") {
-		for (const key in config) {
-			const data = {
-				name: key,
-				value: config[key],
-				verbatim: config[key],
-				arg: config[key],
-				dashes: 0
-			};
-			const matchOpt = this.cmdBase.options.match(data);
-			if (matchOpt) {
-				const optNode = this.optNodes[matchOpt.name];
-				if (!optNode || !optNode.source.startsWith("cli")) {
-					this.removeOptionNode(matchOpt.name);
-					new ClapNodeGenerator(this).addOptionWithArgs(matchOpt.name, [].concat(data.arg), matchOpt.option, src);
-				}
-			} else if (!this.optNodes[key]) new ClapNodeGenerator(this).addOptionWithArgs(key, [].concat(data.arg), void 0, src);
-		}
-	}
-	/**
-	* For options that has names with - in them, add it using its name converted to camelCase.
-	*/
-	makeCamelCaseOptions() {
-		for (const key in this.optNodes) {
-			const camelCaseKey = camelCase(key);
-			if (camelCaseKey !== key && !this.optNodes[camelCaseKey]) {
-				this.optNodes[camelCaseKey] = this.optNodes[key];
-				this.optCount[camelCaseKey] = this.optCount[key];
-			}
-		}
-		for (const key in this.subCmdNodes) this.subCmdNodes[key].makeCamelCaseOptions();
-	}
-	/**
-	* check for missing options that are required
-	*
-	* @param missing
-	* @returns
-	*/
-	checkRequiredOptions(missing = []) {
-		const _opts = this.cmdBase.options._options;
-		for (const name in _opts) if (_opts[name].spec.required) {
-			if (!this.optNodes[name]) missing.push(name);
-		}
-		for (const kCmd in this.subCmdNodes) this.subCmdNodes[kCmd].checkRequiredOptions(missing);
-		return missing;
-	}
-	get jsonMeta() {
-		if (this._jsonMeta) return this._jsonMeta;
-		const opts = {};
-		const optsFull = {};
-		const source = {};
-		for (const name in this.optNodes) {
-			const variants = [name];
-			const node = this.optNodes[name];
-			if (node.alias && name !== node.alias) variants.push(node.alias);
-			for (const _name of variants) {
-				if (node.option.isSingleArg) opts[_name] = node.argsMap[0];
-				else if (node.option.isCounting) opts[_name] = this.optCount[node.option.name];
-				else if (!node.option.hasArgs) opts[_name] = node.argsMap[0];
-				else opts[_name] = node.argsMap;
-				optsFull[_name] = node.argsMap;
-				source[_name] = this.optNodes[name].source;
-			}
-		}
-		const subCommands = {};
-		for (const name in this.subCmdNodes) subCommands[name] = this.subCmdNodes[name].jsonMeta;
-		const meta = {
-			name: this.name,
-			alias: this.alias,
-			argList: this.argsList,
-			args: this.argsMap,
-			opts,
-			optsFull,
-			optsCount: this.optCount,
-			source,
-			verbatim: {},
-			subCommands
-		};
-		this._jsonMeta = meta;
-		return meta;
-	}
-};
-
 //#endregion
 //#region node_modules/@fynjs/cli-args/dist/option-base.js
 /**
@@ -100568,35 +101663,6 @@ var UnknownOption = class extends OptionBase {
 };
 const optUnknown = new UnknownOption("", {});
 
-//#endregion
-//#region node_modules/@fynjs/cli-args/dist/option-node.js
-/**
-* Represents an option node in the command-line argument parser.
-* Extends the `ClapNode` class to include specific option-related data.
-*
-* @remarks
-* This class is used to handle options parsed from the command-line input.
-* It includes the option itself and its source.
-*
-* @example
-* ```typescript
-* const optionMatch: OptionMatch = { name: 'verbose', alias: 'v', value: true, option: someOption };
-* const optionNode = new OptionNode(optionMatch);
-* ```
-*
-*/
-var OptionNode = class extends ClapNode {
-	constructor(data, parent) {
-		super(data.name, data.alias, parent);
-		this.argv.push(data.arg);
-		if (data.value !== void 0) this.addArg(data.value);
-		this.option = data.option || optUnknown;
-	}
-	applyDefaults() {
-		if (!this.option.spec.argDefault) return;
-	}
-};
-
 //#endregion
 //#region node_modules/@fynjs/cli-args/dist/options.js
 /**
@@ -100944,6 +102010,286 @@ const unknownCommandBaseNoOptions = new CommandBase("unknown no unknown options"
 	alias: []
 });
 
+//#endregion
+//#region node_modules/@fynjs/cli-args/dist/option-node.js
+/**
+* Represents an option node in the command-line argument parser.
+* Extends the `ClapNode` class to include specific option-related data.
+*
+* @remarks
+* This class is used to handle options parsed from the command-line input.
+* It includes the option itself and its source.
+*
+* @example
+* ```typescript
+* const optionMatch: OptionMatch = { name: 'verbose', alias: 'v', value: true, option: someOption };
+* const optionNode = new OptionNode(optionMatch);
+* ```
+*
+*/
+var OptionNode = class extends ClapNode {
+	constructor(data, parent) {
+		super(data.name, data.alias, parent);
+		this.argv.push(data.arg);
+		if (data.value !== void 0) this.addArg(data.value);
+		this.option = data.option || optUnknown;
+	}
+	applyDefaults() {
+		if (!this.option.spec.argDefault) return;
+	}
+};
+
+//#endregion
+//#region node_modules/@fynjs/cli-args/dist/command-node.js
+/**
+* Object representation for an instance of a command on the CLI
+*/
+var CommandNode = class extends ClapNode {
+	constructor(name, alias, cmdBase) {
+		super(name, alias);
+		this.argv.push(name);
+		this.cmdBase = cmdBase;
+		this.subCmdNodes = {};
+		this.optNodes = {};
+		this.optCount = {};
+		this.isGreedy = false;
+	}
+	/** get the options with full values for this command */
+	get options() {
+		return this.jsonMeta.optsFull;
+	}
+	/** get the options for this command */
+	get opts() {
+		return this.jsonMeta.opts;
+	}
+	/** get the arguments for this command */
+	get args() {
+		return this.jsonMeta.args;
+	}
+	get source() {
+		return this.jsonMeta.source;
+	}
+	get optsFull() {
+		return this.jsonMeta.optsFull;
+	}
+	get subCommands() {
+		return this.jsonMeta.subCommands;
+	}
+	getParent() {
+		return super.getParent();
+	}
+	/**
+	* Get the root command by traversing up the parent chain until no more parent exists.
+	* @returns The root CommandNode
+	*/
+	get rootCmd() {
+		let current = this;
+		while (current.getParent()) current = current.getParent();
+		return current;
+	}
+	/**
+	* Get array of all commands that have exec callback
+	*
+	* Root command execution is handled specially:
+	* - This method filters out the root command (returns false for isRootCommand)
+	* - Root command execution is determined by _shouldExecuteRootCommand() in nix-clap.ts
+	* - Root command is executed in runExec/runExecAsync methods when conditions are met
+	*
+	* @param cmds - Array to accumulate command nodes with exec handlers
+	* @param includeSubCommands - Whether to recursively include sub-commands
+	* @returns Array of command nodes that have exec handlers (excluding root command)
+	*/
+	getExecCommands(cmds, includeSubCommands) {
+		if (this.cmdBase.exec && !isRootCommand(this.alias)) cmds.push(this);
+		if (includeSubCommands) for (const _key in this.subCmdNodes) this.subCmdNodes[_key].getExecCommands(cmds, includeSubCommands);
+		return cmds;
+	}
+	/**
+	* Get the command chain (sequence from root to this command, including itself)
+	* @returns Array of CommandNodes from root to this command
+	*/
+	get cmdChain() {
+		let parent = this;
+		const nodes = [];
+		while (parent && (parent = parent.getParent())) nodes.push(parent);
+		return nodes.reverse().concat(this);
+	}
+	/**
+	* Invoke the command's exec handler
+	*
+	* @param includeSubCommands - if true, then also do sub commands
+	* @param parsed - The parsed result containing remaining args after --
+	*/
+	invokeExec(includeSubCommands, parsed) {
+		let count = 0;
+		const cmds = this.getExecCommands([], includeSubCommands);
+		for (const cmd of cmds) {
+			const result = cmd.cmdBase.exec(cmd, parsed);
+			if (parsed) {
+				if (isThenable(result)) (parsed[_ASYNC_EXEC] || (parsed[_ASYNC_EXEC] = [])).push(cmd.name);
+				if (!parsed.execCmd) parsed.execCmd = cmd;
+			}
+			count++;
+		}
+		return count;
+	}
+	/**
+	*
+	* @param includeSubCommands
+	* @param parsed - The parsed result containing remaining args after --
+	* @returns
+	*/
+	async invokeExecAsync(includeSubCommands, parsed) {
+		let count = 0;
+		const cmds = this.getExecCommands([], includeSubCommands);
+		for (const cmd of cmds) {
+			await cmd.cmdBase.exec(cmd, parsed);
+			if (parsed && !parsed.execCmd) parsed.execCmd = cmd;
+			count++;
+		}
+		return count;
+	}
+	/**
+	* Add a sub command to this node
+	* @param name
+	* @returns node for the new command
+	*/
+	addCommandNode(node) {
+		node[_PARENT] = this;
+		this.subCmdNodes[node.name] = node;
+		return node;
+	}
+	getErrorNodes(errorNodes = []) {
+		if (this.hasErrors) errorNodes.push(this);
+		for (const _key in this.optNodes) {
+			const _optNode = this.optNodes[_key];
+			if (_optNode.hasErrors) errorNodes.push(_optNode);
+		}
+		for (const _key in this.subCmdNodes) this.subCmdNodes[_key].getErrorNodes(errorNodes);
+		return errorNodes;
+	}
+	/**
+	* Add a option to this node
+	* @param name
+	* @returns node for the new option
+	*/
+	addOptionNode(node) {
+		node[_PARENT] = this;
+		const name = node.option.name || node.name;
+		this.optNodes[name] = node;
+		if (!this.optCount[name]) this.optCount[name] = 0;
+		this.optCount[name]++;
+		return node;
+	}
+	removeOptionNode(name) {
+		if (this.optNodes[name]) {
+			delete this.optNodes[name];
+			delete this.optCount[name];
+		}
+	}
+	/**
+	*
+	*/
+	applyDefaults() {
+		for (const optName in this.optNodes) this.optNodes[optName].applyDefaults();
+		const options = this.cmdBase.options._options;
+		for (const optName in options) {
+			const opt = options[optName];
+			if (opt.spec.hasOwnProperty("argDefault") && !this.optNodes[optName]) new ClapNodeGenerator(this).addOptionWithArgs(optName, [].concat(opt.spec.argDefault), opt);
+		}
+		for (const subCmdName in this.subCmdNodes) this.subCmdNodes[subCmdName].applyDefaults();
+	}
+	/**
+	* Allow you to apply extra config to the parsed object, overriding any `opts` with `source` not start with `cli`.
+	*
+	* For example, you can allow user to specify options in their `package.json` file, and apply those after the command line is parsed.
+	* @param config - Config object containing user options config
+	* @param src - Name of the source that provided the config.  Default to `user`
+	* @returns
+	*/
+	applyConfig(config, src = "user") {
+		for (const key in config) {
+			const data = {
+				name: key,
+				value: config[key],
+				verbatim: config[key],
+				arg: config[key],
+				dashes: 0
+			};
+			const matchOpt = this.cmdBase.options.match(data);
+			if (matchOpt) {
+				const optNode = this.optNodes[matchOpt.name];
+				if (!optNode || !optNode.source.startsWith("cli")) {
+					this.removeOptionNode(matchOpt.name);
+					new ClapNodeGenerator(this).addOptionWithArgs(matchOpt.name, [].concat(data.arg), matchOpt.option, src);
+				}
+			} else if (!this.optNodes[key]) new ClapNodeGenerator(this).addOptionWithArgs(key, [].concat(data.arg), void 0, src);
+		}
+	}
+	/**
+	* For options that has names with - in them, add it using its name converted to camelCase.
+	*/
+	makeCamelCaseOptions() {
+		for (const key in this.optNodes) {
+			const camelCaseKey = camelCase(key);
+			if (camelCaseKey !== key && !this.optNodes[camelCaseKey]) {
+				this.optNodes[camelCaseKey] = this.optNodes[key];
+				this.optCount[camelCaseKey] = this.optCount[key];
+			}
+		}
+		for (const key in this.subCmdNodes) this.subCmdNodes[key].makeCamelCaseOptions();
+	}
+	/**
+	* check for missing options that are required
+	*
+	* @param missing
+	* @returns
+	*/
+	checkRequiredOptions(missing = []) {
+		const _opts = this.cmdBase.options._options;
+		for (const name in _opts) if (_opts[name].spec.required) {
+			if (!this.optNodes[name]) missing.push(name);
+		}
+		for (const kCmd in this.subCmdNodes) this.subCmdNodes[kCmd].checkRequiredOptions(missing);
+		return missing;
+	}
+	get jsonMeta() {
+		if (this._jsonMeta) return this._jsonMeta;
+		const opts = {};
+		const optsFull = {};
+		const source = {};
+		for (const name in this.optNodes) {
+			const variants = [name];
+			const node = this.optNodes[name];
+			if (node.alias && name !== node.alias) variants.push(node.alias);
+			for (const _name of variants) {
+				if (node.option.isSingleArg) opts[_name] = node.argsMap[0];
+				else if (node.option.isCounting) opts[_name] = this.optCount[node.option.name];
+				else if (!node.option.hasArgs) opts[_name] = node.argsMap[0];
+				else opts[_name] = node.argsMap;
+				optsFull[_name] = node.argsMap;
+				source[_name] = this.optNodes[name].source;
+			}
+		}
+		const subCommands = {};
+		for (const name in this.subCmdNodes) subCommands[name] = this.subCmdNodes[name].jsonMeta;
+		const meta = {
+			name: this.name,
+			alias: this.alias,
+			argList: this.argsList,
+			args: this.argsMap,
+			opts,
+			optsFull,
+			optsCount: this.optCount,
+			source,
+			verbatim: {},
+			subCommands
+		};
+		this._jsonMeta = meta;
+		return meta;
+	}
+};
+
 //#endregion
 //#region node_modules/@fynjs/cli-args/dist/node-generator.js
 const BUILDER_STATUS_GATHER_END = 1;
@@ -107931,8 +109277,9 @@ var FynGlobal = class {
 	/**
 	* Show PATH setup instructions
 	*/
-	showPathSetup() {
-		const binPath = Path.join(this.globalRoot, "current", "bin");
+	async showPathSetup() {
+		const stableBin = Path.join(this.globalRoot, "bin");
+		const binPath = await file_ops_default.exists(stableBin) ? stableBin : this.globalBinDir;
 		const isWindows = process.platform === "win32";
 		console.log("\nTo use globally installed packages, add the bin directory to your PATH:\n");
 		if (isWindows) {
@@ -109027,6 +110374,23 @@ const options = {
 		desc: "fetch package dist tarball during dep resolving",
 		argDefault: "false"
 	},
+	"script-policy": {
+		args: "<mode string>",
+		desc: "install script policy: all, source, review (default), or off"
+	},
+	"allow-scripts": {
+		args: "[packages string..]",
+		desc: "let these packages run install scripts, for this run only"
+	},
+	"deny-scripts": {
+		args: "[packages string..]",
+		desc: "block these packages from running install scripts, whatever approved them"
+	},
+	"allow-scripts-pin": {
+		args: "<flag boolean>",
+		desc: "pin script approvals to the reviewed version",
+		argDefault: "true"
+	},
 	"central-store": {
 		args: "<flag boolean>",
 		alias: ["central", "cs"],
@@ -109214,6 +110578,10 @@ const commands = {
 			"audit-file": {
 				desc: "write audit report JSON to a file after install",
 				args: "<path string>"
+			},
+			"allow-scripts-pending": {
+				desc: "also report which packages would need approval under script policy review",
+				args: "<flag boolean>"
 			}
 		}
 	},
@@ -109262,6 +110630,11 @@ const commands = {
 				args: "<flag boolean>",
 				desc: "save fyn section to package-fyn.json",
 				argDefault: "false"
+			},
+			audit: {
+				desc: "run security audit after install (use --no-audit to skip)",
+				args: "<flag boolean>",
+				default: true
 			}
 		}
 	},
@@ -109282,14 +110655,21 @@ const commands = {
 				pickOpts.noStartupInfo = true;
 				fyntil.resetFynpo();
 				logger$1.info("installing...");
-				return await new FynCli(pickOpts).install();
+				return await new FynCli(pickOpts).install({ opts: { audit: meta.opts.audit } });
 			}
 		},
-		options: { install: {
-			args: "<flag boolean>",
-			argDefault: "true",
-			desc: "Run install after removed"
-		} }
+		options: {
+			install: {
+				args: "<flag boolean>",
+				argDefault: "true",
+				desc: "Run install after removed"
+			},
+			audit: {
+				desc: "run security audit after install (use --no-audit to skip)",
+				args: "<flag boolean>",
+				default: true
+			}
+		}
 	},
 	stat: {
 		desc: "Show stats of installed packages",
@@ -109375,6 +110755,60 @@ const commands = {
 			args: "<flag boolean>"
 		} }
 	},
+	"install-scripts": {
+		desc: "Review which packages may run install scripts",
+		subCommands: {
+			ls: {
+				desc: "List packages awaiting install-script review",
+				alias: "list",
+				options: { json: {
+					args: "<flag boolean>",
+					desc: "emit the list as JSON"
+				} },
+				async exec(cmd) {
+					return new FynCli(await pickOptions(cmd)).installScripts("ls", cmd.jsonMeta);
+				}
+			},
+			approve: {
+				desc: "Allow packages to run their install scripts",
+				args: "[packages string..]",
+				options: {
+					all: {
+						args: "<flag boolean>",
+						desc: "approve every package awaiting review"
+					},
+					local: {
+						args: "<flag boolean>",
+						desc: "write to this package's package.json instead of the monorepo's fynpo.json"
+					}
+				},
+				async exec(cmd) {
+					return new FynCli(await pickOptions(cmd)).installScripts("approve", cmd.jsonMeta);
+				}
+			},
+			deny: {
+				desc: "Deny packages outright - wins over any approval",
+				args: "[packages string..]",
+				options: { local: {
+					args: "<flag boolean>",
+					desc: "write to this package's package.json instead of the monorepo's fynpo.json"
+				} },
+				async exec(cmd) {
+					return new FynCli(await pickOptions(cmd)).installScripts("deny", cmd.jsonMeta);
+				}
+			},
+			prune: {
+				desc: "Drop approvals for packages that are no longer installed",
+				options: { local: {
+					args: "<flag boolean>",
+					desc: "write to this package's package.json instead of the monorepo's fynpo.json"
+				} },
+				async exec(cmd) {
+					return new FynCli(await pickOptions(cmd)).installScripts("prune", cmd.jsonMeta);
+				}
+			}
+		}
+	},
 	"sync-local": {
 		desc: "Refresh locally linked package files",
 		alias: "sl",
@@ -109529,7 +110963,7 @@ const commands = {
 					desc: "Directory for global packages (default: ~/.fyn/global)"
 				} },
 				async exec(cmd) {
-					(await makeFynGlobal(cmd)).showPathSetup();
+					await (await makeFynGlobal(cmd)).showPathSetup();
 				}
 			}
 		}