zyrk 0.6.9 → 0.7.0

package/README.md

@@ -105,9 +105,11 @@ Manifest, lock, and projection changes are journaled for process-crash recovery;
 a failed resolution, verification, or build-policy check keeps the prior graph.
 
 Dependency `preinstall`, `install`, and `postinstall` scripts (plus implicit
-`binding.gyp` builds) are supported and run during `zyrk install` after you
-approve the exact reviewed candidates. Unreviewed package code stays blocked.
-Review first, trust the selected sources, then install:
+`binding.gyp` builds) are supported. In an interactive terminal, `zyrk install`
+shows the exact candidates and lets you select which scripts to run. Press Enter
+to skip all pending scripts and continue with an intentionally unbuilt install.
+Headless installs also skip unapproved scripts and report that readiness state.
+Review candidates separately with:
 
 ```bash
 zyrk approve-builds                # inspect exact sources and commands; executes no package code
@@ -117,8 +119,12 @@ zyrk rebuild --offline             # rebuild the complete approved locked graph
 ```
 
 Approvals are local to the exact graph, sources, patch contents, and script
-policy. Mandatory user denies override project approvals. Approved scripts run
-with your account's permissions; permission is not a sandbox. Packages that need
+policy. Interactive selections are written to the checked-in
+`zyrk-workspace.json` file with exact package source identities, so collaborators
+can reuse the review alongside the lockfile. Manual `zyrk approve-builds
+<package>` approvals are recorded there too. Mandatory user denies override
+project approvals. Approved scripts run with your account's permissions;
+permission is not a sandbox. Packages that need
 writes use a complete private dependency generation under `.zyrk-local/`, with
 independent writable files and dependency links confined to that generation.
 Build failure keeps the previous project graph active. `--ignore-scripts`
@@ -127,6 +133,12 @@ hooks never run automatically. A project can request runtime writable packages
 with `"zyrk": { "mutablePackages": ["package-name"] }`; this also uses a complete
 private graph.
 
+`zyrk-workspace.json` is portable review state, not a machine-specific store
+manifest. It records each approved package name, version, and exact source ID;
+the file can be committed with `package-lock.json` so collaborators do not have
+to repeat the same approval for the same verified source. User-level denials
+still take precedence.
+
 ### Run project scripts
 
 Use `zyrk run <script>` or the package-manager shortcut `zyrk <script>`; both
@@ -413,11 +425,11 @@ The commit hook runs the full check gate, increments the version in
 `package.json`, `package-lock.json`, and `VERSION`, and creates a matching version
 tag after the commit. Keep changes focused and never bypass the hooks.
 
-CI checks pushed commits and pull requests. The separate
-[npm publishing action](.github/workflows/npm-publish.yml) is triggered when a
-GitHub release is published. It verifies the release tag, formatting, typecheck,
-build, and tests, then publishes that exact commit. Ordinary commits do not
-publish packages. Dependabot and a scheduled advisory check supplement CI; an
+CI checks pushed commits and pull requests. The
+[npm publishing action](.github/workflows/npm-publish.yml) runs when the commit
+hook's version tag is pushed, verifies formatting, typecheck, build, tests, and
+the tag/version match, then publishes that exact commit. A manual workflow
+dispatch can publish a prior version tag for release backfills. Dependabot and a scheduled advisory check supplement CI; an
 unavailable advisory service fails separately from a clean result.
 
 The contributor guide is [AGENTS.md](AGENTS.md). Bug reports and reproducible

package/VERSION

@@ -1 +1 @@
-v0.6.9
+v0.7.0

package/bin/zyrk.js

@@ -12,6 +12,7 @@ const { runCli } = await import(
 process.exitCode = await runCli({
   argv: process.argv.slice(2),
   env: process.env,
+  stdin: process.stdin,
   stdout: process.stdout,
   stderr: process.stderr,
 });

package/dist/cli/main.d.ts

@@ -25,6 +25,7 @@ export type ToolEnvironment = {
 export type RunCliOptions = {
     argv: readonly string[];
     env: NodeJS.ProcessEnv;
+    stdin?: NodeJS.ReadStream;
     stdout: {
         write(chunk: string): unknown;
     };

package/dist/cli/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAe,SAAS,EAAe,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,CAAC;AACrB,OAAO,EAAoB,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAExE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAM3C,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAEhF,eAAO,MAAM,uBAAuB,IAAI,CAAC;AA6DzC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA0BhD;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AA6EF;;;GAGG;AACH,wBAAgB,QAAQ,CACtB,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,GACnD,SAAS,CAgDX;AAmBD,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1C,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3D,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;CACxC,CAAC;AAEF,gFAAgF;AAChF,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CA+epE"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAe,SAAS,EAAe,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,CAAC;AACrB,OAAO,EAAoB,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAExE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAM3C,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAEhF,eAAO,MAAM,uBAAuB,IAAI,CAAC;AA6DzC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA0BhD;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AA6EF;;;GAGG;AACH,wBAAgB,QAAQ,CACtB,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,GACnD,SAAS,CAgDX;AAmBD,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC1B,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1C,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3D,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;CACxC,CAAC;AAuDF,gFAAgF;AAChF,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CA2fpE"}

package/dist/cli/main.js

@@ -13,6 +13,7 @@ import { installProject } from "../install/run.js";
 import { installRegistry } from "../install/registry.js";
 import { readFileSync } from "node:fs";
 import { readFile } from "node:fs/promises";
+import { createInterface } from "node:readline/promises";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import { runCreate, starterSpecFor } from "../dlx/create.js";
@@ -214,6 +215,39 @@ function readCliVersion() {
         return "unknown";
     }
 }
+async function promptForBuildApproval(builds, input, output) {
+    output.write("\nDependency lifecycle scripts need approval. Review these exact package sources:\n");
+    builds.forEach((build, index) => {
+        const stages = build.stages
+            .map((stage) => `${stage.name}: ${redactSecrets(stage.command)
+            .replace(/[\x00-\x1f\x7f-\x9f]/g, "")
+            .slice(0, 180)}`)
+            .join("; ");
+        output.write(`  ${index + 1}. ${build.name}@${build.version} (${build.sourceId}) — ${stages}\n`);
+    });
+    output.write("Enter numbers separated by commas to approve selected sources, `all` to approve all listed sources, or press Enter to skip their scripts and continue unbuilt.\n");
+    const prompt = createInterface({
+        input,
+        output: output,
+        terminal: true,
+    });
+    try {
+        const answer = (await prompt.question("Approve builds> ")).trim();
+        if (!answer)
+            return [];
+        if (answer.toLowerCase() === "all")
+            return ["*"];
+        const numbers = answer.split(/[ ,]+/).map((value) => Number(value));
+        if (numbers.some((number) => !Number.isInteger(number) || number < 1 || number > builds.length))
+            throw new ZyrkError("ZYRK_USAGE", "Build selection contains an invalid candidate number.", {
+                remedy: `Select numbers from 1 to ${builds.length}, enter all, or press Enter to skip scripts.`,
+            });
+        return [...new Set(numbers)].map((number) => builds[number - 1].sourceId);
+    }
+    finally {
+        prompt.close();
+    }
+}
 /** Parse, dispatch, delegate, or run a tool, and emit. The only impure seam. */
 export async function runCli(options) {
     const parsed = parseArgs(options.argv);
@@ -466,6 +500,11 @@ export async function runCli(options) {
                 env: options.env,
                 specs,
                 projectDir: cwd,
+                ...(options.stdin?.isTTY && options.stderr.isTTY && !parsed.json
+                    ? {
+                        requestBuildApproval: (builds) => promptForBuildApproval(builds, options.stdin, options.stderr),
+                    }
+                    : {}),
                 ...tools,
             });
             progress.close();
@@ -522,6 +561,11 @@ export async function runCli(options) {
                 projectDir: options.cwd ?? process.cwd(),
                 store: tools.store,
                 registry: tools.registry,
+                ...(options.stdin?.isTTY && options.stderr.isTTY && !parsed.json
+                    ? {
+                        requestBuildApproval: (builds) => promptForBuildApproval(builds, options.stdin, options.stderr),
+                    }
+                    : {}),
             });
             progress.close();
             if (parsed.json) {

package/dist/commands/dependencies.d.ts

@@ -10,5 +10,6 @@ export declare function runDependencyCommand(options: {
     registry: RegistryClient;
     env?: NodeJS.ProcessEnv;
     onProgress?: InstallOptions["onProgress"];
+    requestBuildApproval?: InstallOptions["requestBuildApproval"];
 }): Promise<InstallResult>;
 //# sourceMappingURL=dependencies.d.ts.map

package/dist/commands/dependencies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../../src/commands/dependencies.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAavE,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,OAAO,EAAE,iBAAiB,CAAC;IAC3B,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC;CAC3C,GAAG,OAAO,CAAC,aAAa,CAAC,CA4HzB"}
+{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../../src/commands/dependencies.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAavE,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,OAAO,EAAE,iBAAiB,CAAC;IAC3B,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC;IAC1C,oBAAoB,CAAC,EAAE,cAAc,CAAC,sBAAsB,CAAC,CAAC;CAC/D,GAAG,OAAO,CAAC,aAAa,CAAC,CA+HzB"}

package/dist/commands/dependencies.js

@@ -16,6 +16,9 @@ export async function runDependencyCommand(options) {
         registry: options.registry,
         ...(options.env ? { env: options.env } : {}),
         ...(options.onProgress ? { onProgress: options.onProgress } : {}),
+        ...(options.requestBuildApproval
+            ? { requestBuildApproval: options.requestBuildApproval }
+            : {}),
     };
     const names = [];
     let from;

package/dist/install/private.d.ts

@@ -12,6 +12,7 @@ export type BuildCandidate = {
         command: string;
     }>;
 };
+export declare const WORKSPACE_POLICY_FILE = "zyrk-workspace.json";
 export declare function candidates(nodes: readonly ResolvedOccurrence[], dirs: ReadonlyMap<string, string>): Promise<BuildCandidate[]>;
 export declare function candidateDigest(graph: GraphDoc, builds: readonly BuildCandidate[], policy: unknown, patches: string): string;
 export declare function approveCandidate(options: {
@@ -21,7 +22,15 @@ export declare function approveCandidate(options: {
     selected: readonly string[];
     env?: NodeJS.ProcessEnv;
     policy?: unknown;
+    portable?: boolean;
 }): Promise<void>;
+export declare function approvedCandidates(options: {
+    project: string;
+    env: NodeJS.ProcessEnv;
+    digest: string;
+    builds: readonly BuildCandidate[];
+    policy: unknown;
+}): Promise<BuildCandidate[]>;
 export declare function assertApproved(options: {
     project: string;
     env: NodeJS.ProcessEnv;

package/dist/install/private.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"private.d.ts","sourceRoot":"","sources":["../../src/install/private.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAG3C,OAAO,EAA2B,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAOjE,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD,CAAC;AAUF,wBAAsB,UAAU,CAC9B,KAAK,EAAE,SAAS,kBAAkB,EAAE,EACpC,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,cAAc,EAAE,CAAC,CA8C3B;AAyBD,wBAAgB,eAAe,CAC7B,KAAK,EAAE,QAAQ,EACf,MAAM,EAAE,SAAS,cAAc,EAAE,EACjC,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,MAAM,GACd,MAAM,CASR;AACD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBhB;AAcD,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgChB;AACD,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;IACb,KAAK,EAAE,QAAQ,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,aAAa,CAAC,CAmGzB;AAID,wBAAsB,YAAY,CAAC,OAAO,EAAE;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACrC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,QAAQ,EAAE,aAAa,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsFhB"}
+{"version":3,"file":"private.d.ts","sourceRoot":"","sources":["../../src/install/private.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAG3C,OAAO,EAA2B,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAOjE,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD,CAAC;AACF,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AAe3D,wBAAsB,UAAU,CAC9B,KAAK,EAAE,SAAS,kBAAkB,EAAE,EACpC,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,cAAc,EAAE,CAAC,CA8C3B;AAyBD,wBAAgB,eAAe,CAC7B,KAAK,EAAE,QAAQ,EACf,MAAM,EAAE,SAAS,cAAc,EAAE,EACjC,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,MAAM,GACd,MAAM,CASR;AACD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgChB;AA0ED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAgC5B;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAYhB;AACD,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;IACb,KAAK,EAAE,QAAQ,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,aAAa,CAAC,CAmGzB;AAID,wBAAsB,YAAY,CAAC,OAAO,EAAE;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACrC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,QAAQ,EAAE,aAAa,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsFhB"}

package/dist/install/private.js

@@ -13,6 +13,7 @@ import { canonicalJson } from "../util/json.js";
 import { isErrno, pathExists, writeFileAtomic } from "../util/fsx.js";
 import { superviseChild } from "../util/proc.js";
 import { redactSecrets } from "../log.js";
+export const WORKSPACE_POLICY_FILE = "zyrk-workspace.json";
 function fail(message) {
     throw new ZyrkError("ZYRK_SCRIPT_BLOCKED", message, {
         remedy: "Review the exact candidate with zyrk approve-builds, then explicitly approve its package names. Mandatory denials cannot be overridden.",
@@ -93,16 +94,62 @@ export async function approveCandidate(options) {
     const selected = new Set(options.selected);
     const all = selected.has("*");
     for (const name of selected)
-        if (name !== "*" && !options.builds.some((b) => b.name === name))
+        if (name !== "*" &&
+            !options.builds.some((b) => b.name === name || b.sourceId === name))
             fail("An approval selector does not match a reviewed build candidate.");
     await writeFileAtomic(path.join(options.project, ".zyrk-local", "approvals.json"), JSON.stringify({
         schemaVersion: 1,
         candidate: options.digest,
         sources: options.builds
-            .filter((b) => all || selected.has(b.name))
+            .filter((b) => all || selected.has(b.name) || selected.has(b.sourceId))
             .map((b) => b.sourceId)
             .sort(),
     }), { mode: 0o600 });
+    if (options.portable) {
+        const selectedBuilds = options.builds.filter((build) => all || selected.has(build.name) || selected.has(build.sourceId));
+        await writePortableApprovals(options.project, selectedBuilds);
+    }
+}
+async function readPortableApprovals(project) {
+    const file = path.join(project, WORKSPACE_POLICY_FILE);
+    let raw;
+    try {
+        const stat = await lstat(file);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            fail("The workspace build-approval file must be a regular file.");
+        raw = JSON.parse(await readFile(file, "utf8"));
+    }
+    catch (cause) {
+        if (cause instanceof ZyrkError)
+            throw cause;
+        if (isErrno(cause, "ENOENT"))
+            return [];
+        fail("The workspace build-approval file is unreadable or malformed.");
+    }
+    if (!object(raw) ||
+        raw.schemaVersion !== 1 ||
+        !Array.isArray(raw.approvedBuilds) ||
+        raw.approvedBuilds.some((item) => !object(item) ||
+            typeof item.name !== "string" ||
+            typeof item.version !== "string" ||
+            typeof item.sourceId !== "string" ||
+            !/^src1_[a-f0-9]{40}$/.test(item.sourceId)))
+        fail("The workspace build-approval file has an unsupported format.");
+    return raw.approvedBuilds;
+}
+async function writePortableApprovals(project, selected) {
+    const current = await readPortableApprovals(project);
+    const bySource = new Map(current.map((item) => [item.sourceId, item]));
+    for (const build of selected)
+        bySource.set(build.sourceId, {
+            name: build.name,
+            version: build.version,
+            sourceId: build.sourceId,
+        });
+    await writeFileAtomic(path.join(project, WORKSPACE_POLICY_FILE), `${JSON.stringify({
+        schemaVersion: 1,
+        approvedBuilds: [...bySource.values()].sort((a, b) => a.name.localeCompare(b.name)),
+    }, null, 2)}\n`, { mode: 0o644 });
 }
 async function readUserPolicy(env) {
     let user = {};
@@ -117,9 +164,9 @@ async function readUserPolicy(env) {
         fail("Mandatory user build policy is malformed.");
     return user;
 }
-export async function assertApproved(options) {
+export async function approvedCandidates(options) {
     if (!options.builds.length)
-        return;
+        return [];
     const user = await readUserPolicy(options.env);
     let local;
     try {
@@ -133,19 +180,29 @@ export async function assertApproved(options) {
             throw cause;
         local = undefined;
     }
-    for (const build of options.builds) {
+    const portable = await readPortableApprovals(options.project);
+    return options.builds.filter((build) => {
         if (denied(user.scripts, build) || denied(options.policy, build))
-            fail(`Build of ${build.name}@${build.version} is denied by policy.`);
-        const portable = object(options.policy) &&
+            return false;
+        const manifestAllowed = object(options.policy) &&
             Array.isArray(options.policy.allow) &&
             options.policy.allow.includes(build.sourceId);
-        if (!portable &&
-            (!object(local) ||
-                local.schemaVersion !== 1 ||
-                local.candidate !== options.digest ||
-                !Array.isArray(local.sources) ||
-                !local.sources.includes(build.sourceId)))
-            fail(`Build of ${build.name}@${build.version} has not been approved for this exact candidate.`);
+        const workspaceAllowed = portable.some((approval) => approval.sourceId === build.sourceId);
+        const localAllowed = object(local) &&
+            local.schemaVersion === 1 &&
+            local.candidate === options.digest &&
+            Array.isArray(local.sources) &&
+            local.sources.includes(build.sourceId);
+        return manifestAllowed || workspaceAllowed || localAllowed;
+    });
+}
+export async function assertApproved(options) {
+    const approved = await approvedCandidates(options);
+    if (approved.length !== options.builds.length) {
+        const pending = options.builds.find((build) => !approved.some((item) => item.sourceId === build.sourceId));
+        fail(pending
+            ? `Build of ${pending.name}@${pending.version} has not been approved for this exact source.`
+            : "Not every dependency build candidate is approved.");
     }
 }
 export async function materializePrivate(options) {

package/dist/install/run.d.ts

@@ -43,6 +43,7 @@ export type InstallOptions = {
     env?: NodeJS.ProcessEnv;
     reviewBuilds?: boolean;
     approveBuilds?: readonly string[];
+    requestBuildApproval?: (builds: readonly BuildCandidate[]) => Promise<readonly string[]>;
     rebuild?: boolean;
     repair?: boolean;
     resolveBudget?: Partial<ResolverLimits>;

package/dist/install/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/install/run.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAK9D,OAAO,EAOL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAYtB,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AA+B3C,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EACD,UAAU,GACV,WAAW,GACX,UAAU,GACV,WAAW,GACX,UAAU,GACV,SAAS,GACT,UAAU,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,aAAa,GAAG,YAAY,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AACF,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACxC,aAAa,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1C,WAAW,CAAC,EAAE;QACZ,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,CAAC;AACF,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EACL,OAAO,GACP,uBAAuB,GACvB,eAAe,GACf,SAAS,GACT,cAAc,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;CAC3B,CAAC;AA4GF,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAuyBxB"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/install/run.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAK9D,OAAO,EAOL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAYtB,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AA+B3C,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EACD,UAAU,GACV,WAAW,GACX,UAAU,GACV,WAAW,GACX,UAAU,GACV,SAAS,GACT,UAAU,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,aAAa,GAAG,YAAY,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AACF,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,oBAAoB,CAAC,EAAE,CACrB,MAAM,EAAE,SAAS,cAAc,EAAE,KAC9B,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACxC,aAAa,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1C,WAAW,CAAC,EAAE;QACZ,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,CAAC;AACF,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EACL,OAAO,GACP,uBAAuB,GACvB,eAAe,GACf,SAAS,GACT,cAAc,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;CAC3B,CAAC;AA4GF,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAq0BxB"}

package/dist/install/run.js

@@ -4,7 +4,7 @@ import { findWorkspaceRoot } from "./workspaces.js";
 import { assertSupportedSourcePayload } from "./source-policy.js";
 import { prepareRepair } from "./repair.js";
 import { createFetchOperation } from "../fetch/package.js";
-import { candidates, candidateDigest, approveCandidate, assertApproved, materializePrivate, buildPrivate, } from "./private.js";
+import { candidates, candidateDigest, approveCandidate, approvedCandidates, materializePrivate, buildPrivate, } from "./private.js";
 import { loadProjectPatches, applyProjectPatches } from "../commands/patch.js";
 import { registerGeneration } from "./metadata.js";
 import { randomId } from "../util/ids.js";
@@ -556,6 +556,7 @@ export async function installProject(options) {
                     selected: options.approveBuilds,
                     env: options.env ?? process.env,
                     policy: scriptPolicy(manifest),
+                    portable: true,
                 });
             return {
                 readiness: "build-review",
@@ -566,15 +567,37 @@ export async function installProject(options) {
                 builds,
             };
         }
-        const unbuilt = builds.length > 0 && options.ignoreScripts === true;
+        let approvedBuilds = [];
         if (builds.length && !options.ignoreScripts) {
-            await assertApproved({
+            const approvalOptions = {
                 project,
                 env: options.env ?? process.env,
                 digest: reviewedDigest,
                 builds,
                 policy: scriptPolicy(manifest),
-            });
+            };
+            approvedBuilds = await approvedCandidates(approvalOptions);
+            if (approvedBuilds.length < builds.length &&
+                options.requestBuildApproval) {
+                const pending = builds.filter((build) => !approvedBuilds.some((item) => item.sourceId === build.sourceId));
+                const selected = await options.requestBuildApproval(pending);
+                if (selected.length) {
+                    await approveCandidate({
+                        project,
+                        digest: reviewedDigest,
+                        builds: pending,
+                        selected,
+                        env: options.env ?? process.env,
+                        policy: scriptPolicy(manifest),
+                        portable: true,
+                    });
+                    approvedBuilds = await approvedCandidates(approvalOptions);
+                }
+            }
+        }
+        const unbuilt = builds.length > 0 &&
+            (options.ignoreScripts === true || approvedBuilds.length < builds.length);
+        if (approvedBuilds.length && !options.ignoreScripts) {
             if (!privateGraph) {
                 realized = await materializePrivate({
                     project,
@@ -589,7 +612,7 @@ export async function installProject(options) {
                 project,
                 generationId,
                 nodes: activeNodes,
-                builds,
+                builds: approvedBuilds,
                 realized,
                 env: options.env ?? process.env,
             });
@@ -613,9 +636,10 @@ export async function installProject(options) {
                 privateGraph = true;
             }
         }
-        if (unbuilt)
-            for (const build of builds)
-                warnings.push(`${build.name}@${build.version}: skipped ${build.stages.map((s) => s.name).join(", ")}; intentionally unbuilt.`);
+        if (unbuilt) {
+            const skipped = builds.length - approvedBuilds.length;
+            warnings.push(`${skipped} dependency build ${skipped === 1 ? "script was" : "scripts were"} skipped because approval was not granted; readiness is intentionally unbuilt. Run zyrk approve-builds to review and approve sources.`);
+        }
         if (privateGraph)
             warnings.push("Using a complete project-private dependency graph; build/runtime writes do not change shared source.");
         const entries = selectedRoots.map((r) => ({

package/dist/install/workspace-install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-install.d.ts","sourceRoot":"","sources":["../../src/install/workspace-install.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAuH9D,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAqrBxB"}
+{"version":3,"file":"workspace-install.d.ts","sourceRoot":"","sources":["../../src/install/workspace-install.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAuH9D,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAqtBxB"}

package/dist/install/workspace-install.js

@@ -32,7 +32,7 @@ import { loadProjectPatches, applyProjectPatches } from "../commands/patch.js";
 import { prepareRepair } from "./repair.js";
 import { assertSupportedSourcePayload } from "./source-policy.js";
 import { registerGeneration } from "./metadata.js";
-import { candidates, candidateDigest, approveCandidate, assertApproved, buildPrivate, } from "./private.js";
+import { candidates, candidateDigest, approveCandidate, approvedCandidates, buildPrivate, } from "./private.js";
 const object = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 const unsupported = (message) => {
     throw new ZyrkError("ZYRK_NOT_IMPLEMENTED", message, {
@@ -444,6 +444,7 @@ export async function installWorkspaceProject(options) {
                     selected: options.approveBuilds,
                     env: options.env ?? process.env,
                     policy,
+                    portable: true,
                 });
             return {
                 readiness: "build-review",
@@ -454,14 +455,38 @@ export async function installWorkspaceProject(options) {
                 builds,
             };
         }
+        let approvedBuilds = [];
         if (builds.length && !options.ignoreScripts) {
-            await assertApproved({
+            const approvalOptions = {
                 project: root,
                 env: options.env ?? process.env,
                 digest,
                 builds,
                 policy,
-            });
+            };
+            approvedBuilds = await approvedCandidates(approvalOptions);
+            if (approvedBuilds.length < builds.length &&
+                options.requestBuildApproval) {
+                const pending = builds.filter((build) => !approvedBuilds.some((item) => item.sourceId === build.sourceId));
+                const selected = await options.requestBuildApproval(pending);
+                if (selected.length) {
+                    await approveCandidate({
+                        project: root,
+                        digest,
+                        builds: pending,
+                        selected,
+                        env: options.env ?? process.env,
+                        policy,
+                        portable: true,
+                    });
+                    approvedBuilds = await approvedCandidates(approvalOptions);
+                }
+            }
+        }
+        const skippedBuilds = builds.length - approvedBuilds.length;
+        if (skippedBuilds > 0)
+            warnings.push(`${skippedBuilds} dependency build ${skippedBuilds === 1 ? "script was" : "scripts were"} skipped because approval was not granted; readiness is intentionally unbuilt. Run zyrk approve-builds to review and approve sources.`);
+        if (approvedBuilds.length && !options.ignoreScripts) {
             // Approved writes need a coherent fully private registry closure.
             await allocatePrivate(new Set(nodes.map((n) => n.key)));
             options.onProgress?.({ phase: "building" });
@@ -469,12 +494,12 @@ export async function installWorkspaceProject(options) {
                 project: root,
                 generationId,
                 nodes,
-                builds,
+                builds: approvedBuilds,
                 realized,
                 env: options.env ?? process.env,
             });
         }
-        const readiness = builds.length && options.ignoreScripts
+        const readiness = builds.length && (options.ignoreScripts || skippedBuilds > 0)
             ? "intentionally-unbuilt"
             : "ready";
         registration = await registerGeneration({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zyrk",
-  "version": "0.6.9",
+  "version": "0.7.0",
   "description": "Storage-efficient Node package manager: one verified store per user, shared across projects through links.",
   "license": "MIT",
   "type": "module",