knarr 0.0.1 → 0.0.3

package/dist/index.mjs

@@ -97,12 +97,12 @@ function pLimit(concurrency) {
       head = 0;
     }
   };
-  return (fn) => new Promise((resolve7, reject) => {
+  return (fn) => new Promise((resolve8, reject) => {
     const run = () => {
       fn().then(
         (val) => {
           active--;
-          resolve7(val);
+          resolve8(val);
           next();
         },
         (err) => {
@@ -126,19 +126,86 @@ var init_concurrency = __esm({
   }
 });
 
+// src/utils/validators.ts
+import { readFile } from "fs/promises";
+import { join } from "path";
+function validatePackageName(name) {
+  if (!name || name.length > 214 || CONTROL_CHARS_RE.test(name) || name.includes("\\") || name.includes("//") || name.split("/").some((part) => part === "." || part === "..") || !PACKAGE_NAME_RE.test(name)) {
+    throw new Error(`Invalid package name "${name}"`);
+  }
+}
+function validatePackageVersion(version) {
+  if (!version || CONTROL_CHARS_RE.test(version) || version.includes("/") || version.includes("\\") || version.includes("..") || !SEMVER_RE.test(version)) {
+    throw new Error(`Invalid package version "${version}"`);
+  }
+}
+function validatePackageIdentity(name, version) {
+  validatePackageName(name);
+  validatePackageVersion(version);
+}
+function isKnarrMeta(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value;
+  return typeof v.contentHash === "string" && typeof v.publishedAt === "string" && typeof v.sourcePath === "string" && (v.buildId === void 0 || typeof v.buildId === "string") && (v.schemaVersion === void 0 || typeof v.schemaVersion === "number");
+}
+function isLinkEntry(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value;
+  return typeof v.version === "string" && typeof v.contentHash === "string" && typeof v.linkedAt === "string" && typeof v.sourcePath === "string" && typeof v.backupExists === "boolean" && typeof v.packageManager === "string" && ["npm", "pnpm", "yarn", "bun"].includes(v.packageManager) && (v.buildId === void 0 || typeof v.buildId === "string");
+}
+function isConsumerState(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value;
+  if (v.version !== "1") return false;
+  if (typeof v.links !== "object" || v.links === null) return false;
+  const links = v.links;
+  for (const entry of Object.values(links)) {
+    if (!isLinkEntry(entry)) return false;
+  }
+  return true;
+}
+function isConsumersRegistry(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value;
+  for (const val of Object.values(v)) {
+    if (!Array.isArray(val)) return false;
+    for (const item of val) {
+      if (typeof item !== "string") return false;
+    }
+  }
+  return true;
+}
+var PACKAGE_NAME_RE, SEMVER_RE, CONTROL_CHARS_RE;
+var init_validators = __esm({
+  "src/utils/validators.ts"() {
+    "use strict";
+    PACKAGE_NAME_RE = /^(?:@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*$/;
+    SEMVER_RE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+    CONTROL_CHARS_RE = /[\x00-\x1F\x7F]/;
+  }
+});
+
 // src/utils/paths.ts
 import { homedir } from "os";
-import { join } from "path";
+import { isAbsolute, join as join2, relative, resolve } from "path";
+function assertInside(root, target, label) {
+  const resolvedRoot = resolve(root);
+  const resolvedTarget = resolve(target);
+  const rel = relative(resolvedRoot, resolvedTarget);
+  if (rel === "" || !rel.startsWith("..") && !isAbsolute(rel)) return;
+  throw new Error(`${label} escapes expected directory: ${target}`);
+}
 function getKnarrHome() {
-  return process.env.KNARR_HOME || join(homedir(), ".knarr");
+  return process.env.KNARR_HOME || join2(homedir(), ".knarr");
 }
 function getStorePath() {
-  return join(getKnarrHome(), "store");
+  return join2(getKnarrHome(), "store");
 }
 function getConsumersPath() {
-  return join(getKnarrHome(), "consumers.json");
+  return join2(getKnarrHome(), "consumers.json");
 }
 function encodePackageName(name) {
+  validatePackageName(name);
   return name.replace(/\//g, "+");
 }
 function decodePackageName(encoded) {
@@ -151,38 +218,54 @@ function decodePackageName(encoded) {
   return encoded;
 }
 function getStoreEntryPath(name, version) {
-  return join(getStorePath(), `${encodePackageName(name)}@${version}`);
+  validatePackageIdentity(name, version);
+  const root = getStorePath();
+  const target = join2(root, `${encodePackageName(name)}@${version}`);
+  assertInside(root, target, "Store entry path");
+  return target;
 }
 function getStorePackagePath(name, version) {
-  return join(getStoreEntryPath(name, version), "package");
+  return join2(getStoreEntryPath(name, version), "package");
 }
 function getStoreMetaPath(name, version) {
-  return join(getStoreEntryPath(name, version), ".knarr-meta.json");
+  return join2(getStoreEntryPath(name, version), ".knarr-meta.json");
 }
 function getStoreHistoryPath(name, version) {
-  return join(getStoreEntryPath(name, version), "history");
+  return join2(getStoreEntryPath(name, version), "history");
 }
 function getHistoryEntryPath(name, version, buildId) {
-  return join(getStoreHistoryPath(name, version), buildId);
+  if (!/^[a-f0-9]{8,64}$/i.test(buildId)) {
+    throw new Error(`Invalid build id "${buildId}"`);
+  }
+  return join2(getStoreHistoryPath(name, version), buildId);
 }
 function getConsumerKnarrDir(consumerPath) {
-  return join(consumerPath, ".knarr");
+  return join2(consumerPath, ".knarr");
 }
 function getConsumerStatePath(consumerPath) {
-  return join(consumerPath, ".knarr", "state.json");
+  return join2(consumerPath, ".knarr", "state.json");
 }
 function getConsumerBackupPath(consumerPath, packageName) {
-  return join(consumerPath, ".knarr", "backups", encodePackageName(packageName));
+  validatePackageName(packageName);
+  const root = join2(consumerPath, ".knarr", "backups");
+  const target = join2(root, encodePackageName(packageName));
+  assertInside(root, target, "Backup path");
+  return target;
 }
 function normalizePath(p) {
   return p.replace(/\\/g, "/");
 }
 function getNodeModulesPackagePath(consumerPath, packageName) {
-  return join(consumerPath, "node_modules", packageName);
+  validatePackageName(packageName);
+  const root = join2(consumerPath, "node_modules");
+  const target = join2(root, packageName);
+  assertInside(root, target, "node_modules package path");
+  return target;
 }
 var init_paths = __esm({
   "src/utils/paths.ts"() {
     "use strict";
+    init_validators();
   }
 });
 
@@ -209,8 +292,8 @@ var init_logger = __esm({
 
 // src/utils/hash.ts
 import { createHash } from "crypto";
-import { readFile, stat } from "fs/promises";
-import { relative } from "path";
+import { readFile as readFile2, stat } from "fs/promises";
+import { relative as relative2 } from "path";
 import { availableParallelism } from "os";
 function getXXHash() {
   if (!_xxhash) {
@@ -223,8 +306,8 @@ function getXXHash() {
 }
 async function computeContentHash(files, baseDir) {
   const sorted = [...files].sort((a, b) => {
-    const relA = normalizePath(relative(baseDir, a));
-    const relB = normalizePath(relative(baseDir, b));
+    const relA = normalizePath(relative2(baseDir, a));
+    const relB = normalizePath(relative2(baseDir, b));
     return relA.localeCompare(relB);
   });
   const currentFiles = new Set(sorted);
@@ -232,14 +315,14 @@ async function computeContentHash(files, baseDir) {
   const contents = await Promise.all(
     sorted.map(
       (file) => limit(async () => {
-        const rel = normalizePath(relative(baseDir, file));
+        const rel = normalizePath(relative2(baseDir, file));
         const s = await stat(file);
         const cached = _contentCache.get(file);
         if (cached && cached.mtimeMs === s.mtimeMs && cached.size === s.size) {
           cacheHits++;
           return { rel, content: cached.content };
         }
-        const content = await readFile(file);
+        const content = await readFile2(file);
         _contentCache.set(file, { mtimeMs: s.mtimeMs, size: s.size, content });
         return { rel, content };
       })
@@ -268,16 +351,16 @@ async function hashFile(filePath, knownSize) {
   if (size > STREAM_THRESHOLD) {
     return hashFileStream(filePath, xx);
   }
-  const content = await readFile(filePath);
+  const content = await readFile2(filePath);
   return xx.h64Raw(content).toString(16);
 }
 async function hashFileStream(filePath, xx) {
   const { createReadStream } = await import("fs");
   const hasher = xx.create64();
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     const stream = createReadStream(filePath);
     stream.on("data", (chunk) => hasher.update(chunk));
-    stream.on("end", () => resolve7(hasher.digest().toString(16)));
+    stream.on("end", () => resolve8(hasher.digest().toString(16)));
     stream.on("error", reject);
   });
 }
@@ -330,7 +413,8 @@ function printDryRunReport() {
     "bin-unlink": "Remove bin link",
     "cache-invalidate": "Invalidate cache",
     "lock-skip": "Skip lock",
-    "lifecycle-skip": "Skip lifecycle hook"
+    "lifecycle-skip": "Skip lifecycle hook",
+    "command-skip": "Skip command"
   };
   for (const [type, items] of grouped) {
     consola.info(`  ${labels[type]} (${items.length}):`);
@@ -385,7 +469,7 @@ import {
   writeFile,
   constants
 } from "fs/promises";
-import { join as join2, dirname, relative as relative2, parse as parsePath } from "path";
+import { join as join3, dirname, relative as relative3, parse as parsePath } from "path";
 import { availableParallelism as availableParallelism2 } from "os";
 function isNodeError(err) {
   return err instanceof Error && "code" in err;
@@ -424,7 +508,7 @@ async function copyWithCoW(src, dest, options) {
 }
 async function collectFiles(dir) {
   const entries = await readdir(dir, { recursive: true, withFileTypes: true });
-  return entries.filter((e) => e.isFile()).map((e) => join2(e.parentPath, e.name));
+  return entries.filter((e) => e.isFile()).map((e) => join3(e.parentPath, e.name));
 }
 async function incrementalCopy(srcDir, destDir, options = {}) {
   const srcFilesPromise = collectFiles(srcDir);
@@ -439,8 +523,8 @@ async function incrementalCopy(srcDir, destDir, options = {}) {
   const results = await Promise.all(
     srcFiles.map(
       (srcFile) => ioLimit(async () => {
-        const rel = relative2(srcDir, srcFile);
-        const destFile = join2(destDir, rel);
+        const rel = relative3(srcDir, srcFile);
+        const destFile = join3(destDir, rel);
         let needsCopy = true;
         let srcTimes = null;
         if (options.force) {
@@ -494,14 +578,14 @@ async function incrementalCopy(srcDir, destDir, options = {}) {
     if (r === "copied") copied++;
     else skipped++;
   }
-  const srcRelPaths = new Set(srcFiles.map((f) => relative2(srcDir, f)));
+  const srcRelPaths = new Set(srcFiles.map((f) => relative3(srcDir, f)));
   const filesToRemove = destFiles.filter(
-    (f) => !srcRelPaths.has(relative2(destDir, f))
+    (f) => !srcRelPaths.has(relative3(destDir, f))
   );
   await Promise.all(
     filesToRemove.map(
       (destFile) => ioLimit(async () => {
-        verbose(`[remove] ${relative2(destDir, destFile)} (no longer in source)`);
+        verbose(`[remove] ${relative3(destDir, destFile)} (no longer in source)`);
         if (isDryRun()) {
           recordMutation({ type: "remove", path: destFile });
         } else {
@@ -584,6 +668,11 @@ async function dirSize(dir) {
   }
 }
 async function copyDir(src, dest) {
+  if (isDryRun()) {
+    verbose(`[dry-run] would copy directory ${src} \u2192 ${dest}`);
+    recordMutation({ type: "copy", path: src, dest });
+    return;
+  }
   await cp(src, dest, { recursive: true });
 }
 var ioLimit, reflinkSupported;
@@ -601,19 +690,19 @@ var init_fs = __esm({
 });
 
 // src/utils/pack-list.ts
-import { readFile as readFile2, readdir as readdir2, stat as stat3 } from "fs/promises";
-import { join as join3, relative as relative3, resolve, sep } from "path";
+import { readFile as readFile3, readdir as readdir2, stat as stat3 } from "fs/promises";
+import { join as join4, relative as relative4, resolve as resolve2, sep } from "path";
 import picomatch from "picomatch";
 async function resolvePackFiles(packageDir, pkg) {
   const files = [];
-  const absDir = resolve(packageDir);
-  files.push(join3(absDir, "package.json"));
+  const absDir = resolve2(packageDir);
+  files.push(join4(absDir, "package.json"));
   const allFiles = await collectAllFiles(absDir, absDir);
-  const allRelPaths = allFiles.map((f) => normalizePath(relative3(absDir, f)));
+  const allRelPaths = allFiles.map((f) => normalizePath(relative4(absDir, f)));
   if (pkg.files && pkg.files.length > 0) {
     for (const pattern of pkg.files) {
-      const target = join3(absDir, pattern);
-      const resolved = resolve(target);
+      const target = join4(absDir, pattern);
+      const resolved = resolve2(target);
       if (!resolved.startsWith(absDir + sep) && resolved !== absDir) {
         consola.warn(`files pattern "${pattern}" escapes package directory, skipping`);
         continue;
@@ -622,7 +711,7 @@ async function resolvePackFiles(packageDir, pkg) {
       try {
         const s = await stat3(target);
         if (s.isDirectory()) {
-          const prefix = normalizePath(relative3(absDir, target)) + "/";
+          const prefix = normalizePath(relative4(absDir, target)) + "/";
           for (let i = 0; i < allRelPaths.length; i++) {
             if (allRelPaths[i].startsWith(prefix)) {
               files.push(allFiles[i]);
@@ -643,7 +732,7 @@ async function resolvePackFiles(packageDir, pkg) {
         let globMatched = 0;
         for (let i = 0; i < allRelPaths.length; i++) {
           if (isMatch(allRelPaths[i])) {
-            const absFile = resolve(allFiles[i]);
+            const absFile = resolve2(allFiles[i]);
             if (!absFile.startsWith(absDir + sep) && absFile !== absDir) continue;
             files.push(allFiles[i]);
             globMatched++;
@@ -665,7 +754,7 @@ async function resolvePackFiles(packageDir, pkg) {
   const fileSet = new Set(files);
   const allFileSet = new Set(allFiles);
   for (const name of ["README.md", "README", "LICENSE", "LICENCE", "CHANGELOG.md"]) {
-    const p = join3(absDir, name);
+    const p = join4(absDir, name);
     if (fileSet.has(p)) continue;
     if (!allFileSet.has(p)) continue;
     files.push(p);
@@ -691,7 +780,7 @@ function shouldIgnore(relPath, matchers) {
 async function loadNpmIgnore(dir) {
   const matchers = { literals: /* @__PURE__ */ new Set(), patterns: [], negations: [] };
   try {
-    const content = await readFile2(join3(dir, ".npmignore"), "utf-8");
+    const content = await readFile3(join4(dir, ".npmignore"), "utf-8");
     for (const line of content.split("\n")) {
       const trimmed = line.trim();
       if (!trimmed || trimmed.startsWith("#")) continue;
@@ -723,7 +812,7 @@ async function collectAllFiles(dir, rootDir) {
   try {
     const entries = await readdir2(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const full = join3(dir, entry.name);
+      const full = join4(dir, entry.name);
       if (entry.isDirectory()) {
         if (entry.name === ".git") continue;
         if (dir === rootDir && entry.name === "node_modules") continue;
@@ -779,47 +868,6 @@ var init_pack_list = __esm({
   }
 });
 
-// src/utils/validators.ts
-import { readFile as readFile3 } from "fs/promises";
-import { join as join4 } from "path";
-function isKnarrMeta(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const v = value;
-  return typeof v.contentHash === "string" && typeof v.publishedAt === "string" && typeof v.sourcePath === "string" && (v.buildId === void 0 || typeof v.buildId === "string") && (v.schemaVersion === void 0 || typeof v.schemaVersion === "number");
-}
-function isLinkEntry(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const v = value;
-  return typeof v.version === "string" && typeof v.contentHash === "string" && typeof v.linkedAt === "string" && typeof v.sourcePath === "string" && typeof v.backupExists === "boolean" && typeof v.packageManager === "string" && ["npm", "pnpm", "yarn", "bun"].includes(v.packageManager) && (v.buildId === void 0 || typeof v.buildId === "string");
-}
-function isConsumerState(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const v = value;
-  if (v.version !== "1") return false;
-  if (typeof v.links !== "object" || v.links === null) return false;
-  const links = v.links;
-  for (const entry of Object.values(links)) {
-    if (!isLinkEntry(entry)) return false;
-  }
-  return true;
-}
-function isConsumersRegistry(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const v = value;
-  for (const val of Object.values(v)) {
-    if (!Array.isArray(val)) return false;
-    for (const item of val) {
-      if (typeof item !== "string") return false;
-    }
-  }
-  return true;
-}
-var init_validators = __esm({
-  "src/utils/validators.ts"() {
-    "use strict";
-  }
-});
-
 // src/core/store.ts
 import { readFile as readFile4, readdir as readdir3 } from "fs/promises";
 import "path";
@@ -991,7 +1039,7 @@ __export(history_exports, {
   resolveHistoryLimit: () => resolveHistoryLimit,
   restoreHistoryEntry: () => restoreHistoryEntry
 });
-import { readdir as readdir4, readFile as readFile5, rename as rename2, writeFile as writeFile2 } from "fs/promises";
+import { readdir as readdir4, readFile as readFile5 } from "fs/promises";
 import { join as join6 } from "path";
 async function captureHistory(name, version, oldEntryDir, historyLimit) {
   const metaPath = join6(oldEntryDir, ".knarr-meta.json");
@@ -1021,11 +1069,11 @@ async function captureHistory(name, version, oldEntryDir, historyLimit) {
     if (await exists(oldPkgDir)) {
       await moveDir(oldPkgDir, join6(tmpHistoryEntry, "package"));
     }
-    await writeFile2(
+    await atomicWriteFile(
       join6(tmpHistoryEntry, ".knarr-meta.json"),
       JSON.stringify(meta, null, 2)
     );
-    await rename2(tmpHistoryEntry, entryDir);
+    await moveDir(tmpHistoryEntry, entryDir);
     verbose(`[history] Captured build ${buildId} to history`);
   } catch (err) {
     verbose(`[history] Failed to capture history: ${err instanceof Error ? err.message : String(err)}`);
@@ -1086,17 +1134,54 @@ async function restoreHistoryEntry(name, version, buildId, historyLimit) {
   const historyPkg = join6(historyEntryDir, "package");
   const historyMeta = join6(historyEntryDir, ".knarr-meta.json");
   const metaContent = await readFile5(historyMeta, "utf-8");
-  if (await exists(storeEntryDir)) {
-    await captureHistory(name, version, storeEntryDir, historyLimit);
-  }
   const storePkg = join6(storeEntryDir, "package");
   const storeMeta = join6(storeEntryDir, ".knarr-meta.json");
-  if (await exists(storePkg)) await removeDir(storePkg);
-  if (await exists(historyPkg)) {
+  if (!await exists(historyPkg)) {
+    throw new Error(`History entry ${buildId} is missing its package directory`);
+  }
+  const currentMetaContent = await readFile5(storeMeta, "utf-8").catch(() => null);
+  const oldEntryDir = storeEntryDir + `.restore-old-${process.pid}-${Date.now()}`;
+  const oldPkg = join6(oldEntryDir, "package");
+  let stagedOld = false;
+  let historyMovedToStore = false;
+  try {
+    if (await exists(storePkg) || currentMetaContent) {
+      await ensureDir(oldEntryDir);
+      if (await exists(storePkg)) {
+        await moveDir(storePkg, oldPkg);
+      }
+      if (currentMetaContent) {
+        await atomicWriteFile(join6(oldEntryDir, ".knarr-meta.json"), currentMetaContent);
+      }
+      stagedOld = true;
+    }
     await moveDir(historyPkg, storePkg);
+    historyMovedToStore = true;
+    await atomicWriteFile(storeMeta, metaContent);
+    await removeDir(historyEntryDir);
+    if (stagedOld) {
+      try {
+        await captureHistory(name, version, oldEntryDir, historyLimit);
+      } finally {
+        await removeDir(oldEntryDir);
+      }
+    }
+  } catch (err) {
+    if (historyMovedToStore && await exists(storePkg)) {
+      await ensureDir(historyEntryDir);
+      await moveDir(storePkg, historyPkg);
+    } else if (stagedOld && await exists(storePkg)) {
+      await removeDir(storePkg);
+    }
+    if (stagedOld && await exists(oldPkg)) {
+      await moveDir(oldPkg, storePkg);
+    }
+    if (currentMetaContent) {
+      await atomicWriteFile(storeMeta, currentMetaContent);
+    }
+    await removeDir(oldEntryDir);
+    throw err;
   }
-  await writeFile2(storeMeta, metaContent);
-  await removeDir(historyEntryDir);
   verbose(`[history] Restored build ${buildId} as current`);
   return entry;
 }
@@ -1147,7 +1232,7 @@ __export(workspace_exports, {
   parseCatalogs: () => parseCatalogs
 });
 import { readFile as readFile6, readdir as readdir5 } from "fs/promises";
-import { join as join7, dirname as dirname3, resolve as resolve2, relative as relative4 } from "path";
+import { join as join7, dirname as dirname3, resolve as resolve3, relative as relative5 } from "path";
 import picomatch2 from "picomatch";
 async function findWorkspaceRoot(startDir) {
   let dir = startDir;
@@ -1317,14 +1402,14 @@ async function resolveWorkspaceGlobs(rootDir, patterns, negations = []) {
         const isMatch = picomatch2(pattern);
         const candidates = await collectDirs(rootDir, 8);
         for (const candidate of candidates) {
-          const rel = normalizePath(relative4(rootDir, candidate));
+          const rel = normalizePath(relative5(rootDir, candidate));
           if (isMatch(rel) && await exists(join7(candidate, "package.json"))) {
             results.push(candidate);
           }
         }
       }
     } else {
-      const pkgDir = resolve2(rootDir, pattern);
+      const pkgDir = resolve3(rootDir, pattern);
       if (await exists(join7(pkgDir, "package.json"))) {
         results.push(pkgDir);
       }
@@ -1334,7 +1419,7 @@ async function resolveWorkspaceGlobs(rootDir, patterns, negations = []) {
   if (negations.length === 0) return unique;
   const isExcluded = picomatch2(negations);
   return unique.filter((dir) => {
-    const rel = normalizePath(relative4(rootDir, dir));
+    const rel = normalizePath(relative5(rootDir, dir));
     return !isExcluded(rel);
   });
 }
@@ -1420,8 +1505,8 @@ var init_workspace = __esm({
 });
 
 // src/core/publisher.ts
-import { readFile as readFile7, writeFile as writeFile3, rename as rename3, stat as stat5 } from "fs/promises";
-import { join as join8, relative as relative5, dirname as dirname4, resolve as resolve3 } from "path";
+import { readFile as readFile7, stat as stat5 } from "fs/promises";
+import { join as join8, relative as relative6, dirname as dirname4, resolve as resolve4 } from "path";
 import { spawn } from "child_process";
 import { platform } from "os";
 import { availableParallelism as availableParallelism3 } from "os";
@@ -1436,6 +1521,7 @@ async function publish(packageDir, options = {}) {
   const pkg = JSON.parse(pkgContent);
   if (!pkg.name) throw new Error("package.json missing 'name' field");
   if (!pkg.version) throw new Error("package.json missing 'version' field");
+  validatePackageIdentity(pkg.name, pkg.version);
   if (pkg.private && !options.allowPrivate) {
     throw new Error(
       `Package "${pkg.name}" is private. Use --private flag to publish private packages.`
@@ -1447,7 +1533,7 @@ async function publish(packageDir, options = {}) {
   }
   let publishDir = packageDir;
   if (pkg.publishConfig?.directory) {
-    publishDir = resolve3(packageDir, pkg.publishConfig.directory);
+    publishDir = resolve4(packageDir, pkg.publishConfig.directory);
     try {
       const s = await stat5(publishDir);
       if (!s.isDirectory()) {
@@ -1511,16 +1597,16 @@ async function publish(packageDir, options = {}) {
         processedPkg = applyPublishConfig(processedPkg);
         verbose(`[publish] Copying files to temp store...`);
         const uniqueDirs = new Set(
-          files.map((file) => dirname4(join8(tmpPackageDir, relative5(publishDir, file))))
+          files.map((file) => dirname4(join8(tmpPackageDir, relative6(publishDir, file))))
         );
         await Promise.all([...uniqueDirs].map((d) => ensureDir(d)));
         await Promise.all(
           files.map(
             (file) => copyLimit(async () => {
-              const rel = relative5(publishDir, file);
+              const rel = relative6(publishDir, file);
               const dest = join8(tmpPackageDir, rel);
               if (rel === "package.json" && processedPkg !== pkg) {
-                await writeFile3(dest, JSON.stringify(processedPkg, null, 2));
+                await atomicWriteFile(dest, JSON.stringify(processedPkg, null, 2));
               } else {
                 await copyWithCoW(file, dest, { ensureParent: false });
               }
@@ -1528,7 +1614,7 @@ async function publish(packageDir, options = {}) {
           )
         );
         if (publishDir !== packageDir) {
-          await writeFile3(
+          await atomicWriteFile(
             join8(tmpPackageDir, "package.json"),
             JSON.stringify(processedPkg, null, 2)
           );
@@ -1540,15 +1626,29 @@ async function publish(packageDir, options = {}) {
           sourcePath: packageDir,
           buildId
         };
-        await writeFile3(
+        await atomicWriteFile(
           join8(tmpDir, ".knarr-meta.json"),
           JSON.stringify(meta, null, 2)
         );
         const hadOld = await exists(storeEntryDir);
         const oldDir = storeEntryDir + ".old-" + Date.now();
-        if (hadOld) await rename3(storeEntryDir, oldDir);
-        await moveDir(tmpDir, storeEntryDir);
-        if (hadOld) {
+        let oldMoved = false;
+        try {
+          if (hadOld) {
+            await moveDir(storeEntryDir, oldDir);
+            oldMoved = !isDryRun();
+          }
+          await moveDir(tmpDir, storeEntryDir);
+        } catch (err) {
+          if (oldMoved && await exists(oldDir)) {
+            if (await exists(storeEntryDir)) {
+              await removeDir(storeEntryDir);
+            }
+            await moveDir(oldDir, storeEntryDir);
+          }
+          throw err;
+        }
+        if (hadOld && !isDryRun()) {
           try {
             const { captureHistory: captureHistory2 } = await Promise.resolve().then(() => (init_history(), history_exports));
             await captureHistory2(pkg.name, pkg.version, oldDir, options.historyLimit);
@@ -1595,7 +1695,7 @@ async function runLifecycleHook(packageDir, pkg, hookName) {
     return;
   }
   verbose(`[lifecycle] Running ${hookName}: ${script}`);
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     const isWin = platform() === "win32";
     const shell = isWin ? "cmd" : "sh";
     const shellFlag = isWin ? "/c" : "-c";
@@ -1610,7 +1710,7 @@ async function runLifecycleHook(packageDir, pkg, hookName) {
     child.on("close", (code) => {
       clearTimeout(timer);
       if (code === 0) {
-        resolve7();
+        resolve8();
       } else {
         reject(new Error(`${hookName} script failed with exit code ${code}`));
       }
@@ -1769,6 +1869,7 @@ var init_publisher = __esm({
     init_lockfile();
     init_logger();
     init_dry_run();
+    init_validators();
     copyLimit = pLimit(Math.max(availableParallelism3(), 8));
     HOOK_TIMEOUT = parseInt(process.env.KNARR_HOOK_TIMEOUT ?? "30000", 10);
     PUBLISH_CONFIG_OVERRIDES = [
@@ -1787,8 +1888,8 @@ var init_publisher = __esm({
 });
 
 // src/utils/bin-linker.ts
-import { mkdir as mkdir3, symlink, writeFile as writeFile4, chmod, rm as rm3 } from "fs/promises";
-import { join as join9, relative as relative6, resolve as resolve4, sep as sep2 } from "path";
+import { mkdir as mkdir3, symlink, writeFile as writeFile2, chmod, rm as rm3 } from "fs/promises";
+import { join as join9, relative as relative7, resolve as resolve5, sep as sep2 } from "path";
 import { platform as platform2 } from "os";
 function resolveBinEntries(pkg) {
   if (!pkg.bin) return {};
@@ -1815,12 +1916,12 @@ async function createBinLinks(consumerPath, packageName, pkg) {
   for (const [binName, binPath] of Object.entries(entries)) {
     const packageRoot = join9(consumerPath, "node_modules", packageName);
     const targetAbsolute = join9(packageRoot, binPath);
-    const resolvedTarget = resolve4(targetAbsolute);
-    if (!resolvedTarget.startsWith(resolve4(packageRoot) + sep2) && resolvedTarget !== resolve4(packageRoot)) {
+    const resolvedTarget = resolve5(targetAbsolute);
+    if (!resolvedTarget.startsWith(resolve5(packageRoot) + sep2) && resolvedTarget !== resolve5(packageRoot)) {
       consola.warn(`bin "${binName}" points outside package directory, skipping`);
       continue;
     }
-    const targetRelative = normalizePath(relative6(binDir, targetAbsolute));
+    const targetRelative = normalizePath(relative7(binDir, targetAbsolute));
     if (isWindows) {
       const cmdPath = join9(binDir, `${binName}.cmd`);
       const targetWindows = targetRelative.replace(/\//g, "\\");
@@ -1831,21 +1932,21 @@ SET dp0=%~dp0\r
 EXIT /b\r
 :start\r
 CALL :find_dp0\r
-"%dp0%\\${targetWindows}" %*\r
+node "%dp0%\\${targetWindows}" %*\r
 `;
-      await writeFile4(cmdPath, cmdContent);
+      await writeFile2(cmdPath, cmdContent);
       const ps1Path = join9(binDir, `${binName}.ps1`);
       const ps1Content = `#!/usr/bin/env pwsh
 $basedir=Split-Path $MyInvocation.MyCommand.Definition -Parent
 & node "$basedir/${targetRelative}" $args
 exit $LASTEXITCODE
 `;
-      await writeFile4(ps1Path, ps1Content);
+      await writeFile2(ps1Path, ps1Content);
       const shPath = join9(binDir, binName);
       const shContent = `#!/bin/sh
 exec node "${targetRelative}" "$@"
 `;
-      await writeFile4(shPath, shContent);
+      await writeFile2(shPath, shContent);
     } else {
       const linkPath = join9(binDir, binName);
       try {
@@ -1861,7 +1962,7 @@ exec node "${targetRelative}" "$@"
           const shContent = `#!/bin/sh
 exec node "${targetRelative}" "$@"
 `;
-          await writeFile4(linkPath, shContent);
+          await writeFile2(linkPath, shContent);
           await chmod(linkPath, 493);
         } else {
           throw err;
@@ -2066,7 +2167,7 @@ var init_bundler_cache = __esm({
 
 // src/core/injector.ts
 import { readFile as readFile9, readdir as readdir6, realpath, stat as stat7 } from "fs/promises";
-import { join as join13, resolve as resolve5 } from "path";
+import { join as join13, resolve as resolve6 } from "path";
 async function inject(storeEntry, consumerPath, pm, options = {}) {
   const targetDir = await resolveTargetDir(
     consumerPath,
@@ -2146,7 +2247,7 @@ async function resolveTargetDir(consumerPath, packageName, pm, version) {
   }
   try {
     const realPath = await resolveRealPath(directPath);
-    if (realPath !== resolve5(directPath)) {
+    if (realPath !== resolve6(directPath)) {
       verbose(`[inject] pnpm: resolved symlink \u2192 ${realPath}`);
       return realPath;
     }
@@ -2194,7 +2295,7 @@ async function resolveRealPath(linkPath) {
     return await realpath(linkPath);
   } catch (err) {
     if (isNodeError(err) && err.code === "ENOENT") {
-      return resolve5(linkPath);
+      return resolve6(linkPath);
     }
     throw err;
   }
@@ -3008,7 +3109,7 @@ async function startWatcher(watchDir, options, onChange) {
   return watcherHandle;
 }
 function runBuildCommand(cmd, cwd) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const isWin = platform3() === "win32";
     const shell = isWin ? "cmd" : "sh";
     const shellFlag = isWin ? "/c" : "-c";
@@ -3022,16 +3123,16 @@ function runBuildCommand(cmd, cwd) {
       activeChild = null;
       if (code === 0) {
         consola.success("Build succeeded");
-        resolve7(true);
+        resolve8(true);
       } else {
         consola.error(`Build failed with code ${code}`);
-        resolve7(false);
+        resolve8(false);
       }
     });
     child.on("error", (err) => {
       activeChild = null;
       consola.error(`Build error: ${err.message}`);
-      resolve7(false);
+      resolve8(false);
     });
   });
 }
@@ -3117,14 +3218,14 @@ var init_watch_orchestrator = __esm({
             },
             wrappedOnChange
           );
-          this.packages.set(name, { dir, state: "idle", watcher });
+          this.packages.set(name, { dir, buildCmd, state: "idle", watcher });
         }
         consola.info(`Watching ${this.packages.size} workspace packages`);
-        await new Promise((resolve7) => {
+        await new Promise((resolve8) => {
           const cleanup = async () => {
             consola.info("Stopping watchers...");
             await this.close();
-            resolve7();
+            resolve8();
           };
           process.once("SIGINT", cleanup);
           process.once("SIGTERM", cleanup);
@@ -3155,11 +3256,9 @@ var init_watch_orchestrator = __esm({
         entry.state = "building";
         verbose(`[cascade] Rebuilding ${name}`);
         try {
-          const config = await loadKnarrConfig(entry.dir);
-          const buildCmd = config.buildCmd;
-          if (buildCmd) {
+          if (entry.buildCmd) {
             const { runBuildCommand: runBuildCommand2 } = await Promise.resolve().then(() => (init_watcher(), watcher_exports));
-            const success = await runBuildCommand2(buildCmd, entry.dir);
+            const success = await runBuildCommand2(entry.buildCmd, entry.dir);
             if (!success) {
               consola.warn(`[cascade] Build failed for ${name}, skipping dependents`);
               entry.state = "idle";
@@ -3256,7 +3355,7 @@ init_workspace();
 // src/utils/preflight.ts
 init_logger();
 import { readFile as readFile14, stat as stat9 } from "fs/promises";
-import { join as join18, resolve as resolve6 } from "path";
+import { join as join18, resolve as resolve7 } from "path";
 async function runPreflightChecks(packageDir) {
   const issues = [];
   let pkgContent;
@@ -3326,7 +3425,7 @@ async function fileExists(filePath) {
   }
 }
 async function checkPath(packageDir, filePath, field, issues) {
-  const resolved = resolve6(packageDir, filePath);
+  const resolved = resolve7(packageDir, filePath);
   if (!await fileExists(resolved)) {
     issues.push({
       code: "MISSING_PATH",
@@ -3339,7 +3438,7 @@ async function checkExports(packageDir, exports, issues) {
   for (const [key, value] of Object.entries(exports)) {
     if (typeof value === "string") {
       if (value.startsWith(".")) {
-        const resolved = resolve6(packageDir, value);
+        const resolved = resolve7(packageDir, value);
         if (!await fileExists(resolved)) {
           issues.push({
             code: "EXPORTS_PATH_MISSING",
@@ -3380,7 +3479,7 @@ async function checkExportsConditions(packageDir, exportKey, conditions, issues)
   }
   for (const [condition, value] of Object.entries(conditions)) {
     if (typeof value === "string" && value.startsWith(".")) {
-      const resolved = resolve6(packageDir, value);
+      const resolved = resolve7(packageDir, value);
       if (!await fileExists(resolved)) {
         issues.push({
           code: "EXPORTS_PATH_MISSING",