zyrk 0.5.2 → 0.5.4

package/README.md

@@ -362,3 +362,13 @@ version-qualified selectors, self rules (`.`), and `$direct` references. Direct
 dependency overrides must match the declared specification. Workspace member
 overrides are ignored, matching npm root-only policy. Override rule order is
 recorded in the manifest fingerprint; frozen installs reject policy drift.
+
+`zyrk help` and `zyrk --help` both show help successfully. Installs report
+preparation, resolution, verified source counts, realization, approved builds,
+and project linking on stderr. Interactive terminals show an activity spinner;
+redirected output contains plain phase messages. `--json` disables progress.
+
+Install resolution has a five-minute deadline; each archive extraction has a
+two-minute deadline. Set `ZYRK_RESOLVE_TIMEOUT_MS` or `ZYRK_EXTRACT_TIMEOUT_MS`
+to an integer from `1` to `900000` milliseconds to adjust these timeouts.
+Graph, archive-entry, and byte limits still apply.

package/VERSION

@@ -1 +1 @@
-v0.5.2
+v0.5.4

package/dist/cli/main.d.ts

@@ -30,6 +30,7 @@ export type RunCliOptions = {
     };
     stderr: {
         write(chunk: string): unknown;
+        isTTY?: boolean;
     };
     readVersion?: () => string;
     cwd?: string;

package/dist/cli/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAe,SAAS,EAAe,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,CAAC;AACrB,OAAO,EAAoB,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAExE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAM3C,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAEhF,eAAO,MAAM,uBAAuB,IAAI,CAAC;AA2DzC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAwBhD;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AA6EF;;;GAGG;AACH,wBAAgB,QAAQ,CACtB,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,GACnD,SAAS,CAgDX;AAmBD,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1C,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1C,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;CACxC,CAAC;AAEF,gFAAgF;AAChF,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAqZpE"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAe,SAAS,EAAe,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,CAAC;AACrB,OAAO,EAAoB,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAExE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAM3C,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAEhF,eAAO,MAAM,uBAAuB,IAAI,CAAC;AA2DzC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAwBhD;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AA6EF;;;GAGG;AACH,wBAAgB,QAAQ,CACtB,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,GACnD,SAAS,CAgDX;AAmBD,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1C,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3D,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;CACxC,CAAC;AAEF,gFAAgF;AAChF,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CA4ZpE"}

package/dist/cli/main.js

@@ -1,3 +1,4 @@
+import { createInstallProgress } from "./progress.js";
 import { runMaintenanceCommand } from "../commands/maintenance.js";
 import { runDeployCommand } from "../commands/deploy.js";
 import { runPatchCommand } from "../commands/patch.js";
@@ -379,6 +380,7 @@ export async function runCli(options) {
         (parsed.command === "install" || parsed.command === "i")) {
         if (isGlobalInstallRequest(parsed.command, parsed.commandArgs, options.env))
             return emit(fail(globalInstallError(parsed.command), parsed));
+        const progress = createInstallProgress(options.stderr, parsed.json);
         try {
             if (parsed.commandArgs.includes("--help") ||
                 parsed.commandArgs.includes("-h")) {
@@ -413,6 +415,7 @@ export async function runCli(options) {
                 else
                     specs.push(token);
             }
+            progress.update({ phase: "planning" });
             const cwd = options.cwd ?? process.cwd();
             const tools = options.tools
                 ? await options.tools()
@@ -429,12 +432,14 @@ export async function runCli(options) {
                     }),
                 };
             const result = await installProject({
+                onProgress: progress.update,
                 ...flags,
                 env: options.env,
                 specs,
                 projectDir: cwd,
                 ...tools,
             });
+            progress.close();
             if (parsed.json)
                 return emit({
                     exitCode: 0,
@@ -451,8 +456,12 @@ export async function runCli(options) {
             });
         }
         catch (error) {
+            progress.close();
             return emit(fail(toZyrkError(error, "zyrk install failed."), parsed));
         }
+        finally {
+            progress.close();
+        }
     }
     if (!parsed.help &&
         !parsed.version &&

package/dist/cli/parse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/cli/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,+DAA+D;IAC/D,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,6EAA6E;IAC7E,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,wEAAwE;IACxE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,IAAI,EAAE,OAAO,CAAC;CACf,CAAC;AAEF,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CAkD7D;AAKD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,OAAO,CAOT"}
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/cli/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,+DAA+D;IAC/D,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,6EAA6E;IAC7E,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,wEAAwE;IACxE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,IAAI,EAAE,OAAO,CAAC;CACf,CAAC;AAEF,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CAmD7D;AAKD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,OAAO,CAOT"}

package/dist/cli/parse.js

@@ -45,6 +45,8 @@ export function parseArgs(argv) {
         }
         if (parsed.command === undefined && !token.startsWith("-")) {
             parsed.command = token;
+            if (token === "help")
+                parsed.help = true;
             commandIndex = index;
             return;
         }

package/dist/cli/progress.d.ts

@@ -0,0 +1,10 @@
+import type { InstallProgress } from "../install/run.ts";
+/** Presentation only: never writes to stdout or exposes package URLs or paths. */
+export declare function createInstallProgress(stream: {
+    write(chunk: string): unknown;
+    isTTY?: boolean;
+}, quiet: boolean): {
+    update(event: InstallProgress): void;
+    close(): void;
+};
+//# sourceMappingURL=progress.d.ts.map

package/dist/cli/progress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"progress.d.ts","sourceRoot":"","sources":["../../src/cli/progress.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAWzD,kFAAkF;AAClF,wBAAgB,qBAAqB,CACnC,MAAM,EAAE;IAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,EAC1D,KAAK,EAAE,OAAO,GACb;IAAE,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IAAC,KAAK,IAAI,IAAI,CAAA;CAAE,CAuCzD"}

package/dist/cli/progress.js

@@ -0,0 +1,52 @@
+const labels = {
+    planning: "Preparing installation",
+    resolving: "Resolving dependencies",
+    fetching: "Verifying package sources",
+    realizing: "Preparing shared realizations",
+    building: "Preparing approved private builds",
+    linking: "Linking project dependencies",
+};
+/** Presentation only: never writes to stdout or exposes package URLs or paths. */
+export function createInstallProgress(stream, quiet) {
+    let timer;
+    let current = "", last = "", frame = 0, closed = false;
+    const write = (text) => {
+        try {
+            stream.write(text);
+        }
+        catch {
+            /* A display failure cannot alter installation. */
+        }
+    };
+    const render = () => write(`\r\u001b[2K${["|", "/", "-", "\\"][frame++ % 4]} ${current}`);
+    return {
+        update(event) {
+            if (quiet || closed)
+                return;
+            current =
+                labels[event.phase] +
+                    (event.total === undefined
+                        ? ""
+                        : ` (${event.completed ?? 0}/${event.total})`);
+            if (stream.isTTY) {
+                render();
+                if (!timer) {
+                    timer = setInterval(render, 100);
+                    timer.unref();
+                }
+            }
+            else if (current !== last)
+                write(`zyrk: ${current}\n`);
+            last = current;
+        },
+        close() {
+            if (closed)
+                return;
+            closed = true;
+            if (timer)
+                clearInterval(timer);
+            if (!quiet && stream.isTTY && current)
+                write("\r\u001b[2K");
+        },
+    };
+}

package/dist/install/budgets.d.ts

@@ -0,0 +1,7 @@
+import type { ResolverLimits } from "../resolve/resolver.ts";
+import type { ExtractionLimits } from "../extract/tarball.ts";
+export declare function installBudgets(env: NodeJS.ProcessEnv): {
+    resolveBudget: Partial<ResolverLimits>;
+    extractBudget: Partial<ExtractionLimits>;
+};
+//# sourceMappingURL=budgets.d.ts.map

package/dist/install/budgets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"budgets.d.ts","sourceRoot":"","sources":["../../src/install/budgets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAwB9D,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG;IACtD,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACvC,aAAa,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC1C,CASA"}

package/dist/install/budgets.js

@@ -0,0 +1,25 @@
+/** Public, bounded install timeout configuration. Node and byte limits stay intact. */
+import { ZyrkError } from "../errors.js";
+function timeout(env, key, fallback) {
+    const raw = env[key];
+    if (raw === undefined)
+        return fallback;
+    if (!/^[0-9]+$/.test(raw) ||
+        !Number.isSafeInteger(Number(raw)) ||
+        Number(raw) < 1 ||
+        Number(raw) > 900000)
+        throw new ZyrkError("ZYRK_POLICY_DENIED", `Cannot configure install: ${key} must be an integer from 1 to 900000.`, {
+            remedy: `Set ${key} to a timeout in milliseconds from 1 to 900000, or unset it to use the default.`,
+        });
+    return Number(raw);
+}
+export function installBudgets(env) {
+    return {
+        resolveBudget: {
+            deadlineMs: timeout(env, "ZYRK_RESOLVE_TIMEOUT_MS", 300000),
+        },
+        extractBudget: {
+            maxDurationMs: timeout(env, "ZYRK_EXTRACT_TIMEOUT_MS", 120000),
+        },
+    };
+}

package/dist/install/import-npm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"import-npm.d.ts","sourceRoot":"","sources":["../../src/install/import-npm.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,wBAAwB,CAAC;AAKhC,wBAAgB,aAAa,CAC3B,GAAG,EAAE,UAAU,EACf,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,EAC3C,SAAS,GAAE,cAAwC,GAClD,cAAc,CAqLhB"}
+{"version":3,"file":"import-npm.d.ts","sourceRoot":"","sources":["../../src/install/import-npm.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,wBAAwB,CAAC;AAKhC,wBAAgB,aAAa,CAC3B,GAAG,EAAE,UAAU,EACf,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,EAC3C,SAAS,GAAE,cAAwC,GAClD,cAAc,CAyMhB"}

package/dist/install/import-npm.js

@@ -2,7 +2,7 @@
 import { createRootOverrides, } from "../resolve/overrides.js";
 import { validateLockDoc } from "../lockfile/read.js";
 import { canonicalStrongSri } from "../util/integrity.js";
-import { valid, satisfies } from "semver";
+import { valid, validRange, satisfies } from "semver";
 import { parseRequirement } from "../resolve/spec.js";
 import { sourceIdOf, sha512Hex } from "../util/hash.js";
 import { cleanUrl, lockMismatch, packageName } from "./lock.js";
@@ -76,12 +76,28 @@ export function importNpmLock(doc, requirements, origin, overrides = createRootO
             peerBindings: [],
         };
         if (entry.engines !== undefined) {
-            if (typeof entry.engines !== "object" ||
-                entry.engines === null ||
-                Array.isArray(entry.engines) ||
-                Object.values(entry.engines).some((value) => typeof value !== "string"))
-                throw lockMismatch("invalid npm engine constraint");
-            node.engines = entry.engines;
+            if (Array.isArray(entry.engines)) {
+                // Old npm manifests used ["node >= 0.2.0"] instead of an engine map.
+                const engines = {};
+                for (const value of entry.engines) {
+                    const match = typeof value === "string"
+                        ? /^([a-z][a-z0-9._-]*)\s+(.+)$/.exec(value)
+                        : null;
+                    if (!match ||
+                        Object.hasOwn(engines, match[1]) ||
+                        validRange(match[2]) === null)
+                        throw lockMismatch("invalid npm engine constraint");
+                    engines[match[1]] = match[2];
+                }
+                node.engines = engines;
+            }
+            else {
+                if (typeof entry.engines !== "object" ||
+                    entry.engines === null ||
+                    Object.values(entry.engines).some((value) => typeof value !== "string"))
+                    throw lockMismatch("invalid npm engine constraint");
+                node.engines = entry.engines;
+            }
         }
         if (typeof entry.bin === "object" &&
             entry.bin !== null &&

package/dist/install/lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../../src/install/lock.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAKvD,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,wBAAwB,CAAC;AAKhC,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMjD;AACD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAa/C;AACD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CASnD;AAID,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,cAAc,CA6M3D;AAED,kFAAkF;AAClF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAK,GAAG,IAAI,CAmC3E"}
+{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../../src/install/lock.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAKvD,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,wBAAwB,CAAC;AAKhC,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMjD;AACD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAa/C;AACD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CASnD;AAID,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,cAAc,CA6M3D;AAUD,kFAAkF;AAClF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAK,GAAG,IAAI,CAM3E"}

package/dist/install/lock.js

@@ -201,10 +201,20 @@ export function lockedGraph(doc) {
     }
     return { nodes, roots };
 }
+// npm publishes this canonical GitHub sponsorship link in funding metadata.
+// Keep source/archive URL validation query-free, and allow no other query here.
+function githubFundingUrl(value) {
+    return /^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\?sponsor=1$/.test(value);
+}
 /** Preserved metadata is subject to the same portability boundary as new data. */
 export function assertPortableLockMetadata(value, field = "") {
+    visitPortableLockMetadata(value, field, field === "funding" ? "entry" : undefined);
+}
+function visitPortableLockMetadata(value, field, funding) {
     if (typeof value === "string") {
-        if (/^(?:https?:|file:|git\+|ssh:)/i.test(value) && !cleanUrl(value))
+        if (/^(?:https?:|file:|git\+|ssh:)/i.test(value) &&
+            !cleanUrl(value) &&
+            !(funding && githubFundingUrl(value)))
             throw lockMismatch("portable metadata contains an unsafe URL");
         if (value.startsWith("/") || /^[A-Za-z]:[\\/]/.test(value))
             throw lockMismatch("portable metadata contains a local path");
@@ -212,7 +222,7 @@ export function assertPortableLockMetadata(value, field = "") {
     }
     if (Array.isArray(value)) {
         for (const item of value)
-            assertPortableLockMetadata(item, field);
+            visitPortableLockMetadata(item, field, funding === "entry" ? "entry" : undefined);
         return;
     }
     if (value && typeof value === "object")
@@ -234,6 +244,10 @@ export function assertPortableLockMetadata(value, field = "") {
                     ".",
                 ].includes(field))
                 throw lockMismatch("portable metadata contains a credential field");
-            assertPortableLockMetadata(item, key);
+            visitPortableLockMetadata(item, key, key === "funding"
+                ? "entry"
+                : funding === "entry" && key === "url"
+                    ? "url"
+                    : undefined);
         }
 }

package/dist/install/run.d.ts

@@ -1,7 +1,15 @@
 import { type BuildCandidate } from "./private.ts";
 import { RegistryClient } from "../fetch/registry.ts";
+import type { ResolverLimits } from "../resolve/resolver.ts";
+import type { ExtractionLimits } from "../extract/tarball.ts";
 import { Store } from "../store/layout.ts";
+export type InstallProgress = {
+    phase: "planning" | "resolving" | "fetching" | "realizing" | "building" | "linking";
+    completed?: number;
+    total?: number;
+};
 export type InstallOptions = {
+    onProgress?: (event: InstallProgress) => void;
     projectDir: string;
     store: Store;
     registry: RegistryClient;
@@ -26,6 +34,8 @@ export type InstallOptions = {
     approveBuilds?: readonly string[];
     rebuild?: boolean;
     repair?: boolean;
+    resolveBudget?: Partial<ResolverLimits>;
+    extractBudget?: Partial<ExtractionLimits>;
     fetchBudget?: {
         maxArchiveBytes?: number;
         maxExpandedBytes?: number;

package/dist/install/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/install/run.ts"],"names":[],"mappings":"AAIA,OAAO,EAOL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAYtB,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAgC3C,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE;QACZ,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,CAAC;AACF,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EACL,OAAO,GACP,uBAAuB,GACvB,eAAe,GACf,SAAS,GACT,cAAc,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;CAC3B,CAAC;AA4GF,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAyyBxB"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/install/run.ts"],"names":[],"mappings":"AAIA,OAAO,EAOL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAYtB,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAgC3C,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EACD,UAAU,GACV,WAAW,GACX,UAAU,GACV,WAAW,GACX,UAAU,GACV,SAAS,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AACF,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACxC,aAAa,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1C,WAAW,CAAC,EAAE;QACZ,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,CAAC;AACF,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EACL,OAAO,GACP,uBAAuB,GACvB,eAAe,GACf,SAAS,GACT,cAAc,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;CAC3B,CAAC;AA4GF,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAs0BxB"}

package/dist/install/run.js

@@ -15,6 +15,7 @@ import npa from "npm-package-arg";
 import { satisfies } from "semver";
 import { ZyrkError } from "../errors.js";
 import { RegistryClient } from "../fetch/registry.js";
+import { installBudgets } from "./budgets.js";
 import { extractTarball } from "../extract/tarball.js";
 import { commitExtractedSource } from "../store/source.js";
 import { Store } from "../store/layout.js";
@@ -93,6 +94,13 @@ function scriptPolicy(manifest) {
     return object(manifest.zyrk) ? manifest.zyrk.scripts : undefined;
 }
 export async function installProject(options) {
+    options.onProgress?.({ phase: "planning" });
+    const budgets = installBudgets(options.env ?? process.env);
+    options = {
+        ...options,
+        resolveBudget: { ...budgets.resolveBudget, ...options.resolveBudget },
+        extractBudget: { ...budgets.extractBudget, ...options.extractBudget },
+    };
     if (await findWorkspaceRoot(options.projectDir)) {
         const { installWorkspaceProject } = await import("./workspace-install.js");
         return installWorkspaceProject(options);
@@ -248,8 +256,10 @@ export async function installProject(options) {
                 throw error("ZYRK_OFFLINE_MISSING", "Offline installation requires an existing compatible zyrk lockfile.");
             const prior = existing?.zyrk ? lockedGraph(existing) : undefined;
             const fresh = new Set(specs.map((spec) => npa(spec).name));
+            options.onProgress?.({ phase: "resolving" });
             resolved = await resolveRequirements({
                 overrides,
+                limits: options.resolveBudget,
                 provider: {
                     origin: options.registry.origin,
                     originFor: (name) => options.registry.originFor(name),
@@ -460,10 +470,21 @@ export async function installProject(options) {
             })
             : undefined;
         const unique = new Map(activeNodes.map((n) => [n.sourceId, n]));
+        let completedSources = 0;
+        options.onProgress?.({
+            phase: "fetching",
+            completed: 0,
+            total: unique.size,
+        });
         for (const node of unique.values()) {
             operation.operation.checkpoint();
             if (await pathExists(sourceManifestPath(options.store, node.sourceId))) {
                 await readSourceManifest(options.store, node.sourceId);
+                options.onProgress?.({
+                    phase: "fetching",
+                    completed: ++completedSources,
+                    total: unique.size,
+                });
                 continue;
             }
             if (options.offline)
@@ -480,6 +501,7 @@ export async function installProject(options) {
                 label: `${node.name}@${node.version}`,
             });
             const extracted = await extractTarball({
+                limits: options.extractBudget,
                 signal: operation.operation.signal,
                 onExpandedBytes: operation.operation.consumeExpandedBytes,
                 tarballPath: tarball,
@@ -497,6 +519,11 @@ export async function installProject(options) {
             if (source.sourceId !== node.sourceId)
                 throw lockMismatch("download identity disagrees with the locked source");
             await rm(tarball, { force: true });
+            options.onProgress?.({
+                phase: "fetching",
+                completed: ++completedSources,
+                total: unique.size,
+            });
         }
         for (const node of unique.values())
             assertSupportedSourcePayload(node, await readSourceManifest(options.store, node.sourceId));
@@ -509,6 +536,7 @@ export async function installProject(options) {
                 warnings,
             };
         const graph = createGraphDoc(activeNodes.map((n) => ({ ...n, deps: n.edges })));
+        options.onProgress?.({ phase: "realizing" });
         const sharedRealized = await realizeGraph({
             store: options.store,
             graph,
@@ -581,6 +609,7 @@ export async function installProject(options) {
                 });
                 privateGraph = true;
             }
+            options.onProgress?.({ phase: "building" });
             await buildPrivate({
                 project,
                 generationId,
@@ -667,6 +696,7 @@ export async function installProject(options) {
             roots: selectedRoots.map((r) => r.target),
             readiness,
         });
+        options.onProgress?.({ phase: "linking" });
         const published = await installProjection(project, entries, {
             generationId,
             lockHeld: true,

package/dist/install/workspace-install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-install.d.ts","sourceRoot":"","sources":["../../src/install/workspace-install.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAyH9D,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CA6pBxB"}
+{"version":3,"file":"workspace-install.d.ts","sourceRoot":"","sources":["../../src/install/workspace-install.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAyH9D,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CA+qBxB"}

package/dist/install/workspace-install.js

@@ -161,6 +161,7 @@ export async function installWorkspaceProject(options) {
         if (!graph) {
             if (options.frozen || options.offline)
                 throw lockMismatch("offline/frozen workspace install needs a compatible lock");
+            options.onProgress?.({ phase: "resolving" });
             graph = await resolveWorkspaceGraph(project, {
                 origin: options.registry.origin,
                 originFor: (name) => options.registry.originFor(name),
@@ -170,6 +171,7 @@ export async function installWorkspaceProject(options) {
             }, {
                 ...(existing ? { previous: existing.graph } : {}),
                 fresh: mutation.fresh,
+                ...options.resolveBudget,
             });
         }
         assertWorkspacePlatform(graph);
@@ -261,7 +263,14 @@ export async function installWorkspaceProject(options) {
                 offline: options.offline === true,
             })
             : undefined;
-        for (const node of new Map(nodes.map((n) => [n.sourceId, n])).values()) {
+        const uniqueSources = new Map(nodes.map((n) => [n.sourceId, n]));
+        let completedSources = 0;
+        options.onProgress?.({
+            phase: "fetching",
+            completed: 0,
+            total: uniqueSources.size,
+        });
+        for (const node of uniqueSources.values()) {
             operation.operation.checkpoint();
             if (!(await pathExists(sourceManifestPath(options.store, node.sourceId)))) {
                 if (options.offline)
@@ -279,6 +288,7 @@ export async function installWorkspaceProject(options) {
                     onBytes: operation.operation.consumeArchiveBytes,
                 });
                 const extraction = await extractTarball({
+                    limits: options.extractBudget,
                     tarballPath: archive,
                     destDir: path.join(txn.dir, node.sourceId),
                     signal: operation.operation.signal,
@@ -298,6 +308,11 @@ export async function installWorkspaceProject(options) {
                 await rm(archive, { force: true });
             }
             assertSupportedSourcePayload(node, await readSourceManifest(options.store, node.sourceId));
+            options.onProgress?.({
+                phase: "fetching",
+                completed: ++completedSources,
+                total: uniqueSources.size,
+            });
         }
         if (options.fetchOnly)
             return {
@@ -306,6 +321,7 @@ export async function installWorkspaceProject(options) {
                 reused: 0,
                 warnings,
             };
+        options.onProgress?.({ phase: "realizing" });
         const shared = await realizeGraph({
             store: options.store,
             graph: pureGraph,
@@ -443,6 +459,7 @@ export async function installWorkspaceProject(options) {
             });
             // Approved writes need a coherent fully private registry closure.
             await allocatePrivate(new Set(nodes.map((n) => n.key)));
+            options.onProgress?.({ phase: "building" });
             await buildPrivate({
                 project: root,
                 generationId,
@@ -498,6 +515,7 @@ export async function installWorkspaceProject(options) {
                     bins[name] = actual;
                 }
             }
+            options.onProgress?.({ phase: "linking" });
             await installProjection(holder, node.edges.map((e) => ({
                 name: e.name,
                 linkTarget: realized.packageDirByKey.get(e.target),

package/dist/resolve/spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../src/resolve/spec.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;AAElE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,eAAe,CAAC;IACtB,mDAAmD;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,UAAU,EAAE,OAAO,GAAG,OAAO,GAAG,KAAK,CAAC;CACvC,CAAC;AAcF;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,iBAAiB,CAqFnB"}
+{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../src/resolve/spec.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;AAElE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,eAAe,CAAC;IACtB,mDAAmD;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,UAAU,EAAE,OAAO,GAAG,OAAO,GAAG,KAAK,CAAC;CACvC,CAAC;AAcF;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,iBAAiB,CA6FnB"}

package/dist/resolve/spec.js

@@ -7,6 +7,7 @@
  * explicitly — they are never handed to a tool that might run scripts.
  */
 import npa from "npm-package-arg";
+import { SemVer } from "semver";
 import { ZyrkError } from "../errors.js";
 function unsupported(what, spec) {
     return new ZyrkError("ZYRK_RESOLUTION_FAILED", `unsupported dependency protocol in "${spec}" (${what})`, {
@@ -46,7 +47,13 @@ export function parseRequirement(edgeName, spec) {
                 edgeName,
                 realName: parsed.name,
                 kind: "exact",
-                targetSpec: parsed.fetchSpec,
+                // npm accepts = and v prefixes for exact versions. SemVer.format()
+                // omits build metadata, so append it explicitly for registry lookup.
+                targetSpec: (() => {
+                    const version = new SemVer(parsed.fetchSpec.replace(/^[=v\s]+/, ""));
+                    return (version.version +
+                        (version.build.length ? `+${version.build.join(".")}` : ""));
+                })(),
                 targetKind: "exact",
             };
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zyrk",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "description": "Storage-efficient Node package manager: one verified store per user, shared across projects through links.",
   "license": "MIT",
   "type": "module",