zyrk 0.5.4 → 0.5.6

package/README.md

@@ -122,7 +122,10 @@ registry; private names never fall back to a public endpoint. Disabled TLS
 verification is rejected before lookup. Git sources and non-workspace local sources remain unsupported;
 they fail explicitly. Optional dependencies incompatible with the selected platform
 are omitted; missing packages, integrity failures, and other optional failures
-remain errors. Platform selection is recorded in the lock. macOS, Windows, and
+remain errors. Locks retain exact platform-qualified optional variants; each machine
+selects its compatible local closure without rewriting the lock or recording store
+paths. Older platform-pruned locks need an intentional non-frozen refresh; incomplete
+npm locks must be freshly resolved before portable adoption. macOS, Windows, and
 broad framework compatibility have not passed their release gates.
 
 ### Workspaces
@@ -164,9 +167,29 @@ JavaScript, shell, or native executable bin entry with the supplied arguments. I
 removed afterward; verified sources and shared realizations remain in the
 store.
 
-`create` uses the same execution path and maps initializer names to their
-`create-*` packages. For example, `vite` maps to `create-vite`, while a scoped
-initializer stays in its scope. Compatibility depends on the selected tool:
+`create` maps initializer names to their `create-*` packages. For example,
+`vite` maps to `create-vite`, while a scoped initializer stays in its scope.
+Initializers run from an independent writable private closure so copied templates
+can be edited without modifying verified store files. The temporary closure is
+removed afterward; generic `dlx` tools continue to use immutable shared files.
+
+For `create next-app`, the native adapter accepts resolved create-next-app
+15.x and 16.x releases, whose official CLI provides `--skip-install`; the real
+scaffold check covers 16.4.2. Other versions fail before execution. zyrk passes the official `--skip-install` flag to
+create-next-app, validates the generated project manifest, then installs its
+dependencies through zyrk using the same store and registry configuration. An
+explicit `--skip-install` leaves the generated project uninstalled. The official
+flag can select create-next-app's configuration defaults instead of prompting
+for each choice; pass its explicit configuration flags to customize them. Its
+interactive project-name prompt remains available. Supply an explicit target
+for nested or existing empty directories; automatic interactive discovery is
+limited to one newly created direct child directory. If generation exits without
+a valid manifest, zyrk reports failure and retains any generated files for review.
+
+Other initializers control their own dependency-install step and may invoke
+another package manager. Use their skip-install option, when available, then run
+`zyrk install` in the generated project to keep installation native to zyrk.
+Compatibility depends on the selected tool:
 closures declaring install lifecycle scripts, implicit native builds, or bundled
 install hooks are blocked. Dependency executables are available on the tool
 PATH. Parent cancellation terminates the supervised process group with bounded

package/VERSION

@@ -1 +1 @@
-v0.5.4
+v0.5.6

package/dist/cli/main.js

@@ -13,7 +13,7 @@ import { installRegistry } from "../install/registry.js";
 import { readFileSync } from "node:fs";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
-import { runCreate } from "../dlx/create.js";
+import { runCreate, starterSpecFor } from "../dlx/create.js";
 import { runDlx } from "../dlx/run.js";
 import { runDependencyCommand, } from "../commands/dependencies.js";
 import { runProjectCommand, } from "../commands/project.js";
@@ -610,5 +610,21 @@ async function runToolCommand(command, parsed, options, version) {
     if (command === "dlx") {
         return (await runDlx({ ...base, spec: first })).exitCode;
     }
-    return (await runCreate({ ...base, input: first })).exitCode;
+    const isNext = starterSpecFor(first).startsWith("create-next-app@");
+    options.stderr.write(isNext
+        ? tail.includes("--skip-install")
+            ? "zyrk: Next scaffolding only; dependency installation was explicitly skipped.\n"
+            : "zyrk: Next scaffolder runs with --skip-install; zyrk will install dependencies.\n"
+        : "zyrk: This initializer controls its own dependency installation.\n");
+    const progress = createInstallProgress(options.stderr, false);
+    try {
+        return (await runCreate({
+            ...base,
+            input: first,
+            onInstallProgress: progress.update,
+        })).exitCode;
+    }
+    finally {
+        progress.close();
+    }
 }

package/dist/dlx/create.d.ts

@@ -5,13 +5,16 @@
  * `init` command): `foo` runs `create-foo`, `@scope/bar` runs
  * `@scope/create-bar`, and a bare `@scope` runs `@scope/create`, each with
  * the requested version or `*` when none was given. An already-prefixed
- * `create-foo` is used as-is. Execution is the dlx flow, so temporary
- * environments, trust policy, and cleanup all behave identically.
+ * `create-foo` is used as-is. Initializers use writable private temporary
+ * closures; trust policy and cleanup match dlx. The Next adapter installs
+ * generated dependencies natively after the initializer's skip-install step.
  */
+import type { InstallOptions } from "../install/run.ts";
 import { type DlxOptions, type DlxResult } from "./run.ts";
 export type CreateOptions = Omit<DlxOptions, "spec"> & {
     /** Initializer as typed: `next-app`, `vite@^5`, `@scope`, `@scope/kit@beta`. */
     input: string;
+    onInstallProgress?: InstallOptions["onProgress"];
 };
 /**
  * Map an initializer to its starter package specifier. Throws ZYRK_USAGE

package/dist/dlx/create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../src/dlx/create.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAU,KAAK,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAEnE,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG;IACrD,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CA6BpD;AAWD,wBAAsB,SAAS,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,CAG1E"}
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../src/dlx/create.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,EAAkB,KAAK,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAE3E,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG;IACrD,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC;CAClD,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CA6BpD;AAWD,wBAAsB,SAAS,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,CAM1E"}

package/dist/dlx/create.js

@@ -5,12 +5,14 @@
  * `init` command): `foo` runs `create-foo`, `@scope/bar` runs
  * `@scope/create-bar`, and a bare `@scope` runs `@scope/create`, each with
  * the requested version or `*` when none was given. An already-prefixed
- * `create-foo` is used as-is. Execution is the dlx flow, so temporary
- * environments, trust policy, and cleanup all behave identically.
+ * `create-foo` is used as-is. Initializers use writable private temporary
+ * closures; trust policy and cleanup match dlx. The Next adapter installs
+ * generated dependencies natively after the initializer's skip-install step.
  */
+import { runNextInitializer } from "./next.js";
 import npa from "npm-package-arg";
 import { ZyrkError } from "../errors.js";
-import { runDlx } from "./run.js";
+import { runInitializer } from "./run.js";
 /**
  * Map an initializer to its starter package specifier. Throws ZYRK_USAGE
  * for non-registry inputs (Git/hosted initializers are deferred along with
@@ -55,5 +57,8 @@ function usage(input, cause) {
 }
 export async function runCreate(options) {
     const { input, ...rest } = options;
-    return runDlx({ ...rest, spec: starterSpecFor(input) });
+    const spec = starterSpecFor(input);
+    return spec.startsWith("create-next-app@")
+        ? runNextInitializer({ ...rest, spec })
+        : runInitializer({ ...rest, spec });
 }

package/dist/dlx/next.d.ts

@@ -0,0 +1,7 @@
+import { type InstallOptions } from "../install/run.ts";
+import { type DlxOptions, type DlxResult } from "./run.ts";
+export declare function nextTarget(args: readonly string[]): string | undefined;
+export declare function runNextInitializer(options: DlxOptions & {
+    onInstallProgress?: InstallOptions["onProgress"];
+}): Promise<DlxResult>;
+//# sourceMappingURL=next.d.ts.map

package/dist/dlx/next.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"next.d.ts","sourceRoot":"","sources":["../../src/dlx/next.ts"],"names":[],"mappings":"AAQA,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExE,OAAO,EAAkB,KAAK,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAuC3E,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAEtE;AA4CD,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,UAAU,GAAG;IAAE,iBAAiB,CAAC,EAAE,cAAc,CAAC,YAAY,CAAC,CAAA;CAAE,GACzE,OAAO,CAAC,SAAS,CAAC,CAkGpB"}

package/dist/dlx/next.js

@@ -0,0 +1,164 @@
+/** create-next-app's documented --skip-install keeps installation native.
+ * Target validation prevents a successful-but-aborted initializer from making
+ * zyrk install an unrelated project. No generated files are deleted on failure.
+ */
+import { lstat, readFile, readdir } from "node:fs/promises";
+import * as path from "node:path";
+import { satisfies } from "semver";
+import { ZyrkError } from "../errors.js";
+import { installProject } from "../install/run.js";
+import { isErrno } from "../util/fsx.js";
+import { runInitializer } from "./run.js";
+function failed(message) {
+    return new ZyrkError("ZYRK_RESOLUTION_FAILED", message, {
+        remedy: "Check the generated project, then run zyrk install there; rerun create with an explicit project directory when needed.",
+    });
+}
+/** Value-bearing options from the official create-next-app CLI. All original
+ * arguments are still forwarded verbatim; these only locate the target. */
+function parseNextArgs(args) {
+    const values = new Set([
+        "--import-alias",
+        "--example",
+        "-e",
+        "--example-path",
+    ]);
+    const flags = new Set();
+    let target;
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === "--") {
+            target ??= args[i + 1]?.trim();
+            break;
+        }
+        if (values.has(arg)) {
+            i++;
+            continue;
+        }
+        if (arg.startsWith("-"))
+            flags.add(arg);
+        else
+            target ??= arg.trim();
+    }
+    return { target, flags };
+}
+export function nextTarget(args) {
+    return parseNextArgs(args).target;
+}
+async function info(file) {
+    try {
+        return await lstat(file);
+    }
+    catch (cause) {
+        if (isErrno(cause, "ENOENT"))
+            return undefined;
+        throw cause;
+    }
+}
+async function manifestExists(directory) {
+    return (await info(path.join(directory, "package.json"))) !== undefined;
+}
+async function verifyManifest(directory) {
+    const file = path.join(directory, "package.json");
+    const entry = await info(file);
+    if (!entry?.isFile() || entry.isSymbolicLink())
+        throw failed("Next initializer did not generate a regular project manifest.");
+    let raw;
+    try {
+        raw = JSON.parse(await readFile(file, "utf8"));
+    }
+    catch {
+        throw failed("Next initializer generated an unreadable project manifest.");
+    }
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+        throw failed("Next initializer generated an invalid project manifest.");
+    const manifest = raw;
+    const deps = manifest.dependencies;
+    if (typeof manifest.name !== "string" ||
+        !manifest.name ||
+        typeof deps !== "object" ||
+        deps === null ||
+        Array.isArray(deps) ||
+        typeof deps.next !== "string" ||
+        !deps.next)
+        throw failed("Next initializer did not generate a Next project manifest.");
+}
+export async function runNextInitializer(options) {
+    const args = options.args ?? [];
+    const { target, flags } = parseNextArgs(args);
+    // Help/version/reset are valid successful commands that generate no app.
+    if ([...flags].some((arg) => [
+        "--help",
+        "-h",
+        "--version",
+        "-v",
+        "--reset",
+        "--reset-preferences",
+    ].includes(arg)))
+        return runInitializer(options);
+    const cwd = options.cwd ?? process.cwd();
+    const explicit = target === undefined ? undefined : path.resolve(cwd, target);
+    const before = explicit === undefined ? undefined : await info(explicit);
+    if (before !== undefined &&
+        (!before.isDirectory() || before.isSymbolicLink()))
+        throw failed("Next initializer target must be a real project directory.");
+    if (explicit !== undefined && (await manifestExists(explicit)))
+        throw failed("Next initializer target already has a project manifest.");
+    const entries = explicit === undefined ? new Set(await readdir(cwd)) : undefined;
+    const skipInstall = flags.has("--skip-install");
+    // Insert before -- so it remains an option when the user supplies a literal target.
+    const forwarded = [...args];
+    if (!skipInstall) {
+        const separator = forwarded.indexOf("--");
+        forwarded.splice(separator < 0 ? forwarded.length : separator, 0, "--skip-install");
+    }
+    const result = await runInitializer({
+        ...options,
+        args: forwarded,
+        validateTool(tool) {
+            options.validateTool?.(tool);
+            if (!satisfies(tool.version, ">=15.0.0 <17.0.0"))
+                throw new ZyrkError("ZYRK_RESOLUTION_FAILED", "The resolved Next initializer version has no verified skip-install adapter.", {
+                    detail: { name: tool.name, version: tool.version },
+                    remedy: "Select create-next-app 15.x or 16.x; the native create adapter requires the verified --skip-install contract.",
+                });
+        },
+    });
+    if (result.exitCode !== 0)
+        return result;
+    let directory = explicit;
+    if (directory === undefined) {
+        const generated = [];
+        for (const entry of await readdir(cwd)) {
+            if (entries.has(entry))
+                continue;
+            const candidate = path.join(cwd, entry);
+            const current = await info(candidate);
+            if (current?.isDirectory() &&
+                !current.isSymbolicLink() &&
+                (await manifestExists(candidate)))
+                generated.push(candidate);
+        }
+        if (generated.length !== 1)
+            throw failed("Cannot identify one generated Next project after the initializer exited.");
+        directory = generated[0];
+    }
+    const after = await info(directory);
+    if (!after?.isDirectory() ||
+        after.isSymbolicLink() ||
+        (before !== undefined &&
+            (before.dev !== after.dev || before.ino !== after.ino)))
+        throw failed("Next initializer did not preserve its project directory.");
+    await verifyManifest(directory);
+    if (!skipInstall)
+        await installProject({
+            projectDir: directory,
+            store: options.store,
+            registry: options.registry,
+            ...(options.env === undefined ? {} : { env: options.env }),
+            ...(options.onInstallProgress === undefined
+                ? {}
+                : { onProgress: options.onInstallProgress }),
+        });
+    return result;
+}

package/dist/dlx/run.d.ts

@@ -31,13 +31,18 @@ export type DlxOptions = {
     /** Capture stdio instead of inheriting it (used by tests). */
     capture?: boolean;
     logger?: Logger;
+    /** Adapter contract checked against the exact resolved tool before execution. */
+    validateTool?: (tool: {
+        name: string;
+        version: string;
+    }) => void;
 };
 export type DlxResult = {
     exitCode: number;
     key: string;
     name: string;
     version: string;
-    /** True when every needed realization already existed. */
+    /** True when every needed shared realization already existed. */
     reused: boolean;
     stdout: string;
     stderr: string;
@@ -50,4 +55,7 @@ export declare function splitDlxSpec(spec: string): {
     versionSpec: string;
 };
 export declare function runDlx(options: DlxOptions): Promise<DlxResult>;
+/** Initializers copy and rewrite their shipped templates, so their full
+ * closure must use independent writable files (I-001, I-002, F-017). */
+export declare function runInitializer(options: DlxOptions): Promise<DlxResult>;
 //# sourceMappingURL=run.d.ts.map

package/dist/dlx/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/dlx/run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAgBH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAGxC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAchD,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,mEAAmE;IACnE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8DAA8D;IAC9D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,kEAAkE;AAClE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB,CAqBA;AAED,wBAAsB,MAAM,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAwMpE"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/dlx/run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAgBH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAGxC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAgBhD,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,mEAAmE;IACnE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8DAA8D;IAC9D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CAClE,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,kEAAkE;AAClE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB,CAqBA;AAED,wBAAsB,MAAM,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAEpE;AAED;wEACwE;AACxE,wBAAsB,cAAc,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAE5E"}

package/dist/dlx/run.js

@@ -29,6 +29,8 @@ import { currentProcessIdentity, superviseChild } from "../util/proc.js";
 import { acquireLock } from "../util/locks.js";
 import { registerGeneration } from "../install/metadata.js";
 import { openStoreDb } from "../store/db.js";
+import { installBudgets } from "../install/budgets.js";
+import { materializePrivate } from "../install/private.js";
 import { randomId } from "../util/ids.js";
 /** Split a tool specifier into its edge name and version part. */
 export function splitDlxSpec(spec) {
@@ -53,6 +55,14 @@ export function splitDlxSpec(spec) {
     return { name: parsed.name, versionSpec: spec.slice(parsed.name.length + 1) };
 }
 export async function runDlx(options) {
+    return runTemporaryTool(options, false);
+}
+/** Initializers copy and rewrite their shipped templates, so their full
+ * closure must use independent writable files (I-001, I-002, F-017). */
+export async function runInitializer(options) {
+    return runTemporaryTool(options, true);
+}
+async function runTemporaryTool(options, writable) {
     const { store, registry } = options;
     const args = options.args ?? [];
     const cwd = options.cwd ?? process.cwd();
@@ -60,6 +70,7 @@ export async function runDlx(options) {
     const split = splitDlxSpec(options.spec);
     const resolved = await resolveRequirements({
         provider: registry,
+        limits: installBudgets(env).resolveBudget,
         requirements: [{ name: split.name, spec: split.versionSpec }],
     });
     const root = resolved.roots.find((entry) => entry.name === split.name);
@@ -69,10 +80,12 @@ export async function runDlx(options) {
     const tool = byKey.get(root.target);
     if (tool === undefined)
         throw internal(`resolution lost node ${root.target}`);
+    options.validateTool?.({ name: tool.name, version: tool.version });
     // Retain the publication/GC barrier until the child and temporary projection
     // are gone. The durable lease additionally protects recovery after a crash.
     const barrier = await acquireLock(path.join(store.paths.locksDir, "liveness.lock"), { name: "temporary tool liveness" });
     let txn;
+    let envDir;
     try {
         txn = await Transaction.begin(store, "dlx");
         await txn.setState("fetching");
@@ -109,17 +122,27 @@ export async function runDlx(options) {
                 target: edge.target,
             })),
         })));
-        const realized = await realizeGraph({
+        const sharedRealized = await realizeGraph({
             store,
             graph,
             ...(options.logger === undefined ? {} : { logger: options.logger }),
         });
         await txn.setState("realizations-ready");
+        await assertNoInstallScripts(sharedRealized.packageDirByKey, byKey);
+        envDir = await mkdtemp(path.join(os.tmpdir(), "zyrk-dlx-"));
+        const generationId = randomId("gen1_");
+        const realized = writable
+            ? await materializePrivate({
+                project: envDir,
+                store,
+                graph,
+                generationId,
+            })
+            : sharedRealized;
         const toolRealization = realized.realizationDirByKey.get(tool.key);
         if (toolRealization === undefined)
             throw internal(`missing realization for ${tool.key}`);
         const toolPkgDir = packageDirIn(toolRealization, tool.name);
-        await assertNoInstallScripts(realized.packageDirByKey, byKey);
         const binKey = selectBin(tool, options.binName);
         const binTarget = tool.bin[binKey];
         if (binTarget === undefined)
@@ -139,8 +162,6 @@ export async function runDlx(options) {
                     bins[name] = await resolveBinScript(directory, dependency, name, target);
             }
         }
-        const envDir = await mkdtemp(path.join(os.tmpdir(), "zyrk-dlx-"));
-        const generationId = randomId("gen1_");
         const projectId = randomId("proj1_");
         const leaseId = randomId("lease1_");
         let registered = false;
@@ -152,6 +173,7 @@ export async function runDlx(options) {
                 generationId,
                 graph,
                 realized,
+                sharedRealized,
                 roots: [tool.key],
                 readiness: "ready",
             });
@@ -185,7 +207,7 @@ export async function runDlx(options) {
                 key: tool.key,
                 name: tool.name,
                 version: tool.version,
-                reused: realized.created.length === 0,
+                reused: sharedRealized.created.length === 0,
                 envDir,
             };
         }
@@ -206,6 +228,8 @@ export async function runDlx(options) {
     }
     finally {
         try {
+            if (envDir !== undefined)
+                await rmrfNoFollow(envDir);
             await txn?.finish();
         }
         finally {

package/dist/install/import-npm-workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"import-npm-workspace.d.ts","sourceRoot":"","sources":["../../src/install/import-npm-workspace.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAQvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,sBAAsB,CAAC;AA0V9B,oEAAoE;AACpE,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,GAC1C,cAAc,CAWhB"}
+{"version":3,"file":"import-npm-workspace.d.ts","sourceRoot":"","sources":["../../src/install/import-npm-workspace.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAOvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,sBAAsB,CAAC;AA6V9B,oEAAoE;AACpE,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,GAC1C,cAAc,CAWhB"}

package/dist/install/import-npm-workspace.js

@@ -8,7 +8,6 @@ import { canonicalJson } from "../util/json.js";
 import { importNpmLock } from "./import-npm.js";
 import { lockMismatch, cleanUrl } from "./lock.js";
 import { ZyrkError } from "../errors.js";
-import { assertWorkspacePlatform } from "./workspace-graph.js";
 function importNpmWorkspaceLockPass(doc, project, origin, overrideState) {
     if (!doc ||
         typeof doc !== "object" ||
@@ -173,7 +172,6 @@ function importNpmWorkspaceLockPass(doc, project, origin, overrideState) {
                 peers: {},
                 optionalPeers: [],
             };
-            assertWorkspacePlatform({ nodes: [node], importers: {}, omissions: [] });
             graph.nodes.push(node);
             locations.set(contextKey, node);
             contexts.set(node.key, selectedOverride.context);
@@ -230,7 +228,7 @@ function importNpmWorkspaceLockPass(doc, project, origin, overrideState) {
                     continue;
                 }
                 if (requirement.kind === "optional")
-                    continue;
+                    throw lockMismatch("npm workspace lock lacks an exact optional selection; restore a complete npm lock or intentionally resolve fresh without the pruned lock");
                 throw lockMismatch("npm workspace lock is missing a required selection");
             }
             let target;

package/dist/install/import-npm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"import-npm.d.ts","sourceRoot":"","sources":["../../src/install/import-npm.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,wBAAwB,CAAC;AAKhC,wBAAgB,aAAa,CAC3B,GAAG,EAAE,UAAU,EACf,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,EAC3C,SAAS,GAAE,cAAwC,GAClD,cAAc,CAyMhB"}
+{"version":3,"file":"import-npm.d.ts","sourceRoot":"","sources":["../../src/install/import-npm.ts"],"names":[],"mappings":"AACA,qFAAqF;AACrF,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,wBAAwB,CAAC;AAKhC,wBAAgB,aAAa,CAC3B,GAAG,EAAE,UAAU,EACf,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,EAC3C,SAAS,GAAE,cAAwC,GAClD,cAAc,CAkLhB"}

package/dist/install/import-npm.js

@@ -1,8 +1,9 @@
+import { normalizeEngineConstraints } from "../util/engines.js";
 /** Adopt npm v2/v3 exact selections without asking the registry to pick versions. */
 import { createRootOverrides, } from "../resolve/overrides.js";
 import { validateLockDoc } from "../lockfile/read.js";
 import { canonicalStrongSri } from "../util/integrity.js";
-import { valid, validRange, satisfies } from "semver";
+import { valid, satisfies } from "semver";
 import { parseRequirement } from "../resolve/spec.js";
 import { sourceIdOf, sha512Hex } from "../util/hash.js";
 import { cleanUrl, lockMismatch, packageName } from "./lock.js";
@@ -75,30 +76,10 @@ export function importNpmLock(doc, requirements, origin, overrides = createRootO
             edges: [],
             peerBindings: [],
         };
-        if (entry.engines !== undefined) {
-            if (Array.isArray(entry.engines)) {
-                // Old npm manifests used ["node >= 0.2.0"] instead of an engine map.
-                const engines = {};
-                for (const value of entry.engines) {
-                    const match = typeof value === "string"
-                        ? /^([a-z][a-z0-9._-]*)\s+(.+)$/.exec(value)
-                        : null;
-                    if (!match ||
-                        Object.hasOwn(engines, match[1]) ||
-                        validRange(match[2]) === null)
-                        throw lockMismatch("invalid npm engine constraint");
-                    engines[match[1]] = match[2];
-                }
-                node.engines = engines;
-            }
-            else {
-                if (typeof entry.engines !== "object" ||
-                    entry.engines === null ||
-                    Object.values(entry.engines).some((value) => typeof value !== "string"))
-                    throw lockMismatch("invalid npm engine constraint");
-                node.engines = entry.engines;
-            }
-        }
+        if (entry.engines !== undefined)
+            node.engines = normalizeEngineConstraints(entry.engines, () => {
+                throw lockMismatch("invalid npm engine constraint");
+            });
         if (typeof entry.bin === "object" &&
             entry.bin !== null &&
             !Array.isArray(entry.bin)) {
@@ -141,11 +122,12 @@ export function importNpmLock(doc, requirements, origin, overrides = createRootO
             const meta = entry.peerDependenciesMeta;
             const optionalPeer = requirement.kind === "peer" && meta?.[dep]?.optional === true;
             if (!targetLocation) {
-                if (requirement.kind === "optional" || optionalPeer) {
-                    if (optionalPeer)
-                        node.peerBindings.push({ name: dep, target: null, optional: true });
+                if (optionalPeer) {
+                    node.peerBindings.push({ name: dep, target: null, optional: true });
                     continue;
                 }
+                if (requirement.kind === "optional")
+                    throw lockMismatch("npm lock lacks an exact optional selection; restore a complete npm lock or intentionally resolve fresh without the pruned lock");
                 throw lockMismatch("npm lock is missing a required dependency");
             }
             const target = load(targetLocation, dep, requirement.spec, selected.context);

package/dist/install/lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../../src/install/lock.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAKvD,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,wBAAwB,CAAC;AAKhC,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMjD;AACD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAa/C;AACD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CASnD;AAID,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,cAAc,CA6M3D;AAUD,kFAAkF;AAClF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAK,GAAG,IAAI,CAM3E"}
+{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../../src/install/lock.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAKvD,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,wBAAwB,CAAC;AAKhC,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMjD;AACD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAa/C;AACD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CASnD;AAID,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,cAAc,CA+M3D;AAYD,kFAAkF;AAClF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAK,GAAG,IAAI,CAM3E"}

package/dist/install/lock.js

@@ -39,6 +39,7 @@ export function lockedGraph(doc) {
         Object.keys(ext).some((key) => ![
             "version",
             "resolver",
+            "platformPolicy",
             "contextCanonicalization",
             "manifest",
             "scripts",
@@ -48,6 +49,7 @@ export function lockedGraph(doc) {
         ].includes(key)) ||
         ![ext.manifest, ext.scripts, ext.config].every((value) => typeof value === "string" && /^sha512-[A-Za-z0-9+/]{86}==$/.test(value)) ||
         ext.resolver !== ZYRK_RESOLVER_POLICY ||
+        ext.platformPolicy !== "portable-optional/1" ||
         ext.contextCanonicalization !== CONTEXT_CANONICALIZATION_VERSION ||
         !record(ext.nodes) ||
         !record(ext.roots) ||
@@ -180,7 +182,7 @@ export function lockedGraph(doc) {
             sourceId: raw.source,
             tarballUrl: raw.tarball,
             bin,
-            engines,
+            ...(raw.engines === undefined ? {} : { engines }),
             platform,
             edges,
             peerBindings: peers,
@@ -204,11 +206,11 @@ export function lockedGraph(doc) {
 // npm publishes this canonical GitHub sponsorship link in funding metadata.
 // Keep source/archive URL validation query-free, and allow no other query here.
 function githubFundingUrl(value) {
-    return /^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\?sponsor=1$/.test(value);
+    return (/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\?sponsor=1$/.test(value) && new URL(value).href === value);
 }
 /** Preserved metadata is subject to the same portability boundary as new data. */
 export function assertPortableLockMetadata(value, field = "") {
-    visitPortableLockMetadata(value, field, field === "funding" ? "entry" : undefined);
+    visitPortableLockMetadata(value, field, field === "funding" ? "funding" : undefined);
 }
 function visitPortableLockMetadata(value, field, funding) {
     if (typeof value === "string") {
@@ -222,7 +224,7 @@ function visitPortableLockMetadata(value, field, funding) {
     }
     if (Array.isArray(value)) {
         for (const item of value)
-            visitPortableLockMetadata(item, field, funding === "entry" ? "entry" : undefined);
+            visitPortableLockMetadata(item, field, funding === "funding" ? "entry" : undefined);
         return;
     }
     if (value && typeof value === "object")
@@ -245,8 +247,8 @@ function visitPortableLockMetadata(value, field, funding) {
                 ].includes(field))
                 throw lockMismatch("portable metadata contains a credential field");
             visitPortableLockMetadata(item, key, key === "funding"
-                ? "entry"
-                : funding === "entry" && key === "url"
+                ? "funding"
+                : (funding === "funding" || funding === "entry") && key === "url"
                     ? "url"
                     : undefined);
         }

package/dist/install/platform.d.ts

@@ -0,0 +1,5 @@
+import { type RuntimePlatform, type FinalizedGraph } from "../resolve/resolver.ts";
+import type { WorkspaceGraph } from "./workspace-graph.ts";
+export declare function selectPlatformGraph(graph: FinalizedGraph, optionalRoots: ReadonlySet<string>, platform?: RuntimePlatform): FinalizedGraph;
+export declare function selectWorkspacePlatform(graph: WorkspaceGraph, platform?: RuntimePlatform): WorkspaceGraph;
+//# sourceMappingURL=platform.d.ts.map

package/dist/install/platform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/install/platform.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAuG3D,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,cAAc,EACrB,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,EAClC,QAAQ,kBAAoB,GAC3B,cAAc,CAqBhB;AACD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,cAAc,EACrB,QAAQ,kBAAoB,GAC3B,cAAc,CAsBhB"}