zyrk 0.5.0 → 0.5.1

package/README.md

@@ -116,8 +116,10 @@ Default registry and authentication settings are loaded from user/project
 token placeholders are supported. Credentials are restricted to their configured
 scheme, host, port, and path; redirects cannot expand that scope. Use
 `--registry=https://your-registry.example/` on install for an explicit registry.
-Mixed scoped routing and disabled TLS verification are rejected before public
-lookup. Git sources, non-workspace local sources, and overrides remain unsupported;
+Scoped registries route metadata, exact sources, imports and tool commands by
+the real package name, including aliases. Advisory requests are partitioned by
+registry; private names never fall back to a public endpoint. Disabled TLS
+verification is rejected before lookup. Git sources, non-workspace local sources, and overrides remain unsupported;
 they fail explicitly. Optional dependencies incompatible with the selected platform
 are omitted; missing packages, integrity failures, and other optional failures
 remain errors. Platform selection is recorded in the lock. macOS, Windows, and

package/VERSION

@@ -1 +1 @@
-v0.5.0
+v0.5.1

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAmEA,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC7B,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1C,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1C,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAwEF,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,MAAM,CAAC,CA0ZjB"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAoEA,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC7B,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1C,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1C,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAwEF,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAqZjB"}

package/dist/commands/deploy.js

@@ -1,3 +1,4 @@
+import { installedRegistryConfig } from "../install/registry-policy.js";
 /** Self-contained runtime deployment and explicit local Docker commands. */
 import { constants } from "node:fs";
 import { open, copyFile, chmod, lstat, mkdir, mkdtemp, readFile, readdir, readlink, realpath, rename, rm, symlink, writeFile, } from "node:fs/promises";
@@ -141,16 +142,14 @@ export async function runDeployCommand(options) {
                 manifestFingerprint(manifest))
             throw error("ZYRK_LOCK_MISMATCH", "Deployment manifest, lock, and installed generation disagree.");
         if (resolved.nodes.length) {
-            const origins = new Set(resolved.nodes.map((node) => node.origin));
-            if (origins.size !== 1)
-                throw error("ZYRK_DEPLOY_NONRELOCATABLE", "Mixed-origin deployment requires a validated registry adapter.");
+            const registryConfig = installedRegistryConfig(state, resolved.nodes);
             const patches = await loadProjectPatches(project);
             const policy = object(manifest.zyrk) ? manifest.zyrk : {};
             assertFrozenCompatible(doc, {
                 manifest: manifestFingerprint(manifest),
                 scripts: scriptPolicyFingerprint(policy.scripts),
                 config: configFingerprint({
-                    registry: [...origins][0],
+                    ...registryConfig,
                     linker: "shared",
                     platform: currentPlatform(),
                     ...(Array.isArray(policy.mutablePackages)
@@ -800,15 +799,12 @@ async function exportWorkspace(options, project, manifest, state, out, parent, f
     const policy = object(manifest.zyrk) ? manifest.zyrk : {};
     if (locked.doc.zyrk.scripts !== scriptPolicyFingerprint(policy.scripts))
         throw error("ZYRK_LOCK_MISMATCH", "Workspace deployment build policy changed after installation.");
-    const origins = new Set(locked.graph.nodes
-        .filter((n) => n.kind === "registry")
-        .map((n) => n.origin));
-    if (origins.size > 1)
-        throw error("ZYRK_DEPLOY_NONRELOCATABLE", "Mixed-origin workspace export requires a validated registry adapter.");
-    if (origins.size === 1) {
+    const registryNodesForPolicy = locked.graph.nodes.filter((n) => n.kind === "registry");
+    if (registryNodesForPolicy.length || state.registryConfig !== undefined) {
+        const registryConfig = installedRegistryConfig(state, registryNodesForPolicy);
         const patches = await loadProjectPatches(project);
         const expected = configFingerprint({
-            registry: [...origins][0],
+            ...registryConfig,
             linker: "shared",
             platform: currentPlatform(),
             ...(Array.isArray(policy.mutablePackages)

package/dist/commands/maintenance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"maintenance.d.ts","sourceRoot":"","sources":["../../src/commands/maintenance.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AASvE,QAAA,MAAM,UAAU,YAAI,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;AAC5E,KAAK,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAC5C,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,aAAa,CAAC;IAChD,UAAU,EAAE,KAAK,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,QAAQ,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;IACH,iBAAiB,EAAE,OAAO,CAAC;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAUF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,OAAO,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;IACtC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,OAAO,CAAC,aAAa,GAAG,WAAW,CAAC,CAwOvC"}
+{"version":3,"file":"maintenance.d.ts","sourceRoot":"","sources":["../../src/commands/maintenance.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AASvE,QAAA,MAAM,UAAU,YAAI,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;AAC5E,KAAK,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAC5C,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,aAAa,CAAC;IAChD,UAAU,EAAE,KAAK,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,QAAQ,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;IACH,iBAAiB,EAAE,OAAO,CAAC;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAUF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,OAAO,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;IACtC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,OAAO,CAAC,aAAa,GAAG,WAAW,CAAC,CAgQvC"}

package/dist/commands/maintenance.js

@@ -126,6 +126,7 @@ export async function runMaintenanceCommand(options) {
         scripts: scriptPolicyFingerprint(object(manifest.zyrk) ? manifest.zyrk.scripts : undefined),
         config: configFingerprint({
             registry: options.registry.origin,
+            registries: options.registry.scopedRegistries,
             linker: "shared",
             platform: currentPlatform(),
             ...(object(manifest.zyrk) && Array.isArray(manifest.zyrk.mutablePackages)
@@ -146,7 +147,7 @@ export async function runMaintenanceCommand(options) {
         : lockedGraph(lock.doc).nodes;
     const packages = Object.create(null);
     for (const node of graphNodes) {
-        if (node.origin !== options.registry.origin)
+        if (node.origin !== options.registry.originFor(node.name))
             throw new ZyrkError("ZYRK_POLICY_DENIED", "Cannot audit a graph from a different registry origin.", {
                 remedy: "Select the registry recorded by the lockfile before sending dependency names.",
             });
@@ -158,7 +159,26 @@ export async function runMaintenanceCommand(options) {
         return base;
     let response;
     try {
-        response = await options.registry.auditAdvisories(packages);
+        const groups = new Map();
+        for (const [name, versions] of Object.entries(packages)) {
+            const client = options.registry.forPackage(name);
+            let selected = groups.get(client);
+            if (!selected) {
+                selected = Object.create(null);
+                groups.set(client, selected);
+            }
+            selected[name] = versions;
+        }
+        const replies = await Promise.all([...groups].map(async ([client, selected]) => {
+            const reply = await client.auditAdvisories(selected);
+            if (!object(reply) ||
+                Object.keys(reply).some((name) => !Object.hasOwn(selected, name)))
+                return null;
+            return reply;
+        }));
+        response = replies.some((reply) => reply === null)
+            ? null
+            : Object.assign({}, ...replies);
     }
     catch {
         return {

package/dist/fetch/package.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"package.d.ts","sourceRoot":"","sources":["../../src/fetch/package.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,EAAkB,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAGxC,OAAO,EAA0B,KAAK,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAA6B,MAAM,eAAe,CAAC;AAE1E;;2EAE2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,IAAI,IAAI,CAAC;IACnB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,wBAAgB,oBAAoB,CAClC,OAAO,GAAE;IACP,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;CACjB,GACL;IAAE,SAAS,EAAE,cAAc,CAAC;IAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAAC,KAAK,IAAI,IAAI,CAAA;CAAE,CAuDzE;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,EAAE,WAAW,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACnC,4EAA4E;IAC5E,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,wEAAwE;IACxE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,aAAc,SAAQ,eAAe;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,aAAa,CAAC,CA+IxB"}
+{"version":3,"file":"package.d.ts","sourceRoot":"","sources":["../../src/fetch/package.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,EAAkB,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAGxC,OAAO,EAA0B,KAAK,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAA6B,MAAM,eAAe,CAAC;AAE1E;;2EAE2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,IAAI,IAAI,CAAC;IACnB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,wBAAgB,oBAAoB,CAClC,OAAO,GAAE;IACP,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;CACjB,GACL;IAAE,SAAS,EAAE,cAAc,CAAC;IAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAAC,KAAK,IAAI,IAAI,CAAA;CAAE,CAuDzE;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,EAAE,WAAW,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACnC,4EAA4E;IAC5E,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,wEAAwE;IACxE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,aAAc,SAAQ,eAAe;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,aAAa,CAAC,CAgJxB"}

package/dist/fetch/package.js

@@ -72,7 +72,8 @@ export function createFetchOperation(options = {}) {
  * Callers resolve the version first; this function never guesses.
  */
 export async function fetchAndCommitSource(options) {
-    const { store, registry, txn, name, version } = options;
+    const { store, txn, name, version } = options;
+    const registry = options.registry.forPackage(name);
     const label = `${name}@${version}`;
     // ---- 1. Metadata: exact version entry for the resolved identity ----
     options.operation?.checkpoint();

package/dist/fetch/registry.d.ts

@@ -48,6 +48,7 @@ export interface Packument {
     modified?: string;
 }
 export interface RegistryClientOptions {
+    scopedRegistries?: Readonly<Record<string, string>>;
     /** Registry base URL; must be http(s). Trailing slash optional. */
     registry: string;
     userAgent: string;
@@ -83,6 +84,10 @@ export declare class RegistryClient {
     /** Credential-free registry origin; participates in source identity (§8.1). */
     get origin(): string;
     get registry(): string;
+    /** Routing always follows the real package name, including npm aliases. */
+    forPackage(name: string): RegistryClient;
+    originFor(name: string): string;
+    get scopedRegistries(): Readonly<Record<string, string>>;
     /** Fetch the (abbreviated) packument for an exact package name. */
     packument(name: string, options?: {
         signal?: AbortSignal;

package/dist/fetch/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/fetch/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAc9B,wEAAwE;AACxE,eAAO,MAAM,yBAAyB,QAAoB,CAAC;AAE3D,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB,gCAAgC,CAAC;AAK9D,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,aAAa,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9D,mBAAmB,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC;IACpB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,qBAAa,cAAc;;IAezB,YAAY,OAAO,EAAE,qBAAqB,EA2CzC;IAED,+EAA+E;IAC/E,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,mEAAmE;IAC7D,SAAS,CACb,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACrC,OAAO,CAAC,SAAS,CAAC,CAqBpB;IAED,sFAAsF;IAChF,eAAe,CACnB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,EACrD,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACrC,OAAO,CAAC,OAAO,CAAC,CA8BlB;IAsCD;;;;OAIG;IACG,eAAe,CAAC,OAAO,EAAE;QAC7B,GAAG,EAAE,MAAM,CAAC;QACZ,6EAA6E;QAC7E,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;QACtC,QAAQ,EAAE,MAAM,CAAC;QACjB,oDAAoD;QACpD,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,gFAAgF;QAChF,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;KACnC,GAAG,OAAO,CAAC,cAAc,CAAC,CA2G1B;CAuLF;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,aAAa,GAClB,MAAM,GAAG,SAAS,CAQpB;AAgDD;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAqB9D"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/fetch/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAc9B,wEAAwE;AACxE,eAAO,MAAM,yBAAyB,QAAoB,CAAC;AAE3D,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB,gCAAgC,CAAC;AAK9D,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,aAAa,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9D,mBAAmB,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC;IACpB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,qBAAa,cAAc;;IAiBzB,YAAY,OAAO,EAAE,qBAAqB,EAuGzC;IAED,+EAA+E;IAC/E,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,2EAA2E;IAC3E,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAKvC;IACD,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9B;IACD,IAAI,gBAAgB,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAIvD;IAED,mEAAmE;IAC7D,SAAS,CACb,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACrC,OAAO,CAAC,SAAS,CAAC,CAsBpB;IAED,sFAAsF;IAChF,eAAe,CACnB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,EACrD,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACrC,OAAO,CAAC,OAAO,CAAC,CA6ClB;IAsCD;;;;OAIG;IACG,eAAe,CAAC,OAAO,EAAE;QAC7B,GAAG,EAAE,MAAM,CAAC;QACZ,6EAA6E;QAC7E,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;QACtC,QAAQ,EAAE,MAAM,CAAC;QACjB,oDAAoD;QACpD,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,gFAAgF;QAChF,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;KACnC,GAAG,OAAO,CAAC,cAAc,CAAC,CA2G1B;CA4MF;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,aAAa,GAClB,MAAM,GAAG,SAAS,CAQpB;AAgDD;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAqB9D"}

package/dist/fetch/registry.js

@@ -22,6 +22,8 @@ export const DEFAULT_REGISTRY = "https://registry.npmjs.org/";
 /** npm's abbreviated packument media type, used for installs. */
 const INSTALL_V1_ACCEPT = "application/vnd.npm.install-v1+json";
 export class RegistryClient {
+    #routeBoundaries = [];
+    #scopedClients = new Map();
     #registry;
     #origin;
     #userAgent;
@@ -30,7 +32,7 @@ export class RegistryClient {
     #maxTarballBytes;
     #maxMetadataBytes;
     #maxTotalMetadataBytes;
-    #totalMetadataBytes = 0;
+    #metadataBudget = { bytes: 0 };
     #maxMetadataVersions;
     #requestDeadlineMs;
     #signal;
@@ -59,13 +61,51 @@ export class RegistryClient {
             base.timeout = options.timeoutMs;
         const parsed = safeTransportOptions(options.fetchOptions ?? {}, registry);
         this.#fetchOptions = { ...base, ...parsed.transport, strictSSL: true };
-        this.#credentials = parsed.credentials;
+        const boundary = new URL(registry);
+        this.#credentials = parsed.credentials.filter(({ scope }) => scope.origin === boundary.origin &&
+            (scope.pathname.startsWith(boundary.pathname) ||
+                boundary.pathname.startsWith(scope.pathname)));
         this.#maxMetadataBytes = positiveLimit(options.maxMetadataBytes ?? 32 * 1024 * 1024, "maxMetadataBytes");
         this.#maxTotalMetadataBytes = positiveLimit(options.maxTotalMetadataBytes ?? 128 * 1024 * 1024, "maxTotalMetadataBytes");
         this.#maxMetadataVersions = positiveLimit(options.maxMetadataVersions ?? 100_000, "maxMetadataVersions");
         this.#requestDeadlineMs = positiveLimit(options.requestDeadlineMs ?? 120_000, "requestDeadlineMs");
         positiveLimit(this.#maxTarballBytes, "maxTarballBytes");
         this.#signal = options.signal;
+        const { scopedRegistries, ...baseOptions } = options;
+        for (const [scope, selected] of Object.entries(scopedRegistries ?? {}).sort(([a], [b]) => a.localeCompare(b))) {
+            if (!/^@[a-z0-9][a-z0-9._-]*$/.test(scope))
+                throw new ZyrkError("ZYRK_POLICY_DENIED", "Invalid scoped registry name.", { remedy: "Use an npm @scope registry setting." });
+            const { headers, ...childFetchOptions } = options.fetchOptions ?? {};
+            const client = new RegistryClient({
+                ...baseOptions,
+                fetchOptions: childFetchOptions,
+                registry: selected,
+            });
+            // Raw Authorization headers are scoped once to the original registry.
+            // Cloning must never reinterpret them as credentials for a child host.
+            for (const authorization of Object.values((headers ?? {}))) {
+                const originalScope = new URL(registry), childScope = new URL(client.registry);
+                if (originalScope.origin === childScope.origin &&
+                    (originalScope.pathname.startsWith(childScope.pathname) ||
+                        childScope.pathname.startsWith(originalScope.pathname)))
+                    client.#credentials.push({ scope: originalScope, authorization });
+            }
+            client.#credentials.sort((a, b) => b.scope.pathname.length - a.scope.pathname.length);
+            client.#metadataBudget = this.#metadataBudget;
+            this.#scopedClients.set(scope, client);
+        }
+        // A containing public registry must not borrow a credential belonging to a
+        // narrower configured private registry on the same host. Explicit broad
+        // credentials retain their declared scope, including use by child routes.
+        const clients = [this, ...this.#scopedClients.values()];
+        const boundaries = clients.map((client) => new URL(client.registry));
+        for (const client of clients) {
+            const own = new URL(client.registry);
+            client.#routeBoundaries = boundaries;
+            client.#credentials = client.#credentials.filter(({ scope }) => !boundaries.some((boundary) => boundary.origin === scope.origin &&
+                boundary.pathname.length > own.pathname.length &&
+                scope.pathname.startsWith(boundary.pathname)));
+        }
     }
     /** Credential-free registry origin; participates in source identity (§8.1). */
     get origin() {
@@ -74,9 +114,24 @@ export class RegistryClient {
     get registry() {
         return this.#registry;
     }
+    /** Routing always follows the real package name, including npm aliases. */
+    forPackage(name) {
+        validateRegistryPackageName(name);
+        return name.startsWith("@")
+            ? (this.#scopedClients.get(name.slice(0, name.indexOf("/"))) ?? this)
+            : this;
+    }
+    originFor(name) {
+        return this.forPackage(name).origin;
+    }
+    get scopedRegistries() {
+        return Object.fromEntries([...this.#scopedClients].map(([scope, client]) => [scope, client.origin]));
+    }
     /** Fetch the (abbreviated) packument for an exact package name. */
     async packument(name, options = {}) {
-        validateRegistryPackageName(name);
+        const selected = this.forPackage(name);
+        if (selected !== this)
+            return selected.packument(name, options);
         const url = `${this.#registry}${escapePackageName(name)}`;
         this.#logger?.debug("fetching packument", { name, url });
         let raw;
@@ -96,6 +151,14 @@ export class RegistryClient {
                 versions.some((version) => typeof version !== "string"))
                 throw new ZyrkError("ZYRK_POLICY_DENIED", "Invalid registry advisory package versions.");
         }
+        const routes = new Set(Object.keys(packages).map((name) => this.forPackage(name)));
+        if (routes.size > 1)
+            throw new ZyrkError("ZYRK_POLICY_DENIED", "Mixed-registry audit requests must be partitioned by registry.", {
+                remedy: "Audit each selected registry independently so private names are never disclosed across origins.",
+            });
+        const selected = [...routes][0];
+        if (selected && selected !== this)
+            return selected.auditAdvisories(packages, options);
         const body = JSON.stringify(packages);
         if (Buffer.byteLength(body) > this.#maxMetadataBytes)
             throw resourceLimit("advisory request bytes", this.#maxMetadataBytes, "maxMetadataBytes");
@@ -107,10 +170,10 @@ export class RegistryClient {
         }
     }
     #countMetadataBytes(bytes, responseBytes) {
-        this.#totalMetadataBytes += bytes;
+        this.#metadataBudget.bytes += bytes;
         if (responseBytes > this.#maxMetadataBytes)
             throw resourceLimit("metadata bytes", this.#maxMetadataBytes, "maxMetadataBytes");
-        if (this.#totalMetadataBytes > this.#maxTotalMetadataBytes)
+        if (this.#metadataBudget.bytes > this.#maxTotalMetadataBytes)
             throw resourceLimit("total metadata bytes", this.#maxTotalMetadataBytes, "maxTotalMetadataBytes");
     }
     async #readMetadata(response) {
@@ -226,6 +289,15 @@ export class RegistryClient {
             throw mapFetchError(error, `download tarball for ${options.label}`);
         }
     }
+    #insideAdvisoryBoundary(url) {
+        const registryScope = new URL(this.#registry);
+        return (url.origin === registryScope.origin &&
+            url.pathname.startsWith(registryScope.pathname) &&
+            !/%(?:2f|5c|2e)/i.test(url.pathname) &&
+            !this.#routeBoundaries.some((boundary) => boundary.origin === url.origin &&
+                boundary.pathname.length > registryScope.pathname.length &&
+                url.pathname.startsWith(boundary.pathname)));
+    }
     async #withRequest(url, accept, consume, signal, request = {}) {
         const controller = new AbortController();
         let active;
@@ -246,6 +318,10 @@ export class RegistryClient {
             cancel();
         try {
             let current = parseTarballUrl(url, "registry request");
+            if (request.method === "POST" && !this.#insideAdvisoryBoundary(current))
+                throw new ZyrkError("ZYRK_FETCH_REFUSED", "Registry advisory endpoint overlaps another configured registry or has an ambiguous path.", {
+                    remedy: "Use a distinct advisory endpoint within the selected registry's own route.",
+                });
             let crossedBoundary = false;
             for (let hop = 0; hop <= 10; hop++) {
                 if (controller.signal.aborted)
@@ -317,10 +393,8 @@ export class RegistryClient {
                     if (current.protocol === "https:" && next.protocol !== "https:")
                         throw new ZyrkError("ZYRK_FETCH_REFUSED", "Registry HTTPS downgrade redirect refused.", { remedy: "Use HTTPS for every registry redirect." });
                     if (request.method === "POST") {
-                        const registryScope = new URL(this.#registry);
                         if (![307, 308].includes(active.status) ||
-                            next.origin !== registryScope.origin ||
-                            !next.pathname.startsWith(registryScope.pathname))
+                            !this.#insideAdvisoryBoundary(next))
                             throw new ZyrkError("ZYRK_FETCH_REFUSED", "Registry advisory redirect crosses its authorized endpoint boundary or changes POST semantics.", {
                                 remedy: "Configure the advisory service directly within the selected registry; private package names are never forwarded outside that boundary.",
                             });
@@ -421,8 +495,8 @@ export function validateRegistryPackageName(name) {
     // eslint-disable-next-line no-control-regex
     if (/[\u0000-\u0020\u007f]/.test(name))
         bad("control or whitespace character");
-    if (!/^(?:@[^/@]+\/)?[^/@]+$/.test(name))
-        bad("shape is not `name` or `@scope/name`");
+    if (!/^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/.test(name))
+        bad("name must use supported lowercase npm package characters");
     for (const segment of name.split("/")) {
         if (segment === "." || segment === "..")
             bad("path-like segment");

package/dist/install/import-npm-workspace.d.ts

@@ -1,5 +1,5 @@
 import type { NpmLockDoc } from "../lockfile/types.ts";
 import type { WorkspaceProject } from "./workspaces.ts";
 import type { WorkspaceGraph } from "./workspace-graph.ts";
-export declare function importNpmWorkspaceLock(doc: NpmLockDoc, project: WorkspaceProject, origin: string): WorkspaceGraph;
+export declare function importNpmWorkspaceLock(doc: NpmLockDoc, project: WorkspaceProject, origin: string | ((name: string) => string)): WorkspaceGraph;
 //# sourceMappingURL=import-npm-workspace.d.ts.map

package/dist/install/import-npm-workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"import-npm-workspace.d.ts","sourceRoot":"","sources":["../../src/install/import-npm-workspace.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAQvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,sBAAsB,CAAC;AAE9B,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,MAAM,GACb,cAAc,CAyThB"}
+{"version":3,"file":"import-npm-workspace.d.ts","sourceRoot":"","sources":["../../src/install/import-npm-workspace.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAQvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,sBAAsB,CAAC;AAE9B,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,GAC1C,cAAc,CAyThB"}

package/dist/install/import-npm-workspace.js

@@ -62,7 +62,7 @@ export function importNpmWorkspaceLock(doc, project, origin) {
     if (doc.zyrk ||
         ![2, 3].includes(doc.lockfileVersion ?? 0) ||
         !doc.packages ||
-        !cleanUrl(origin))
+        (typeof origin === "string" && !cleanUrl(origin)))
         throw lockMismatch("workspace adoption needs an unannotated npm v2/v3 lock");
     const packages = doc.packages;
     const graph = { nodes: [], importers: {}, omissions: [] };

package/dist/install/import-npm.d.ts

@@ -1,4 +1,4 @@
 import type { NpmLockDoc } from "../lockfile/types.ts";
 import type { FinalizedGraph } from "../resolve/resolver.ts";
-export declare function importNpmLock(doc: NpmLockDoc, requirements: Record<string, string>, origin: string): FinalizedGraph;
+export declare function importNpmLock(doc: NpmLockDoc, requirements: Record<string, string>, origin: string | ((name: string) => string)): FinalizedGraph;
 //# sourceMappingURL=import-npm.d.ts.map

package/dist/install/import-npm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"import-npm.d.ts","sourceRoot":"","sources":["../../src/install/import-npm.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,wBAAwB,CAAC;AAKhC,wBAAgB,aAAa,CAC3B,GAAG,EAAE,UAAU,EACf,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,MAAM,EAAE,MAAM,GACb,cAAc,CA0KhB"}
+{"version":3,"file":"import-npm.d.ts","sourceRoot":"","sources":["../../src/install/import-npm.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,wBAAwB,CAAC;AAKhC,wBAAgB,aAAa,CAC3B,GAAG,EAAE,UAAU,EACf,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,GAC1C,cAAc,CA4KhB"}

package/dist/install/import-npm.js

@@ -32,6 +32,7 @@ export function importNpmLock(doc, requirements, origin) {
         if (!entry || entry.link === true || entry.inBundle === true)
             throw lockMismatch("npm lock contains an unsupported linked or bundled selection");
         const request = parseRequirement(edgeName, spec);
+        const selectedOrigin = typeof origin === "string" ? origin : origin(request.realName);
         const name = typeof entry.name === "string" ? entry.name : request.realName;
         const integrity = typeof entry.integrity === "string"
             ? canonicalStrongSri(entry.integrity)
@@ -55,13 +56,13 @@ export function importNpmLock(doc, requirements, origin) {
             key: `${name}@${entry.version}#${sha512Hex(location).slice(0, 16)}`,
             name,
             version: entry.version,
-            origin,
+            origin: selectedOrigin,
             integrity,
             sourceId: sourceIdOf({
                 sourceType: "registry",
                 name,
                 version: entry.version,
-                origin,
+                origin: selectedOrigin,
                 integrity,
             }),
             tarballUrl: entry.resolved,

package/dist/install/registry-policy.d.ts

@@ -0,0 +1,9 @@
+export type InstalledRegistryConfig = {
+    registry: string;
+    registries?: Readonly<Record<string, string>>;
+};
+export declare function installedRegistryConfig(state: Record<string, unknown>, nodes: readonly {
+    name: string;
+    origin: string;
+}[]): InstalledRegistryConfig;
+//# sourceMappingURL=registry-policy.d.ts.map

package/dist/install/registry-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-policy.d.ts","sourceRoot":"","sources":["../../src/install/registry-policy.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC/C,CAAC;AACF,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,KAAK,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAAE,GACjD,uBAAuB,CAqCzB"}

package/dist/install/registry-policy.js

@@ -0,0 +1,30 @@
+/** Credential-free routing captured with the exact installed generation. */
+import { cleanUrl, lockMismatch } from "./lock.js";
+export function installedRegistryConfig(state, nodes) {
+    const object = (x) => !!x && typeof x === "object" && !Array.isArray(x);
+    const raw = state.registryConfig;
+    if (raw === undefined) {
+        const origins = new Set(nodes.map((n) => n.origin));
+        if (origins.size !== 1)
+            throw lockMismatch("legacy installed state has no exact registry routing");
+        return { registry: [...origins][0] };
+    }
+    if (!object(raw) ||
+        Object.keys(raw).some((k) => !["registry", "registries"].includes(k)) ||
+        typeof raw.registry !== "string" ||
+        !cleanUrl(raw.registry) ||
+        !object(raw.registries) ||
+        Object.entries(raw.registries).some(([scope, url]) => !/^@[a-z0-9][a-z0-9._-]*$/.test(scope) ||
+            typeof url !== "string" ||
+            !cleanUrl(url)))
+        throw lockMismatch("installed registry routing is malformed");
+    const registries = raw.registries;
+    for (const node of nodes) {
+        const expected = node.name.startsWith("@")
+            ? (registries[node.name.slice(0, node.name.indexOf("/"))] ?? raw.registry)
+            : raw.registry;
+        if (node.origin !== expected)
+            throw lockMismatch("installed registry routing disagrees with selected sources");
+    }
+    return { registry: raw.registry, registries };
+}

package/dist/install/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/install/registry.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,cAAc,EAAoB,MAAM,sBAAsB,CAAC;AAKxE,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,cAAc,CAAC,CAwI1B"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/install/registry.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,cAAc,EAAoB,MAAM,sBAAsB,CAAC;AAKxE,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,cAAc,CAAC,CAuI1B"}

package/dist/install/registry.js

@@ -11,6 +11,7 @@ import { cleanUrl } from "./lock.js";
 export async function installRegistry(options) {
     let registry = DEFAULT_REGISTRY;
     const auth = {};
+    const scopedRegistries = {};
     const home = options.env.HOME ?? os.homedir();
     const project = (await findWorkspaceRoot(options.cwd)) ??
         (await findProjectBoundary(options.cwd)) ??
@@ -64,9 +65,7 @@ export async function installRegistry(options) {
             if (key === "registry")
                 registry = value;
             if (/^@.+:registry$/.test(key))
-                throw new ZyrkError("ZYRK_POLICY_DENIED", "Scoped registry routing is not supported by native commands yet.", {
-                    remedy: "Use npm for mixed-registry projects; zyrk will not silently fetch a private scope from a public registry.",
-                });
+                scopedRegistries[key.slice(0, -9)] = value;
             if (key === "strict-ssl" && value === "false")
                 throw new ZyrkError("ZYRK_POLICY_DENIED", "Disabling registry TLS verification is not supported.", {
                     remedy: "Configure a trusted HTTPS registry with valid TLS certificates.",
@@ -80,18 +79,24 @@ export async function installRegistry(options) {
             options.env.npm_config_registry ??
             options.env.NPM_CONFIG_REGISTRY ??
             registry;
-    if (!cleanUrl(registry))
-        throw new ZyrkError("ZYRK_POLICY_DENIED", "Registry URL must be HTTP(S) without credentials, query parameters, or fragments.", {
-            remedy: "Use a credential-free registry URL and configure URL-scoped credentials separately in .npmrc.",
-        });
-    const url = new URL(registry);
-    if (url.protocol !== "https:" &&
-        !["127.0.0.1", "localhost", "[::1]"].includes(url.hostname))
-        throw new ZyrkError("ZYRK_POLICY_DENIED", "Remote registries require HTTPS.", {
-            remedy: "Select an HTTPS registry; HTTP is limited to loopback development registries.",
-        });
+    const validate = (registry) => {
+        if (!cleanUrl(registry))
+            throw new ZyrkError("ZYRK_POLICY_DENIED", "Registry URL must be HTTP(S) without credentials, query parameters, or fragments.", {
+                remedy: "Use a credential-free registry URL and configure URL-scoped credentials separately in .npmrc.",
+            });
+        const url = new URL(registry);
+        if (url.protocol !== "https:" &&
+            !["127.0.0.1", "localhost", "[::1]"].includes(url.hostname))
+            throw new ZyrkError("ZYRK_POLICY_DENIED", "Remote registries require HTTPS.", {
+                remedy: "Select an HTTPS registry; HTTP is limited to loopback development registries.",
+            });
+    };
+    validate(registry);
+    for (const selected of Object.values(scopedRegistries))
+        validate(selected);
     return new RegistryClient({
         registry,
+        scopedRegistries,
         userAgent: `zyrk/${options.version}`,
         fetchOptions: auth,
     });

package/dist/install/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/install/run.ts"],"names":[],"mappings":"AAIA,OAAO,EAOL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAWtB,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAgC3C,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE;QACZ,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,CAAC;AACF,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EACL,OAAO,GACP,uBAAuB,GACvB,eAAe,GACf,SAAS,GACT,cAAc,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;CAC3B,CAAC;AA6GF,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CA4wBxB"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/install/run.ts"],"names":[],"mappings":"AAIA,OAAO,EAOL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAWtB,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAgC3C,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE;QACZ,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,CAAC;AACF,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EACL,OAAO,GACP,uBAAuB,GACvB,eAAe,GACf,SAAS,GACT,cAAc,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;CAC3B,CAAC;AA6GF,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAsxBxB"}

package/dist/install/run.js

@@ -197,6 +197,7 @@ export async function installProject(options) {
             scripts: scriptPolicyFingerprint(scriptPolicy(manifest)),
             config: configFingerprint({
                 registry: options.registry.origin,
+                registries: options.registry.scopedRegistries,
                 linker: "shared",
                 platform: currentPlatform(),
                 ...(object(manifest.zyrk) &&
@@ -214,7 +215,7 @@ export async function installProject(options) {
         if (existing && !existing.zyrk) {
             if (options.frozen || options.offline || specs.length)
                 throw lockMismatch("npm-only lockfile requires a non-frozen adoption install before adding packages");
-            resolved = importNpmLock(existing, allDeps, options.registry.origin);
+            resolved = importNpmLock(existing, allDeps, (name) => options.registry.originFor(name));
         }
         if (existing?.zyrk &&
             specs.length === 0 &&
@@ -242,6 +243,7 @@ export async function installProject(options) {
             resolved = await resolveRequirements({
                 provider: {
                     origin: options.registry.origin,
+                    originFor: (name) => options.registry.originFor(name),
                     packument: (name) => options.registry.packument(name, {
                         signal: operation.operation.signal,
                     }),
@@ -342,7 +344,7 @@ export async function installProject(options) {
             if (!packageName(node.name) ||
                 !cleanUrl(node.origin) ||
                 !cleanUrl(node.tarballUrl) ||
-                node.origin !== options.registry.origin)
+                node.origin !== options.registry.originFor(node.name))
                 throw error("ZYRK_POLICY_DENIED", "Selected source has an unsupported or credential-bearing registry origin or archive URL.");
         }
         const selectedRoots = resolved.roots.filter((r) => !options.omitDev ||
@@ -458,7 +460,9 @@ export async function installProject(options) {
             if (options.offline)
                 throw error("ZYRK_OFFLINE_MISSING", `Verified source for ${node.name}@${node.version} is missing from the store.`);
             const tarball = path.join(txn.dir, `${node.sourceId}.tgz`);
-            const download = await options.registry.downloadTarball({
+            const download = await options.registry
+                .forPackage(node.name)
+                .downloadTarball({
                 signal: operation.operation.signal,
                 onBytes: operation.operation.consumeArchiveBytes,
                 url: node.tarballUrl,
@@ -680,6 +684,10 @@ export async function installProject(options) {
                 instances: registration.instances,
                 activeContexts: registration.contexts,
                 lockDigest: sha512Hex(canonicalJson(doc)),
+                registryConfig: {
+                    registry: options.registry.origin,
+                    registries: options.registry.scopedRegistries,
+                },
                 graphDigest: digest,
                 platform: process.platform,
                 arch: process.arch,

package/dist/install/workspace-graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-graph.d.ts","sourceRoot":"","sources":["../../src/install/workspace-graph.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EAChB,MAAM,wBAAwB,CAAC;AAKhC,OAAO,EAEL,KAAK,gBAAgB,EAEtB,MAAM,iBAAiB,CAAC;AAGzB,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACrC,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,QAAQ,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACrC,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;AACF,MAAM,MAAM,aAAa,GAAG,kBAAkB,GAAG,qBAAqB,CAAC;AACvE,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;CACxE,CAAC;AAYF,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,gBAAgB,EACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,GAAE;IACP,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,KAAK,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5B,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CAChB,GACL,OAAO,CAAC,cAAc,CAAC,CAkWzB;AACD,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,cAAc,GACpB,kBAAkB,EAAE,CAetB;AAED,uGAAuG;AACvG,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,MAAM,CAgCR;AAED,oFAAoF;AACpF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAsCnE"}
+{"version":3,"file":"workspace-graph.d.ts","sourceRoot":"","sources":["../../src/install/workspace-graph.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EAChB,MAAM,wBAAwB,CAAC;AAKhC,OAAO,EAEL,KAAK,gBAAgB,EAEtB,MAAM,iBAAiB,CAAC;AAGzB,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACrC,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,QAAQ,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACrC,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;AACF,MAAM,MAAM,aAAa,GAAG,kBAAkB,GAAG,qBAAqB,CAAC;AACvE,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;CACxE,CAAC;AAYF,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,gBAAgB,EACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,GAAE;IACP,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,KAAK,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5B,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CAChB,GACL,OAAO,CAAC,cAAc,CAAC,CAoWzB;AACD,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,cAAc,GACpB,kBAAkB,EAAE,CAetB;AAED,uGAAuG;AACvG,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,MAAM,CAgCR;AAED,oFAAoF;AACpF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAsCnE"}

package/dist/install/workspace-graph.js

@@ -151,7 +151,8 @@ export async function resolveWorkspaceGraph(project, provider, options = {}) {
             const key = `${requirement.realName}@${version}#${sha512Hex(parent.key + "\0" + name).slice(0, 16)}`;
             if (byKey.has(key))
                 return key;
-            if (!cleanUrl(provider.origin) || !cleanUrl(entry.dist.tarball))
+            const origin = provider.originFor?.(requirement.realName) ?? provider.origin;
+            if (!cleanUrl(origin) || !cleanUrl(entry.dist.tarball))
                 fail("unsafe registry source metadata");
             const bin = typeof entry.bin === "string"
                 ? { [requirement.realName.split("/").at(-1)]: entry.bin }
@@ -165,10 +166,10 @@ export async function resolveWorkspaceGraph(project, provider, options = {}) {
                     sourceType: "registry",
                     name: requirement.realName,
                     version,
-                    origin: provider.origin,
+                    origin,
                     integrity,
                 }),
-                origin: provider.origin,
+                origin,
                 integrity,
                 tarballUrl: entry.dist.tarball,
                 bin,

package/dist/install/workspace-install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-install.d.ts","sourceRoot":"","sources":["../../src/install/workspace-install.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAyH9D,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAopBxB"}
+{"version":3,"file":"workspace-install.d.ts","sourceRoot":"","sources":["../../src/install/workspace-install.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAwH9D,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CA+pBxB"}

package/dist/install/workspace-install.js

@@ -61,7 +61,7 @@ async function readNpmWorkspaceImport(root, project, options) {
     catch {
         throw lockMismatch("npm workspace adoption needs an existing readable JSON lock");
     }
-    const graph = importNpmWorkspaceLock(npmDoc, project, options.registry.origin);
+    const graph = importNpmWorkspaceLock(npmDoc, project, (name) => options.registry.originFor(name));
     // Prove the complete graph and ordinary npm projection are representable
     // before any project state is created. Actual policy fingerprints are added
     // under the install lock after policy validation.
@@ -70,6 +70,7 @@ async function readNpmWorkspaceImport(root, project, options) {
         scripts: scriptPolicyFingerprint(undefined),
         config: configFingerprint({
             registry: options.registry.origin,
+            registries: options.registry.scopedRegistries,
             linker: "shared",
         }),
     });
@@ -131,6 +132,7 @@ export async function installWorkspaceProject(options) {
             scripts: scriptPolicyFingerprint(policy),
             config: configFingerprint({
                 registry: options.registry.origin,
+                registries: options.registry.scopedRegistries,
                 linker: "shared",
                 platform: currentPlatform(),
                 ...(mutable !== undefined
@@ -144,7 +146,7 @@ export async function installWorkspaceProject(options) {
             : undefined;
         let existing = options.importNpm
             ? null
-            : await readWorkspaceLock(root, project, options.registry.origin), graph = imported;
+            : await readWorkspaceLock(root, project, (name) => options.registry.originFor(name)), graph = imported;
         if (existing) {
             const ext = existing.doc.zyrk;
             if (!mutation.changed &&
@@ -160,6 +162,7 @@ export async function installWorkspaceProject(options) {
                 throw lockMismatch("offline/frozen workspace install needs a compatible lock");
             graph = await resolveWorkspaceGraph(project, {
                 origin: options.registry.origin,
+                originFor: (name) => options.registry.originFor(name),
                 packument: (name) => options.registry.packument(name, {
                     signal: operation.operation.signal,
                 }),
@@ -264,7 +267,9 @@ export async function installWorkspaceProject(options) {
                     throw new ZyrkError("ZYRK_OFFLINE_MISSING", `Verified workspace dependency ${node.name}@${node.version} is missing.`, {
                         remedy: "Fetch the exact locked sources online before retrying offline.",
                     });
-                const archive = path.join(txn.dir, `${node.sourceId}.tgz`), download = await options.registry.downloadTarball({
+                const archive = path.join(txn.dir, `${node.sourceId}.tgz`), download = await options.registry
+                    .forPackage(node.name)
+                    .downloadTarball({
                     url: node.tarballUrl,
                     expectedIntegrity: node.integrity,
                     destPath: archive,
@@ -508,6 +513,10 @@ export async function installWorkspaceProject(options) {
                     instances: registration.instances,
                     activeContexts: registration.contexts,
                     lockDigest: sha512Hex(canonicalJson(doc)),
+                    registryConfig: {
+                        registry: options.registry.origin,
+                        registries: options.registry.scopedRegistries,
+                    },
                     graphDigest: graphHash(sourceGraph),
                     platform: process.platform,
                     arch: process.arch,

package/dist/install/workspace-lock.d.ts

@@ -9,7 +9,7 @@ export type WorkspaceFingerprints = {
 export declare function safeImporter(id: unknown): id is string;
 export declare function workspaceLockDoc(project: WorkspaceProject, graph: WorkspaceGraph, fp: WorkspaceFingerprints): NpmLockDoc;
 export declare function validateWorkspaceLockDoc(doc: unknown): WorkspaceGraph;
-export declare function readWorkspaceLock(root: string, project?: WorkspaceProject, registryOrigin?: string): Promise<{
+export declare function readWorkspaceLock(root: string, project?: WorkspaceProject, registryOrigin?: string | ((name: string) => string)): Promise<{
     doc: NpmLockDoc;
     graph: WorkspaceGraph;
 } | null>;

package/dist/install/workspace-lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-lock.d.ts","sourceRoot":"","sources":["../../src/install/workspace-lock.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AASvD,OAAO,KAAK,EAAE,cAAc,EAAiB,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGxD,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAGF,wBAAgB,YAAY,CAAC,EAAE,EAAE,OAAO,GAAG,EAAE,IAAI,MAAM,CAqBtD;AACD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,qBAAqB,GACxB,UAAU,CAyCZ;AACD,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAgTrE;AACD,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,gBAAgB,EAC1B,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC;IAAE,GAAG,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GAAG,IAAI,CAAC,CAsC5D"}
+{"version":3,"file":"workspace-lock.d.ts","sourceRoot":"","sources":["../../src/install/workspace-lock.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AASvD,OAAO,KAAK,EAAE,cAAc,EAAiB,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGxD,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAGF,wBAAgB,YAAY,CAAC,EAAE,EAAE,OAAO,GAAG,EAAE,IAAI,MAAM,CAqBtD;AACD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,qBAAqB,GACxB,UAAU,CAyCZ;AACD,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAgTrE;AACD,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,gBAAgB,EAC1B,cAAc,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,GACnD,OAAO,CAAC;IAAE,GAAG,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GAAG,IAAI,CAAC,CA2C5D"}

package/dist/install/workspace-lock.js

@@ -333,7 +333,11 @@ export async function readWorkspaceLock(root, project, registryOrigin) {
             throw lockMismatch("workspace importer is missing");
     }
     if (registryOrigin &&
-        graph.nodes.some((n) => n.kind === "registry" && n.origin !== registryOrigin))
+        graph.nodes.some((n) => n.kind === "registry" &&
+            n.origin !==
+                (typeof registryOrigin === "string"
+                    ? registryOrigin
+                    : registryOrigin(n.name))))
         throw lockMismatch("workspace registry origin differs");
     return { doc: doc, graph };
 }

package/dist/lockfile/fingerprints.d.ts

@@ -32,6 +32,7 @@ export declare function scriptPolicyFingerprint(policy: unknown): string;
 export type ResolutionConfig = {
     /** Credential-free registry origin. */
     registry: string;
+    registries?: Readonly<Record<string, string>>;
     linker: "shared" | "local";
     patches?: string;
     mutablePackages?: readonly string[];

package/dist/lockfile/fingerprints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fingerprints.d.ts","sourceRoot":"","sources":["../../src/lockfile/fingerprints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,MAAM,MAAM,mBAAmB,GAAG;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,MAAM,CA2BzE;AAED,eAAO,MAAM,qBAAqB;IAAK,OAAO;IAAU,KAAK;IAAM,IAAI;CAAM,CAAC;AAE9E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAG/D;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACvD,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAUlE"}
+{"version":3,"file":"fingerprints.d.ts","sourceRoot":"","sources":["../../src/lockfile/fingerprints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,MAAM,MAAM,mBAAmB,GAAG;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,MAAM,CA2BzE;AAED,eAAO,MAAM,qBAAqB;IAAK,OAAO;IAAU,KAAK;IAAM,IAAI;CAAM,CAAC;AAE9E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAG/D;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACvD,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAalE"}

package/dist/lockfile/fingerprints.js

@@ -55,6 +55,9 @@ export function scriptPolicyFingerprint(policy) {
 export function configFingerprint(config) {
     return fingerprintOf({
         registry: config.registry,
+        ...(config.registries && Object.keys(config.registries).length
+            ? { registries: config.registries }
+            : {}),
         linker: config.linker,
         ...(config.patches === undefined ? {} : { patches: config.patches }),
         ...(config.platform === undefined ? {} : { platform: config.platform }),

package/dist/resolve/resolver.d.ts

@@ -22,6 +22,7 @@
 import { type Packument } from "../fetch/registry.ts";
 export type MetadataProvider = {
     readonly origin: string;
+    originFor?(name: string): string;
     packument(name: string): Promise<Packument>;
 };
 export type EdgeKind = "prod" | "optional" | "peer";

package/dist/resolve/resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/resolve/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,EAEL,KAAK,SAAS,EAEf,MAAM,sBAAsB,CAAC;AAK9B,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;AAEpD,MAAM,MAAM,YAAY,GAAG;IACzB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,YAAY,EAAE,KAAK,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC,CAAC;IACH,QAAQ,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACxE,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACzE,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,eAAe,IAAI,eAAe,CAcjD;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACjC,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,oDAAoD;IACpD,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD,CAAC;AAEF,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CA+BzB"}
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/resolve/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,EAEL,KAAK,SAAS,EAEf,MAAM,sBAAsB,CAAC;AAK9B,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;AAEpD,MAAM,MAAM,YAAY,GAAG;IACzB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,YAAY,EAAE,KAAK,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC,CAAC;IACH,QAAQ,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACxE,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACzE,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,eAAe,IAAI,eAAe,CAcjD;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACjC,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,oDAAoD;IACpD,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD,CAAC;AAEF,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CA+BzB"}

package/dist/resolve/resolver.js

@@ -381,14 +381,14 @@ class ResolverState {
                 throw internal("missing finalized key");
             const existing = byKey.get(key);
             if (existing !== undefined) {
-                assertMergeable(existing, occ, keys, this.provider.origin);
+                assertMergeable(existing, occ, keys, this.provider.originFor?.(occ.name) ?? this.provider.origin);
                 continue;
             }
             byKey.set(key, occ);
         }
         const nodes = [...byKey.entries()]
             .sort((a, b) => compareStrings(a[0], b[0]))
-            .map(([key, occ]) => toResolved(occ, key, keys, this.provider.origin));
+            .map(([key, occ]) => toResolved(occ, key, keys, this.provider.originFor?.(occ.name) ?? this.provider.origin));
         const roots = rootLinks.map((link) => {
             const target = keys.get(link.child);
             if (target === undefined)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zyrk",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Storage-efficient Node package manager: one verified store per user, shared across projects through links.",
   "license": "MIT",
   "type": "module",