zyrk 0.6.5 → 0.6.7

package/README.md

@@ -27,6 +27,14 @@ the shared store, exact dependency context, mutation rules, and cleanup contract
 central to its design. Storage savings, speed, and framework compatibility will
 be reported only after reproducible measurements and compatibility tests.
 
+### The name and the idea
+
+The project began as **snpm**, short for “space-efficient npm.” That name was
+already in use, so it became **nexu**; npm's package-name similarity policy
+then blocked publishing that name, and the project became **zyrk**. The names
+changed, while the goal stayed the same: make shared package storage practical,
+careful, and useful in everyday Node.js development.
+
 ## Try the current CLI
 
 Install from npm:
@@ -46,11 +54,17 @@ From a checkout:
 ```bash
 git clone https://github.com/kingjethro999/zyrk.git zyrk
 cd zyrk
-npm ci
-node bin/zyrk.js --help
-node bin/zyrk.js --version
+npm install --global zyrk@0.6.6
+zyrk install --frozen-lockfile
+zyrk --help
+zyrk --version
 ```
 
+The global npm install bootstraps the `zyrk` executable. Project dependencies
+are installed by zyrk itself. On a fresh checkout, use the published bootstrap
+version first because the source checkout's own development dependencies are
+needed to run its local CLI.
+
 ### One-line install (shell)
 
 Linux / macOS:
@@ -194,9 +208,13 @@ limited to one newly created direct child directory. If generation exits without
 a valid manifest, zyrk reports failure and retains any generated files for review.
 
 For Next.js 16.4.2 with dependencies in the external shared store, use
-`zyrk run dev -- --webpack` and `zyrk run build -- --webpack`. Strict-root
-Turbopack rejects that layout. The [Next compatibility report](docs/next-compatibility.md)
-records the tested scaffold, native install, build and HTTP runtime.
+`zyrk run dev -- --webpack` and `zyrk run build -- --webpack`, or explicitly opt
+into Turbopack with `zyrk next --turbopack` before normal `zyrk run dev` / build.
+The [Turbopack guide](docs/next-turbopack.md) explains the experimental additional
+roots, preserved configuration, portable local-state lookup, and deployment
+boundary. The [Next compatibility report](docs/next-compatibility.md) records
+the tested scaffold, native install, build and HTTP runtime. These checks cover
+Linux x64; they do not establish universal framework or device support.
 
 Other initializers control their own dependency-install step and may invoke
 another package manager. Use their skip-install option, when available, then run
@@ -355,15 +373,25 @@ own options and configuration.
 ## Develop and contribute
 
 ```bash
-npm ci
-npm run setup:hooks
-npm run typecheck
-npm test
-npm run check
-npm run format:check
-npm run format
+npm install --global zyrk@0.6.6  # bootstrap the CLI, once per machine
+zyrk install --frozen-lockfile
+zyrk run setup:hooks
+zyrk run typecheck
+zyrk run test
+zyrk run check
+zyrk run format:check
+zyrk run format
 ```
 
+Linux and macOS development, CI, and release verification use zyrk to install
+the repository's dependencies. The Windows contract job continues to use npm
+while native Windows filesystem and link behavior is being validated. npm is
+also used to publish the package; that is a registry operation, not a project
+dependency install. Vercel deployments should set the install command to
+the commands in [web/vercel.json](web/vercel.json) and set the Vercel project
+root directory to `web/`. The included site uses zyrk for project dependencies
+after npm bootstraps the CLI.
+
 The commit hook runs the full check gate, increments the version in
 `package.json`, `package-lock.json`, and `VERSION`, and creates a matching version
 tag after the commit. Keep changes focused and never bypass the hooks.
@@ -408,10 +436,29 @@ lists each unique package/version linked after the project transaction commits.
 Source counts differ from dependency contexts when peers split a package.
 `--json` disables progress.
 
-Install resolution has a five-minute deadline; each archive extraction has a
-two-minute deadline. Set `ZYRK_RESOLVE_TIMEOUT_MS` or `ZYRK_EXTRACT_TIMEOUT_MS`
-to an integer from `1` to `900000` milliseconds to adjust these timeouts.
-Graph, archive-entry, and byte limits still apply.
+Install resolution has a five-minute deadline, registry requests (including
+archive downloads) have a fifteen-minute deadline, a complete fetch operation
+has a fifteen-minute deadline, and each archive extraction has a two-minute
+deadline. On a slow or unreliable connection, increase the request and complete
+fetch deadlines together. For example, this gives a single request up to 30
+minutes and the entire fetch phase up to 45 minutes:
+
+```bash
+ZYRK_REQUEST_TIMEOUT_MS=1800000 ZYRK_FETCH_TIMEOUT_MS=2700000 zyrk install
+```
+
+To keep the settings for future commands in the current shell, use
+`export ZYRK_REQUEST_TIMEOUT_MS=1800000` and
+`export ZYRK_FETCH_TIMEOUT_MS=2700000`. Both values are milliseconds.
+Resolution and extraction timeouts accept `1` to `900000` (15 minutes); request
+and whole-fetch timeouts accept `1` to `3600000` (60 minutes). For a very slow
+connection, the largest supported combination is:
+
+```bash
+ZYRK_REQUEST_TIMEOUT_MS=3600000 ZYRK_FETCH_TIMEOUT_MS=3600000 zyrk install
+```
+
+These are finite deadlines; graph, archive-entry, and byte limits still apply.
 
 Platform gates run the complete check on Ubuntu and macOS/Node 24 and a
 Windows CLI/artifact contract suite, including paths with spaces and Unicode.

package/VERSION

@@ -1 +1 @@
-v0.6.5
+v0.6.7

package/dist/cli/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAe,SAAS,EAAe,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,CAAC;AACrB,OAAO,EAAoB,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAExE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAM3C,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAEhF,eAAO,MAAM,uBAAuB,IAAI,CAAC;AA2DzC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAyBhD;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AA6EF;;;GAGG;AACH,wBAAgB,QAAQ,CACtB,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,GACnD,SAAS,CAgDX;AAmBD,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1C,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3D,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;CACxC,CAAC;AAEF,gFAAgF;AAChF,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAkapE"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAe,SAAS,EAAe,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,CAAC;AACrB,OAAO,EAAoB,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAExE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAM3C,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAEhF,eAAO,MAAM,uBAAuB,IAAI,CAAC;AA6DzC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAyBhD;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AA6EF;;;GAGG;AACH,wBAAgB,QAAQ,CACtB,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,GACnD,SAAS,CAgDX;AAmBD,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1C,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3D,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;CACxC,CAAC;AAEF,gFAAgF;AAChF,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CA8bpE"}

package/dist/cli/main.js

@@ -1,3 +1,4 @@
+import { runNextCommand } from "../commands/next.js";
 import { createInstallProgress } from "./progress.js";
 import { runMaintenanceCommand } from "../commands/maintenance.js";
 import { runDeployCommand } from "../commands/deploy.js";
@@ -37,6 +38,7 @@ const NATIVE_COMMANDS = [
     ["exec", "Run an installed executable (never fetches)."],
     ["dlx", "Explicitly fetch and run a temporary tool environment."],
     ["create", "Scaffold from a create-* starter package."],
+    ["next", "Explicitly configure Next Turbopack: next --turbopack."],
     ["list, why", "Show the installed graph / why a dependency is selected."],
     ["doctor", "Diagnose filesystem, links, policy, install-state issues."],
     ["approve-builds, rebuild", "Review script permissions / rebuild."],
@@ -58,6 +60,7 @@ for (const [names] of NATIVE_COMMANDS) {
 const IMPLEMENTED_COMMANDS = new Set([
     "dlx",
     "create",
+    "next",
     "install",
     "i",
     "add",
@@ -97,7 +100,7 @@ export function helpText(version) {
     }
     lines.push("", "Registry publishing and account commands (via your npm):");
     lines.push(...delegatedHelpLines());
-    lines.push("", "Install timeouts: ZYRK_RESOLVE_TIMEOUT_MS and ZYRK_EXTRACT_TIMEOUT_MS (1..900000 ms).", "zyrk never installs packages globally and never runs npm to do it.", "Need a global package? Run npm directly: npm install --global <package-spec>");
+    lines.push("", "Install timeouts: ZYRK_RESOLVE_TIMEOUT_MS and ZYRK_EXTRACT_TIMEOUT_MS (1..900000 ms); ZYRK_REQUEST_TIMEOUT_MS (1..3600000 ms); ZYRK_FETCH_TIMEOUT_MS (1..3600000 ms).", "zyrk never installs packages globally and never runs npm to do it.", "Need a global package? Run npm directly: npm install --global <package-spec>");
     return `${lines.join("\n")}\n`;
 }
 function ok(stdout, parsed) {
@@ -375,6 +378,30 @@ export async function runCli(options) {
             return emit(fail(toZyrkError(error, `zyrk ${parsed.command} failed.`), parsed));
         }
     }
+    if (!parsed.help && !parsed.version && parsed.command === "next") {
+        try {
+            const result = await runNextCommand({
+                args: parsed.commandArgs,
+                cwd: options.cwd ?? process.cwd(),
+                env: options.env,
+            });
+            return emit({
+                exitCode: 0,
+                stdout: parsed.json
+                    ? JSON.stringify({
+                        schemaVersion: CLI_JSON_SCHEMA_VERSION,
+                        command: "next",
+                        status: "ok",
+                        ...result,
+                    }) + "\n"
+                    : `${result.changed ? "Configured" : "Already configured"} Next Turbopack with the project's strict root and the installed external shared realizations. Experimental additional roots require Next.js 16.4+. Backup: ${result.backup}.\n`,
+                stderr: "",
+            });
+        }
+        catch (error) {
+            return emit(fail(toZyrkError(error, "Next Turbopack configuration failed."), parsed));
+        }
+    }
     if (!parsed.help &&
         !parsed.version &&
         (parsed.command === "install" || parsed.command === "i")) {

package/dist/commands/next.d.ts

@@ -0,0 +1,10 @@
+export declare function runNextCommand(options: {
+    args: readonly string[];
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+}): Promise<{
+    changed: boolean;
+    config: string;
+    backup: string;
+}>;
+//# sourceMappingURL=next.d.ts.map

package/dist/commands/next.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"next.d.ts","sourceRoot":"","sources":["../../src/commands/next.ts"],"names":[],"mappings":"AAqFA,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAC5C,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA0LhE"}

package/dist/commands/next.js

@@ -0,0 +1,185 @@
+/** Explicit Next.js configuration editing; ordinary installs never call this. */
+import { constants } from "node:fs";
+import { chmod, copyFile, lstat, readFile, realpath, readdir, rm, writeFile, } from "node:fs/promises";
+import * as path from "node:path";
+import { satisfies } from "semver";
+import { findProjectBoundary, resolveStoreRoot } from "../config/paths.js";
+import { ZyrkError } from "../errors.js";
+import { lockedGraph } from "../install/lock.js";
+import { selectPlatformGraph } from "../install/platform.js";
+import { validateLockDoc } from "../lockfile/read.js";
+import { manifestFingerprint } from "../lockfile/fingerprints.js";
+import { Store } from "../store/layout.js";
+import { createGraphDoc, contextIdFor } from "../store/graph.js";
+import { packageDirIn, selectRealizationDirs } from "../store/realize.js";
+import { verifyRealization } from "../store/verify.js";
+import { acquireLock } from "../util/locks.js";
+import { isErrno, writeFileAtomic } from "../util/fsx.js";
+import { sha512Hex } from "../util/hash.js";
+import { canonicalJson } from "../util/json.js";
+const HELPER = "next.config.zyrk-turbopack.cjs";
+const DECLARATION = "next.config.zyrk-turbopack.d.cts";
+const MARKER = "// Managed by explicit zyrk next --turbopack; original configuration is preserved.\n";
+const TYPES = "declare function withZyrkTurbopack<T>(configuration: T, projectDir: string): T;\nexport = withZyrkTurbopack;\n";
+const RUNTIME = `// Local paths are discovered at Next startup, never committed into configuration.
+const fs = require("node:fs");
+const path = require("node:path");
+const crypto = require("node:crypto");
+const canonical = value => JSON.stringify(value && typeof value === "object" ? Array.isArray(value) ? value.map(v => JSON.parse(canonical(v))) : Object.fromEntries(Object.keys(value).sort().map(k => [k, JSON.parse(canonical(value[k]))])) : value);
+const inside = (root, file) => { const relative = path.relative(root, file); return relative === "" || (!relative.startsWith(".." + path.sep) && relative !== ".." && !path.isAbsolute(relative)); };
+module.exports = (configuration, directory) => async (phase, context) => {
+  if (process.platform === "win32") throw new Error("zyrk Turbopack Windows support has not passed its compatibility gate.");
+  const project = fs.realpathSync(directory);
+  const state = JSON.parse(fs.readFileSync(path.join(project, "node_modules/.zyrk/install-state.json"), "utf8"));
+  if (state.schemaVersion !== 1 || state.readiness !== "ready" || state.linker !== "shared" || typeof state.storeRoot !== "string" || !path.isAbsolute(state.storeRoot)) throw new Error("zyrk Turbopack requires a ready shared installation; run zyrk install.");
+  const lock = JSON.parse(fs.readFileSync(path.join(project, "package-lock.json"), "utf8"));
+  if (crypto.createHash("sha512").update(canonical(lock)).digest("hex") !== state.lockDigest) throw new Error("zyrk Turbopack installation and lock disagree; run zyrk install.");
+  const next = fs.realpathSync(path.join(project, "node_modules/next"));
+  const version = JSON.parse(fs.readFileSync(path.join(next, "package.json"), "utf8")).version;
+  if (typeof version !== "string" || !/^16\\.(?:[4-9]|[1-9][0-9]+)\\.[0-9]+$/.test(version)) throw new Error("zyrk Turbopack additional roots require stable Next.js 16.4.x through 16.x.");
+  const store = fs.realpathSync(path.join(state.storeRoot, "realizations"));
+  const direct = Array.isArray(state.direct) && state.direct.find(edge => edge.name === "next");
+  if (!direct || fs.realpathSync(direct.target) !== next || !inside(store, next) || inside(project, store) || inside(store, project)) throw new Error("zyrk Turbopack requires the recorded external shared dependency projection.");
+  const resolved = await (typeof configuration === "function" ? configuration(phase, context) : configuration);
+  if (!resolved || typeof resolved !== "object" || Array.isArray(resolved)) throw new Error("The original Next configuration must return an object.");
+  const roots = resolved.experimental?.turbopackAdditionalRoots || {};
+  if (roots.zyrkStore && fs.realpathSync(roots.zyrkStore.path) !== store) throw new Error("The existing zyrkStore Turbopack root conflicts with the installed store.");
+  return { ...resolved, turbopack: { ...resolved.turbopack, root: project }, experimental: { ...resolved.experimental, turbopackAdditionalRoots: { ...roots, zyrkStore: { path: store } } } };
+};
+`;
+function denied(message) {
+    return new ZyrkError("ZYRK_USAGE", message, {
+        remedy: "Run zyrk next --turbopack in a ready shared Next.js 16.4+ project; restore or review existing configuration files before retrying.",
+    });
+}
+async function regular(file) {
+    const info = await lstat(file);
+    if (!info.isFile() || info.isSymbolicLink())
+        throw denied("Next configuration editing requires regular files.");
+}
+function wrapper(name, esm) {
+    const original = name.replace(/\.(ts|mjs|js)$/, ".zyrk-original.$1");
+    if (!esm)
+        return `${MARKER}module.exports = require("./${HELPER}")(require("./${original}"), __dirname);\n`;
+    const importedOriginal = name.endsWith(".ts")
+        ? original.slice(0, -3)
+        : original;
+    const directory = name.endsWith(".mjs") || name.endsWith(".js")
+        ? 'fileURLToPath(new URL(".", import.meta.url))'
+        : "__dirname";
+    return `${MARKER}${directory === "__dirname" ? "" : 'import { fileURLToPath } from "node:url";\n'}import original from "./${importedOriginal}";\nimport withZyrkTurbopack from "./${HELPER}";\n\nexport default withZyrkTurbopack(original, ${directory});\n`;
+}
+export async function runNextCommand(options) {
+    if (process.platform === "win32")
+        throw new ZyrkError("ZYRK_PLATFORM_UNSUPPORTED", "Next Turbopack configuration is not verified on Windows.", {
+            remedy: "Use a platform with a verified zyrk store; Windows support remains gated.",
+        });
+    if (options.args.length !== 1 || options.args[0] !== "--turbopack")
+        throw denied("Next configuration editing requires the explicit --turbopack option.");
+    const boundary = await findProjectBoundary(options.cwd);
+    if (!boundary)
+        throw denied("Cannot find a Next project manifest.");
+    const project = await realpath(boundary);
+    const control = await lstat(path.join(project, ".zyrk-local"));
+    if (!control.isDirectory() || control.isSymbolicLink())
+        throw denied("Next project control directory is unsafe.");
+    const held = await acquireLock(path.join(project, ".zyrk-local/project.lock"), { name: "Next Turbopack configuration" });
+    try {
+        const state = JSON.parse(await readFile(path.join(project, "node_modules/.zyrk/install-state.json"), "utf8"));
+        const doc = validateLockDoc(JSON.parse(await readFile(path.join(project, "package-lock.json"), "utf8")), "project package-lock.json");
+        if (state.schemaVersion !== 1 ||
+            state.readiness !== "ready" ||
+            state.linker !== "shared" ||
+            state.lockDigest !== sha512Hex(canonicalJson(doc)))
+            throw denied("Next configuration requires a ready shared installation matching its lock.");
+        const manifest = JSON.parse(await readFile(path.join(project, "package.json"), "utf8"));
+        if (doc.zyrk?.manifest !== manifestFingerprint(manifest))
+            throw denied("The Next project manifest differs from its installed lock.");
+        const resolved = lockedGraph(doc);
+        const selected = selectPlatformGraph({
+            ...resolved,
+            roots: resolved.roots.filter((root) => Array.isArray(state.direct) &&
+                state.direct.some((edge) => edge.name === root.name)),
+        }, new Set(Object.keys(doc.packages?.[""]?.optionalDependencies ?? {})));
+        const next = selected.nodes.find((node) => node.name === "next" &&
+            selected.roots.some((root) => root.name === "next" && root.target === node.key));
+        if (!next || !satisfies(next.version, ">=16.4.0 <17.0.0"))
+            throw denied("The additional-root adapter requires stable Next.js 16.4.x through 16.x.");
+        const store = await Store.open({
+            root: resolveStoreRoot({ env: options.env }).root,
+        });
+        store.requireInitialized();
+        if (state.storeRoot !== store.root)
+            throw denied("The installed Next store differs from the selected user store.");
+        const storeRealizations = await realpath(store.paths.realizationsDir);
+        const contains = (root, file) => {
+            const relative = path.relative(root, file);
+            return (relative === "" ||
+                (!relative.startsWith(".." + path.sep) &&
+                    relative !== ".." &&
+                    !path.isAbsolute(relative)));
+        };
+        if (contains(project, storeRealizations) ||
+            contains(storeRealizations, project))
+            throw denied("The Turbopack adapter requires shared realizations outside the project root.");
+        const graph = createGraphDoc(selected.nodes.map((node) => ({ ...node, deps: node.edges })));
+        const directories = selectRealizationDirs(store, graph);
+        await verifyRealization({
+            store,
+            graph,
+            rootKey: next.key,
+            contextId: contextIdFor(graph, next.key),
+            realizationDirs: directories,
+        });
+        if ((await realpath(path.join(project, "node_modules/next"))) !==
+            (await realpath(packageDirIn(directories.get(next.key), "next"))))
+            throw denied("The installed Next link differs from its verified context.");
+        const names = (await readdir(project)).filter((name) => ["next.config.ts", "next.config.js", "next.config.mjs"].includes(name));
+        if (names.length !== 1)
+            throw denied("Select a project with exactly one supported Next configuration file.");
+        const name = names[0];
+        const original = name.replace(/\.(ts|mjs|js)$/, ".zyrk-original.$1");
+        const target = path.join(project, name);
+        await regular(target);
+        const contents = await readFile(target, "utf8");
+        const generated = wrapper(name, name !== "next.config.js" || manifest.type === "module");
+        if (contents === generated) {
+            for (const file of [original, HELPER, DECLARATION])
+                await regular(path.join(project, file));
+            if ((await readFile(path.join(project, HELPER), "utf8")) !== RUNTIME ||
+                (await readFile(path.join(project, DECLARATION), "utf8")) !== TYPES)
+                throw denied("The existing Turbopack adapter was changed; review it before retrying.");
+            return { changed: false, config: name, backup: original };
+        }
+        const created = [];
+        let configWriteAttempted = false;
+        try {
+            await copyFile(target, path.join(project, original), constants.COPYFILE_EXCL);
+            created.push(original);
+            await chmod(path.join(project, original), 0o444);
+            for (const [file, text] of [
+                [HELPER, RUNTIME],
+                [DECLARATION, TYPES],
+            ]) {
+                await writeFile(path.join(project, file), text, { flag: "wx" });
+                created.push(file);
+            }
+            configWriteAttempted = true;
+            await writeFileAtomic(target, generated);
+        }
+        catch (cause) {
+            // The atomic write may have renamed successfully before a durability
+            // error. Retain its dependencies and original backup for recovery.
+            if (!configWriteAttempted)
+                for (const file of created.reverse())
+                    await rm(path.join(project, file)).catch(() => { });
+            if (isErrno(cause, "EEXIST"))
+                throw denied("A Next configuration backup or adapter already exists; no existing files were overwritten.");
+            throw cause;
+        }
+        return { changed: true, config: name, backup: original };
+    }
+    finally {
+        await held.release();
+    }
+}

package/dist/fetch/registry.d.ts

@@ -13,6 +13,10 @@ import type { Logger } from "../log.ts";
 import { type HashedBytes } from "../util/integrity.ts";
 /** 512 MiB: large for an npm package, small enough to bound mishaps. */
 export declare const DEFAULT_MAX_TARBALL_BYTES: number;
+/** Bounds the complete metadata closure while allowing large framework graphs. */
+export declare const DEFAULT_MAX_TOTAL_METADATA_BYTES: number;
+/** Fifteen minutes per registry operation, including archive transfer. */
+export declare const DEFAULT_REQUEST_DEADLINE_MS = 900000;
 /** Default registry for tool environments (SPEC 13.1). */
 export declare const DEFAULT_REGISTRY = "https://registry.npmjs.org/";
 export interface PackumentDist {
@@ -92,6 +96,10 @@ export declare class RegistryClient {
     packument(name: string, options?: {
         signal?: AbortSignal;
     }): Promise<Packument>;
+    /** Fetch one exact version without transferring every release in a packument. */
+    versionManifest(name: string, version: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<PackumentVersion>;
     /** Registry advisory request; private names may never follow an external redirect. */
     auditAdvisories(packages: Readonly<Record<string, readonly string[]>>, options?: {
         signal?: AbortSignal;

package/dist/fetch/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/fetch/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAc9B,wEAAwE;AACxE,eAAO,MAAM,yBAAyB,QAAoB,CAAC;AAE3D,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB,gCAAgC,CAAC;AAK9D,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,aAAa,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9D,mBAAmB,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC;IACpB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,qBAAa,cAAc;;IAiBzB,YAAY,OAAO,EAAE,qBAAqB,EAuGzC;IAED,+EAA+E;IAC/E,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,2EAA2E;IAC3E,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAKvC;IACD,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9B;IACD,IAAI,gBAAgB,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAIvD;IAED,mEAAmE;IAC7D,SAAS,CACb,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACrC,OAAO,CAAC,SAAS,CAAC,CAsBpB;IAED,sFAAsF;IAChF,eAAe,CACnB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,EACrD,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACrC,OAAO,CAAC,OAAO,CAAC,CA6ClB;IAsCD;;;;OAIG;IACG,eAAe,CAAC,OAAO,EAAE;QAC7B,GAAG,EAAE,MAAM,CAAC;QACZ,6EAA6E;QAC7E,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;QACtC,QAAQ,EAAE,MAAM,CAAC;QACjB,oDAAoD;QACpD,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,gFAAgF;QAChF,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;KACnC,GAAG,OAAO,CAAC,cAAc,CAAC,CA2G1B;CA4MF;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,aAAa,GAClB,MAAM,GAAG,SAAS,CAQpB;AAgDD;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAqB9D"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/fetch/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAc9B,wEAAwE;AACxE,eAAO,MAAM,yBAAyB,QAAoB,CAAC;AAE3D,kFAAkF;AAClF,eAAO,MAAM,gCAAgC,QAAoB,CAAC;AAElE,0EAA0E;AAC1E,eAAO,MAAM,2BAA2B,SAAU,CAAC;AAEnD,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB,gCAAgC,CAAC;AAK9D,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,aAAa,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9D,mBAAmB,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC;IACpB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,qBAAa,cAAc;;IAiBzB,YAAY,OAAO,EAAE,qBAAqB,EAuGzC;IAED,+EAA+E;IAC/E,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,2EAA2E;IAC3E,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAKvC;IACD,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9B;IACD,IAAI,gBAAgB,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAIvD;IAED,mEAAmE;IAC7D,SAAS,CACb,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACrC,OAAO,CAAC,SAAS,CAAC,CAsBpB;IAED,iFAAiF;IAC3E,eAAe,CACnB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACrC,OAAO,CAAC,gBAAgB,CAAC,CAuC3B;IAED,sFAAsF;IAChF,eAAe,CACnB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,EACrD,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACrC,OAAO,CAAC,OAAO,CAAC,CA6ClB;IAsCD;;;;OAIG;IACG,eAAe,CAAC,OAAO,EAAE;QAC7B,GAAG,EAAE,MAAM,CAAC;QACZ,6EAA6E;QAC7E,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;QACtC,QAAQ,EAAE,MAAM,CAAC;QACjB,oDAAoD;QACpD,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,gFAAgF;QAChF,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;KACnC,GAAG,OAAO,CAAC,cAAc,CAAC,CA2G1B;CA+MF;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,aAAa,GAClB,MAAM,GAAG,SAAS,CAQpB;AAgDD;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAqB9D"}

package/dist/fetch/registry.js

@@ -17,6 +17,10 @@ import { assertIntegrityOk, canonicalStrongSri, IntegrityHasher, base64FromHex,
 const transport = createRequire(import.meta.url)("make-fetch-happen");
 /** 512 MiB: large for an npm package, small enough to bound mishaps. */
 export const DEFAULT_MAX_TARBALL_BYTES = 512 * 1024 * 1024;
+/** Bounds the complete metadata closure while allowing large framework graphs. */
+export const DEFAULT_MAX_TOTAL_METADATA_BYTES = 256 * 1024 * 1024;
+/** Fifteen minutes per registry operation, including archive transfer. */
+export const DEFAULT_REQUEST_DEADLINE_MS = 900_000;
 /** Default registry for tool environments (SPEC 13.1). */
 export const DEFAULT_REGISTRY = "https://registry.npmjs.org/";
 /** npm's abbreviated packument media type, used for installs. */
@@ -66,9 +70,9 @@ export class RegistryClient {
             (scope.pathname.startsWith(boundary.pathname) ||
                 boundary.pathname.startsWith(scope.pathname)));
         this.#maxMetadataBytes = positiveLimit(options.maxMetadataBytes ?? 32 * 1024 * 1024, "maxMetadataBytes");
-        this.#maxTotalMetadataBytes = positiveLimit(options.maxTotalMetadataBytes ?? 128 * 1024 * 1024, "maxTotalMetadataBytes");
+        this.#maxTotalMetadataBytes = positiveLimit(options.maxTotalMetadataBytes ?? DEFAULT_MAX_TOTAL_METADATA_BYTES, "maxTotalMetadataBytes");
         this.#maxMetadataVersions = positiveLimit(options.maxMetadataVersions ?? 100_000, "maxMetadataVersions");
-        this.#requestDeadlineMs = positiveLimit(options.requestDeadlineMs ?? 120_000, "requestDeadlineMs");
+        this.#requestDeadlineMs = positiveLimit(options.requestDeadlineMs ?? DEFAULT_REQUEST_DEADLINE_MS, "requestDeadlineMs");
         positiveLimit(this.#maxTarballBytes, "maxTarballBytes");
         this.#signal = options.signal;
         const { scopedRegistries, ...baseOptions } = options;
@@ -143,6 +147,33 @@ export class RegistryClient {
         }
         return validatePackument(raw, name, this.#origin, this.#maxMetadataVersions);
     }
+    /** Fetch one exact version without transferring every release in a packument. */
+    async versionManifest(name, version, options = {}) {
+        const selected = this.forPackage(name);
+        if (selected !== this)
+            return selected.versionManifest(name, version, options);
+        const url = `${this.#registry}${escapePackageName(name)}/${encodeURIComponent(version)}`;
+        this.#logger?.debug("fetching exact version metadata", {
+            name,
+            version,
+            url,
+        });
+        let raw;
+        try {
+            raw = await this.#withRequest(url, `${INSTALL_V1_ACCEPT}, application/json`, (response) => this.#readMetadata(response), options.signal);
+        }
+        catch (error) {
+            throw mapFetchError(error, `fetch metadata for ${name}@${version}`);
+        }
+        const validated = validatePackument({ name, versions: { [version]: raw } }, name, this.#origin, 1);
+        const entry = validated.versions[version];
+        if (entry === undefined)
+            throw new ZyrkError("ZYRK_RESOLUTION_FAILED", `registry has no version ${version} of ${name}`, {
+                detail: { name, version },
+                remedy: "check the requested version exists in the configured registry",
+            });
+        return entry;
+    }
     /** Registry advisory request; private names may never follow an external redirect. */
     async auditAdvisories(packages, options = {}) {
         for (const [name, versions] of Object.entries(packages)) {
@@ -414,7 +445,10 @@ export class RegistryClient {
             throw resourceLimit("redirect count", 10, "registry redirect configuration");
         }
         catch (error) {
-            active?.body.destroy();
+            // A bounded body consumer can stop while the decoder still has source
+            // bytes arriving. Abort the transport before closing the exposed stream
+            // so compressed responses cannot write into a closed decompressor.
+            cancel();
             if (timedOut || signals.some((source) => source.aborted))
                 throw resourceLimit("request deadline or cancellation", this.#requestDeadlineMs, "requestDeadlineMs");
             throw error;

package/dist/install/budgets.d.ts

@@ -3,5 +3,10 @@ import type { ExtractionLimits } from "../extract/tarball.ts";
 export declare function installBudgets(env: NodeJS.ProcessEnv): {
     resolveBudget: Partial<ResolverLimits>;
     extractBudget: Partial<ExtractionLimits>;
+    fetchBudget: {
+        deadlineMs: number;
+    };
 };
+/** Bound slow registry transfers while allowing large framework archives. */
+export declare function registryRequestDeadline(env: NodeJS.ProcessEnv): number;
 //# sourceMappingURL=budgets.d.ts.map

package/dist/install/budgets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"budgets.d.ts","sourceRoot":"","sources":["../../src/install/budgets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAwB9D,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG;IACtD,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACvC,aAAa,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC1C,CASA"}
+{"version":3,"file":"budgets.d.ts","sourceRoot":"","sources":["../../src/install/budgets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAyB9D,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG;IACtD,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACvC,aAAa,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACzC,WAAW,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CACrC,CAYA;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAEtE"}

package/dist/install/budgets.js

@@ -1,15 +1,15 @@
 /** Public, bounded install timeout configuration. Node and byte limits stay intact. */
 import { ZyrkError } from "../errors.js";
-function timeout(env, key, fallback) {
+function timeout(env, key, fallback, maximum = 900000) {
     const raw = env[key];
     if (raw === undefined)
         return fallback;
     if (!/^[0-9]+$/.test(raw) ||
         !Number.isSafeInteger(Number(raw)) ||
         Number(raw) < 1 ||
-        Number(raw) > 900000)
-        throw new ZyrkError("ZYRK_POLICY_DENIED", `Cannot configure install: ${key} must be an integer from 1 to 900000.`, {
-            remedy: `Set ${key} to a timeout in milliseconds from 1 to 900000, or unset it to use the default.`,
+        Number(raw) > maximum)
+        throw new ZyrkError("ZYRK_POLICY_DENIED", `Cannot configure install: ${key} must be an integer from 1 to ${maximum}.`, {
+            remedy: `Set ${key} to a timeout in milliseconds from 1 to ${maximum}, or unset it to use the default.`,
         });
     return Number(raw);
 }
@@ -21,5 +21,12 @@ export function installBudgets(env) {
         extractBudget: {
             maxDurationMs: timeout(env, "ZYRK_EXTRACT_TIMEOUT_MS", 120000),
         },
+        fetchBudget: {
+            deadlineMs: timeout(env, "ZYRK_FETCH_TIMEOUT_MS", 900000, 3600000),
+        },
     };
 }
+/** Bound slow registry transfers while allowing large framework archives. */
+export function registryRequestDeadline(env) {
+    return timeout(env, "ZYRK_REQUEST_TIMEOUT_MS", 900000, 3600000);
+}

package/dist/install/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/install/registry.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,cAAc,EAAoB,MAAM,sBAAsB,CAAC;AAKxE,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,cAAc,CAAC,CAuI1B"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/install/registry.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,cAAc,EAAoB,MAAM,sBAAsB,CAAC;AAMxE,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,cAAc,CAAC,CAwI1B"}

package/dist/install/registry.js

@@ -8,6 +8,7 @@ import { RegistryClient, DEFAULT_REGISTRY } from "../fetch/registry.js";
 import { isErrno } from "../util/fsx.js";
 import { findProjectBoundary } from "../config/paths.js";
 import { cleanUrl } from "./lock.js";
+import { registryRequestDeadline } from "./budgets.js";
 export async function installRegistry(options) {
     let registry = DEFAULT_REGISTRY;
     const auth = {};
@@ -97,6 +98,7 @@ export async function installRegistry(options) {
     return new RegistryClient({
         registry,
         scopedRegistries,
+        requestDeadlineMs: registryRequestDeadline(options.env),
         userAgent: `zyrk/${options.version}`,
         fetchOptions: auth,
     });

package/dist/install/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/install/run.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAK9D,OAAO,EAOL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAYtB,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AA+B3C,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EACD,UAAU,GACV,WAAW,GACX,UAAU,GACV,WAAW,GACX,UAAU,GACV,SAAS,GACT,UAAU,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,aAAa,GAAG,YAAY,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AACF,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACxC,aAAa,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1C,WAAW,CAAC,EAAE;QACZ,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,CAAC;AACF,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EACL,OAAO,GACP,uBAAuB,GACvB,eAAe,GACf,SAAS,GACT,cAAc,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;CAC3B,CAAC;AA4GF,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAiyBxB"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/install/run.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAK9D,OAAO,EAOL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAYtB,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AA+B3C,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EACD,UAAU,GACV,WAAW,GACX,UAAU,GACV,WAAW,GACX,UAAU,GACV,SAAS,GACT,UAAU,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,aAAa,GAAG,YAAY,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AACF,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACxC,aAAa,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1C,WAAW,CAAC,EAAE;QACZ,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,CAAC;AACF,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EACL,OAAO,GACP,uBAAuB,GACvB,eAAe,GACf,SAAS,GACT,cAAc,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;CAC3B,CAAC;AA4GF,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAsyBxB"}

package/dist/install/run.js

@@ -102,6 +102,7 @@ export async function installProject(options) {
         ...options,
         resolveBudget: { ...budgets.resolveBudget, ...options.resolveBudget },
         extractBudget: { ...budgets.extractBudget, ...options.extractBudget },
+        fetchBudget: { ...budgets.fetchBudget, ...options.fetchBudget },
     };
     if (await findWorkspaceRoot(options.projectDir)) {
         const { installWorkspaceProject } = await import("./workspace-install.js");
@@ -272,6 +273,9 @@ export async function installProject(options) {
                     packument: (name) => options.registry.packument(name, {
                         signal: operation.operation.signal,
                     }),
+                    versionManifest: (name, version) => options.registry.versionManifest(name, version, {
+                        signal: operation.operation.signal,
+                    }),
                 },
                 requirements: Object.entries(allDeps)
                     .map(([name, spec]) => {

package/dist/lockfile/write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"write.d.ts","sourceRoot":"","sources":["../../src/lockfile/write.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGjE,OAAO,EAGL,KAAK,UAAU,EAGhB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC1D,QAAQ,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,mBAAmB,CAAC;IAChC,YAAY,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,eAAe,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;CACzB,CAAC;AAEF,wBAAsB,aAAa,CACjC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,UAAU,CAAC,CAqOrB"}
+{"version":3,"file":"write.d.ts","sourceRoot":"","sources":["../../src/lockfile/write.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGjE,OAAO,EAGL,KAAK,UAAU,EAGhB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC1D,QAAQ,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,mBAAmB,CAAC;IAChC,YAAY,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,eAAe,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;CACzB,CAAC;AAEF,wBAAsB,aAAa,CACjC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,UAAU,CAAC,CAqPrB"}

package/dist/lockfile/write.js

@@ -94,7 +94,23 @@ export async function writeLockfile(options) {
                         : `npm:${target.name}@${target.version}`;
             }
         }
+        const npmMetadata = {};
+        const existingEntry = existingPackages[location];
+        if (existingEntry !== undefined) {
+            for (const field of [
+                "license",
+                "funding",
+                "deprecated",
+                "hasInstallScript",
+                "inBundle",
+            ]) {
+                if (Object.hasOwn(existingEntry, field)) {
+                    npmMetadata[field] = existingEntry[field];
+                }
+            }
+        }
         packages[location] = {
+            ...npmMetadata,
             name: node.name,
             version: node.version,
             resolved: node.tarballUrl,

package/dist/resolve/resolver.d.ts

@@ -1,9 +1,10 @@
-import { type Packument } from "../fetch/registry.ts";
+import { type Packument, type PackumentVersion } from "../fetch/registry.ts";
 import { type OverridePolicy } from "./overrides.ts";
 export type MetadataProvider = {
     readonly origin: string;
     originFor?(name: string): string;
     packument(name: string): Promise<Packument>;
+    versionManifest?(name: string, version: string): Promise<PackumentVersion>;
 };
 export type EdgeKind = "prod" | "optional" | "peer";
 export type ResolvedEdge = {

package/dist/resolve/resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/resolve/resolver.ts"],"names":[],"mappings":"AAyBA,OAAO,EAEL,KAAK,SAAS,EAEf,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;AAEpD,MAAM,MAAM,YAAY,GAAG;IACzB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,YAAY,EAAE,KAAK,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC,CAAC;IACH,QAAQ,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACxE,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACzE,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,eAAe,IAAI,eAAe,CAcjD;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACjC,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,oDAAoD;IACpD,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD,CAAC;AAEF,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAmCzB"}
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/resolve/resolver.ts"],"names":[],"mappings":"AAyBA,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,gBAAgB,EACtB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,eAAe,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC5E,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;AAEpD,MAAM,MAAM,YAAY,GAAG;IACzB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,YAAY,EAAE,KAAK,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC,CAAC;IACH,QAAQ,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACxE,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACzE,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,eAAe,IAAI,eAAe,CAcjD;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACjC,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,oDAAoD;IACpD,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD,CAAC;AAEF,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAmCzB"}

package/dist/resolve/resolver.js

@@ -70,6 +70,7 @@ class ResolverState {
     provider;
     overrides;
     packuments = new Map();
+    versionManifests = new Map();
     peerless = new Map();
     peerBearing = new Map();
     freshPeers = new Map();
@@ -142,6 +143,23 @@ class ResolverState {
         this.packuments.set(name, pending);
         return pending;
     }
+    versionManifestOf(name, version) {
+        const key = `${name}\0${version}`;
+        const cached = this.versionManifests.get(key);
+        if (cached !== undefined)
+            return cached;
+        this.checkBudget();
+        let timer;
+        const deadline = new Promise((_resolve, reject) => {
+            timer = setTimeout(() => reject(budgetError("resolution deadline exceeded")), Math.max(1, this.expires - Date.now()));
+        });
+        const pending = Promise.race([
+            this.provider.versionManifest(name, version),
+            deadline,
+        ]).finally(() => clearTimeout(timer));
+        this.versionManifests.set(key, pending);
+        return pending;
+    }
     /**
      * Build (or reuse) the occurrence for one dependency edge. Peerless
      * packages share one occurrence per name@version; packages declaring
@@ -442,6 +460,21 @@ class ResolverState {
 // Version selection
 // ---------------------------------------------------------------------------
 async function selectVersion(state, req) {
+    if (req.targetKind === "exact" && state.provider.versionManifest) {
+        try {
+            return {
+                version: req.targetSpec,
+                entry: await state.versionManifestOf(req.realName, req.targetSpec),
+            };
+        }
+        catch (error) {
+            // Registries and older test adapters may expose only packuments. Keep
+            // the optimization opportunistic when the exact endpoint is absent.
+            if (!(error instanceof ZyrkError) || error.detail?.status !== 404) {
+                throw error;
+            }
+        }
+    }
     const packument = await state.packumentOf(req.realName);
     const fail = (message, remedy) => new ZyrkError("ZYRK_RESOLUTION_FAILED", message, {
         detail: { name: req.realName, spec: req.targetSpec },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zyrk",
-  "version": "0.6.5",
+  "version": "0.6.7",
   "description": "Storage-efficient Node package manager: one verified store per user, shared across projects through links.",
   "license": "MIT",
   "type": "module",
@@ -20,7 +20,7 @@
     "version:bump": "node scripts/bump-version.js",
     "setup:hooks": "git config core.hooksPath .githooks",
     "build": "tsc -p tsconfig.build.json",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "node bin/zyrk.js run build"
   },
   "dependencies": {
     "make-fetch-happen": "16.0.1",