zyrk 0.5.3 → 0.5.5

package/README.md

@@ -122,7 +122,10 @@ registry; private names never fall back to a public endpoint. Disabled TLS
 verification is rejected before lookup. Git sources and non-workspace local sources remain unsupported;
 they fail explicitly. Optional dependencies incompatible with the selected platform
 are omitted; missing packages, integrity failures, and other optional failures
-remain errors. Platform selection is recorded in the lock. macOS, Windows, and
+remain errors. Locks retain exact platform-qualified optional variants; each machine
+selects its compatible local closure without rewriting the lock or recording store
+paths. Older platform-pruned locks need an intentional non-frozen refresh; incomplete
+npm locks must be freshly resolved before portable adoption. macOS, Windows, and
 broad framework compatibility have not passed their release gates.
 
 ### Workspaces
@@ -367,3 +370,8 @@ recorded in the manifest fingerprint; frozen installs reject policy drift.
 preparation, resolution, verified source counts, realization, approved builds,
 and project linking on stderr. Interactive terminals show an activity spinner;
 redirected output contains plain phase messages. `--json` disables progress.
+
+Install resolution has a five-minute deadline; each archive extraction has a
+two-minute deadline. Set `ZYRK_RESOLVE_TIMEOUT_MS` or `ZYRK_EXTRACT_TIMEOUT_MS`
+to an integer from `1` to `900000` milliseconds to adjust these timeouts.
+Graph, archive-entry, and byte limits still apply.

package/VERSION

@@ -1 +1 @@
-v0.5.3
+v0.5.5

package/dist/install/budgets.d.ts

@@ -0,0 +1,7 @@
+import type { ResolverLimits } from "../resolve/resolver.ts";
+import type { ExtractionLimits } from "../extract/tarball.ts";
+export declare function installBudgets(env: NodeJS.ProcessEnv): {
+    resolveBudget: Partial<ResolverLimits>;
+    extractBudget: Partial<ExtractionLimits>;
+};
+//# sourceMappingURL=budgets.d.ts.map

package/dist/install/budgets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"budgets.d.ts","sourceRoot":"","sources":["../../src/install/budgets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAwB9D,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG;IACtD,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACvC,aAAa,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC1C,CASA"}

package/dist/install/budgets.js

@@ -0,0 +1,25 @@
+/** Public, bounded install timeout configuration. Node and byte limits stay intact. */
+import { ZyrkError } from "../errors.js";
+function timeout(env, key, fallback) {
+    const raw = env[key];
+    if (raw === undefined)
+        return fallback;
+    if (!/^[0-9]+$/.test(raw) ||
+        !Number.isSafeInteger(Number(raw)) ||
+        Number(raw) < 1 ||
+        Number(raw) > 900000)
+        throw new ZyrkError("ZYRK_POLICY_DENIED", `Cannot configure install: ${key} must be an integer from 1 to 900000.`, {
+            remedy: `Set ${key} to a timeout in milliseconds from 1 to 900000, or unset it to use the default.`,
+        });
+    return Number(raw);
+}
+export function installBudgets(env) {
+    return {
+        resolveBudget: {
+            deadlineMs: timeout(env, "ZYRK_RESOLVE_TIMEOUT_MS", 300000),
+        },
+        extractBudget: {
+            maxDurationMs: timeout(env, "ZYRK_EXTRACT_TIMEOUT_MS", 120000),
+        },
+    };
+}

package/dist/install/import-npm-workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"import-npm-workspace.d.ts","sourceRoot":"","sources":["../../src/install/import-npm-workspace.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAQvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,sBAAsB,CAAC;AA0V9B,oEAAoE;AACpE,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,GAC1C,cAAc,CAWhB"}
+{"version":3,"file":"import-npm-workspace.d.ts","sourceRoot":"","sources":["../../src/install/import-npm-workspace.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAOvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,sBAAsB,CAAC;AA6V9B,oEAAoE;AACpE,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,GAC1C,cAAc,CAWhB"}

package/dist/install/import-npm-workspace.js

@@ -8,7 +8,6 @@ import { canonicalJson } from "../util/json.js";
 import { importNpmLock } from "./import-npm.js";
 import { lockMismatch, cleanUrl } from "./lock.js";
 import { ZyrkError } from "../errors.js";
-import { assertWorkspacePlatform } from "./workspace-graph.js";
 function importNpmWorkspaceLockPass(doc, project, origin, overrideState) {
     if (!doc ||
         typeof doc !== "object" ||
@@ -173,7 +172,6 @@ function importNpmWorkspaceLockPass(doc, project, origin, overrideState) {
                 peers: {},
                 optionalPeers: [],
             };
-            assertWorkspacePlatform({ nodes: [node], importers: {}, omissions: [] });
             graph.nodes.push(node);
             locations.set(contextKey, node);
             contexts.set(node.key, selectedOverride.context);
@@ -230,7 +228,7 @@ function importNpmWorkspaceLockPass(doc, project, origin, overrideState) {
                     continue;
                 }
                 if (requirement.kind === "optional")
-                    continue;
+                    throw lockMismatch("npm workspace lock lacks an exact optional selection; restore a complete npm lock or intentionally resolve fresh without the pruned lock");
                 throw lockMismatch("npm workspace lock is missing a required selection");
             }
             let target;

package/dist/install/import-npm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"import-npm.d.ts","sourceRoot":"","sources":["../../src/install/import-npm.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,wBAAwB,CAAC;AAKhC,wBAAgB,aAAa,CAC3B,GAAG,EAAE,UAAU,EACf,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,EAC3C,SAAS,GAAE,cAAwC,GAClD,cAAc,CAqLhB"}
+{"version":3,"file":"import-npm.d.ts","sourceRoot":"","sources":["../../src/install/import-npm.ts"],"names":[],"mappings":"AACA,qFAAqF;AACrF,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,wBAAwB,CAAC;AAKhC,wBAAgB,aAAa,CAC3B,GAAG,EAAE,UAAU,EACf,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,EAC3C,SAAS,GAAE,cAAwC,GAClD,cAAc,CAkLhB"}

package/dist/install/import-npm.js

@@ -1,3 +1,4 @@
+import { normalizeEngineConstraints } from "../util/engines.js";
 /** Adopt npm v2/v3 exact selections without asking the registry to pick versions. */
 import { createRootOverrides, } from "../resolve/overrides.js";
 import { validateLockDoc } from "../lockfile/read.js";
@@ -75,14 +76,10 @@ export function importNpmLock(doc, requirements, origin, overrides = createRootO
             edges: [],
             peerBindings: [],
         };
-        if (entry.engines !== undefined) {
-            if (typeof entry.engines !== "object" ||
-                entry.engines === null ||
-                Array.isArray(entry.engines) ||
-                Object.values(entry.engines).some((value) => typeof value !== "string"))
+        if (entry.engines !== undefined)
+            node.engines = normalizeEngineConstraints(entry.engines, () => {
                 throw lockMismatch("invalid npm engine constraint");
-            node.engines = entry.engines;
-        }
+            });
         if (typeof entry.bin === "object" &&
             entry.bin !== null &&
             !Array.isArray(entry.bin)) {
@@ -125,11 +122,12 @@ export function importNpmLock(doc, requirements, origin, overrides = createRootO
             const meta = entry.peerDependenciesMeta;
             const optionalPeer = requirement.kind === "peer" && meta?.[dep]?.optional === true;
             if (!targetLocation) {
-                if (requirement.kind === "optional" || optionalPeer) {
-                    if (optionalPeer)
-                        node.peerBindings.push({ name: dep, target: null, optional: true });
+                if (optionalPeer) {
+                    node.peerBindings.push({ name: dep, target: null, optional: true });
                     continue;
                 }
+                if (requirement.kind === "optional")
+                    throw lockMismatch("npm lock lacks an exact optional selection; restore a complete npm lock or intentionally resolve fresh without the pruned lock");
                 throw lockMismatch("npm lock is missing a required dependency");
             }
             const target = load(targetLocation, dep, requirement.spec, selected.context);

package/dist/install/lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../../src/install/lock.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAKvD,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,wBAAwB,CAAC;AAKhC,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMjD;AACD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAa/C;AACD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CASnD;AAID,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,cAAc,CA6M3D;AAED,kFAAkF;AAClF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAK,GAAG,IAAI,CAmC3E"}
+{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../../src/install/lock.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAKvD,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,wBAAwB,CAAC;AAKhC,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMjD;AACD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAa/C;AACD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CASnD;AAID,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,cAAc,CA+M3D;AAYD,kFAAkF;AAClF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAK,GAAG,IAAI,CAM3E"}

package/dist/install/lock.js

@@ -39,6 +39,7 @@ export function lockedGraph(doc) {
         Object.keys(ext).some((key) => ![
             "version",
             "resolver",
+            "platformPolicy",
             "contextCanonicalization",
             "manifest",
             "scripts",
@@ -48,6 +49,7 @@ export function lockedGraph(doc) {
         ].includes(key)) ||
         ![ext.manifest, ext.scripts, ext.config].every((value) => typeof value === "string" && /^sha512-[A-Za-z0-9+/]{86}==$/.test(value)) ||
         ext.resolver !== ZYRK_RESOLVER_POLICY ||
+        ext.platformPolicy !== "portable-optional/1" ||
         ext.contextCanonicalization !== CONTEXT_CANONICALIZATION_VERSION ||
         !record(ext.nodes) ||
         !record(ext.roots) ||
@@ -180,7 +182,7 @@ export function lockedGraph(doc) {
             sourceId: raw.source,
             tarballUrl: raw.tarball,
             bin,
-            engines,
+            ...(raw.engines === undefined ? {} : { engines }),
             platform,
             edges,
             peerBindings: peers,
@@ -201,10 +203,20 @@ export function lockedGraph(doc) {
     }
     return { nodes, roots };
 }
+// npm publishes this canonical GitHub sponsorship link in funding metadata.
+// Keep source/archive URL validation query-free, and allow no other query here.
+function githubFundingUrl(value) {
+    return (/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\?sponsor=1$/.test(value) && new URL(value).href === value);
+}
 /** Preserved metadata is subject to the same portability boundary as new data. */
 export function assertPortableLockMetadata(value, field = "") {
+    visitPortableLockMetadata(value, field, field === "funding" ? "funding" : undefined);
+}
+function visitPortableLockMetadata(value, field, funding) {
     if (typeof value === "string") {
-        if (/^(?:https?:|file:|git\+|ssh:)/i.test(value) && !cleanUrl(value))
+        if (/^(?:https?:|file:|git\+|ssh:)/i.test(value) &&
+            !cleanUrl(value) &&
+            !(funding && githubFundingUrl(value)))
             throw lockMismatch("portable metadata contains an unsafe URL");
         if (value.startsWith("/") || /^[A-Za-z]:[\\/]/.test(value))
             throw lockMismatch("portable metadata contains a local path");
@@ -212,7 +224,7 @@ export function assertPortableLockMetadata(value, field = "") {
     }
     if (Array.isArray(value)) {
         for (const item of value)
-            assertPortableLockMetadata(item, field);
+            visitPortableLockMetadata(item, field, funding === "funding" ? "entry" : undefined);
         return;
     }
     if (value && typeof value === "object")
@@ -234,6 +246,10 @@ export function assertPortableLockMetadata(value, field = "") {
                     ".",
                 ].includes(field))
                 throw lockMismatch("portable metadata contains a credential field");
-            assertPortableLockMetadata(item, key);
+            visitPortableLockMetadata(item, key, key === "funding"
+                ? "funding"
+                : (funding === "funding" || funding === "entry") && key === "url"
+                    ? "url"
+                    : undefined);
         }
 }

package/dist/install/platform.d.ts

@@ -0,0 +1,5 @@
+import { type RuntimePlatform, type FinalizedGraph } from "../resolve/resolver.ts";
+import type { WorkspaceGraph } from "./workspace-graph.ts";
+export declare function selectPlatformGraph(graph: FinalizedGraph, optionalRoots: ReadonlySet<string>, platform?: RuntimePlatform): FinalizedGraph;
+export declare function selectWorkspacePlatform(graph: WorkspaceGraph, platform?: RuntimePlatform): WorkspaceGraph;
+//# sourceMappingURL=platform.d.ts.map

package/dist/install/platform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/install/platform.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAuG3D,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,cAAc,EACrB,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,EAClC,QAAQ,kBAAoB,GAC3B,cAAc,CAqBhB;AACD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,cAAc,EACrB,QAAQ,kBAAoB,GAC3B,cAAc,CAsBhB"}

package/dist/install/platform.js

@@ -0,0 +1,97 @@
+/** Portable selections stay in the lock; only a compatible closure is realized. */
+import { satisfies } from "semver";
+import { ZyrkError } from "../errors.js";
+import { currentPlatform, } from "../resolve/resolver.js";
+import { lockMismatch } from "./lock.js";
+function compatible(node, platform) {
+    return ([
+        [node.platform?.os, platform.os],
+        [node.platform?.cpu, platform.cpu],
+        [node.platform?.libc, platform.libc],
+    ].every(([list, actual]) => !list?.length ||
+        (!!actual &&
+            !list.includes(`!${actual}`) &&
+            (!list.some((v) => !v.startsWith("!")) ||
+                list.includes(actual) ||
+                list.includes("any")))) &&
+        (!node.engines?.node || satisfies(process.versions.node, node.engines.node)));
+}
+function optional(node, edge) {
+    return (edge.kind === "optional" ||
+        (edge.kind === "peer" &&
+            (node.optionalPeers?.includes(edge.name) === true ||
+                node.peerBindings?.some((p) => p.name === edge.name && p.optional) ===
+                    true)));
+}
+function select(nodes, roots, platform) {
+    const byKey = new Map(nodes.map((n) => [n.key, n]));
+    const viable = new Set(nodes.filter((n) => compatible(n, platform)).map((n) => n.key));
+    // Propagate required incompatibility back to the nearest optional boundary.
+    let changed = true;
+    while (changed) {
+        changed = false;
+        for (const node of nodes)
+            if (viable.has(node.key) &&
+                node.edges.some((e) => !optional(node, e) && !viable.has(e.target))) {
+                viable.delete(node.key);
+                changed = true;
+            }
+    }
+    const active = new Set();
+    const omissions = [];
+    const visit = (name, target, isOptional, parent) => {
+        if (!byKey.has(target))
+            throw lockMismatch("missing platform selection");
+        if (!viable.has(target)) {
+            if (isOptional) {
+                omissions.push({ name, parent, reason: "platform" });
+                return;
+            }
+            throw new ZyrkError("ZYRK_PLATFORM_UNSUPPORTED", `Cannot install required dependency ${name} on the selected platform or Node.js runtime.`, {
+                remedy: "Select a compatible package version, platform, or Node.js runtime.",
+            });
+        }
+        if (active.has(target))
+            return;
+        active.add(target);
+        const node = byKey.get(target);
+        for (const edge of node.edges)
+            visit(edge.name, edge.target, optional(node, edge), node.key);
+    };
+    for (const root of roots)
+        visit(root.name, root.target, root.optional === true, "<root>");
+    return { active, viable, omissions };
+}
+export function selectPlatformGraph(graph, optionalRoots, platform = currentPlatform()) {
+    const { active, viable, omissions } = select(graph.nodes, graph.roots.map((r) => ({ ...r, optional: optionalRoots.has(r.name) })), platform);
+    return {
+        roots: graph.roots.filter((r) => active.has(r.target)),
+        omissions,
+        nodes: graph.nodes
+            .filter((n) => active.has(n.key))
+            .map((n) => ({
+            ...n,
+            edges: n.edges.filter((e) => viable.has(e.target)),
+            peerBindings: n.peerBindings.map((p) => p.target !== null && !viable.has(p.target)
+                ? { ...p, target: null }
+                : p),
+        })),
+    };
+}
+export function selectWorkspacePlatform(graph, platform = currentPlatform()) {
+    const { active, viable, omissions } = select(graph.nodes, Object.entries(graph.importers).map(([name, target]) => ({ name, target })), platform);
+    return {
+        ...graph,
+        omissions,
+        nodes: graph.nodes
+            .filter((n) => active.has(n.key))
+            .map((n) => ({
+            ...n,
+            edges: n.edges.filter((e) => viable.has(e.target)),
+            peers: Object.fromEntries(Object.entries(n.peers).map(([name, target]) => [
+                name,
+                target !== null && !viable.has(target) ? null : target,
+            ])),
+        })),
+    };
+}

package/dist/install/run.d.ts

@@ -1,5 +1,8 @@
+import type { RuntimePlatform } from "../resolve/resolver.ts";
 import { type BuildCandidate } from "./private.ts";
 import { RegistryClient } from "../fetch/registry.ts";
+import type { ResolverLimits } from "../resolve/resolver.ts";
+import type { ExtractionLimits } from "../extract/tarball.ts";
 import { Store } from "../store/layout.ts";
 export type InstallProgress = {
     phase: "planning" | "resolving" | "fetching" | "realizing" | "building" | "linking";
@@ -9,6 +12,8 @@ export type InstallProgress = {
 export type InstallOptions = {
     onProgress?: (event: InstallProgress) => void;
     projectDir: string;
+    /** Target selection only; Store.open still checks the actual host. */
+    platform?: RuntimePlatform;
     store: Store;
     registry: RegistryClient;
     specs?: readonly string[];
@@ -32,6 +37,8 @@ export type InstallOptions = {
     approveBuilds?: readonly string[];
     rebuild?: boolean;
     repair?: boolean;
+    resolveBudget?: Partial<ResolverLimits>;
+    extractBudget?: Partial<ExtractionLimits>;
     fetchBudget?: {
         maxArchiveBytes?: number;
         maxExpandedBytes?: number;

package/dist/install/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/install/run.ts"],"names":[],"mappings":"AAIA,OAAO,EAOL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAYtB,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAgC3C,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EACD,UAAU,GACV,WAAW,GACX,UAAU,GACV,WAAW,GACX,UAAU,GACV,SAAS,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AACF,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE;QACZ,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,CAAC;AACF,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EACL,OAAO,GACP,uBAAuB,GACvB,eAAe,GACf,SAAS,GACT,cAAc,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;CAC3B,CAAC;AA4GF,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CA8zBxB"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/install/run.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAK9D,OAAO,EAOL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAYtB,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AA+B3C,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EACD,UAAU,GACV,WAAW,GACX,UAAU,GACV,WAAW,GACX,UAAU,GACV,SAAS,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AACF,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACxC,aAAa,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1C,WAAW,CAAC,EAAE;QACZ,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,CAAC;AACF,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EACL,OAAO,GACP,uBAAuB,GACvB,eAAe,GACf,SAAS,GACT,cAAc,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;CAC3B,CAAC;AA4GF,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAoyBxB"}

package/dist/install/run.js

@@ -1,3 +1,4 @@
+import { selectPlatformGraph } from "./platform.js";
 import { findWorkspaceRoot } from "./workspaces.js";
 import { assertSupportedSourcePayload } from "./source-policy.js";
 import { prepareRepair } from "./repair.js";
@@ -15,6 +16,7 @@ import npa from "npm-package-arg";
 import { satisfies } from "semver";
 import { ZyrkError } from "../errors.js";
 import { RegistryClient } from "../fetch/registry.js";
+import { installBudgets } from "./budgets.js";
 import { extractTarball } from "../extract/tarball.js";
 import { commitExtractedSource } from "../store/source.js";
 import { Store } from "../store/layout.js";
@@ -22,7 +24,7 @@ import { Transaction } from "../store/txn.js";
 import { readSourceManifest, sourceManifestPath } from "../store/manifests.js";
 import { realizeGraph, selectRealizationDirs } from "../store/realize.js";
 import { createGraphDoc, graphHash } from "../store/graph.js";
-import { resolveRequirements, currentPlatform, } from "../resolve/resolver.js";
+import { resolveRequirements, } from "../resolve/resolver.js";
 import { parseRequirement } from "../resolve/spec.js";
 import { readLockfile, assertFrozenCompatible } from "../lockfile/read.js";
 import { writeLockfile } from "../lockfile/write.js";
@@ -94,6 +96,12 @@ function scriptPolicy(manifest) {
 }
 export async function installProject(options) {
     options.onProgress?.({ phase: "planning" });
+    const budgets = installBudgets(options.env ?? process.env);
+    options = {
+        ...options,
+        resolveBudget: { ...budgets.resolveBudget, ...options.resolveBudget },
+        extractBudget: { ...budgets.extractBudget, ...options.extractBudget },
+    };
     if (await findWorkspaceRoot(options.projectDir)) {
         const { installWorkspaceProject } = await import("./workspace-install.js");
         return installWorkspaceProject(options);
@@ -208,7 +216,6 @@ export async function installProject(options) {
                 registry: options.registry.origin,
                 registries: options.registry.scopedRegistries,
                 linker: "shared",
-                platform: currentPlatform(),
                 ...(object(manifest.zyrk) &&
                     Array.isArray(manifest.zyrk.mutablePackages)
                     ? { mutablePackages: manifest.zyrk.mutablePackages }
@@ -217,7 +224,7 @@ export async function installProject(options) {
             }),
         });
         const lockPath = path.join(project, "package-lock.json");
-        const existing = (await readLockfile(lockPath))?.doc;
+        const existing = (await readLockfile(lockPath, !options.frozen && !options.offline))?.doc;
         let resolved;
         if (options.importNpm && (!existing || existing.zyrk))
             throw lockMismatch("import --from npm requires an existing npm-only lockfile");
@@ -233,6 +240,8 @@ export async function installProject(options) {
             let compatible = true;
             try {
                 assertFrozenCompatible(existing, fingerprints());
+                if (existing.zyrk?.platformPolicy !== "portable-optional/1")
+                    throw lockMismatch("lock predates portable platform selections; refresh intentionally");
             }
             catch (cause) {
                 if (options.frozen)
@@ -247,11 +256,15 @@ export async function installProject(options) {
                 throw lockMismatch("missing compatible lockfile");
             if (options.offline)
                 throw error("ZYRK_OFFLINE_MISSING", "Offline installation requires an existing compatible zyrk lockfile.");
-            const prior = existing?.zyrk ? lockedGraph(existing) : undefined;
+            const prior = existing?.zyrk?.platformPolicy === "portable-optional/1"
+                ? lockedGraph(existing)
+                : undefined;
             const fresh = new Set(specs.map((spec) => npa(spec).name));
             options.onProgress?.({ phase: "resolving" });
             resolved = await resolveRequirements({
                 overrides,
+                limits: options.resolveBudget,
+                preservePlatformVariants: true,
                 provider: {
                     origin: options.registry.origin,
                     originFor: (name) => options.registry.originFor(name),
@@ -358,49 +371,15 @@ export async function installProject(options) {
                 node.origin !== options.registry.originFor(node.name))
                 throw error("ZYRK_POLICY_DENIED", "Selected source has an unsupported or credential-bearing registry origin or archive URL.");
         }
-        const selectedRoots = resolved.roots.filter((r) => !options.omitDev ||
-            manifest.dependencies?.[r.name] !== undefined ||
-            manifest.optionalDependencies?.[r.name] !== undefined);
-        const byKey = new Map(resolved.nodes.map((n) => [n.key, n]));
-        const activeKeys = new Set();
-        const visit = (key) => {
-            if (activeKeys.has(key))
-                return;
-            activeKeys.add(key);
-            const n = byKey.get(key);
-            if (!n)
-                throw lockMismatch("missing selected node");
-            for (const e of n.edges)
-                visit(e.target);
-        };
-        for (const r of selectedRoots)
-            visit(r.target);
-        const activeNodes = resolved.nodes.filter((n) => activeKeys.has(n.key));
-        for (const n of activeNodes) {
-            for (const [list, current] of [
-                [n.platform.os, process.platform],
-                [n.platform.cpu, process.arch],
-            ]) {
-                if (list &&
-                    (list.includes(`!${current}`) ||
-                        (list.some((x) => !x.startsWith("!")) &&
-                            !list.includes(current) &&
-                            !list.includes("any"))))
-                    throw new ZyrkError("ZYRK_PLATFORM_UNSUPPORTED", `Cannot install ${n.name}@${n.version} on the selected platform.`, { remedy: "Select a package version supporting this OS and CPU." });
-            }
-            if (n.platform.libc?.length) {
-                const libc = currentPlatform().libc;
-                if (!libc ||
-                    n.platform.libc.includes(`!${libc}`) ||
-                    (n.platform.libc.some((v) => !v.startsWith("!")) &&
-                        !n.platform.libc.includes(libc)))
-                    throw new ZyrkError("ZYRK_PLATFORM_UNSUPPORTED", `Cannot install ${n.name}@${n.version} with this libc.`, { remedy: "Select a compatible platform or package version." });
-            }
-            if (n.engines?.node && !satisfies(process.versions.node, n.engines.node))
-                throw new ZyrkError("ZYRK_PLATFORM_UNSUPPORTED", `Cannot install ${n.name}@${n.version} on this Node.js version.`, {
-                    remedy: "Use a Node.js version satisfying the package's engines.node range.",
-                });
-        }
+        const activeResolution = selectPlatformGraph({
+            ...resolved,
+            roots: resolved.roots.filter((r) => !options.omitDev ||
+                manifest.dependencies?.[r.name] !== undefined ||
+                manifest.optionalDependencies?.[r.name] !== undefined),
+        }, new Set(Object.keys(manifest.optionalDependencies ?? {})), options.platform);
+        const selectedRoots = activeResolution.roots;
+        const activeNodes = activeResolution.nodes;
+        const byKey = new Map(activeNodes.map((n) => [n.key, n]));
         barrier = await acquireLock(path.join(options.store.paths.locksDir, "liveness.lock"), { name: "store liveness" });
         txn = await Transaction.begin(options.store, "install");
         const candidateLock = path.join(txn.dir, "package-lock.json");
@@ -436,7 +415,7 @@ export async function installProject(options) {
                 name: "package.json",
                 contents: `${JSON.stringify(manifest, null, 2)}\n`,
             });
-        const warnings = (resolved.omissions ?? []).map((item) => `${item.name}: omitted optional dependency incompatible with the selected platform.`);
+        const warnings = (activeResolution.omissions ?? []).map((item) => `${item.name}: omitted optional dependency incompatible with the selected platform.`);
         for (const stage of ["preinstall", "install", "postinstall"])
             if (manifest.scripts?.[stage])
                 warnings.push(`Root ${stage} hook was not run; invoke it explicitly after installation.`);
@@ -493,6 +472,7 @@ export async function installProject(options) {
                 label: `${node.name}@${node.version}`,
             });
             const extracted = await extractTarball({
+                limits: options.extractBudget,
                 signal: operation.operation.signal,
                 onExpandedBytes: operation.operation.consumeExpandedBytes,
                 tarballPath: tarball,

package/dist/install/workspace-graph.d.ts

@@ -50,6 +50,7 @@ declare function resolveWorkspaceGraphPass(project: WorkspaceProject, provider:
     previous?: WorkspaceGraph;
     fresh?: ReadonlySet<string>;
     platform?: RuntimePlatform;
+    preservePlatformVariants?: boolean;
     maxNodes?: number;
     maxDepth?: number;
     deadlineMs?: number;

package/dist/install/workspace-graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-graph.d.ts","sourceRoot":"","sources":["../../src/install/workspace-graph.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EAChB,MAAM,wBAAwB,CAAC;AAUhC,OAAO,EAEL,KAAK,gBAAgB,EAEtB,MAAM,iBAAiB,CAAC;AAGzB,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACrC,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,QAAQ,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACrC,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;AACF,MAAM,MAAM,aAAa,GAAG,kBAAkB,GAAG,qBAAqB,CAAC;AACvE,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;CACxE,CAAC;AAYF,iBAAe,yBAAyB,CACtC,OAAO,EAAE,gBAAgB,EACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,GAAE;IACP,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,KAAK,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5B,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CAChB,EACN,aAAa;;;CAA8B,GAC1C,OAAO,CAAC,cAAc,CAAC,CA4XzB;AACD,gFAAgF;AAChF,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,gBAAgB,EACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,GAAE,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAC,CAAC,CAAM,GAC5D,OAAO,CAAC,cAAc,CAAC,CAmCzB;AACD,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,cAAc,GACpB,kBAAkB,EAAE,CAetB;AAED,uGAAuG;AACvG,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,MAAM,CAgCR;AAED,oFAAoF;AACpF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAsCnE"}
+{"version":3,"file":"workspace-graph.d.ts","sourceRoot":"","sources":["../../src/install/workspace-graph.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EAChB,MAAM,wBAAwB,CAAC;AAUhC,OAAO,EAEL,KAAK,gBAAgB,EAEtB,MAAM,iBAAiB,CAAC;AAGzB,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACrC,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,QAAQ,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACrC,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;AACF,MAAM,MAAM,aAAa,GAAG,kBAAkB,GAAG,qBAAqB,CAAC;AACvE,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;CACxE,CAAC;AAYF,iBAAe,yBAAyB,CACtC,OAAO,EAAE,gBAAgB,EACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,GAAE;IACP,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,KAAK,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5B,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CAChB,EACN,aAAa;;;CAA8B,GAC1C,OAAO,CAAC,cAAc,CAAC,CAsYzB;AACD,gFAAgF;AAChF,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,gBAAgB,EACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,GAAE,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAC,CAAC,CAAM,GAC5D,OAAO,CAAC,cAAc,CAAC,CAmCzB;AACD,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,cAAc,GACpB,kBAAkB,EAAE,CAetB;AAED,uGAAuG;AACvG,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,MAAM,CAgCR;AAED,oFAAoF;AACpF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAsCnE"}

package/dist/install/workspace-graph.js

@@ -1,3 +1,4 @@
+import { normalizeEngineConstraints } from "../util/engines.js";
 /** Multi-importer resolution. Live nodes are never registry sources or CAS inputs. */
 import { maxSatisfying, satisfies, valid } from "semver";
 import { expectedIntegrityFromDist, } from "../fetch/registry.js";
@@ -67,6 +68,11 @@ async function resolveWorkspaceGraphPass(project, provider, options = {}, overri
         ]).finally(() => clearTimeout(timer));
     };
     const compatible = (entry) => {
+        const engines = entry.engines === undefined
+            ? undefined
+            : normalizeEngineConstraints(entry.engines, () => fail("invalid npm engine constraint"));
+        if (options.preservePlatformVariants)
+            return;
         for (const [list, actual] of [
             [entry.os, platform.os],
             [entry.cpu, platform.cpu],
@@ -79,8 +85,7 @@ async function resolveWorkspaceGraphPass(project, provider, options = {}, overri
                         !list.includes(actual) &&
                         !list.includes("any"))))
                 throw new PlatformMismatch();
-        if (entry.engines?.node &&
-            !satisfies(process.versions.node, entry.engines.node))
+        if (engines?.node && !satisfies(process.versions.node, engines.node))
             throw new PlatformMismatch();
     };
     const build = async (parent, name, spec, kind, ancestry, explicitLocal) => {
@@ -189,7 +194,11 @@ async function resolveWorkspaceGraphPass(project, provider, options = {}, overri
                     ...(entry.cpu ? { cpu: entry.cpu } : {}),
                     ...(entry.libc ? { libc: entry.libc } : {}),
                 },
-                ...(entry.engines ? { engines: entry.engines } : {}),
+                ...(entry.engines === undefined
+                    ? {}
+                    : {
+                        engines: normalizeEngineConstraints(entry.engines, () => fail("invalid npm engine constraint")),
+                    }),
                 edges: [],
                 peers: {},
                 optionalPeers: [],

package/dist/install/workspace-install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-install.d.ts","sourceRoot":"","sources":["../../src/install/workspace-install.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAyH9D,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CA6qBxB"}
+{"version":3,"file":"workspace-install.d.ts","sourceRoot":"","sources":["../../src/install/workspace-install.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAuH9D,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAkrBxB"}

package/dist/install/workspace-install.js

@@ -1,9 +1,10 @@
+import { selectWorkspacePlatform } from "./platform.js";
 /** Multi-importer live workspace installation with one publication journal. */
 import { chmod, copyFile, lstat, mkdir, readFile, realpath, rename, rm, symlink, } from "node:fs/promises";
 import { constants } from "node:fs";
 import * as path from "node:path";
 import { discoverWorkspaces, findWorkspaceRoot, assertNoLiveSourceBuilds, } from "./workspaces.js";
-import { resolveWorkspaceGraph, workspaceRegistryOccurrences, workspaceContextId, assertWorkspacePlatform, } from "./workspace-graph.js";
+import { resolveWorkspaceGraph, workspaceRegistryOccurrences, workspaceContextId, } from "./workspace-graph.js";
 import { workspaceOverrides } from "./workspace-overrides.js";
 import { importNpmWorkspaceLock } from "./import-npm-workspace.js";
 import { readWorkspaceLock, workspaceLockDoc } from "./workspace-lock.js";
@@ -24,7 +25,6 @@ import { randomId } from "../util/ids.js";
 import { sha512Hex } from "../util/hash.js";
 import { canonicalJson } from "../util/json.js";
 import { configFingerprint, scriptPolicyFingerprint, } from "../lockfile/fingerprints.js";
-import { currentPlatform } from "../resolve/resolver.js";
 import { installProjection, installMetadata } from "../project/projection.js";
 import { prepareWorkspaceMutation } from "./workspace-mutation.js";
 import { loadProjectPatches, applyProjectPatches } from "../commands/patch.js";
@@ -135,7 +135,6 @@ export async function installWorkspaceProject(options) {
                 registry: options.registry.origin,
                 registries: options.registry.scopedRegistries,
                 linker: "shared",
-                platform: currentPlatform(),
                 ...(mutable !== undefined
                     ? { mutablePackages: mutable }
                     : {}),
@@ -147,7 +146,7 @@ export async function installWorkspaceProject(options) {
             : undefined;
         let existing = options.importNpm
             ? null
-            : await readWorkspaceLock(root, project, (name) => options.registry.originFor(name)), graph = imported;
+            : await readWorkspaceLock(root, project, (name) => options.registry.originFor(name), !options.frozen && !options.offline), graph = imported;
         if (existing) {
             const ext = existing.doc.zyrk;
             if (!mutation.changed &&
@@ -171,9 +170,10 @@ export async function installWorkspaceProject(options) {
             }, {
                 ...(existing ? { previous: existing.graph } : {}),
                 fresh: mutation.fresh,
+                ...options.resolveBudget,
+                preservePlatformVariants: true,
             });
         }
-        assertWorkspacePlatform(graph);
         mutation.finish(graph);
         fp.manifest = project.manifestFingerprint;
         const manifestChanges = project.importers
@@ -189,6 +189,7 @@ export async function installWorkspaceProject(options) {
             : workspaceLockDoc(project, graph, fp), lockText = options.frozen
             ? await readFile(path.join(root, "package-lock.json"), "utf8")
             : JSON.stringify(doc, null, 2) + "\n";
+        graph = selectWorkspacePlatform(graph, options.platform);
         const warnings = graph.omissions.map((o) => `${o.name}: omitted incompatible optional workspace dependency.`);
         for (const importer of project.importers)
             for (const stage of ["preinstall", "install", "postinstall"])
@@ -287,6 +288,7 @@ export async function installWorkspaceProject(options) {
                     onBytes: operation.operation.consumeArchiveBytes,
                 });
                 const extraction = await extractTarball({
+                    limits: options.extractBudget,
                     tarballPath: archive,
                     destDir: path.join(txn.dir, node.sourceId),
                     signal: operation.operation.signal,

package/dist/install/workspace-lock.d.ts

@@ -9,7 +9,7 @@ export type WorkspaceFingerprints = {
 export declare function safeImporter(id: unknown): id is string;
 export declare function workspaceLockDoc(project: WorkspaceProject, graph: WorkspaceGraph, fp: WorkspaceFingerprints): NpmLockDoc;
 export declare function validateWorkspaceLockDoc(doc: unknown): WorkspaceGraph;
-export declare function readWorkspaceLock(root: string, project?: WorkspaceProject, registryOrigin?: string | ((name: string) => string)): Promise<{
+export declare function readWorkspaceLock(root: string, project?: WorkspaceProject, registryOrigin?: string | ((name: string) => string), allowPlatformRefresh?: boolean): Promise<{
     doc: NpmLockDoc;
     graph: WorkspaceGraph;
 } | null>;

package/dist/install/workspace-lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-lock.d.ts","sourceRoot":"","sources":["../../src/install/workspace-lock.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AASvD,OAAO,KAAK,EAAE,cAAc,EAAiB,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGxD,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAGF,wBAAgB,YAAY,CAAC,EAAE,EAAE,OAAO,GAAG,EAAE,IAAI,MAAM,CAqBtD;AACD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,qBAAqB,GACxB,UAAU,CAyCZ;AACD,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAgTrE;AACD,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,gBAAgB,EAC1B,cAAc,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,GACnD,OAAO,CAAC;IAAE,GAAG,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GAAG,IAAI,CAAC,CA2C5D"}
+{"version":3,"file":"workspace-lock.d.ts","sourceRoot":"","sources":["../../src/install/workspace-lock.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AASvD,OAAO,KAAK,EAAE,cAAc,EAAiB,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGxD,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAGF,wBAAgB,YAAY,CAAC,EAAE,EAAE,OAAO,GAAG,EAAE,IAAI,MAAM,CAqBtD;AACD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,qBAAqB,GACxB,UAAU,CA0CZ;AACD,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAmTrE;AACD,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,gBAAgB,EAC1B,cAAc,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,EACpD,oBAAoB,UAAQ,GAC3B,OAAO,CAAC;IAAE,GAAG,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GAAG,IAAI,CAAC,CAmD5D"}

package/dist/install/workspace-lock.js

@@ -54,6 +54,7 @@ export function workspaceLockDoc(project, graph, fp) {
         zyrk: {
             version: 2,
             resolver: ZYRK_RESOLVER_POLICY,
+            platformPolicy: "portable-optional/1",
             contextCanonicalization: CONTEXT_CANONICALIZATION_VERSION,
             ...fp,
             nodes: {},
@@ -71,6 +72,7 @@ export function validateWorkspaceLockDoc(doc) {
     if (Object.keys(e).some((k) => ![
         "version",
         "resolver",
+        "platformPolicy",
         "contextCanonicalization",
         "manifest",
         "scripts",
@@ -85,6 +87,7 @@ export function validateWorkspaceLockDoc(doc) {
         Object.keys(e.roots).length !== 0 ||
         e.version !== 2 ||
         e.resolver !== ZYRK_RESOLVER_POLICY ||
+        e.platformPolicy !== "portable-optional/1" ||
         e.contextCanonicalization !== CONTEXT_CANONICALIZATION_VERSION ||
         typeof e.manifest !== "string" ||
         !/^[a-f0-9]{128}$/.test(e.manifest) ||
@@ -249,6 +252,7 @@ export function validateWorkspaceLockDoc(doc) {
         zyrk: {
             version: 1,
             resolver: ZYRK_RESOLVER_POLICY,
+            platformPolicy: "portable-optional/1",
             contextCanonicalization: CONTEXT_CANONICALIZATION_VERSION,
             manifest: "sha512-" + "A".repeat(86) + "==",
             scripts: "sha512-" + "A".repeat(86) + "==",
@@ -300,7 +304,7 @@ export function validateWorkspaceLockDoc(doc) {
     }
     return g;
 }
-export async function readWorkspaceLock(root, project, registryOrigin) {
+export async function readWorkspaceLock(root, project, registryOrigin, allowPlatformRefresh = false) {
     let text;
     try {
         text = await readFile(path.join(root, "package-lock.json"), "utf8");
@@ -317,6 +321,12 @@ export async function readWorkspaceLock(root, project, registryOrigin) {
     catch {
         throw lockMismatch("workspace lock is not valid JSON");
     }
+    if (allowPlatformRefresh &&
+        object(doc) &&
+        object(doc.zyrk) &&
+        doc.zyrk.version === 2 &&
+        doc.zyrk.platformPolicy === undefined)
+        return null;
     const graph = validateWorkspaceLockDoc(doc);
     if (project) {
         const expected = new Map(project.importers.map((i) => [i.id, i]));

package/dist/lockfile/fingerprints.js

@@ -72,7 +72,6 @@ export function configFingerprint(config) {
             : {}),
         linker: config.linker,
         ...(config.patches === undefined ? {} : { patches: config.patches }),
-        ...(config.platform === undefined ? {} : { platform: config.platform }),
         ...(config.mutablePackages === undefined
             ? {}
             : { mutablePackages: [...config.mutablePackages].sort() }),

package/dist/lockfile/read.d.ts

@@ -10,7 +10,7 @@ export type ReadLockResult = {
     path: string;
     doc: NpmLockDoc;
 };
-export declare function readLockfile(lockPath: string): Promise<ReadLockResult | null>;
+export declare function readLockfile(lockPath: string, allowPlatformRefresh?: boolean): Promise<ReadLockResult | null>;
 export declare function validateLockDoc(doc: unknown, label: string): NpmLockDoc;
 export type FrozenFingerprints = {
     manifest: string;

package/dist/lockfile/read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../src/lockfile/read.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,EAEL,KAAK,UAAU,EAEhB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,UAAU,CAAC;CACjB,CAAC;AAEF,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAyBhC;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CA2DvE;AA4CD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,kBAAkB,GAC3B,IAAI,CAmCN"}
+{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../src/lockfile/read.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,EAEL,KAAK,UAAU,EAEhB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,UAAU,CAAC;CACjB,CAAC;AAEF,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,oBAAoB,UAAQ,GAC3B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAmChC;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CA2DvE;AA4CD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,kBAAkB,GAC3B,IAAI,CAmCN"}

package/dist/lockfile/read.js

@@ -11,7 +11,7 @@ import { readFile } from "node:fs/promises";
 import { ZyrkError } from "../errors.js";
 import { isErrno, pathExists } from "../util/fsx.js";
 import { ZYRK_LOCK_EXTENSION_VERSION, } from "./types.js";
-export async function readLockfile(lockPath) {
+export async function readLockfile(lockPath, allowPlatformRefresh = false) {
     if (!(await pathExists(lockPath)))
         return null;
     let raw;
@@ -34,6 +34,16 @@ export async function readLockfile(lockPath) {
             cause: error,
         });
     }
+    if (allowPlatformRefresh && typeof parsed === "object" && parsed !== null) {
+        const extension = parsed.zyrk;
+        if (extension?.version === 1 && extension.platformPolicy === undefined) {
+            // Validate old metadata without treating a platform-pruned graph as portable.
+            const checked = structuredClone(parsed);
+            checked.zyrk.platformPolicy = "portable-optional/1";
+            validateLockDoc(checked, lockPath);
+            return { path: lockPath, doc: parsed };
+        }
+    }
     return { path: lockPath, doc: validateLockDoc(parsed, lockPath) };
 }
 export function validateLockDoc(doc, label) {

package/dist/lockfile/types.d.ts

@@ -15,6 +15,7 @@
  * manifest, policy, or configuration drift.
  */
 export declare const ZYRK_LOCK_EXTENSION_VERSION = 1;
+export declare const ZYRK_PLATFORM_POLICY = "portable-optional/1";
 /** npm package metadata, interpreted during exact-selection import. */
 export type NpmPackageEntry = Record<string, unknown>;
 export type NpmLockDoc = {

package/dist/lockfile/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/lockfile/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAE7C,uEAAuE;AACvE,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEtD,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,QAAQ,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC,CAAC;IACxD,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACrC,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,uBAAuB,EAAE,MAAM,CAAC;IAChC,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACpC,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,eAAO,MAAM,oBAAoB,mBAAmB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/lockfile/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAC7C,eAAO,MAAM,oBAAoB,wBAAwB,CAAC;AAE1D,uEAAuE;AACvE,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEtD,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,QAAQ,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC,CAAC;IACxD,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACrC,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,uBAAuB,EAAE,MAAM,CAAC;IAChC,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACpC,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,eAAO,MAAM,oBAAoB,mBAAmB,CAAC"}

package/dist/lockfile/types.js

@@ -15,4 +15,5 @@
  * manifest, policy, or configuration drift.
  */
 export const ZYRK_LOCK_EXTENSION_VERSION = 1;
+export const ZYRK_PLATFORM_POLICY = "portable-optional/1";
 export const ZYRK_RESOLVER_POLICY = "zyrk-resolve/1";

package/dist/lockfile/write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"write.d.ts","sourceRoot":"","sources":["../../src/lockfile/write.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGjE,OAAO,EAGL,KAAK,UAAU,EAGhB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC1D,QAAQ,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,mBAAmB,CAAC;IAChC,YAAY,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,eAAe,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;CACzB,CAAC;AAEF,wBAAsB,aAAa,CACjC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,UAAU,CAAC,CAoOrB"}
+{"version":3,"file":"write.d.ts","sourceRoot":"","sources":["../../src/lockfile/write.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGjE,OAAO,EAGL,KAAK,UAAU,EAGhB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC1D,QAAQ,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,mBAAmB,CAAC;IAChC,YAAY,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,eAAe,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;CACzB,CAAC;AAEF,wBAAsB,aAAa,CACjC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,UAAU,CAAC,CAqOrB"}

package/dist/lockfile/write.js

@@ -172,6 +172,7 @@ export async function writeLockfile(options) {
     const extension = {
         version: ZYRK_LOCK_EXTENSION_VERSION,
         resolver: ZYRK_RESOLVER_POLICY,
+        platformPolicy: "portable-optional/1",
         contextCanonicalization: CONTEXT_CANONICALIZATION_VERSION,
         manifest: options.fingerprints.manifest,
         scripts: options.fingerprints.scripts,

package/dist/resolve/resolver.d.ts

@@ -1,24 +1,3 @@
-/**
- * Registry-backed dependency resolver (SPEC 9).
- *
- * Turns requirement strings into an immutable resolved graph: exact name,
- * version, origin-qualified source identity, dependency edges, and peer
- * bindings. No package code runs here; no project files are touched.
- *
- * Scope of this slice: registry versions, ranges, tags, scoped names, and
- * npm aliases; prod and optional groups; required and optional peers with
- * explicit-consumer-context bindings; cycles; bundled subtrees (skipped,
- * never exposed). Dev groups need full packuments and arrive later, as do
- * overrides and workspace relationships. Platform omissions are reported
- * explicitly, and resource limits bound graph construction. Remote
- * tarballs, Git, and local sources fail explicitly (SPEC 9.2).
- *
- * Peer contexts (SPEC 9.3-9.4): one verified source may back several
- * dependency contexts. Occurrences that declare peers are instantiated per
- * requesting parent and keyed by a fingerprint of their resolved peer
- * closure, so identical bindings share one occurrence while differing
- * bindings stay distinct. Peerless occurrences share by name@version.
- */
 import { type Packument } from "../fetch/registry.ts";
 import { type OverridePolicy } from "./overrides.ts";
 export type MetadataProvider = {
@@ -70,6 +49,7 @@ export type ResolveOptions = {
     overrides?: OverridePolicy;
     limits?: Partial<ResolverLimits>;
     platform?: RuntimePlatform;
+    preservePlatformVariants?: boolean;
 };
 export type RuntimePlatform = {
     os: string;

package/dist/resolve/resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/resolve/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,EAEL,KAAK,SAAS,EAEf,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;AAEpD,MAAM,MAAM,YAAY,GAAG;IACzB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,YAAY,EAAE,KAAK,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC,CAAC;IACH,QAAQ,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACxE,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACzE,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,eAAe,IAAI,eAAe,CAcjD;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACjC,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,oDAAoD;IACpD,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD,CAAC;AAEF,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAmCzB"}
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/resolve/resolver.ts"],"names":[],"mappings":"AAyBA,OAAO,EAEL,KAAK,SAAS,EAEf,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;AAEpD,MAAM,MAAM,YAAY,GAAG;IACzB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,YAAY,EAAE,KAAK,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC,CAAC;IACH,QAAQ,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACxE,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACzE,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,eAAe,IAAI,eAAe,CAcjD;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACjC,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,oDAAoD;IACpD,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD,CAAC;AAEF,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAmCzB"}

package/dist/resolve/resolver.js

@@ -1,3 +1,4 @@
+import { normalizeEngineConstraints } from "../util/engines.js";
 /**
  * Registry-backed dependency resolver (SPEC 9).
  *
@@ -75,6 +76,7 @@ class ResolverState {
     occurrences = [];
     limits;
     platform;
+    preservePlatformVariants;
     omissions = [];
     expires;
     peerExpansions = 0;
@@ -93,6 +95,7 @@ class ResolverState {
             if (!Number.isSafeInteger(value) || value <= 0)
                 throw budgetError("invalid resolver limits");
         this.platform = options.platform ?? currentPlatform();
+        this.preservePlatformVariants = options.preservePlatformVariants === true;
         this.expires = Date.now() + this.limits.deadlineMs;
     }
     checkBudget(depth = 0, adding = false) {
@@ -104,6 +107,8 @@ class ResolverState {
             throw budgetError("resolved node limit exceeded");
     }
     checkPlatform(name, entry) {
+        if (this.preservePlatformVariants)
+            return;
         for (const [constraints, actual] of [
             [entry.os, this.platform.os],
             [entry.cpu, this.platform.cpu],
@@ -582,6 +587,13 @@ function assertMergeable(a, b, keys, origin) {
     }
 }
 function toResolved(occ, key, keys, origin) {
+    const engines = occ.entry.engines === undefined
+        ? undefined
+        : normalizeEngineConstraints(occ.entry.engines, () => {
+            throw new ZyrkError("ZYRK_RESOLUTION_FAILED", `Cannot resolve ${occ.name}: invalid engine constraints.`, {
+                remedy: "Select a package version with valid npm engine metadata.",
+            });
+        });
     const edgesByName = new Map();
     for (const link of occ.children) {
         const target = keys.get(link.child);
@@ -630,7 +642,7 @@ function toResolved(occ, key, keys, origin) {
             ...(occ.entry.cpu === undefined ? {} : { cpu: occ.entry.cpu }),
             ...(occ.entry.libc === undefined ? {} : { libc: occ.entry.libc }),
         },
-        ...(occ.entry.engines === undefined ? {} : { engines: occ.entry.engines }),
+        ...(engines === undefined ? {} : { engines }),
     };
 }
 function sourceIdForOccurrence(occ, origin) {

package/dist/resolve/spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../src/resolve/spec.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;AAElE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,eAAe,CAAC;IACtB,mDAAmD;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,UAAU,EAAE,OAAO,GAAG,OAAO,GAAG,KAAK,CAAC;CACvC,CAAC;AAcF;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,iBAAiB,CAqFnB"}
+{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../src/resolve/spec.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;AAElE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,eAAe,CAAC;IACtB,mDAAmD;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,UAAU,EAAE,OAAO,GAAG,OAAO,GAAG,KAAK,CAAC;CACvC,CAAC;AAcF;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,iBAAiB,CA6FnB"}

package/dist/resolve/spec.js

@@ -7,6 +7,7 @@
  * explicitly — they are never handed to a tool that might run scripts.
  */
 import npa from "npm-package-arg";
+import { SemVer } from "semver";
 import { ZyrkError } from "../errors.js";
 function unsupported(what, spec) {
     return new ZyrkError("ZYRK_RESOLUTION_FAILED", `unsupported dependency protocol in "${spec}" (${what})`, {
@@ -46,7 +47,13 @@ export function parseRequirement(edgeName, spec) {
                 edgeName,
                 realName: parsed.name,
                 kind: "exact",
-                targetSpec: parsed.fetchSpec,
+                // npm accepts = and v prefixes for exact versions. SemVer.format()
+                // omits build metadata, so append it explicitly for registry lookup.
+                targetSpec: (() => {
+                    const version = new SemVer(parsed.fetchSpec.replace(/^[=v\s]+/, ""));
+                    return (version.version +
+                        (version.build.length ? `+${version.build.join(".")}` : ""));
+                })(),
                 targetKind: "exact",
             };
         }

package/dist/util/engines.d.ts

@@ -0,0 +1,2 @@
+export declare function normalizeEngineConstraints(value: unknown, invalid: () => never): Record<string, string>;
+//# sourceMappingURL=engines.d.ts.map

package/dist/util/engines.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engines.d.ts","sourceRoot":"","sources":["../../src/util/engines.ts"],"names":[],"mappings":"AAGA,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,MAAM,KAAK,GACnB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAyBxB"}

package/dist/util/engines.js

@@ -0,0 +1,23 @@
+/** Normalize npm's historical engine arrays without weakening modern map checks. */
+import { validRange } from "semver";
+export function normalizeEngineConstraints(value, invalid) {
+    if (Array.isArray(value)) {
+        const engines = {};
+        for (const item of value) {
+            const match = typeof item === "string"
+                ? /^([a-z][a-z0-9._-]*)\s+(.+)$/.exec(item)
+                : null;
+            if (!match ||
+                Object.hasOwn(engines, match[1]) ||
+                validRange(match[2]) === null)
+                return invalid();
+            engines[match[1]] = match[2];
+        }
+        return engines;
+    }
+    if (typeof value !== "object" ||
+        value === null ||
+        Object.values(value).some((item) => typeof item !== "string"))
+        return invalid();
+    return value;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zyrk",
-  "version": "0.5.3",
+  "version": "0.5.5",
   "description": "Storage-efficient Node package manager: one verified store per user, shared across projects through links.",
   "license": "MIT",
   "type": "module",