fyn 3.1.10 → 3.2.0

package/bin/fun.mjs

@@ -7,7 +7,8 @@ const { fun } = await import("./index.mjs");
 
 try {
   await fun();
-  process.exit(0);
+  // no argument, so a code the CLI parser set (e.g. 1 on a parse error) is kept
+  process.exit();
 } catch (err) {
   console.error(err);
   process.exit(1);

package/bin/fyn.mjs

@@ -7,7 +7,8 @@ const { run } = await import("./index.mjs");
 
 try {
   await run();
-  process.exit(0);
+  // no argument, so a code the CLI parser set (e.g. 1 on a parse error) is kept
+  process.exit();
 } catch (err) {
   console.error(err);
   process.exit(1);

package/dist/fyn.mjs

@@ -26180,7 +26180,7 @@ function simpleCompare(a, b) {
 function isVersionNewer(a, b) {
 	return simpleCompare(a, b) < 0;
 }
-function clean(v) {
+function clean$1(v) {
 	const f = v.split("-");
 	f[0] = f[0].split("+")[0].split(".").map((x) => x && parseInt(x, 10) || 0).join(".");
 	return f.join("-");
@@ -26943,6 +26943,11 @@ const PACKAGE_FYN_JSON = "package-fyn.json";
 */
 const FYN_INSTALL_CONFIG_FILE = ".fyn.json";
 const FYN_LOCK_FILE = "fyn-lock.yaml";
+/**
+* Copy of the lock data saved under FV_DIR. It always matches what is installed in
+* node_modules. Install uses it when FYN_LOCK_FILE is missing.
+*/
+const FYN_INSTALLED_LOCK_FILE = "lock.yaml";
 
 //#endregion
 //#region node_modules/filter-scan-dir/dist/util.js
@@ -30697,7 +30702,7 @@ var FynpoConfigManager = class {
 * Pipe streams together and resolve when the pipeline fully completes.
 * Replaces mississippi.pipe with node:stream/promises pipeline.
 */
-const missPipe$3 = (...streams) => pipeline(...streams);
+const missPipe$3 = (source, destination) => pipeline(source, destination);
 const DIR_SYMLINK_TYPE = isWin32 ? "junction" : "dir";
 /**
 * Check if a value satisfies a list of rules.
@@ -30779,7 +30784,7 @@ const fyntil = {
 			if (parent === treeTop) break;
 			treeTop = parent;
 		}
-		if (!gitPath || gitStat.isDirectory()) return dir;
+		if (!gitPath || gitStat?.isDirectory()) return dir;
 		try {
 			const m = (await file_ops_default.readFile(gitPath, "utf8")).match(/^gitdir:\s*(.+)$/m);
 			if (!m) return dir;
@@ -30870,7 +30875,7 @@ const fyntil = {
 			existTarget = false;
 			try {
 				await file_ops_default.unlink(linkName);
-			} catch (e) {
+			} catch {
 				await file_ops_default.$.rimraf(linkName);
 			}
 		} else logger$1.debug("local link existTarget", existTarget, "match new target", actualTarget);
@@ -32117,7 +32122,6 @@ var PkgDepResolver = class {
 			};
 			if (item.specifier) newPkgV.specifier = item.specifier;
 			pkgV = kpkg.versions[resolved] = newPkgV;
-			if (meta[LOCK_RSEMVERS]) pkgV.fromLock = true;
 			const scripts = metaJson.scripts || {};
 			if (metaJson.hasPI || scripts.preinstall || scripts.preInstall) pkgV.hasPI = 1;
 			if (metaJson.hasI || scripts.install || scripts.postinstall || scripts.postInstall) pkgV.hasI = 1;
@@ -94231,7 +94235,8 @@ var PkgSrcManager = class {
 			email: this._options.email,
 			alwaysAuth: this._options["always-auth"],
 			username: this._options.username,
-			password: this._options.password
+			password: this._options.password,
+			maxSockets: this._fyn.concurrency
 		}, authTokens, registryData);
 		this._pacoteOpts.Arborist = import_lib$5.default;
 		this._regData = registryData;
@@ -96473,7 +96478,12 @@ var PkgDepLocker = class {
 		}
 		const badDepsVersion = Object.entries(locked.versions).find(([, vpkg]) => vpkg.dependencies && !this._depsResolvable(item, vpkg.dependencies))?.[0];
 		if (badDepsVersion) {
-			logger$1.error(`lockfile entry ${item.name}@${badDepsVersion} has dependencies not satisfiable within the lock (corrupt lock) - ignoring and re-resolving from registry`);
+			const entry = `${item.name}@${badDepsVersion}`;
+			const msgKey = `staleLock:${entry}`;
+			if (!this._fyn._shownMissingFiles.has(msgKey)) {
+				this._fyn._shownMissingFiles.add(msgKey);
+				this._fyn._staleLockEntries.push(entry);
+			}
 			return false;
 		}
 		return valid && locked;
@@ -96633,12 +96643,7 @@ var PkgDepLocker = class {
 		let resolvedFilename = filename;
 		if (!Path.isAbsolute(resolvedFilename)) resolvedFilename = Path.resolve(resolvedFilename);
 		if (!this._lockOnly) {
-			assert(this._isFynFormat, "can't save lock data that's no longer in fyn format");
-			const basedir = Path.dirname(resolvedFilename);
-			this._lockData.$fyn = this._config;
-			const sortData = sortObjKeys(this._lockData);
-			this._relativeLocalPath(basedir, sortData);
-			const data = import_Yaml.default.stringify(sortData, 4, 1);
+			const data = this._stringify(Path.dirname(resolvedFilename));
 			if (this.shasum(data) !== this._shaSum) {
 				logger$1.info("saving lock file", resolvedFilename);
 				file_ops_default.writeFileSync(resolvedFilename, data);
@@ -96646,6 +96651,33 @@ var PkgDepLocker = class {
 		}
 	}
 	/**
+	* Save the lock copy that tracks what's installed in node_modules. Unlike save,
+	* it always writes, even in lock-only mode, so it matches every install.
+	*/
+	saveInstalled(filename) {
+		if (!this._enable) return;
+		file_ops_default.writeFileSync(filename, this._stringify(Path.dirname(filename)));
+	}
+	/**
+	* Read the lock copy the last install saved in node_modules. The outside lockfile
+	* is missing, so reset the checksum to make save write it again.
+	*/
+	async readInstalled(filename) {
+		const found = await this.read(filename);
+		this._shaSum = Date.now();
+		return found;
+	}
+	/**
+	* Serialize lock data, with local package paths relative to basedir
+	*/
+	_stringify(basedir) {
+		assert(this._isFynFormat, "can't save lock data that's no longer in fyn format");
+		this._lockData.$fyn = this._config;
+		const sortData = sortObjKeys(this._lockData);
+		this._relativeLocalPath(basedir, sortData);
+		return import_Yaml.default.stringify(sortData, 4, 1);
+	}
+	/**
 	* Read lock file
 	*/
 	async read(filename) {
@@ -96722,11 +96754,6 @@ var DepData = class {
 		this.pkgs = {};
 		Object.keys(pkgs).sort().forEach((x) => this.pkgs[x] = pkgs[x]);
 	}
-	cleanLinked() {
-		this.eachVersion((pkg) => {
-			pkg.linked = 0;
-		});
-	}
 	getPkgsData(bad) {
 		return bad ? this.badPkgs : this.pkgs;
 	}
@@ -96742,15 +96769,6 @@ var DepData = class {
 		if (!kpkg) return void 0;
 		return version ? kpkg.versions[version] : kpkg;
 	}
-	eachVersion(cb) {
-		const pkgs = this.pkgs;
-		Object.keys(pkgs).forEach((name) => {
-			const kpkg = pkgs[name];
-			Object.entries(kpkg.versions).forEach(([version, pkg]) => {
-				cb(pkg, version, kpkg);
-			});
-		});
-	}
 };
 
 //#endregion
@@ -100413,14 +100431,6 @@ var PkgDepLinker = class {
 	async loadLocalPackageAppFynLink() {
 		throw new Error("symlink local package is deprecated, only hard linking.");
 	}
-	async loadPkgDepData(depInfo) {
-		const installedDir = this._fyn.getInstalledPkgDir(depInfo.name, depInfo.version, depInfo);
-		if (!depInfo.json) {
-			const fname = Path.join(installedDir, "package.json");
-			depInfo.json = JSON.parse(await file_ops_default.readFile(fname));
-		}
-		if (depInfo.local === "sym") throw new Error("sym linking local package deprecated. only hard linking.");
-	}
 };
 
 //#endregion
@@ -101351,6 +101361,7 @@ var Fyn = class Fyn {
 	_shownMissingFiles;
 	_localCopiesInfo;
 	_skipBuildLocalPaths;
+	_staleLockEntries;
 	_options;
 	_cwd;
 	_initCwd;
@@ -101399,6 +101410,7 @@ var Fyn = class Fyn {
 		this._shownMissingFiles = /* @__PURE__ */ new Set();
 		this._localCopiesInfo = [];
 		this._skipBuildLocalPaths = [];
+		this._staleLockEntries = [];
 		const options = this._options = fynConfig(opts);
 		this._cwd = options.cwd || process.cwd();
 		this._initCwd = options.initCwd || this._cwd;
@@ -101446,7 +101458,11 @@ var Fyn = class Fyn {
 		if (this._depLocker) return null;
 		this._npmLockData = null;
 		this._depLocker = new PkgDepLocker(Boolean(this.lockOnly), Boolean(this._options.lockfile), this);
-		const foundLock = await this._depLocker.read(Path.join(this._cwd, FYN_LOCK_FILE));
+		let foundLock = await this._depLocker.read(Path.join(this._cwd, FYN_LOCK_FILE));
+		if (!foundLock && !this.lockOnly && this._options.lockfile) {
+			foundLock = await this._depLocker.readInstalled(this.getInstalledLockFile());
+			if (foundLock) logger$1.info(`${FYN_LOCK_FILE} not found - using lock data from last install. Remove ${this._options.targetDir} to resolve everything again.`);
+		}
 		this.updateConfigInLockfile("layout", this._options.layout);
 		this.updateConfigInLockfile("flattenTop", this._options.flattenTop);
 		this.checkLayoutOption();
@@ -101802,6 +101818,9 @@ var Fyn = class Fyn {
 	getInstallConfigFile() {
 		return Path.join(this.getFvDir(FYN_INSTALL_CONFIG_FILE));
 	}
+	getInstalledLockFile() {
+		return this.getFvDir(FYN_INSTALLED_LOCK_FILE);
+	}
 	setLocalPkgLinks(localLinks) {
 		this._installConfig.localPkgLinks = localLinks;
 	}
@@ -102186,6 +102205,7 @@ var Fyn = class Fyn {
 			const lines = this._localCopiesInfo.map(({ pkgName, depSec, names }) => `   ${pkgName} ${depSec}: ${names}`);
 			logger$1.info(`Following package and their dependencies using local copies from monorepo:\n${lines.join("\n")}`);
 		}
+		if (this._staleLockEntries.length > 0) logger$1.verbose(`lockfile stale for following entries - refreshing:\n   ${this._staleLockEntries.join(", ")}`);
 		if (this._skipBuildLocalPaths.length > 0) {
 			const lines = this._skipBuildLocalPaths.map((x) => `   ${x}`);
 			logger$1.info(`installing fynpo top level modules - skip build local for packages at:\n${lines.join("\n")}`);
@@ -102349,7 +102369,7 @@ var Fyn = class Fyn {
 		const pkgId = `${pkg.name}@${pkg.version}`;
 		const id = `${json.name}@${json.version}`;
 		if (json.version !== pkg.version) {
-			const cleanVersion = import_semver.default.valid(json.version) || clean(json.version);
+			const cleanVersion = import_semver.default.valid(json.version) || clean$1(json.version);
 			if (cleanVersion !== json.version) {
 				assert(import_semver.default.valid(cleanVersion), `Pkg ${id} version is not valid semver and fyn was unable to fix it.`);
 				json._origVersion = json.version;
@@ -103451,6 +103471,7 @@ var PkgInstaller = class {
 	async install() {
 		this._stepTime = Date.now();
 		this.timeCheck("beginning");
+		await file_ops_default.unlink(this._fyn.getInstalledLockFile()).catch(() => void 0);
 		const outputDir = this._fyn.getOutputDir();
 		this._binLinker = new PkgBinLinker({
 			outputDir,
@@ -103462,7 +103483,6 @@ var PkgInstaller = class {
 		this.blockedScripts = [];
 		this.pendingScripts = [];
 		this._blockedDeps = [];
-		this._data.cleanLinked();
 		this._fyn._depResolver.resolvePkgPeerDep(this._fyn._pkg, "your app", this._data);
 		const pkgsData = this._data.getPkgsData();
 		this.timeCheck("queueing packages");
@@ -104030,11 +104050,10 @@ var PkgInstaller = class {
 		}
 	}
 	_saveLockData() {
-		if (!this._fyn.lockOnly) {
-			const locker = this._fyn._depLocker || new PkgDepLocker(false, true, this._fyn);
-			locker.generate(this._fyn._data);
-			locker.save(Path.join(this._fyn.cwd, "fyn-lock.yaml"));
-		}
+		const locker = this._fyn._depLocker || new PkgDepLocker(false, true, this._fyn);
+		locker.generate(this._fyn._data);
+		if (!this._fyn.lockOnly) locker.save(Path.join(this._fyn.cwd, FYN_LOCK_FILE));
+		locker.saveInstalled(this._fyn.getInstalledLockFile());
 	}
 };
 
@@ -104759,7 +104778,7 @@ var AuditReport = class {
 			Object.keys(kpkg.versions).forEach((version) => {
 				const pkgInfo = kpkg.versions[version];
 				if (this.isOmitted(pkgInfo)) return;
-				if (pkgInfo.local || pkgInfo.localType) return;
+				if (pkgInfo.local) return;
 				if (!payload[name]) payload[name] = [];
 				if (!payload[name].includes(version)) payload[name].push(version);
 			});
@@ -105594,6 +105613,851 @@ const __filename$1 = fileURLToPath$1(import.meta.url);
 const __dirname$1 = Path.dirname(__filename$1);
 const myPkg = JSON.parse(fs.readFileSync(Path.join(__dirname$1, "../package.json"), "utf-8"));
 
+//#endregion
+//#region lib/prod-prune/licenses.ts
+/**
+* Recognisable licenses, most specific first, matched against the text with its
+* case and whitespace normalised. Each phrase is both the fingerprint of the
+* license and the point its terms begin, so it must be the opening words of the
+* license proper and cannot be wording another license shares.
+*/
+const SIGNATURES = [
+	{
+		id: "Apache-2.0",
+		name: "Apache License, Version 2.0",
+		phrase: "apache license version 2.0 january 2004"
+	},
+	{
+		id: "MPL-2.0",
+		name: "Mozilla Public License, Version 2.0",
+		phrase: "mozilla public license version 2.0"
+	},
+	{
+		id: "CC0-1.0",
+		name: "Creative Commons Zero, Version 1.0 Universal",
+		phrase: "cc0 1.0 universal"
+	},
+	{
+		id: "BlueOak-1.0.0",
+		name: "Blue Oak Model License, Version 1.0.0",
+		phrase: "blue oak model license version 1.0.0"
+	},
+	{
+		id: "Unlicense",
+		name: "The Unlicense",
+		phrase: "this is free and unencumbered software released into the public domain"
+	},
+	{
+		id: "Python-2.0",
+		name: "Python Software Foundation License, Version 2",
+		phrase: "python software foundation license version 2"
+	},
+	{
+		id: "ISC",
+		name: "ISC License",
+		phrase: "permission to use copy modify and/or distribute this software for any purpose with or without fee is hereby granted provided that the above copyright notice"
+	},
+	{
+		id: "0BSD",
+		name: "BSD Zero Clause License",
+		phrase: "permission to use copy modify and/or distribute this software for any purpose with or without fee is hereby granted"
+	},
+	{
+		id: "MIT",
+		name: "MIT License",
+		phrase: "permission is hereby granted free of charge to any person obtaining a copy"
+	},
+	{
+		id: "BSD-2-Clause",
+		name: "BSD 2-Clause License",
+		phrase: "redistribution and use in source and binary forms",
+		refine: (flat) => flat.includes("neither the name") ? {
+			id: "BSD-3-Clause",
+			name: "BSD 3-Clause License"
+		} : null
+	}
+];
+/** Words a line may consist of and still be only a title, not attribution. */
+const TITLE_WORDS = new Set("the mit isc bsd apache mozilla blue oak model unlicense python software foundation public license licence clause zero universal version cc0 0 1 2 3 1.0.0 2.0 v2 creative commons".split(" "));
+/**
+* Reduce a text to what it actually says, so wording can be compared without
+* layout getting in the way.
+*
+* Every run of anything that is not a letter, digit, `/` or `.` collapses to a
+* single space, which takes care of line wrapping and of the packages that
+* indent every line of their license. Trailing punctuation then goes too:
+* DefinitelyTyped ends its MIT with "SOFTWARE" where everyone else writes
+* "SOFTWARE.", and a full stop is not a difference in terms.
+*
+* `.` and `/` survive mid-string because the signature phrases need them —
+* "version 2.0 january 2004", "cc0 1.0 universal", "and/or distribute".
+*/
+const normalise = (text) => text.toLowerCase().replace(/[^a-z0-9/.]+/g, " ").trim().replace(/[./]+$/, "");
+/**
+* @param text license file contents
+*/
+function detectLicense(text) {
+	const flat = normalise(text);
+	for (const signature of SIGNATURES) {
+		if (!flat.includes(signature.phrase)) continue;
+		const refined = signature.refine?.(flat);
+		return {
+			id: refined?.id ?? signature.id,
+			name: refined?.name ?? signature.name,
+			phrase: signature.phrase
+		};
+	}
+	return {
+		id: "",
+		name: "",
+		phrase: ""
+	};
+}
+const isTitleOnly = (line) => {
+	const words = normalise(line).split(" ").filter(Boolean);
+	return words.length > 0 && words.every((word) => TITLE_WORDS.has(word));
+};
+/**
+* Split a license file into the package's own attribution and the license terms.
+*
+* @param text
+* @param phrase opening words of the terms, normalised; `""` when the license
+*   was not recognised, in which case the whole text is the terms
+*/
+function splitAtTerms(text, phrase) {
+	const lines = text.split("\n");
+	let start = 0;
+	if (phrase) {
+		start = lines.length;
+		for (let i = 0; i < lines.length; i++) if (normalise(lines.slice(i).join("\n")).startsWith(phrase)) {
+			start = i;
+			break;
+		}
+		if (start === lines.length) start = 0;
+	}
+	return {
+		attribution: lines.slice(0, start).map((line) => line.trim().replace(/\s+/g, " ")).filter((line) => line && !isTitleOnly(line)),
+		terms: lines.slice(start).join("\n").trim()
+	};
+}
+/**
+* Merge collected notices into the contents of a single file.
+*
+* Everything is done from what the caller already read; nothing is re-read from
+* disk. Output is fully sorted, so identical input always produces identical
+* bytes and the image layer stays reproducible.
+*
+* @param entries
+*/
+function combineLicenses(entries) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		const text = entry.text.trim();
+		if (!text) continue;
+		const license = /^notice/i.test(entry.file) ? {
+			id: "NOTICE",
+			name: "Attribution notice",
+			phrase: ""
+		} : detectLicense(text);
+		const { attribution, terms } = splitAtTerms(text, license.phrase);
+		const key = `${license.id}\u0000${normalise(terms)}`;
+		if (!groups.has(key)) groups.set(key, {
+			license,
+			terms,
+			packages: /* @__PURE__ */ new Map()
+		});
+		const group = groups.get(key);
+		const notices = group.packages.get(entry.package) ?? /* @__PURE__ */ new Set();
+		for (const line of attribution) notices.add(line);
+		group.packages.set(entry.package, notices);
+	}
+	const collected = [...groups.values()].map((group) => ({
+		...group,
+		packages: [...group.packages].map(([name, notices]) => ({
+			name,
+			notices: [...notices]
+		})).sort((a, b) => a.name.localeCompare(b.name))
+	})).sort((a, b) => b.packages.length - a.packages.length || a.license.id.localeCompare(b.license.id));
+	const packages = /* @__PURE__ */ new Set();
+	for (const group of collected) for (const entry of group.packages) packages.add(entry.name);
+	const out = [
+		"Third-party license and copyright notices",
+		"=========================================",
+		"",
+		`${packages.size} packages installed under this directory ship a license or notice file.`,
+		`They use ${collected.length} distinct ${collected.length === 1 ? "set of terms" : "sets of terms"}, reproduced once each below, with the`,
+		"packages that use them, and their copyright notices, listed above each.",
+		""
+	];
+	for (const group of collected) {
+		out.push(RULE, group.license.id ? `${group.license.name}  (${group.license.id})` : "Unrecognised license", "-".repeat(RULE.length), "");
+		for (const entry of group.packages) {
+			out.push(entry.name);
+			for (const notice of entry.notices) out.push(`    ${notice}`);
+		}
+		out.push("", RULE, "", group.terms, "", "");
+	}
+	return {
+		content: out.join("\n"),
+		licenses: collected.length,
+		packages: packages.size
+	};
+}
+const RULE = "=".repeat(78);
+
+//#endregion
+//#region lib/prod-prune/rules.ts
+/**
+* What counts as non-runtime material in an installed `node_modules` tree.
+*
+* ESM, TypeScript. See index.ts for this module's own reasoning.
+*
+* Every rule is keyed on what a file *is*, never on which package ships it. A
+* rule that has to name a package is only correct for the dependency tree as it
+* looked on the day it was written, and it rots silently — the failure mode
+* being a runtime crash in a deployed image that no build-time check catches.
+*
+* License and notice files are never removed by these rules — they are gathered
+* into a single combined file first (see `isLicenseFile`). MIT, BSD and Apache
+* all require the copyright notice to travel with redistributed code, and
+* shipping a container image is redistribution.
+*
+* Build formats are deliberately not touched either. A package that publishes
+* both CJS and ESM has both trees reachable, and `require-in-the-middle` (which
+* @sentry/node and @opentelemetry monkey-patch through) needs the CJS one
+* present. Deleting a format risks a runtime failure no build-time check sees.
+* The one exception is `isBundlerOnlyEsnext`, which node provably cannot reach.
+*/
+/**
+* Removed whole, wherever they appear in the tree, except as a package's own
+* directory (see `isPackageRoot`).
+*/
+const REMOVE_DIRS = /* @__PURE__ */ new Set([
+	"test",
+	"tests",
+	"__tests__",
+	"spec",
+	"__mocks__",
+	"docs",
+	"doc",
+	"example",
+	"examples",
+	"benchmark",
+	"benchmarks",
+	"coverage",
+	".nyc_output",
+	".github",
+	".circleci",
+	".husky",
+	".idea",
+	".vscode"
+]);
+/**
+* Removed by extension, compared lower-case. `.ts` covers `.d.ts`, since the
+* extension is taken from the last dot; both are compile-time only. `.mts` and
+* `.cts` are the same in the module and commonjs flavours — node loads `.mjs`
+* and `.cjs`, never their TypeScript spellings, so nothing there is reachable
+* either.
+*/
+const REMOVE_EXTS = /* @__PURE__ */ new Set([
+	".ts",
+	".mts",
+	".cts",
+	".map",
+	".tsbuildinfo",
+	".md",
+	".markdown",
+	".log",
+	".tmp",
+	".temp",
+	".bak",
+	".orig",
+	".rej",
+	".swp",
+	".swo"
+]);
+/** Removed by exact name, case-sensitive. */
+const REMOVE_NAMES = /* @__PURE__ */ new Set([
+	".editorconfig",
+	".npmignore",
+	".gitignore",
+	".gitattributes",
+	".jshintrc",
+	".taprc",
+	".c8rc",
+	".nojekyll",
+	".runkit_example.js",
+	"Makefile",
+	".DS_Store",
+	"Thumbs.db"
+]);
+/**
+* YAML removed by exact name, compared lower-case. YAML is not removed by
+* extension: a package may read its own `.yaml` config, schema or spec at
+* runtime. These names are CI and tooling config that no package loads.
+*/
+const REMOVE_YAML_NAMES = /* @__PURE__ */ new Set([
+	".travis.yml",
+	"appveyor.yml",
+	".appveyor.yml",
+	"azure-pipelines.yml",
+	"bitbucket-pipelines.yml",
+	".drone.yml",
+	".gitlab-ci.yml",
+	".codeclimate.yml",
+	"codecov.yml",
+	".codecov.yml",
+	".readthedocs.yml",
+	".readthedocs.yaml",
+	".pre-commit-config.yaml",
+	".yarnrc.yml",
+	"pnpm-lock.yaml",
+	"pnpm-workspace.yaml",
+	".mocharc.yml",
+	".mocharc.yaml",
+	".nycrc.yml",
+	".nycrc.yaml",
+	".lintstagedrc.yml",
+	".lintstagedrc.yaml",
+	".stylelintrc.yml",
+	".stylelintrc.yaml",
+	".markdownlint.yml",
+	".markdownlint.yaml",
+	".markdownlint-cli2.yaml",
+	".borp.yml",
+	".borp.yaml",
+	".airtap.yml"
+]);
+/**
+* Tooling config removed when the file name starts with one of these, compared
+* lower-case. Any extension, since a dotfile with these names is never loaded
+* by a package.
+*
+* `.eslint` and `.prettier` rather than `.eslintrc` and `.prettierrc`, so the
+* matching `.eslintignore` and `.prettierignore` go with them.
+*/
+const REMOVE_CONFIG_PREFIXES = [
+	".eslint",
+	".prettier",
+	".babelrc"
+];
+/**
+* Project documents removed when the file name starts with one of these,
+* compared lower-case, and only with a document extension. The names are
+* ordinary words, so a code file can start with one: the `history` package
+* loads `umd/history.production.min.js`.
+*/
+const REMOVE_DOC_PREFIXES = [
+	"changelog",
+	"history",
+	"authors",
+	"contributing",
+	"code_of_conduct"
+];
+const DOC_EXTS = /* @__PURE__ */ new Set([
+	"",
+	".md",
+	".markdown",
+	".txt",
+	".rst"
+]);
+const TSCONFIG_RE = /^tsconfig.*\.json$/;
+/**
+* Names that carry a copyright notice. The extension list keeps this from
+* matching source files such as `license.js`.
+*
+* This check runs *before* `isNonRuntimeFile`, which would otherwise delete the
+* nine `LICENSE.md` files in a BFF install under its `.md` rule.
+*
+* @param file file name, no directory part
+* @param ext extension including the dot, `""` for a dotfile
+*/
+function isLicenseFile(file, ext) {
+	if (!LICENSE_EXTS.has(ext.toLowerCase())) return false;
+	return LICENSE_RE.test(file);
+}
+const LICENSE_EXTS = /* @__PURE__ */ new Set([
+	"",
+	".txt",
+	".md",
+	".markdown"
+]);
+const LICENSE_RE = /^(licen[cs]e|notice|copying)/i;
+/**
+* @param file file name, no directory part
+* @param ext extension including the dot, `""` for a dotfile
+* @returns true when node never loads this file
+*/
+function isNonRuntimeFile(file, ext) {
+	const lowerExt = ext.toLowerCase();
+	if (REMOVE_EXTS.has(lowerExt)) return true;
+	if (REMOVE_NAMES.has(file)) return true;
+	const lower = file.toLowerCase();
+	if (TSCONFIG_RE.test(lower) || REMOVE_YAML_NAMES.has(lower)) return true;
+	if (REMOVE_CONFIG_PREFIXES.some((prefix) => lower.startsWith(prefix))) return true;
+	return DOC_EXTS.has(lowerExt) && REMOVE_DOC_PREFIXES.some((prefix) => lower.startsWith(prefix));
+}
+/**
+* Is this fyn's installed-lock copy? fyn writes it at `.f/lock.yaml` to record
+* what it installed. A pruned tree no longer matches a fyn install, so the copy
+* goes, and fyn cannot trust it later. `.f/.fyn.json` stays: `fyn prod-prune`
+* reads its `production` flag.
+*
+* @param root the node_modules being cleaned
+* @param fullPath
+*/
+function isFynInstalledLock(root, fullPath) {
+	return Path.relative(root, fullPath) === Path.join(".f", "lock.yaml");
+}
+/**
+* Is this directory a package's own folder rather than one inside it?
+* `REMOVE_DIRS` names are real package names too (`benchmark` is one), and
+* `esnext` sitting beside the `esm` package would pass `isBundlerOnlyEsnext`.
+* A name match alone would delete a whole dependency.
+*
+* A package folder sits directly under a `node_modules` (or the tree root),
+* under an `@scope` there, or in fyn's store at `.f/_/<name>` or
+* `.f/_/@scope/<name>`.
+*
+* @param root the node_modules being cleaned
+* @param dir full path of the directory
+*/
+function isPackageRoot(root, dir) {
+	const parts = Path.relative(root, dir).split(Path.sep);
+	const n = parts.length;
+	const container = n >= 2 && parts[n - 2].startsWith("@") ? parts.slice(0, n - 2) : parts.slice(0, n - 1);
+	const c = container.length;
+	return c === 0 || container[c - 1] === "node_modules" || c === 2 && container[0] === ".f" && container[1] === "_";
+}
+/**
+* Media and archives that survive the prune and are worth a human's attention.
+*
+* These are *reported, never removed*. An image or a zip in a server's runtime
+* tree is odd — it is usually a test fixture, a README screenshot or vendored
+* source — but a package is free to read its own asset at runtime, and nothing
+* about the file says which case this is. Deleting on a guess would break a
+* dependency in a way no build-time check catches, so the tool surfaces them
+* and leaves the judgement to whoever reads the build log.
+*
+* Native and WebAssembly binaries (`.node`, `.wasm`, `.so`, `.dylib`) are
+* deliberately absent: those genuinely are loaded at runtime.
+*
+* @param ext extension including the dot
+*/
+function isReviewableAsset(ext) {
+	return REVIEW_EXTS.has(ext.toLowerCase());
+}
+const REVIEW_EXTS = /* @__PURE__ */ new Set([
+	".png",
+	".jpg",
+	".jpeg",
+	".gif",
+	".bmp",
+	".ico",
+	".webp",
+	".avif",
+	".svg",
+	".psd",
+	".mp4",
+	".webm",
+	".mov",
+	".mp3",
+	".wav",
+	".ogg",
+	".ttf",
+	".otf",
+	".woff",
+	".woff2",
+	".eot",
+	".zip",
+	".tar",
+	".tgz",
+	".gz",
+	".bz2",
+	".xz",
+	".7z",
+	".rar",
+	".br",
+	".pdf",
+	".drawio",
+	".sketch"
+]);
+/**
+* Is this `esnext/` directory a build only a bundler will ever read?
+*
+* `esnext` is not a condition node implements, so node can enter such a
+* directory only if the package's own manifest points at it. Two questions
+* decide it, and both must agree:
+*
+* 1. **Can node reach it?** Every path a resolver can land on comes from the
+*    manifest — `main`, `bin`, or an `exports` entry under a condition node
+*    implements (`import`, `require`, `node`, `default`). If any of them lands
+*    inside the directory, it stays, whatever else suggests otherwise. This is
+*    what keeps the rule from going stale: a future package that does point
+*    node at its `esnext/` is left alone instead of being broken at runtime.
+*
+* 2. **Is something else claiming it?** Absence of evidence is not enough, so
+*    the directory also has to be claimed by a bundler: named under a condition
+*    node does not implement (`esnext`, `module`, `browser`, `webpack`, …),
+*    pointed at by the legacy `module` field, or sitting beside an `esm/`
+*    sibling — which shows the package publishes per-syntax-level variants for
+*    a bundler to choose between. Anything unclaimed is left alone.
+*
+* The one case this cannot see is a reachable file reaching sideways with a
+* relative `../esnext/x.js` import. Packages publish parallel compiled outputs
+* precisely so that they do not cross-import, so the assumption holds in
+* practice, but it is an assumption rather than a proof.
+*
+* @param dir full path of the candidate `esnext` directory
+* @param siblings names of the entries beside it
+* @param manifestTargets resolves a package directory to its manifest paths,
+*   memoised by the caller
+*/
+function isBundlerOnlyEsnext(dir, siblings, manifestTargets) {
+	if (Path.basename(dir) !== "esnext") return false;
+	const pkgDir = findPackageDir(dir);
+	if (!pkgDir) return false;
+	const inside = `${Path.relative(pkgDir, dir).split(Path.sep).join("/")}/`;
+	const pointsInside = (target) => target.replace(/^\.\//, "").startsWith(inside);
+	const targets = manifestTargets(pkgDir);
+	if (targets.node.some(pointsInside)) return false;
+	return targets.bundler.some(pointsInside) || siblings.includes("esm");
+}
+/** Nearest ancestor directory holding a package.json, or `""`. */
+function findPackageDir(dir) {
+	let cur = Path.dirname(dir);
+	for (let i = 0; i < 8 && cur && cur !== Path.dirname(cur); i++) {
+		if (fs.existsSync(Path.join(cur, "package.json"))) return cur;
+		cur = Path.dirname(cur);
+	}
+	return "";
+}
+/** Conditions node resolves. `module` and `esnext` are bundler conventions. */
+const NODE_CONDITIONS = /* @__PURE__ */ new Set([
+	"import",
+	"require",
+	"node",
+	"node-addons",
+	"default"
+]);
+/**
+* Split a manifest's entry points into the ones node can resolve and the ones
+* only a bundler will.
+*
+* @param pkgDir directory holding the package.json
+*/
+function readManifestTargets(pkgDir) {
+	const targets = {
+		node: [],
+		bundler: []
+	};
+	let manifest;
+	try {
+		manifest = JSON.parse(fs.readFileSync(Path.join(pkgDir, "package.json"), "utf8"));
+	} catch {
+		return targets;
+	}
+	if (typeof manifest.main === "string") targets.node.push(manifest.main);
+	if (typeof manifest.bin === "string") targets.node.push(manifest.bin);
+	else if (manifest.bin && typeof manifest.bin === "object") for (const key of Object.keys(manifest.bin)) targets.node.push(manifest.bin[key]);
+	if (typeof manifest.module === "string") targets.bundler.push(manifest.module);
+	collectExportTargets(manifest.exports, targets, false);
+	return targets;
+}
+function collectExportTargets(node, targets, bundlerOnly) {
+	if (typeof node === "string") {
+		targets[bundlerOnly ? "bundler" : "node"].push(node);
+		return;
+	}
+	if (!node || typeof node !== "object") return;
+	for (const key of Object.keys(node)) if (key.startsWith(".")) collectExportTargets(node[key], targets, bundlerOnly);
+	else if (key !== "types") collectExportTargets(node[key], targets, bundlerOnly || !NODE_CONDITIONS.has(key));
+}
+
+//#endregion
+//#region lib/prod-prune/index.ts
+/**
+* Remove non-runtime files from a production `node_modules` tree, so a
+* container image carries only what node actually loads.
+*
+* ESM, TypeScript, bundled like the rest of fyn (see tsconfig.json for why the
+* lib target sits at ES2022). This backs the `fyn prod-prune` command rather
+* than running as its own standalone tool.
+*
+* None of what this deletes is reachable code, all of it is readable by anyone
+* who pulls the image, and every file of it is inventory a scanner has to
+* enumerate. Source maps reconstruct a dependency's original source; test and
+* fixture directories are a well-known home for hardcoded credentials and
+* sample tokens.
+*
+*   fyn prod-prune [dir] [--max-kb <n>] [--max-files <n>]
+*
+* Nothing about a file's size says whether it may be deleted — the largest file
+* in a BFF install is loaded at runtime — so size is only ever reported, never
+* acted on. Every run lists the files over 100kB, so the build log says where
+* the weight sits. The budgets are the regression gate on top of that: they
+* make new material entering the image someone's decision at review time
+* rather than a surprise at deploy time, and exceeding either names the largest
+* packages and exits non-zero.
+*/
+const LARGE_FILE_BYTES = 102400;
+const LARGE_LIST_LIMIT = 20;
+const REVIEW_LIST_LIMIT = 20;
+const COMBINED_LICENSE_FILE = "THIRD-PARTY-LICENSES.txt";
+/**
+* What the package owning this tree declares about its own pruning, under a
+* `prodPruning` key in the package.json beside `node_modules`.
+*
+*   "prodPruning": {
+*     "maxKb": 15600,        // fail the build above this many kB
+*     "maxFiles": 2850,      // fail the build above this many files
+*     "keepPaths": ["some-pkg/vendor", "some-pkg/table.bin"]
+*   }
+*
+* Budgets live here rather than in a Dockerfile so that a dependency change and
+* the budget it moves land in the same file, in the same commit, under the same
+* review. `keepPaths` is the escape hatch that lets the rules stay generic: an
+* app that needs one specific file or directory spared says so here, instead of
+* a package name leaking into a rule where it would go stale.
+*
+* @param root the node_modules being cleaned
+*/
+function readConfig(root) {
+	let declared = {};
+	try {
+		const manifest = Path.join(Path.dirname(root), "package.json");
+		declared = JSON.parse(fs.readFileSync(manifest, "utf8")).prodPruning ?? {};
+	} catch {}
+	return {
+		maxKb: Number(declared.maxKb) || 0,
+		maxFiles: Number(declared.maxFiles) || 0,
+		keepPaths: Array.isArray(declared.keepPaths) ? declared.keepPaths : []
+	};
+}
+/**
+* Walk the tree once, sorting every entry into what goes, what stays, and what
+* carries a copyright notice.
+*
+* @param root
+* @param keepPaths relative to `root`, each either a file or a directory;
+*   naming a directory spares everything under it
+*/
+async function scan(root, keepPaths) {
+	const keepList = keepPaths.map((path) => path.split("/").join(Path.sep));
+	const isKeepPath = (fullPath) => {
+		const rel = Path.relative(root, fullPath);
+		return keepList.some((path) => rel === path || rel.startsWith(`${path}${Path.sep}`));
+	};
+	const removeDirs = [];
+	const kept = [];
+	const licenses = [];
+	let keptBytes = 0;
+	const targetCache = /* @__PURE__ */ new Map();
+	const manifestTargets = (pkgDir) => {
+		if (!targetCache.has(pkgDir)) targetCache.set(pkgDir, readManifestTargets(pkgDir));
+		return targetCache.get(pkgDir);
+	};
+	return {
+		removeDirs,
+		removeFiles: (await filterScanDir({
+			cwd: root,
+			prependCwd: true,
+			grouping: true,
+			rethrowError: true,
+			filterDir: (file, path, extras) => {
+				if (isKeepPath(extras.fullFile)) return true;
+				if (!isPackageRoot(root, extras.fullFile) && (REMOVE_DIRS.has(file) || isBundlerOnlyEsnext(extras.fullFile, extras.files, manifestTargets))) {
+					removeDirs.push(extras.fullFile);
+					return false;
+				}
+				return true;
+			},
+			filter: (file, path, extras) => {
+				if (isKeepPath(extras.fullFile)) {
+					kept.push({
+						path: extras.fullFile,
+						size: extras.stat.size,
+						review: false
+					});
+					keptBytes += extras.stat.size;
+					return false;
+				}
+				if (isLicenseFile(file, extras.ext)) {
+					const owner = packageOf(root, extras.fullFile);
+					licenses.push({
+						path: extras.fullFile,
+						package: owner.version ? `${owner.name}@${owner.version}` : owner.name,
+						file,
+						text: fs.readFileSync(extras.fullFile, "utf8")
+					});
+					return false;
+				}
+				if (isNonRuntimeFile(file, extras.ext) || isFynInstalledLock(root, extras.fullFile)) return "remove";
+				kept.push({
+					path: extras.fullFile,
+					size: extras.stat.size,
+					review: isReviewableAsset(extras.ext)
+				});
+				keptBytes += extras.stat.size;
+				return false;
+			}
+		})).remove || [],
+		licenses,
+		kept,
+		keptBytes
+	};
+}
+/**
+* Delete the directories the deletions left empty. Deepest first, so a parent
+* emptied by its own children going away is collected in the same pass.
+*/
+async function removeEmptyDirs(root) {
+	const dirs = await filterScanDir({
+		cwd: root,
+		prependCwd: true,
+		includeDir: true,
+		rethrowError: true,
+		filter: () => false
+	});
+	const depth = (dir) => dir.split("/").length;
+	dirs.sort((a, b) => depth(b) - depth(a));
+	let removed = 0;
+	for (const dir of dirs) try {
+		fs.rmdirSync(dir);
+		removed++;
+	} catch {}
+	return removed;
+}
+const packageCache = /* @__PURE__ */ new Map();
+/**
+* Which package ships this file, and at which version.
+*
+* The directory is found from the *last* `node_modules` in the path, not the
+* first, so a nested copy is attributed to the package itself rather than to
+* the store holding it — fyn keeps duplicate versions under
+* `.f/_/<name>/<version>/node_modules/`, and reporting those as a package
+* called `.f` tells you nothing. One path segment after that, or two when the
+* first starts with `@`.
+*
+* The name then comes from that directory's own package.json rather than from
+* the directory name, which is the only authoritative answer — and the reason
+* to compute the directory this way instead of walking up looking for the
+* nearest manifest, since packages routinely drop a `dist/cjs/package.json`
+* carrying nothing but `{"type": "commonjs"}`.
+*/
+function packageOf(root, fullPath) {
+	const parts = Path.relative(root, fullPath).split(Path.sep);
+	const start = parts.lastIndexOf("node_modules") + 1;
+	if (start >= parts.length - 1) return {
+		name: parts.at(-1),
+		version: ""
+	};
+	const span = parts[start].startsWith("@") ? 2 : 1;
+	const dir = Path.join(root, ...parts.slice(0, start + span));
+	if (!packageCache.has(dir)) packageCache.set(dir, readPackageIdentity(dir, parts.slice(start, start + span).join("/")));
+	return packageCache.get(dir);
+}
+function readPackageIdentity(dir, fallbackName) {
+	try {
+		const manifest = JSON.parse(fs.readFileSync(Path.join(dir, "package.json"), "utf8"));
+		return {
+			name: manifest.name ?? fallbackName,
+			version: manifest.version ?? ""
+		};
+	} catch {
+		return {
+			name: fallbackName,
+			version: ""
+		};
+	}
+}
+/** Total size of the surviving files, grouped by the package that ships them. */
+function largestPackages(root, files, limit) {
+	const byPackage = /* @__PURE__ */ new Map();
+	for (const file of files) {
+		const name = packageOf(root, file.path).name;
+		const group = byPackage.get(name);
+		if (group) group.push(file);
+		else byPackage.set(name, [file]);
+	}
+	return [...byPackage.entries()].map(([name, group]) => [name, group.reduce((total, file) => total + file.size, 0)]).sort((a, b) => b[1] - a[1]).slice(0, limit);
+}
+function kb(bytes) {
+	return Math.round(bytes / 1024);
+}
+/** The limits that are set, like `15600kB / 2850 files`, or `none`. */
+function describeBudget(maxKb, maxFiles) {
+	const limits = [maxKb > 0 && `${maxKb}kB`, maxFiles > 0 && `${maxFiles} file${maxFiles === 1 ? "" : "s"}`].filter(Boolean);
+	return limits.length > 0 ? limits.join(" / ") : "none";
+}
+/**
+* @returns the state of the tree afterwards. Returned rather than turned
+*   straight into an exit code so the caller decides what a budget overrun
+*   means — the CLI fails the build with it; a test just reads it.
+*/
+async function clean(dir, cliMaxKb, cliMaxFiles) {
+	const root = Path.resolve(dir);
+	if (!fs.existsSync(root)) throw new Error(`no such directory: ${root}`);
+	const config = readConfig(root);
+	const maxKb = cliMaxKb || config.maxKb;
+	const maxFiles = cliMaxFiles || config.maxFiles;
+	if (config.keepPaths.length > 0) logger$1.info(`keeping ${config.keepPaths.length} path${config.keepPaths.length === 1 ? "" : "s"} named in prodPruning: ` + config.keepPaths.join(", "));
+	const found = await scan(root, config.keepPaths);
+	let combined = null;
+	if (found.licenses.length > 0) {
+		const merged = combineLicenses(found.licenses);
+		const path = Path.join(root, COMBINED_LICENSE_FILE);
+		fs.writeFileSync(path, merged.content);
+		combined = {
+			...merged,
+			path,
+			size: Buffer.byteLength(merged.content)
+		};
+	}
+	for (const path of found.removeDirs) fs.rmSync(path, {
+		recursive: true,
+		force: true
+	});
+	for (const path of found.removeFiles.concat(found.licenses.map((l) => l.path))) fs.rmSync(path, { force: true });
+	const emptied = await removeEmptyDirs(root);
+	const kept = combined ? found.kept.concat([{
+		path: combined.path,
+		size: combined.size
+	}]) : found.kept;
+	const keptBytes = found.keptBytes + (combined ? combined.size : 0);
+	logger$1.info(`removed ${found.removeFiles.length} files, ${found.removeDirs.length} directories and ${emptied} more left empty`);
+	if (combined) logger$1.info(`merged ${found.licenses.length} license files from ${combined.packages} packages into ${combined.licenses} distinct ${combined.licenses === 1 ? "license" : "licenses"} in ${COMBINED_LICENSE_FILE}`);
+	logger$1.info(`${kept.length} files, ${kb(keptBytes)}kB remain (budget ${describeBudget(maxKb, maxFiles)})`);
+	const review = found.kept.filter((file) => file.review).sort((a, b) => b.size - a.size);
+	if (review.length > 0) {
+		logger$1.info(`${review.length} media or archive ${review.length === 1 ? "file survives" : "files survive"} the prune. A server's runtime tree rarely needs one, but only a human can say whether a package reads its own asset, so these are reported and left alone:`);
+		for (const file of review.slice(0, REVIEW_LIST_LIMIT)) logger$1.info(`  ${String(kb(file.size)).padStart(7)}kB  ${Path.relative(root, file.path)}`);
+		if (review.length > REVIEW_LIST_LIMIT) logger$1.info(`  ... and ${review.length - REVIEW_LIST_LIMIT} more`);
+	}
+	const large = kept.filter((file) => file.size > LARGE_FILE_BYTES).sort((a, b) => b.size - a.size);
+	if (large.length > 0) {
+		const total = large.reduce((sum, file) => sum + file.size, 0);
+		logger$1.info(`${large.length} files over ${kb(LARGE_FILE_BYTES)}kB hold ${kb(total)}kB of the remaining ${kb(keptBytes)}kB:`);
+		for (const file of large.slice(0, LARGE_LIST_LIMIT)) logger$1.info(`  ${String(kb(file.size)).padStart(7)}kB  ${Path.relative(root, file.path)}`);
+		if (large.length > LARGE_LIST_LIMIT) logger$1.info(`  ... and ${large.length - LARGE_LIST_LIMIT} more`);
+	}
+	const result = {
+		files: kept.length,
+		kb: kb(keptBytes),
+		withinBudget: true
+	};
+	const overKb = maxKb > 0 && result.kb > maxKb;
+	const overFiles = maxFiles > 0 && result.files > maxFiles;
+	if (!overKb && !overFiles) return result;
+	logger$1.error(`FATAL: ${root} holds ${result.files} files and ${result.kb}kB, over the ${describeBudget(maxKb, maxFiles)} budget.`);
+	logger$1.error("Largest packages:");
+	for (const [name, size] of largestPackages(root, kept, 20)) logger$1.error(`  ${String(kb(size)).padStart(7)}kB  ${name}`);
+	return {
+		...result,
+		withinBudget: false
+	};
+}
+
 //#endregion
 //#region cli/fyn-cli.ts
 function checkNewVersion(npmConfig) {
@@ -106076,6 +106940,23 @@ var FynCli = class {
 			return this._opts.saveLogs && this.saveLogs(this._opts.saveLogs);
 		});
 	}
+	/**
+	* Remove non-runtime files from a production node_modules. Only runs on demand,
+	* and refuses a tree that did not come from `fyn install --production` unless forced.
+	*/
+	async prodPrune(argv) {
+		const dir = argv.args.dir ? Path.resolve(this.fyn.cwd, argv.args.dir) : this.fyn.getOutputDir();
+		try {
+			if (!argv.opts.force) {
+				const configFile = Path.join(dir, ".f", FYN_INSTALL_CONFIG_FILE);
+				if ((await file_ops_default.readFile(configFile, "utf8").then((data) => JSON.parse(data)).catch(() => ({}))).production !== true) throw new Error(`${dir} is not from a production install (fyn install --production). Use --force to prune it anyway.`);
+			}
+			if (!(await clean(dir, argv.opts.maxKb || 0, argv.opts.maxFiles || 0)).withinBudget) fyntil.exit(1);
+		} catch (err) {
+			logger$1.error(err.message);
+			fyntil.exit(1);
+		}
+	}
 	async runScript(pkg, script, env, scriptArgs = []) {
 		const config = (x) => this.fyn.allrc[x];
 		const options = {
@@ -114234,11 +115115,10 @@ var FynGlobal = class {
 			pkgJson.dependencies[targetPackageName] = targetVersion.semver || "latest";
 			await file_ops_default.writeFile(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + "\n");
 		}
-		const lockPath = Path.join(pkgDir, "fyn-lock.yaml");
-		try {
+		const fyn = this._createFyn(pkgDir, targetVersion.local);
+		for (const lockPath of [Path.join(pkgDir, "fyn-lock.yaml"), fyn.getInstalledLockFile()]) try {
 			await file_ops_default.unlink(lockPath);
 		} catch (err) {}
-		const fyn = this._createFyn(pkgDir, targetVersion.local);
 		await fyn.resolveDependencies();
 		await fyn.fetchPackages();
 		await new PkgInstaller({ fyn }).install();
@@ -115902,6 +116782,30 @@ const commands = {
 			}
 		}
 	},
+	"prod-prune": {
+		desc: "Remove non-runtime files from a production node_modules",
+		usage: "$0 $1 [dir] [--max-kb <n>] [--max-files <n>] [--force]",
+		args: "[dir string]",
+		exec: async (cmd) => {
+			return new FynCli(await pickOptions(cmd)).prodPrune(cmd.jsonMeta);
+		},
+		options: {
+			"max-kb": {
+				args: "<kb number>",
+				desc: "Fail when the pruned tree exceeds this many kB",
+				argDefault: "0"
+			},
+			"max-files": {
+				args: "<count number>",
+				desc: "Fail when the pruned tree exceeds this many files",
+				argDefault: "0"
+			},
+			force: {
+				args: "<flag boolean>",
+				desc: "Prune even if the tree is not from a production install"
+			}
+		}
+	},
 	"sync-local": {
 		desc: "Refresh locally linked package files",
 		alias: "sl",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fyn",
   "type": "module",
-  "version": "3.1.10",
+  "version": "3.2.0",
   "description": "fyn is a node.js package manager, and supports fynpo -- a zero setup monorepo tool",
   "main": "./bin/index.mjs",
   "homepage": "https://github.com/jchip/fynjs/tree/main/packages/fyn",
@@ -35,8 +35,7 @@
   },
   "author": "Joel Chen",
   "publishConfig": {
-    "access": "public",
-    "registry": "https://registry.npmjs.com/"
+    "access": "public"
   },
   "files": [
     "bin",
@@ -82,7 +81,7 @@
     "Walmart GTP.js Team and Contributors"
   ],
   "devDependencies": {
-    "@fynjs/run": "^1.1.7",
+    "@fynjs/run": "^1.1.8",
     "@fynjs/ts-resolve": "^1.0.3",
     "@types/node": "^26.4.1",
     "@vitest/coverage-v8": "^5.0.0",
@@ -92,7 +91,7 @@
     "patch-package": "^8.0.0",
     "prettier": "^3.5.3",
     "rolldown": "^1.2.6",
-    "run-verify": "^2.1.7",
+    "run-verify": "^2.1.8",
     "typescript": "^7.0.2",
     "vite": "^8.2.2",
     "vitest": "^5.0.0",