fyn 3.2.3 → 3.3.0

package/dist/fyn.mjs

@@ -17,7 +17,7 @@ import os$1 from "os";
 import * as util$5 from "util";
 import Util from "util";
 import EventEmitter$1, { EventEmitter, once } from "events";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import Pr, { basename, join, posix, win32 } from "node:path";
 import { pipeline } from "stream/promises";
 import * as Fs from "node:fs";
@@ -30,13 +30,14 @@ import { Buffer as Buffer$1 } from "buffer";
 import * as Ps$1 from "zlib";
 import en from "zlib";
 import co from "node:assert";
-import { randomBytes } from "node:crypto";
+import Crypto$1, { randomBytes } from "node:crypto";
 import * as FsPromises from "node:fs/promises";
 import ro from "node:fs/promises";
+import { Worker } from "node:worker_threads";
 import { URL as URL$1, fileURLToPath as fileURLToPath$1 } from "url";
 import childProcess from "child_process";
 import fs$1 from "fs/promises";
-import { PassThrough } from "stream";
+import { PassThrough, Readable } from "stream";
 import * as dns from "dns";
 import * as net$3 from "net";
 import * as tls$1 from "tls";
@@ -680,7 +681,9 @@ var TimeoutRunner = class {
 		this.defer = makeDefer(options.Promise);
 		this.ThePromise = options.Promise;
 		this.TimeoutError = options.TimeoutError;
-		this.timeout = setTimeout(() => this.defer.reject(new this.TimeoutError(rejectMsg)), maxMs);
+		const msg = rejectMsg || "xaa TimeoutRunner operation timed out";
+		this.timeout = setTimeout(() => this.defer.reject(new this.TimeoutError(msg)), maxMs);
+		this.defer.promise.catch(() => {});
 	}
 	/**
 	* check if runner has failed with error
@@ -787,6 +790,19 @@ function createMapContext(array) {
 	};
 }
 /**
+* attach partial results to a map error
+*
+* Thrown values can be primitives or frozen, so a failed assignment is ignored.
+*
+* @param err - the thrown value
+* @param partial - results mapped so far
+*/
+function addPartial(err, partial) {
+	try {
+		err.partial = partial;
+	} catch (_a) {}
+}
+/**
 * async map for array that supports concurrency
 *
 * Use by xaa.map internally.
@@ -798,7 +814,7 @@ function createMapContext(array) {
 */
 function multiMap(array, func, options) {
 	const awaited = new Array(array.length);
-	let error;
+	let failed = false;
 	let completedCount = 0;
 	let freeSlots = options.concurrency;
 	let index = 0;
@@ -808,15 +824,15 @@ function multiMap(array, func, options) {
 	const defer = makeDefer();
 	const fail = (err) => {
 		context.failed = true;
-		if (!error) {
-			error = err;
-			error.partial = awaited;
-			defer.reject(error);
+		if (!failed) {
+			failed = true;
+			addPartial(err, awaited);
+			defer.reject(err);
 		}
 	};
 	const mapNext = () => {
-		if (!error && completedCount === totalCount) return defer.resolve(awaited);
-		if (error || freeSlots <= 0 || index >= totalCount) return null;
+		if (!failed && completedCount === totalCount) return defer.resolve(awaited);
+		if (failed || freeSlots <= 0 || index >= totalCount) return null;
 		const ir = iterator && iterator.next();
 		/* c8 ignore next 7 */
 		if (ir && ir.done) {
@@ -840,15 +856,16 @@ function multiMap(array, func, options) {
 				return mapNext();
 			} else return save(res);
 		};
+		const callFunc = (val) => {
+			try {
+				return handleRet(func.call(options.thisArg, val, pendingIx, context));
+			} catch (err) {
+				return fail(err);
+			}
+		};
 		const item = ir ? ir.value : array[pendingIx];
-		if (isPromise$1(item)) return item.then((val) => {
-			return handleRet(func.call(options.thisArg, val, pendingIx, context));
-		}, fail);
-		else try {
-			return handleRet(func.call(options.thisArg, item, pendingIx, context));
-		} catch (err) {
-			return fail(err);
-		}
+		if (isPromise$1(item)) return item.then(callFunc, fail);
+		else return callFunc(item);
 	};
 	mapNext();
 	return defer.promise;
@@ -865,7 +882,7 @@ async function mapSeries(array, func, options) {
 		}
 	} catch (err) {
 		context.failed = true;
-		err.partial = awaited;
+		addPartial(err, awaited);
 		throw err;
 	}
 	return awaited;
@@ -1223,13 +1240,15 @@ function cleanErrorStack(error, { replacePath = `${process.cwd()}/`, ignorePathF
 	if (!stack) return String(stack);
 	return stack.split("\n").map((line) => {
 		if (!line.match(/ {4,}at/)) return line;
-		const match = line.match(/( {4,}at)([^\(]+\()([^\)]+\))(.*)/);
-		if (!match || !match[3].match(/[^:]+:\/\//) && !Path.isAbsolute(match[3])) return false;
-		const path = match[3].replace(/\\/g, "/");
+		const match = line.match(/( {4,}at )(?:([^(]*\()(.+)(\).*)|(.+))/);
+		const [, at, name = "", location = match === null || match === void 0 ? void 0 : match[5], tail = ""] = match || [];
+		if (!location || !location.match(/[^:]+:\/\//) && !Path.isAbsolute(location)) return false;
+		const path = location.replace(/\\/g, "/");
 		if (defaultPathFilter.concat(ignorePathFilter).find((s) => s && (s instanceof RegExp ? path.match(s) : path.includes(s)))) return false;
-		const path2 = replacePath && replacePath.length > 1 ? path.replace(replacePath, "") : path;
-		return `${match[1]}${match[2]}${path2}${match[4]}`;
-	}).filter((x) => x).join("\n");
+		let path2 = path;
+		if (replacePath && replacePath.length > 1) path2 = path.startsWith(`file://${replacePath}`) ? path.slice(`file://${replacePath}`.length) : path.replace(replacePath, "");
+		return `${at}${name}${path2}${tail}`;
+	}).filter((x) => x !== false).join("\n");
 }
 /**
 * Build stack of aggregate errors
@@ -1250,16 +1269,17 @@ function aggregateStack(stack, errors) {
 * @returns aggregate stack
 */
 function aggregateErrorStack(error) {
-	return aggregateStack(error.__stack || error.message || String(error), error.errors);
+	return aggregateStack(error.__stack || (error instanceof AggregateError$1 ? "" : error.stack) || error.message || String(error), error.errors);
 }
 /**
 * AggregateError
 * - https://tc39.es/ecma262/multipage/fundamental-objects.html#sec-aggregate-error-objects
 */
 var AggregateError$1 = class extends globalThis.AggregateError {
-	constructor(errors, msg) {
+	constructor(errors, msg, options) {
 		if (!errors || !(errors[Symbol.iterator] instanceof Function)) throw new TypeError(`input errors must be iterable but it's ${typeof errors}`);
-		super(errors, msg);
+		const list = Array.from(errors);
+		super(list, msg, options);
 		Object.defineProperty(this, "name", { value: "AggregateError" });
 		let aggStack;
 		Object.defineProperties(this, {
@@ -1267,7 +1287,7 @@ var AggregateError$1 = class extends globalThis.AggregateError {
 				configurable: true,
 				enumerable: false,
 				writable: true,
-				value: [].concat(errors)
+				value: list
 			},
 			__stack: {
 				enumerable: false,
@@ -1540,6 +1560,22 @@ var AveAzul = class AveAzul extends Promise {
 	constructor(executor) {
 		super(executor);
 	}
+	catch(...args) {
+		if (args.length <= 1) return super.catch(args[0]);
+		const handler = args.pop();
+		if (typeof handler !== "function") throw new TypeError("The last argument to .catch() must be a function, got " + String(handler));
+		const filters = args;
+		return super.catch((err) => {
+			for (const f of filters) if (f === Error || f != null && f.prototype instanceof Error) {
+				if (err instanceof f) return handler(err);
+			} else if (typeof f === "function") {
+				if (f(err)) return handler(err);
+			} else if (err !== null && (typeof err === "object" || typeof err === "function")) {
+				if (Object.keys(f).every((k) => f[k] == err[k])) return handler(err);
+			}
+			throw err;
+		});
+	}
 	/**
 	* Bluebird-style tap() method that lets you perform side effects in a chain
 	* Similar to Bluebird's Promise.prototype.tap()
@@ -1559,7 +1595,16 @@ var AveAzul = class AveAzul extends Promise {
 	* @returns Promise that resolves with the filtered array
 	*/
 	filter(fn) {
-		return this.then((value) => filter$2(value, fn));
+		return this.then(async (value) => {
+			const arr = toArray$1(value);
+			const len = arr.length;
+			const result = [];
+			for (let i = 0; i < len; i++) {
+				const x = isPromise(arr[i]) ? await arr[i] : arr[i];
+				if (await fn(x, i, len)) result.push(x);
+			}
+			return result;
+		});
 	}
 	/**
 	* Bluebird-style map() method for array operations
@@ -1568,7 +1613,11 @@ var AveAzul = class AveAzul extends Promise {
 	* @returns Promise that resolves with the mapped array
 	*/
 	map(fn, options = { concurrency: 50 }) {
-		return this.then((value) => map$1(value, fn, options));
+		return this.then((value) => {
+			const arr = toArray$1(value);
+			const len = arr.length;
+			return map$1(arr, (item, index) => fn(item, index, len), options);
+		});
 	}
 	/**
 	* Bluebird-style mapSeries() method for array operations
@@ -1605,7 +1654,7 @@ var AveAzul = class AveAzul extends Promise {
 	*/
 	each(fn) {
 		return this.then(async (value) => {
-			const arr = value;
+			const arr = toArray$1(value);
 			const result = [];
 			for (let i = 0; i < arr.length; i++) {
 				let x = arr[i];
@@ -1675,7 +1724,7 @@ var AveAzul = class AveAzul extends Promise {
 	reduce(fn, initialValue) {
 		const hasInitial = arguments.length > 1;
 		return this.then(async (array) => {
-			const arr = array;
+			const arr = toArray$1(array);
 			const len = arr.length;
 			let value;
 			let idx;
@@ -1750,8 +1799,9 @@ var AveAzul = class AveAzul extends Promise {
 		if (typeof fn !== "function") return AveAzul.reject(/* @__PURE__ */ new TypeError("expecting a function but got " + fn));
 		return this.then(async (args) => {
 			if (Array.isArray(args)) {
-				for (let i = 0; i < args.length; i++) if (isPromise(args[i])) args[i] = await args[i];
-				return fn(...args);
+				const values = args.slice();
+				for (let i = 0; i < values.length; i++) if (isPromise(values[i])) values[i] = await values[i];
+				return fn(...values);
 			} else return fn(args);
 		});
 	}
@@ -1931,6 +1981,15 @@ var AveAzul = class AveAzul extends Promise {
 		return AveAzul.resolve(items).each(fn);
 	}
 	/**
+	* Bluebird-style filter() for array filtering
+	* @param items - Array or iterable to filter
+	* @param fn - Filter function (item, index, length)
+	* @returns Promise that resolves with the items that passed the filter
+	*/
+	static filter(items, fn) {
+		return AveAzul.resolve(items).filter(fn);
+	}
+	/**
 	* Bluebird-style reduce() for array reduction
 	* @param array - Array to reduce
 	* @param fn - Reducer function (value, item, index, length)
@@ -1990,7 +2049,7 @@ var AveAzul = class AveAzul extends Promise {
 	* @returns Promise that resolves with handler result
 	*/
 	static using(resources, ...args) {
-		if (args.length === 0) throw new TypeError("resrouces and handler function required");
+		if (args.length === 0) throw new TypeError("resources and handler function required");
 		if (Array.isArray(resources)) {
 			if (args.length > 1) throw new TypeError("only two arguments are allowed when passing an array of resources");
 			return using(resources, args[0], AveAzul, true);
@@ -2118,7 +2177,7 @@ var require_signal_exit = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			/* istanbul ignore if */
 			if (!processOk(global.process)) return function() {};
 			assert$3.equal(typeof cb, "function", "a callback must be provided for exit handler");
-			if (loaded === false) load$1();
+			if (loaded === false) load$2();
 			var ev = "exit";
 			if (opts && opts.alwaysLast) ev = "afterexit";
 			var remove = function() {
@@ -2168,7 +2227,7 @@ var require_signal_exit = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			return signals$1;
 		};
 		var loaded = false;
-		var load$1 = function load() {
+		var load$2 = function load() {
 			if (loaded || !processOk(global.process)) return;
 			loaded = true;
 			emitter.count += 1;
@@ -2183,7 +2242,7 @@ var require_signal_exit = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			process.emit = processEmit;
 			process.reallyExit = processReallyExit;
 		};
-		module.exports.load = load$1;
+		module.exports.load = load$2;
 		var originalProcessReallyExit = process.reallyExit;
 		var processReallyExit = function processReallyExit(code) {
 			/* istanbul ignore if */
@@ -21628,7 +21687,7 @@ var SignalExit = class extends SignalExitBase {
 	}
 };
 const process$3 = globalThis.process;
-const { onExit, load, unload } = signalExitWrap(processOk(process$3) ? new SignalExit(process$3) : new SignalExitFallback());
+const { onExit, load: load$1, unload } = signalExitWrap(processOk(process$3) ? new SignalExit(process$3) : new SignalExitFallback());
 
 //#endregion
 //#region node_modules/restore-cursor/index.js
@@ -24034,11 +24093,16 @@ const LogItemTypes = {
 	none: 0
 };
 const DEFAULT_SPINNER_INTERVAL = 100;
+function levelValue(level) {
+	if (!Object.prototype.hasOwnProperty.call(Levels, level)) throw new TypeError(`VisualLogger unknown log level: ${String(level)}`);
+	return Levels[level];
+}
 const SPIN_OFF = 0;
 const SPIN_STARTED = 1;
 const SPIN_RUNNING = 2;
 var VisualLogger = class VisualLogger {
 	constructor(options = {}) {
+		var _a;
 		options = {
 			renderFps: 30,
 			...options
@@ -24047,7 +24111,7 @@ var VisualLogger = class VisualLogger {
 		this._items = [];
 		this._itemOptions = {};
 		this._lines = [];
-		this._logLevel = Levels.info;
+		this._logLevel = levelValue((_a = options.logLevel) !== null && _a !== void 0 ? _a : "info");
 		this._itemType = LogItemTypes.normal;
 		this._logData = [];
 		this._output = options.output || defaultOutput$1;
@@ -24076,6 +24140,12 @@ var VisualLogger = class VisualLogger {
 		this._color = enable;
 		this.setPrefix();
 	}
+	get logLevel() {
+		return Object.keys(Levels).find((k) => Levels[k] === this._logLevel);
+	}
+	set logLevel(level) {
+		this._logLevel = levelValue(level);
+	}
 	static get spinners() {
 		return [
 			"|/-\\",
@@ -24210,7 +24280,10 @@ var VisualLogger = class VisualLogger {
 			this._renderLineMsg(options, data);
 			const updateData = typeof data === "string" ? {} : data;
 			if (options.save !== false && updateData._save !== false) this._save(options._msg);
-			if (updateData._render === false) return this;
+			if (updateData._render === false) {
+				this._lines[itemIdx] = this._shouldLogItem() ? this._renderLine(options) : options._msg;
+				return this;
+			}
 		}
 		if (this._shouldLogItem()) {
 			if (data === void 0 && !this._nextSpin(options)) return this;
@@ -26695,6 +26768,7 @@ var InflightStore = class {
 //#endregion
 //#region node_modules/item-queue/dist/item-queue.js
 const PAUSE_ITEM = Symbol("pause");
+const PAUSE_CALL = Symbol("pauseCall");
 const RESUME_ITEM = Symbol("resume");
 const NOOP_ITEM = Symbol("NOOP");
 const WATCH_PERIOD = 500;
@@ -26705,6 +26779,8 @@ var ItemQueue = class ItemQueue extends EventEmitter$1 {
 	constructor(options) {
 		assert(options && typeof options.processItem === "function", "ItemQueue: must provide options.processItem callback");
 		super();
+		/** bumped by an immediate pause(), so a resume() tick scheduled earlier skips itself */
+		this._pauseSeq = 0;
 		this.Promise = options.Promise || ItemQueue.Promise;
 		assert(this.Promise, "ItemQueue: No Promise implementation available");
 		this._pending = new InflightStore();
@@ -26714,7 +26790,7 @@ var ItemQueue = class ItemQueue extends EventEmitter$1 {
 		this._processItem = options.processItem;
 		this._stopOnError = options.stopOnError;
 		this._failed = false;
-		this._timeout = options.timeout;
+		this._timeout = options.timeout > 0 ? options.timeout : 0;
 		this._watchPeriod = options.watchPeriod || WATCH_PERIOD;
 		this._watchTime = options.watchTime;
 		this._id = 1;
@@ -26731,19 +26807,18 @@ var ItemQueue = class ItemQueue extends EventEmitter$1 {
 	* @returns promise that wait for queue to finish
 	*/
 	wait() {
-		if (this._failed) return this.Promise.reject(this._failed);
+		if (this._failed) return this.Promise.reject(this._failError);
 		if (this.isPending) return new this.Promise((resolve, reject) => {
-			const h = (data) => {
-				if (data.error) {
-					this.removeListener("done", h);
-					reject(data.error);
-				} else {
-					this.removeListener("fail", h);
-					resolve(data);
-				}
+			const onDone = (data) => {
+				this.removeListener("fail", onFail);
+				resolve(data);
+			};
+			const onFail = (data) => {
+				this.removeListener("done", onDone);
+				reject(data.error);
 			};
-			this.once("done", h);
-			this.once("fail", h);
+			this.once("done", onDone);
+			this.once("fail", onFail);
 		});
 		return this.Promise.resolve();
 	}
@@ -26831,7 +26906,15 @@ var ItemQueue = class ItemQueue extends EventEmitter$1 {
 	* @returns instance self
 	*/
 	pause() {
-		this._itemQ.unshift(this._wrap(ItemQueue.pauseItem));
+		if (this._processing || !this._pending.isEmpty) this._itemQ.unshift({
+			item: void 0,
+			_control: PAUSE_CALL
+		});
+		else {
+			this._pause = true;
+			this._pauseSeq++;
+			process.nextTick(() => this.emit("pause"));
+		}
 		return this;
 	}
 	/**
@@ -26854,7 +26937,10 @@ var ItemQueue = class ItemQueue extends EventEmitter$1 {
 	* @returns instance self
 	*/
 	resume() {
+		this._itemQ = this._itemQ.filter((x) => x._control !== PAUSE_CALL);
+		const pauseSeq = this._pauseSeq;
 		process.nextTick(() => {
+			if (pauseSeq !== this._pauseSeq) return;
 			this.unpause();
 			if (this._itemQ.length === 0) this._itemQ.push(this._wrap(RESUME_ITEM));
 			this._process();
@@ -26872,7 +26958,7 @@ var ItemQueue = class ItemQueue extends EventEmitter$1 {
 		return this.resume();
 	}
 	_wrap(item, stopOnError) {
-		if (typeof item === "symbol") return {
+		if (item === PAUSE_ITEM || item === RESUME_ITEM) return {
 			item: void 0,
 			_control: item
 		};
@@ -26884,14 +26970,15 @@ var ItemQueue = class ItemQueue extends EventEmitter$1 {
 	_emit(evt, data) {
 		this.emit(evt, data);
 	}
-	_handleQueueItemDone(data) {
+	_handleQueueItemDone(data, failed) {
 		if (data.id > 0) this._pending.remove(data.id);
 		if (this._failed) return;
 		if (!data._control && data.id > 0) {
-			if (data.error) {
+			if (failed) {
 				this._emit("failItem", data);
 				if (data.stopOnError !== false && this._stopOnError) {
-					this._failed = data.error;
+					this._failed = true;
+					this._failError = data.error;
 					this._emit("fail", data);
 					return;
 				}
@@ -26963,25 +27050,60 @@ var ItemQueue = class ItemQueue extends EventEmitter$1 {
 		}
 		this._watchTimer = setTimeout(() => this._pendingWatcher(), this._watchPeriod).unref();
 	}
+	/**
+	* Fail the item if it doesn't settle within `options.timeout`. The first outcome wins,
+	* so a result that arrives after the timeout is ignored.
+	*/
+	_withTimeout(promise, abort) {
+		return new this.Promise((resolve, reject) => {
+			const timer = setTimeout(() => {
+				const error = Object.assign(/* @__PURE__ */ new Error(`item-queue: item timed out after ${this._timeout}ms`), { code: "ETIMEDOUT" });
+				abort.abort(error);
+				reject(error);
+			}, this._timeout);
+			promise.then((res) => {
+				clearTimeout(timer);
+				resolve(res);
+			}, (err) => {
+				clearTimeout(timer);
+				reject(err);
+			});
+		});
+	}
 	_setupWatch() {
 		if (!this._watchTimer && this._watchTime) process.nextTick(() => this._pendingWatcher());
 	}
+	/**
+	* A failed queue never runs queued items. Report each one as a failed item
+	* with the queue's error, so callers waiting on a `failItem` don't hang.
+	*/
+	_failQueued() {
+		const queued = this._itemQ;
+		this._itemQ = [];
+		for (const wrapped of queued) if (!wrapped._control) this._emit("failItem", {
+			id: this._id++,
+			error: this._failError,
+			...wrapped
+		});
+		return 0;
+	}
 	_process() {
 		if (this._startTime === void 0) this._startTime = Date.now();
+		if (this._failed) return this._failQueued();
 		if (this._processing || this._pause || this._itemQ.length === 0) return 0;
 		this._processing = true;
 		let count = 0;
 		let i = this._pending.count;
 		for (; this._itemQ.length > 0 && i < this._concurrency; i++) {
 			const wrapped = this._itemQ.shift();
-			if (wrapped._control === PAUSE_ITEM) {
+			if (wrapped._control === PAUSE_ITEM || wrapped._control === PAUSE_CALL) {
 				this._pause = true;
 				if (this._pending.isEmpty) process.nextTick(() => {
 					this._handleQueueItemDone({
 						id: 0,
 						item: void 0,
 						_control: NOOP_ITEM
-					});
+					}, false);
 				});
 				break;
 			}
@@ -26989,12 +27111,16 @@ var ItemQueue = class ItemQueue extends EventEmitter$1 {
 			const id = this._id++;
 			let promise;
 			if (wrapped._control === RESUME_ITEM) promise = this.Promise.resolve({});
-			else try {
-				const res = this._processItem(wrapped.item, id);
-				if (res && res.then) promise = res;
-				else promise = this.Promise.resolve(res);
-			} catch (err) {
-				promise = this.Promise.reject(err);
+			else {
+				const abort = this._timeout ? new AbortController() : void 0;
+				try {
+					const res = this._processItem(wrapped.item, id, abort === null || abort === void 0 ? void 0 : abort.signal);
+					if (res && res.then) promise = res;
+					else promise = this.Promise.resolve(res);
+				} catch (err) {
+					promise = this.Promise.reject(err);
+				}
+				if (abort) promise = this._withTimeout(promise, abort);
 			}
 			this._pending.add(id, {
 				item: wrapped.item,
@@ -27002,12 +27128,12 @@ var ItemQueue = class ItemQueue extends EventEmitter$1 {
 					id,
 					res,
 					...wrapped
-				}), (error) => {
+				}, false), (error) => {
 					this._handleQueueItemDone({
 						id,
 						error,
 						...wrapped
-					});
+					}, true);
 				})
 			});
 		}
@@ -27192,7 +27318,7 @@ function makeExtrasData(file, fullFile, path, stat, files, options) {
 * @param extras
 */
 function addResult(result, options, extras) {
-	const group = (options.grouping && typeof result === "string" ? result : result && result.group) || "files";
+	const group = options.grouping && (typeof result === "string" ? result : result.group) || "files";
 	if (!options.result[group]) options.result[group] = [];
 	if (result.formatName !== void 0) options.result[group].push(result.formatName);
 	else options.result[group].push(options.prependCwd ? extras.fullFile : extras.dirFile);
@@ -27234,10 +27360,10 @@ function processFile(options, extras) {
 	}
 	return false;
 }
-function acceptEntry(options, entry, path, gitignore) {
+function acceptEntry(options, entry, path, gitignore, fsPath) {
 	const isDirectory = entry.isDirectory();
 	if (isDirectory && options._ignoreDirs.has(entry.name)) return false;
-	if (gitignore === null || gitignore === void 0 ? void 0 : gitignore.ignores(Path.resolve(options.dir, path, entry.name), isDirectory)) return false;
+	if (gitignore === null || gitignore === void 0 ? void 0 : gitignore.ignores(Path.resolve(options.dir, fsPath, entry.name), isDirectory)) return false;
 	if (options.prefilter && !options.prefilter(entry.name, path, entry)) return false;
 	if (isDirectory) return true;
 	if (options.ignoreExt.length || options.filterExt.length) {
@@ -27280,7 +27406,7 @@ function releaseDirectory(options) {
 * @param level
 * @returns
 */
-async function walk(path, options, level = 0, parentRules) {
+async function walk(path, options, level = 0, parentRules, fsPath = path) {
 	let promises = [];
 	let hasSlot = false;
 	try {
@@ -27290,7 +27416,9 @@ async function walk(path, options, level = 0, parentRules) {
 			hasSlot = true;
 		}
 		if (options._stopped) return void 0;
-		const dir = Path.join(options.dir, path);
+		const dir = Path.join(options.dir, fsPath);
+		const posixSep = options._sep === "/";
+		const outDir = posixSep ? dir : join2(options._sep, options._outCwd, path);
 		const gitignore = options.gitignore ? await GitignoreRules.load(Path.resolve(dir), options.gitignore, parentRules) : void 0;
 		let files = await asyncReaddir(dir, options.readdirOpts);
 		if (options.sortFiles) {
@@ -27301,16 +27429,16 @@ async function walk(path, options, level = 0, parentRules) {
 		const extrasFiles = options.fullStat && options._earlyFilter && (options.filter || options.filterDir) ? files.map((entry) => entry.name) : files;
 		for (let ix = 0; !options._stopped && ix < files.length; ix++) {
 			const file = files[ix];
-			if (options._earlyFilter && !acceptEntry(options, file, path, gitignore)) continue;
+			if (options._earlyFilter && !acceptEntry(options, file, path, gitignore, fsPath)) continue;
 			let extras;
 			if (options.fullStat) {
 				const name = options._earlyFilter ? file.name : file;
-				const fullFile = join2(options._sep, dir, name);
-				const stat = await asyncLStat(fullFile);
+				const fullFile = join2(options._sep, outDir, name);
+				const stat = await asyncLStat(posixSep ? fullFile : join2("/", dir, name));
 				if (options._stopped) break;
 				extras = makeExtrasData(name, fullFile, path, stat, extrasFiles, options);
 			} else {
-				const fullFile = join2(options._sep, dir, file.name);
+				const fullFile = join2(options._sep, outDir, file.name);
 				extras = makeExtrasData(file.name, fullFile, path, file, files, options);
 			}
 			if (extras.stat.isDirectory()) dirs.push(extras);
@@ -27328,7 +27456,8 @@ async function walk(path, options, level = 0, parentRules) {
 				break;
 			}
 			if (!flags.skip && level < options.maxLevel) {
-				const walkP = walk(extras.dirFile, options, level + 1, gitignore);
+				const childFsPath = posixSep ? extras.dirFile : join2("/", fsPath, extras.file);
+				const walkP = walk(extras.dirFile, options, level + 1, gitignore, childFsPath);
 				if (options.concurrency > 1) {
 					promises.push(walkP);
 					if (promises.length >= options.concurrency) {
@@ -27357,8 +27486,15 @@ async function walk(path, options, level = 0, parentRules) {
 * @returns
 */
 function makeOptions(opts) {
-	const options = typeof opts === "string" ? { cwd: opts } : opts;
+	const input = typeof opts === "string" ? { cwd: opts } : opts;
+	const options = {};
+	for (const key of Object.keys(input)) if (input[key] !== void 0) options[key] = input[key];
 	if (options.prefilter && options.fullStat === false) throw new TypeError("prefilter requires fullStat: true");
+	for (const name of [
+		"filter",
+		"filterDir",
+		"prefilter"
+	]) if (Object.prototype.toString.call(options[name]) === "[object AsyncFunction]") throw new TypeError(`${name} must return a result synchronously, not a promise`);
 	const sep = options.pathSep || Path.posix.sep;
 	let cwd = options.cwd || options.dir || process.cwd();
 	if (!options.hasOwnProperty("pathSep") && cwd.includes("\\")) cwd = cwd.replace(/\\/g, "/");
@@ -27380,6 +27516,7 @@ function makeOptions(opts) {
 		grouping: void 0
 	}, options, {
 		dir: cwd,
+		_outCwd: Path.join(cwd),
 		fullStat: options.fullStat === void 0 ? true : options.fullStat,
 		result: Object.create(null),
 		ignoreExt: [].concat(options.ignoreExt).map(cleanExt).filter((x) => x),
@@ -27469,6 +27606,8 @@ const commaPattern = /\\,/g;
 const periodPattern = /\\\./g;
 const EXPANSION_MAX = 1e5;
 const EXPANSION_MAX_LENGTH = 4e6;
+const EXPANSION_MAX_DEPTH = 1e3;
+const EXPANSION_MAX_REWRITES = 1e3;
 function numeric(str) {
 	return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0);
 }
@@ -27478,32 +27617,43 @@ function escapeBraces(str) {
 function unescapeBraces(str) {
 	return str.replace(escSlashPattern, "\\").replace(escOpenPattern, "{").replace(escClosePattern, "}").replace(escCommaPattern, ",").replace(escPeriodPattern, ".");
 }
+function pushAll(target, items) {
+	for (let i = 0; i < items.length; i++) target.push(items[i]);
+}
 /**
 * Basically just str.split(","), but handling cases
 * where we have nested braced sections, which should be
 * treated as individual members, like {a,{b,c},d}
 */
 function parseCommaParts(str) {
-	if (!str) return [""];
 	const parts = [];
-	const m = balanced("{", "}", str);
-	if (!m) return str.split(",");
-	const { pre, body, post } = m;
-	const p = pre.split(",");
-	p[p.length - 1] += "{" + body + "}";
-	const postParts = parseCommaParts(post);
-	if (post.length) {
-		p[p.length - 1] += postParts.shift();
-		p.push.apply(p, postParts);
-	}
-	parts.push.apply(parts, p);
-	return parts;
+	let carry = "";
+	for (;;) {
+		const m = balanced("{", "}", str);
+		if (!m) {
+			const tail = str.split(",");
+			tail[0] = carry + tail[0];
+			pushAll(parts, tail);
+			return parts;
+		}
+		const { pre, body, post } = m;
+		const p = pre.split(",");
+		p[0] = carry + p[0];
+		p[p.length - 1] += "{" + body + "}";
+		if (!post.length) {
+			pushAll(parts, p);
+			return parts;
+		}
+		carry = p.pop();
+		pushAll(parts, p);
+		str = post;
+	}
 }
 function expand(str, options = {}) {
 	if (!str) return [];
-	const { max = EXPANSION_MAX, maxLength = EXPANSION_MAX_LENGTH } = options;
+	const { max = EXPANSION_MAX, maxLength = EXPANSION_MAX_LENGTH, maxDepth = EXPANSION_MAX_DEPTH, maxRewrites = EXPANSION_MAX_REWRITES } = options;
 	if (str.slice(0, 2) === "{}") str = "\\{\\}" + str.slice(2);
-	return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces);
+	return expand_(escapeBraces(str), max, maxLength, maxDepth, 0, maxRewrites, true).map(unescapeBraces);
 }
 function embrace(str) {
 	return "{" + str + "}";
@@ -27569,8 +27719,10 @@ function expandSequence(body, isAlphaSequence, max, maxLength) {
 	}
 	return N;
 }
-function expand_(str, max, maxLength, isTop) {
+function expand_(str, max, maxLength, maxDepth, depth, maxRewrites, isTop) {
+	if (depth > maxDepth) return [str];
 	let acc = [""];
+	let rewrites = 0;
 	let dropEmpties = false;
 	let firstGroup = true;
 	for (;;) {
@@ -27589,7 +27741,8 @@ function expand_(str, max, maxLength, isTop) {
 		const isSequence = isNumericSequence || isAlphaSequence;
 		const isOptions = m.body.indexOf(",") >= 0;
 		if (!isSequence && !isOptions) {
-			if (m.post.match(/,(?!,).*\}/)) {
+			if (rewrites < maxRewrites && m.post.match(/,(?!,).*\}/)) {
+				rewrites++;
 				str = m.pre + "{" + m.body + escClose + m.post;
 				isTop = true;
 				continue;
@@ -27605,7 +27758,7 @@ function expand_(str, max, maxLength, isTop) {
 		else {
 			let n = parseCommaParts(m.body);
 			if (n.length === 1 && n[0] !== void 0) {
-				n = expand_(n[0], max, maxLength, false).map(embrace);
+				n = expand_(n[0], max, maxLength, maxDepth, depth + 1, maxRewrites, false).map(embrace);
 				/* c8 ignore start */
 				if (n.length === 1) {
 					acc = combine(acc, pre + n[0], [""], max, maxLength, dropEmpties && !m.post.length);
@@ -27619,7 +27772,7 @@ function expand_(str, max, maxLength, isTop) {
 			values = [];
 			let valuesLength = 0;
 			outer: for (let j = 0; j < n.length; j++) {
-				const expanded = expand_(n[j], max, maxLength, false);
+				const expanded = expand_(n[j], max, maxLength, maxDepth, depth + 1, maxRewrites, false);
 				for (let k = 0; k < expanded.length; k++) {
 					const v = expanded[k];
 					if (dropsEmpties && !v) continue;
@@ -29724,14 +29877,14 @@ var PackageRef = class {
 	* @param ref package string reference
 	*/
 	parseRef(ref) {
-		const parts = ref.split(":");
-		if (parts.length > 1) {
-			const tmp = parts[0].trim();
+		const colonIx = ref.indexOf(":");
+		if (colonIx >= 0) {
+			const tmp = ref.substring(0, colonIx).trim();
 			if (tmp === "id" || tmp === "path" || tmp === "name") this.type = tmp;
 			else throw new Error(`package ref '${ref}' has unknown type '${tmp}' - must be 'id', 'path', or 'name'`);
-			this.value = parts[1].trim();
+			this.value = ref.substring(colonIx + 1).trim();
 		} else {
-			this.value = parts[0].trim();
+			this.value = ref.trim();
 			if (this.value.lastIndexOf("@") > 0) this.type = "id";
 			else this.type = "name";
 		}
@@ -29745,6 +29898,7 @@ var PackageRef = class {
 		} else if (this.type === "path") this.mm = new Minimatch(this.value);
 	}
 	match(pkgInfo) {
+		if (this.regex) this.regex.lastIndex = 0;
 		if (this.type === "path") return this.regex ? this.regex.exec(pkgInfo.path) !== null : this.mm.match(pkgInfo.path);
 		else if (this.type === "id") return this.regex ? this.regex.exec(pkgInfoId(pkgInfo)) !== null : this.value === pkgInfoId(pkgInfo);
 		else return this.regex ? this.regex.exec(pkgInfo.name) !== null : this.value === pkgInfo.name;
@@ -29776,6 +29930,24 @@ function resolvePackage(semver, packages, fallbackToFirst = true) {
 	if (fallbackToFirst) return packages[0];
 }
 /**
+* Widen a local dep's semver per `localDepAutoSemver`, same as fyn's getAutoSemver.
+*
+* @param semver semver string
+* @param autoSemver the `localDepAutoSemver` setting
+* @returns the semver to match local versions with
+*/
+function localAutoSemver(semver, autoSemver) {
+	if (autoSemver) {
+		const parsedSv = import_semver.default.coerce(semver);
+		if (parsedSv && parsedSv.raw) switch (autoSemver) {
+			case "patch": return `~${parsedSv.raw}`;
+			case "minor": return `^${parsedSv.raw}`;
+			case "major": return "*";
+		}
+	}
+	return semver;
+}
+/**
 * Make a package ID from basic info by joining name and version into a single string.
 *
 * @param info package basic info
@@ -29949,6 +30121,7 @@ var FynpoDepGraph = class {
 			});
 			files.push(scanned);
 		}
+		this.packages.byName = Object.create(null);
 		const filesByDepth = [...[].concat(...files)].sort((a, b) => {
 			const depth = (file) => posixify$2(Path.dirname(file)).split("/").length;
 			return depth(a) - depth(b) || a.localeCompare(b);
@@ -30115,16 +30288,17 @@ var FynpoDepGraph = class {
 				if (this.checkNoFynLocal(pkgInfo, name)) continue;
 				const semId = pkgId$1(name, semver);
 				const resolveId = this.resolvedCache[semId];
-				const depPkg = resolveId && byId[resolveId] || resolvePackage(semver, byName[name]);
-				if (!resolveId) this.resolvedCache[semId] = pkgInfoId(depPkg);
-				this.addDep(pkgInfo, depPkg, section);
+				if (resolveId === "") continue;
+				let depPkg = resolveId ? byId[resolveId] : void 0;
+				if (!depPkg) {
+					const localSemver = localAutoSemver(semver, this._options.localDepAutoSemver);
+					depPkg = resolvePackage(localSemver, byName[name], !import_semver.default.validRange(localSemver));
+					this.resolvedCache[semId] = depPkg ? pkgInfoId(depPkg) : "";
+				}
+				if (depPkg) this.addDep(pkgInfo, depPkg, section);
 			}
 		};
-		for (const path in byPath) if (!depMapByPath[path]) depMapByPath[path] = {
-			pkgInfo: byPath[path],
-			localDepsByPath: Object.create(null),
-			dependentsByPath: Object.create(null)
-		};
+		for (const path in byPath) this.getDepData(byPath[path]);
 		for (const path in byPath) {
 			const pkgInfo = byPath[path];
 			const depData = depMapByPath[pkgInfo.path];
@@ -30134,6 +30308,21 @@ var FynpoDepGraph = class {
 		}
 	}
 	/**
+	* Get the dep data of a package, creating an empty one if it doesn't exist yet
+	*
+	* @param pkgInfo package info
+	* @returns dep data
+	*/
+	getDepData(pkgInfo) {
+		let depData = this.depMapByPath[pkgInfo.path];
+		if (!depData) depData = this.depMapByPath[pkgInfo.path] = {
+			pkgInfo,
+			localDepsByPath: Object.create(null),
+			dependentsByPath: Object.create(null)
+		};
+		return depData;
+	}
+	/**
 	* Add a dependency relation by package paths
 	*
 	* @param from - path of package depend from
@@ -30198,8 +30387,8 @@ var FynpoDepGraph = class {
 	*/
 	addDep(pkgInfo, depPkg, depSection, indirectSteps) {
 		if (pkgInfo.path === depPkg.path) return false;
-		const dataPkg = this.depMapByPath[pkgInfo.path];
-		const dataDep = this.depMapByPath[depPkg.path];
+		const dataPkg = this.getDepData(pkgInfo);
+		const dataDep = this.getDepData(depPkg);
 		if (dataPkg.localDepsByPath[depPkg.path]) return false;
 		dataPkg.localDepsByPath[depPkg.path] = {
 			name: depPkg.name,
@@ -30367,7 +30556,7 @@ let defaultLog$1 = consoleLog;
 const ERR_MODULE_NOT_FOUND = "ERR_MODULE_NOT_FOUND";
 const ERR_PACKAGE_PATH_NOT_EXPORTED = "ERR_PACKAGE_PATH_NOT_EXPORTED";
 function normalizeOpts(optsOrMsg) {
-	if (optsOrMsg === void 0) return {};
+	if (optsOrMsg == null) return {};
 	if (optsOrMsg === true || typeof optsOrMsg === "string") return { message: optsOrMsg };
 	return optsOrMsg;
 }
@@ -30852,7 +31041,8 @@ const fyntil = {
 			const graph = new FynpoDepGraph({
 				cwd: fcm.topDir,
 				packages: config.packages,
-				noFynLocal: config.noFynLocal
+				noFynLocal: config.noFynLocal,
+				localDepAutoSemver: config.localDepAutoSemver
 			});
 			await graph.resolve();
 			return fyntil.fynpoConfig = {
@@ -30942,14 +31132,15 @@ const fyntil = {
 		if (!Path.isAbsolute(rel) && !rel.startsWith(".")) return `.${Path.sep}${rel}`;
 		return shouldPosixify ? posixify$2(rel) : rel;
 	},
-	async readPkgJson(dirOrFile, keepRaw = false, packageFyn = false) {
+	/** @param pkgJsonStr - package.json's content, when the caller has it already */
+	async readPkgJson(dirOrFile, keepRaw = false, packageFyn = false, pkgJsonStr) {
 		const dir = !dirOrFile.endsWith(".json") ? dirOrFile : Path.dirname(dirOrFile);
 		const files = ["package.json", packageFyn && "package-fyn.json"].filter(Boolean);
 		const finalJson = {};
 		for (const fname of files) {
 			const file = Path.join(dir, fname);
 			try {
-				const str = await file_ops_default.readFile(file, "utf8");
+				const str = fname === "package.json" && pkgJsonStr !== void 0 ? pkgJsonStr : await file_ops_default.readFile(file, "utf8");
 				const json = JSON.parse(str.trim());
 				merge(finalJson, json);
 				if (keepRaw && fname !== "package-fyn.json") finalJson[PACKAGE_RAW_INFO] = {
@@ -35966,15 +36157,114 @@ var To = (s) => {
 	s.mtimeCache || (s.mtimeCache = /* @__PURE__ */ new Map()), s.filter = t ? (e, i) => t(e, i) && !((s.mtimeCache?.get(e) ?? i.mtime ?? 0) > (i.mtime ?? 0)) : (e, i) => !((s.mtimeCache?.get(e) ?? i.mtime ?? 0) > (i.mtime ?? 0));
 };
 
+//#endregion
+//#region lib/util/fs-worker-pool.ts
+/** One worker less than the CPUs, for the main thread, and at most 8 */
+const POOL_SIZE = Math.max(1, Math.min(8, os.availableParallelism() - 1));
+/**
+* A downloaded Buffer is often a view into a much bigger ArrayBuffer, and postMessage copies the
+* whole ArrayBuffer. So the message gets a copy of just the view, transferred. The caller's
+* Buffer stays usable.
+*/
+function postJob(worker, id, { op, job }) {
+	const { data } = job;
+	if (!data) {
+		worker.postMessage({
+			id,
+			op,
+			job
+		});
+		return;
+	}
+	const copy = new Uint8Array(data.byteLength);
+	copy.set(data);
+	worker.postMessage({
+		id,
+		op,
+		job: {
+			...job,
+			data: copy
+		}
+	}, [copy.buffer]);
+}
+var FsWorkerPool = class {
+	_file;
+	_workers = [];
+	_queue = [];
+	_nextId = 0;
+	constructor(file) {
+		this._file = file;
+	}
+	run(op, job) {
+		return new Promise((resolve, reject) => {
+			this._queue.push({
+				job: {
+					op,
+					job
+				},
+				resolve,
+				reject
+			});
+			this._dispatch();
+		});
+	}
+	_dispatch() {
+		while (this._queue.length > 0) {
+			let pw = this._workers.find((w) => !w.busy);
+			if (!pw) {
+				if (this._workers.length >= POOL_SIZE) return;
+				pw = this._start();
+			}
+			const pending = this._queue.shift();
+			pw.busy = pending;
+			pw.worker.ref();
+			postJob(pw.worker, this._nextId++, pending.job);
+		}
+	}
+	_start() {
+		const pw = { worker: new Worker(this._file) };
+		pw.worker.on("message", (msg) => {
+			const pending = pw.busy;
+			pw.busy = void 0;
+			pw.worker.unref();
+			if (msg.error) pending.reject(Object.assign(new Error(msg.error.message), msg.error));
+			else pending.resolve(msg.result);
+			this._dispatch();
+		});
+		pw.worker.on("error", (err) => {
+			this._workers = this._workers.filter((w) => w !== pw);
+			pw.busy?.reject(err);
+			pw.busy = void 0;
+			this._dispatch();
+		});
+		this._workers.push(pw);
+		return pw;
+	}
+};
+let pool;
+/**
+* The pool, or undefined when there's no built worker next to this module, which is the case
+* when running from source. Callers then do the work in-thread.
+*/
+function getFsWorkerPool() {
+	if (pool === void 0) {
+		const file = fileURLToPath(new URL("./fs-worker.mjs", import.meta.url));
+		pool = Br.existsSync(file) && new FsWorkerPool(file);
+		logger$1.debug(pool ? `fs workers: up to ${POOL_SIZE} from ${file}` : "fs workers: none built, working in-thread");
+	}
+	return pool || void 0;
+}
+
 //#endregion
 //#region lib/pkg-dist-extractor.ts
 const { retry, missPipe: missPipe$2 } = fyntil;
+const isStoreJob = (result) => typeof result?.store === "function";
 var PkgDistExtractor = class {
 	_promiseQ;
 	_fyn;
 	constructor(options) {
 		this._promiseQ = new promise_queue_default({
-			concurrency: 4,
+			concurrency: options.fyn.extractConcurrency || Math.min(4, POOL_SIZE + 1),
 			stopOnError: true,
 			processItem: (x, id) => this.processItem(x, id)
 		});
@@ -36024,6 +36314,7 @@ var PkgDistExtractor = class {
 		const { pkg } = data;
 		const promotedOpt = defaults$1({ promoted }, pick(pkg, "promoted"));
 		const fullOutDir = this._fyn.getInstalledPkgDir(pkg.name, pkg.version, promotedOpt);
+		let placed;
 		if (pkg.extracted && pkg.extracted === fullOutDir) {
 			logger$1.debug(`package ${pkg.name} ${pkg.version} has already been extracted to ${pkg.extracted}`);
 			if (this._fyn.isNormalLayout && pkg.promoted && !promotedOpt.promoted) await this.movePromotedPkgFromFV(pkg, fullOutDir);
@@ -36036,18 +36327,24 @@ var PkgDistExtractor = class {
 				}
 				return json;
 			}
-			await this._fyn.createPkgOutDir(fullOutDir);
-			const result = data.result;
+			const job = data.result;
+			if (isStoreJob(job) && !await job.store(!data.listener && !data.deferred)) {
+				data.deferred = true;
+				this._promiseQ.addItem(data);
+				return;
+			}
+			const result = isStoreJob(job) ? job.integrity : job;
 			let act;
 			let retrieve;
 			if (typeof result === "string") {
 				act = "hardlink";
-				retrieve = () => {
-					return this._fyn.central.replicate(result, fullOutDir);
+				retrieve = async () => {
+					placed = await this._fyn.central.replicate(result, fullOutDir, () => this._fyn.createPkgOutDir(fullOutDir));
 				};
 			} else {
 				act = "extract";
-				retrieve = () => {
+				retrieve = async () => {
+					await this._fyn.createPkgOutDir(fullOutDir);
 					const untarStream = So({
 						strip: 1,
 						strict: true,
@@ -36063,7 +36360,7 @@ var PkgDistExtractor = class {
 			logger$1.updateItem(LOAD_PACKAGE, `${act}ed ${msg}`);
 		}
 		let retries = 0;
-		return retry(() => this._fyn.loadJsonForPkg(pkg, fullOutDir), () => {
+		return retry(() => this._fyn.loadJsonForPkg(pkg, fullOutDir, placed), () => {
 			retries++;
 			logger$1.warn(`retrying ${retries} reading package.json`, fullOutDir);
 			return true;
@@ -38464,7 +38761,7 @@ var require_commonjs$8 = /* @__PURE__ */ __commonJSMin(((exports) => {
 //#region node_modules/brace-expansion/dist/commonjs/index.js
 var require_commonjs$7 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
-	exports.EXPANSION_MAX_LENGTH = exports.EXPANSION_MAX = void 0;
+	exports.EXPANSION_MAX_REWRITES = exports.EXPANSION_MAX_DEPTH = exports.EXPANSION_MAX_LENGTH = exports.EXPANSION_MAX = void 0;
 	exports.expand = expand;
 	const balanced_match_1 = require_commonjs$8();
 	const escSlash = "\0SLASH" + Math.random() + "\0";
@@ -38484,6 +38781,8 @@ var require_commonjs$7 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	const periodPattern = /\\\./g;
 	exports.EXPANSION_MAX = 1e5;
 	exports.EXPANSION_MAX_LENGTH = 4e6;
+	exports.EXPANSION_MAX_DEPTH = 1e3;
+	exports.EXPANSION_MAX_REWRITES = 1e3;
 	function numeric(str) {
 		return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0);
 	}
@@ -38493,32 +38792,43 @@ var require_commonjs$7 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	function unescapeBraces(str) {
 		return str.replace(escSlashPattern, "\\").replace(escOpenPattern, "{").replace(escClosePattern, "}").replace(escCommaPattern, ",").replace(escPeriodPattern, ".");
 	}
+	function pushAll(target, items) {
+		for (let i = 0; i < items.length; i++) target.push(items[i]);
+	}
 	/**
 	* Basically just str.split(","), but handling cases
 	* where we have nested braced sections, which should be
 	* treated as individual members, like {a,{b,c},d}
 	*/
 	function parseCommaParts(str) {
-		if (!str) return [""];
 		const parts = [];
-		const m = (0, balanced_match_1.balanced)("{", "}", str);
-		if (!m) return str.split(",");
-		const { pre, body, post } = m;
-		const p = pre.split(",");
-		p[p.length - 1] += "{" + body + "}";
-		const postParts = parseCommaParts(post);
-		if (post.length) {
-			p[p.length - 1] += postParts.shift();
-			p.push.apply(p, postParts);
+		let carry = "";
+		for (;;) {
+			const m = (0, balanced_match_1.balanced)("{", "}", str);
+			if (!m) {
+				const tail = str.split(",");
+				tail[0] = carry + tail[0];
+				pushAll(parts, tail);
+				return parts;
+			}
+			const { pre, body, post } = m;
+			const p = pre.split(",");
+			p[0] = carry + p[0];
+			p[p.length - 1] += "{" + body + "}";
+			if (!post.length) {
+				pushAll(parts, p);
+				return parts;
+			}
+			carry = p.pop();
+			pushAll(parts, p);
+			str = post;
 		}
-		parts.push.apply(parts, p);
-		return parts;
 	}
 	function expand(str, options = {}) {
 		if (!str) return [];
-		const { max = exports.EXPANSION_MAX, maxLength = exports.EXPANSION_MAX_LENGTH } = options;
+		const { max = exports.EXPANSION_MAX, maxLength = exports.EXPANSION_MAX_LENGTH, maxDepth = exports.EXPANSION_MAX_DEPTH, maxRewrites = exports.EXPANSION_MAX_REWRITES } = options;
 		if (str.slice(0, 2) === "{}") str = "\\{\\}" + str.slice(2);
-		return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces);
+		return expand_(escapeBraces(str), max, maxLength, maxDepth, 0, maxRewrites, true).map(unescapeBraces);
 	}
 	function embrace(str) {
 		return "{" + str + "}";
@@ -38584,8 +38894,10 @@ var require_commonjs$7 = /* @__PURE__ */ __commonJSMin(((exports) => {
 		}
 		return N;
 	}
-	function expand_(str, max, maxLength, isTop) {
+	function expand_(str, max, maxLength, maxDepth, depth, maxRewrites, isTop) {
+		if (depth > maxDepth) return [str];
 		let acc = [""];
+		let rewrites = 0;
 		let dropEmpties = false;
 		let firstGroup = true;
 		for (;;) {
@@ -38604,7 +38916,8 @@ var require_commonjs$7 = /* @__PURE__ */ __commonJSMin(((exports) => {
 			const isSequence = isNumericSequence || isAlphaSequence;
 			const isOptions = m.body.indexOf(",") >= 0;
 			if (!isSequence && !isOptions) {
-				if (m.post.match(/,(?!,).*\}/)) {
+				if (rewrites < maxRewrites && m.post.match(/,(?!,).*\}/)) {
+					rewrites++;
 					str = m.pre + "{" + m.body + escClose + m.post;
 					isTop = true;
 					continue;
@@ -38620,7 +38933,7 @@ var require_commonjs$7 = /* @__PURE__ */ __commonJSMin(((exports) => {
 			else {
 				let n = parseCommaParts(m.body);
 				if (n.length === 1 && n[0] !== void 0) {
-					n = expand_(n[0], max, maxLength, false).map(embrace);
+					n = expand_(n[0], max, maxLength, maxDepth, depth + 1, maxRewrites, false).map(embrace);
 					/* c8 ignore start */
 					if (n.length === 1) {
 						acc = combine(acc, pre + n[0], [""], max, maxLength, dropEmpties && !m.post.length);
@@ -38634,7 +38947,7 @@ var require_commonjs$7 = /* @__PURE__ */ __commonJSMin(((exports) => {
 				values = [];
 				let valuesLength = 0;
 				outer: for (let j = 0; j < n.length; j++) {
-					const expanded = expand_(n[j], max, maxLength, false);
+					const expanded = expand_(n[j], max, maxLength, maxDepth, depth + 1, maxRewrites, false);
 					for (let k = 0; k < expanded.length; k++) {
 						const v = expanded[k];
 						if (dropsEmpties && !v) continue;
@@ -45425,7 +45738,7 @@ var require_normalize_data = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 }));
 
 //#endregion
-//#region node_modules/.f/_/isexe/4.0.0/node_modules/isexe/dist/commonjs/index.min.js
+//#region node_modules/isexe/dist/commonjs/index.min.js
 var require_index_min$1 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	var a = (t, e) => () => (e || t((e = { exports: {} }).exports, e), e.exports);
 	var _ = a((i) => {
@@ -50375,12 +50688,18 @@ var require_cache_dir$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 # This file is a cache directory tag created by cacache.
 # For information about cache directory tags, see https://bford.info/cachedir/
 `;
-	async function mkdir(cache) {
-		await fs$15.mkdir(cache, {
-			recursive: true,
-			owner: "inherit"
-		});
-		await writeTag(cache);
+	const made = /* @__PURE__ */ new Map();
+	function mkdir(cache) {
+		let p = made.get(cache);
+		if (!p) {
+			p = fs$15.mkdir(cache, {
+				recursive: true,
+				owner: "inherit"
+			}).then(() => writeTag(cache));
+			made.set(cache, p);
+			p.catch(() => made.delete(cache));
+		}
+		return p;
 	}
 	async function writeTag(cache) {
 		try {
@@ -58967,11 +59286,14 @@ var require_http_cache_semantics = /* @__PURE__ */ __commonJSMin(((exports, modu
 		}
 		/**
 		* @param {{headers: Record<string, string>, synchronous: boolean}|undefined} revalidation - Revalidation information, if any.
-		* @returns {{response: {headers: Record<string, string>}, revalidation: {headers: Record<string, string>, synchronous: boolean}|undefined}} An object with a cached response headers and revalidation info.
+		* @returns {{response: HttpResponse, revalidation: {headers: Record<string, string>, synchronous: boolean}|undefined}} An object with a cached response headers and revalidation info.
 		*/
 		_evaluateRequestHitResult(revalidation) {
 			return {
-				response: { headers: this.responseHeaders() },
+				response: {
+					headers: this.responseHeaders(),
+					status: this._status
+				},
 				revalidation
 			};
 		}
@@ -59015,9 +59337,9 @@ var require_http_cache_semantics = /* @__PURE__ */ __commonJSMin(((exports, modu
 		* }
 		* ```
 		* @param {HttpRequest} req - new incoming HTTP request
-		* @returns {{response: {headers: Record<string, string>}|undefined, revalidation: {headers: Record<string, string>, synchronous: boolean}|undefined}} An object containing keys:
+		* @returns {{response: HttpResponse|undefined, revalidation: {headers: Record<string, string>, synchronous: boolean}|undefined}} An object containing keys:
 		*   - revalidation: { headers: Record<string, string>, synchronous: boolean } Set if you should send this to the origin server
-		*   - response: { headers: Record<string, string> } Set if you can respond to the client with these cached headers
+		*   - response: HttpResponse Set if you can respond to the client with these cached headers
 		*/
 		evaluateRequest(req) {
 			this._assertRequestHasHeaders(req);
@@ -59056,9 +59378,11 @@ var require_http_cache_semantics = /* @__PURE__ */ __commonJSMin(((exports, modu
 		*/
 		_varyMatches(req) {
 			if (!this._resHeaders.vary) return true;
-			if (this._resHeaders.vary === "*") return false;
 			const fields = this._resHeaders.vary.trim().toLowerCase().split(/\s*,\s*/);
-			for (const name of fields) if (req.headers[name] !== this._reqHeaders[name]) return false;
+			for (const name of fields) {
+				if (name === "*") return false;
+				if ((Object.prototype.hasOwnProperty.call(req.headers, name) && req.headers[name]) !== (Object.prototype.hasOwnProperty.call(this._reqHeaders, name) && this._reqHeaders[name])) return false;
+			}
 			return true;
 		}
 		/**
@@ -59100,6 +59424,13 @@ var require_http_cache_semantics = /* @__PURE__ */ __commonJSMin(((exports, modu
 			return headers;
 		}
 		/**
+		* Returns the status code of the cached response.
+		* @returns {number} The response status code.
+		*/
+		status() {
+			return this._status;
+		}
+		/**
 		* Returns the Date header value from the response or the current time if invalid.
 		* @returns {number} Timestamp (in milliseconds) representing the Date header or response time.
 		*/
@@ -62205,8 +62536,14 @@ var require_common = /* @__PURE__ */ __commonJSMin(((exports) => {
 	* {@link isInSubnet} when classifying a single address — notably when the
 	* address came from untrusted input and the result backs a trust-boundary
 	* decision such as an SSRF allow/deny filter.
+	*
+	* An address of one family is never inside a network of the other, so an
+	* `Address4` against an `Address6` (or the reverse) is `false`. To compare
+	* across families, convert first: `Address6.fromAddress4()`, `to4()`, or
+	* `toAddress4Nat64()`.
 	*/
 	function isHostInSubnet(address) {
+		if (this.binaryZeroPad().length !== address.binaryZeroPad().length) return false;
 		return this.mask(address.subnetMask) === address.mask();
 	}
 	/**
@@ -62493,7 +62830,9 @@ var require_ipv4 = /* @__PURE__ */ __commonJSMin(((exports) => {
 			*/
 			this.isCorrect = isCorrect4;
 			/**
-			* Returns true if the given address is in the subnet of the current address
+			* Returns true if the given address is in the subnet of the current address.
+			* An `Address6` is never in the subnet of an `Address4`; convert with
+			* `to4()` or `Address6.fromAddress4()` to compare across families.
 			* @returns {boolean}
 			*/
 			this.isInSubnet = common.isInSubnet;
@@ -62503,6 +62842,8 @@ var require_ipv4 = /* @__PURE__ */ __commonJSMin(((exports) => {
 			* when classifying a single address, so the answer doesn't change with the
 			* CIDR suffix the caller happened to write — notably when the address came
 			* from untrusted input and the result backs a trust-boundary decision.
+			* An `Address6` is never in the subnet of an `Address4`; convert with
+			* `to4()` or `Address6.fromAddress4()` to compare across families.
 			* @returns {boolean}
 			*/
 			this.isHostInSubnet = common.isHostInSubnet;
@@ -62515,6 +62856,8 @@ var require_ipv4 = /* @__PURE__ */ __commonJSMin(((exports) => {
 				if (this.subnetMask < 0 || this.subnetMask > constants.BITS) throw new address_error_1.AddressError("Invalid subnet mask.");
 				address = address.replace(constants.RE_SUBNET_STRING, "");
 			}
+			const longest = constants.GROUPS * 4 - 1;
+			if (address.length > longest) throw new address_error_1.AddressError(`IPv4 addresses are at most ${longest} characters.`);
 			this.addressMinusSuffix = address;
 			this.parsedAddress = this.parse(address);
 		}
@@ -62631,15 +62974,20 @@ var require_ipv4 = /* @__PURE__ */ __commonJSMin(((exports) => {
 			return Address4.fromHex(integer.toString(16).padStart(8, "0"));
 		}
 		/**
-		* Return an address from in-addr.arpa form
+		* Return an address from in-addr.arpa form: the four octets reversed, with
+		* or without the `.in-addr.arpa` suffix and root dot, in any case. Throws
+		* `AddressError` unless the reversed labels form a valid IPv4 address, so
+		* `fromArpa(x.reverseForm())` round-trips {@link reverseForm}.
 		* @param {string} arpaFormAddress - an 'in-addr.arpa' form ipv4 address
 		* @returns {Adress4}
 		* @example
-		* var address = Address4.fromArpa(42.2.0.192.in-addr.arpa.)
+		* var address = Address4.fromArpa('42.2.0.192.in-addr.arpa.')
 		* address.correctForm(); // '192.0.2.42'
 		*/
 		static fromArpa(arpaFormAddress) {
-			const address = arpaFormAddress.replace(/(\.in-addr\.arpa)?\.$/, "").split(".").reverse().join(".");
+			const longest = constants.GROUPS * 4 - 1 + 3 + 14;
+			if (arpaFormAddress.length > longest) throw new address_error_1.AddressError(`in-addr.arpa names are at most ${longest} characters.`);
+			const address = arpaFormAddress.replace(/(\.in-addr\.arpa)?\.?$/i, "").split(".").reverse().join(".");
 			return new Address4(address);
 		}
 		/**
@@ -63420,7 +63768,9 @@ var require_ipv6 = /* @__PURE__ */ __commonJSMin(((exports) => {
 			this.v4 = false;
 			this.zone = "";
 			/**
-			* Returns true if the given address is in the subnet of the current address
+			* Returns true if the given address is in the subnet of the current address.
+			* An `Address4` is never in the subnet of an `Address6`; convert with
+			* `Address6.fromAddress4()` or `to4()` to compare across families.
 			* @returns {boolean}
 			*/
 			this.isInSubnet = common.isInSubnet;
@@ -63430,6 +63780,8 @@ var require_ipv6 = /* @__PURE__ */ __commonJSMin(((exports) => {
 			* when classifying a single address, so the answer doesn't change with the
 			* CIDR suffix the caller happened to write — notably when the address came
 			* from untrusted input and the result backs a trust-boundary decision.
+			* An `Address4` is never in the subnet of an `Address6`; convert with
+			* `Address6.fromAddress4()` or `to4()` to compare across families.
 			* @returns {boolean}
 			*/
 			this.isHostInSubnet = common.isHostInSubnet;
@@ -63455,6 +63807,8 @@ var require_ipv6 = /* @__PURE__ */ __commonJSMin(((exports) => {
 				this.zone = zone[0];
 				address = address.replace(constants6.RE_ZONE_STRING, "");
 			}
+			const longest = this.groups * 5 + 5;
+			if (address.length > longest) throw new address_error_1.AddressError(`IPv6 addresses are at most ${longest} characters.`);
 			this.addressMinusSuffix = address;
 			this.parsedAddress = this.parse(this.addressMinusSuffix);
 		}
@@ -63640,7 +63994,7 @@ var require_ipv6 = /* @__PURE__ */ __commonJSMin(((exports) => {
 		* Address6.fromArpa('8.b.d.0.1.0.0.2.ip6.arpa.').networkForm(); // '2001:db8::/32'
 		*/
 		static fromArpa(arpaFormAddress) {
-			const nibbles = arpaFormAddress.replace(/(\.ip6\.arpa)?\.?$/, "");
+			const nibbles = arpaFormAddress.replace(/(\.ip6\.arpa)?\.?$/i, "");
 			if (!/^[0-9a-f](\.[0-9a-f]){0,31}$/i.test(nibbles)) throw new address_error_1.AddressError("Invalid 'ip6.arpa' form.");
 			const reversed = nibbles.split(".").reverse();
 			const subnetMask = reversed.length * 4;
@@ -65801,6 +66155,7 @@ var require_lib$14 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		});
 		if (agentCache.has(cacheKey)) return agentCache.get(cacheKey);
 		const newAgent = new Agent(normalizedOptions);
+		newAgent.protocol = url.protocol;
 		agentCache.set(cacheKey, newAgent);
 		return newAgent;
 	};
@@ -65892,7 +66247,7 @@ var require_package$5 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			"publish": "true"
 		},
 		"_fyn": {},
-		"_from": "make-fetch-happen@^16.0.0",
+		"_from": "make-fetch-happen@^16.0.1",
 		"_id": "make-fetch-happen@16.0.1"
 	};
 }));
@@ -86762,7 +87117,7 @@ var require_package_extensions = /* @__PURE__ */ __commonJSMin(((exports, module
 var require_npm_extension = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const { resolve: resolve$9, sep: sep$3 } = __require("node:path");
 	const { readFileSync, existsSync: existsSync$3 } = __require("node:fs");
-	const { pathToFileURL } = __require("node:url");
+	const { pathToFileURL: pathToFileURL$1 } = __require("node:url");
 	const { isDeepStrictEqual } = __require("node:util");
 	const { log } = require_lib$38();
 	const ssri = require_lib$23();
@@ -86831,7 +87186,7 @@ var require_npm_extension = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 		async load() {
 			if (!this.present) return;
 			let mod;
-			if (this.format === "mjs") mod = await import(`${pathToFileURL(this.path).href}?h=${this.hash}`);
+			if (this.format === "mjs") mod = await import(`${pathToFileURL$1(this.path).href}?h=${this.hash}`);
 			else {
 				delete __require.cache[__require.resolve(this.path)];
 				mod = __require(this.path);
@@ -92175,10 +92530,11 @@ async function copyFile(srcFp, destFp) {
 *
 * @param {*} srcFp - source file path
 * @param {*} destFp - destination file path
+* @param {*} noCopy - fail instead of falling back to a copy (always fails on macOS)
 * @returns
 */
-async function cloneFile(srcFp, destFp) {
-	return copyNew(srcFp, destFp, fs.constants.COPYFILE_FICLONE);
+async function cloneFile(srcFp, destFp, noCopy = false) {
+	return copyNew(srcFp, destFp, noCopy ? fs.constants.COPYFILE_FICLONE_FORCE : fs.constants.COPYFILE_FICLONE);
 }
 async function prepDestDir(dest) {
 	const statDest = await tryCatch(() => file_ops_default.lstat(dest));
@@ -92679,6 +93035,15 @@ function getBucketPath(cache, key) {
 	return Path.join(cache, `index-v${indexV}`, hashed.slice(0, 2), hashed.slice(2, 4), hashed.slice(4));
 }
 /**
+* Get the content file path for an integrity that cacache matched, such as the `sri` from
+* `get.hasContent`. Same layout as cacache: the algorithm, then the hex digest in segments.
+*/
+function getContentPath(cache, sri) {
+	const hex = sri.hexDigest();
+	const contentV = import_package.default["cache-version"].content;
+	return Path.join(cache, `content-v${contentV}`, sri.algorithm, hex.slice(0, 2), hex.slice(2, 4), hex.slice(4));
+}
+/**
 * Update cache entry refresh timestamp by modifying bucket file mtime.
 * Does not modify file contents, only filesystem metadata.
 * Errors are silently ignored (cache refresh is non-critical).
@@ -92714,7 +93079,7 @@ async function getCacheInfoWithRefreshTime(cache, key) {
 //#endregion
 //#region lib/util/trimmed-packument.ts
 /** Bump when the kept fields change, so files from older versions are rebuilt. */
-const TRIMMED_FORMAT = 1;
+const TRIMMED_FORMAT = 2;
 /**
 * The version fields fyn reads from a registry packument. Code that starts reading another
 * field from `meta.versions[v]` must add it here and bump TRIMMED_FORMAT.
@@ -92731,6 +93096,7 @@ const KEEP_VERSION_FIELDS = [
 	"cpu",
 	"deprecated",
 	"_hasShrinkwrap",
+	"_shrinkwrap",
 	"fyn"
 ];
 /** Only the install hooks are read from `scripts`. */
@@ -92762,7 +93128,7 @@ function trimPackument(packument) {
 		versions[version] = trimmed;
 	}
 	return {
-		$format: 1,
+		$format: 2,
 		name: packument.name,
 		"dist-tags": packument["dist-tags"],
 		time: packument.time,
@@ -92775,33 +93141,68 @@ function trimmedPackumentFile(dir, packumentUrl) {
 	return Path.join(dir, `${hash}.json`);
 }
 /**
-* Read a trimmed packument and its refresh time. Resolves undefined when the file is missing,
-* unreadable, or from another format, so the caller falls back to the full copy.
+* Read a trimmed packument, its refresh time, and its validators. Resolves undefined when the
+* file is missing, unreadable, or from another format, so the caller falls back to the full copy.
 */
 async function readTrimmedPackument(file) {
 	try {
 		const [data, stat] = await Promise.all([fs.promises.readFile(file), fs.promises.stat(file)]);
-		const packument = JSON.parse(data.toString());
-		if (packument.$format !== 1) return void 0;
-		delete packument.$format;
-		return {
-			packument,
+		const parsed = parseTrimmed(data.toString());
+		return parsed && {
+			...parsed,
 			refreshTime: stat.mtimeMs
 		};
 	} catch {
 		return;
 	}
 }
+/** Parse a trimmed copy's JSON into the packument and its validators. Undefined for another format. */
+function parseTrimmed(json) {
+	const packument = JSON.parse(json);
+	if (packument.$format !== 2) return void 0;
+	const { $etag: etag, $lastModified: lastModified, $corgi: corgi } = packument;
+	delete packument.$format;
+	delete packument.$etag;
+	delete packument.$lastModified;
+	delete packument.$corgi;
+	return {
+		packument,
+		etag,
+		lastModified,
+		corgi
+	};
+}
+/** Mark a trimmed packument as refreshed now, after the registry said it hasn't changed */
+async function touchTrimmedPackument(file) {
+	const now = /* @__PURE__ */ new Date();
+	await fs.promises.utimes(file, now, now).catch(() => void 0);
+}
 /**
 * Write a trimmed copy of a packument. The write goes to a temp file renamed over the target,
 * so concurrent installs never read half a file. `refreshTime` sets the mtime when the copy is
-* made from an existing cache entry rather than a fresh fetch. Failures are ignored: the full
-* copy in cacache still works, just slower.
+* made from an existing cache entry rather than a fresh fetch. Failures are ignored: the next
+* install fetches the packument again.
 */
-async function writeTrimmedPackument(file, packument, refreshTime) {
+async function writeTrimmedPackument(file, packument, refreshTime, validators) {
+	let json;
+	try {
+		json = trimmedJson(trimPackument(packument), validators);
+	} catch {
+		return;
+	}
+	await writeTrimmed(file, json, refreshTime);
+}
+function trimmedJson(trimmed, validators) {
+	return JSON.stringify({
+		...trimmed,
+		$etag: validators?.etag,
+		$lastModified: validators?.lastModified,
+		$corgi: validators?.corgi || void 0
+	});
+}
+async function writeTrimmed(file, data, refreshTime) {
 	const tmp = `${file}.${process.pid}.${Crypto.randomBytes(4).toString("hex")}.tmp`;
 	try {
-		const data = JSON.stringify(trimPackument(packument));
 		try {
 			await fs.promises.writeFile(tmp, data);
 		} catch (err) {
@@ -92818,9 +93219,160 @@ async function writeTrimmedPackument(file, packument, refreshTime) {
 		await fs.promises.rm(tmp, { force: true }).catch(() => void 0);
 	}
 }
+/** Parse a registry response body, as sent with `encoding` */
+function decodePackument(data, encoding) {
+	const json = encoding === "gzip" || encoding === "x-gzip" || encoding === "deflate" ? en.unzipSync(data) : encoding === "br" ? en.brotliDecompressSync(data) : data;
+	return JSON.parse(Buffer.from(json.buffer, json.byteOffset, json.byteLength).toString());
+}
+/**
+* Decode a packument response and write its trimmed copy. The abbreviated form only flags that
+* a version has install scripts, and fyn records which ones, so one with any isn't saved. This
+* is the CPU-heavy part of a packument fetch, so an fs worker runs it when fyn has them built.
+*/
+async function savePackument(job) {
+	const packument = decodePackument(job.data, job.encoding);
+	if (job.corgi && Object.values(packument.versions || {}).some((v) => v.hasInstallScript)) return { needFull: true };
+	return { json: await saveTrimmed(job.file, packument, job) };
+}
+/** Trim a packument and write it with its validators. @returns the JSON written */
+async function saveTrimmed(file, packument, validators) {
+	const text = trimmedJson(trimPackument(packument), validators);
+	await writeTrimmed(file, text);
+	return text;
+}
+
+//#endregion
+//#region lib/util/registry-get.ts
+let load;
+const loadRegistryFetch = () => load ??= Promise.all([Promise.resolve().then(() => /* @__PURE__ */ __toESM(require_lib$13(), 1)), Promise.resolve().then(() => /* @__PURE__ */ __toESM(require_lib$12(), 1))]).then(([mfh, nrf]) => ({
+	fetch: mfh.default,
+	getAuth: nrf.default.getAuth
+}));
+/** The plain values of `opts`, which is all auth needs and all that can go to a worker */
+function pickRegistryOpts(opts) {
+	const out = {};
+	for (const [k, v] of Object.entries(opts)) if (v === void 0 || [
+		"string",
+		"number",
+		"boolean"
+	].includes(typeof v)) out[k] = v;
+	return out;
+}
+/** getAuth results, per opts, by authCacheKey */
+const authCaches = /* @__PURE__ */ new WeakMap();
+/**
+* What getAuth's result for `url` depends on. It walks up the URL's path for the longest
+* `//host/path` that has auth configured, and without one, falls back to the registry's auth.
+* So it's the longest configured prefix that matches, else the host.
+*/
+function authCacheKey(url, prefixes) {
+	const m = /^[a-z]+:(\/\/[^/?#]+)([^?#]*)/i.exec(url);
+	if (!m) return void 0;
+	const full = m[1] + m[2];
+	let best = "";
+	for (const p of prefixes) if (p.length > best.length && full.startsWith(p) && (p.endsWith("/") || full.length === p.length || full[p.length] === "/")) best = p;
+	return best || `host ${m[1]}`;
+}
+function cachedAuth(getAuth, url, opts) {
+	if (opts.forceAuth) return getAuth(url, opts);
+	let cache = authCaches.get(opts);
+	if (!cache) {
+		cache = {
+			prefixes: Object.keys(opts).map((k) => /^(\/\/.+):(_authToken|_auth|username|_password|certfile|keyfile)$/.exec(k)?.[1]).filter((p) => Boolean(p)),
+			auths: /* @__PURE__ */ new Map()
+		};
+		authCaches.set(opts, cache);
+	}
+	const key = authCacheKey(url, cache.prefixes);
+	if (key === void 0) return getAuth(url, opts);
+	let auth = cache.auths.get(key);
+	if (!auth) cache.auths.set(key, auth = getAuth(url, opts));
+	return auth;
+}
+/** Statuses from 400 up throw */
+async function registryGet(url, extraHeaders, opts) {
+	const { fetch, getAuth } = await loadRegistryFetch();
+	const auth = cachedAuth(getAuth, url, opts);
+	const headers = {
+		"user-agent": `fyn node/${process.version}`,
+		...extraHeaders
+	};
+	if (auth.token) headers.authorization = `Bearer ${auth.token}`;
+	else if (auth.auth) headers.authorization = `Basic ${auth.auth}`;
+	const res = await fetch(url, {
+		headers,
+		compress: false,
+		cert: auth.cert,
+		key: auth.key,
+		maxSockets: opts.maxSockets,
+		noProxy: process.env.NOPROXY,
+		retry: { retries: 3 },
+		timeout: 3e5
+	});
+	if (res.status >= 400) {
+		res.body.resume();
+		throw Object.assign(/* @__PURE__ */ new Error(`${res.status} ${res.statusText} - GET ${url}`), {
+			code: `E${res.status}`,
+			statusCode: res.status
+		});
+	}
+	return res;
+}
+/** npm's abbreviated install metadata, about a third the size of a full packument */
+const CORGI_DOC = "application/vnd.npm.install-v1+json; q=1.0, application/json; q=0.8, */*";
+/**
+* The request headers for a packument, with validators so the registry can answer 304.
+*
+* @param full - ask for the full packument, not the abbreviated one
+*/
+function packumentHeaders(validators, full) {
+	const headers = {
+		accept: full ? "application/json" : CORGI_DOC,
+		"accept-encoding": "gzip"
+	};
+	if (validators?.etag) headers["if-none-match"] = validators.etag;
+	if (validators?.lastModified) headers["if-modified-since"] = validators.lastModified;
+	return headers;
+}
+/**
+* Fetch a packument and write fyn's trimmed copy of it. It starts with the abbreviated form, and
+* gets the full one when `save` finds that abbreviated isn't enough.
+*
+* @param get - does the GET, registryGet with the job's opts by default
+* @param save - decodes and writes the response; an fs worker can run it
+*/
+async function fetchPackument(job, get, save = savePackument) {
+	const doGet = get || ((url, headers) => registryGet(url, headers, job.opts || {}));
+	const request = async (headers) => {
+		const res = await doGet(job.url, headers);
+		if (res.status === 304) {
+			res.body?.resume();
+			return;
+		}
+		const header = (name) => res.headers.get(name) || void 0;
+		return {
+			data: await res.buffer(),
+			encoding: header("content-encoding"),
+			etag: header("etag"),
+			lastModified: header("last-modified"),
+			corgi: /vnd\.npm\.install-v1/.test(header("content-type") || ""),
+			file: job.file
+		};
+	};
+	const first = await request(packumentHeaders(job, job.full));
+	if (!first) return { status: 304 };
+	let saved = await save(first);
+	if ("needFull" in saved) saved = await save(await request(packumentHeaders(void 0, true)));
+	if ("needFull" in saved) throw new Error(`no full packument from ${job.url}`);
+	return {
+		status: 200,
+		json: saved.json
+	};
+}
 
 //#endregion
 //#region lib/util/inflight.ts
+var import_lib = /* @__PURE__ */ __toESM(require_lib$23(), 1);
 var inflight_default = InflightStore;
 
 //#endregion
@@ -92855,7 +93407,10 @@ var PkgPreper = class {
 				};
 				return Promise.resolve((0, import_lib$2.default)(treeStub)).then((files) => {
 					return Qn(tarOpt, files.map((f) => `./${f}`));
-				}).then(() => FsPromises.rename(tmpTarget, target)).then(() => void 0);
+				}).then(() => FsPromises.rename(tmpTarget, target).catch((err) => {
+					if (err.code !== "EXDEV") throw err;
+					return FsPromises.copyFile(tmpTarget, target);
+				})).then(() => void 0);
 			});
 		});
 	}
@@ -92872,7 +93427,7 @@ var PkgPreper = class {
 				});
 			});
 		}).catch((err) => {
-			stream.emit("error", err);
+			stream.destroy(err);
 		});
 		return stream;
 	}
@@ -92883,7 +93438,6 @@ var PkgPreper = class {
 
 //#endregion
 //#region node_modules/xsh/dist/util.js
-var import_lib = /* @__PURE__ */ __toESM(require_lib$23(), 1);
 /**
 * Mutable holder for the Promise implementation xsh uses.
 *
@@ -93112,12 +93666,11 @@ const envPath = {
 //#endregion
 //#region node_modules/xsh/dist/mkcmd.js
 /**
-* Make a command string: a single array of strings is joined with `" "`,
-* otherwise all arguments are joined with `" "`.
+* Make a command string: every argument, string or array of strings,
+* contributes its words in order, joined with `" "`.
 */
 function mkCmd(...args) {
-	const a = args[0];
-	return Array.isArray(a) ? a.join(" ") : args.join(" ");
+	return args.flat().join(" ");
 }
 
 //#endregion
@@ -93268,19 +93821,14 @@ const TEN_MB = 10485760;
 const DEFAULT_TIMEOUT_GRACE = 5e3;
 const DEFAULT_LAST_LINES = 10;
 const MAX_OUTPUT_IN_ERROR = 5e4;
-function createTimeoutError(context, elapsed) {
-	const err = /* @__PURE__ */ new Error(`Command timed out after ${elapsed}ms: ${context.command}`);
+function createTimeoutError(command, elapsed) {
+	const err = /* @__PURE__ */ new Error(`Command timed out after ${elapsed}ms: ${command}`);
 	err.name = "TimeoutError";
-	err.context = {
-		...context,
-		duration: elapsed
-	};
 	return err;
 }
-function createAbortError(context) {
-	const err = /* @__PURE__ */ new Error(`Command aborted: ${context.command}`);
+function createAbortError(command) {
+	const err = /* @__PURE__ */ new Error(`Command aborted: ${command}`);
 	err.name = "AbortError";
-	err.context = context;
 	return err;
 }
 function lastLines(text, n) {
@@ -93388,7 +93936,7 @@ var VisualExec = class {
 	}
 	_extractProgress(line) {
 		const cfg = this._progress;
-		if (!cfg || !this._onProgress) return;
+		if (!cfg || !(this._onProgress || cfg.format)) return;
 		let progress = null;
 		if (cfg.extract) progress = cfg.extract(line);
 		else if (cfg.pattern) {
@@ -93399,7 +93947,24 @@ var VisualExec = class {
 				percent: m.groups.percent ? parseInt(m.groups.percent, 10) : void 0
 			};
 		}
-		if (progress) this._onProgress(progress);
+		if (!progress) return;
+		if (cfg.format) {
+			const text = cfg.format(progress);
+			if (text !== this._progressText) {
+				this._progressText = text;
+				this._renderDigest(this._stdoutDigest);
+			}
+		}
+		if (this._onProgress) this._onProgress(progress);
+	}
+	_renderDigest(item) {
+		const display = item === this._stdoutDigest && this._progressText ? `=== ${this._title}\nstdout ${this._progressText}` : void 0;
+		this._logger.updateItem(item.name, {
+			msg: item.msg,
+			display,
+			_save: false,
+			_render: false
+		});
 	}
 	_updateDigest(item, buf) {
 		const lines = (item.buf + sanitizeForDisplay(buf)).split("\n").map((x) => x && x.trim()).filter((x) => x);
@@ -93420,11 +93985,8 @@ var VisualExec = class {
 			msgs = [item.buf];
 		} else item.buf = msgs.join("\n");
 		if (buf.endsWith("\n")) item.buf += "\n";
-		this._logger.updateItem(item.name, {
-			msg: msgs.join(chalk.blue.inverse("\\n")),
-			_save: false,
-			_render: false
-		});
+		item.msg = msgs.join(chalk.blue.inverse("\\n"));
+		this._renderDigest(item);
 	}
 	_createDataHandler(stream) {
 		return (buf) => {
@@ -93459,6 +94021,9 @@ var VisualExec = class {
 	* it defaults to `ExecOutput`, which is what a run without an `onComplete` produces.
 	*/
 	show(child) {
+		return this._show(child, this._command);
+	}
+	_show(child, command) {
 		this._stdoutKey = Symbol("visual-exec-stdout");
 		this._stderrKey = Symbol("visual-exec-stderr");
 		this._rawChild = child.child;
@@ -93477,19 +94042,30 @@ var VisualExec = class {
 			name: this._stdoutKey,
 			buf: ""
 		};
+		this._stdoutDigest = stdoutDigest;
 		const stderrDigest = {
 			name: this._stderrKey,
 			buf: ""
 		};
 		this._updateStdout = (buf) => this._updateDigest(stdoutDigest, buf);
 		this._updateStderr = (buf) => this._updateDigest(stderrDigest, buf);
+		const seen = {
+			stdout: "",
+			stderr: ""
+		};
+		const capture = (stream, data) => {
+			const text = seen[stream] + data;
+			seen[stream] = text.length > MAX_OUTPUT_IN_ERROR ? text.slice(-5e4) : text;
+		};
 		this._onStdoutData = (buf) => {
 			const data = typeof buf === "string" ? buf : buf.toString();
+			capture("stdout", data);
 			this._updateStdout(data);
 			this._createDataHandler("stdout")(buf);
 		};
 		this._onStderrData = (buf) => {
 			const data = typeof buf === "string" ? buf : buf.toString();
+			capture("stderr", data);
 			this._updateStderr(data);
 			this._createDataHandler("stderr")(buf);
 		};
@@ -93508,7 +94084,9 @@ var VisualExec = class {
 				stderr: ""
 			};
 			const exitCode = (_d = (_c = err.exitCode) !== null && _c !== void 0 ? _c : err.code) !== null && _d !== void 0 ? _d : 1;
-			(_a = this._onComplete) === null || _a === void 0 || _a.call(this, output, exitCode);
+			try {
+				(_a = this._onComplete) === null || _a === void 0 || _a.call(this, output, exitCode);
+			} catch (_e) {}
 			this.logResult(err);
 			throw err;
 		}).then((output) => {
@@ -93517,6 +94095,20 @@ var VisualExec = class {
 			const result = (_a = this._onComplete) === null || _a === void 0 ? void 0 : _a.call(this, output, 0);
 			return result !== void 0 ? result : output;
 		});
+		const cancelError = (err, duration) => {
+			const output = { ...seen };
+			err.output = output;
+			return enhanceError(err, {
+				exitCode: -1,
+				signal: "SIGTERM",
+				cwd: this._cwd,
+				command,
+				duration,
+				lastLines: lastLines(`${output.stdout}\n${output.stderr}`, DEFAULT_LAST_LINES),
+				stdout: output.stdout,
+				stderr: output.stderr
+			});
+		};
 		if (this._timeout) {
 			const timeoutPromise = new Promise((_, reject) => {
 				timeoutId = setTimeout(() => {
@@ -93530,18 +94122,15 @@ var VisualExec = class {
 							if ((_a = this._rawChild) === null || _a === void 0 ? void 0 : _a.pid) this._rawChild.kill("SIGKILL");
 						}, this._timeoutGrace)).unref) === null || _d === void 0 || _d.call(_c);
 					}
-					reject(createTimeoutError({
-						command: this._command,
-						cwd: this._cwd,
-						exitCode: -1,
-						signal: "SIGTERM"
-					}, this._timeout));
+					reject(cancelError(createTimeoutError(command, this._timeout), this._timeout));
 				}, this._timeout);
 			});
 			execPromise = Promise.race([execPromise, timeoutPromise]);
 		}
+		let handleAbort;
 		const cleanup = () => {
 			if (timeoutId) clearTimeout(timeoutId);
+			if (handleAbort) this._signal.removeEventListener("abort", handleAbort);
 			const stream = this._outputStream;
 			this._outputStream = void 0;
 			if (!(stream === null || stream === void 0 ? void 0 : stream.end)) return;
@@ -93554,15 +94143,9 @@ var VisualExec = class {
 		};
 		if (this._signal) {
 			const abortPromise = new Promise((_, reject) => {
-				const handleAbort = () => {
+				handleAbort = () => {
 					this.abort();
-					reject(createAbortError({
-						command: this._command,
-						cwd: this._cwd,
-						exitCode: -1,
-						signal: "SIGTERM",
-						duration: Date.now() - startTime
-					}));
+					reject(cancelError(createAbortError(command), Date.now() - startTime));
 				};
 				if (this._signal.aborted) handleAbort();
 				else this._signal.addEventListener("abort", handleAbort);
@@ -93667,7 +94250,7 @@ var VisualExec = class {
 			};
 			return Promise.reject(enhanceError(err, context));
 		});
-		return this.show(child);
+		return this._show(child, cmd);
 	}
 };
 
@@ -93711,7 +94294,8 @@ function renameFromObj(obj, rename) {
 function removeFromObj(obj, fields) {
 	for (const f of fields) if (typeof f === "string") deleteFields(f, obj);
 	else Object.keys(f).forEach((f2) => {
-		removeFromObj(obj[f2], f[f2]);
+		const sub = obj[f2];
+		if (sub) removeFromObj(sub, f[f2]);
 	});
 }
 function extractFromObj(obj, fields, output = {}) {
@@ -93783,6 +94367,7 @@ const keepStandardFields = [
 
 //#endregion
 //#region node_modules/publish-util/dist/prepack.js
+const runsPrePack = (script) => typeof script === "string" && script.includes("publish-util-prepack");
 function prePackObj(pkg, config = {}) {
 	renameFromObj(pkg, config.rename);
 	const keepObj = config.keep && extractFromObj(pkg, config.keep);
@@ -93800,7 +94385,8 @@ function prePackObj(pkg, config = {}) {
 		if (!config.silent) console.log("scripts.postpack missing, adding it.\n To skip this, set publishUtil.autoPostPack to false");
 		set(pkg, "scripts.postpack", "publish-util-postpack");
 	}
-	if ((scripts === null || scripts === void 0 ? void 0 : scripts.prepack) === "publish-util-prepack") delete scripts.prepack;
+	if (scripts && runsPrePack(scripts.prepack)) delete scripts.prepack;
+	if ((scripts === null || scripts === void 0 ? void 0 : scripts.prepublishOnly) === "publish-util-prepublishonly") delete scripts.prepublishOnly;
 	if (keepObj) merge(pkg, keepObj);
 }
 
@@ -94464,6 +95050,7 @@ var PkgSrcManager = class {
 	/** trimmed packument copies, see util/trimmed-packument */
 	_packumentDir;
 	_lastMetaStatus;
+	_registryOpts;
 	_fetching;
 	_fetchingMsg;
 	constructor(options) {
@@ -94665,33 +95252,38 @@ var PkgSrcManager = class {
 				this.updateFetchMetaStatus();
 			}
 		};
-		const pacoteRequest = () => {
-			logger$1.debug(`pacote.packument ${qItem.packumentUrl}`);
-			return loadPacote().then((pacote) => pacote.packument(pkgName, this.getPacoteOpts({
-				fullMetadata: true,
-				fetchRetries: 3,
-				preferOnline: true,
-				memoize: false
-			}))).then((x) => {
-				if (!x) {
-					const msg = `pacote returned null/undefined for packument of ${pkgName}`;
-					logger$1.error(chalk.yellow(msg));
-					throw Object.assign(new AggregateError$1([new Error(msg)], msg), { expected: true });
-				}
-				if (x.readme) delete x.readme;
-				if (x._contentLength) delete x._contentLength;
-				updateItem(x._cached ? "cached" : "200");
-				return x;
-			}).catch((err) => {
-				const msg = `pacote failed fetching packument of ${pkgName}`;
+		const registryRequest = async () => {
+			logger$1.debug(`fetch packument ${qItem.packumentUrl}`);
+			const { cached } = qItem;
+			const file = trimmedPackumentFile(this._packumentDir, qItem.packumentUrl);
+			try {
+				const job = {
+					url: qItem.packumentUrl,
+					file,
+					etag: cached?.etag,
+					lastModified: cached?.lastModified,
+					full: Boolean(this._fyn.lockTime) || Boolean(cached && !cached.corgi)
+				};
+				const pool = getFsWorkerPool();
+				const res = await fetchPackument(job, (url, headers) => this.registryGet(url, headers), pool ? (saveJob) => pool.run("savePackument", saveJob) : void 0);
+				if (res.status === 304) {
+					if (cached.trimmed) touchTrimmedPackument(file);
+					else writeTrimmedPackument(file, cached.packument, void 0, cached);
+					updateItem("304");
+					return cached.packument;
+				}
+				updateItem("200");
+				return parseTrimmed(res.json).packument;
+			} catch (err) {
+				const msg = `failed fetching packument of ${pkgName}`;
 				logger$1.error(chalk.yellow(msg), chalk.red(err.message));
 				throw Object.assign(new AggregateError$1([err], msg), { expected: true });
-			});
+			}
 		};
 		this._metaStat.wait--;
 		this._metaStat.inTx++;
 		this.updateFetchMetaStatus(false);
-		return (qItem.item.urlType ? this.fetchUrlSemverMeta(qItem.item) : pacoteRequest()).then((x) => {
+		return (qItem.item.urlType ? this.fetchUrlSemverMeta(qItem.item) : dist_default.resolve(registryRequest())).then((x) => {
 			this._metaStat.inTx--;
 			const time = Date.now() - startTime;
 			if (time > 2e4) logger$1.info(chalk.red("Fetch meta of package"), log_format_default.pkgId(qItem.item), `took ${log_format_default.time(time)}!!!`);
@@ -94701,14 +95293,20 @@ var PkgSrcManager = class {
 				qItem.defer.reject(Object.assign(new AggregateError$1([new Error(msg)], msg), { expected: true }));
 				return;
 			}
-			refreshCacheEntry(this._cacheDir, qItem.cacheKey).catch(() => {});
-			if (!qItem.item.urlType) writeTrimmedPackument(trimmedPackumentFile(this._packumentDir, qItem.packumentUrl), x);
 			qItem.defer.resolve(x);
 		}).catch((err) => {
 			this._metaStat.inTx--;
 			qItem.defer.reject(err);
 		});
 	}
+	/** the plain values of the pacote options, for util/registry-get */
+	get registryOpts() {
+		return this._registryOpts ??= pickRegistryOpts(this._pacoteOpts);
+	}
+	/** GET from the registry, see util/registry-get */
+	registryGet(url, extraHeaders) {
+		return registryGet(url, extraHeaders, this.registryOpts);
+	}
 	hasMeta(item) {
 		return Boolean(this._meta[item.resolutionName || item.name]);
 	}
@@ -94882,16 +95480,35 @@ var PkgSrcManager = class {
 			};
 		};
 		const readMemoizedPackument = async () => {
-			const memoized = await loadBestCachedPackument(false);
-			if (!(memoized && memoized.data)) return;
+			const memoized = await readTrimmedPackument(trimmedFile) || await loadBestCachedPackument(false);
+			if (!(memoized && (memoized.packument || memoized.data))) return;
 			logger$1.debug(`using memoized packument cache for '${pkgName}'`);
 			cacheMemoized = true;
 			this._metaStat.wait--;
-			return JSON.parse(memoized.data.toString());
+			return memoized.packument || JSON.parse(memoized.data.toString());
 		};
 		let fetchAttempted = false;
 		let foundCache;
 		let foundPackument;
+		const revalidate = (packument) => {
+			if (foundCache.packument) {
+				const { etag, lastModified, corgi } = foundCache;
+				return {
+					packument,
+					trimmed: true,
+					etag,
+					lastModified,
+					corgi
+				};
+			}
+			const resHeaders = foundCache.metadata?.resHeaders || {};
+			return {
+				packument,
+				trimmed: false,
+				etag: resHeaders.etag,
+				lastModified: resHeaders["last-modified"]
+			};
+		};
 		const queueMetaFetchRequest = (cached) => {
 			fetchAttempted = true;
 			const offline = this._fyn.remoteMetaDisabled;
@@ -94912,7 +95529,8 @@ var PkgSrcManager = class {
 				cacheKey,
 				item,
 				packumentUrl,
-				defer: dist_default.defer()
+				defer: dist_default.defer(),
+				cached: cached && revalidate(cached)
 			};
 			this._netQ.addItem(netQItem);
 			return netQItem.defer.promise;
@@ -94922,7 +95540,7 @@ var PkgSrcManager = class {
 		let cacheLookup;
 		if (item.urlType) cacheLookup = this._fyn.remoteMetaDisabled ? loadPreparedUrlMeta().then((preparedUrlMeta) => ({ preparedUrlMeta })) : dist_default.resolve();
 		else if (forceRefresh) cacheLookup = dist_default.resolve();
-		else cacheLookup = readTrimmedPackument(trimmedFile).then((trimmed) => trimmed || loadBestCachedPackument(true));
+		else cacheLookup = readTrimmedPackument(trimmedFile).then((trimmed) => trimmed && !(trimmed.corgi && this._fyn.lockTime) ? trimmed : loadBestCachedPackument(true));
 		const promise = cacheLookup.then((cached) => {
 			if (cached && cached.preparedUrlMeta) {
 				cacheMemoized = true;
@@ -95053,10 +95671,21 @@ var PkgSrcManager = class {
 		if (di && di.urlType) return `${di.name}@${di.semver}`;
 		return `${pkgInfo.name}@${pkgInfo.version}`;
 	}
-	async getCentralPackage(integrity, pkgInfo) {
+	/**
+	* A package not in the central store yet comes back as a store job, so the extractor writes
+	* the store, not the download slot this runs in.
+	*
+	* @param data - the tarball's bytes, when it was downloaded for the central store and not
+	*   into cacache
+	*/
+	async getCentralPackage(integrity, pkgInfo, data) {
 		const { central, copy } = this._fyn;
 		const tarId = this.tarballFetchId(pkgInfo);
 		const tarStream = async () => {
+			if (data) {
+				if (!import_lib.default.checkData(data, integrity)) throw Object.assign(/* @__PURE__ */ new Error(`integrity check failed for ${tarId}`), { code: "EINTEGRITY" });
+				return Readable.from([data]);
+			}
 			return integrity && await (await loadCacache()).get.hasContent(this._cacheDir, integrity) ? this.cacacheTarballStream(integrity) : this.pacoteTarballStream(tarId, pkgInfo, integrity);
 		};
 		if (integrity && central) {
@@ -95075,7 +95704,17 @@ var PkgSrcManager = class {
 						hasCentral = false;
 					}
 				}
-				if (!hasCentral) await central.storeTarStream(tarId, integrity, tarStream);
+				if (!hasCentral) {
+					const tarSource = async () => {
+						if (data) return { data };
+						const content = await (await loadCacache()).get.hasContent(this._cacheDir, integrity);
+						return content ? { file: getContentPath(this._cacheDir, content.sri) } : void 0;
+					};
+					return {
+						integrity,
+						store: (deferIfBusy) => central.storeTarStream(tarId, integrity, tarStream, deferIfBusy, tarSource)
+					};
+				}
 				return integrity;
 			}
 		}
@@ -95085,7 +95724,14 @@ var PkgSrcManager = class {
 		const startTime = Date.now();
 		const pkgId = this.tarballFetchId(pkgInfo);
 		const integrity = this.getIntegrity(pkgInfo);
-		const doFetch = () => {
+		const tarballUrl = get$1(pkgInfo, "dist.tarball");
+		const central = this._fyn.central;
+		const centralEligible = Boolean(integrity && tarballUrl && central && !tarballUrl.startsWith("~url-spec~"));
+		const copied = () => {
+			const { copy } = this._fyn;
+			return copy.indexOf(pkgInfo.name) >= 0 || copy.indexOf(`${pkgInfo.name}@${pkgInfo.version}`) >= 0;
+		};
+		const doFetch = (fetchForCentral) => {
 			const fetchStartTime = Date.now();
 			if (!this._fetching) {
 				this._fetching = [];
@@ -95093,21 +95739,28 @@ var PkgSrcManager = class {
 			}
 			this._fetching.push(pkgId);
 			logger$1.updateItem(FETCH_PACKAGE, `${this._fetching.length} ${this._fetchingMsg}`);
-			return this.pacotePrefetch(pkgId, pkgInfo, integrity).then(() => {
+			return (fetchForCentral ? dist_default.resolve(this.registryGet(tarballUrl, {})).then((res) => res.buffer()) : this.pacotePrefetch(pkgId, pkgInfo, integrity)).then((data) => {
 				const status = chalk.cyan(`200`);
 				const time = log_format_default.time(Date.now() - fetchStartTime);
 				const ix = this._fetching.indexOf(pkgId);
 				this._fetching.splice(ix, 1);
 				this._fetchingMsg = `${status} ${time} ${chalk.red.bgGreen(pkgInfo.name)}`;
 				logger$1.updateItem(FETCH_PACKAGE, `${this._fetching.length} ${this._fetchingMsg}`);
-				return this.getCentralPackage(integrity, pkgInfo);
+				return this.getCentralPackage(integrity, pkgInfo, data || void 0);
 			});
 		};
-		const promise = dist_default.resolve(loadCacache()).then((cacache) => cacache.get.hasContent(this._cacheDir, integrity)).catch(() => false).then((content) => {
-			if (content) return this.getCentralPackage(integrity, pkgInfo);
+		const fetchRemote = (fetchForCentral) => {
 			const rd = this._fyn.remoteTgzDisabled;
 			if (rd) throw new Error(`option ${rd} has disabled retrieving tarball from remote`);
-			return doFetch();
+			return doFetch(fetchForCentral);
+		};
+		const promise = dist_default.resolve().then(async () => {
+			if (centralEligible) {
+				if (await central.has(integrity)) return this.getCentralPackage(integrity, pkgInfo);
+				if (!this._fyn.remoteTgzDisabled && !copied() && await central.allow(integrity)) return fetchRemote(true);
+			}
+			if (await dist_default.resolve(loadCacache()).then((cacache) => cacache.get.hasContent(this._cacheDir, integrity)).catch(() => false)) return this.getCentralPackage(integrity, pkgInfo);
+			return fetchRemote(false);
 		});
 		return {
 			then: (r, e) => promise.then(r, e),
@@ -96928,6 +97581,7 @@ var PkgDepLocker = class {
 	*/
 	saveInstalled(filename) {
 		if (!this._enable) return;
+		file_ops_default.$.mkdirp(Path.dirname(filename));
 		file_ops_default.writeFileSync(filename, this._stringify(Path.dirname(filename)));
 	}
 	/**
@@ -97113,8 +97767,7 @@ const xenvConfig = (spec, userConfig, options) => {
 			};
 		}
 	};
-	const sources = options && options.sources || ["env", "option"];
-	sources.push("default");
+	const sources = [...options && options.sources || ["env", "option"], "default"];
 	const config = Object.keys(spec).reduce((cfg, k) => {
 		const opt = spec[k];
 		const type = getType(opt);
@@ -97143,18 +97796,12 @@ const xenvConfig = (spec, userConfig, options) => {
 //#endregion
 //#region lib/fyn-config.ts
 const spec = {
-	registry: {
-		env: "FYN_REGISTRY",
-		default: "http://localhost:4873"
-	},
+	registry: { default: "http://localhost:4873" },
 	pkgFile: {
 		env: "FYN_PACKAGE_FILE",
 		default: "package.json"
 	},
-	targetDir: {
-		env: "FYN_TARGET_DIR",
-		default: "xout"
-	},
+	targetDir: { default: "xout" },
 	fynDir: {
 		env: [
 			"FYN_DIR",
@@ -97183,12 +97830,135 @@ function fynConfig(override) {
 }
 
 //#endregion
-//#region lib/fyn-central.ts
-const { missPipe } = fyntil;
-/** Type guard to check if parsed tree is new format with version */
-function isTreeFileContent(obj) {
-	return typeof obj === "object" && obj !== null && "_" in obj && typeof obj._ === "number";
+//#region lib/util/reflink.ts
+let nativeReflink;
+/**
+* @fynjs/reflink is a native addon, so it cannot be bundled into dist/. Load it at runtime from
+* an optional dependency, and resolve to undefined when it is absent or has no binary for
+* this platform.
+*/
+function loadReflink() {
+	nativeReflink ??= (async () => {
+		try {
+			const file = createRequire(import.meta.url).resolve("@fynjs/reflink");
+			return await import(
+				/* @vite-ignore */
+				pathToFileURL(file).href
+);
+		} catch (err) {
+			logger$1.debug(`@fynjs/reflink not loaded, using JS clone: ${err.message}`);
+			return;
+		}
+	})();
+	return nativeReflink;
 }
+async function loadReflinkCloneFiles() {
+	return (await loadReflink())?.cloneFiles;
+}
+/** undefined with no reflink, or an reflink older than cloneDir */
+async function loadReflinkCloneDir() {
+	return (await loadReflink())?.cloneDir;
+}
+
+//#endregion
+//#region lib/util/untar-tree.ts
+/** An `onentry` for Tar.x that builds the tree, and the result once extraction finishes */
+function treeCollector(strip) {
+	const newDirObj = () => {
+		const n = Object.create(null);
+		n["/"] = Object.create(null);
+		return n;
+	};
+	const result = {
+		tree: newDirObj(),
+		fromHeaders: true
+	};
+	const onentry = (entry) => {
+		const parts = entry.path.split(/\/|\\/);
+		const isDir = entry.type === "Directory";
+		const wtree = parts.slice(strip, isDir ? parts.length : parts.length - 1).reduce((wt, dir) => {
+			return wt[dir] || (wt[dir] = newDirObj());
+		}, result.tree);
+		if (isDir) return;
+		if (!entry.mtime || ![
+			"File",
+			"OldFile",
+			"ContiguousFile"
+		].includes(entry.type)) result.fromHeaders = false;
+		const fname = parts[parts.length - 1];
+		if (fname) {
+			const m = Math.round((entry.mtime ? entry.mtime.getTime() : Date.now()) / 1e3);
+			wtree["/"][fname] = {
+				z: entry.size,
+				m,
+				$: entry.header.cksumValid && entry.header.cksum
+			};
+		}
+	};
+	return {
+		onentry,
+		result
+	};
+}
+const hashList = (list) => Crypto$1.createHash("sha512").update(JSON.stringify(list.sort())).digest("base64");
+/** The shaSum of a tree from tar headers, in SUM_VERSION's format */
+function treeShasum(tree) {
+	const files = [];
+	const walk = (node, dir) => {
+		for (const [name, child] of Object.entries(node)) if (name === "/") for (const [file, info] of Object.entries(child)) files.push(`${dir}${file}-${info.m}-${info.z}`);
+		else walk(child, `${dir}${name}/`);
+	};
+	walk(tree, "");
+	return hashList(files);
+}
+/** tree.json's content. An old entry keeps its sumVersion until validate() converts it. */
+function treeFileJson(info) {
+	return JSON.stringify({
+		$: info.tree,
+		shaSum: info.shaSum,
+		mutates: info.mutates,
+		_: info.sumVersion ?? 1
+	});
+}
+
+//#endregion
+//#region lib/util/store-entry.ts
+/** an extraction marker or temp dir older than this was left by an install that died */
+const STALE_MS = 3e5;
+/** a name suffix no other install, or other call in this one, will pick */
+const uniqueSuffix = () => `${process.pid}-${Crypto$1.randomBytes(4).toString("hex")}`;
+/**
+* filterScanDir options that hash a package dir in one stat walk, in both formats: v1 for
+* checking an old entry, v2 for everything else (see SUM_VERSION). Call `sums` with the scan's
+* result.
+*/
+function shasumScan(packageDir) {
+	const v2 = [];
+	const filter = (_file, _path, extras) => {
+		const { stat, dirFile } = extras;
+		const fullStat = stat;
+		if (!fullStat.isDirectory()) v2.push(`${dirFile.replace(/\\/g, "/")}-${Math.floor(fullStat.mtimeMs / 1e3)}-${fullStat.size}`);
+		return { formatName: `${dirFile}-${fullStat.mtimeMs}-${fullStat.size}` };
+	};
+	return {
+		options: {
+			cwd: packageDir,
+			filter,
+			filterDir: filter,
+			fullStat: true,
+			concurrency: 500,
+			sortFiles: false,
+			includeDir: true
+		},
+		sums: (files) => ({
+			v1: hashList(files),
+			v2: hashList(v2)
+		})
+	};
+}
+
+//#endregion
+//#region lib/util/place-files.ts
 /** link errors that mean the filesystem can't hardlink from the store at all */
 const NO_LINK_CODES = [
 	"EXDEV",
@@ -97197,6 +97967,14 @@ const NO_LINK_CODES = [
 	"EOPNOTSUPP",
 	"ENOSYS"
 ];
+
+//#endregion
+//#region lib/fyn-central.ts
+const { missPipe } = fyntil;
+/** Type guard to check if parsed tree is new format with version */
+function isTreeFileContent(obj) {
+	return typeof obj === "object" && obj !== null && "_" in obj && typeof obj._ === "number";
+}
 /**
 * Convert a directory tree structure to a flatten one like:
 * ```
@@ -97234,11 +98012,26 @@ function flattenTree(tree, output, baseDir) {
 var FynCentral = class {
 	_centralDir;
 	_map;
+	/** entries found missing, so has() and allow() don't stat them again; storing re-checks */
+	_missing = /* @__PURE__ */ new Map();
+	/** store dirs this install has made, so each is made once */
+	_madeDirs = /* @__PURE__ */ new Set();
 	_hardlink;
-	constructor({ centralDir = ".fyn/_central-storage", hardlink = true } = {}) {
+	_reflink;
+	_copyFallback;
+	/** cleared on the first dir clone the filesystem can't do, so later packages skip it */
+	_cloneDirs = true;
+	/**
+	* cleared when a package's files hardlink but none clone, so later packages hardlink in the
+	* fs workers. That's faster than @fynjs/reflink on a filesystem that can't clone (ext4).
+	*/
+	_cloneFiles = true;
+	constructor({ centralDir = ".fyn/_central-storage", hardlink = true, reflink = true, copyFallback = true } = {}) {
 		this._centralDir = Path.resolve(centralDir);
 		this._map = /* @__PURE__ */ new Map();
 		this._hardlink = hardlink;
+		this._reflink = reflink;
+		this._copyFallback = copyFallback;
 	}
 	_analyze(integrity) {
 		const sri = import_lib.default.parse(integrity, { single: true });
@@ -97272,14 +98065,16 @@ var FynCentral = class {
 			}
 		}
 		try {
-			const stat = await file_ops_default.stat(info.contentPath);
-			info.exist = true;
-			if (stat.isDirectory()) {
+			if ((await file_ops_default.stat(info.contentPath)).isDirectory()) {
 				await this.readInfoTree(info);
 				if (!noSet) this._map.set(integrity, info);
 			}
+			info.exist = true;
+			this._missing.delete(integrity);
 			return info;
 		} catch (_err) {
+			info.exist = false;
+			if (!noSet) this._missing.set(integrity, info);
 			return info;
 		}
 	}
@@ -97290,7 +98085,7 @@ var FynCentral = class {
 	* @returns boolean
 	*/
 	async has(integrity) {
-		const info = this._map.has(integrity) ? this._map.get(integrity) : await this._loadTree(integrity);
+		const info = this._map.get(integrity) ?? this._missing.get(integrity) ?? await this._loadTree(integrity);
 		return Boolean(info.tree);
 	}
 	/**
@@ -97300,7 +98095,7 @@ var FynCentral = class {
 	* @returns boolean
 	*/
 	async allow(integrity) {
-		return (this._map.has(integrity) ? this._map.get(integrity) : await this._loadTree(integrity)).mutates ? false : true;
+		return (this._map.get(integrity) ?? this._missing.get(integrity) ?? await this._loadTree(integrity)).mutates ? false : true;
 	}
 	async getContentPath(integrity) {
 		return (await this.getInfo(integrity)).contentPath;
@@ -97311,28 +98106,25 @@ var FynCentral = class {
 		if (!info.tree) throw new Error(`fyn-central can't get package for integrity ${integrity}`);
 		return info;
 	}
-	async _calcContentShasum(info, pkgDir) {
+	/**
+	* Hash a package dir in one stat walk, in both formats: v1 for checking an old entry, v2 for
+	* everything else (see SUM_VERSION).
+	*/
+	async _scanShasums(packageDir) {
 		try {
-			const packageDir = pkgDir || Path.join(info.contentPath, "package");
-			const filter = (_file, _path, extras) => {
-				const { stat, dirFile } = extras;
-				const fullStat = stat;
-				return { formatName: `${dirFile}-${fullStat.mtimeMs}-${fullStat.size}` };
-			};
-			const files = await filterScanDir({
-				cwd: packageDir,
-				filter,
-				filterDir: filter,
-				fullStat: true,
-				concurrency: 500,
-				sortFiles: false,
-				includeDir: true
-			});
-			return Crypto.createHash("sha512").update(JSON.stringify(files.sort())).digest("base64");
+			const { options, sums } = shasumScan(packageDir);
+			return sums(await filterScanDir(options));
 		} catch (_err) {
 			return;
 		}
 	}
+	/** The v2 hash of a fresh extraction, from the tar header sizes and mtimes in its tree */
+	_treeShasum(tree) {
+		return treeShasum(tree);
+	}
+	async _calcContentShasum(info, pkgDir) {
+		return (await this._scanShasums(pkgDir || Path.join(info.contentPath, "package")))?.v1;
+	}
 	/**
 	* Get the hash of a npm package's extracted content.
 	* - only consider the file names and their mtime and size because npm tar files
@@ -97351,16 +98143,41 @@ var FynCentral = class {
 		}
 	}
 	async getMutation(integrity) {
-		return (this._map.has(integrity) ? this._map.get(integrity) : await this._loadTree(integrity)).mutates;
+		return (this._map.get(integrity) ?? this._missing.get(integrity) ?? await this._loadTree(integrity)).mutates;
 	}
+	/**
+	* Rename the entry away before removing it, so a concurrent install never finds it half
+	* deleted, with tree.json present and package/ partly gone.
+	*/
 	async delete(integrity) {
 		const info = this._map.get(integrity);
 		if (info && info.exist && info.contentPath) {
-			await file_ops_default.$.rimraf(info.contentPath);
+			const trash = `${info.contentPath}.del-${uniqueSuffix()}`;
+			try {
+				await file_ops_default.rename(info.contentPath, trash);
+			} catch (err) {
+				if (err.code !== "ENOENT") throw err;
+			}
 			this._map.delete(integrity);
+			await file_ops_default.$.rimraf(trash);
 		}
 	}
 	/**
+	* An entry with no readable tree.json is left from a broken write. Rename it away, then
+	* remove it, the same way delete() does.
+	*/
+	async _removeBrokenEntry(contentPath) {
+		const trash = `${contentPath}.del-${uniqueSuffix()}`;
+		try {
+			await file_ops_default.rename(contentPath, trash);
+		} catch (err) {
+			if (err.code !== "ENOENT") throw err;
+			return;
+		}
+		logger$1.warn(`fyn-central: replacing a broken store entry with no tree.json at ${contentPath}`);
+		await file_ops_default.$.rimraf(trash);
+	}
+	/**
 	* Read the content dir tree from file into info
 	*
 	* @param info - package info
@@ -97374,24 +98191,30 @@ var FynCentral = class {
 				if (parsed.mutates !== void 0) info.mutates = parsed.mutates;
 				info.tree = parsed.$;
 				info.shaSum = parsed.shaSum;
+				info.sumVersion = parsed._;
 			} else info.tree = parsed;
 		} catch (err) {
 			throw new AggregateError$1([err], `fyn-central: reading tree file ${treeFile}`);
 		}
 	}
 	/**
-	* Save the content dir tree from info to file
+	* Save the content dir tree from info to file. In a live entry it's written to a temp file
+	* and renamed over, so a concurrent install never reads half of it. A `path` is a temp dir
+	* only this install uses, so it's written directly.
 	*
 	* @param info - package info
 	* @param path - path to save the file
 	*/
 	async saveInfoTree(info, path) {
-		await file_ops_default.writeFile(Path.join(path || info.contentPath, "tree.json"), JSON.stringify({
-			$: info.tree,
-			shaSum: info.shaSum,
-			mutates: info.mutates,
-			_: 1
-		}));
+		const data = treeFileJson(info);
+		if (path) {
+			await file_ops_default.writeFile(Path.join(path, "tree.json"), data);
+			return;
+		}
+		const treeFile = Path.join(info.contentPath, "tree.json");
+		const tmpFile = `${treeFile}.${uniqueSuffix()}`;
+		await file_ops_default.writeFile(tmpFile, data);
+		await file_ops_default.rename(tmpFile, treeFile);
 	}
 	async setMutation(integrity, mutates = true) {
 		const info = await this._loadTree(integrity);
@@ -97399,19 +98222,72 @@ var FynCentral = class {
 		info.mutates = mutates;
 		await this.saveInfoTree(info);
 	}
-	async replicate(integrity, destDir) {
+	/**
+	* @param prepare - makes destDir, when the caller hasn't. An fs worker does it instead when
+	*   it places the files.
+	* @returns package.json as placed, when an fs worker placed the files
+	*/
+	async replicate(integrity, destDir, prepare) {
+		let prepared = !prepare;
+		const ensurePrepared = async () => {
+			if (!prepared) {
+				prepared = true;
+				await prepare();
+			}
+		};
 		try {
 			const info = await this.getInfo(integrity);
 			const list = flattenTree(info.tree, {
 				dirs: [],
 				files: []
 			}, "");
-			for (const dir of list.dirs) await file_ops_default.$.mkdirp(Path.join(destDir, dir));
+			const srcDir = Path.join(info.contentPath, "package");
+			const cloneDir = this._reflink && this._cloneDirs && await loadReflinkCloneDir();
+			if (cloneDir) {
+				await ensurePrepared();
+				if (await this._cloneWholeDir(cloneDir, srcDir, destDir)) return;
+			}
+			const reflinkCloneFiles = this._reflink && this._cloneFiles && await loadReflinkCloneFiles();
+			const copy = this._copyFallback;
+			const mkdirs = async () => {
+				for (const dir of list.dirs) await file_ops_default.$.mkdirp(Path.join(destDir, dir));
+			};
+			if (reflinkCloneFiles) {
+				await ensurePrepared();
+				await mkdirs();
+				const others = list.files.filter((f) => f !== "package.json");
+				const [stats] = await Promise.all([reflinkCloneFiles(srcDir, destDir, others, this._hardlink, copy), others.length < list.files.length && reflinkCloneFiles(srcDir, destDir, ["package.json"], false, copy)]);
+				if (this._cloneFiles && stats.cloned === 0 && stats.linked > 0) {
+					this._cloneFiles = false;
+					logger$1.debug(`fyn-central: can't clone files from ${this._centralDir}, hardlinking instead`);
+				}
+				return;
+			}
+			const pool = getFsWorkerPool();
+			if (pool) {
+				const { noLink, pkgJson } = await pool.run("place", {
+					srcDir,
+					destDir,
+					dirs: list.dirs,
+					files: list.files,
+					hardlink: this._hardlink,
+					reflink: this._reflink,
+					copyFallback: copy,
+					prepare: !prepared
+				});
+				if (noLink && this._hardlink) {
+					this._hardlink = false;
+					logger$1.info(`fyn-central: can't hardlink from ${this._centralDir} (${noLink}), copying instead`);
+				}
+				return pkgJson;
+			}
+			await ensurePrepared();
+			await mkdirs();
 			await map$1(list.files, (file) => {
 				const src = Path.join(info.contentPath, "package", file);
 				const dest = Path.join(destDir, file);
-				if (file === "package.json") return copyFile(src, dest);
-				return this._hardlink ? this._linkFile(src, dest) : cloneFile(src, dest);
+				if (file === "package.json") return this._reflink && !copy ? cloneFile(src, dest, true) : copyFile(src, dest);
+				return this._hardlink ? this._linkFile(src, dest) : this._cloneOrCopy(src, dest);
 			}, { concurrency: 5 });
 		} catch (err) {
 			const msg = `fyn-central can't replicate package at ${destDir} for integrity ${integrity}`;
@@ -97435,68 +98311,118 @@ var FynCentral = class {
 				}
 			} else if (code !== "EMLINK") throw err;
 		}
-		await cloneFile(src, dest);
+		await this._cloneOrCopy(src, dest);
+	}
+	/** Clone, else copy, as reflink and copyFallback allow. */
+	async _cloneOrCopy(src, dest) {
+		if (this._reflink) await cloneFile(src, dest, !this._copyFallback);
+		else if (this._copyFallback) await copyFile(src, dest);
+		else throw new Error(`fyn-central: can't place ${dest}: it can't be hardlinked, and reflink and copy-fallback are off`);
+	}
+	/**
+	* Clone the store's package dir to `destDir` in one call. A dir clone needs a path that
+	* doesn't exist, so it goes to a unique sibling that's then renamed over `destDir`. The
+	* rename replaces `destDir` only while it's still the empty dir createPkgOutDir made. If
+	* anything put files there meanwhile, the clone is dropped for the per-file path, which never
+	* writes through an existing file. Resolves false, with `destDir` untouched, when not cloned.
+	*/
+	async _cloneWholeDir(cloneDir, srcDir, destDir) {
+		const tmp = `${destDir}.clone-${uniqueSuffix()}`;
+		if (!await cloneDir(srcDir, tmp)) {
+			this._cloneDirs = false;
+			logger$1.debug(`fyn-central: can't clone dirs from ${this._centralDir}, cloning files instead`);
+			return false;
+		}
+		try {
+			await file_ops_default.rename(tmp, destDir);
+			return true;
+		} catch (err) {
+			await file_ops_default.$.rimraf(tmp);
+			const code = err.code;
+			if (code === "ENOTEMPTY" || code === "EEXIST") return false;
+			throw err;
+		}
 	}
+	/** Extract a tarball and build its tree from the tar headers. */
 	_untarStream(tarStream, targetDir) {
-		const newDirObj = () => {
-			const n = Object.create(null);
-			n["/"] = Object.create(null);
-			return n;
-		};
-		const dirTree = newDirObj();
 		const strip = 1;
+		const { onentry, result } = treeCollector(strip);
 		const untarStream = So({
 			strip,
 			strict: true,
 			C: targetDir,
-			onentry: (entry) => {
-				const parts = entry.path.split(/\/|\\/);
-				const isDir = entry.type === "Directory";
-				const wtree = parts.slice(strip, isDir ? parts.length : parts.length - 1).reduce((wt, dir) => {
-					return wt[dir] || (wt[dir] = newDirObj());
-				}, dirTree);
-				if (isDir) return;
-				const fname = parts[parts.length - 1];
-				if (fname) {
-					const m = Math.round((entry.mtime ? entry.mtime.getTime() : Date.now()) / 1e3);
-					wtree["/"][fname] = {
-						z: entry.size,
-						m,
-						$: entry.header.cksumValid && entry.header.cksum
-					};
-				}
-			}
+			onentry
 		});
-		return missPipe(tarStream, untarStream).then(() => dirTree);
+		return missPipe(tarStream, untarStream).then(() => result);
 	}
-	async _acquireTmpLock(info) {
-		const tmpLock = `${info.contentPath}.lock`;
+	/**
+	* Claim the `.extracting` marker that tells other installs this one is writing the entry.
+	* mkdir is atomic, so only one install gets it. A marker older than STALE_MS was left by an
+	* install that died, so it is taken over.
+	*
+	* @returns true when this install owns the marker
+	*/
+	async _claimMarker(marker, retry = true) {
 		try {
-			await file_ops_default.$.mkdirp(Path.dirname(info.contentPath));
-			await file_ops_default.$.acquireLock(tmpLock, {
-				wait: 3e5,
-				pollPeriod: 500,
-				stale: 3e5
-			});
+			await file_ops_default.mkdir(marker);
+			return true;
 		} catch (err) {
-			logger$1.error("fyn-central - unable to acquire tmp lock", tmpLock);
-			const msg = err.message && err.message.replace(tmpLock, "<lockfile>");
-			throw new Error(`Unable to acquire fyn-central tmp lock ${tmpLock} - ${msg}`);
+			if (err.code !== "EEXIST") throw err;
 		}
-		return tmpLock;
+		const stat = await file_ops_default.stat(marker).catch(() => void 0);
+		if (retry && (!stat || Date.now() - stat.mtimeMs > 3e5)) {
+			await file_ops_default.$.rimraf(marker);
+			return this._claimMarker(marker, false);
+		}
+		return false;
 	}
-	async _storeTarStream(info, _integrity, _stream) {
+	/** Remove temp and trash dirs that installs which died left next to the entry. */
+	async _removeStaleTemps(contentPath) {
+		const dir = Path.dirname(contentPath);
+		const base = Path.basename(contentPath);
+		for (const name of await file_ops_default.readdir(dir)) {
+			if (!name.startsWith(`${base}.tmp`) && !name.startsWith(`${base}.del-`)) continue;
+			const stat = await file_ops_default.stat(Path.join(dir, name)).catch(() => void 0);
+			if (stat && Date.now() - stat.mtimeMs > 3e5) await file_ops_default.$.rimraf(Path.join(dir, name));
+		}
+	}
+	/**
+	* Extract into a temp dir only this call uses, then rename it into place. The rename is
+	* atomic, so other installs see the entry complete or not at all. If another install renamed
+	* its copy in first, that copy has the same integrity, so this one is dropped for it.
+	*
+	* With an fs worker, storeTarStream hands the whole job to _storeInWorker instead.
+	*/
+	async _storeTarStream(info, _stream) {
 		let stream = _stream;
-		const tmp = `${info.contentPath}.tmp`;
-		await file_ops_default.$.rimraf(tmp);
-		const targetDir = Path.join(tmp, "package");
-		await file_ops_default.$.mkdirp(targetDir);
-		if (typeof stream === "function") stream = stream();
-		if (stream.then) stream = await stream;
-		info.tree = await this._untarStream(stream, targetDir);
-		info.shaSum = await this._calcContentShasum(info, targetDir);
-		await this.saveInfoTree(info, tmp);
-		await file_ops_default.rename(tmp, info.contentPath);
+		const tmp = `${info.contentPath}.tmp-${uniqueSuffix()}`;
+		try {
+			const targetDir = Path.join(tmp, "package");
+			await file_ops_default.$.mkdirp(targetDir);
+			if (typeof stream === "function") stream = stream();
+			if (stream.then) stream = await stream;
+			const { tree, fromHeaders } = await this._untarStream(stream, targetDir);
+			info.tree = tree;
+			info.shaSum = fromHeaders ? this._treeShasum(tree) : (await this._scanShasums(targetDir))?.v2;
+			info.sumVersion = 2;
+			await this.saveInfoTree(info, tmp);
+			try {
+				await file_ops_default.rename(tmp, info.contentPath);
+			} catch (err) {
+				const code = err.code;
+				if (![
+					"ENOTEMPTY",
+					"EEXIST",
+					"EPERM"
+				].includes(code) || !await file_ops_default.exists(info.contentPath)) throw err;
+				logger$1.debug("fyn-central: another install stored it first", info.contentPath);
+				await file_ops_default.$.rimraf(tmp);
+				await this.readInfoTree(info);
+			}
+		} catch (err) {
+			await file_ops_default.$.rimraf(tmp);
+			throw err;
+		}
 		info.exist = true;
 	}
 	/**
@@ -97509,46 +98435,100 @@ var FynCentral = class {
 		const info = this._map.get(integrity);
 		if (info === void 0 || !info.exist) return false;
 		if (info.validated === void 0) {
-			const sum = await this.getContentShasum(integrity);
-			if (!info.shaSum) {
-				info.shaSum = sum;
-				await this.saveInfoTree(info);
+			const pkgDir = Path.join(info.contentPath, "package");
+			const pool = getFsWorkerPool();
+			const sums = pool ? await pool.run("scan", { dir: pkgDir }) : await this._scanShasums(pkgDir);
+			if (info.sumVersion === 2) info.validated = Boolean(sums) && info.shaSum === sums.v2;
+			else {
+				info.validated = Boolean(sums) && (!info.shaSum || info.shaSum === sums.v1);
+				if (info.validated) {
+					info.shaSum = sums.v2;
+					info.sumVersion = 2;
+					await this.saveInfoTree(info);
+				}
 			}
-			info.validated = info.shaSum === sum;
 		}
 		return info.validated;
 	}
-	async storeTarStream(pkgId, integrity, stream) {
-		let tmpLock = false;
+	/**
+	* Store a package's tarball in the central store. Installs never wait on each other: each
+	* extracts into its own temp dir and renames it into place.
+	*
+	* While extracting, an install holds the entry's `.extracting` marker. With `deferIfBusy`, a
+	* live marker from another install returns false without reading the stream, so the caller
+	* can do its other packages first and come back to this one.
+	*
+	* @param tarSource - resolves the tarball's file on disk or its bytes, when it has either, so
+	*   an fs worker can untar it instead of the stream
+	* @returns false when deferred, true when the package is in the store
+	*/
+	async storeTarStream(pkgId, integrity, stream, deferIfBusy = false, tarSource) {
 		let currentStream = stream;
+		let marker;
 		try {
-			let info = await this._loadTree(integrity);
+			const pool = tarSource && getFsWorkerPool();
+			const source = pool && await tarSource();
+			if (source) return await this._storeInWorker(pool, source, pkgId, integrity, deferIfBusy);
+			const info = await this._loadTree(integrity);
 			if (info.exist) {
 				logger$1.debug("fyn-central storeTarStream: already exist", info.contentPath);
 				if (!info.tree) logger$1.error(`fyn-central exist package missing tree.json`);
-			} else {
-				tmpLock = await this._acquireTmpLock(info);
-				info = await this._loadTree(integrity, info, true);
-				if (info.exist) {
-					logger$1.debug("fyn-central storeTarStream: found after lock acquired", info.contentPath);
-					if (!info.tree) {
-						const msg = `fyn-central content exist but no tree.json ${info.contentPath}`;
-						logger$1.error(msg);
-						throw new Error(msg);
-					}
-				} else {
-					logger$1.debug("storing tar to central store", pkgId, integrity);
-					await this._storeTarStream(info, integrity, currentStream);
-					currentStream = void 0;
-					this._map.set(integrity, info);
-					logger$1.debug("fyn-central storeTarStream: stored", pkgId, info.contentPath);
-				}
+				return true;
+			}
+			const entryDir = Path.dirname(info.contentPath);
+			if (!this._madeDirs.has(entryDir)) {
+				await file_ops_default.$.mkdirp(entryDir);
+				this._madeDirs.add(entryDir);
+			}
+			const markerPath = `${info.contentPath}.extracting`;
+			if (await this._claimMarker(markerPath)) {
+				marker = markerPath;
+				if ((await this._loadTree(integrity, info)).exist) return true;
+				await this._removeStaleTemps(info.contentPath);
+			} else if (deferIfBusy) {
+				logger$1.debug("fyn-central: another install is storing it, deferring", pkgId);
+				return false;
 			}
+			if (await file_ops_default.exists(info.contentPath)) await this._removeBrokenEntry(info.contentPath);
+			logger$1.debug("storing tar to central store", pkgId, integrity);
+			await this._storeTarStream(info, currentStream);
+			currentStream = void 0;
+			this._map.set(integrity, info);
+			this._missing.delete(integrity);
+			logger$1.debug("fyn-central storeTarStream: stored", pkgId, info.contentPath);
+			return true;
 		} finally {
 			if (currentStream && currentStream.destroy !== void 0) currentStream.destroy();
-			if (tmpLock) await file_ops_default.$.releaseLock(tmpLock);
+			if (marker) await file_ops_default.rmdir(marker).catch(() => void 0);
 		}
 	}
+	/** storeTarStream's steps, run by an fs worker with sync calls, marker and all */
+	async _storeInWorker(pool, source, pkgId, integrity, deferIfBusy) {
+		const info = this._map.get(integrity) ?? this._missing.get(integrity) ?? this._analyze(integrity);
+		const result = await pool.run("store", {
+			...source,
+			integrity,
+			contentPath: info.contentPath,
+			deferIfBusy
+		});
+		if (result.busy) {
+			logger$1.debug("fyn-central: another install is storing it, deferring", pkgId);
+			return false;
+		}
+		if (result.stored) {
+			info.tree = result.tree;
+			info.shaSum = result.stored.shaSum;
+			info.sumVersion = result.stored.sumVersion;
+			info.exist = true;
+			this._map.set(integrity, info);
+			this._missing.delete(integrity);
+			logger$1.debug("fyn-central storeTarStream: stored", pkgId, info.contentPath);
+		} else {
+			logger$1.debug("fyn-central: the entry is in place already", info.contentPath);
+			if (!(await this._loadTree(integrity, info)).tree) logger$1.error(`fyn-central exist package missing tree.json`);
+		}
+		return true;
+	}
 };
 
 //#endregion
@@ -99499,19 +100479,10 @@ function applyChalkMethod(chalkInstance, name, values) {
 	throw new TypeError(`${name} is not a chalk function`);
 }
 function decodeHtml(str) {
-	return str.replace(/&[\w#]+;/g, (m) => {
-		if (Object.prototype.hasOwnProperty.call(htmlEntities, m)) return htmlEntities[m];
-		if (m.startsWith("&#x")) {
-			const s = m.substring(3, m.length - 1);
-			const p = parseInt(s, 16);
-			return String.fromCodePoint(p);
-		}
-		if (m.startsWith("&#")) {
-			const s = m.substring(2, m.length - 1);
-			const p = parseInt(s, 10);
-			return String.fromCodePoint(p);
-		}
-		return m;
+	return str.replace(/&(?:#[xX]([0-9a-fA-F]+)|#([0-9]+)|\w+);/g, (m, hex, dec) => {
+		if (hex === void 0 && dec === void 0) return Object.prototype.hasOwnProperty.call(htmlEntities, m) ? htmlEntities[m] : m;
+		const p = hex !== void 0 ? parseInt(hex, 16) : parseInt(dec, 10);
+		return p <= 1114111 ? String.fromCodePoint(p) : m;
 	});
 }
 function applyChalkMarkers(markers, text, userChalk) {
@@ -99553,18 +100524,19 @@ function applyChalkMarkers(markers, text, userChalk) {
 	co(typeof chalkify === "function", `final chalk value is not a function after applying ${markers}`);
 	return chalkify(text);
 }
+const MARKERS_RE = /<[^>]*>/g;
 function remove(s, keepHtml) {
-	const r = s.replace(/<[^>]*>/g, "").trim();
+	const r = s.replace(MARKERS_RE, "");
 	return keepHtml ? r : decodeHtml(r);
 }
 function format$1(s, instance, userChalk) {
 	userChalk = normalizeColors(userChalk || instance.CHALK);
-	if (userChalk.supportsColor === false) return remove(s);
-	const tks = s && s.match(/(<[^>]+>|[^<>]+)/g);
+	const off = userChalk.supportsColor === false;
+	const tks = s && s.match(/<[^<>]+>|[^<>]+|[<>]/g);
 	if (!tks) return s || "";
-	return decodeHtml(tks.reduceRight((a, e, ix) => {
+	const colorized = tks.reduceRight((a, e, ix) => {
 		const lvl = a[a.length - 1];
-		if (e[0] !== "<") {
+		if (e[0] !== "<" || e.length === 1) {
 			lvl.s = e + lvl.s;
 			return a;
 		}
@@ -99577,20 +100549,27 @@ function format$1(s, instance, userChalk) {
 			return a;
 		}
 		if (a.length === 1) {
+			if (off) return a;
 			const partial = tks.slice(0, ix).join("") + `[${tks[ix]}]` + (tks.length > ix + 1 ? "..." : "");
 			throw new Error(`unbalanced open/close markers: ${partial}`);
 		}
 		const mk = e.substring(1, e.length - 1);
-		if (lvl.mk && mk !== lvl.mk) {
+		if (lvl.mk && mk !== lvl.mk && !off) {
 			const partial = tks.slice(0, ix).join("") + `[** ${tks[ix]} **]` + tks.slice(ix + 1, lvl.ix).join("") + `[** ${tks[lvl.ix]} **]`;
 			throw new Error(`mismatch markers: ${partial}`);
 		}
-		const t = applyChalkMarkers(mk, lvl.s, userChalk);
+		const t = off ? lvl.s : applyChalkMarkers(mk, lvl.s, userChalk);
 		a.pop();
 		const nl = a.length - 1;
 		a[nl].s = t + a[nl].s;
 		return a;
-	}, [{ s: "" }])[0].s);
+	}, [{ s: "" }]);
+	while (colorized.length > 1) {
+		const lvl = colorized.pop();
+		const nl = colorized.length - 1;
+		colorized[nl].s = lvl.s + tks[lvl.ix] + colorized[nl].s;
+	}
+	return decodeHtml(colorized[0].s);
 }
 /**
 * Build a chalker bound to a specific colors module.
@@ -101659,6 +102638,25 @@ async function syncLocalExports(options) {
 const createLock$1 = Util.promisify(import_lockfile.lock);
 const unlock$1 = Util.promisify(import_lockfile.unlock);
 const { posixify } = fyntil;
+/** FYN_SHORT_PKG_DIR is on only for "1" or "true" (any case); any other value is off. */
+function shortPkgDirFromEnv() {
+	const v = (process.env.FYN_SHORT_PKG_DIR || "").toLowerCase();
+	return v === "1" || v === "true";
+}
+/**
+* Whether an install lock was left by a process on this host that no longer runs. A lock
+* without an owner, from an older fyn, is left to lockfile's stale time.
+*/
+async function installLockOwnerGone(fname) {
+	try {
+		const { pid, host } = JSON.parse(await file_ops_default.readFile(fname, "utf8"));
+		if (host !== os$1.hostname() || !Number.isInteger(pid)) return false;
+		process.kill(pid, 0);
+		return false;
+	} catch (err) {
+		return err.code === "ESRCH";
+	}
+}
 var Fyn = class Fyn {
 	_cliSource;
 	_shownMissingFiles;
@@ -101726,7 +102724,7 @@ var Fyn = class Fyn {
 			logger$1.info("dep lock time set to", this._lockTime.toString());
 		}
 		this._installConfig = { time: 0 };
-		this._shortPkgDir = Boolean(process.env.FYN_SHORT_PKG_DIR);
+		this._shortPkgDir = shortPkgDirFromEnv();
 		if (!_fynpo) this._fynpo = {};
 		else if (typeof _fynpo === "object") this._fynpo = _fynpo;
 	}
@@ -101809,8 +102807,11 @@ var Fyn = class Fyn {
 		} else if (options.centralStore) {
 			centralDir = Path.join(this.fynDir, "_central-storage");
 			logger$1.debug(`Enabling central store by CLI flag using dir ${centralDir}`);
-		} else if (!this._fynpo?.config) return this._central = false;
-		else {
+		} else if (!this._fynpo?.config) {
+			if (!await this._defaultCentralStore()) return this._central = false;
+			centralDir = Path.join(this.fynDir, "_central-storage");
+			logger$1.debug(`Enabling central store by default using dir ${centralDir}`);
+		} else {
 			centralDir = this._fynpo.config.centralDir;
 			if (!centralDir) {
 				const storeBaseDir = await fyntil.resolveGitMainWorktreeDir(this._fynpo.dir);
@@ -101827,15 +102828,31 @@ var Fyn = class Fyn {
 		}
 		return this._central = new FynCentral({
 			centralDir,
-			hardlink: this.hardlink
+			hardlink: this.hardlink,
+			reflink: this.reflink,
+			copyFallback: this.copyFallback
 		});
 	}
 	/**
-	* The central store only pays off when node_modules links to it. Copying out of it writes
-	* every file twice, so it's skipped when linking is known to be impossible.
+	* A new install uses the central store on macOS when @fynjs/reflink can clone dirs, and on
+	* Linux when it can hardlink or clone, since warm installs then run 2-3x faster than copying.
+	* Files are cloned where possible, else hardlinked, else copied. A .fyn.json that saved
+	* centralDir false keeps copying, and --no-central-store opts out.
+	*/
+	async _defaultCentralStore() {
+		if (this._options.centralStore !== void 0 || this._installConfig.centralDir !== void 0) return false;
+		if (process.platform === "darwin") return this.reflink && Boolean(await loadReflinkCloneDir());
+		if (process.platform === "linux") return this.hardlink || this.reflink && Boolean(await loadReflinkCloneFiles());
+		return false;
+	}
+	/**
+	* The central store only pays off when node_modules links or clones from it. Copying out of
+	* it writes every file twice, so it's skipped when neither is known to be possible.
 	*/
 	async _centralCopyOnlyReason(centralDir) {
-		if (!this.hardlink && ["darwin", "win32"].includes(process.platform)) return "hardlink is off";
+		if (!this.copyFallback) return;
+		if (!this.hardlink && !this.reflink) return "hardlink and reflink are off";
+		if (!this.hardlink && ["darwin", "win32"].includes(process.platform) && !await loadReflinkCloneFiles()) return "hardlink is off and @fynjs/reflink isn't loaded";
 		const deviceOf = async (dir) => {
 			for (;;) try {
 				return (await file_ops_default.stat(dir)).dev;
@@ -102425,9 +103442,6 @@ var Fyn = class Fyn {
 	get refreshOptionals() {
 		return this._options.refreshOptionals;
 	}
-	get ignoreDist() {
-		return this._options.ignoreDist;
-	}
 	get production() {
 		return this._options.production;
 	}
@@ -102441,9 +103455,20 @@ var Fyn = class Fyn {
 		if (process.env.FYN_HARDLINK !== void 0) return fyntil.strToBool(process.env.FYN_HARDLINK);
 		return this._installConfig.hardlink !== false;
 	}
+	/** --no-reflink never clones store files into node_modules, so @fynjs/reflink isn't used */
+	get reflink() {
+		return this._options.reflink !== false;
+	}
+	/** --no-copy-fallback fails the install on a store file that can't be cloned or hardlinked */
+	get copyFallback() {
+		return this._options.copyFallback !== false;
+	}
 	get concurrency() {
 		return this._options.concurrency;
 	}
+	get extractConcurrency() {
+		return this._options.extractConcurrency;
+	}
 	get deepResolve() {
 		return this._options.deepResolve;
 	}
@@ -102574,10 +103599,18 @@ var Fyn = class Fyn {
 	async createInstallLock() {
 		await this.createDir(this.getFvDir());
 		const fname = this.getFvDir(".installing.lock");
+		if (await installLockOwnerGone(fname)) {
+			logger$1.debug(`taking over ${fname}, its install process is gone`);
+			await file_ops_default.unlink(fname).catch(() => void 0);
+		}
 		await createLock$1(fname, {
 			wait: 3e3,
 			stale: 18e5
 		});
+		await file_ops_default.writeFile(fname, JSON.stringify({
+			pid: process.pid,
+			host: os$1.hostname()
+		}));
 		return true;
 	}
 	/**
@@ -102706,9 +103739,10 @@ var Fyn = class Fyn {
 		}
 		return null;
 	}
-	async loadJsonForPkg(pkg, dir) {
+	/** @param placed - package.json as an fs worker placed it, so it isn't read back */
+	async loadJsonForPkg(pkg, dir, placed) {
 		const fullOutDir = dir || this.getInstalledPkgDir(pkg.name, pkg.version, pkg);
-		const json = await fyntil.readPkgJson(fullOutDir, true);
+		const json = await fyntil.readPkgJson(fullOutDir, true, false, placed?.str);
 		const pkgId = `${pkg.name}@${pkg.version}`;
 		const id = `${json.name}@${json.version}`;
 		if (json.version !== pkg.version) {
@@ -102732,13 +103766,11 @@ var Fyn = class Fyn {
 		}
 		pkg.dir = json[PACKAGE_RAW_INFO].dir;
 		pkg.str = json[PACKAGE_RAW_INFO].str;
-		try {
-			const gypFile = Path.join(fullOutDir, "binding.gyp");
-			await file_ops_default.lstat(gypFile);
+		if (placed?.gyp ?? await file_ops_default.lstat(Path.join(fullOutDir, "binding.gyp")).then(() => true, () => false)) {
 			json.gypfile = true;
 			const scr = json.scripts;
 			if (isEmpty(scr) || !scr.install && !scr.postinstall && !scr.postInstall) set(json, "scripts.install", "node-gyp rebuild");
-		} catch (err) {}
+		}
 		pkg.json = json;
 		return json;
 	}
@@ -105006,13 +106038,15 @@ const showOutdated = async (fyn, options = {}) => {
 /**
 * Audit cache utilities for storing/retrieving npm security advisory data.
 *
-* Advisories are immutable - once an advisory exists for a specific package@version,
-* it doesn't change. Therefore we cache indefinitely (no TTL check needed).
+* New advisories get published against versions that already exist, and a pinned lockfile
+* keeps the same cache key for a long time. So entries expire after AUDIT_CACHE_TTL.
 *
 * Cache key is generated from SHA256 hash of the sorted bulk request payload,
 * ensuring different dependency sets get different cache entries.
 */
 const AUDIT_CACHE_PREFIX = "fyn-audit-";
+/** How long a cached audit result stays fresh, in ms. */
+const AUDIT_CACHE_TTL = 18e5;
 /**
 * Generate a deterministic cache key from the bulk request payload.
 * Sorts package names and versions to ensure same dependencies = same key.
@@ -105036,12 +106070,17 @@ async function cacheAuditResult(cacheDir, key, result) {
 }
 /**
 * Retrieve cached audit result.
-* Returns null if not found (cache miss).
+* Returns null if not found, or if `maxAge` (ms) is given and the entry is older than that.
 */
-async function getCachedAuditResult(cacheDir, key) {
+async function getCachedAuditResult(cacheDir, key, maxAge) {
 	const auditCacheDir = Path.join(cacheDir, "audit");
+	const cacache = await loadCacache();
 	try {
-		const { data } = await (await loadCacache()).get(auditCacheDir, key);
+		if (maxAge !== void 0) {
+			const info = await cacache.get.info(auditCacheDir, key);
+			if (!info || Date.now() - info.time > maxAge) return null;
+		}
+		const { data } = await cacache.get(auditCacheDir, key);
 		return JSON.parse(data.toString());
 	} catch (err) {
 		const code = err.code;
@@ -105057,7 +106096,7 @@ async function getCachedAuditResult(cacheDir, key) {
 *
 * Workflow:
 * 1. Build bulk payload from resolved DepData.pkgs
-* 2. Check cache for existing advisories
+* 2. Check cache for advisories fetched within AUDIT_CACHE_TTL
 * 3. If miss, POST to /-/npm/v1/security/advisories/bulk
 * 4. Cache response and return
 */
@@ -105166,7 +106205,7 @@ var AuditReport = class {
 		}
 		const cacheKey = generateCacheKey(payload);
 		if (!this._noCache) {
-			const cached = await getCachedAuditResult(this._cacheDir, cacheKey);
+			const cached = await getCachedAuditResult(this._cacheDir, cacheKey, AUDIT_CACHE_TTL);
 			if (cached) {
 				logger$1.debug("Using cached audit result");
 				return cached;
@@ -105306,6 +106345,12 @@ var AuditFormatter = class {
 		return this.getSeverityLevel(severity) >= this.getSeverityLevel(this._auditLevel);
 	}
 	/**
+	* Exit code like npm audit: 1 when any vulnerability meets the audit level.
+	*/
+	exitCodeFor(filtered) {
+		return filtered.length > 0 ? 1 : 0;
+	}
+	/**
 	* Colorize text based on severity.
 	*/
 	colorize(text, severity) {
@@ -105343,7 +106388,7 @@ var AuditFormatter = class {
 		const total = filtered.length;
 		return {
 			output: `audited ${pkgCount} packages\n\n${total} ${total === 1 ? "vulnerability" : "vulnerabilities"} (${parts.join(", ")})\n\nRun \`fyn audit\` for details.`,
-			exitCode: 0
+			exitCode: 1
 		};
 	}
 	/**
@@ -105357,7 +106402,7 @@ var AuditFormatter = class {
 				metadata: auditResult.metadata,
 				advisories: auditResult.advisories
 			}, null, 2),
-			exitCode: 0
+			exitCode: this.exitCodeFor(filtered)
 		};
 	}
 	/**
@@ -105404,7 +106449,7 @@ var AuditFormatter = class {
 		lines.push("");
 		return {
 			output: lines.join("\n"),
-			exitCode: 0
+			exitCode: this.exitCodeFor(filtered)
 		};
 	}
 	/**
@@ -105481,6 +106526,9 @@ var ShowAudit = class {
 	}
 	/**
 	* Run the audit workflow.
+	*
+	* @returns exit code like npm audit: 1 if a vulnerability meets the audit level
+	*   or the audit fails, else 0. Errors are logged, not thrown.
 	*/
 	async runAudit() {
 		const spinner = cli_logger_default.spinners[1];
@@ -105499,7 +106547,7 @@ var ShowAudit = class {
 			}
 			if (Object.keys(depData.pkgs).length === 0) {
 				logger$1.info("No dependencies to audit");
-				return;
+				return 0;
 			}
 			logger$1.addItem({
 				name: FETCH_META,
@@ -105529,7 +106577,7 @@ var ShowAudit = class {
 				statProvider
 			});
 			if (statProvider) await formatter.precomputeStats(vulnerabilities);
-			const { output } = formatter.format(auditResult, vulnerabilities);
+			const { output, exitCode } = formatter.format(auditResult, vulnerabilities);
 			if (output) console.log(output);
 			if (this._opts.auditFile) {
 				const { output: jsonOutput } = new AuditFormatter({
@@ -105541,10 +106589,12 @@ var ShowAudit = class {
 				const targetPath = Path.isAbsolute(this._opts.auditFile) ? this._opts.auditFile : Path.join(baseDir, this._opts.auditFile);
 				await fs.promises.writeFile(targetPath, jsonOutput, "utf8");
 			}
+			return exitCode;
 		} catch (err) {
 			logger$1.removeItem(FETCH_META);
 			logger$1.error("Audit failed:", err.message);
 			if (process.env.FYN_DEBUG) logger$1.error(err.stack);
+			return 1;
 		}
 	}
 };
@@ -105845,7 +106895,7 @@ async function fetchDistTags2(baseUrl, _authToken, options) {
 	try {
 		return (await options.fetchJSON(pkUrl.toString(), { headers }))["dist-tags"];
 	} catch (_a) {
-		return {};
+		return;
 	}
 }
 /**
@@ -105859,7 +106909,7 @@ async function fetchDistTags2(baseUrl, _authToken, options) {
 function getNpmRegistryInfo(npmConfig, pkg) {
 	const pkgNames = pkg.name.split("/");
 	const scope = pkgNames.length > 1 ? pkgNames[0] : "";
-	const regKey = Object.keys(npmConfig).find((k) => k.endsWith("registry") && (!scope || k.startsWith(scope)));
+	const regKey = scope && Object.keys(npmConfig).find((k) => k.endsWith("registry") && k.startsWith(scope));
 	const registry = regKey && npmConfig[regKey] || npmConfig.registry || "https://registry.npmjs.org/";
 	const regHost = `//${new URL(registry).host}/`;
 	const authKey = Object.keys(npmConfig).find((k) => k.endsWith("_authToken") && k.startsWith(regHost));
@@ -105920,6 +106970,7 @@ async function _internalCheck(options) {
 		}));
 	};
 	if (shouldFetch) {
+		if (!distTags || typeof distTags !== "object") return false;
 		let notifiedVersion = typeof existMeta.notifiedVersion === "string" ? existMeta.notifiedVersion : "";
 		let notifiedTime = existMeta.notifiedTime || 0;
 		const checked = options.checkIsNewer(pkg, distTags, tag);
@@ -107097,6 +108148,18 @@ var FynCli = class {
 		const start = Date.now();
 		const runAudit = argv.opts?.audit !== false;
 		const auditFile = argv.opts?.auditFile;
+		const auditAfterInstall = async () => {
+			if (!runAudit) return;
+			try {
+				await showAudit(this.fyn, {
+					colors: this.fyn._options.colors !== false,
+					summary: true,
+					auditFile
+				});
+			} catch (err) {
+				logger$1.warn("Security audit failed:", err.message);
+			}
+		};
 		return dist_default.try(() => this.fyn._initializePkg()).then(async () => {
 			checkNewVersion(this.fyn._options);
 			if (!this.fyn._changeProdMode && !this.fyn._options.forceInstall && this.fyn._installConfig.fynlocal === Boolean(this.fyn.fynlocal) && this.fyn._installConfig.time) {
@@ -107211,19 +108274,13 @@ var FynCli = class {
 			const end = Date.now();
 			await this.fyn.saveFynpoIndirects();
 			logger$1.info(chalk.green("complete in total"), chalk.magenta(`${(end - start) / 1e3}`) + "secs");
-			if (runAudit) try {
-				await showAudit(this.fyn, {
-					colors: this.fyn._options.colors !== false,
-					summary: true,
-					auditFile
-				});
-			} catch (err) {
-				logger$1.warn("Security audit failed:", err.message);
-			}
-		}).catch((err) => {
-			if (err.message === "No Change") logger$1.info(`No changes detected since last fyn install - nothing to be done.
+			await auditAfterInstall();
+		}).catch(async (err) => {
+			if (err.message === "No Change") {
+				logger$1.info(`No changes detected since last fyn install - nothing to be done.
   To force install, run 'fyn install --force-install' or 'fyn install --fi'`);
-			else failure = err;
+				await auditAfterInstall();
+			} else failure = err;
 		}).finally(async () => {
 			const localPkgBuild = this.fyn._localPkgBuilder?.waitForDone();
 			if (localPkgBuild) try {
@@ -107288,16 +108345,16 @@ var FynCli = class {
 			if (this._opts.saveLogs) await this.saveLogs(this._opts.saveLogs);
 		}
 	}
-	audit(argv) {
+	async audit(argv) {
 		const opts = {
 			json: argv.opts?.json || false,
 			omit: argv.opts?.omit || [],
 			auditLevel: argv.opts?.auditLevel || "info",
-			noCache: argv.opts?.noCache || false
+			noCache: argv.opts?.cache === false
 		};
-		return showAudit(this.fyn, opts).finally(() => {
-			return this._opts.saveLogs && this.saveLogs(this._opts.saveLogs);
-		});
+		const exitCode = await showAudit(this.fyn, opts);
+		if (this._opts.saveLogs) await this.saveLogs(this._opts.saveLogs);
+		if (exitCode) fyntil.exit(exitCode);
 	}
 	/**
 	* Remove non-runtime files from a production node_modules. Only runs on demand,
@@ -107818,7 +108875,7 @@ var CliBase = class {
 		if (!args) return;
 		let seenOptional;
 		args.replace(/([<[])([^>\]]*)([>\]])/g, (a, mark, xname) => {
-			assert(!this.variadic, `For args specifier of '${this.name}', only the last one can be variadic`);
+			assert(!this.variadic, new InvalidArgSpecifierError(`For args specifier of '${this.name}', only the last one can be variadic`, args));
 			const xm = xname.match(/([^\. ]+)?( +)?([^\.]+)?(\.\.+)?([^\.,]*)?( *, *)?([^\.]+)?$/);
 			assert(xm, new InvalidArgSpecifierError(`Invalid args specifier '${xname}' for '${this.name}'.`));
 			let variadic;
@@ -108026,6 +109083,7 @@ var Options = class {
 	makeHelp() {
 		const width = this.findLongestOptionHelpText();
 		let help = [];
+		setHelpZebra(this.command.ncConfig?.helpZebra !== false);
 		resetZebraIndex();
 		for (const opt of Object.values(this._options)) {
 			const tail = [];
@@ -108249,6 +109307,7 @@ var CommandBase = class CommandBase extends CliBase {
 			data.push(strs);
 		}
 		const cmdWidth = data.reduce((max, n) => n[0].length > max ? n[0].length : max, 0);
+		setHelpZebra(this.ncConfig?.helpZebra !== false);
 		resetZebraIndex();
 		return data.reduce((help, strs) => {
 			const lines = fitLines(strs, "  ", "    ", cmdWidth, getTerminalWidth());
@@ -108489,6 +109548,9 @@ var CommandNode = class extends ClapNode {
 	* Allow you to apply extra config to the parsed object, overriding any `opts` with `source` not start with `cli`.
 	*
 	* For example, you can allow user to specify options in their `package.json` file, and apply those after the command line is parsed.
+	*
+	* Each key goes to this command and any parsed sub command that declares the option.
+	* Keys that match no declared option are ignored.
 	* @param config - Config object containing user options config
 	* @param src - Name of the source that provided the config.  Default to `user`
 	* @returns
@@ -108515,8 +109577,9 @@ var CommandNode = class extends ClapNode {
 						this.optCount[camelCaseKey] = this.optCount[matchOpt.name];
 					}
 				}
-			} else if (!this.optNodes[key]) new ClapNodeGenerator(this).addOptionWithArgs(key, [].concat(data.arg), void 0, src);
+			}
 		}
+		for (const name in this.subCmdNodes) this.subCmdNodes[name].applyConfig(config, src);
 		for (let command = this; command; command = command.getParent()) command._jsonMeta = void 0;
 	}
 	/**
@@ -108849,6 +109912,7 @@ var ClapNodeGenerator = class ClapNodeGenerator {
 			}
 			return [null];
 		}
+		if (this.optNode && this.takesNegativeNumber(opt)) return this.consumeNonOptAsOption(opt);
 		if (this.optNode) {
 			this.complete();
 			return [null].concat(this.parent.consumeOpt(opt));
@@ -108891,6 +109955,17 @@ var ClapNodeGenerator = class ClapNodeGenerator {
 		});
 	}
 	/**
+	* Whether this open option takes a negative number like `-5` as its next value.
+	* Boolean args don't, so `--flag -5` still reads `-5` as an option.
+	*
+	* @param arg - an argv entry that starts with '-'
+	*/
+	takesNegativeNumber(arg) {
+		if (!isNumber(arg)) return false;
+		const args = this.optNode.option.args;
+		return args[Math.min(this.node.argsList.length, args.length - 1)].type !== "boolean";
+	}
+	/**
 	*
 	* @param data
 	* @returns
@@ -108918,7 +109993,11 @@ var ClapNodeGenerator = class ClapNodeGenerator {
 			node.argsMap[argIx] = setValue;
 		};
 		if (opt.hasArgs) for (let i = 0; i < args.length && i < node.argsList.length; i++) setArg(i, args[i], node.argsList[i]);
-		else node.argsMap[0] = node.argsList.length > 0 ? this.convertValue(isBoolean(node.argsList[0]) ? "boolean" : isNumber(node.argsList[0]) ? "number" : "string", node.argsList[0], opt) : true;
+		else {
+			const value = node.argsList[0];
+			const isBool = isBoolean(value) || !opt.isUnknown && (value === "0" || value === "1");
+			node.argsMap[0] = node.argsList.length > 0 ? this.convertValue(isBool ? "boolean" : isNumber(value) ? "number" : "string", value, opt) : true;
+		}
 		if (args.length > 0 && args[args.length - 1].array) {
 			const lastIx = args.length - 1;
 			if (node.argsList.length > lastIx) setArg(lastIx, args[lastIx], node.argsList.slice(lastIx));
@@ -109248,7 +110327,6 @@ var NixClap = class extends EventEmitter$1 {
 		this._config = config;
 		this._name = config.name;
 		this._version = config.version || false;
-		setHelpZebra(config.helpZebra !== false);
 		this._versionAlias = config.versionAlias;
 		this._helpOpt = config.hasOwnProperty("help") ? config.help : {
 			[HELP]: true,
@@ -109284,10 +110362,13 @@ var NixClap = class extends EventEmitter$1 {
 			"parse-fail": (parsed) => this.showError(parsed.command.getErrorNodes()[0].error),
 			"no-action": () => this.showHelp(/* @__PURE__ */ new Error("No command given"))
 		};
-		if (!config.noDefaultHandlers) this.on("exit", defaultExit);
 		const handlers = config.handlers || {};
-		for (const [name, handler] of Object.entries(this._evtHandlers)) {
-			const h = handlers.hasOwnProperty(name) ? handlers[name] : handler;
+		const exitHandler = Object.hasOwn(handlers, "exit") ? handlers.exit : !config.noDefaultHandlers && defaultExit;
+		if (typeof exitHandler === "function") this.on("exit", exitHandler);
+		const names = /* @__PURE__ */ new Set([...Object.keys(this._evtHandlers), ...Object.keys(handlers)]);
+		names.delete("exit");
+		for (const name of names) {
+			const h = Object.hasOwn(handlers, name) ? handlers[name] : this._evtHandlers[name];
 			if (typeof h === "function") this.on(name, h);
 		}
 		this._skipExec = config.skipExec;
@@ -109356,6 +110437,23 @@ var NixClap = class extends EventEmitter$1 {
 		return this;
 	}
 	/**
+	* Make a copy of the help option without aliases that other options already use.
+	*/
+	_withFreeHelpAliases(existingOptions) {
+		const helpOpt = this._helpOpt;
+		const usedAliases = /* @__PURE__ */ new Set();
+		for (const optName in existingOptions) {
+			const opt = existingOptions[optName];
+			if (optName !== "help" && opt.alias) (Array.isArray(opt.alias) ? opt.alias : [opt.alias]).forEach((a) => usedAliases.add(a));
+		}
+		/* c8 ignore next 3 */
+		const helpAliases = helpOpt.alias ? Array.isArray(helpOpt.alias) ? helpOpt.alias : [helpOpt.alias] : [];
+		return {
+			...helpOpt,
+			alias: helpAliases.filter((a) => !usedAliases.has(a))
+		};
+	}
+	/**
 	* Recursively adds help option to all subcommands.
 	* Filters out help aliases that conflict with existing options in the subcommand.
 	*/
@@ -109364,18 +110462,9 @@ var NixClap = class extends EventEmitter$1 {
 		for (const name in commands) {
 			const cmd = commands[name];
 			const existingOptions = cmd.options || {};
-			const usedAliases = /* @__PURE__ */ new Set();
-			for (const optName in existingOptions) {
-				const opt = existingOptions[optName];
-				if (opt.alias) (Array.isArray(opt.alias) ? opt.alias : [opt.alias]).forEach((a) => usedAliases.add(a));
-			}
-			const filteredAliases = (this._helpOpt.alias ? Array.isArray(this._helpOpt.alias) ? this._helpOpt.alias : [this._helpOpt.alias] : []).filter((a) => !usedAliases.has(a));
 			if (!existingOptions.hasOwnProperty("help")) cmd.options = {
 				...existingOptions,
-				help: {
-					...this._helpOpt,
-					alias: filteredAliases
-				}
+				help: this._withFreeHelpAliases(existingOptions)
 			};
 			if (cmd.subCommands) this._addHelpToSubCommands(cmd.subCommands);
 		}
@@ -109396,13 +110485,13 @@ var NixClap = class extends EventEmitter$1 {
 			let verAlias = ["V", "v"];
 			Object.keys(options).forEach((k) => {
 				const opt = options[k];
-				if (opt.alias) verAlias = verAlias.filter((x) => opt.alias.indexOf(x) < 0);
+				if (opt.alias) verAlias = verAlias.filter((x) => ![].concat(opt.alias).includes(x));
 			});
 			options.version = this._getVersionOpt(verAlias);
 		}
 		if (this._helpOpt) {
 			options = { ...options };
-			options["help"] = this._helpOpt;
+			options["help"] = this._withFreeHelpAliases(options);
 			this._addHelpToSubCommands(commands);
 		}
 		this._options = options;
@@ -109581,6 +110670,7 @@ var NixClap = class extends EventEmitter$1 {
 	skipExec(skip = true) {
 		this._skipExec = skip;
 		this._skipExecDefault = skip;
+		return this;
 	}
 	/**
 	* Parses the given arguments and returns the result.
@@ -109671,9 +110761,10 @@ var NixClap = class extends EventEmitter$1 {
 			this._rootCommand.name = this._name;
 		}
 		const { command, index } = new Parser(this).parse(argv, start);
+		if (this._config.config) command.applyConfig(this._config.config(command) || {}, "user");
+		command.applyDefaults();
 		const missing = command.checkRequiredOptions();
 		if (missing.length > 0) command.addError(/* @__PURE__ */ new Error("missing these required options " + missing.join(", ")));
-		command.applyDefaults();
 		command.makeCamelCaseOptions();
 		const errorNodes = command.getErrorNodes();
 		return {
@@ -116550,8 +117641,7 @@ function setLogLevel(ll) {
 	if (ll) {
 		const levels = Object.keys(cli_logger_default.Levels);
 		const real = find(levels, (l) => l.startsWith(ll));
-		const x = real ? cli_logger_default.Levels[real] : void 0;
-		if (x !== void 0) logger$1._logLevel = x;
+		if ((real ? cli_logger_default.Levels[real] : void 0) !== void 0) logger$1.logLevel = real;
 		else {
 			logger$1.error(`Invalid log level "${ll}".  Supported levels are: ${levels.join(", ")}`);
 			fyntil.exit(1);
@@ -116691,12 +117781,21 @@ const options = {
 	"central-store": {
 		args: "<flag boolean>",
 		alias: ["central", "cs"],
-		desc: "keep single copy of packages in central store",
-		argDefault: "false"
+		desc: "keep single copy of packages in central store. On by default on macOS when @fynjs/reflink can clone, and on Linux when it can hardlink or clone, unless node_modules was installed without it. --no-central-store turns the default off"
 	},
 	hardlink: {
 		args: "<flag boolean>",
-		desc: "hardlink central store files into node_modules (default). --no-hardlink is remembered, and skips the central store on macOS and Windows, where it would only copy"
+		desc: "hardlink central store files into node_modules (default). --no-hardlink is remembered, and skips the central store on macOS and Windows, where it would only copy unless @fynjs/reflink can clone"
+	},
+	reflink: {
+		args: "<flag boolean>",
+		desc: "reflink (copy-on-write clone) central store files into node_modules where the filesystem can (default). --no-reflink never clones, so @fynjs/reflink isn't used",
+		argDefault: "true"
+	},
+	"copy-fallback": {
+		args: "<flag boolean>",
+		desc: "copy central store files that can't be cloned or hardlinked (default). --no-copy-fallback fails the install instead",
+		argDefault: "true"
 	},
 	copy: {
 		args: "[packages string..]",
@@ -116776,11 +117875,6 @@ const options = {
 		argDefault: "false",
 		desc: "force refresh package meta from registry"
 	},
-	"ignore-dist": {
-		alias: "i",
-		args: "<flag boolean>",
-		desc: "Ignore host in tarball URL from meta dist."
-	},
 	"ignore-lock-url": {
 		args: "<flag boolean>",
 		argDefault: "false",
@@ -116828,6 +117922,11 @@ const options = {
 		desc: "Max network concurrency (registry sockets)",
 		argDefault: "32"
 	},
+	"extract-concurrency": {
+		args: "<num number>",
+		alias: "excc",
+		desc: "Max packages extracted at once (default: CPU cores, at most 4)"
+	},
 	"auto-run": {
 		args: "<flag boolean>",
 		argDefault: "true",
@@ -116986,14 +118085,14 @@ const commands = {
 		args: "[packages string..]",
 		exec: async (cmd) => {
 			const json = Boolean(cmd.jsonMeta.opts.json);
-			const previousLogLevel = logger$1._logLevel;
+			const previousLogLevel = logger$1.logLevel;
 			if (json) cmd.jsonMeta.opts.logLevel = "none";
 			try {
 				const config = await pickOptions(cmd);
 				config.noStartupInfo = json;
 				return await new FynCli(config).outdated(cmd.jsonMeta);
 			} finally {
-				if (json) logger$1._logLevel = previousLogLevel;
+				if (json) logger$1.logLevel = previousLogLevel;
 			}
 		},
 		options: { json: {
@@ -117022,9 +118121,10 @@ const commands = {
 				desc: "Minimum severity level to report (info, low, moderate, high, critical)",
 				argDefault: "info"
 			},
-			"no-cache": {
+			cache: {
 				args: "<flag boolean>",
-				desc: "Bypass the audit cache and fetch fresh data"
+				desc: "use the audit cache (use --no-cache to fetch fresh data)",
+				argDefault: "true"
 			}
 		}
 	},
@@ -117051,7 +118151,7 @@ const commands = {
 				} else {
 					logger$1.error(chalk.red("Script execution failed:"));
 					logger$1.error(err.message || err.toString());
-					if (err.stack && logger$1._logLevel <= cli_logger_default.Levels.debug) logger$1.debug(err.stack);
+					if (err.stack && cli_logger_default.Levels[logger$1.logLevel] <= cli_logger_default.Levels.debug) logger$1.debug(err.stack);
 				}
 				fyntil.exit(typeof exitCode === "number" ? exitCode : 1);
 			}