zyrk 0.0.0-stage → 0.2.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 King Jethro (kingjethro999)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,189 @@
-# Temporary Holding Version
+# zyrk
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[![CI](https://github.com/kingjethro999/nexu/actions/workflows/ci.yml/badge.svg)](https://github.com/kingjethro999/nexu/actions/workflows/ci.yml)
+[![Node.js](https://img.shields.io/badge/Node.js-24%2B-339933?logo=node.js&logoColor=white)](https://nodejs.org/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+
+An npm-compatible package manager built around **one verified package store per
+OS user**, with dependency-aware package instances linked into projects.
+
+**Pre-release and under active construction.** The current CLI can fetch and run
+one-off tools with `dlx` and `create`. Ordinary project installation, dependency
+editing, garbage collection, repair, and deployment are still being built. Check
+`zyrk --help` for the implemented command surface.
+
+## Why zyrk exists
+
+A developer often works on several Node.js projects with overlapping
+dependencies. zyrk's intended default is to verify package sources once, keep
+them in a per-user store, and assemble each project's dependency graph through
+links. Different versions and peer dependency contexts remain separate.
+
+Application code keeps using ordinary imports. There is no custom Node.js
+loader, privileged daemon, or manual mount setup in the intended development
+model.
+
+Sharing files is an established approach: pnpm also uses hard links. zyrk makes
+the shared store, exact dependency context, mutation rules, and cleanup contract
+central to its design. Storage savings, speed, and framework compatibility will
+be reported only after reproducible measurements and compatibility tests.
+
+## Try the current CLI
+
+Once the `zyrk` package is published, install it with `npm install -g zyrk`,
+then run `zyrk --help`.
+
+Requires **Node.js 24 or newer**. The source runs directly with Node's native
+TypeScript support; no compilation step or native toolchain is required to
+install zyrk itself.
+
+From a checkout:
+
+```bash
+git clone https://github.com/kingjethro999/nexu.git zyrk
+cd zyrk
+npm ci
+node bin/zyrk.js --help
+node bin/zyrk.js --version
+```
+
+For an npm-distributed build, use the exact package name listed on its npm page
+and check that its repository points to `kingjethro999/nexu`. The executable is
+`zyrk`. The existing [npm publishing action](.github/workflows/npm-publish.yml)
+uses the repository’s `NPM_TOKEN` secret when a GitHub release is created.
+
+### Run a one-off tool
+
+```bash
+zyrk dlx <package>[@version] [args...]
+zyrk create <initializer>[@version] [args...]
+```
+
+When running from source, replace `zyrk` with `node bin/zyrk.js`.
+
+`dlx` resolves the requested package and its dependencies, verifies downloaded
+archives, creates a dependency-aware tool graph, and launches the selected
+JavaScript bin entry with the supplied arguments. Its temporary projection is
+removed afterward; verified sources and shared realizations remain in the
+store.
+
+`create` uses the same execution path and maps initializer names to their
+`create-*` packages. For example, `vite` maps to `create-vite`, while a scoped
+initializer stays in its scope. Compatibility depends on the selected tool:
+closures declaring install lifecycle scripts are currently blocked, and native
+or shell executable bins are not supported by the JavaScript-only launcher.
+
+These commands run the tool's code with your account's permissions. The tool
+working directory is your current directory. A temporary tool projection is
+not a sandbox.
+
+### Current command coverage
+
+| Surface                                                                                | Current behavior                                                      |
+| -------------------------------------------------------------------------------------- | --------------------------------------------------------------------- |
+| `--help`, `--version`                                                                  | Show the CLI surface and package version.                             |
+| `dlx`, `create`                                                                        | Resolve, fetch, verify archives, and run temporary tool environments. |
+| `publish`, `unpublish`, `access`, `deprecate`, `dist-tag`, `owner`                     | Explicitly delegate to your npm CLI.                                  |
+| `token`, `adduser`, `login`, `logout`, `whoami`, `ping`, `pack`                        | Explicitly delegate to your npm CLI.                                  |
+| `install`, `add`, `remove`, `update`, `run`, `exec`                                    | Report `ZYRK_NOT_IMPLEMENTED`.                                        |
+| `store`, `projects`, `repair`, `import`, `deploy`, `docker`                            | Report `ZYRK_NOT_IMPLEMENTED`.                                        |
+| `list`, `why`, `doctor`, `approve-builds`, `rebuild`, `audit`, `patch`, `patch-commit` | Report `ZYRK_NOT_IMPLEMENTED`.                                        |
+
+Native commands that support `--json` return a versioned result envelope.
+`dlx` and `create` reject that option because the tool owns stdout. Delegated
+commands preserve npm's own output format.
+
+## Storage, isolation, and trust
+
+On Linux, the default store is:
+
+```text
+${XDG_DATA_HOME:-$HOME/.local/share}/zyrk/store/v1
+```
+
+Set `ZYRK_STORE_DIR` deliberately to choose another store location. The store
+must satisfy ownership and permission checks. Linux local filesystems are the
+initial target; platform and framework support remain gated on their own tests.
+
+The design separates three things:
+
+- **Verified source:** archive integrity is checked before extraction and source
+  publication. Extraction rejects unsafe paths and links and normalizes modes.
+- **Dependency context:** a package instance records its selected dependency
+  wiring, so incompatible versions and peer contexts are not merged.
+- **Mutable work:** the planned build/runtime mutation model uses private
+  project generations. Writable build outputs must not change shared source.
+
+Read-only modes help prevent accidental writes; they are not a security boundary
+against code running as the same OS user. Shared stores should be used only by
+mutually trusted processes. Do not share them across unrelated CI trust domains.
+
+Native tool commands currently use the public npm registry. Private registry
+configuration and credential support are not implemented; do not use these
+commands for internal tools that depend on private registry routing.
+
+## Global installs and npm delegation
+
+zyrk never installs packages globally and never forwards a global-install
+request to npm:
+
+```bash
+zyrk install --global <package>
+# ZYRK_GLOBAL_INSTALL_UNSUPPORTED
+```
+
+Use npm directly when you want a global package. Installing the zyrk executable
+with npm is separate from asking zyrk to install another package globally.
+
+Registry write and account operations use your npm installation. zyrk prints a
+disclosure, inherits stdio, and returns the child status. npm uses its own
+registry configuration and authentication:
+
+```bash
+zyrk publish --tag beta
+zyrk pack --ignore-scripts
+```
+
+npm options may come before or after the command: zyrk forwards every
+non-zyrk token verbatim, so protective flags such as `--dry-run` always
+reach npm. A bare value before the command that cannot be the command
+itself fails before npm launches — use the `--flag=value` form or place
+the command first. npm may run package lifecycle scripts according to its
+own options and configuration.
+
+## Develop and contribute
+
+```bash
+npm ci
+npm run setup:hooks
+npm run typecheck
+npm test
+npm run check
+npm run format:check
+npm run format
+```
+
+The commit hook runs the full check gate, increments the version in
+`package.json`, `package-lock.json`, and `VERSION`, and creates a matching version
+tag after the commit. Keep changes focused and never bypass the hooks.
+
+CI checks pushed commits and pull requests. The separate
+[npm publishing action](.github/workflows/npm-publish.yml) is triggered when a
+GitHub release is created; ordinary commits do not trigger that action.
+
+The contributor guide is [AGENTS.md](AGENTS.md). Bug reports and reproducible
+compatibility cases belong in
+[GitHub issues](https://github.com/kingjethro999/nexu/issues).
+
+## Naming and local state
+
+The project was renamed from snpm to **zyrk**. The shared-store philosophy,
+version isolation, mutation policy, and security requirements remain the same.
+Current CLI/configuration uses `zyrk` / `ZYRK`, and lock metadata uses the `zyrk`
+namespace. Pre-rename stores and lock metadata are not migrated automatically.
+Keep existing data until an explicit migration is supported.
+
+## License
+
+[MIT](LICENSE). If you want to support development,
+[sponsor the maintainer](https://github.com/sponsors/kingjethro999).

package/VERSION

@@ -0,0 +1 @@
+v0.2.3

package/bin/zyrk.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import { runCli } from "../src/cli/main.ts";
+
+process.exitCode = await runCli({
+  argv: process.argv.slice(2),
+  env: process.env,
+  stdout: process.stdout,
+  stderr: process.stderr,
+});

package/package.json

@@ -1,6 +1,66 @@
 {
   "name": "zyrk",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.3",
+  "description": "Storage-efficient Node package manager: one verified store per user, shared across projects through links.",
+  "license": "MIT",
+  "type": "module",
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "bin": {
+    "zyrk": "bin/zyrk.js"
+  },
+  "scripts": {
+    "typecheck": "tsc -p tsconfig.json",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "check": "node scripts/check.mjs",
+    "format:check": "prettier --check .",
+    "format": "prettier --write .",
+    "version:bump": "node scripts/bump-version.js",
+    "setup:hooks": "git config core.hooksPath .githooks"
+  },
+  "dependencies": {
+    "npm-package-arg": "^14.0.0",
+    "npm-registry-fetch": "^20.0.1",
+    "semver": "^7.8.5",
+    "ssri": "^14.0.0",
+    "tar": "^7.5.22"
+  },
+  "devDependencies": {
+    "@types/node": "^24.19.2",
+    "@types/semver": "^7.8.0",
+    "prettier": "3.9.10",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.5"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kingjethro999/nexu.git"
+  },
+  "bugs": {
+    "url": "https://github.com/kingjethro999/nexu/issues"
+  },
+  "homepage": "https://github.com/kingjethro999/nexu#readme",
+  "keywords": [
+    "package-manager",
+    "npm",
+    "nodejs",
+    "typescript",
+    "dependency-management",
+    "shared-store",
+    "content-addressable-storage",
+    "cli"
+  ],
+  "files": [
+    "bin/",
+    "src/",
+    "VERSION",
+    "LICENSE",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  }
+}

package/src/cli/main.ts

@@ -0,0 +1,383 @@
+/**
+ * zyrk command dispatch (SPEC 15).
+ *
+ * This is the roadmap skeleton, not the whole implementation: `dlx` and
+ * `create` run temporary tool environments; `--help`, `--version`, the
+ * global-install rejection, and explicit npm delegation do their jobs.
+ * Every other native dependency command fails with ZYRK_NOT_IMPLEMENTED
+ * rather than pretending to work; unknown commands fail with ZYRK_USAGE
+ * and the help text.
+ * Nothing here launches a subprocess: rejection happens before resolution,
+ * downloads, lifecycle execution, project/store mutation, or any child
+ * process (SPEC 15.3.1).
+ */
+
+import { readFileSync } from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import { runCreate } from "../dlx/create.ts";
+import { runDlx } from "../dlx/run.ts";
+import { exitCodeFor, ZyrkError, toZyrkError } from "../errors.ts";
+import { DEFAULT_REGISTRY, RegistryClient } from "../fetch/registry.ts";
+import { resolveStoreRoot } from "../config/paths.ts";
+import { Store } from "../store/layout.ts";
+import {
+  delegateToNpm,
+  delegatedHelpLines,
+  isDelegatedCommand,
+} from "./npm-delegate.ts";
+import { isGlobalInstallRequest, parseArgs, type ParsedArgs } from "./parse.ts";
+
+export const CLI_JSON_SCHEMA_VERSION = 1;
+
+/** Spec-defined dependency commands (SPEC 15.1-15.2, fetch, docker). */
+const NATIVE_COMMANDS: ReadonlyArray<readonly [string, string]> = [
+  ["install, i", "Install the locked or newly resolved graph."],
+  ["fetch", "Fetch and verify a locked source closure."],
+  ["add", "Add dependencies transactionally."],
+  ["remove", "Remove direct dependencies and refresh the closure."],
+  ["update", "Update within allowed ranges."],
+  ["run", "Run a project script with local binary paths."],
+  ["exec", "Run an installed executable (never fetches)."],
+  ["dlx", "Explicitly fetch and run a temporary tool environment."],
+  ["create", "Scaffold from a create-* starter package."],
+  ["list, why", "Show the installed graph / why a dependency is selected."],
+  ["doctor", "Diagnose filesystem, links, policy, install-state issues."],
+  ["approve-builds, rebuild", "Review script permissions / rebuild."],
+  ["audit", "Report vulnerabilities under the configured privacy policy."],
+  ["patch, patch-commit", "Create a private edit area / emit a patch."],
+  ["store", "Inspect, verify, collect, and retain the store."],
+  ["projects", "List registrations / drop a retention root."],
+  ["repair", "Reconstruct the project from verified locked inputs."],
+  ["import", "Convert supported npm lock information."],
+  ["deploy", "Create self-contained production output."],
+  ["docker", "Generate, build, and start the Docker setup."],
+];
+
+const KNOWN_COMMANDS = new Set<string>();
+for (const [names] of NATIVE_COMMANDS) {
+  for (const name of names.split(", ")) KNOWN_COMMANDS.add(name);
+}
+
+/** Commands with a real implementation behind runCli. */
+const IMPLEMENTED_COMMANDS = new Set(["dlx", "create"]);
+
+export function helpText(version: string): string {
+  const lines = [
+    `zyrk v${version} — one verified store per user, shared across projects through links.`,
+    "",
+    "Usage: zyrk <command> [args] [--json]",
+    "",
+    "Dependency commands:",
+  ];
+  for (const [names, description] of NATIVE_COMMANDS) {
+    const done = names
+      .split(", ")
+      .some((name) => IMPLEMENTED_COMMANDS.has(name));
+    lines.push(
+      `  ${names.padEnd(24, " ")}${description}${done ? "" : " (not implemented yet)"}`,
+    );
+  }
+  lines.push("", "Registry publishing and account commands (via your npm):");
+  lines.push(...delegatedHelpLines());
+  lines.push(
+    "",
+    "zyrk never installs packages globally and never runs npm to do it.",
+    "Need a global package? Run npm directly: npm install --global <package-spec>",
+  );
+  return `${lines.join("\n")}\n`;
+}
+
+export type CliOutput = {
+  exitCode: number;
+  stdout: string;
+  stderr: string;
+};
+
+function ok(stdout: string, parsed: ParsedArgs): CliOutput {
+  if (!parsed.json) return { exitCode: 0, stdout, stderr: "" };
+  return {
+    exitCode: 0,
+    stdout: `${JSON.stringify({ schemaVersion: CLI_JSON_SCHEMA_VERSION, status: "ok" })}\n`,
+    stderr: "",
+  };
+}
+
+function fail(
+  error: ZyrkError,
+  parsed: ParsedArgs,
+  stdoutHint = "",
+): CliOutput {
+  const human =
+    `zyrk: error ${error.code}: ${error.message}` +
+    (error.remedy === undefined ? "" : `\n${error.remedy}`);
+  if (!parsed.json) {
+    return {
+      exitCode: exitCodeFor(error),
+      stdout: stdoutHint,
+      stderr: `${human}\n`,
+    };
+  }
+  const body: Record<string, unknown> = {
+    schemaVersion: CLI_JSON_SCHEMA_VERSION,
+    status: "error",
+    code: error.code,
+    message: error.message,
+  };
+  if (error.remedy !== undefined) body.remedy = error.remedy;
+  return {
+    exitCode: exitCodeFor(error),
+    stdout: `${JSON.stringify(body)}\n`,
+    stderr: "",
+  };
+}
+
+/**
+ * Echo a command token back safely: drop control characters, cap length,
+ * and strip URL userinfo so error output cannot leak credentials or forge
+ * terminal sequences. Full structured output redaction is S03; this covers
+ * the one place CLI dispatch interpolates an arbitrary token today.
+ */
+/**
+ * Drop C0 control characters and DEL without regex escapes.
+ */
+function stripControlChars(token: string): string {
+  let out = "";
+  for (const ch of token) {
+    const code = ch.codePointAt(0);
+    if (code !== undefined && code >= 32 && code !== 127) out += ch;
+  }
+  return out;
+}
+
+function sanitizeCommandToken(token: string): string {
+  const oneLine = stripControlChars(token);
+  const capped = oneLine.length > 64 ? `${oneLine.slice(0, 64)}…` : oneLine;
+  return capped.replace(/([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)([^@/]*@)?/, "$1");
+}
+
+function globalInstallError(command: string): ZyrkError {
+  return new ZyrkError(
+    "ZYRK_GLOBAL_INSTALL_UNSUPPORTED",
+    `zyrk does not install packages globally (requested: zyrk ${command} with global-install mode).`,
+    {
+      detail: { command },
+      remedy:
+        "Shared storage is not global installation. Run npm directly, for example: " +
+        "npm install --global <package-spec>. zyrk will not run npm for you.",
+    },
+  );
+}
+
+/**
+ * Pure dispatch: no filesystem, network, or subprocess effects. Returns the
+ * exact bytes for stdout/stderr and the process exit code.
+ */
+export function dispatch(
+  parsed: ParsedArgs,
+  context: { version: string; env: NodeJS.ProcessEnv },
+): CliOutput {
+  if (parsed.version) {
+    return ok(`${context.version}\n`, parsed);
+  }
+  if (parsed.help || parsed.command === undefined) {
+    return ok(helpText(context.version), parsed);
+  }
+  const command = parsed.command;
+  if (isGlobalInstallRequest(command, parsed.commandArgs, context.env)) {
+    return fail(globalInstallError(command), parsed);
+  }
+  if (!KNOWN_COMMANDS.has(command)) {
+    const shown = sanitizeCommandToken(command);
+    const placementHint =
+      command.includes("://") || parsed.argsBeforeCommand.length > 0
+        ? " If this was an option value, use the --flag=value form or place the command first."
+        : "";
+    return fail(
+      new ZyrkError("ZYRK_USAGE", `unknown command: ${shown}.`, {
+        detail: { command: shown },
+        remedy: `Run \`zyrk --help\` for the documented command list.${placementHint}`,
+      }),
+      parsed,
+      helpText(context.version),
+    );
+  }
+  if (!IMPLEMENTED_COMMANDS.has(command)) {
+    return fail(
+      new ZyrkError(
+        "ZYRK_NOT_IMPLEMENTED",
+        `zyrk ${command} is not implemented yet.`,
+        {
+          detail: { command },
+          remedy:
+            "Only documented, implemented commands are advertised; this one is on the roadmap.",
+        },
+      ),
+      parsed,
+    );
+  }
+  throw new ZyrkError(
+    "ZYRK_INTERNAL",
+    `implemented command ${command} bypassed runCli.`,
+    {
+      detail: { command },
+      remedy: "report this unreachable dispatch failure",
+    },
+  );
+}
+
+function readCliVersion(): string {
+  try {
+    const root = path.resolve(
+      path.dirname(fileURLToPath(import.meta.url)),
+      "../..",
+    );
+    const pkg = JSON.parse(
+      readFileSync(path.join(root, "package.json"), "utf8"),
+    ) as {
+      version?: unknown;
+    };
+    return typeof pkg.version === "string" ? pkg.version : "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
+export type ToolEnvironment = {
+  store: Store;
+  registry: RegistryClient;
+};
+
+export type RunCliOptions = {
+  argv: readonly string[];
+  env: NodeJS.ProcessEnv;
+  stdout: { write(chunk: string): unknown };
+  stderr: { write(chunk: string): unknown };
+  readVersion?: () => string;
+  cwd?: string;
+  tools?: () => Promise<ToolEnvironment>;
+};
+
+/** Parse, dispatch, delegate, or run a tool, and emit. The only impure seam. */
+export async function runCli(options: RunCliOptions): Promise<number> {
+  const parsed = parseArgs(options.argv);
+  const version = (options.readVersion ?? readCliVersion)();
+  const emit = (result: CliOutput): number => {
+    if (result.stdout !== "") options.stdout.write(result.stdout);
+    if (result.stderr !== "") options.stderr.write(result.stderr);
+    return result.exitCode;
+  };
+  // Delegation bypasses dispatch: zyrk interprets no command arguments
+  // itself, adds no JSON envelope, and forwards every non-zyrk token
+  // verbatim — before the command as well as after it. A leading
+  // protective flag such as `--dry-run` belongs to npm; dropping it would
+  // silently change what runs (S05). The only tokens zyrk consumes are its
+  // own `--json`/`--help`/`--version`, and `--json` is passed on so npm
+  // still sees exactly what it was given.
+  if (
+    !parsed.help &&
+    !parsed.version &&
+    parsed.command !== undefined &&
+    isDelegatedCommand(parsed.command)
+  ) {
+    try {
+      const forwarded = [...parsed.argsBeforeCommand];
+      if (parsed.json && !parsed.argsAfterCommand.includes("--json")) {
+        forwarded.push("--json");
+      }
+      forwarded.push(...parsed.argsAfterCommand);
+      return await delegateToNpm({
+        command: parsed.command,
+        args: forwarded,
+        env: options.env,
+        stderr: options.stderr,
+      });
+    } catch (error) {
+      return emit(
+        fail(
+          toZyrkError(error, "zyrk failed while delegating to npm."),
+          parsed,
+        ),
+      );
+    }
+  }
+  if (
+    !parsed.help &&
+    !parsed.version &&
+    (parsed.command === "dlx" || parsed.command === "create")
+  ) {
+    try {
+      return await runToolCommand(parsed.command, parsed, options, version);
+    } catch (error) {
+      return emit(
+        fail(toZyrkError(error, `zyrk ${parsed.command} failed.`), parsed),
+      );
+    }
+  }
+  return emit(dispatch(parsed, { version, env: options.env }));
+}
+
+async function defaultTools(
+  env: NodeJS.ProcessEnv,
+  version: string,
+): Promise<ToolEnvironment> {
+  const store = await Store.open({
+    root: resolveStoreRoot({ env }).root,
+    create: true,
+  });
+  const registry = new RegistryClient({
+    registry: DEFAULT_REGISTRY,
+    userAgent: `zyrk/${version}`,
+  });
+  return { store, registry };
+}
+
+async function runToolCommand(
+  command: "dlx" | "create",
+  parsed: ParsedArgs,
+  options: RunCliOptions,
+  version: string,
+): Promise<number> {
+  if (parsed.json) {
+    throw new ZyrkError(
+      "ZYRK_USAGE",
+      `zyrk ${command} does not support --json; the tool owns stdout.`,
+      {
+        detail: { command },
+        remedy: `run zyrk ${command} without --json.`,
+      },
+    );
+  }
+  const tail = parsed.commandArgs;
+  const first = tail[0];
+  if (first === undefined) {
+    throw new ZyrkError(
+      "ZYRK_USAGE",
+      command === "dlx"
+        ? "zyrk dlx needs a tool specifier."
+        : "zyrk create needs an initializer name.",
+      {
+        detail: { command },
+        remedy:
+          command === "dlx"
+            ? "use zyrk dlx <package>[@version] [args...]."
+            : "use zyrk create <name>[@version] [args...].",
+      },
+    );
+  }
+  const tools =
+    options.tools === undefined
+      ? await defaultTools(options.env, version)
+      : await options.tools();
+  const base = {
+    store: tools.store,
+    registry: tools.registry,
+    args: tail.slice(1),
+    cwd: options.cwd ?? process.cwd(),
+    env: options.env,
+  };
+  if (command === "dlx") {
+    return (await runDlx({ ...base, spec: first })).exitCode;
+  }
+  return (await runCreate({ ...base, input: first })).exitCode;
+}