zyrk 0.5.3 → 0.5.4

package/README.md

@@ -367,3 +367,8 @@ recorded in the manifest fingerprint; frozen installs reject policy drift.
 preparation, resolution, verified source counts, realization, approved builds,
 and project linking on stderr. Interactive terminals show an activity spinner;
 redirected output contains plain phase messages. `--json` disables progress.
+
+Install resolution has a five-minute deadline; each archive extraction has a
+two-minute deadline. Set `ZYRK_RESOLVE_TIMEOUT_MS` or `ZYRK_EXTRACT_TIMEOUT_MS`
+to an integer from `1` to `900000` milliseconds to adjust these timeouts.
+Graph, archive-entry, and byte limits still apply.

package/VERSION

@@ -1 +1 @@
-v0.5.3
+v0.5.4

package/dist/install/budgets.d.ts

@@ -0,0 +1,7 @@
+import type { ResolverLimits } from "../resolve/resolver.ts";
+import type { ExtractionLimits } from "../extract/tarball.ts";
+export declare function installBudgets(env: NodeJS.ProcessEnv): {
+    resolveBudget: Partial<ResolverLimits>;
+    extractBudget: Partial<ExtractionLimits>;
+};
+//# sourceMappingURL=budgets.d.ts.map

package/dist/install/budgets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"budgets.d.ts","sourceRoot":"","sources":["../../src/install/budgets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAwB9D,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG;IACtD,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACvC,aAAa,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC1C,CASA"}

package/dist/install/budgets.js

@@ -0,0 +1,25 @@
+/** Public, bounded install timeout configuration. Node and byte limits stay intact. */
+import { ZyrkError } from "../errors.js";
+function timeout(env, key, fallback) {
+    const raw = env[key];
+    if (raw === undefined)
+        return fallback;
+    if (!/^[0-9]+$/.test(raw) ||
+        !Number.isSafeInteger(Number(raw)) ||
+        Number(raw) < 1 ||
+        Number(raw) > 900000)
+        throw new ZyrkError("ZYRK_POLICY_DENIED", `Cannot configure install: ${key} must be an integer from 1 to 900000.`, {
+            remedy: `Set ${key} to a timeout in milliseconds from 1 to 900000, or unset it to use the default.`,
+        });
+    return Number(raw);
+}
+export function installBudgets(env) {
+    return {
+        resolveBudget: {
+            deadlineMs: timeout(env, "ZYRK_RESOLVE_TIMEOUT_MS", 300000),
+        },
+        extractBudget: {
+            maxDurationMs: timeout(env, "ZYRK_EXTRACT_TIMEOUT_MS", 120000),
+        },
+    };
+}

package/dist/install/import-npm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"import-npm.d.ts","sourceRoot":"","sources":["../../src/install/import-npm.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,wBAAwB,CAAC;AAKhC,wBAAgB,aAAa,CAC3B,GAAG,EAAE,UAAU,EACf,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,EAC3C,SAAS,GAAE,cAAwC,GAClD,cAAc,CAqLhB"}
+{"version":3,"file":"import-npm.d.ts","sourceRoot":"","sources":["../../src/install/import-npm.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,wBAAwB,CAAC;AAKhC,wBAAgB,aAAa,CAC3B,GAAG,EAAE,UAAU,EACf,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,EAC3C,SAAS,GAAE,cAAwC,GAClD,cAAc,CAyMhB"}

package/dist/install/import-npm.js

@@ -2,7 +2,7 @@
 import { createRootOverrides, } from "../resolve/overrides.js";
 import { validateLockDoc } from "../lockfile/read.js";
 import { canonicalStrongSri } from "../util/integrity.js";
-import { valid, satisfies } from "semver";
+import { valid, validRange, satisfies } from "semver";
 import { parseRequirement } from "../resolve/spec.js";
 import { sourceIdOf, sha512Hex } from "../util/hash.js";
 import { cleanUrl, lockMismatch, packageName } from "./lock.js";
@@ -76,12 +76,28 @@ export function importNpmLock(doc, requirements, origin, overrides = createRootO
             peerBindings: [],
         };
         if (entry.engines !== undefined) {
-            if (typeof entry.engines !== "object" ||
-                entry.engines === null ||
-                Array.isArray(entry.engines) ||
-                Object.values(entry.engines).some((value) => typeof value !== "string"))
-                throw lockMismatch("invalid npm engine constraint");
-            node.engines = entry.engines;
+            if (Array.isArray(entry.engines)) {
+                // Old npm manifests used ["node >= 0.2.0"] instead of an engine map.
+                const engines = {};
+                for (const value of entry.engines) {
+                    const match = typeof value === "string"
+                        ? /^([a-z][a-z0-9._-]*)\s+(.+)$/.exec(value)
+                        : null;
+                    if (!match ||
+                        Object.hasOwn(engines, match[1]) ||
+                        validRange(match[2]) === null)
+                        throw lockMismatch("invalid npm engine constraint");
+                    engines[match[1]] = match[2];
+                }
+                node.engines = engines;
+            }
+            else {
+                if (typeof entry.engines !== "object" ||
+                    entry.engines === null ||
+                    Object.values(entry.engines).some((value) => typeof value !== "string"))
+                    throw lockMismatch("invalid npm engine constraint");
+                node.engines = entry.engines;
+            }
         }
         if (typeof entry.bin === "object" &&
             entry.bin !== null &&

package/dist/install/lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../../src/install/lock.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAKvD,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,wBAAwB,CAAC;AAKhC,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMjD;AACD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAa/C;AACD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CASnD;AAID,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,cAAc,CA6M3D;AAED,kFAAkF;AAClF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAK,GAAG,IAAI,CAmC3E"}
+{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../../src/install/lock.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAKvD,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,wBAAwB,CAAC;AAKhC,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMjD;AACD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAa/C;AACD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CASnD;AAID,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,cAAc,CA6M3D;AAUD,kFAAkF;AAClF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAK,GAAG,IAAI,CAM3E"}

package/dist/install/lock.js

@@ -201,10 +201,20 @@ export function lockedGraph(doc) {
     }
     return { nodes, roots };
 }
+// npm publishes this canonical GitHub sponsorship link in funding metadata.
+// Keep source/archive URL validation query-free, and allow no other query here.
+function githubFundingUrl(value) {
+    return /^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\?sponsor=1$/.test(value);
+}
 /** Preserved metadata is subject to the same portability boundary as new data. */
 export function assertPortableLockMetadata(value, field = "") {
+    visitPortableLockMetadata(value, field, field === "funding" ? "entry" : undefined);
+}
+function visitPortableLockMetadata(value, field, funding) {
     if (typeof value === "string") {
-        if (/^(?:https?:|file:|git\+|ssh:)/i.test(value) && !cleanUrl(value))
+        if (/^(?:https?:|file:|git\+|ssh:)/i.test(value) &&
+            !cleanUrl(value) &&
+            !(funding && githubFundingUrl(value)))
             throw lockMismatch("portable metadata contains an unsafe URL");
         if (value.startsWith("/") || /^[A-Za-z]:[\\/]/.test(value))
             throw lockMismatch("portable metadata contains a local path");
@@ -212,7 +222,7 @@ export function assertPortableLockMetadata(value, field = "") {
     }
     if (Array.isArray(value)) {
         for (const item of value)
-            assertPortableLockMetadata(item, field);
+            visitPortableLockMetadata(item, field, funding === "entry" ? "entry" : undefined);
         return;
     }
     if (value && typeof value === "object")
@@ -234,6 +244,10 @@ export function assertPortableLockMetadata(value, field = "") {
                     ".",
                 ].includes(field))
                 throw lockMismatch("portable metadata contains a credential field");
-            assertPortableLockMetadata(item, key);
+            visitPortableLockMetadata(item, key, key === "funding"
+                ? "entry"
+                : funding === "entry" && key === "url"
+                    ? "url"
+                    : undefined);
         }
 }

package/dist/install/run.d.ts

@@ -1,5 +1,7 @@
 import { type BuildCandidate } from "./private.ts";
 import { RegistryClient } from "../fetch/registry.ts";
+import type { ResolverLimits } from "../resolve/resolver.ts";
+import type { ExtractionLimits } from "../extract/tarball.ts";
 import { Store } from "../store/layout.ts";
 export type InstallProgress = {
     phase: "planning" | "resolving" | "fetching" | "realizing" | "building" | "linking";
@@ -32,6 +34,8 @@ export type InstallOptions = {
     approveBuilds?: readonly string[];
     rebuild?: boolean;
     repair?: boolean;
+    resolveBudget?: Partial<ResolverLimits>;
+    extractBudget?: Partial<ExtractionLimits>;
     fetchBudget?: {
         maxArchiveBytes?: number;
         maxExpandedBytes?: number;

package/dist/install/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/install/run.ts"],"names":[],"mappings":"AAIA,OAAO,EAOL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAYtB,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAgC3C,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EACD,UAAU,GACV,WAAW,GACX,UAAU,GACV,WAAW,GACX,UAAU,GACV,SAAS,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AACF,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE;QACZ,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,CAAC;AACF,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EACL,OAAO,GACP,uBAAuB,GACvB,eAAe,GACf,SAAS,GACT,cAAc,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;CAC3B,CAAC;AA4GF,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CA8zBxB"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/install/run.ts"],"names":[],"mappings":"AAIA,OAAO,EAOL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAYtB,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAgC3C,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EACD,UAAU,GACV,WAAW,GACX,UAAU,GACV,WAAW,GACX,UAAU,GACV,SAAS,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AACF,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACxC,aAAa,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1C,WAAW,CAAC,EAAE;QACZ,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,CAAC;AACF,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EACL,OAAO,GACP,uBAAuB,GACvB,eAAe,GACf,SAAS,GACT,cAAc,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;CAC3B,CAAC;AA4GF,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAs0BxB"}

package/dist/install/run.js

@@ -15,6 +15,7 @@ import npa from "npm-package-arg";
 import { satisfies } from "semver";
 import { ZyrkError } from "../errors.js";
 import { RegistryClient } from "../fetch/registry.js";
+import { installBudgets } from "./budgets.js";
 import { extractTarball } from "../extract/tarball.js";
 import { commitExtractedSource } from "../store/source.js";
 import { Store } from "../store/layout.js";
@@ -94,6 +95,12 @@ function scriptPolicy(manifest) {
 }
 export async function installProject(options) {
     options.onProgress?.({ phase: "planning" });
+    const budgets = installBudgets(options.env ?? process.env);
+    options = {
+        ...options,
+        resolveBudget: { ...budgets.resolveBudget, ...options.resolveBudget },
+        extractBudget: { ...budgets.extractBudget, ...options.extractBudget },
+    };
     if (await findWorkspaceRoot(options.projectDir)) {
         const { installWorkspaceProject } = await import("./workspace-install.js");
         return installWorkspaceProject(options);
@@ -252,6 +259,7 @@ export async function installProject(options) {
             options.onProgress?.({ phase: "resolving" });
             resolved = await resolveRequirements({
                 overrides,
+                limits: options.resolveBudget,
                 provider: {
                     origin: options.registry.origin,
                     originFor: (name) => options.registry.originFor(name),
@@ -493,6 +501,7 @@ export async function installProject(options) {
                 label: `${node.name}@${node.version}`,
             });
             const extracted = await extractTarball({
+                limits: options.extractBudget,
                 signal: operation.operation.signal,
                 onExpandedBytes: operation.operation.consumeExpandedBytes,
                 tarballPath: tarball,

package/dist/install/workspace-install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-install.d.ts","sourceRoot":"","sources":["../../src/install/workspace-install.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAyH9D,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CA6qBxB"}
+{"version":3,"file":"workspace-install.d.ts","sourceRoot":"","sources":["../../src/install/workspace-install.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAyH9D,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CA+qBxB"}

package/dist/install/workspace-install.js

@@ -171,6 +171,7 @@ export async function installWorkspaceProject(options) {
             }, {
                 ...(existing ? { previous: existing.graph } : {}),
                 fresh: mutation.fresh,
+                ...options.resolveBudget,
             });
         }
         assertWorkspacePlatform(graph);
@@ -287,6 +288,7 @@ export async function installWorkspaceProject(options) {
                     onBytes: operation.operation.consumeArchiveBytes,
                 });
                 const extraction = await extractTarball({
+                    limits: options.extractBudget,
                     tarballPath: archive,
                     destDir: path.join(txn.dir, node.sourceId),
                     signal: operation.operation.signal,

package/dist/resolve/spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../src/resolve/spec.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;AAElE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,eAAe,CAAC;IACtB,mDAAmD;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,UAAU,EAAE,OAAO,GAAG,OAAO,GAAG,KAAK,CAAC;CACvC,CAAC;AAcF;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,iBAAiB,CAqFnB"}
+{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../src/resolve/spec.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;AAElE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,eAAe,CAAC;IACtB,mDAAmD;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,UAAU,EAAE,OAAO,GAAG,OAAO,GAAG,KAAK,CAAC;CACvC,CAAC;AAcF;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,iBAAiB,CA6FnB"}

package/dist/resolve/spec.js

@@ -7,6 +7,7 @@
  * explicitly — they are never handed to a tool that might run scripts.
  */
 import npa from "npm-package-arg";
+import { SemVer } from "semver";
 import { ZyrkError } from "../errors.js";
 function unsupported(what, spec) {
     return new ZyrkError("ZYRK_RESOLUTION_FAILED", `unsupported dependency protocol in "${spec}" (${what})`, {
@@ -46,7 +47,13 @@ export function parseRequirement(edgeName, spec) {
                 edgeName,
                 realName: parsed.name,
                 kind: "exact",
-                targetSpec: parsed.fetchSpec,
+                // npm accepts = and v prefixes for exact versions. SemVer.format()
+                // omits build metadata, so append it explicitly for registry lookup.
+                targetSpec: (() => {
+                    const version = new SemVer(parsed.fetchSpec.replace(/^[=v\s]+/, ""));
+                    return (version.version +
+                        (version.build.length ? `+${version.build.join(".")}` : ""));
+                })(),
                 targetKind: "exact",
             };
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zyrk",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "description": "Storage-efficient Node package manager: one verified store per user, shared across projects through links.",
   "license": "MIT",
   "type": "module",