zyrk 0.5.0 → 0.5.2

package/README.md

@@ -116,8 +116,10 @@ Default registry and authentication settings are loaded from user/project
 token placeholders are supported. Credentials are restricted to their configured
 scheme, host, port, and path; redirects cannot expand that scope. Use
 `--registry=https://your-registry.example/` on install for an explicit registry.
-Mixed scoped routing and disabled TLS verification are rejected before public
-lookup. Git sources, non-workspace local sources, and overrides remain unsupported;
+Scoped registries route metadata, exact sources, imports and tool commands by
+the real package name, including aliases. Advisory requests are partitioned by
+registry; private names never fall back to a public endpoint. Disabled TLS
+verification is rejected before lookup. Git sources and non-workspace local sources remain unsupported;
 they fail explicitly. Optional dependencies incompatible with the selected platform
 are omitted; missing packages, integrity failures, and other optional failures
 remain errors. Platform selection is recorded in the lock. macOS, Windows, and
@@ -354,3 +356,9 @@ Keep existing data until an explicit migration is supported.
 
 [MIT](LICENSE). If you want to support development,
 [sponsor the maintainer](https://github.com/sponsors/kingjethro999).
+
+Root `package.json` dependency overrides support exact specifications, nested and
+version-qualified selectors, self rules (`.`), and `$direct` references. Direct
+dependency overrides must match the declared specification. Workspace member
+overrides are ignored, matching npm root-only policy. Override rule order is
+recorded in the manifest fingerprint; frozen installs reject policy drift.

package/VERSION

@@ -1 +1 @@
-v0.5.0
+v0.5.2

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAmEA,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC7B,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1C,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1C,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAwEF,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,MAAM,CAAC,CA0ZjB"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAoEA,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC7B,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1C,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1C,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAwEF,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAqZjB"}

package/dist/commands/deploy.js

@@ -1,3 +1,4 @@
+import { installedRegistryConfig } from "../install/registry-policy.js";
 /** Self-contained runtime deployment and explicit local Docker commands. */
 import { constants } from "node:fs";
 import { open, copyFile, chmod, lstat, mkdir, mkdtemp, readFile, readdir, readlink, realpath, rename, rm, symlink, writeFile, } from "node:fs/promises";
@@ -141,16 +142,14 @@ export async function runDeployCommand(options) {
                 manifestFingerprint(manifest))
             throw error("ZYRK_LOCK_MISMATCH", "Deployment manifest, lock, and installed generation disagree.");
         if (resolved.nodes.length) {
-            const origins = new Set(resolved.nodes.map((node) => node.origin));
-            if (origins.size !== 1)
-                throw error("ZYRK_DEPLOY_NONRELOCATABLE", "Mixed-origin deployment requires a validated registry adapter.");
+            const registryConfig = installedRegistryConfig(state, resolved.nodes);
             const patches = await loadProjectPatches(project);
             const policy = object(manifest.zyrk) ? manifest.zyrk : {};
             assertFrozenCompatible(doc, {
                 manifest: manifestFingerprint(manifest),
                 scripts: scriptPolicyFingerprint(policy.scripts),
                 config: configFingerprint({
-                    registry: [...origins][0],
+                    ...registryConfig,
                     linker: "shared",
                     platform: currentPlatform(),
                     ...(Array.isArray(policy.mutablePackages)
@@ -800,15 +799,12 @@ async function exportWorkspace(options, project, manifest, state, out, parent, f
     const policy = object(manifest.zyrk) ? manifest.zyrk : {};
     if (locked.doc.zyrk.scripts !== scriptPolicyFingerprint(policy.scripts))
         throw error("ZYRK_LOCK_MISMATCH", "Workspace deployment build policy changed after installation.");
-    const origins = new Set(locked.graph.nodes
-        .filter((n) => n.kind === "registry")
-        .map((n) => n.origin));
-    if (origins.size > 1)
-        throw error("ZYRK_DEPLOY_NONRELOCATABLE", "Mixed-origin workspace export requires a validated registry adapter.");
-    if (origins.size === 1) {
+    const registryNodesForPolicy = locked.graph.nodes.filter((n) => n.kind === "registry");
+    if (registryNodesForPolicy.length || state.registryConfig !== undefined) {
+        const registryConfig = installedRegistryConfig(state, registryNodesForPolicy);
         const patches = await loadProjectPatches(project);
         const expected = configFingerprint({
-            registry: [...origins][0],
+            ...registryConfig,
             linker: "shared",
             platform: currentPlatform(),
             ...(Array.isArray(policy.mutablePackages)

package/dist/commands/maintenance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"maintenance.d.ts","sourceRoot":"","sources":["../../src/commands/maintenance.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AASvE,QAAA,MAAM,UAAU,YAAI,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;AAC5E,KAAK,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAC5C,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,aAAa,CAAC;IAChD,UAAU,EAAE,KAAK,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,QAAQ,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;IACH,iBAAiB,EAAE,OAAO,CAAC;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAUF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,OAAO,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;IACtC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,OAAO,CAAC,aAAa,GAAG,WAAW,CAAC,CAwOvC"}
+{"version":3,"file":"maintenance.d.ts","sourceRoot":"","sources":["../../src/commands/maintenance.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AASvE,QAAA,MAAM,UAAU,YAAI,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;AAC5E,KAAK,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAC5C,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,aAAa,CAAC;IAChD,UAAU,EAAE,KAAK,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,QAAQ,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;IACH,iBAAiB,EAAE,OAAO,CAAC;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAUF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,OAAO,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;IACtC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,OAAO,CAAC,aAAa,GAAG,WAAW,CAAC,CAgQvC"}

package/dist/commands/maintenance.js

@@ -126,6 +126,7 @@ export async function runMaintenanceCommand(options) {
         scripts: scriptPolicyFingerprint(object(manifest.zyrk) ? manifest.zyrk.scripts : undefined),
         config: configFingerprint({
             registry: options.registry.origin,
+            registries: options.registry.scopedRegistries,
             linker: "shared",
             platform: currentPlatform(),
             ...(object(manifest.zyrk) && Array.isArray(manifest.zyrk.mutablePackages)
@@ -146,7 +147,7 @@ export async function runMaintenanceCommand(options) {
         : lockedGraph(lock.doc).nodes;
     const packages = Object.create(null);
     for (const node of graphNodes) {
-        if (node.origin !== options.registry.origin)
+        if (node.origin !== options.registry.originFor(node.name))
             throw new ZyrkError("ZYRK_POLICY_DENIED", "Cannot audit a graph from a different registry origin.", {
                 remedy: "Select the registry recorded by the lockfile before sending dependency names.",
             });
@@ -158,7 +159,26 @@ export async function runMaintenanceCommand(options) {
         return base;
     let response;
     try {
-        response = await options.registry.auditAdvisories(packages);
+        const groups = new Map();
+        for (const [name, versions] of Object.entries(packages)) {
+            const client = options.registry.forPackage(name);
+            let selected = groups.get(client);
+            if (!selected) {
+                selected = Object.create(null);
+                groups.set(client, selected);
+            }
+            selected[name] = versions;
+        }
+        const replies = await Promise.all([...groups].map(async ([client, selected]) => {
+            const reply = await client.auditAdvisories(selected);
+            if (!object(reply) ||
+                Object.keys(reply).some((name) => !Object.hasOwn(selected, name)))
+                return null;
+            return reply;
+        }));
+        response = replies.some((reply) => reply === null)
+            ? null
+            : Object.assign({}, ...replies);
     }
     catch {
         return {

package/dist/fetch/package.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"package.d.ts","sourceRoot":"","sources":["../../src/fetch/package.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,EAAkB,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAGxC,OAAO,EAA0B,KAAK,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAA6B,MAAM,eAAe,CAAC;AAE1E;;2EAE2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,IAAI,IAAI,CAAC;IACnB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,wBAAgB,oBAAoB,CAClC,OAAO,GAAE;IACP,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;CACjB,GACL;IAAE,SAAS,EAAE,cAAc,CAAC;IAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAAC,KAAK,IAAI,IAAI,CAAA;CAAE,CAuDzE;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,EAAE,WAAW,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACnC,4EAA4E;IAC5E,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,wEAAwE;IACxE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,aAAc,SAAQ,eAAe;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,aAAa,CAAC,CA+IxB"}
+{"version":3,"file":"package.d.ts","sourceRoot":"","sources":["../../src/fetch/package.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,EAAkB,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAGxC,OAAO,EAA0B,KAAK,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAA6B,MAAM,eAAe,CAAC;AAE1E;;2EAE2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,IAAI,IAAI,CAAC;IACnB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,wBAAgB,oBAAoB,CAClC,OAAO,GAAE;IACP,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;CACjB,GACL;IAAE,SAAS,EAAE,cAAc,CAAC;IAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAAC,KAAK,IAAI,IAAI,CAAA;CAAE,CAuDzE;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,EAAE,WAAW,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACnC,4EAA4E;IAC5E,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,wEAAwE;IACxE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,aAAc,SAAQ,eAAe;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,aAAa,CAAC,CAgJxB"}

package/dist/fetch/package.js

@@ -72,7 +72,8 @@ export function createFetchOperation(options = {}) {
  * Callers resolve the version first; this function never guesses.
  */
 export async function fetchAndCommitSource(options) {
-    const { store, registry, txn, name, version } = options;
+    const { store, txn, name, version } = options;
+    const registry = options.registry.forPackage(name);
     const label = `${name}@${version}`;
     // ---- 1. Metadata: exact version entry for the resolved identity ----
     options.operation?.checkpoint();

package/dist/fetch/registry.d.ts

@@ -48,6 +48,7 @@ export interface Packument {
     modified?: string;
 }
 export interface RegistryClientOptions {
+    scopedRegistries?: Readonly<Record<string, string>>;
     /** Registry base URL; must be http(s). Trailing slash optional. */
     registry: string;
     userAgent: string;
@@ -83,6 +84,10 @@ export declare class RegistryClient {
     /** Credential-free registry origin; participates in source identity (§8.1). */
     get origin(): string;
     get registry(): string;
+    /** Routing always follows the real package name, including npm aliases. */
+    forPackage(name: string): RegistryClient;
+    originFor(name: string): string;
+    get scopedRegistries(): Readonly<Record<string, string>>;
     /** Fetch the (abbreviated) packument for an exact package name. */
     packument(name: string, options?: {
         signal?: AbortSignal;

package/dist/fetch/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/fetch/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAc9B,wEAAwE;AACxE,eAAO,MAAM,yBAAyB,QAAoB,CAAC;AAE3D,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB,gCAAgC,CAAC;AAK9D,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,aAAa,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9D,mBAAmB,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC;IACpB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,qBAAa,cAAc;;IAezB,YAAY,OAAO,EAAE,qBAAqB,EA2CzC;IAED,+EAA+E;IAC/E,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,mEAAmE;IAC7D,SAAS,CACb,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACrC,OAAO,CAAC,SAAS,CAAC,CAqBpB;IAED,sFAAsF;IAChF,eAAe,CACnB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,EACrD,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACrC,OAAO,CAAC,OAAO,CAAC,CA8BlB;IAsCD;;;;OAIG;IACG,eAAe,CAAC,OAAO,EAAE;QAC7B,GAAG,EAAE,MAAM,CAAC;QACZ,6EAA6E;QAC7E,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;QACtC,QAAQ,EAAE,MAAM,CAAC;QACjB,oDAAoD;QACpD,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,gFAAgF;QAChF,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;KACnC,GAAG,OAAO,CAAC,cAAc,CAAC,CA2G1B;CAuLF;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,aAAa,GAClB,MAAM,GAAG,SAAS,CAQpB;AAgDD;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAqB9D"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/fetch/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAc9B,wEAAwE;AACxE,eAAO,MAAM,yBAAyB,QAAoB,CAAC;AAE3D,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB,gCAAgC,CAAC;AAK9D,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,aAAa,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9D,mBAAmB,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC;IACpB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,qBAAa,cAAc;;IAiBzB,YAAY,OAAO,EAAE,qBAAqB,EAuGzC;IAED,+EAA+E;IAC/E,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,2EAA2E;IAC3E,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAKvC;IACD,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9B;IACD,IAAI,gBAAgB,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAIvD;IAED,mEAAmE;IAC7D,SAAS,CACb,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACrC,OAAO,CAAC,SAAS,CAAC,CAsBpB;IAED,sFAAsF;IAChF,eAAe,CACnB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,EACrD,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACrC,OAAO,CAAC,OAAO,CAAC,CA6ClB;IAsCD;;;;OAIG;IACG,eAAe,CAAC,OAAO,EAAE;QAC7B,GAAG,EAAE,MAAM,CAAC;QACZ,6EAA6E;QAC7E,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;QACtC,QAAQ,EAAE,MAAM,CAAC;QACjB,oDAAoD;QACpD,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,gFAAgF;QAChF,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;KACnC,GAAG,OAAO,CAAC,cAAc,CAAC,CA2G1B;CA4MF;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,aAAa,GAClB,MAAM,GAAG,SAAS,CAQpB;AAgDD;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAqB9D"}

package/dist/fetch/registry.js

@@ -22,6 +22,8 @@ export const DEFAULT_REGISTRY = "https://registry.npmjs.org/";
 /** npm's abbreviated packument media type, used for installs. */
 const INSTALL_V1_ACCEPT = "application/vnd.npm.install-v1+json";
 export class RegistryClient {
+    #routeBoundaries = [];
+    #scopedClients = new Map();
     #registry;
     #origin;
     #userAgent;
@@ -30,7 +32,7 @@ export class RegistryClient {
     #maxTarballBytes;
     #maxMetadataBytes;
     #maxTotalMetadataBytes;
-    #totalMetadataBytes = 0;
+    #metadataBudget = { bytes: 0 };
     #maxMetadataVersions;
     #requestDeadlineMs;
     #signal;
@@ -59,13 +61,51 @@ export class RegistryClient {
             base.timeout = options.timeoutMs;
         const parsed = safeTransportOptions(options.fetchOptions ?? {}, registry);
         this.#fetchOptions = { ...base, ...parsed.transport, strictSSL: true };
-        this.#credentials = parsed.credentials;
+        const boundary = new URL(registry);
+        this.#credentials = parsed.credentials.filter(({ scope }) => scope.origin === boundary.origin &&
+            (scope.pathname.startsWith(boundary.pathname) ||
+                boundary.pathname.startsWith(scope.pathname)));
         this.#maxMetadataBytes = positiveLimit(options.maxMetadataBytes ?? 32 * 1024 * 1024, "maxMetadataBytes");
         this.#maxTotalMetadataBytes = positiveLimit(options.maxTotalMetadataBytes ?? 128 * 1024 * 1024, "maxTotalMetadataBytes");
         this.#maxMetadataVersions = positiveLimit(options.maxMetadataVersions ?? 100_000, "maxMetadataVersions");
         this.#requestDeadlineMs = positiveLimit(options.requestDeadlineMs ?? 120_000, "requestDeadlineMs");
         positiveLimit(this.#maxTarballBytes, "maxTarballBytes");
         this.#signal = options.signal;
+        const { scopedRegistries, ...baseOptions } = options;
+        for (const [scope, selected] of Object.entries(scopedRegistries ?? {}).sort(([a], [b]) => a.localeCompare(b))) {
+            if (!/^@[a-z0-9][a-z0-9._-]*$/.test(scope))
+                throw new ZyrkError("ZYRK_POLICY_DENIED", "Invalid scoped registry name.", { remedy: "Use an npm @scope registry setting." });
+            const { headers, ...childFetchOptions } = options.fetchOptions ?? {};
+            const client = new RegistryClient({
+                ...baseOptions,
+                fetchOptions: childFetchOptions,
+                registry: selected,
+            });
+            // Raw Authorization headers are scoped once to the original registry.
+            // Cloning must never reinterpret them as credentials for a child host.
+            for (const authorization of Object.values((headers ?? {}))) {
+                const originalScope = new URL(registry), childScope = new URL(client.registry);
+                if (originalScope.origin === childScope.origin &&
+                    (originalScope.pathname.startsWith(childScope.pathname) ||
+                        childScope.pathname.startsWith(originalScope.pathname)))
+                    client.#credentials.push({ scope: originalScope, authorization });
+            }
+            client.#credentials.sort((a, b) => b.scope.pathname.length - a.scope.pathname.length);
+            client.#metadataBudget = this.#metadataBudget;
+            this.#scopedClients.set(scope, client);
+        }
+        // A containing public registry must not borrow a credential belonging to a
+        // narrower configured private registry on the same host. Explicit broad
+        // credentials retain their declared scope, including use by child routes.
+        const clients = [this, ...this.#scopedClients.values()];
+        const boundaries = clients.map((client) => new URL(client.registry));
+        for (const client of clients) {
+            const own = new URL(client.registry);
+            client.#routeBoundaries = boundaries;
+            client.#credentials = client.#credentials.filter(({ scope }) => !boundaries.some((boundary) => boundary.origin === scope.origin &&
+                boundary.pathname.length > own.pathname.length &&
+                scope.pathname.startsWith(boundary.pathname)));
+        }
     }
     /** Credential-free registry origin; participates in source identity (§8.1). */
     get origin() {
@@ -74,9 +114,24 @@ export class RegistryClient {
     get registry() {
         return this.#registry;
     }
+    /** Routing always follows the real package name, including npm aliases. */
+    forPackage(name) {
+        validateRegistryPackageName(name);
+        return name.startsWith("@")
+            ? (this.#scopedClients.get(name.slice(0, name.indexOf("/"))) ?? this)
+            : this;
+    }
+    originFor(name) {
+        return this.forPackage(name).origin;
+    }
+    get scopedRegistries() {
+        return Object.fromEntries([...this.#scopedClients].map(([scope, client]) => [scope, client.origin]));
+    }
     /** Fetch the (abbreviated) packument for an exact package name. */
     async packument(name, options = {}) {
-        validateRegistryPackageName(name);
+        const selected = this.forPackage(name);
+        if (selected !== this)
+            return selected.packument(name, options);
         const url = `${this.#registry}${escapePackageName(name)}`;
         this.#logger?.debug("fetching packument", { name, url });
         let raw;
@@ -96,6 +151,14 @@ export class RegistryClient {
                 versions.some((version) => typeof version !== "string"))
                 throw new ZyrkError("ZYRK_POLICY_DENIED", "Invalid registry advisory package versions.");
         }
+        const routes = new Set(Object.keys(packages).map((name) => this.forPackage(name)));
+        if (routes.size > 1)
+            throw new ZyrkError("ZYRK_POLICY_DENIED", "Mixed-registry audit requests must be partitioned by registry.", {
+                remedy: "Audit each selected registry independently so private names are never disclosed across origins.",
+            });
+        const selected = [...routes][0];
+        if (selected && selected !== this)
+            return selected.auditAdvisories(packages, options);
         const body = JSON.stringify(packages);
         if (Buffer.byteLength(body) > this.#maxMetadataBytes)
             throw resourceLimit("advisory request bytes", this.#maxMetadataBytes, "maxMetadataBytes");
@@ -107,10 +170,10 @@ export class RegistryClient {
         }
     }
     #countMetadataBytes(bytes, responseBytes) {
-        this.#totalMetadataBytes += bytes;
+        this.#metadataBudget.bytes += bytes;
         if (responseBytes > this.#maxMetadataBytes)
             throw resourceLimit("metadata bytes", this.#maxMetadataBytes, "maxMetadataBytes");
-        if (this.#totalMetadataBytes > this.#maxTotalMetadataBytes)
+        if (this.#metadataBudget.bytes > this.#maxTotalMetadataBytes)
             throw resourceLimit("total metadata bytes", this.#maxTotalMetadataBytes, "maxTotalMetadataBytes");
     }
     async #readMetadata(response) {
@@ -226,6 +289,15 @@ export class RegistryClient {
             throw mapFetchError(error, `download tarball for ${options.label}`);
         }
     }
+    #insideAdvisoryBoundary(url) {
+        const registryScope = new URL(this.#registry);
+        return (url.origin === registryScope.origin &&
+            url.pathname.startsWith(registryScope.pathname) &&
+            !/%(?:2f|5c|2e)/i.test(url.pathname) &&
+            !this.#routeBoundaries.some((boundary) => boundary.origin === url.origin &&
+                boundary.pathname.length > registryScope.pathname.length &&
+                url.pathname.startsWith(boundary.pathname)));
+    }
     async #withRequest(url, accept, consume, signal, request = {}) {
         const controller = new AbortController();
         let active;
@@ -246,6 +318,10 @@ export class RegistryClient {
             cancel();
         try {
             let current = parseTarballUrl(url, "registry request");
+            if (request.method === "POST" && !this.#insideAdvisoryBoundary(current))
+                throw new ZyrkError("ZYRK_FETCH_REFUSED", "Registry advisory endpoint overlaps another configured registry or has an ambiguous path.", {
+                    remedy: "Use a distinct advisory endpoint within the selected registry's own route.",
+                });
             let crossedBoundary = false;
             for (let hop = 0; hop <= 10; hop++) {
                 if (controller.signal.aborted)
@@ -317,10 +393,8 @@ export class RegistryClient {
                     if (current.protocol === "https:" && next.protocol !== "https:")
                         throw new ZyrkError("ZYRK_FETCH_REFUSED", "Registry HTTPS downgrade redirect refused.", { remedy: "Use HTTPS for every registry redirect." });
                     if (request.method === "POST") {
-                        const registryScope = new URL(this.#registry);
                         if (![307, 308].includes(active.status) ||
-                            next.origin !== registryScope.origin ||
-                            !next.pathname.startsWith(registryScope.pathname))
+                            !this.#insideAdvisoryBoundary(next))
                             throw new ZyrkError("ZYRK_FETCH_REFUSED", "Registry advisory redirect crosses its authorized endpoint boundary or changes POST semantics.", {
                                 remedy: "Configure the advisory service directly within the selected registry; private package names are never forwarded outside that boundary.",
                             });
@@ -421,8 +495,8 @@ export function validateRegistryPackageName(name) {
     // eslint-disable-next-line no-control-regex
     if (/[\u0000-\u0020\u007f]/.test(name))
         bad("control or whitespace character");
-    if (!/^(?:@[^/@]+\/)?[^/@]+$/.test(name))
-        bad("shape is not `name` or `@scope/name`");
+    if (!/^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/.test(name))
+        bad("name must use supported lowercase npm package characters");
     for (const segment of name.split("/")) {
         if (segment === "." || segment === "..")
             bad("path-like segment");

package/dist/install/import-npm-workspace.d.ts

@@ -1,5 +1,6 @@
 import type { NpmLockDoc } from "../lockfile/types.ts";
 import type { WorkspaceProject } from "./workspaces.ts";
 import type { WorkspaceGraph } from "./workspace-graph.ts";
-export declare function importNpmWorkspaceLock(doc: NpmLockDoc, project: WorkspaceProject, origin: string): WorkspaceGraph;
+/** Import stays pure while live-node scope refinement converges. */
+export declare function importNpmWorkspaceLock(doc: NpmLockDoc, project: WorkspaceProject, origin: string | ((name: string) => string)): WorkspaceGraph;
 //# sourceMappingURL=import-npm-workspace.d.ts.map

package/dist/install/import-npm-workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"import-npm-workspace.d.ts","sourceRoot":"","sources":["../../src/install/import-npm-workspace.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAQvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,sBAAsB,CAAC;AAE9B,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,MAAM,GACb,cAAc,CAyThB"}
+{"version":3,"file":"import-npm-workspace.d.ts","sourceRoot":"","sources":["../../src/install/import-npm-workspace.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAQvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,sBAAsB,CAAC;AA0V9B,oEAAoE;AACpE,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,GAC1C,cAAc,CAWhB"}

package/dist/install/import-npm-workspace.js

@@ -1,5 +1,6 @@
 /** Translate npm's physical virtual tree without selecting new registry versions. */
 import * as path from "node:path";
+import { workspaceOverrides, refineWorkspaceOverride, WorkspaceOverrideRestart, } from "./workspace-overrides.js";
 import { satisfies } from "semver";
 import { validateLockDoc } from "../lockfile/read.js";
 import { sha512Hex } from "../util/hash.js";
@@ -8,7 +9,7 @@ import { importNpmLock } from "./import-npm.js";
 import { lockMismatch, cleanUrl } from "./lock.js";
 import { ZyrkError } from "../errors.js";
 import { assertWorkspacePlatform } from "./workspace-graph.js";
-export function importNpmWorkspaceLock(doc, project, origin) {
+function importNpmWorkspaceLockPass(doc, project, origin, overrideState) {
     if (!doc ||
         typeof doc !== "object" ||
         Array.isArray(doc) ||
@@ -62,9 +63,11 @@ export function importNpmWorkspaceLock(doc, project, origin) {
     if (doc.zyrk ||
         ![2, 3].includes(doc.lockfileVersion ?? 0) ||
         !doc.packages ||
-        !cleanUrl(origin))
+        (typeof origin === "string" && !cleanUrl(origin)))
         throw lockMismatch("workspace adoption needs an unannotated npm v2/v3 lock");
     const packages = doc.packages;
+    const overrides = overrideState.policy;
+    const contexts = new Map(overrideState.contexts);
     const graph = { nodes: [], importers: {}, omissions: [] };
     const locations = new Map();
     const local = new Map(project.importers.map((i) => [i.id === "." ? "" : i.id, i]));
@@ -131,7 +134,10 @@ export function importNpmWorkspaceLock(doc, project, origin) {
         }
     };
     const populated = new Set();
-    const load = (location, name, spec, from) => {
+    const load = (location, name, spec, from, parentContext) => {
+        const selectedOverride = overrides.select(parentContext, name, spec);
+        spec = selectedOverride.spec;
+        const contextKey = `${location}\0${selectedOverride.context.id}`;
         const entry = packages[location];
         if (entry.link === true) {
             const target = locations.get(entry.resolved);
@@ -143,6 +149,7 @@ export function importNpmWorkspaceLock(doc, project, origin) {
                     (!["*", "^", "~"].includes(range) &&
                         !satisfies(target.version, range)))
                 throw lockMismatch("npm workspace link disagrees with requirement");
+            refineWorkspaceOverride(overrideState.contexts, target.key, selectedOverride.context);
             return target;
         }
         // Reuse the strict single-selection adapter's archive, alias, source and
@@ -155,12 +162,12 @@ export function importNpmWorkspaceLock(doc, project, origin) {
             lockfileVersion: 3,
             packages: { "": {}, [`node_modules/${name}`]: shallow },
         }, { [name]: spec }, origin).nodes[0];
-        let node = locations.get(location);
+        let node = locations.get(contextKey);
         if (!node) {
             const { peerBindings: _bindings, ...source } = selected;
             node = {
                 ...source,
-                key: `${selected.name}@${selected.version}#${sha512Hex(location).slice(0, 16)}`,
+                key: `${selected.name}@${selected.version}#${sha512Hex(selectedOverride.context.id ? contextKey : location).slice(0, 16)}`,
                 kind: "registry",
                 edges: [],
                 peers: {},
@@ -168,25 +175,26 @@ export function importNpmWorkspaceLock(doc, project, origin) {
             };
             assertWorkspacePlatform({ nodes: [node], importers: {}, omissions: [] });
             graph.nodes.push(node);
-            locations.set(location, node);
+            locations.set(contextKey, node);
+            contexts.set(node.key, selectedOverride.context);
         }
         try {
             populate(location, node);
         }
         catch (cause) {
-            populated.delete(location);
-            locations.delete(location);
+            populated.delete(node.key);
+            locations.delete(contextKey);
             graph.nodes = graph.nodes.filter((n) => n !== node);
             throw cause;
         }
         return node;
     };
     const populate = (location, node) => {
-        if (populated.has(location))
+        if (populated.has(node.key))
             return;
         if (populated.size >= 10000)
             throw lockMismatch("npm import resource limit exceeded");
-        populated.add(location);
+        populated.add(node.key);
         const entry = packages[location];
         const requirements = new Map();
         for (const [field, kind] of [
@@ -227,7 +235,7 @@ export function importNpmWorkspaceLock(doc, project, origin) {
             }
             let target;
             try {
-                target = load(targetLocation, name, requirement.spec, location);
+                target = load(targetLocation, name, requirement.spec, location, contexts.get(node.key));
             }
             catch (cause) {
                 if (requirement.kind === "optional" &&
@@ -259,7 +267,7 @@ export function importNpmWorkspaceLock(doc, project, origin) {
                 node.peers[name] = null;
                 continue;
             }
-            const target = load(targetLocation, name, spec, location);
+            const target = load(targetLocation, name, spec, location, contexts.get(node.key));
             node.peers[name] = target.key;
             if (!node.edges.some((edge) => edge.name === name))
                 node.edges.push({ name, target: target.key, kind: "peer", spec });
@@ -281,3 +289,17 @@ export function importNpmWorkspaceLock(doc, project, origin) {
     graph.nodes.sort((a, b) => a.key.localeCompare(b.key));
     return graph;
 }
+/** Import stays pure while live-node scope refinement converges. */
+export function importNpmWorkspaceLock(doc, project, origin) {
+    const state = workspaceOverrides(project), expires = Date.now() + 30000;
+    for (let round = 0; round < 128 && Date.now() < expires; round++) {
+        try {
+            return importNpmWorkspaceLockPass(doc, project, origin, state);
+        }
+        catch (cause) {
+            if (!(cause instanceof WorkspaceOverrideRestart))
+                throw cause;
+        }
+    }
+    throw lockMismatch("npm workspace override import resource limit exceeded");
+}

package/dist/install/import-npm.d.ts

@@ -1,4 +1,6 @@
+/** Adopt npm v2/v3 exact selections without asking the registry to pick versions. */
+import { type OverridePolicy } from "../resolve/overrides.ts";
 import type { NpmLockDoc } from "../lockfile/types.ts";
 import type { FinalizedGraph } from "../resolve/resolver.ts";
-export declare function importNpmLock(doc: NpmLockDoc, requirements: Record<string, string>, origin: string): FinalizedGraph;
+export declare function importNpmLock(doc: NpmLockDoc, requirements: Record<string, string>, origin: string | ((name: string) => string), overrides?: OverridePolicy): FinalizedGraph;
 //# sourceMappingURL=import-npm.d.ts.map

package/dist/install/import-npm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"import-npm.d.ts","sourceRoot":"","sources":["../../src/install/import-npm.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,wBAAwB,CAAC;AAKhC,wBAAgB,aAAa,CAC3B,GAAG,EAAE,UAAU,EACf,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,MAAM,EAAE,MAAM,GACb,cAAc,CA0KhB"}
+{"version":3,"file":"import-npm.d.ts","sourceRoot":"","sources":["../../src/install/import-npm.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,wBAAwB,CAAC;AAKhC,wBAAgB,aAAa,CAC3B,GAAG,EAAE,UAAU,EACf,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,EAC3C,SAAS,GAAE,cAAwC,GAClD,cAAc,CAqLhB"}

package/dist/install/import-npm.js

@@ -1,11 +1,12 @@
 /** Adopt npm v2/v3 exact selections without asking the registry to pick versions. */
+import { createRootOverrides, } from "../resolve/overrides.js";
 import { validateLockDoc } from "../lockfile/read.js";
 import { canonicalStrongSri } from "../util/integrity.js";
 import { valid, satisfies } from "semver";
 import { parseRequirement } from "../resolve/spec.js";
 import { sourceIdOf, sha512Hex } from "../util/hash.js";
 import { cleanUrl, lockMismatch, packageName } from "./lock.js";
-export function importNpmLock(doc, requirements, origin) {
+export function importNpmLock(doc, requirements, origin, overrides = createRootOverrides({})) {
     validateLockDoc(doc, "package-lock.json");
     const packages = doc.packages;
     if (!packages || !packages[""])
@@ -26,12 +27,16 @@ export function importNpmLock(doc, requirements, origin) {
                 : "";
         }
     };
-    const load = (location, edgeName, spec) => {
-        const existing = locations.get(location);
+    const load = (location, edgeName, spec, parentContext) => {
+        const selected = overrides.select(parentContext, edgeName, spec);
+        spec = selected.spec;
+        const contextKey = `${location}\0${selected.context.id}`;
+        const existing = locations.get(contextKey);
         const entry = packages[location];
         if (!entry || entry.link === true || entry.inBundle === true)
             throw lockMismatch("npm lock contains an unsupported linked or bundled selection");
         const request = parseRequirement(edgeName, spec);
+        const selectedOrigin = typeof origin === "string" ? origin : origin(request.realName);
         const name = typeof entry.name === "string" ? entry.name : request.realName;
         const integrity = typeof entry.integrity === "string"
             ? canonicalStrongSri(entry.integrity)
@@ -52,16 +57,16 @@ export function importNpmLock(doc, requirements, origin) {
         if (existing)
             return existing;
         const node = {
-            key: `${name}@${entry.version}#${sha512Hex(location).slice(0, 16)}`,
+            key: `${name}@${entry.version}#${sha512Hex(selected.context.id ? contextKey : location).slice(0, 16)}`,
             name,
             version: entry.version,
-            origin,
+            origin: selectedOrigin,
             integrity,
             sourceId: sourceIdOf({
                 sourceType: "registry",
                 name,
                 version: entry.version,
-                origin,
+                origin: selectedOrigin,
                 integrity,
             }),
             tarballUrl: entry.resolved,
@@ -95,7 +100,7 @@ export function importNpmLock(doc, requirements, origin) {
                 node.platform[field] = value;
             }
         }
-        locations.set(location, node);
+        locations.set(contextKey, node);
         const dependencies = Object.create(null);
         for (const [group, kind] of [
             ["dependencies", "prod"],
@@ -127,7 +132,7 @@ export function importNpmLock(doc, requirements, origin) {
                 }
                 throw lockMismatch("npm lock is missing a required dependency");
             }
-            const target = load(targetLocation, dep, requirement.spec);
+            const target = load(targetLocation, dep, requirement.spec, selected.context);
             node.edges.push({
                 name: dep,
                 target: target.key,
@@ -147,7 +152,7 @@ export function importNpmLock(doc, requirements, origin) {
         const location = find("", name);
         if (!location)
             throw lockMismatch("npm lock is missing a direct selection");
-        return { name, target: load(location, name, spec).key };
+        return { name, target: load(location, name, spec, overrides.root).key };
     });
     return {
         nodes: [...locations.values()].sort((a, b) => a.key.localeCompare(b.key)),

package/dist/install/registry-policy.d.ts

@@ -0,0 +1,9 @@
+export type InstalledRegistryConfig = {
+    registry: string;
+    registries?: Readonly<Record<string, string>>;
+};
+export declare function installedRegistryConfig(state: Record<string, unknown>, nodes: readonly {
+    name: string;
+    origin: string;
+}[]): InstalledRegistryConfig;
+//# sourceMappingURL=registry-policy.d.ts.map

package/dist/install/registry-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-policy.d.ts","sourceRoot":"","sources":["../../src/install/registry-policy.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC/C,CAAC;AACF,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,KAAK,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAAE,GACjD,uBAAuB,CAqCzB"}