zyrk 0.5.1 → 0.5.2

package/README.md

@@ -119,7 +119,7 @@ scheme, host, port, and path; redirects cannot expand that scope. Use
 Scoped registries route metadata, exact sources, imports and tool commands by
 the real package name, including aliases. Advisory requests are partitioned by
 registry; private names never fall back to a public endpoint. Disabled TLS
-verification is rejected before lookup. Git sources, non-workspace local sources, and overrides remain unsupported;
+verification is rejected before lookup. Git sources and non-workspace local sources remain unsupported;
 they fail explicitly. Optional dependencies incompatible with the selected platform
 are omitted; missing packages, integrity failures, and other optional failures
 remain errors. Platform selection is recorded in the lock. macOS, Windows, and
@@ -356,3 +356,9 @@ Keep existing data until an explicit migration is supported.
 
 [MIT](LICENSE). If you want to support development,
 [sponsor the maintainer](https://github.com/sponsors/kingjethro999).
+
+Root `package.json` dependency overrides support exact specifications, nested and
+version-qualified selectors, self rules (`.`), and `$direct` references. Direct
+dependency overrides must match the declared specification. Workspace member
+overrides are ignored, matching npm root-only policy. Override rule order is
+recorded in the manifest fingerprint; frozen installs reject policy drift.

package/VERSION

@@ -1 +1 @@
-v0.5.1
+v0.5.2

package/dist/install/import-npm-workspace.d.ts

@@ -1,5 +1,6 @@
 import type { NpmLockDoc } from "../lockfile/types.ts";
 import type { WorkspaceProject } from "./workspaces.ts";
 import type { WorkspaceGraph } from "./workspace-graph.ts";
+/** Import stays pure while live-node scope refinement converges. */
 export declare function importNpmWorkspaceLock(doc: NpmLockDoc, project: WorkspaceProject, origin: string | ((name: string) => string)): WorkspaceGraph;
 //# sourceMappingURL=import-npm-workspace.d.ts.map

package/dist/install/import-npm-workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"import-npm-workspace.d.ts","sourceRoot":"","sources":["../../src/install/import-npm-workspace.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAQvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,sBAAsB,CAAC;AAE9B,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,GAC1C,cAAc,CAyThB"}
+{"version":3,"file":"import-npm-workspace.d.ts","sourceRoot":"","sources":["../../src/install/import-npm-workspace.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAQvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,sBAAsB,CAAC;AA0V9B,oEAAoE;AACpE,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,GAC1C,cAAc,CAWhB"}

package/dist/install/import-npm-workspace.js

@@ -1,5 +1,6 @@
 /** Translate npm's physical virtual tree without selecting new registry versions. */
 import * as path from "node:path";
+import { workspaceOverrides, refineWorkspaceOverride, WorkspaceOverrideRestart, } from "./workspace-overrides.js";
 import { satisfies } from "semver";
 import { validateLockDoc } from "../lockfile/read.js";
 import { sha512Hex } from "../util/hash.js";
@@ -8,7 +9,7 @@ import { importNpmLock } from "./import-npm.js";
 import { lockMismatch, cleanUrl } from "./lock.js";
 import { ZyrkError } from "../errors.js";
 import { assertWorkspacePlatform } from "./workspace-graph.js";
-export function importNpmWorkspaceLock(doc, project, origin) {
+function importNpmWorkspaceLockPass(doc, project, origin, overrideState) {
     if (!doc ||
         typeof doc !== "object" ||
         Array.isArray(doc) ||
@@ -65,6 +66,8 @@ export function importNpmWorkspaceLock(doc, project, origin) {
         (typeof origin === "string" && !cleanUrl(origin)))
         throw lockMismatch("workspace adoption needs an unannotated npm v2/v3 lock");
     const packages = doc.packages;
+    const overrides = overrideState.policy;
+    const contexts = new Map(overrideState.contexts);
     const graph = { nodes: [], importers: {}, omissions: [] };
     const locations = new Map();
     const local = new Map(project.importers.map((i) => [i.id === "." ? "" : i.id, i]));
@@ -131,7 +134,10 @@ export function importNpmWorkspaceLock(doc, project, origin) {
         }
     };
     const populated = new Set();
-    const load = (location, name, spec, from) => {
+    const load = (location, name, spec, from, parentContext) => {
+        const selectedOverride = overrides.select(parentContext, name, spec);
+        spec = selectedOverride.spec;
+        const contextKey = `${location}\0${selectedOverride.context.id}`;
         const entry = packages[location];
         if (entry.link === true) {
             const target = locations.get(entry.resolved);
@@ -143,6 +149,7 @@ export function importNpmWorkspaceLock(doc, project, origin) {
                     (!["*", "^", "~"].includes(range) &&
                         !satisfies(target.version, range)))
                 throw lockMismatch("npm workspace link disagrees with requirement");
+            refineWorkspaceOverride(overrideState.contexts, target.key, selectedOverride.context);
             return target;
         }
         // Reuse the strict single-selection adapter's archive, alias, source and
@@ -155,12 +162,12 @@ export function importNpmWorkspaceLock(doc, project, origin) {
             lockfileVersion: 3,
             packages: { "": {}, [`node_modules/${name}`]: shallow },
         }, { [name]: spec }, origin).nodes[0];
-        let node = locations.get(location);
+        let node = locations.get(contextKey);
         if (!node) {
             const { peerBindings: _bindings, ...source } = selected;
             node = {
                 ...source,
-                key: `${selected.name}@${selected.version}#${sha512Hex(location).slice(0, 16)}`,
+                key: `${selected.name}@${selected.version}#${sha512Hex(selectedOverride.context.id ? contextKey : location).slice(0, 16)}`,
                 kind: "registry",
                 edges: [],
                 peers: {},
@@ -168,25 +175,26 @@ export function importNpmWorkspaceLock(doc, project, origin) {
             };
             assertWorkspacePlatform({ nodes: [node], importers: {}, omissions: [] });
             graph.nodes.push(node);
-            locations.set(location, node);
+            locations.set(contextKey, node);
+            contexts.set(node.key, selectedOverride.context);
         }
         try {
             populate(location, node);
         }
         catch (cause) {
-            populated.delete(location);
-            locations.delete(location);
+            populated.delete(node.key);
+            locations.delete(contextKey);
             graph.nodes = graph.nodes.filter((n) => n !== node);
             throw cause;
         }
         return node;
     };
     const populate = (location, node) => {
-        if (populated.has(location))
+        if (populated.has(node.key))
             return;
         if (populated.size >= 10000)
             throw lockMismatch("npm import resource limit exceeded");
-        populated.add(location);
+        populated.add(node.key);
         const entry = packages[location];
         const requirements = new Map();
         for (const [field, kind] of [
@@ -227,7 +235,7 @@ export function importNpmWorkspaceLock(doc, project, origin) {
             }
             let target;
             try {
-                target = load(targetLocation, name, requirement.spec, location);
+                target = load(targetLocation, name, requirement.spec, location, contexts.get(node.key));
             }
             catch (cause) {
                 if (requirement.kind === "optional" &&
@@ -259,7 +267,7 @@ export function importNpmWorkspaceLock(doc, project, origin) {
                 node.peers[name] = null;
                 continue;
             }
-            const target = load(targetLocation, name, spec, location);
+            const target = load(targetLocation, name, spec, location, contexts.get(node.key));
             node.peers[name] = target.key;
             if (!node.edges.some((edge) => edge.name === name))
                 node.edges.push({ name, target: target.key, kind: "peer", spec });
@@ -281,3 +289,17 @@ export function importNpmWorkspaceLock(doc, project, origin) {
     graph.nodes.sort((a, b) => a.key.localeCompare(b.key));
     return graph;
 }
+/** Import stays pure while live-node scope refinement converges. */
+export function importNpmWorkspaceLock(doc, project, origin) {
+    const state = workspaceOverrides(project), expires = Date.now() + 30000;
+    for (let round = 0; round < 128 && Date.now() < expires; round++) {
+        try {
+            return importNpmWorkspaceLockPass(doc, project, origin, state);
+        }
+        catch (cause) {
+            if (!(cause instanceof WorkspaceOverrideRestart))
+                throw cause;
+        }
+    }
+    throw lockMismatch("npm workspace override import resource limit exceeded");
+}

package/dist/install/import-npm.d.ts

@@ -1,4 +1,6 @@
+/** Adopt npm v2/v3 exact selections without asking the registry to pick versions. */
+import { type OverridePolicy } from "../resolve/overrides.ts";
 import type { NpmLockDoc } from "../lockfile/types.ts";
 import type { FinalizedGraph } from "../resolve/resolver.ts";
-export declare function importNpmLock(doc: NpmLockDoc, requirements: Record<string, string>, origin: string | ((name: string) => string)): FinalizedGraph;
+export declare function importNpmLock(doc: NpmLockDoc, requirements: Record<string, string>, origin: string | ((name: string) => string), overrides?: OverridePolicy): FinalizedGraph;
 //# sourceMappingURL=import-npm.d.ts.map

package/dist/install/import-npm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"import-npm.d.ts","sourceRoot":"","sources":["../../src/install/import-npm.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,wBAAwB,CAAC;AAKhC,wBAAgB,aAAa,CAC3B,GAAG,EAAE,UAAU,EACf,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,GAC1C,cAAc,CA4KhB"}
+{"version":3,"file":"import-npm.d.ts","sourceRoot":"","sources":["../../src/install/import-npm.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,wBAAwB,CAAC;AAKhC,wBAAgB,aAAa,CAC3B,GAAG,EAAE,UAAU,EACf,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,EAC3C,SAAS,GAAE,cAAwC,GAClD,cAAc,CAqLhB"}

package/dist/install/import-npm.js

@@ -1,11 +1,12 @@
 /** Adopt npm v2/v3 exact selections without asking the registry to pick versions. */
+import { createRootOverrides, } from "../resolve/overrides.js";
 import { validateLockDoc } from "../lockfile/read.js";
 import { canonicalStrongSri } from "../util/integrity.js";
 import { valid, satisfies } from "semver";
 import { parseRequirement } from "../resolve/spec.js";
 import { sourceIdOf, sha512Hex } from "../util/hash.js";
 import { cleanUrl, lockMismatch, packageName } from "./lock.js";
-export function importNpmLock(doc, requirements, origin) {
+export function importNpmLock(doc, requirements, origin, overrides = createRootOverrides({})) {
     validateLockDoc(doc, "package-lock.json");
     const packages = doc.packages;
     if (!packages || !packages[""])
@@ -26,8 +27,11 @@ export function importNpmLock(doc, requirements, origin) {
                 : "";
         }
     };
-    const load = (location, edgeName, spec) => {
-        const existing = locations.get(location);
+    const load = (location, edgeName, spec, parentContext) => {
+        const selected = overrides.select(parentContext, edgeName, spec);
+        spec = selected.spec;
+        const contextKey = `${location}\0${selected.context.id}`;
+        const existing = locations.get(contextKey);
         const entry = packages[location];
         if (!entry || entry.link === true || entry.inBundle === true)
             throw lockMismatch("npm lock contains an unsupported linked or bundled selection");
@@ -53,7 +57,7 @@ export function importNpmLock(doc, requirements, origin) {
         if (existing)
             return existing;
         const node = {
-            key: `${name}@${entry.version}#${sha512Hex(location).slice(0, 16)}`,
+            key: `${name}@${entry.version}#${sha512Hex(selected.context.id ? contextKey : location).slice(0, 16)}`,
             name,
             version: entry.version,
             origin: selectedOrigin,
@@ -96,7 +100,7 @@ export function importNpmLock(doc, requirements, origin) {
                 node.platform[field] = value;
             }
         }
-        locations.set(location, node);
+        locations.set(contextKey, node);
         const dependencies = Object.create(null);
         for (const [group, kind] of [
             ["dependencies", "prod"],
@@ -128,7 +132,7 @@ export function importNpmLock(doc, requirements, origin) {
                 }
                 throw lockMismatch("npm lock is missing a required dependency");
             }
-            const target = load(targetLocation, dep, requirement.spec);
+            const target = load(targetLocation, dep, requirement.spec, selected.context);
             node.edges.push({
                 name: dep,
                 target: target.key,
@@ -148,7 +152,7 @@ export function importNpmLock(doc, requirements, origin) {
         const location = find("", name);
         if (!location)
             throw lockMismatch("npm lock is missing a direct selection");
-        return { name, target: load(location, name, spec).key };
+        return { name, target: load(location, name, spec, overrides.root).key };
     });
     return {
         nodes: [...locations.values()].sort((a, b) => a.key.localeCompare(b.key)),

package/dist/install/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/install/run.ts"],"names":[],"mappings":"AAIA,OAAO,EAOL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAWtB,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAgC3C,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE;QACZ,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,CAAC;AACF,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EACL,OAAO,GACP,uBAAuB,GACvB,eAAe,GACf,SAAS,GACT,cAAc,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;CAC3B,CAAC;AA6GF,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAsxBxB"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/install/run.ts"],"names":[],"mappings":"AAIA,OAAO,EAOL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAYtB,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAgC3C,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE;QACZ,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,CAAC;AACF,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EACL,OAAO,GACP,uBAAuB,GACvB,eAAe,GACf,SAAS,GACT,cAAc,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;CAC3B,CAAC;AA4GF,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAyyBxB"}

package/dist/install/run.js

@@ -6,6 +6,7 @@ import { candidates, candidateDigest, approveCandidate, assertApproved, material
 import { loadProjectPatches, applyProjectPatches } from "../commands/patch.js";
 import { registerGeneration } from "./metadata.js";
 import { randomId } from "../util/ids.js";
+import { createRootOverrides } from "../resolve/overrides.js";
 import { importNpmLock } from "./import-npm.js";
 /** Native project install: resolve -> verify -> realize -> journaled publication. */
 import { readFile, realpath, lstat, mkdir, rm } from "node:fs/promises";
@@ -65,10 +66,9 @@ async function readManifest(project) {
             throw error("ZYRK_MANIFEST_INVALID", `Project ${group} must contain valid package names and string specifiers.`);
     }
     if (doc.workspaces !== undefined ||
-        doc.overrides !== undefined ||
         doc.bundledDependencies !== undefined ||
         doc.bundleDependencies !== undefined)
-        throw error("ZYRK_NOT_IMPLEMENTED", "Project workspaces, overrides, and bundled dependencies are not supported by install yet.");
+        throw error("ZYRK_NOT_IMPLEMENTED", "Project workspaces and bundled dependencies are not supported by install yet.");
     if (doc.zyrk !== undefined &&
         (!object(doc.zyrk) ||
             Object.keys(doc.zyrk).some((key) => !["scripts", "audit", "patches", "mutablePackages"].includes(key)) ||
@@ -98,6 +98,13 @@ export async function installProject(options) {
         return installWorkspaceProject(options);
     }
     const project = await realpath(options.projectDir);
+    const preliminaryManifest = (await readManifest(project)).doc;
+    const preliminaryOverrides = createRootOverrides(preliminaryManifest);
+    if (options.importNpm) {
+        const preliminaryLock = (await readLockfile(path.join(project, "package-lock.json")))?.doc;
+        if (preliminaryLock && !preliminaryLock.zyrk)
+            importNpmLock(preliminaryLock, requirements(preliminaryManifest), (name) => options.registry.originFor(name), preliminaryOverrides);
+    }
     // A local control-directory link would redirect locks and recovery writes.
     const local = path.join(project, PROJECT_STATE_DIR);
     try {
@@ -189,6 +196,7 @@ export async function installProject(options) {
                 if (other !== group && manifest[other])
                     delete manifest[other][parsed.name];
         }
+        const overrides = createRootOverrides(manifest);
         const allDeps = requirements(manifest);
         for (const [name, spec] of Object.entries(allDeps))
             parseRequirement(name, spec);
@@ -215,7 +223,7 @@ export async function installProject(options) {
         if (existing && !existing.zyrk) {
             if (options.frozen || options.offline || specs.length)
                 throw lockMismatch("npm-only lockfile requires a non-frozen adoption install before adding packages");
-            resolved = importNpmLock(existing, allDeps, (name) => options.registry.originFor(name));
+            resolved = importNpmLock(existing, allDeps, (name) => options.registry.originFor(name), overrides);
         }
         if (existing?.zyrk &&
             specs.length === 0 &&
@@ -241,6 +249,7 @@ export async function installProject(options) {
             const prior = existing?.zyrk ? lockedGraph(existing) : undefined;
             const fresh = new Set(specs.map((spec) => npa(spec).name));
             resolved = await resolveRequirements({
+                overrides,
                 provider: {
                     origin: options.registry.origin,
                     originFor: (name) => options.registry.originFor(name),

package/dist/install/workspace-graph.d.ts

@@ -46,17 +46,23 @@ export type WorkspaceGraph = {
         reason: "platform";
     }>;
 };
-export declare function resolveWorkspaceGraph(project: WorkspaceProject, provider: MetadataProvider, options?: {
+declare function resolveWorkspaceGraphPass(project: WorkspaceProject, provider: MetadataProvider, options?: {
     previous?: WorkspaceGraph;
     fresh?: ReadonlySet<string>;
     platform?: RuntimePlatform;
     maxNodes?: number;
     maxDepth?: number;
     deadlineMs?: number;
+}, overrideState?: {
+    policy: import("../resolve/overrides.ts").OverridePolicy;
+    contexts: Map<string, import("../resolve/overrides.ts").OverrideContext>;
 }): Promise<WorkspaceGraph>;
+/** Retry pure planning when a registry edge narrows a live importer's scope. */
+export declare function resolveWorkspaceGraph(project: WorkspaceProject, provider: MetadataProvider, options?: Parameters<typeof resolveWorkspaceGraphPass>[2]): Promise<WorkspaceGraph>;
 export declare function workspaceRegistryOccurrences(graph: WorkspaceGraph): ResolvedOccurrence[];
 /** Rooted semantic context including live source identity; occurrence keys never split equal peers. */
 export declare function workspaceContextId(graph: WorkspaceGraph, rootKey: string, projectId: string): string;
 /** Recheck locked platform/runtime requirements as strictly as fresh resolution. */
 export declare function assertWorkspacePlatform(graph: WorkspaceGraph): void;
+export {};
 //# sourceMappingURL=workspace-graph.d.ts.map

package/dist/install/workspace-graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-graph.d.ts","sourceRoot":"","sources":["../../src/install/workspace-graph.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EAChB,MAAM,wBAAwB,CAAC;AAKhC,OAAO,EAEL,KAAK,gBAAgB,EAEtB,MAAM,iBAAiB,CAAC;AAGzB,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACrC,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,QAAQ,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACrC,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;AACF,MAAM,MAAM,aAAa,GAAG,kBAAkB,GAAG,qBAAqB,CAAC;AACvE,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;CACxE,CAAC;AAYF,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,gBAAgB,EACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,GAAE;IACP,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,KAAK,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5B,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CAChB,GACL,OAAO,CAAC,cAAc,CAAC,CAoWzB;AACD,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,cAAc,GACpB,kBAAkB,EAAE,CAetB;AAED,uGAAuG;AACvG,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,MAAM,CAgCR;AAED,oFAAoF;AACpF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAsCnE"}
+{"version":3,"file":"workspace-graph.d.ts","sourceRoot":"","sources":["../../src/install/workspace-graph.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EAChB,MAAM,wBAAwB,CAAC;AAUhC,OAAO,EAEL,KAAK,gBAAgB,EAEtB,MAAM,iBAAiB,CAAC;AAGzB,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACrC,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,QAAQ,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACrC,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;AACF,MAAM,MAAM,aAAa,GAAG,kBAAkB,GAAG,qBAAqB,CAAC;AACvE,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;CACxE,CAAC;AAYF,iBAAe,yBAAyB,CACtC,OAAO,EAAE,gBAAgB,EACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,GAAE;IACP,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,KAAK,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5B,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CAChB,EACN,aAAa;;;CAA8B,GAC1C,OAAO,CAAC,cAAc,CAAC,CA4XzB;AACD,gFAAgF;AAChF,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,gBAAgB,EACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,GAAE,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAC,CAAC,CAAM,GAC5D,OAAO,CAAC,cAAc,CAAC,CAmCzB;AACD,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,cAAc,GACpB,kBAAkB,EAAE,CAetB;AAED,uGAAuG;AACvG,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,MAAM,CAgCR;AAED,oFAAoF;AACpF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAsCnE"}

package/dist/install/workspace-graph.js

@@ -2,6 +2,7 @@
 import { maxSatisfying, satisfies, valid } from "semver";
 import { expectedIntegrityFromDist, } from "../fetch/registry.js";
 import { currentPlatform } from "../resolve/resolver.js";
+import { workspaceOverrides, refineWorkspaceOverride, WorkspaceOverrideRestart, } from "./workspace-overrides.js";
 import { parseRequirement } from "../resolve/spec.js";
 import { sourceIdOf, sha512Hex } from "../util/hash.js";
 import { ZyrkError } from "../errors.js";
@@ -14,7 +15,9 @@ const fail = (reason) => {
 };
 class PlatformMismatch extends Error {
 }
-export async function resolveWorkspaceGraph(project, provider, options = {}) {
+async function resolveWorkspaceGraphPass(project, provider, options = {}, overrideState = workspaceOverrides(project)) {
+    const overrides = overrideState.policy;
+    const overrideContexts = new Map(overrideState.contexts);
     const graph = { nodes: [], importers: {}, omissions: [] };
     const byKey = new Map(), manifests = new Map(), chains = new Map();
     const metadata = new Map();
@@ -83,6 +86,10 @@ export async function resolveWorkspaceGraph(project, provider, options = {}) {
     const build = async (parent, name, spec, kind, ancestry, explicitLocal) => {
         check(ancestry.length);
         try {
+            const overridden = overrides.select(overrideContexts.get(parent.key), name, spec);
+            if (overridden.spec !== spec)
+                explicitLocal = undefined;
+            spec = overridden.spec;
             let local = explicitLocal === undefined
                 ? undefined
                 : project.importers.find((item) => item.id === explicitLocal);
@@ -106,8 +113,11 @@ export async function resolveWorkspaceGraph(project, provider, options = {}) {
                         local = candidate;
                 }
             }
-            if (local)
-                return graph.importers[local.id];
+            if (local) {
+                const key = graph.importers[local.id];
+                refineWorkspaceOverride(overrideState.contexts, key, overridden.context);
+                return key;
+            }
             if (!requirement)
                 throw lockMismatch("missing workspace requirement");
             const doc = await packument(requirement.realName);
@@ -145,7 +155,8 @@ export async function resolveWorkspaceGraph(project, provider, options = {}) {
                 .map((key) => byKey.get(key))
                 .find((node) => node?.kind === "registry" &&
                 node.name === requirement.realName &&
-                node.version === version);
+                node.version === version &&
+                overrideContexts.get(node.key)?.id === overridden.context.id);
             if (ancestor)
                 return ancestor.key;
             const key = `${requirement.realName}@${version}#${sha512Hex(parent.key + "\0" + name).slice(0, 16)}`;
@@ -184,6 +195,7 @@ export async function resolveWorkspaceGraph(project, provider, options = {}) {
                 optionalPeers: [],
             };
             graph.nodes.push(node);
+            overrideContexts.set(key, overridden.context);
             byKey.set(key, node);
             manifests.set(key, entry);
             chains.set(key, [...ancestry, parent.key]);
@@ -235,7 +247,8 @@ export async function resolveWorkspaceGraph(project, provider, options = {}) {
         for (const node of graph.nodes) {
             check();
             const manifest = manifests.get(node.key);
-            for (const [name, range] of Object.entries(manifest.peerDependencies ?? {}).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))) {
+            for (const [name, rawRange] of Object.entries(manifest.peerDependencies ?? {}).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))) {
+                const range = overrides.select(overrideContexts.get(node.key), name, rawRange).spec;
                 const optional = manifest.peerDependenciesMeta?.[name]?.optional === true;
                 if (optional && !node.optionalPeers.includes(name))
                     node.optionalPeers.push(name);
@@ -257,7 +270,7 @@ export async function resolveWorkspaceGraph(project, provider, options = {}) {
                     const selected = byKey.get(target);
                     const requested = range.startsWith("workspace:")
                         ? range.slice(10)
-                        : range;
+                        : parseRequirement(name, range).targetSpec;
                     if (!["*", "^", "~"].includes(requested) &&
                         !satisfies(selected.version, requested))
                         throw new ZyrkError("ZYRK_PEER_CONFLICT", `Workspace peer ${name} required by ${node.name} conflicts with its consumer.`, { remedy: "Align the consumer and package peer requirements." });
@@ -294,6 +307,36 @@ export async function resolveWorkspaceGraph(project, provider, options = {}) {
     }
     return fail("peer binding iteration limit exceeded");
 }
+/** Retry pure planning when a registry edge narrows a live importer's scope. */
+export async function resolveWorkspaceGraph(project, provider, options = {}) {
+    const state = workspaceOverrides(project), expires = Date.now() + (options.deadlineMs ?? 30000);
+    const packuments = new Map();
+    const cached = {
+        ...provider,
+        origin: provider.origin,
+        ...(provider.originFor
+            ? { originFor: (name) => provider.originFor(name) }
+            : {}),
+        packument: (name) => {
+            let pending = packuments.get(name);
+            if (!pending) {
+                pending = provider.packument(name);
+                packuments.set(name, pending);
+            }
+            return pending;
+        },
+    };
+    for (let round = 0; round < 128 && Date.now() < expires; round++) {
+        try {
+            return await resolveWorkspaceGraphPass(project, cached, { ...options, deadlineMs: Math.max(1, expires - Date.now()) }, state);
+        }
+        catch (cause) {
+            if (!(cause instanceof WorkspaceOverrideRestart))
+                throw cause;
+        }
+    }
+    throw lockMismatch("workspace override planning resource limit exceeded");
+}
 export function workspaceRegistryOccurrences(graph) {
     return graph.nodes
         .filter((node) => node.kind === "registry")

package/dist/install/workspace-install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-install.d.ts","sourceRoot":"","sources":["../../src/install/workspace-install.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAwH9D,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CA+pBxB"}
+{"version":3,"file":"workspace-install.d.ts","sourceRoot":"","sources":["../../src/install/workspace-install.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAyH9D,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CA6pBxB"}

package/dist/install/workspace-install.js

@@ -4,6 +4,7 @@ import { constants } from "node:fs";
 import * as path from "node:path";
 import { discoverWorkspaces, findWorkspaceRoot, assertNoLiveSourceBuilds, } from "./workspaces.js";
 import { resolveWorkspaceGraph, workspaceRegistryOccurrences, workspaceContextId, assertWorkspacePlatform, } from "./workspace-graph.js";
+import { workspaceOverrides } from "./workspace-overrides.js";
 import { importNpmWorkspaceLock } from "./import-npm-workspace.js";
 import { readWorkspaceLock, workspaceLockDoc } from "./workspace-lock.js";
 import { publishWorkspaceProjection, recoverWorkspaceProjection, workspaceProjectionPaths, } from "./workspace-transaction.js";
@@ -80,6 +81,7 @@ export async function installWorkspaceProject(options) {
     const root = await findWorkspaceRoot(options.projectDir);
     if (!root)
         throw lockMismatch("no authoritative workspace root");
+    workspaceOverrides(await discoverWorkspaces(root));
     // Refuse untranslatable locks before creating control directories or
     // recovering a previous generation. Revalidate under the project lock below.
     if (options.importNpm)
@@ -99,10 +101,9 @@ export async function installWorkspaceProject(options) {
             await readFile(path.join(i.directory, "package.json"), "utf8"),
         ])));
         const mutation = await prepareWorkspaceMutation(project, options);
-        if (manifest.overrides !== undefined ||
-            manifest.bundledDependencies !== undefined ||
+        if (manifest.bundledDependencies !== undefined ||
             manifest.bundleDependencies !== undefined)
-            unsupported("Workspace overrides and bundled root dependencies are unsupported.");
+            unsupported("Workspace bundled root dependencies are unsupported.");
         const policy = object(manifest.zyrk) ? manifest.zyrk.scripts : undefined;
         if (manifest.zyrk !== undefined &&
             (!object(manifest.zyrk) ||

package/dist/install/workspace-mutation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-mutation.d.ts","sourceRoot":"","sources":["../../src/install/workspace-mutation.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAiB3D,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAW3E;AACD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,gBAAgB,EACzB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC;IACT,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAAC;IACpC,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC,CA8ID"}
+{"version":3,"file":"workspace-mutation.d.ts","sourceRoot":"","sources":["../../src/install/workspace-mutation.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAiB3D,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAc3E;AACD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,gBAAgB,EACzB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC;IACT,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAAC;IACpC,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC,CA8ID"}

package/dist/install/workspace-mutation.js

@@ -18,7 +18,10 @@ export function refreshWorkspaceFingerprint(project) {
         member.id,
         member.manifest.name ?? null,
         member.manifest.version ?? null,
-        manifestFingerprint(member.manifest),
+        manifestFingerprint({
+            ...member.manifest,
+            overrides: member.id === "." ? member.manifest.overrides : undefined,
+        }),
     ])));
 }
 export async function prepareWorkspaceMutation(project, options) {

package/dist/install/workspace-overrides.d.ts

@@ -0,0 +1,11 @@
+import { type OverrideContext } from "../resolve/overrides.ts";
+import { type WorkspaceProject } from "./workspaces.ts";
+export declare function workspaceOverrides(project: WorkspaceProject): {
+    policy: import("../resolve/overrides.ts").OverridePolicy;
+    contexts: Map<string, OverrideContext>;
+};
+/** Internal signal: restart pure planning before any fetch/publication mutation. */
+export declare class WorkspaceOverrideRestart extends Error {
+}
+export declare function refineWorkspaceOverride(contexts: Map<string, OverrideContext>, key: string, incoming: OverrideContext): void;
+//# sourceMappingURL=workspace-overrides.d.ts.map

package/dist/install/workspace-overrides.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-overrides.d.ts","sourceRoot":"","sources":["../../src/install/workspace-overrides.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAC;AAWzB,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB;;;EAuD3D;AACD,oFAAoF;AACpF,qBAAa,wBAAyB,SAAQ,KAAK;CAAG;AACtD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,EACtC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,eAAe,GACxB,IAAI,CASN"}

package/dist/install/workspace-overrides.js

@@ -0,0 +1,67 @@
+/** Live importers have one dependency graph; compatible scopes may narrow it. */
+import { satisfies } from "semver";
+import { createRootOverrides, } from "../resolve/overrides.js";
+import { parseRequirement } from "../resolve/spec.js";
+import { planWorkspaceDependencies, } from "./workspaces.js";
+import { lockMismatch } from "./lock.js";
+function ancestor(outer, inner) {
+    for (let current = inner; current; current = current.parent)
+        if (current === outer)
+            return true;
+    return false;
+}
+export function workspaceOverrides(project) {
+    const policy = createRootOverrides(project.importers.find((i) => i.id === ".").manifest);
+    const contexts = new Map();
+    const plans = planWorkspaceDependencies(project);
+    for (const importer of project.importers)
+        contexts.set(`workspace:${importer.id}`, importer.id === "."
+            ? policy.root
+            : policy.select(policy.root, importer.manifest.name, importer.manifest.version).context);
+    for (let round = 0; round <= 128; round++) {
+        let changed = false;
+        for (const plan of plans) {
+            const parent = contexts.get(`workspace:${plan.importer.id}`);
+            for (const edge of plan.dependencies) {
+                const selected = policy.select(parent, edge.name, edge.spec);
+                const localId = edge.selection.kind === "local" ? edge.selection.importer : undefined;
+                let local = project.importers.find((i) => i.id === localId);
+                if (selected.spec !== edge.spec) {
+                    const requirement = parseRequirement(edge.name, selected.spec);
+                    local = project.importers.find((i) => i.id !== "." &&
+                        i.manifest.name === requirement.realName &&
+                        requirement.kind !== "alias" &&
+                        requirement.targetKind !== "tag" &&
+                        satisfies(i.manifest.version, requirement.targetSpec));
+                }
+                if (!local)
+                    continue;
+                const key = `workspace:${local.id}`, current = contexts.get(key);
+                if (ancestor(current, selected.context)) {
+                    if (current !== selected.context) {
+                        contexts.set(key, selected.context);
+                        changed = true;
+                    }
+                }
+                else if (!ancestor(selected.context, current)) {
+                    throw lockMismatch("one live workspace cannot represent incompatible scoped override contexts");
+                }
+            }
+        }
+        if (!changed)
+            return { policy, contexts };
+    }
+    throw lockMismatch("workspace override propagation resource limit exceeded");
+}
+/** Internal signal: restart pure planning before any fetch/publication mutation. */
+export class WorkspaceOverrideRestart extends Error {
+}
+export function refineWorkspaceOverride(contexts, key, incoming) {
+    const current = contexts.get(key);
+    if (current === incoming || ancestor(incoming, current))
+        return;
+    if (!ancestor(current, incoming))
+        throw lockMismatch("one live workspace cannot represent incompatible scoped override contexts");
+    contexts.set(key, incoming);
+    throw new WorkspaceOverrideRestart();
+}

package/dist/install/workspaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspaces.d.ts","sourceRoot":"","sources":["../../src/install/workspaces.ts"],"names":[],"mappings":"AAUA,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE9E,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,GAAG;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AACF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,0EAA0E;IAC1E,MAAM,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9E,CAAC;AACF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAAC;AA2GF,kFAAkF;AAClF,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7D,OAAO,CAAC,gBAAgB,CAAC,CA4F3B;AACD,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,CAAC;IAC3C,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,EACL;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GACnC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,WAAW,EAAE,iBAAiB,CAAA;KAAE,CAAC;CAC1D,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,YAAY,EAAE,mBAAmB,EAAE,CAAC;CACrC,CAAC;AACF,8FAA8F;AAC9F,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,gBAAgB,GACxB,qBAAqB,EAAE,CAmFzB;AACD,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,gBAAgB,EACzB,SAAS,EAAE,SAAS,MAAM,EAAE,GAC3B,iBAAiB,EAAE,CAerB;AACD,0FAA0F;AAC1F,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAChD,MAAM,EAAE,SAAS;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACjD,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IAC9C,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C,GAAG,IAAI,CA+BP;AAED,sFAAsF;AACtF,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,SAAS,qBAAqB,EAAE,GACrC,MAAM,EAAE,CAoCV;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiC3E"}
+{"version":3,"file":"workspaces.d.ts","sourceRoot":"","sources":["../../src/install/workspaces.ts"],"names":[],"mappings":"AAUA,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE9E,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,GAAG;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AACF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,0EAA0E;IAC1E,MAAM,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9E,CAAC;AACF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAAC;AA2GF,kFAAkF;AAClF,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7D,OAAO,CAAC,gBAAgB,CAAC,CAgG3B;AACD,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,CAAC;IAC3C,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,EACL;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GACnC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,WAAW,EAAE,iBAAiB,CAAA;KAAE,CAAC;CAC1D,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,YAAY,EAAE,mBAAmB,EAAE,CAAC;CACrC,CAAC;AACF,8FAA8F;AAC9F,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,gBAAgB,GACxB,qBAAqB,EAAE,CAmFzB;AACD,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,gBAAgB,EACzB,SAAS,EAAE,SAAS,MAAM,EAAE,GAC3B,iBAAiB,EAAE,CAerB;AACD,0FAA0F;AAC1F,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAChD,MAAM,EAAE,SAAS;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACjD,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IAC9C,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C,GAAG,IAAI,CA+BP;AAED,sFAAsF;AACtF,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,SAAS,qBAAqB,EAAE,GACrC,MAAM,EAAE,CAoCV;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiC3E"}

package/dist/install/workspaces.js

@@ -164,7 +164,10 @@ export async function discoverWorkspaces(rootDirectory, options = {}) {
             member.id,
             member.manifest.name ?? null,
             member.manifest.version ?? null,
-            manifestFingerprint(member.manifest),
+            manifestFingerprint({
+                ...member.manifest,
+                overrides: member.id === "." ? member.manifest.overrides : undefined,
+            }),
         ]))),
     };
 }

package/dist/lockfile/fingerprints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fingerprints.d.ts","sourceRoot":"","sources":["../../src/lockfile/fingerprints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,MAAM,MAAM,mBAAmB,GAAG;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,MAAM,CA2BzE;AAED,eAAO,MAAM,qBAAqB;IAAK,OAAO;IAAU,KAAK;IAAM,IAAI;CAAM,CAAC;AAE9E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAG/D;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACvD,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAalE"}
+{"version":3,"file":"fingerprints.d.ts","sourceRoot":"","sources":["../../src/lockfile/fingerprints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,MAAM,MAAM,mBAAmB,GAAG;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAcF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,MAAM,CA2BzE;AAED,eAAO,MAAM,qBAAqB;IAAK,OAAO;IAAU,KAAK;IAAM,IAAI;CAAM,CAAC;AAE9E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAG/D;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACvD,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAalE"}

package/dist/lockfile/fingerprints.js

@@ -16,6 +16,18 @@ import { canonicalJson } from "../util/json.js";
 function fingerprintOf(value) {
     return `sha512-${createHash("sha512").update(canonicalJson(value), "utf8").digest("base64")}`;
 }
+/** npm evaluates sibling override rules in declaration order. Preserve that
+ * order inside canonical JSON instead of sorting the policy's object keys. */
+function orderedOverridePolicy(value) {
+    if (Array.isArray(value))
+        return value.map(orderedOverridePolicy);
+    if (value && typeof value === "object")
+        return Object.entries(value).map(([key, rule]) => [
+            key,
+            orderedOverridePolicy(rule),
+        ]);
+    return value;
+}
 export function manifestFingerprint(manifest) {
     const normalized = {};
     for (const group of [
@@ -40,7 +52,7 @@ export function manifestFingerprint(manifest) {
         peerDependenciesMeta: manifest.peerDependenciesMeta ?? {},
         ...(manifest.overrides === undefined
             ? {}
-            : { overrides: manifest.overrides }),
+            : { overrides: orderedOverridePolicy(manifest.overrides) }),
         ...(manifest.workspaces === undefined
             ? {}
             : { workspaces: manifest.workspaces }),

package/dist/resolve/overrides.d.ts

@@ -0,0 +1,19 @@
+import type { ManifestDeclaration } from "../lockfile/fingerprints.ts";
+export type OverrideContext = {
+    readonly id: string;
+    readonly name?: string;
+    readonly range?: string;
+    readonly value?: string;
+    readonly parent?: OverrideContext;
+    readonly children: readonly OverrideContext[];
+};
+export declare class OverridePolicy {
+    readonly root: OverrideContext;
+    constructor(manifest: ManifestDeclaration);
+    select(context: OverrideContext, name: string, spec: string): {
+        spec: string;
+        context: OverrideContext;
+    };
+}
+export declare function createRootOverrides(manifest: ManifestDeclaration): OverridePolicy;
+//# sourceMappingURL=overrides.d.ts.map

package/dist/resolve/overrides.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"overrides.d.ts","sourceRoot":"","sources":["../../src/resolve/overrides.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAGvE,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;CAC/C,CAAC;AAaF,qBAAa,cAAc;IACzB,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,YAAY,QAAQ,EAAE,mBAAmB,EAsFxC;IACD,MAAM,CACJ,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,eAAe,CAAA;KAAE,CA6C5C;CACF;AACD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,mBAAmB,GAC5B,cAAc,CAEhB"}

package/dist/resolve/overrides.js

@@ -0,0 +1,142 @@
+/** Root npm override policy. Parsing never fetches metadata or executes code. */
+import npa from "npm-package-arg";
+import { intersects, validRange } from "semver";
+import { ZyrkError } from "../errors.js";
+import { parseRequirement } from "./spec.js";
+import { packageName } from "../install/lock.js";
+function invalid(reason) {
+    throw new ZyrkError("ZYRK_MANIFEST_INVALID", `Cannot apply root dependency overrides (${reason}).`, {
+        remedy: "Use root registry override rules, valid nested selectors and references to declared direct dependencies.",
+    });
+}
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+export class OverridePolicy {
+    root;
+    constructor(manifest) {
+        const raw = manifest.overrides;
+        if (raw !== undefined && !object(raw))
+            invalid("policy must be an object");
+        // npm's $reference lookup checks dev before optional, production and peer.
+        const references = {
+            ...manifest.peerDependencies,
+            ...manifest.dependencies,
+            ...manifest.optionalDependencies,
+            ...manifest.devDependencies,
+        };
+        let count = 0;
+        const build = (value, key, parent, depth = 0) => {
+            if (++count > 10000 || depth > 128)
+                invalid("policy resource limit exceeded");
+            if (typeof value === "string")
+                value = { ".": value };
+            if (!object(value))
+                invalid("each rule must be a string or object");
+            let name, range, replacement;
+            if (key !== undefined) {
+                try {
+                    const spec = npa(key);
+                    name = spec.name;
+                    range = spec.rawSpec || "*";
+                    if (!name ||
+                        !packageName(name) ||
+                        !["version", "range"].includes(spec.type) ||
+                        validRange(range) === null)
+                        invalid("selector must be a package name and optional semver range");
+                }
+                catch {
+                    invalid("invalid registry override selector");
+                }
+                const self = value["."];
+                if (self !== undefined && typeof self !== "string")
+                    invalid("self replacement must be a string");
+                replacement = self === undefined ? range : self || "*";
+                if (replacement.startsWith("$")) {
+                    const reference = replacement.slice(1);
+                    if (!packageName(reference) || !Object.hasOwn(references, reference))
+                        invalid("unknown direct dependency reference");
+                    replacement = references[reference];
+                }
+                try {
+                    parseRequirement(name, replacement);
+                }
+                catch {
+                    invalid("replacement must use a supported registry source");
+                }
+            }
+            else if (Object.hasOwn(value, "."))
+                invalid("root cannot contain a self replacement");
+            const children = [];
+            const context = {
+                id: parent ? `${parent.id}/${key}` : "",
+                ...(name ? { name } : {}),
+                ...(range ? { range } : {}),
+                ...(replacement !== undefined ? { value: replacement } : {}),
+                ...(parent ? { parent } : {}),
+                children,
+            };
+            for (const [child, spec] of Object.entries(value))
+                if (child !== ".")
+                    children.push(build(spec, child, context, depth + 1));
+            return context;
+        };
+        this.root = build(raw ?? {}, undefined);
+        // Legality applies to the edge selected by zyrk's install groups, which
+        // prioritize optional > production > development, independently of refs.
+        const direct = {
+            ...manifest.peerDependencies,
+            ...manifest.devDependencies,
+            ...manifest.dependencies,
+            ...manifest.optionalDependencies,
+        };
+        for (const [name, spec] of Object.entries(direct)) {
+            const selected = this.select(this.root, name, spec);
+            if (selected.spec !== spec)
+                invalid("override conflicts with an exact direct dependency spec");
+        }
+    }
+    select(context, name, spec) {
+        const seen = new Set();
+        for (let ancestor = context; ancestor; ancestor = ancestor.parent) {
+            const rules = [
+                ...ancestor.children,
+                ...(ancestor.parent ? [ancestor] : []),
+            ];
+            for (const rule of rules) {
+                const key = `${rule.name}@${rule.range}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                if (rule.name !== name)
+                    continue;
+                let matches = rule.range === "*";
+                if (!matches) {
+                    try {
+                        const workspaceRange = spec.startsWith("workspace:")
+                            ? spec.slice(10)
+                            : undefined;
+                        const requested = parseRequirement(name, workspaceRange === undefined
+                            ? spec
+                            : ["*", "^", "~"].includes(workspaceRange)
+                                ? "*"
+                                : workspaceRange);
+                        matches =
+                            requested.targetKind === "tag" ||
+                                intersects(requested.targetSpec, rule.range);
+                    }
+                    catch {
+                        matches = spec.startsWith("file:") || spec.startsWith("link:");
+                    }
+                }
+                if (matches)
+                    return {
+                        spec: rule.value === "*" ? spec : rule.value,
+                        context: rule,
+                    };
+            }
+        }
+        return { spec, context };
+    }
+}
+export function createRootOverrides(manifest) {
+    return new OverridePolicy(manifest);
+}

package/dist/resolve/resolver.d.ts

@@ -20,6 +20,7 @@
  * bindings stay distinct. Peerless occurrences share by name@version.
  */
 import { type Packument } from "../fetch/registry.ts";
+import { type OverridePolicy } from "./overrides.ts";
 export type MetadataProvider = {
     readonly origin: string;
     originFor?(name: string): string;
@@ -66,6 +67,7 @@ export type ResolveOptions = {
         spec: string;
         optional?: boolean;
     }>;
+    overrides?: OverridePolicy;
     limits?: Partial<ResolverLimits>;
     platform?: RuntimePlatform;
 };

package/dist/resolve/resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/resolve/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,EAEL,KAAK,SAAS,EAEf,MAAM,sBAAsB,CAAC;AAK9B,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;AAEpD,MAAM,MAAM,YAAY,GAAG;IACzB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,YAAY,EAAE,KAAK,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC,CAAC;IACH,QAAQ,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACxE,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACzE,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,eAAe,IAAI,eAAe,CAcjD;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACjC,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,oDAAoD;IACpD,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD,CAAC;AAEF,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CA+BzB"}
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/resolve/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,EAEL,KAAK,SAAS,EAEf,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;AAEpD,MAAM,MAAM,YAAY,GAAG;IACzB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,YAAY,EAAE,KAAK,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC,CAAC;IACH,QAAQ,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACxE,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACzE,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,eAAe,IAAI,eAAe,CAcjD;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACjC,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,oDAAoD;IACpD,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD,CAAC;AAEF,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAmCzB"}

package/dist/resolve/resolver.js

@@ -24,6 +24,7 @@ import { ZyrkError } from "../errors.js";
 import { expectedIntegrityFromDist, } from "../fetch/registry.js";
 import { sha512Hex, sourceIdOf } from "../util/hash.js";
 import { canonicalJson } from "../util/json.js";
+import { createRootOverrides, } from "./overrides.js";
 import { parseRequirement } from "./spec.js";
 export function currentPlatform() {
     const result = { os: process.platform, cpu: process.arch };
@@ -38,7 +39,11 @@ export function currentPlatform() {
 }
 export async function resolveRequirements(options) {
     const state = new ResolverState(options);
-    const rootFrame = { label: "<root>", children: [] };
+    const rootFrame = {
+        label: "<root>",
+        children: [],
+        overrideContext: state.overrides.root,
+    };
     const seenRoots = new Set();
     for (const requirement of [...options.requirements].sort((a, b) => compareStrings(a.name, b.name))) {
         if (seenRoots.has(requirement.name))
@@ -62,6 +67,7 @@ export async function resolveRequirements(options) {
 }
 class ResolverState {
     provider;
+    overrides;
     packuments = new Map();
     peerless = new Map();
     peerBearing = new Map();
@@ -74,6 +80,7 @@ class ResolverState {
     peerExpansions = 0;
     constructor(options) {
         this.provider = options.provider;
+        this.overrides = options.overrides ?? createRootOverrides({});
         this.limits = {
             maxNodes: 10000,
             maxDepth: 128,
@@ -153,7 +160,11 @@ class ResolverState {
     }
     async buildRequiredChild(parentFrame, chain, edgeName, rawSpec, kind) {
         this.checkBudget();
-        const req = parseRequirement(edgeName, rawSpec);
+        const override = this.overrides.select(parentFrame.overrideContext, edgeName, rawSpec);
+        // Root override legality was checked against the declared manifest.
+        // A caller may pass an existing exact root pin inside that declaration;
+        // applying the identical declared range again would discard the pin.
+        const req = parseRequirement(edgeName, parentFrame.label === "<root>" ? rawSpec : override.spec);
         const { version, entry } = await selectVersion(this, req);
         this.checkPlatform(req.realName, entry);
         const integrity = expectedIntegrityFromDist(entry.dist);
@@ -164,9 +175,10 @@ class ResolverState {
             });
         }
         const baseKey = `${req.realName}@${version}`;
+        const memoKey = `${baseKey}\0${override.context.id}`;
         const hasPeers = peerSpecsOf(entry).length > 0;
         if (!hasPeers) {
-            const existing = this.peerless.get(baseKey);
+            const existing = this.peerless.get(memoKey);
             if (existing !== undefined)
                 return existing;
         }
@@ -177,28 +189,37 @@ class ResolverState {
                 this.peerBearing.set(parentFrame, perParent);
             }
             else {
-                const existing = perParent.get(baseKey);
+                const existing = perParent.get(memoKey);
                 if (existing !== undefined)
                     return existing;
             }
         }
         this.checkBudget(chain.length, true);
         const occ = {
+            overrideContext: override.context,
             name: req.realName,
             version,
             entry,
             integrity,
             children: [],
-            peerSpecs: peerSpecsOf(entry),
+            peerSpecs: peerSpecsOf(entry).map((peer) => ({
+                ...peer,
+                range: this.overrides.select(override.context, peer.name, peer.range)
+                    .spec,
+            })),
             peerBindings: new Map(),
             chain: hasPeers ? [...chain, parentFrame] : [],
         };
         if (!hasPeers)
-            this.peerless.set(baseKey, occ);
+            this.peerless.set(memoKey, occ);
         else
-            this.peerBearing.get(parentFrame)?.set(baseKey, occ);
+            this.peerBearing.get(parentFrame)?.set(memoKey, occ);
         this.occurrences.push(occ);
-        const selfFrame = { label: baseKey, children: occ.children };
+        const selfFrame = {
+            label: baseKey,
+            children: occ.children,
+            overrideContext: override.context,
+        };
         const childChain = [...chain, parentFrame];
         for (const dep of regularDepsOf(entry)) {
             const child = await this.buildChild(selfFrame, childChain, dep.name, dep.spec, dep.kind);
@@ -294,7 +315,8 @@ class ResolverState {
         const existing = perOcc.get(spec.name);
         if (existing !== undefined)
             return existing;
-        const req = parseRequirement(spec.name, spec.range);
+        const override = this.overrides.select(occ.overrideContext, spec.name, spec.range);
+        const req = parseRequirement(spec.name, override.spec);
         const { version, entry } = await selectVersion(this, {
             realName: req.realName,
             targetSpec: req.targetSpec,
@@ -310,12 +332,17 @@ class ResolverState {
         this.checkPlatform(req.realName, entry);
         this.checkBudget(occ.chain.length + 1, true);
         const fresh = {
+            overrideContext: override.context,
             name: req.realName,
             version,
             entry,
             integrity,
             children: [],
-            peerSpecs: peerSpecsOf(entry),
+            peerSpecs: peerSpecsOf(entry).map((peer) => ({
+                ...peer,
+                range: this.overrides.select(override.context, peer.name, peer.range)
+                    .spec,
+            })),
             peerBindings: new Map(),
             chain: [...occ.chain, this.frameOf(occ)],
         };
@@ -340,7 +367,11 @@ class ResolverState {
     frameOf(occ) {
         let frame = this.frames.get(occ);
         if (frame === undefined) {
-            frame = { label: `${occ.name}@${occ.version}`, children: occ.children };
+            frame = {
+                label: `${occ.name}@${occ.version}`,
+                children: occ.children,
+                overrideContext: occ.overrideContext,
+            };
             this.frames.set(occ, frame);
         }
         return frame;
@@ -458,7 +489,10 @@ function lookupPeer(occ, peerName, range) {
         const matches = level.children.filter((link) => link.edgeName === peerName);
         if (matches.length === 0)
             continue;
-        const satisfying = matches.filter((link) => satisfies(link.child.version, range));
+        const requested = parseRequirement(peerName, range);
+        const satisfying = matches.filter((link) => link.child.name === requested.realName &&
+            (requested.targetKind === "tag" ||
+                satisfies(link.child.version, requested.targetSpec)));
         const first = satisfying[0];
         if (first !== undefined)
             return { status: "bound", target: first.child };
@@ -490,10 +524,10 @@ function peerConflict(occ, spec, found) {
 /** Canonical fingerprint over the transitive peer closure (SPEC 9.4). */
 function occurrenceKey(occ, check) {
     const base = `${occ.name}@${occ.version}`;
-    if (occ.peerSpecs.length === 0)
+    if (occ.peerSpecs.length === 0 && !occ.overrideContext.id)
         return base;
     const expansion = expandPeerBindings(occ, new Set([occ]), check);
-    return `${base}#${sha512Hex(canonicalJson(expansion)).slice(0, 12)}`;
+    return `${base}#${sha512Hex(canonicalJson(occ.overrideContext.id ? [occ.overrideContext.id, expansion] : expansion)).slice(0, 12)}`;
 }
 function expandPeerBindings(occ, visiting, check) {
     check(visiting.size);
@@ -507,14 +541,24 @@ function expandPeerBindings(occ, visiting, check) {
             parts.push([spec.name, "absent"]);
         }
         else if (visiting.has(bound)) {
-            parts.push([spec.name, ["ref", `${bound.name}@${bound.version}`]]);
+            parts.push([
+                spec.name,
+                [
+                    "ref",
+                    bound.overrideContext.id
+                        ? [`${bound.name}@${bound.version}`, bound.overrideContext.id]
+                        : `${bound.name}@${bound.version}`,
+                ],
+            ]);
         }
         else {
             parts.push([
                 spec.name,
                 [
                     "node",
-                    `${bound.name}@${bound.version}`,
+                    bound.overrideContext.id
+                        ? [`${bound.name}@${bound.version}`, bound.overrideContext.id]
+                        : `${bound.name}@${bound.version}`,
                     expandPeerBindings(bound, new Set([...visiting, bound]), check),
                 ],
             ]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zyrk",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "Storage-efficient Node package manager: one verified store per user, shared across projects through links.",
   "license": "MIT",
   "type": "module",