zyrk 0.6.6 → 0.7.1

package/README.md

@@ -27,6 +27,14 @@ the shared store, exact dependency context, mutation rules, and cleanup contract
 central to its design. Storage savings, speed, and framework compatibility will
 be reported only after reproducible measurements and compatibility tests.
 
+### The name and the idea
+
+The project began as **snpm**, short for “space-efficient npm.” That name was
+already in use, so it became **nexu**; npm's package-name similarity policy
+then blocked publishing that name, and the project became **zyrk**. The names
+changed, while the goal stayed the same: make shared package storage practical,
+careful, and useful in everyday Node.js development.
+
 ## Try the current CLI
 
 Install from npm:
@@ -46,11 +54,17 @@ From a checkout:
 ```bash
 git clone https://github.com/kingjethro999/zyrk.git zyrk
 cd zyrk
-npm ci
-node bin/zyrk.js --help
-node bin/zyrk.js --version
+npm install --global zyrk@0.6.6
+zyrk install --frozen-lockfile
+zyrk --help
+zyrk --version
 ```
 
+The global npm install bootstraps the `zyrk` executable. Project dependencies
+are installed by zyrk itself. On a fresh checkout, use the published bootstrap
+version first because the source checkout's own development dependencies are
+needed to run its local CLI.
+
 ### One-line install (shell)
 
 Linux / macOS:
@@ -90,8 +104,12 @@ Offline installs use locked verified sources and fail if an input is missing.
 Manifest, lock, and projection changes are journaled for process-crash recovery;
 a failed resolution, verification, or build-policy check keeps the prior graph.
 
-Dependency install scripts and implicit `binding.gyp` builds require explicit
-approval. Review first, trust the selected sources, then install:
+Dependency `preinstall`, `install`, and `postinstall` scripts (plus implicit
+`binding.gyp` builds) are supported. In an interactive terminal, `zyrk install`
+shows the exact candidates and lets you select which scripts to run. Press Enter
+to skip all pending scripts and continue with an intentionally unbuilt install.
+Headless installs also skip unapproved scripts and report that readiness state.
+Review candidates separately with:
 
 ```bash
 zyrk approve-builds                # inspect exact sources and commands; executes no package code
@@ -101,8 +119,12 @@ zyrk rebuild --offline             # rebuild the complete approved locked graph
 ```
 
 Approvals are local to the exact graph, sources, patch contents, and script
-policy. Mandatory user denies override project approvals. Approved scripts run
-with your account's permissions; permission is not a sandbox. Packages that need
+policy. Interactive selections are written to the checked-in
+`zyrk-workspace.json` file with exact package source identities, so collaborators
+can reuse the review alongside the lockfile. Manual `zyrk approve-builds
+<package>` approvals are recorded there too. Mandatory user denies override
+project approvals. Approved scripts run with your account's permissions;
+permission is not a sandbox. Packages that need
 writes use a complete private dependency generation under `.zyrk-local/`, with
 independent writable files and dependency links confined to that generation.
 Build failure keeps the previous project graph active. `--ignore-scripts`
@@ -111,6 +133,24 @@ hooks never run automatically. A project can request runtime writable packages
 with `"zyrk": { "mutablePackages": ["package-name"] }`; this also uses a complete
 private graph.
 
+`zyrk-workspace.json` is portable review state, not a machine-specific store
+manifest. It records each approved package name, version, and exact source ID;
+the file can be committed with `package-lock.json` so collaborators do not have
+to repeat the same approval for the same verified source. User-level denials
+still take precedence.
+
+### Run project scripts
+
+Use `zyrk run <script>` or the package-manager shortcut `zyrk <script>`; both
+use the same project-script policy, installed-generation checks, and local
+binary path. Arguments after `--` are passed to the script:
+
+```bash
+zyrk dev
+zyrk test -- --watch
+zyrk run build
+```
+
 Default registry and authentication settings are loaded from user/project
 `.npmrc` for installation, dependency edits, `dlx`, and `create`. Environment
 token placeholders are supported. Credentials are restricted to their configured
@@ -122,7 +162,10 @@ registry; private names never fall back to a public endpoint. Disabled TLS
 verification is rejected before lookup. Git sources and non-workspace local sources remain unsupported;
 they fail explicitly. Optional dependencies incompatible with the selected platform
 are omitted; missing packages, integrity failures, and other optional failures
-remain errors. Locks retain exact platform-qualified optional variants; each machine
+remain errors. Platform-specific optional packages that do not match this machine
+are summarized once after installation; these are normal variants for packages
+supporting multiple operating systems and CPUs. Locks retain exact
+platform-qualified optional variants; each machine
 selects its compatible local closure without rewriting the lock or recording store
 paths. Older platform-pruned locks need an intentional non-frozen refresh; incomplete
 npm locks must be freshly resolved before portable adoption. macOS, Windows, and
@@ -359,24 +402,34 @@ own options and configuration.
 ## Develop and contribute
 
 ```bash
-npm ci
-npm run setup:hooks
-npm run typecheck
-npm test
-npm run check
-npm run format:check
-npm run format
+npm install --global zyrk@0.6.6  # bootstrap the CLI, once per machine
+zyrk install --frozen-lockfile
+zyrk run setup:hooks
+zyrk run typecheck
+zyrk run test
+zyrk run check
+zyrk run format:check
+zyrk run format
 ```
 
+Linux and macOS development, CI, and release verification use zyrk to install
+the repository's dependencies. The Windows contract job continues to use npm
+while native Windows filesystem and link behavior is being validated. npm is
+also used to publish the package; that is a registry operation, not a project
+dependency install. Vercel deployments should set the install command to
+the commands in [web/vercel.json](web/vercel.json) and set the Vercel project
+root directory to `web/`. The included site uses zyrk for project dependencies
+after npm bootstraps the CLI.
+
 The commit hook runs the full check gate, increments the version in
 `package.json`, `package-lock.json`, and `VERSION`, and creates a matching version
 tag after the commit. Keep changes focused and never bypass the hooks.
 
-CI checks pushed commits and pull requests. The separate
-[npm publishing action](.github/workflows/npm-publish.yml) is triggered when a
-GitHub release is published. It verifies the release tag, formatting, typecheck,
-build, and tests, then publishes that exact commit. Ordinary commits do not
-publish packages. Dependabot and a scheduled advisory check supplement CI; an
+CI checks pushed commits and pull requests. The
+[npm publishing action](.github/workflows/npm-publish.yml) runs when the commit
+hook's version tag is pushed, verifies formatting, typecheck, build, tests, and
+the tag/version match, then publishes that exact commit. A manual workflow
+dispatch can publish a prior version tag for release backfills. Dependabot and a scheduled advisory check supplement CI; an
 unavailable advisory service fails separately from a clean result.
 
 The contributor guide is [AGENTS.md](AGENTS.md). Bug reports and reproducible
@@ -412,10 +465,29 @@ lists each unique package/version linked after the project transaction commits.
 Source counts differ from dependency contexts when peers split a package.
 `--json` disables progress.
 
-Install resolution has a five-minute deadline; each archive extraction has a
-two-minute deadline. Set `ZYRK_RESOLVE_TIMEOUT_MS` or `ZYRK_EXTRACT_TIMEOUT_MS`
-to an integer from `1` to `900000` milliseconds to adjust these timeouts.
-Graph, archive-entry, and byte limits still apply.
+Install resolution has a five-minute deadline, registry requests (including
+archive downloads) have a fifteen-minute deadline, a complete fetch operation
+has a fifteen-minute deadline, and each archive extraction has a two-minute
+deadline. On a slow or unreliable connection, increase the request and complete
+fetch deadlines together. For example, this gives a single request up to 30
+minutes and the entire fetch phase up to 45 minutes:
+
+```bash
+ZYRK_REQUEST_TIMEOUT_MS=1800000 ZYRK_FETCH_TIMEOUT_MS=2700000 zyrk install
+```
+
+To keep the settings for future commands in the current shell, use
+`export ZYRK_REQUEST_TIMEOUT_MS=1800000` and
+`export ZYRK_FETCH_TIMEOUT_MS=2700000`. Both values are milliseconds.
+Resolution and extraction timeouts accept `1` to `900000` (15 minutes); request
+and whole-fetch timeouts accept `1` to `3600000` (60 minutes). For a very slow
+connection, the largest supported combination is:
+
+```bash
+ZYRK_REQUEST_TIMEOUT_MS=3600000 ZYRK_FETCH_TIMEOUT_MS=3600000 zyrk install
+```
+
+These are finite deadlines; graph, archive-entry, and byte limits still apply.
 
 Platform gates run the complete check on Ubuntu and macOS/Node 24 and a
 Windows CLI/artifact contract suite, including paths with spaces and Unicode.

package/VERSION

@@ -1 +1 @@
-v0.6.6
+v0.7.1

package/bin/zyrk.js

@@ -12,6 +12,7 @@ const { runCli } = await import(
 process.exitCode = await runCli({
   argv: process.argv.slice(2),
   env: process.env,
+  stdin: process.stdin,
   stdout: process.stdout,
   stderr: process.stderr,
 });

package/dist/cli/main.d.ts

@@ -25,6 +25,7 @@ export type ToolEnvironment = {
 export type RunCliOptions = {
     argv: readonly string[];
     env: NodeJS.ProcessEnv;
+    stdin?: NodeJS.ReadStream;
     stdout: {
         write(chunk: string): unknown;
     };

package/dist/cli/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAe,SAAS,EAAe,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,CAAC;AACrB,OAAO,EAAoB,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAExE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAM3C,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAEhF,eAAO,MAAM,uBAAuB,IAAI,CAAC;AA6DzC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAyBhD;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AA6EF;;;GAGG;AACH,wBAAgB,QAAQ,CACtB,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,GACnD,SAAS,CAgDX;AAmBD,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1C,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3D,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;CACxC,CAAC;AAEF,gFAAgF;AAChF,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CA8bpE"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAe,SAAS,EAAe,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,CAAC;AACrB,OAAO,EAAoB,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAExE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAM3C,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAEhF,eAAO,MAAM,uBAAuB,IAAI,CAAC;AA6DzC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA0BhD;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AA6EF;;;GAGG;AACH,wBAAgB,QAAQ,CACtB,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,GACnD,SAAS,CAgDX;AAmBD,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC1B,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1C,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3D,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;CACxC,CAAC;AAuDF,gFAAgF;AAChF,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CA2fpE"}

package/dist/cli/main.js

@@ -12,6 +12,8 @@ import { sanitizeDiagnostic, redactSecrets } from "../log.js";
 import { installProject } from "../install/run.js";
 import { installRegistry } from "../install/registry.js";
 import { readFileSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { createInterface } from "node:readline/promises";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import { runCreate, starterSpecFor } from "../dlx/create.js";
@@ -22,7 +24,7 @@ import { runStoreCommand } from "../commands/store.js";
 import { exitCodeFor, ZyrkError, toZyrkError } from "../errors.js";
 export { ZyrkError };
 import { DEFAULT_REGISTRY, RegistryClient } from "../fetch/registry.js";
-import { resolveStoreRoot } from "../config/paths.js";
+import { findProjectBoundary, resolveStoreRoot } from "../config/paths.js";
 import { Store } from "../store/layout.js";
 import { delegateToNpm, delegatedHelpLines, isDelegatedCommand, } from "./npm-delegate.js";
 import { isGlobalInstallRequest, parseArgs } from "./parse.js";
@@ -89,6 +91,7 @@ export function helpText(version) {
         `zyrk v${version} — one verified store per user, shared across projects through links.`,
         "",
         "Usage: zyrk <command> [args] [--json]",
+        "       zyrk <script> [args]  (shortcut for zyrk run <script> [args])",
         "",
         "Dependency commands:",
     ];
@@ -100,7 +103,7 @@ export function helpText(version) {
     }
     lines.push("", "Registry publishing and account commands (via your npm):");
     lines.push(...delegatedHelpLines());
-    lines.push("", "Install timeouts: ZYRK_RESOLVE_TIMEOUT_MS and ZYRK_EXTRACT_TIMEOUT_MS (1..900000 ms).", "zyrk never installs packages globally and never runs npm to do it.", "Need a global package? Run npm directly: npm install --global <package-spec>");
+    lines.push("", "Install timeouts: ZYRK_RESOLVE_TIMEOUT_MS and ZYRK_EXTRACT_TIMEOUT_MS (1..900000 ms); ZYRK_REQUEST_TIMEOUT_MS (1..3600000 ms); ZYRK_FETCH_TIMEOUT_MS (1..3600000 ms).", "zyrk never installs packages globally and never runs npm to do it.", "Need a global package? Run npm directly: npm install --global <package-spec>");
     return `${lines.join("\n")}\n`;
 }
 function ok(stdout, parsed) {
@@ -212,6 +215,39 @@ function readCliVersion() {
         return "unknown";
     }
 }
+async function promptForBuildApproval(builds, input, output) {
+    output.write("\nDependency lifecycle scripts need approval. Review these exact package sources:\n");
+    builds.forEach((build, index) => {
+        const stages = build.stages
+            .map((stage) => `${stage.name}: ${redactSecrets(stage.command)
+            .replace(/[\x00-\x1f\x7f-\x9f]/g, "")
+            .slice(0, 180)}`)
+            .join("; ");
+        output.write(`  ${index + 1}. ${build.name}@${build.version} (${build.sourceId}) — ${stages}\n`);
+    });
+    output.write("Enter numbers separated by commas to approve selected sources, `all` to approve all listed sources, or press Enter to skip their scripts and continue unbuilt.\n");
+    const prompt = createInterface({
+        input,
+        output: output,
+        terminal: true,
+    });
+    try {
+        const answer = (await prompt.question("Approve builds> ")).trim();
+        if (!answer)
+            return [];
+        if (answer.toLowerCase() === "all")
+            return ["*"];
+        const numbers = answer.split(/[ ,]+/).map((value) => Number(value));
+        if (numbers.some((number) => !Number.isInteger(number) || number < 1 || number > builds.length))
+            throw new ZyrkError("ZYRK_USAGE", "Build selection contains an invalid candidate number.", {
+                remedy: `Select numbers from 1 to ${builds.length}, enter all, or press Enter to skip scripts.`,
+            });
+        return [...new Set(numbers)].map((number) => builds[number - 1].sourceId);
+    }
+    finally {
+        prompt.close();
+    }
+}
 /** Parse, dispatch, delegate, or run a tool, and emit. The only impure seam. */
 export async function runCli(options) {
     const parsed = parseArgs(options.argv);
@@ -464,6 +500,11 @@ export async function runCli(options) {
                 env: options.env,
                 specs,
                 projectDir: cwd,
+                ...(options.stdin?.isTTY && options.stderr.isTTY && !parsed.json
+                    ? {
+                        requestBuildApproval: (builds) => promptForBuildApproval(builds, options.stdin, options.stderr),
+                    }
+                    : {}),
                 ...tools,
             });
             progress.close();
@@ -520,6 +561,11 @@ export async function runCli(options) {
                 projectDir: options.cwd ?? process.cwd(),
                 store: tools.store,
                 registry: tools.registry,
+                ...(options.stdin?.isTTY && options.stderr.isTTY && !parsed.json
+                    ? {
+                        requestBuildApproval: (builds) => promptForBuildApproval(builds, options.stdin, options.stderr),
+                    }
+                    : {}),
             });
             progress.close();
             if (parsed.json) {
@@ -602,6 +648,48 @@ export async function runCli(options) {
             return emit(fail(toZyrkError(error, `zyrk ${parsed.command} failed.`), parsed));
         }
     }
+    // Package scripts are accepted as ergonomic aliases for `zyrk run <name>`.
+    // Route through the same project runner so policy, generation leases,
+    // local-bin PATH and lifecycle environment stay identical.
+    if (!parsed.help &&
+        !parsed.version &&
+        parsed.command !== undefined &&
+        !KNOWN_COMMANDS.has(parsed.command) &&
+        parsed.argsBeforeCommand.length === 0) {
+        const cwd = options.cwd ?? process.cwd();
+        const boundary = await findProjectBoundary(cwd);
+        if (boundary) {
+            let declared = false;
+            try {
+                const manifest = JSON.parse(await readFile(path.join(boundary, "package.json"), "utf8"));
+                if (manifest.scripts !== null &&
+                    typeof manifest.scripts === "object" &&
+                    !Array.isArray(manifest.scripts) &&
+                    typeof manifest.scripts[parsed.command] === "string")
+                    declared = true;
+            }
+            catch {
+                // Preserve the normal unknown-command diagnostic when no valid
+                // project script can be identified.
+            }
+            if (declared) {
+                try {
+                    return await runProjectCommand({
+                        command: "run",
+                        args: [parsed.command, ...parsed.commandArgs],
+                        cwd,
+                        env: options.env,
+                        stdout: options.stdout,
+                        stderr: options.stderr,
+                        json: parsed.json,
+                    });
+                }
+                catch (error) {
+                    return emit(fail(toZyrkError(error, `zyrk ${parsed.command} failed.`), parsed));
+                }
+            }
+        }
+    }
     return emit(dispatch(parsed, { version, env: options.env }));
 }
 async function defaultTools(env, version, cwd = process.cwd()) {

package/dist/commands/dependencies.d.ts

@@ -10,5 +10,6 @@ export declare function runDependencyCommand(options: {
     registry: RegistryClient;
     env?: NodeJS.ProcessEnv;
     onProgress?: InstallOptions["onProgress"];
+    requestBuildApproval?: InstallOptions["requestBuildApproval"];
 }): Promise<InstallResult>;
 //# sourceMappingURL=dependencies.d.ts.map

package/dist/commands/dependencies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../../src/commands/dependencies.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAavE,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,OAAO,EAAE,iBAAiB,CAAC;IAC3B,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC;CAC3C,GAAG,OAAO,CAAC,aAAa,CAAC,CA4HzB"}
+{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../../src/commands/dependencies.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAavE,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,OAAO,EAAE,iBAAiB,CAAC;IAC3B,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC;IAC1C,oBAAoB,CAAC,EAAE,cAAc,CAAC,sBAAsB,CAAC,CAAC;CAC/D,GAAG,OAAO,CAAC,aAAa,CAAC,CA+HzB"}

package/dist/commands/dependencies.js

@@ -16,6 +16,9 @@ export async function runDependencyCommand(options) {
         registry: options.registry,
         ...(options.env ? { env: options.env } : {}),
         ...(options.onProgress ? { onProgress: options.onProgress } : {}),
+        ...(options.requestBuildApproval
+            ? { requestBuildApproval: options.requestBuildApproval }
+            : {}),
     };
     const names = [];
     let from;

package/dist/fetch/registry.d.ts

@@ -13,6 +13,10 @@ import type { Logger } from "../log.ts";
 import { type HashedBytes } from "../util/integrity.ts";
 /** 512 MiB: large for an npm package, small enough to bound mishaps. */
 export declare const DEFAULT_MAX_TARBALL_BYTES: number;
+/** Bounds the complete metadata closure while allowing large framework graphs. */
+export declare const DEFAULT_MAX_TOTAL_METADATA_BYTES: number;
+/** Fifteen minutes per registry operation, including archive transfer. */
+export declare const DEFAULT_REQUEST_DEADLINE_MS = 900000;
 /** Default registry for tool environments (SPEC 13.1). */
 export declare const DEFAULT_REGISTRY = "https://registry.npmjs.org/";
 export interface PackumentDist {
@@ -92,6 +96,10 @@ export declare class RegistryClient {
     packument(name: string, options?: {
         signal?: AbortSignal;
     }): Promise<Packument>;
+    /** Fetch one exact version without transferring every release in a packument. */
+    versionManifest(name: string, version: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<PackumentVersion>;
     /** Registry advisory request; private names may never follow an external redirect. */
     auditAdvisories(packages: Readonly<Record<string, readonly string[]>>, options?: {
         signal?: AbortSignal;

package/dist/fetch/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/fetch/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAc9B,wEAAwE;AACxE,eAAO,MAAM,yBAAyB,QAAoB,CAAC;AAE3D,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB,gCAAgC,CAAC;AAK9D,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,aAAa,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9D,mBAAmB,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC;IACpB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,qBAAa,cAAc;;IAiBzB,YAAY,OAAO,EAAE,qBAAqB,EAuGzC;IAED,+EAA+E;IAC/E,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,2EAA2E;IAC3E,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAKvC;IACD,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9B;IACD,IAAI,gBAAgB,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAIvD;IAED,mEAAmE;IAC7D,SAAS,CACb,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACrC,OAAO,CAAC,SAAS,CAAC,CAsBpB;IAED,sFAAsF;IAChF,eAAe,CACnB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,EACrD,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACrC,OAAO,CAAC,OAAO,CAAC,CA6ClB;IAsCD;;;;OAIG;IACG,eAAe,CAAC,OAAO,EAAE;QAC7B,GAAG,EAAE,MAAM,CAAC;QACZ,6EAA6E;QAC7E,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;QACtC,QAAQ,EAAE,MAAM,CAAC;QACjB,oDAAoD;QACpD,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,gFAAgF;QAChF,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;KACnC,GAAG,OAAO,CAAC,cAAc,CAAC,CA2G1B;CA4MF;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,aAAa,GAClB,MAAM,GAAG,SAAS,CAQpB;AAgDD;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAqB9D"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/fetch/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAc9B,wEAAwE;AACxE,eAAO,MAAM,yBAAyB,QAAoB,CAAC;AAE3D,kFAAkF;AAClF,eAAO,MAAM,gCAAgC,QAAoB,CAAC;AAElE,0EAA0E;AAC1E,eAAO,MAAM,2BAA2B,SAAU,CAAC;AAEnD,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB,gCAAgC,CAAC;AAK9D,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,aAAa,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9D,mBAAmB,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC;IACpB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,qBAAa,cAAc;;IAiBzB,YAAY,OAAO,EAAE,qBAAqB,EAuGzC;IAED,+EAA+E;IAC/E,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,2EAA2E;IAC3E,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAKvC;IACD,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9B;IACD,IAAI,gBAAgB,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAIvD;IAED,mEAAmE;IAC7D,SAAS,CACb,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACrC,OAAO,CAAC,SAAS,CAAC,CAsBpB;IAED,iFAAiF;IAC3E,eAAe,CACnB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACrC,OAAO,CAAC,gBAAgB,CAAC,CAuC3B;IAED,sFAAsF;IAChF,eAAe,CACnB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,EACrD,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACrC,OAAO,CAAC,OAAO,CAAC,CA6ClB;IAsCD;;;;OAIG;IACG,eAAe,CAAC,OAAO,EAAE;QAC7B,GAAG,EAAE,MAAM,CAAC;QACZ,6EAA6E;QAC7E,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;QACtC,QAAQ,EAAE,MAAM,CAAC;QACjB,oDAAoD;QACpD,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,gFAAgF;QAChF,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;KACnC,GAAG,OAAO,CAAC,cAAc,CAAC,CA2G1B;CA+MF;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,aAAa,GAClB,MAAM,GAAG,SAAS,CAQpB;AAgDD;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAqB9D"}

package/dist/fetch/registry.js

@@ -17,6 +17,10 @@ import { assertIntegrityOk, canonicalStrongSri, IntegrityHasher, base64FromHex,
 const transport = createRequire(import.meta.url)("make-fetch-happen");
 /** 512 MiB: large for an npm package, small enough to bound mishaps. */
 export const DEFAULT_MAX_TARBALL_BYTES = 512 * 1024 * 1024;
+/** Bounds the complete metadata closure while allowing large framework graphs. */
+export const DEFAULT_MAX_TOTAL_METADATA_BYTES = 256 * 1024 * 1024;
+/** Fifteen minutes per registry operation, including archive transfer. */
+export const DEFAULT_REQUEST_DEADLINE_MS = 900_000;
 /** Default registry for tool environments (SPEC 13.1). */
 export const DEFAULT_REGISTRY = "https://registry.npmjs.org/";
 /** npm's abbreviated packument media type, used for installs. */
@@ -66,9 +70,9 @@ export class RegistryClient {
             (scope.pathname.startsWith(boundary.pathname) ||
                 boundary.pathname.startsWith(scope.pathname)));
         this.#maxMetadataBytes = positiveLimit(options.maxMetadataBytes ?? 32 * 1024 * 1024, "maxMetadataBytes");
-        this.#maxTotalMetadataBytes = positiveLimit(options.maxTotalMetadataBytes ?? 128 * 1024 * 1024, "maxTotalMetadataBytes");
+        this.#maxTotalMetadataBytes = positiveLimit(options.maxTotalMetadataBytes ?? DEFAULT_MAX_TOTAL_METADATA_BYTES, "maxTotalMetadataBytes");
         this.#maxMetadataVersions = positiveLimit(options.maxMetadataVersions ?? 100_000, "maxMetadataVersions");
-        this.#requestDeadlineMs = positiveLimit(options.requestDeadlineMs ?? 120_000, "requestDeadlineMs");
+        this.#requestDeadlineMs = positiveLimit(options.requestDeadlineMs ?? DEFAULT_REQUEST_DEADLINE_MS, "requestDeadlineMs");
         positiveLimit(this.#maxTarballBytes, "maxTarballBytes");
         this.#signal = options.signal;
         const { scopedRegistries, ...baseOptions } = options;
@@ -143,6 +147,33 @@ export class RegistryClient {
         }
         return validatePackument(raw, name, this.#origin, this.#maxMetadataVersions);
     }
+    /** Fetch one exact version without transferring every release in a packument. */
+    async versionManifest(name, version, options = {}) {
+        const selected = this.forPackage(name);
+        if (selected !== this)
+            return selected.versionManifest(name, version, options);
+        const url = `${this.#registry}${escapePackageName(name)}/${encodeURIComponent(version)}`;
+        this.#logger?.debug("fetching exact version metadata", {
+            name,
+            version,
+            url,
+        });
+        let raw;
+        try {
+            raw = await this.#withRequest(url, `${INSTALL_V1_ACCEPT}, application/json`, (response) => this.#readMetadata(response), options.signal);
+        }
+        catch (error) {
+            throw mapFetchError(error, `fetch metadata for ${name}@${version}`);
+        }
+        const validated = validatePackument({ name, versions: { [version]: raw } }, name, this.#origin, 1);
+        const entry = validated.versions[version];
+        if (entry === undefined)
+            throw new ZyrkError("ZYRK_RESOLUTION_FAILED", `registry has no version ${version} of ${name}`, {
+                detail: { name, version },
+                remedy: "check the requested version exists in the configured registry",
+            });
+        return entry;
+    }
     /** Registry advisory request; private names may never follow an external redirect. */
     async auditAdvisories(packages, options = {}) {
         for (const [name, versions] of Object.entries(packages)) {
@@ -414,7 +445,10 @@ export class RegistryClient {
             throw resourceLimit("redirect count", 10, "registry redirect configuration");
         }
         catch (error) {
-            active?.body.destroy();
+            // A bounded body consumer can stop while the decoder still has source
+            // bytes arriving. Abort the transport before closing the exposed stream
+            // so compressed responses cannot write into a closed decompressor.
+            cancel();
             if (timedOut || signals.some((source) => source.aborted))
                 throw resourceLimit("request deadline or cancellation", this.#requestDeadlineMs, "requestDeadlineMs");
             throw error;

package/dist/install/budgets.d.ts

@@ -3,5 +3,10 @@ import type { ExtractionLimits } from "../extract/tarball.ts";
 export declare function installBudgets(env: NodeJS.ProcessEnv): {
     resolveBudget: Partial<ResolverLimits>;
     extractBudget: Partial<ExtractionLimits>;
+    fetchBudget: {
+        deadlineMs: number;
+    };
 };
+/** Bound slow registry transfers while allowing large framework archives. */
+export declare function registryRequestDeadline(env: NodeJS.ProcessEnv): number;
 //# sourceMappingURL=budgets.d.ts.map

package/dist/install/budgets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"budgets.d.ts","sourceRoot":"","sources":["../../src/install/budgets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAwB9D,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG;IACtD,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACvC,aAAa,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC1C,CASA"}
+{"version":3,"file":"budgets.d.ts","sourceRoot":"","sources":["../../src/install/budgets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAyB9D,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG;IACtD,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACvC,aAAa,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACzC,WAAW,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CACrC,CAYA;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAEtE"}

package/dist/install/budgets.js

@@ -1,15 +1,15 @@
 /** Public, bounded install timeout configuration. Node and byte limits stay intact. */
 import { ZyrkError } from "../errors.js";
-function timeout(env, key, fallback) {
+function timeout(env, key, fallback, maximum = 900000) {
     const raw = env[key];
     if (raw === undefined)
         return fallback;
     if (!/^[0-9]+$/.test(raw) ||
         !Number.isSafeInteger(Number(raw)) ||
         Number(raw) < 1 ||
-        Number(raw) > 900000)
-        throw new ZyrkError("ZYRK_POLICY_DENIED", `Cannot configure install: ${key} must be an integer from 1 to 900000.`, {
-            remedy: `Set ${key} to a timeout in milliseconds from 1 to 900000, or unset it to use the default.`,
+        Number(raw) > maximum)
+        throw new ZyrkError("ZYRK_POLICY_DENIED", `Cannot configure install: ${key} must be an integer from 1 to ${maximum}.`, {
+            remedy: `Set ${key} to a timeout in milliseconds from 1 to ${maximum}, or unset it to use the default.`,
         });
     return Number(raw);
 }
@@ -21,5 +21,12 @@ export function installBudgets(env) {
         extractBudget: {
             maxDurationMs: timeout(env, "ZYRK_EXTRACT_TIMEOUT_MS", 120000),
         },
+        fetchBudget: {
+            deadlineMs: timeout(env, "ZYRK_FETCH_TIMEOUT_MS", 900000, 3600000),
+        },
     };
 }
+/** Bound slow registry transfers while allowing large framework archives. */
+export function registryRequestDeadline(env) {
+    return timeout(env, "ZYRK_REQUEST_TIMEOUT_MS", 900000, 3600000);
+}

package/dist/install/platform.d.ts

@@ -1,5 +1,9 @@
 import { type RuntimePlatform, type FinalizedGraph } from "../resolve/resolver.ts";
 import type { WorkspaceGraph } from "./workspace-graph.ts";
+/** Summarize expected platform filtering without emitting one warning per variant. */
+export declare function platformOmissionSummary(omissions: readonly {
+    name: string;
+}[]): string | undefined;
 export declare function selectPlatformGraph(graph: FinalizedGraph, optionalRoots: ReadonlySet<string>, platform?: RuntimePlatform): FinalizedGraph;
 export declare function selectWorkspacePlatform(graph: WorkspaceGraph, platform?: RuntimePlatform, omitDev?: boolean): WorkspaceGraph;
 //# sourceMappingURL=platform.d.ts.map

package/dist/install/platform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/install/platform.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAuG3D,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,cAAc,EACrB,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,EAClC,QAAQ,kBAAoB,GAC3B,cAAc,CAqBhB;AACD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,cAAc,EACrB,QAAQ,kBAAoB,EAC5B,OAAO,UAAQ,GACd,cAAc,CA+BhB"}
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/install/platform.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D,sFAAsF;AACtF,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,GACrC,MAAM,GAAG,SAAS,CAQpB;AAsGD,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,cAAc,EACrB,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,EAClC,QAAQ,kBAAoB,GAC3B,cAAc,CAqBhB;AACD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,cAAc,EACrB,QAAQ,kBAAoB,EAC5B,OAAO,UAAQ,GACd,cAAc,CA+BhB"}

package/dist/install/platform.js

@@ -3,6 +3,17 @@ import { satisfies } from "semver";
 import { ZyrkError } from "../errors.js";
 import { currentPlatform, } from "../resolve/resolver.js";
 import { lockMismatch } from "./lock.js";
+/** Summarize expected platform filtering without emitting one warning per variant. */
+export function platformOmissionSummary(omissions) {
+    if (omissions.length === 0)
+        return undefined;
+    const packages = new Set(omissions.map((item) => item.name));
+    const entries = omissions.length;
+    const variants = packages.size;
+    const entryLabel = `${entries} platform-specific optional ${entries === 1 ? "dependency" : "dependencies"}`;
+    const packageLabel = `${variants} ${variants === 1 ? "package variant" : "package variants"}`;
+    return `Skipped ${entryLabel} across ${packageLabel}; this is expected when selecting dependencies for the current platform.`;
+}
 function compatible(node, platform) {
     return ([
         [node.platform?.os, platform.os],

package/dist/install/private.d.ts

@@ -12,6 +12,7 @@ export type BuildCandidate = {
         command: string;
     }>;
 };
+export declare const WORKSPACE_POLICY_FILE = "zyrk-workspace.json";
 export declare function candidates(nodes: readonly ResolvedOccurrence[], dirs: ReadonlyMap<string, string>): Promise<BuildCandidate[]>;
 export declare function candidateDigest(graph: GraphDoc, builds: readonly BuildCandidate[], policy: unknown, patches: string): string;
 export declare function approveCandidate(options: {
@@ -21,7 +22,15 @@ export declare function approveCandidate(options: {
     selected: readonly string[];
     env?: NodeJS.ProcessEnv;
     policy?: unknown;
+    portable?: boolean;
 }): Promise<void>;
+export declare function approvedCandidates(options: {
+    project: string;
+    env: NodeJS.ProcessEnv;
+    digest: string;
+    builds: readonly BuildCandidate[];
+    policy: unknown;
+}): Promise<BuildCandidate[]>;
 export declare function assertApproved(options: {
     project: string;
     env: NodeJS.ProcessEnv;

package/dist/install/private.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"private.d.ts","sourceRoot":"","sources":["../../src/install/private.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAG3C,OAAO,EAA2B,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAOjE,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD,CAAC;AAUF,wBAAsB,UAAU,CAC9B,KAAK,EAAE,SAAS,kBAAkB,EAAE,EACpC,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,cAAc,EAAE,CAAC,CA8C3B;AAyBD,wBAAgB,eAAe,CAC7B,KAAK,EAAE,QAAQ,EACf,MAAM,EAAE,SAAS,cAAc,EAAE,EACjC,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,MAAM,GACd,MAAM,CASR;AACD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBhB;AAcD,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgChB;AACD,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;IACb,KAAK,EAAE,QAAQ,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,aAAa,CAAC,CAmGzB;AAID,wBAAsB,YAAY,CAAC,OAAO,EAAE;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACrC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,QAAQ,EAAE,aAAa,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsFhB"}
+{"version":3,"file":"private.d.ts","sourceRoot":"","sources":["../../src/install/private.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAG3C,OAAO,EAA2B,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAOjE,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD,CAAC;AACF,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AAe3D,wBAAsB,UAAU,CAC9B,KAAK,EAAE,SAAS,kBAAkB,EAAE,EACpC,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,cAAc,EAAE,CAAC,CA8C3B;AAyBD,wBAAgB,eAAe,CAC7B,KAAK,EAAE,QAAQ,EACf,MAAM,EAAE,SAAS,cAAc,EAAE,EACjC,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,MAAM,GACd,MAAM,CASR;AACD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgChB;AA0ED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAgC5B;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAYhB;AACD,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;IACb,KAAK,EAAE,QAAQ,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,aAAa,CAAC,CAmGzB;AAID,wBAAsB,YAAY,CAAC,OAAO,EAAE;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACrC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,QAAQ,EAAE,aAAa,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsFhB"}

package/dist/install/private.js

@@ -13,6 +13,7 @@ import { canonicalJson } from "../util/json.js";
 import { isErrno, pathExists, writeFileAtomic } from "../util/fsx.js";
 import { superviseChild } from "../util/proc.js";
 import { redactSecrets } from "../log.js";
+export const WORKSPACE_POLICY_FILE = "zyrk-workspace.json";
 function fail(message) {
     throw new ZyrkError("ZYRK_SCRIPT_BLOCKED", message, {
         remedy: "Review the exact candidate with zyrk approve-builds, then explicitly approve its package names. Mandatory denials cannot be overridden.",
@@ -93,16 +94,62 @@ export async function approveCandidate(options) {
     const selected = new Set(options.selected);
     const all = selected.has("*");
     for (const name of selected)
-        if (name !== "*" && !options.builds.some((b) => b.name === name))
+        if (name !== "*" &&
+            !options.builds.some((b) => b.name === name || b.sourceId === name))
             fail("An approval selector does not match a reviewed build candidate.");
     await writeFileAtomic(path.join(options.project, ".zyrk-local", "approvals.json"), JSON.stringify({
         schemaVersion: 1,
         candidate: options.digest,
         sources: options.builds
-            .filter((b) => all || selected.has(b.name))
+            .filter((b) => all || selected.has(b.name) || selected.has(b.sourceId))
             .map((b) => b.sourceId)
             .sort(),
     }), { mode: 0o600 });
+    if (options.portable) {
+        const selectedBuilds = options.builds.filter((build) => all || selected.has(build.name) || selected.has(build.sourceId));
+        await writePortableApprovals(options.project, selectedBuilds);
+    }
+}
+async function readPortableApprovals(project) {
+    const file = path.join(project, WORKSPACE_POLICY_FILE);
+    let raw;
+    try {
+        const stat = await lstat(file);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            fail("The workspace build-approval file must be a regular file.");
+        raw = JSON.parse(await readFile(file, "utf8"));
+    }
+    catch (cause) {
+        if (cause instanceof ZyrkError)
+            throw cause;
+        if (isErrno(cause, "ENOENT"))
+            return [];
+        fail("The workspace build-approval file is unreadable or malformed.");
+    }
+    if (!object(raw) ||
+        raw.schemaVersion !== 1 ||
+        !Array.isArray(raw.approvedBuilds) ||
+        raw.approvedBuilds.some((item) => !object(item) ||
+            typeof item.name !== "string" ||
+            typeof item.version !== "string" ||
+            typeof item.sourceId !== "string" ||
+            !/^src1_[a-f0-9]{40}$/.test(item.sourceId)))
+        fail("The workspace build-approval file has an unsupported format.");
+    return raw.approvedBuilds;
+}
+async function writePortableApprovals(project, selected) {
+    const current = await readPortableApprovals(project);
+    const bySource = new Map(current.map((item) => [item.sourceId, item]));
+    for (const build of selected)
+        bySource.set(build.sourceId, {
+            name: build.name,
+            version: build.version,
+            sourceId: build.sourceId,
+        });
+    await writeFileAtomic(path.join(project, WORKSPACE_POLICY_FILE), `${JSON.stringify({
+        schemaVersion: 1,
+        approvedBuilds: [...bySource.values()].sort((a, b) => a.name.localeCompare(b.name)),
+    }, null, 2)}\n`, { mode: 0o644 });
 }
 async function readUserPolicy(env) {
     let user = {};
@@ -117,9 +164,9 @@ async function readUserPolicy(env) {
         fail("Mandatory user build policy is malformed.");
     return user;
 }
-export async function assertApproved(options) {
+export async function approvedCandidates(options) {
     if (!options.builds.length)
-        return;
+        return [];
     const user = await readUserPolicy(options.env);
     let local;
     try {
@@ -133,19 +180,29 @@ export async function assertApproved(options) {
             throw cause;
         local = undefined;
     }
-    for (const build of options.builds) {
+    const portable = await readPortableApprovals(options.project);
+    return options.builds.filter((build) => {
         if (denied(user.scripts, build) || denied(options.policy, build))
-            fail(`Build of ${build.name}@${build.version} is denied by policy.`);
-        const portable = object(options.policy) &&
+            return false;
+        const manifestAllowed = object(options.policy) &&
             Array.isArray(options.policy.allow) &&
             options.policy.allow.includes(build.sourceId);
-        if (!portable &&
-            (!object(local) ||
-                local.schemaVersion !== 1 ||
-                local.candidate !== options.digest ||
-                !Array.isArray(local.sources) ||
-                !local.sources.includes(build.sourceId)))
-            fail(`Build of ${build.name}@${build.version} has not been approved for this exact candidate.`);
+        const workspaceAllowed = portable.some((approval) => approval.sourceId === build.sourceId);
+        const localAllowed = object(local) &&
+            local.schemaVersion === 1 &&
+            local.candidate === options.digest &&
+            Array.isArray(local.sources) &&
+            local.sources.includes(build.sourceId);
+        return manifestAllowed || workspaceAllowed || localAllowed;
+    });
+}
+export async function assertApproved(options) {
+    const approved = await approvedCandidates(options);
+    if (approved.length !== options.builds.length) {
+        const pending = options.builds.find((build) => !approved.some((item) => item.sourceId === build.sourceId));
+        fail(pending
+            ? `Build of ${pending.name}@${pending.version} has not been approved for this exact source.`
+            : "Not every dependency build candidate is approved.");
     }
 }
 export async function materializePrivate(options) {

package/dist/install/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/install/registry.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,cAAc,EAAoB,MAAM,sBAAsB,CAAC;AAKxE,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,cAAc,CAAC,CAuI1B"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/install/registry.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,cAAc,EAAoB,MAAM,sBAAsB,CAAC;AAMxE,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,cAAc,CAAC,CAwI1B"}

package/dist/install/registry.js

@@ -8,6 +8,7 @@ import { RegistryClient, DEFAULT_REGISTRY } from "../fetch/registry.js";
 import { isErrno } from "../util/fsx.js";
 import { findProjectBoundary } from "../config/paths.js";
 import { cleanUrl } from "./lock.js";
+import { registryRequestDeadline } from "./budgets.js";
 export async function installRegistry(options) {
     let registry = DEFAULT_REGISTRY;
     const auth = {};
@@ -97,6 +98,7 @@ export async function installRegistry(options) {
     return new RegistryClient({
         registry,
         scopedRegistries,
+        requestDeadlineMs: registryRequestDeadline(options.env),
         userAgent: `zyrk/${options.version}`,
         fetchOptions: auth,
     });

package/dist/install/run.d.ts

@@ -43,6 +43,7 @@ export type InstallOptions = {
     env?: NodeJS.ProcessEnv;
     reviewBuilds?: boolean;
     approveBuilds?: readonly string[];
+    requestBuildApproval?: (builds: readonly BuildCandidate[]) => Promise<readonly string[]>;
     rebuild?: boolean;
     repair?: boolean;
     resolveBudget?: Partial<ResolverLimits>;

package/dist/install/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/install/run.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAK9D,OAAO,EAOL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAYtB,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AA+B3C,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EACD,UAAU,GACV,WAAW,GACX,UAAU,GACV,WAAW,GACX,UAAU,GACV,SAAS,GACT,UAAU,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,aAAa,GAAG,YAAY,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AACF,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACxC,aAAa,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1C,WAAW,CAAC,EAAE;QACZ,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,CAAC;AACF,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EACL,OAAO,GACP,uBAAuB,GACvB,eAAe,GACf,SAAS,GACT,cAAc,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;CAC3B,CAAC;AA4GF,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAiyBxB"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/install/run.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAK9D,OAAO,EAOL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAYtB,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AA+B3C,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EACD,UAAU,GACV,WAAW,GACX,UAAU,GACV,WAAW,GACX,UAAU,GACV,SAAS,GACT,UAAU,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,aAAa,GAAG,YAAY,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AACF,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,oBAAoB,CAAC,EAAE,CACrB,MAAM,EAAE,SAAS,cAAc,EAAE,KAC9B,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACxC,aAAa,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1C,WAAW,CAAC,EAAE;QACZ,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,CAAC;AACF,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EACL,OAAO,GACP,uBAAuB,GACvB,eAAe,GACf,SAAS,GACT,cAAc,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;CAC3B,CAAC;AA4GF,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAq0BxB"}

package/dist/install/run.js

@@ -1,10 +1,10 @@
 import { sourceProgress, reportLinked } from "./progress.js";
-import { selectPlatformGraph } from "./platform.js";
+import { platformOmissionSummary, selectPlatformGraph } from "./platform.js";
 import { findWorkspaceRoot } from "./workspaces.js";
 import { assertSupportedSourcePayload } from "./source-policy.js";
 import { prepareRepair } from "./repair.js";
 import { createFetchOperation } from "../fetch/package.js";
-import { candidates, candidateDigest, approveCandidate, assertApproved, materializePrivate, buildPrivate, } from "./private.js";
+import { candidates, candidateDigest, approveCandidate, approvedCandidates, materializePrivate, buildPrivate, } from "./private.js";
 import { loadProjectPatches, applyProjectPatches } from "../commands/patch.js";
 import { registerGeneration } from "./metadata.js";
 import { randomId } from "../util/ids.js";
@@ -102,6 +102,7 @@ export async function installProject(options) {
         ...options,
         resolveBudget: { ...budgets.resolveBudget, ...options.resolveBudget },
         extractBudget: { ...budgets.extractBudget, ...options.extractBudget },
+        fetchBudget: { ...budgets.fetchBudget, ...options.fetchBudget },
     };
     if (await findWorkspaceRoot(options.projectDir)) {
         const { installWorkspaceProject } = await import("./workspace-install.js");
@@ -272,6 +273,9 @@ export async function installProject(options) {
                     packument: (name) => options.registry.packument(name, {
                         signal: operation.operation.signal,
                     }),
+                    versionManifest: (name, version) => options.registry.versionManifest(name, version, {
+                        signal: operation.operation.signal,
+                    }),
                 },
                 requirements: Object.entries(allDeps)
                     .map(([name, spec]) => {
@@ -416,7 +420,10 @@ export async function installProject(options) {
                 name: "package.json",
                 contents: `${JSON.stringify(manifest, null, 2)}\n`,
             });
-        const warnings = (activeResolution.omissions ?? []).map((item) => `${item.name}: omitted optional dependency incompatible with the selected platform.`);
+        const warnings = [];
+        const omissionSummary = platformOmissionSummary(activeResolution.omissions ?? []);
+        if (omissionSummary)
+            warnings.push(omissionSummary);
         for (const stage of ["preinstall", "install", "postinstall"])
             if (manifest.scripts?.[stage])
                 warnings.push(`Root ${stage} hook was not run; invoke it explicitly after installation.`);
@@ -549,6 +556,7 @@ export async function installProject(options) {
                     selected: options.approveBuilds,
                     env: options.env ?? process.env,
                     policy: scriptPolicy(manifest),
+                    portable: true,
                 });
             return {
                 readiness: "build-review",
@@ -559,15 +567,37 @@ export async function installProject(options) {
                 builds,
             };
         }
-        const unbuilt = builds.length > 0 && options.ignoreScripts === true;
+        let approvedBuilds = [];
         if (builds.length && !options.ignoreScripts) {
-            await assertApproved({
+            const approvalOptions = {
                 project,
                 env: options.env ?? process.env,
                 digest: reviewedDigest,
                 builds,
                 policy: scriptPolicy(manifest),
-            });
+            };
+            approvedBuilds = await approvedCandidates(approvalOptions);
+            if (approvedBuilds.length < builds.length &&
+                options.requestBuildApproval) {
+                const pending = builds.filter((build) => !approvedBuilds.some((item) => item.sourceId === build.sourceId));
+                const selected = await options.requestBuildApproval(pending);
+                if (selected.length) {
+                    await approveCandidate({
+                        project,
+                        digest: reviewedDigest,
+                        builds: pending,
+                        selected,
+                        env: options.env ?? process.env,
+                        policy: scriptPolicy(manifest),
+                        portable: true,
+                    });
+                    approvedBuilds = await approvedCandidates(approvalOptions);
+                }
+            }
+        }
+        const unbuilt = builds.length > 0 &&
+            (options.ignoreScripts === true || approvedBuilds.length < builds.length);
+        if (approvedBuilds.length && !options.ignoreScripts) {
             if (!privateGraph) {
                 realized = await materializePrivate({
                     project,
@@ -582,7 +612,7 @@ export async function installProject(options) {
                 project,
                 generationId,
                 nodes: activeNodes,
-                builds,
+                builds: approvedBuilds,
                 realized,
                 env: options.env ?? process.env,
             });
@@ -606,9 +636,10 @@ export async function installProject(options) {
                 privateGraph = true;
             }
         }
-        if (unbuilt)
-            for (const build of builds)
-                warnings.push(`${build.name}@${build.version}: skipped ${build.stages.map((s) => s.name).join(", ")}; intentionally unbuilt.`);
+        if (unbuilt) {
+            const skipped = builds.length - approvedBuilds.length;
+            warnings.push(`${skipped} dependency build ${skipped === 1 ? "script was" : "scripts were"} skipped because approval was not granted; readiness is intentionally unbuilt. Run zyrk approve-builds to review and approve sources.`);
+        }
         if (privateGraph)
             warnings.push("Using a complete project-private dependency graph; build/runtime writes do not change shared source.");
         const entries = selectedRoots.map((r) => ({

package/dist/install/workspace-install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-install.d.ts","sourceRoot":"","sources":["../../src/install/workspace-install.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAuH9D,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAqrBxB"}
+{"version":3,"file":"workspace-install.d.ts","sourceRoot":"","sources":["../../src/install/workspace-install.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAuH9D,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAqtBxB"}

package/dist/install/workspace-install.js

@@ -1,5 +1,5 @@
 import { sourceProgress, reportLinked } from "./progress.js";
-import { selectWorkspacePlatform } from "./platform.js";
+import { platformOmissionSummary, selectWorkspacePlatform, } from "./platform.js";
 /** Multi-importer live workspace installation with one publication journal. */
 import { chmod, copyFile, lstat, mkdir, readFile, realpath, rename, rm, symlink, } from "node:fs/promises";
 import { constants } from "node:fs";
@@ -32,7 +32,7 @@ import { loadProjectPatches, applyProjectPatches } from "../commands/patch.js";
 import { prepareRepair } from "./repair.js";
 import { assertSupportedSourcePayload } from "./source-policy.js";
 import { registerGeneration } from "./metadata.js";
-import { candidates, candidateDigest, approveCandidate, assertApproved, buildPrivate, } from "./private.js";
+import { candidates, candidateDigest, approveCandidate, approvedCandidates, buildPrivate, } from "./private.js";
 const object = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 const unsupported = (message) => {
     throw new ZyrkError("ZYRK_NOT_IMPLEMENTED", message, {
@@ -191,7 +191,10 @@ export async function installWorkspaceProject(options) {
             ? await readFile(path.join(root, "package-lock.json"), "utf8")
             : JSON.stringify(doc, null, 2) + "\n";
         graph = selectWorkspacePlatform(graph, options.platform, options.omitDev);
-        const warnings = graph.omissions.map((o) => `${o.name}: omitted incompatible optional workspace dependency.`);
+        const warnings = [];
+        const omissionSummary = platformOmissionSummary(graph.omissions);
+        if (omissionSummary)
+            warnings.push(omissionSummary);
         for (const importer of project.importers)
             for (const stage of ["preinstall", "install", "postinstall"])
                 if (importer.manifest.scripts?.[stage])
@@ -441,6 +444,7 @@ export async function installWorkspaceProject(options) {
                     selected: options.approveBuilds,
                     env: options.env ?? process.env,
                     policy,
+                    portable: true,
                 });
             return {
                 readiness: "build-review",
@@ -451,14 +455,38 @@ export async function installWorkspaceProject(options) {
                 builds,
             };
         }
+        let approvedBuilds = [];
         if (builds.length && !options.ignoreScripts) {
-            await assertApproved({
+            const approvalOptions = {
                 project: root,
                 env: options.env ?? process.env,
                 digest,
                 builds,
                 policy,
-            });
+            };
+            approvedBuilds = await approvedCandidates(approvalOptions);
+            if (approvedBuilds.length < builds.length &&
+                options.requestBuildApproval) {
+                const pending = builds.filter((build) => !approvedBuilds.some((item) => item.sourceId === build.sourceId));
+                const selected = await options.requestBuildApproval(pending);
+                if (selected.length) {
+                    await approveCandidate({
+                        project: root,
+                        digest,
+                        builds: pending,
+                        selected,
+                        env: options.env ?? process.env,
+                        policy,
+                        portable: true,
+                    });
+                    approvedBuilds = await approvedCandidates(approvalOptions);
+                }
+            }
+        }
+        const skippedBuilds = builds.length - approvedBuilds.length;
+        if (skippedBuilds > 0)
+            warnings.push(`${skippedBuilds} dependency build ${skippedBuilds === 1 ? "script was" : "scripts were"} skipped because approval was not granted; readiness is intentionally unbuilt. Run zyrk approve-builds to review and approve sources.`);
+        if (approvedBuilds.length && !options.ignoreScripts) {
             // Approved writes need a coherent fully private registry closure.
             await allocatePrivate(new Set(nodes.map((n) => n.key)));
             options.onProgress?.({ phase: "building" });
@@ -466,12 +494,12 @@ export async function installWorkspaceProject(options) {
                 project: root,
                 generationId,
                 nodes,
-                builds,
+                builds: approvedBuilds,
                 realized,
                 env: options.env ?? process.env,
             });
         }
-        const readiness = builds.length && options.ignoreScripts
+        const readiness = builds.length && (options.ignoreScripts || skippedBuilds > 0)
             ? "intentionally-unbuilt"
             : "ready";
         registration = await registerGeneration({

package/dist/lockfile/write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"write.d.ts","sourceRoot":"","sources":["../../src/lockfile/write.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGjE,OAAO,EAGL,KAAK,UAAU,EAGhB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC1D,QAAQ,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,mBAAmB,CAAC;IAChC,YAAY,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,eAAe,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;CACzB,CAAC;AAEF,wBAAsB,aAAa,CACjC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,UAAU,CAAC,CAqOrB"}
+{"version":3,"file":"write.d.ts","sourceRoot":"","sources":["../../src/lockfile/write.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGjE,OAAO,EAGL,KAAK,UAAU,EAGhB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC1D,QAAQ,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,mBAAmB,CAAC;IAChC,YAAY,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,eAAe,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;CACzB,CAAC;AAEF,wBAAsB,aAAa,CACjC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,UAAU,CAAC,CAqPrB"}

package/dist/lockfile/write.js

@@ -94,7 +94,23 @@ export async function writeLockfile(options) {
                         : `npm:${target.name}@${target.version}`;
             }
         }
+        const npmMetadata = {};
+        const existingEntry = existingPackages[location];
+        if (existingEntry !== undefined) {
+            for (const field of [
+                "license",
+                "funding",
+                "deprecated",
+                "hasInstallScript",
+                "inBundle",
+            ]) {
+                if (Object.hasOwn(existingEntry, field)) {
+                    npmMetadata[field] = existingEntry[field];
+                }
+            }
+        }
         packages[location] = {
+            ...npmMetadata,
             name: node.name,
             version: node.version,
             resolved: node.tarballUrl,

package/dist/resolve/resolver.d.ts

@@ -1,9 +1,10 @@
-import { type Packument } from "../fetch/registry.ts";
+import { type Packument, type PackumentVersion } from "../fetch/registry.ts";
 import { type OverridePolicy } from "./overrides.ts";
 export type MetadataProvider = {
     readonly origin: string;
     originFor?(name: string): string;
     packument(name: string): Promise<Packument>;
+    versionManifest?(name: string, version: string): Promise<PackumentVersion>;
 };
 export type EdgeKind = "prod" | "optional" | "peer";
 export type ResolvedEdge = {

package/dist/resolve/resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/resolve/resolver.ts"],"names":[],"mappings":"AAyBA,OAAO,EAEL,KAAK,SAAS,EAEf,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;AAEpD,MAAM,MAAM,YAAY,GAAG;IACzB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,YAAY,EAAE,KAAK,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC,CAAC;IACH,QAAQ,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACxE,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACzE,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,eAAe,IAAI,eAAe,CAcjD;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACjC,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,oDAAoD;IACpD,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD,CAAC;AAEF,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAmCzB"}
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/resolve/resolver.ts"],"names":[],"mappings":"AAyBA,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,gBAAgB,EACtB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,eAAe,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC5E,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;AAEpD,MAAM,MAAM,YAAY,GAAG;IACzB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,YAAY,EAAE,KAAK,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC,CAAC;IACH,QAAQ,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACxE,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACzE,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,eAAe,IAAI,eAAe,CAcjD;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACjC,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,oDAAoD;IACpD,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD,CAAC;AAEF,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAmCzB"}

package/dist/resolve/resolver.js

@@ -70,6 +70,7 @@ class ResolverState {
     provider;
     overrides;
     packuments = new Map();
+    versionManifests = new Map();
     peerless = new Map();
     peerBearing = new Map();
     freshPeers = new Map();
@@ -142,6 +143,23 @@ class ResolverState {
         this.packuments.set(name, pending);
         return pending;
     }
+    versionManifestOf(name, version) {
+        const key = `${name}\0${version}`;
+        const cached = this.versionManifests.get(key);
+        if (cached !== undefined)
+            return cached;
+        this.checkBudget();
+        let timer;
+        const deadline = new Promise((_resolve, reject) => {
+            timer = setTimeout(() => reject(budgetError("resolution deadline exceeded")), Math.max(1, this.expires - Date.now()));
+        });
+        const pending = Promise.race([
+            this.provider.versionManifest(name, version),
+            deadline,
+        ]).finally(() => clearTimeout(timer));
+        this.versionManifests.set(key, pending);
+        return pending;
+    }
     /**
      * Build (or reuse) the occurrence for one dependency edge. Peerless
      * packages share one occurrence per name@version; packages declaring
@@ -442,6 +460,21 @@ class ResolverState {
 // Version selection
 // ---------------------------------------------------------------------------
 async function selectVersion(state, req) {
+    if (req.targetKind === "exact" && state.provider.versionManifest) {
+        try {
+            return {
+                version: req.targetSpec,
+                entry: await state.versionManifestOf(req.realName, req.targetSpec),
+            };
+        }
+        catch (error) {
+            // Registries and older test adapters may expose only packuments. Keep
+            // the optimization opportunistic when the exact endpoint is absent.
+            if (!(error instanceof ZyrkError) || error.detail?.status !== 404) {
+                throw error;
+            }
+        }
+    }
     const packument = await state.packumentOf(req.realName);
     const fail = (message, remedy) => new ZyrkError("ZYRK_RESOLUTION_FAILED", message, {
         detail: { name: req.realName, spec: req.targetSpec },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zyrk",
-  "version": "0.6.6",
+  "version": "0.7.1",
   "description": "Storage-efficient Node package manager: one verified store per user, shared across projects through links.",
   "license": "MIT",
   "type": "module",
@@ -20,7 +20,7 @@
     "version:bump": "node scripts/bump-version.js",
     "setup:hooks": "git config core.hooksPath .githooks",
     "build": "tsc -p tsconfig.build.json",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "node bin/zyrk.js run build"
   },
   "dependencies": {
     "make-fetch-happen": "16.0.1",