zyrk 0.3.9 → 0.4.9

package/dist/commands/dependencies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../../src/commands/dependencies.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAavE,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,OAAO,EAAE,iBAAiB,CAAC;IAC3B,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;CAC1B,GAAG,OAAO,CAAC,aAAa,CAAC,CA0HzB"}
+{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../../src/commands/dependencies.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAavE,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,OAAO,EAAE,iBAAiB,CAAC;IAC3B,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,OAAO,CAAC,aAAa,CAAC,CA2HzB"}

package/dist/commands/dependencies.js

@@ -14,6 +14,7 @@ export async function runDependencyCommand(options) {
         projectDir: options.projectDir,
         store: options.store,
         registry: options.registry,
+        ...(options.env ? { env: options.env } : {}),
     };
     const names = [];
     let from;

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AA8CA,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC7B,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1C,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1C,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAwEF,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAmUjB"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAyDA,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC7B,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1C,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1C,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAwEF,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,MAAM,CAAC,CA8YjB"}

package/dist/commands/deploy.js

@@ -1,21 +1,24 @@
 /** Self-contained pure-package deployment and explicit local Docker commands. */
-import { spawn } from "node:child_process";
-import { copyFile, chmod, lstat, mkdir, mkdtemp, readFile, readdir, readlink, realpath, rename, rm, symlink, writeFile, } from "node:fs/promises";
+import { constants } from "node:fs";
+import { open, copyFile, chmod, lstat, mkdir, mkdtemp, readFile, readdir, readlink, realpath, rename, rm, symlink, writeFile, } from "node:fs/promises";
 import * as path from "node:path";
 import { findProjectBoundary, resolveStoreRoot } from "../config/paths.js";
 import { ZyrkError } from "../errors.js";
 import { lockedGraph } from "../install/lock.js";
-import { validateLockDoc } from "../lockfile/read.js";
-import { manifestFingerprint, } from "../lockfile/fingerprints.js";
-import { createGraphDoc, contextIdFor } from "../store/graph.js";
+import { loadProjectPatches } from "./patch.js";
+import { currentPlatform } from "../resolve/resolver.js";
+import { openStoreDb } from "../store/db.js";
+import { validateLockDoc, assertFrozenCompatible } from "../lockfile/read.js";
+import { manifestFingerprint, scriptPolicyFingerprint, configFingerprint, } from "../lockfile/fingerprints.js";
+import { createGraphDoc, contextIdFor, graphHash, } from "../store/graph.js";
 import { Store } from "../store/layout.js";
 import { readSourceManifest } from "../store/manifests.js";
-import { packageDirIn, realizationDirFor } from "../store/realize.js";
+import { packageDirIn, selectRealizationDirs } from "../store/realize.js";
 import { verifyRealization } from "../store/verify.js";
 import { sha512Hex, sha512HexOfFile } from "../util/hash.js";
 import { canonicalJson } from "../util/json.js";
 import { acquireLock } from "../util/locks.js";
-import { closeCode } from "../util/proc.js";
+import { superviseChild } from "../util/proc.js";
 function object(v) {
     return typeof v === "object" && v !== null && !Array.isArray(v);
 }
@@ -119,14 +122,46 @@ export async function runDeployCommand(options) {
     const projectLock = await acquireLock(path.join(project, ".zyrk-local/project.lock"), { name: "portable deployment" });
     try {
         const state = await readJson(path.join(project, "node_modules/.zyrk/install-state.json"));
-        const doc = validateLockDoc(await readJson(path.join(project, "package-lock.json")), "project package-lock.json");
+        const rawLock = await readJson(path.join(project, "package-lock.json"));
+        if (manifest.workspaces !== undefined ||
+            (object(rawLock.zyrk) && rawLock.zyrk.version === 2))
+            throw error("ZYRK_DEPLOY_NONRELOCATABLE", "Workspace runtime exports require a validated live-importer deployment adapter.");
+        const doc = validateLockDoc(rawLock, "project package-lock.json");
         const resolved = lockedGraph(doc);
+        const privateGraph = state.linker === "private";
         if (state.readiness !== "ready")
             throw error("ZYRK_SCRIPT_BLOCKED", "Cannot export an unready or intentionally unbuilt generation.");
         if (state.lockDigest !== sha512Hex(canonicalJson(doc)) ||
             doc.zyrk?.manifest !==
                 manifestFingerprint(manifest))
             throw error("ZYRK_LOCK_MISMATCH", "Deployment manifest, lock, and installed generation disagree.");
+        if (resolved.nodes.length) {
+            const origins = new Set(resolved.nodes.map((node) => node.origin));
+            if (origins.size !== 1)
+                throw error("ZYRK_DEPLOY_NONRELOCATABLE", "Mixed-origin deployment requires a validated registry adapter.");
+            const patches = await loadProjectPatches(project);
+            const policy = object(manifest.zyrk) ? manifest.zyrk : {};
+            assertFrozenCompatible(doc, {
+                manifest: manifestFingerprint(manifest),
+                scripts: scriptPolicyFingerprint(policy.scripts),
+                config: configFingerprint({
+                    registry: [...origins][0],
+                    linker: "shared",
+                    platform: currentPlatform(),
+                    ...(Array.isArray(policy.mutablePackages)
+                        ? { mutablePackages: policy.mutablePackages }
+                        : {}),
+                    ...(patches.length
+                        ? {
+                            patches: sha512Hex(canonicalJson(patches.map((p) => ({
+                                sourceId: p.sourceId,
+                                digest: p.digest,
+                            })))),
+                        }
+                        : {}),
+                }),
+            });
+        }
         if (state.platform !== process.platform || state.arch !== process.arch)
             throw error("ZYRK_PLATFORM_UNSUPPORTED", "Deployment requires artifacts for the current platform and architecture.");
         const store = await Store.open({
@@ -140,6 +175,9 @@ export async function runDeployCommand(options) {
                 : []);
             const installedNodes = resolved.nodes.filter((n) => installedKeys.has(n.key));
             const graph = createGraphDoc(installedNodes.map((n) => ({ ...n, deps: n.edges })));
+            const directories = privateGraph
+                ? await privateDirectories(project, store, graph, state)
+                : selectRealizationDirs(store, graph);
             const selectedRoots = {};
             const declarations = {
                 ...(object(manifest.dependencies) ? manifest.dependencies : {}),
@@ -168,13 +206,17 @@ export async function runDeployCommand(options) {
                     visit(edge.target);
             };
             Object.values(selectedRoots).forEach(visit);
-            for (const key of selected)
-                await verifyRealization({
-                    store,
-                    graph,
-                    rootKey: key,
-                    contextId: contextIdFor(graph, key),
-                });
+            if (privateGraph)
+                await validatePrivateProjection(project, graph, directories, selected, selectedRoots);
+            else
+                for (const key of selected)
+                    await verifyRealization({
+                        store,
+                        graph,
+                        rootKey: key,
+                        contextId: contextIdFor(graph, key),
+                        realizationDirs: directories,
+                    });
             const stage = await mkdtemp(path.join(parent, ".zyrk-deploy-"));
             try {
                 for (const file of files)
@@ -185,13 +227,25 @@ export async function runDeployCommand(options) {
                 delete deployedManifest.packageManager;
                 await writeFile(path.join(stage, "package.json"), JSON.stringify(deployedManifest, null, 2) + "\n");
                 const packageDirs = new Map();
+                const privateBudget = { entries: 0, bytes: 0, started: Date.now() };
                 for (const key of selected) {
                     const node = byKey.get(key);
                     const context = contextIdFor(graph, key);
-                    const sourceDir = packageDirIn(realizationDirFor(store, context), node.name);
+                    const sourceDir = packageDirIn(directories.get(key), node.name);
                     const targetDir = packageDirIn(path.join(stage, "node_modules/.zyrk/portable", context), node.name);
                     packageDirs.set(key, targetDir);
                     await mkdir(targetDir, { recursive: true });
+                    if (privateGraph) {
+                        const nestedSlots = new Set();
+                        const names = new Set([node.name]);
+                        for (const edge of node.edges) {
+                            if (names.has(edge.name))
+                                nestedSlots.add(path.join("node_modules", ...edge.name.split("/")));
+                            names.add(edge.name);
+                        }
+                        await copyPrivatePayload(sourceDir, targetDir, sourceDir, targetDir, nestedSlots, [project, store.root], privateBudget);
+                        continue;
+                    }
                     const source = await readSourceManifest(store, node.sourceId);
                     for (const e of source.manifest.entries) {
                         const target = path.join(targetDir, e.path);
@@ -257,6 +311,8 @@ export async function runDeployCommand(options) {
                 const entryStat = await lstat(path.join(stage, entry)).catch(() => null);
                 if (!entryStat?.isFile())
                     throw error("ZYRK_DEPLOY_NONRELOCATABLE", "The selected runtime Node entry is missing.");
+                if (privateGraph)
+                    await scanPrivateExport(stage, [project, store.root], privateBudget);
                 await validateLinks(stage, stage);
                 await writeFile(path.join(stage, "zyrk-deploy.json"), JSON.stringify({
                     schemaVersion: 1,
@@ -313,8 +369,9 @@ async function copyApplication(source, target, project) {
     const stat = await lstat(source).catch(() => null);
     if (!stat)
         throw error("ZYRK_DEPLOY_NONRELOCATABLE", "A selected runtime file is missing.");
-    if (stat.isSymbolicLink())
-        throw error("ZYRK_DEPLOY_ESCAPE", "Application runtime selections must contain real files and directories.");
+    if (stat.isSymbolicLink() ||
+        (await realpath(source).catch(() => null)) !== source)
+        throw error("ZYRK_DEPLOY_ESCAPE", "Application runtime selections must contain real files and directories without linked ancestors.");
     if (stat.isDirectory()) {
         await mkdir(target, { recursive: true });
         for (const name of await readdir(source))
@@ -416,7 +473,7 @@ async function docker(options, project, manifest) {
                 buildScript: build ?? null,
                 port: Number(portText),
             }, null, 2) + "\n",
-            "ZYRK_DOCKER.md": `Review Dockerfile and .dockerignore before building. Runtime files: ${files.join(", ")}. Runtime entry: node ${entry}. Build script: ${build ?? "none"}. Container port: ${portText}.\n\nThe pinned CLI tarball must remain at its declared path. Dependencies are fetched with an optional BuildKit npmrc secret, then installed, built, and exported without networking or registry secrets. No host node_modules or store enters the runtime image. Adapt build inputs and credential exclusions to your project; generated files do not prove application health. Native/private build adapters and arbitrary shell start commands are not supported by this generic exporter.\n\nBuild: zyrk docker build --tag your-app:local\nRun: zyrk docker run --tag your-app:local --port ${portText}\nSupply private registry credentials to Docker BuildKit directly with docker build --secret id=npmrc,src=<credential-file> when required; zyrk never embeds them.\n`,
+            "ZYRK_DOCKER.md": `Review Dockerfile and .dockerignore before building. Runtime files: ${files.join(", ")}. Runtime entry: node ${entry}. Build script: ${build ?? "none"}. Container port: ${portText}.\n\nThe pinned CLI tarball must remain at its declared path. Dependencies are fetched with an optional BuildKit npmrc secret, then installed, built, and exported without networking or registry secrets. No host node_modules or store enters the runtime image. Adapt build inputs and credential exclusions to your project; generated files do not prove application health. Relocatable JavaScript output from ready private generations is supported, including patches and approved build output. Native outputs, embedded host paths, live workspace exports, and arbitrary shell start commands require a validated adapter and are rejected by this generic exporter.\n\nBuild: zyrk docker build --tag your-app:local\nRun: zyrk docker run --tag your-app:local --port ${portText}\nSupply private registry credentials to Docker BuildKit directly with docker build --secret id=npmrc,src=<credential-file> when required; zyrk never embeds them.\n`,
         };
         for (const name of Object.keys(contents))
             if (await lstat(path.join(project, name)).catch(() => null))
@@ -480,27 +537,225 @@ async function docker(options, project, manifest) {
     return code;
 }
 async function subprocess(options, command, args, cwd, env) {
-    return new Promise((resolve, reject) => {
-        const child = spawn(command, args, {
+    try {
+        const result = await superviseChild(command, args, {
             cwd,
             env,
-            stdio: ["inherit", "pipe", "pipe"],
-        });
-        child.stdout?.on("data", (c) => options.stdout.write(c.toString()));
-        child.stderr?.on("data", (c) => options.stderr.write(c.toString()));
-        const signals = ["SIGTERM", "SIGINT", "SIGHUP"];
-        const listeners = signals.map((sig) => {
-            const listener = () => {
-                child.kill(sig);
-            };
-            process.on(sig, listener);
-            return [sig, listener];
+            stdout: options.stdout,
+            stderr: options.stderr,
         });
-        child.once("error", () => reject(error("ZYRK_BUILD_FAILED", "Cannot launch Docker; install the Docker CLI and enable a reachable BuildKit-capable daemon.")));
-        child.once("close", (code, signal) => {
-            for (const [sig, listener] of listeners)
-                process.off(sig, listener);
-            resolve(closeCode(code, signal));
-        });
-    });
+        return result.exitCode;
+    }
+    catch {
+        throw error("ZYRK_BUILD_FAILED", "Cannot launch Docker; install the Docker CLI and enable a reachable BuildKit-capable daemon.");
+    }
+}
+async function privateDirectories(project, store, graph, state) {
+    const profile = state.buildProfile;
+    if (!object(profile) ||
+        typeof state.generationId !== "string" ||
+        !/^gen1_[a-z2-7]+$/.test(state.generationId) ||
+        typeof state.projectId !== "string")
+        throw error("ZYRK_DEPLOY_NONRELOCATABLE", "Private generation has no supported build profile or selected identity.");
+    if (profile.node !== process.version ||
+        profile.abi !== process.versions.modules ||
+        profile.platform !== process.platform ||
+        profile.arch !== process.arch)
+        throw error("ZYRK_PLATFORM_UNSUPPORTED", "Private export requires its exact recorded Node, ABI, platform and architecture.");
+    if (typeof profile.candidate !== "string" ||
+        !/^[0-9a-f]{128}$/.test(profile.candidate) ||
+        state.graphDigest !== graphHash(graph) ||
+        state.storeRoot !== store.root)
+        throw error("ZYRK_STORE_CORRUPT", "Private generation profile does not match its selected graph and store.");
+    const base = path.join(project, ".zyrk-local", "generations", state.generationId);
+    if (state.privateDir !== base ||
+        !Array.isArray(state.instances) ||
+        state.instances.some((id) => typeof id !== "string"))
+        throw error("ZYRK_STORE_CORRUPT", "Private generation instance selection is invalid.");
+    const db = openStoreDb(store.paths.dbFile);
+    const directories = new Map();
+    try {
+        const generation = db
+            .prepare("SELECT graph_digest,readiness,state FROM generations WHERE generation_id=? AND project_id=?")
+            .get(state.generationId, state.projectId);
+        if (!generation ||
+            generation.graph_digest !== graphHash(graph) ||
+            generation.readiness !== "ready" ||
+            generation.state !== "active")
+            throw error("ZYRK_STORE_CORRUPT", "Private deployment requires the active ready generation recorded by the project.");
+        const rows = db
+            .prepare("SELECT gi.context_id,ri.instance_id,ri.path FROM generation_instances gi JOIN realization_instances ri ON gi.instance_id=ri.instance_id WHERE gi.generation_id=? AND ri.verification_state='verified'")
+            .all(state.generationId);
+        const ids = new Set(state.instances);
+        if (rows.length !== ids.size ||
+            rows.some((row) => !ids.has(row.instance_id)))
+            throw error("ZYRK_STORE_CORRUPT", "Private generation instance metadata disagrees with the selected projection.");
+        const byContext = new Map(rows.map((row) => [row.context_id, row.path]));
+        for (const node of graph.nodes) {
+            const directory = path.join(base, contextIdFor(graph, node.key));
+            if (byContext.get(contextIdFor(graph, node.key)) !== directory)
+                throw error("ZYRK_DEPLOY_ESCAPE", "Private context path is outside its exact selected generation.");
+            directories.set(node.key, directory);
+            const pkg = packageDirIn(directory, node.name);
+            const ancestors = [
+                path.join(project, ".zyrk-local"),
+                path.join(project, ".zyrk-local/generations"),
+                base,
+                directory,
+                path.join(directory, "node_modules"),
+                ...(node.name.startsWith("@") ? [path.dirname(pkg)] : []),
+                pkg,
+            ];
+            for (const ancestor of ancestors) {
+                const metadata = await lstat(ancestor).catch(() => null);
+                if (!metadata?.isDirectory() || metadata.isSymbolicLink())
+                    throw error("ZYRK_DEPLOY_ESCAPE", "Private generation passes through an unexpected link or missing directory.");
+            }
+        }
+    }
+    finally {
+        db.close();
+    }
+    return directories;
+}
+async function validatePrivateProjection(project, graph, directories, selected, roots) {
+    const nodes = new Map(graph.nodes.map((node) => [node.key, node]));
+    const check = async (slot, target) => {
+        const metadata = await lstat(slot).catch(() => null);
+        if (!metadata?.isSymbolicLink() ||
+            (await realpath(slot).catch(() => null)) !== target)
+            throw error("ZYRK_DEPLOY_ESCAPE", "Private dependency projection does not select its recorded context.");
+    };
+    for (const [name, key] of Object.entries(roots))
+        await check(path.join(project, "node_modules", name), packageDirIn(directories.get(key), nodes.get(key).name));
+    for (const key of selected) {
+        const node = nodes.get(key);
+        const pkg = packageDirIn(directories.get(key), node.name);
+        const names = new Set([node.name]);
+        for (const edge of node.edges) {
+            const target = nodes.get(edge.target);
+            const slot = names.has(edge.name)
+                ? path.join(pkg, "node_modules", ...edge.name.split("/"))
+                : path.join(directories.get(key), "node_modules", ...edge.name.split("/"));
+            await check(slot, packageDirIn(directories.get(target.key), target.name));
+            names.add(edge.name);
+        }
+    }
+}
+function checkPrivateBudget(budget) {
+    if (budget.entries > 200_000 ||
+        budget.bytes > 4 * 1024 * 1024 * 1024 ||
+        Date.now() - budget.started > 120_000)
+        throw error("ZYRK_DEPLOY_NONRELOCATABLE", "Private deployment exceeds its file, byte or duration budget.");
+}
+function nativeMagic(buffer) {
+    const magic = buffer.subarray(0, 4).toString("hex");
+    return ([
+        "7f454c46",
+        "feedface",
+        "cefaedfe",
+        "feedfacf",
+        "cffaedfe",
+        "cafebabe",
+        "bebafeca",
+    ].includes(magic) || buffer.subarray(0, 2).toString("ascii") === "MZ");
+}
+async function scanOrCopyPrivateFile(source, target, forbidden, budget) {
+    const input = await open(source, constants.O_RDONLY | constants.O_NOFOLLOW);
+    let output;
+    try {
+        const metadata = await input.stat();
+        if (!metadata.isFile())
+            throw error("ZYRK_DEPLOY_ESCAPE", "Private payload contains a special filesystem entry.");
+        if (/\.node$/i.test(source))
+            throw error("ZYRK_DEPLOY_NONRELOCATABLE", "Native dependency outputs require a validated export adapter.");
+        if (target !== undefined)
+            output = await open(target, "wx", metadata.mode & 0o111 ? 0o755 : 0o644);
+        const needles = [
+            ...new Set(forbidden.flatMap((value) => [
+                value,
+                JSON.stringify(value).slice(1, -1),
+            ])),
+        ].map((value) => Buffer.from(value));
+        // Keep enough overlap to detect credential markers split across read chunks.
+        const overlap = Math.max(4096, ...needles.map((value) => value.length));
+        let previous = Buffer.alloc(0);
+        let first = true;
+        let fileBytes = 0;
+        const chunk = Buffer.allocUnsafe(1024 * 1024);
+        for (;;) {
+            const { bytesRead } = await input.read(chunk, 0, chunk.length, null);
+            if (!bytesRead)
+                break;
+            const bytes = chunk.subarray(0, bytesRead);
+            fileBytes += bytesRead;
+            budget.bytes += bytesRead;
+            checkPrivateBudget(budget);
+            if (fileBytes > 512 * 1024 * 1024)
+                throw error("ZYRK_DEPLOY_NONRELOCATABLE", "A private generated file exceeds the deployment byte budget.");
+            if (first && nativeMagic(bytes))
+                throw error("ZYRK_DEPLOY_NONRELOCATABLE", "Native dependency outputs require a validated export adapter.");
+            first = false;
+            const inspect = Buffer.concat([previous, bytes]);
+            if (needles.some((needle) => inspect.includes(needle)))
+                throw error("ZYRK_DEPLOY_NONRELOCATABLE", "Private output embeds an absolute host project or store path.");
+            if (/-----BEGIN (?:[A-Z ]+ )?PRIVATE KEY-----|\bnpm_[A-Za-z0-9]{20,}|\bgh[pousr]_[A-Za-z0-9]{20,}|https?:\/\/[^\s/@]+:[^\s/@]+@|["']?_(?:authToken|auth|password)["']?\s*[:=]\s*["']?[^\s"';,}]+/i.test(inspect.toString("utf8")))
+                throw error("ZYRK_DEPLOY_NONRELOCATABLE", "Private output contains credential-like content.");
+            previous = Buffer.from(inspect.subarray(Math.max(0, inspect.length - overlap)));
+            if (output) {
+                let offset = 0;
+                while (offset < bytes.length) {
+                    const written = await output.write(bytes, offset, bytes.length - offset);
+                    if (!written.bytesWritten)
+                        throw error("ZYRK_DEPLOY_NONRELOCATABLE", "Cannot finish copying private dependency output.");
+                    offset += written.bytesWritten;
+                }
+            }
+        }
+    }
+    finally {
+        await input.close();
+        await output?.close();
+    }
+}
+async function copyPrivatePayload(source, target, sourceRoot, targetRoot, skip, forbidden, budget) {
+    const metadata = await lstat(source);
+    budget.entries++;
+    checkPrivateBudget(budget);
+    const relative = path.relative(sourceRoot, source);
+    if (skip.has(relative))
+        return;
+    const name = path.basename(source);
+    if (relative && name !== "node_modules" && sensitive(name))
+        throw error("ZYRK_DEPLOY_NONRELOCATABLE", "Private dependency output contains a credential or host configuration filename.");
+    if (metadata.isSymbolicLink()) {
+        const actual = await realpath(source).catch(() => null);
+        if (actual === null || !within(sourceRoot, actual))
+            throw error("ZYRK_DEPLOY_ESCAPE", "Private payload link escapes its package or has no stable target.");
+        const mapped = path.join(targetRoot, path.relative(sourceRoot, actual));
+        await symlink(path.relative(path.dirname(target), mapped) || ".", target);
+        return;
+    }
+    if (metadata.isDirectory()) {
+        await mkdir(target, { recursive: true });
+        for (const name of (await readdir(source)).sort())
+            await copyPrivatePayload(path.join(source, name), path.join(target, name), sourceRoot, targetRoot, skip, forbidden, budget);
+        return;
+    }
+    if (!metadata.isFile())
+        throw error("ZYRK_DEPLOY_ESCAPE", "Private payload contains a special filesystem entry.");
+    await mkdir(path.dirname(target), { recursive: true });
+    await scanOrCopyPrivateFile(source, target, forbidden, budget);
+}
+async function scanPrivateExport(root, forbidden, budget) {
+    for (const name of await readdir(root)) {
+        const file = path.join(root, name);
+        const metadata = await lstat(file);
+        budget.entries++;
+        checkPrivateBudget(budget);
+        if (metadata.isDirectory())
+            await scanPrivateExport(file, forbidden, budget);
+        else if (metadata.isFile())
+            await scanOrCopyPrivateFile(file, undefined, forbidden, budget);
+    }
 }

package/dist/commands/maintenance.d.ts

@@ -22,6 +22,7 @@ export declare function runMaintenanceCommand(options: {
     projectDir: string;
     store: Store;
     registry: RegistryClient;
+    env?: NodeJS.ProcessEnv;
 }): Promise<InstallResult | AuditResult>;
 export {};
 //# sourceMappingURL=maintenance.d.ts.map

package/dist/commands/maintenance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"maintenance.d.ts","sourceRoot":"","sources":["../../src/commands/maintenance.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AASvE,QAAA,MAAM,UAAU,YAAI,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;AAC5E,KAAK,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAC5C,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,aAAa,CAAC;IAChD,UAAU,EAAE,KAAK,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,QAAQ,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;IACH,iBAAiB,EAAE,OAAO,CAAC;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAUF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,OAAO,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;IACtC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;CAC1B,GAAG,OAAO,CAAC,aAAa,GAAG,WAAW,CAAC,CAoNvC"}
+{"version":3,"file":"maintenance.d.ts","sourceRoot":"","sources":["../../src/commands/maintenance.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AASvE,QAAA,MAAM,UAAU,YAAI,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;AAC5E,KAAK,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAC5C,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,aAAa,CAAC;IAChD,UAAU,EAAE,KAAK,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,QAAQ,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;IACH,iBAAiB,EAAE,OAAO,CAAC;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAUF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,OAAO,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;IACtC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,OAAO,CAAC,aAAa,GAAG,WAAW,CAAC,CAwOvC"}

package/dist/commands/maintenance.js

@@ -1,7 +1,12 @@
+import { findWorkspaceRoot, discoverWorkspaces, } from "../install/workspaces.js";
+import { readWorkspaceLock } from "../install/workspace-lock.js";
+import { currentPlatform } from "../resolve/resolver.js";
+import { loadProjectPatches } from "./patch.js";
+import { sha512Hex } from "../util/hash.js";
+import { canonicalJson } from "../util/json.js";
 /** Read-only advisory reporting and verified source prefetch. */
 import { readFile } from "node:fs/promises";
 import * as path from "node:path";
-import { json as fetchJson } from "npm-registry-fetch";
 import { satisfies, validRange } from "semver";
 import { ZyrkError } from "../errors.js";
 import { installProject } from "../install/run.js";
@@ -18,6 +23,9 @@ function usage(reason) {
     });
 }
 export async function runMaintenanceCommand(options) {
+    const workspaceRoot = await findWorkspaceRoot(options.projectDir);
+    if (workspaceRoot)
+        options = { ...options, projectDir: workspaceRoot };
     let frozen = false, offline = false;
     let threshold;
     for (let i = 0; i < options.args.length; i++) {
@@ -36,10 +44,19 @@ export async function runMaintenanceCommand(options) {
         else
             throw usage("an unsupported option or argument was supplied");
     }
-    if (options.command === "repair")
-        throw new ZyrkError("ZYRK_STORE_CORRUPT", "Cannot repair shared content in place while other projects may reference it.", {
-            remedy: "Use store verify to identify affected sources; immutable replacement and reverse-closure repair are not available yet.",
+    if (options.command === "repair") {
+        if (options.args.some((arg) => arg !== "--offline"))
+            throw usage("repair accepts only --offline");
+        return installProject({
+            projectDir: options.projectDir,
+            store: options.store,
+            registry: options.registry,
+            frozen: true,
+            repair: true,
+            offline,
+            ...(options.env ? { env: options.env } : {}),
         });
+    }
     if (options.command === "fetch") {
         if (!frozen)
             throw usage("fetch requires --frozen-lockfile");
@@ -50,6 +67,7 @@ export async function runMaintenanceCommand(options) {
             frozen: true,
             offline,
             fetchOnly: true,
+            ...(options.env ? { env: options.env } : {}),
         });
     }
     let manifest;
@@ -100,17 +118,34 @@ export async function runMaintenanceCommand(options) {
     const lock = await readLockfile(path.join(options.projectDir, "package-lock.json"));
     if (!lock?.doc.zyrk)
         throw lockMismatch("audit requires an exact zyrk lockfile");
+    const patches = await loadProjectPatches(options.projectDir);
     assertFrozenCompatible(lock.doc, {
-        manifest: manifestFingerprint(manifest),
+        manifest: workspaceRoot
+            ? (await discoverWorkspaces(workspaceRoot)).manifestFingerprint
+            : manifestFingerprint(manifest),
         scripts: scriptPolicyFingerprint(object(manifest.zyrk) ? manifest.zyrk.scripts : undefined),
         config: configFingerprint({
             registry: options.registry.origin,
             linker: "shared",
+            platform: currentPlatform(),
+            ...(object(manifest.zyrk) && Array.isArray(manifest.zyrk.mutablePackages)
+                ? { mutablePackages: manifest.zyrk.mutablePackages }
+                : {}),
+            ...(patches.length
+                ? {
+                    patches: sha512Hex(canonicalJson(patches.map((p) => ({
+                        sourceId: p.sourceId,
+                        digest: p.digest,
+                    })))),
+                }
+                : {}),
         }),
     });
-    const graph = lockedGraph(lock.doc);
+    const graphNodes = workspaceRoot
+        ? (await readWorkspaceLock(workspaceRoot, await discoverWorkspaces(workspaceRoot))).graph.nodes.filter((node) => node.kind === "registry")
+        : lockedGraph(lock.doc).nodes;
     const packages = Object.create(null);
-    for (const node of graph.nodes) {
+    for (const node of graphNodes) {
         if (node.origin !== options.registry.origin)
             throw new ZyrkError("ZYRK_POLICY_DENIED", "Cannot audit a graph from a different registry origin.", {
                 remedy: "Select the registry recorded by the lockfile before sending dependency names.",
@@ -119,19 +154,11 @@ export async function runMaintenanceCommand(options) {
         if (!packages[node.name].includes(node.version))
             packages[node.name].push(node.version);
     }
-    if (!graph.nodes.length)
+    if (!graphNodes.length)
         return base;
     let response;
     try {
-        response = await fetchJson(new URL("-/npm/v1/security/advisories/bulk", options.registry.registry)
-            .href, {
-            method: "POST",
-            body: packages,
-            registry: options.registry.registry,
-            retry: false,
-            timeout: 15_000,
-            headers: { "content-type": "application/json" },
-        });
+        response = await options.registry.auditAdvisories(packages);
     }
     catch {
         return {

package/dist/commands/patch.d.ts

@@ -20,6 +20,7 @@ export declare function hasProjectPatches(project: string): Promise<boolean>;
 /** Caller supplies the complete private generation, copied/reflinked without store hardlinks. */
 export declare function applyProjectPatches(options: {
     project: string;
+    store: Store;
     packages: ReadonlyMap<string, {
         sourceId: string;
         directory: string;

package/dist/commands/patch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"patch.d.ts","sourceRoot":"","sources":["../../src/commands/patch.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAS3C,KAAK,MAAM,GAAG;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,OAAO,CAAC;CACrB,CAAC;AACF,MAAM,MAAM,YAAY,GAAG;IACzB,aAAa,EAAE,CAAC,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AA+DF,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,kBAAkB,EAAE,CAAC,CA+C/B;AACD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEzE;AAED,iGAAiG;AACjG,wBAAsB,mBAAmB,CAAC,OAAO,EAAE;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxE,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAgD7C;AAED,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,OAAO,EAAE,OAAO,GAAG,cAAc,CAAC;IAClC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,KAAK,EAAE,KAAK,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,OAAO,CAAC,OAAO,CAAC,CAsBnB"}
+{"version":3,"file":"patch.d.ts","sourceRoot":"","sources":["../../src/commands/patch.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAS3C,KAAK,MAAM,GAAG;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,OAAO,CAAC;CACrB,CAAC;AACF,MAAM,MAAM,YAAY,GAAG;IACzB,aAAa,EAAE,CAAC,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AA+DF,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,kBAAkB,EAAE,CAAC,CA+C/B;AACD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEzE;AAED,iGAAiG;AACjG,wBAAsB,mBAAmB,CAAC,OAAO,EAAE;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxE,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CA4D7C;AAED,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,OAAO,EAAE,OAAO,GAAG,cAAc,CAAC;IAClC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,KAAK,EAAE,KAAK,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,OAAO,CAAC,OAAO,CAAC,CAwBnB"}